Skip to content

Commit 76a6368

Browse files
lucianozablockilucianozablocki
committed
address PR comments
Signed-off-by: Luciano <[email protected]>
1 parent efcb6c2 commit 76a6368

File tree

13 files changed

+136
-231
lines changed

13 files changed

+136
-231
lines changed

‎k8s/k8s-workload-registrar/README.md

Lines changed: 124 additions & 144 deletions
Large diffs are not rendered by default.

‎k8s/k8s-workload-registrar/mode-crd/k8s/spire-agent.yaml

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
# ServiceAccount for the SPIRE agent
21
apiVersion: v1
32
kind: ServiceAccount
43
metadata:
@@ -7,7 +6,6 @@ metadata:
76

87
---
98

10-
# Required cluster role to allow spire-agent to query k8s API server
119
kind: ClusterRole
1210
apiVersion: rbac.authorization.k8s.io/v1
1311
metadata:
@@ -19,7 +17,6 @@ rules:
1917

2018
---
2119

22-
# Binds above cluster role to spire-agent service account
2320
kind: ClusterRoleBinding
2421
apiVersion: rbac.authorization.k8s.io/v1
2522
metadata:
@@ -55,7 +52,7 @@ data:
5552
plugins {
5653
NodeAttestor "k8s_psat" {
5754
plugin_data {
58-
cluster = "example-cluster"
55+
cluster = "demo-cluster"
5956
}
6057
}
6158
@@ -106,7 +103,6 @@ spec:
106103
annotations:
107104
spiffe.io/spiffe-id: "testing/agent"
108105
spec:
109-
# hostPID is required for K8S Workload Attestation.
110106
hostPID: true
111107
hostNetwork: true
112108
dnsPolicy: ClusterFirstWithHostNet

‎k8s/k8s-workload-registrar/mode-crd/k8s/spire-server.yaml

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,6 @@ kind: ClusterRole
1212
metadata:
1313
name: k8s-workload-registrar-role
1414
rules:
15-
# allow TokenReview requests (to verify service account tokens for PSAT
16-
# attestation)
1715
- apiGroups: ["authentication.k8s.io"]
1816
resources: ["tokenreviews"]
1917
verbs: ["get", "create"]
@@ -47,28 +45,22 @@ subjects:
4745

4846
---
4947

50-
# Role for the SPIRE server
5148
kind: Role
5249
apiVersion: rbac.authorization.k8s.io/v1
5350
metadata:
5451
namespace: spire
5552
name: spire-server-role
5653
rules:
57-
# allow "get" access to pods (to resolve selectors for PSAT attestation)
5854
- apiGroups: [""]
5955
resources: ["pods"]
6056
verbs: ["get"]
61-
# allow access to "get" and "patch" the spire-bundle ConfigMap (for SPIRE
62-
# agent bootstrapping, see the spire-bundle ConfigMap below)
6357
- apiGroups: [""]
6458
resources: ["configmaps"]
6559
resourceNames: ["spire-bundle"]
6660
verbs: ["get", "patch"]
6761

6862
---
6963

70-
# RoleBinding granting the spire-server-role to the SPIRE server
71-
# service account.
7264
kind: RoleBinding
7365
apiVersion: rbac.authorization.k8s.io/v1
7466
metadata:
@@ -93,7 +85,6 @@ metadata:
9385

9486
---
9587

96-
# ConfigMap containing the SPIRE server configuration.
9788
apiVersion: v1
9889
kind: ConfigMap
9990
metadata:
@@ -128,7 +119,7 @@ data:
128119
NodeAttestor "k8s_psat" {
129120
plugin_data {
130121
clusters = {
131-
"example-cluster" = {
122+
"demo-cluster" = {
132123
service_account_whitelist = ["spire:spire-agent"]
133124
}
134125
}
@@ -168,7 +159,7 @@ data:
168159
k8s-workload-registrar.conf: |
169160
trust_domain = "example.org"
170161
server_socket_path = "/tmp/spire-server/private/api.sock"
171-
cluster = "example-cluster"
162+
cluster = "demo-cluster"
172163
mode = "crd"
173164
pod_annotation = "spiffe.io/spiffe-id"
174165
metrics_bind_addr = "0"
@@ -251,7 +242,6 @@ spec:
251242

252243
---
253244

254-
# Service definition for SPIRE server defining the gRPC port.
255245
apiVersion: v1
256246
kind: Service
257247
metadata:

‎k8s/k8s-workload-registrar/mode-crd/test.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ trap cleanup EXIT
2424
cleanup
2525
set_env
2626

27-
NODE_SPIFFE_ID="spiffe://example.org/k8s-workload-registrar/example-cluster/node/"
27+
NODE_SPIFFE_ID="spiffe://example.org/k8s-workload-registrar/demo-cluster/node/"
2828
AGENT_SPIFFE_ID="spiffe://example.org/testing/agent"
2929
WORKLOAD_SPIFFE_ID="spiffe://example.org/testing/example-workload"
3030

‎k8s/k8s-workload-registrar/mode-reconcile/k8s/spire-agent.yaml

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
# ServiceAccount for the SPIRE agent
21
apiVersion: v1
32
kind: ServiceAccount
43
metadata:
@@ -7,7 +6,6 @@ metadata:
76

87
---
98

10-
# Required cluster role to allow spire-agent to query k8s API server
119
kind: ClusterRole
1210
apiVersion: rbac.authorization.k8s.io/v1
1311
metadata:
@@ -19,7 +17,6 @@ rules:
1917

2018
---
2119

22-
# Binds above cluster role to spire-agent service account
2320
kind: ClusterRoleBinding
2421
apiVersion: rbac.authorization.k8s.io/v1
2522
metadata:
@@ -36,9 +33,6 @@ roleRef:
3633

3734
---
3835

39-
# ConfigMap for the SPIRE agent featuring:
40-
# 1) PSAT node attestation
41-
# 2) K8S Workload Attestation over the secure kubelet port
4236
apiVersion: v1
4337
kind: ConfigMap
4438
metadata:
@@ -59,7 +53,7 @@ data:
5953
plugins {
6054
NodeAttestor "k8s_psat" {
6155
plugin_data {
62-
cluster = "example-cluster"
56+
cluster = "demo-cluster"
6357
}
6458
}
6559
@@ -108,7 +102,6 @@ spec:
108102
app: spire-agent
109103
spire-workload: agent
110104
spec:
111-
# hostPID is required for K8S Workload Attestation.
112105
hostPID: true
113106
hostNetwork: true
114107
dnsPolicy: ClusterFirstWithHostNet

‎k8s/k8s-workload-registrar/mode-reconcile/k8s/spire-server.yaml

Lines changed: 2 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
# ServiceAccount used by the SPIRE server.
21
apiVersion: v1
32
kind: ServiceAccount
43
metadata:
@@ -7,7 +6,6 @@ metadata:
76

87
---
98

10-
# Required cluster role to allow spire-server to query k8s API server
119
kind: ClusterRole
1210
apiVersion: rbac.authorization.k8s.io/v1
1311
metadata:
@@ -16,15 +14,12 @@ rules:
1614
- apiGroups: [""]
1715
resources: ["pods", "nodes"]
1816
verbs: ["get", "list", "watch"]
19-
# allow TokenReview requests (to verify service account tokens for PSAT
20-
# attestation)
2117
- apiGroups: ["authentication.k8s.io"]
2218
resources: ["tokenreviews"]
2319
verbs: ["get", "create"]
2420

2521
---
2622

27-
# Binds above cluster role to spire-server service account
2823
kind: ClusterRoleBinding
2924
apiVersion: rbac.authorization.k8s.io/v1
3025
metadata:
@@ -41,19 +36,15 @@ roleRef:
4136

4237
---
4338

44-
# Role for the SPIRE server
4539
kind: Role
4640
apiVersion: rbac.authorization.k8s.io/v1
4741
metadata:
4842
namespace: spire
4943
name: spire-server-role
5044
rules:
51-
# allow "get" access to pods (to resolve selectors for PSAT attestation)
5245
- apiGroups: [""]
5346
resources: ["pods"]
5447
verbs: ["get"]
55-
# allow access to "get" and "patch" the spire-bundle ConfigMap (for SPIRE
56-
# agent bootstrapping, see the spire-bundle ConfigMap below)
5748
- apiGroups: [""]
5849
resources: ["configmaps"]
5950
resourceNames: ["spire-bundle"]
@@ -71,8 +62,6 @@ rules:
7162

7263
---
7364

74-
# RoleBinding granting the spire-server-role to the SPIRE server
75-
# service account.
7665
kind: RoleBinding
7766
apiVersion: rbac.authorization.k8s.io/v1
7867
metadata:
@@ -89,10 +78,6 @@ roleRef:
8978

9079
---
9180

92-
# ConfigMap containing the latest trust bundle for the trust domain. It is
93-
# updated by SPIRE using the k8sbundle notifier plugin. SPIRE agents mount
94-
# this config map and use the certificate to bootstrap trust with the SPIRE
95-
# server during attestation.
9681
apiVersion: v1
9782
kind: ConfigMap
9883
metadata:
@@ -101,7 +86,6 @@ metadata:
10186

10287
---
10388

104-
# ConfigMap containing the SPIRE server configuration.
10589
apiVersion: v1
10690
kind: ConfigMap
10791
metadata:
@@ -136,7 +120,7 @@ data:
136120
NodeAttestor "k8s_psat" {
137121
plugin_data {
138122
clusters = {
139-
"example-cluster" = {
123+
"demo-cluster" = {
140124
service_account_whitelist = ["spire:spire-agent"]
141125
}
142126
}
@@ -176,17 +160,14 @@ data:
176160
k8s-workload-registrar.conf: |
177161
trust_domain = "example.org"
178162
server_socket_path = "/tmp/spire-server/private/api.sock"
179-
cluster = "example-cluster"
163+
cluster = "demo-cluster"
180164
mode = "reconcile"
181165
pod_label = "spire-workload"
182166
metrics_addr = "0"
183167
controller_name = "k8s-workload-registrar"
184168
185169
---
186170

187-
# This is the Deployment for the SPIRE server. It waits for SPIRE database to
188-
# initialize and uses the SPIRE healthcheck command for liveness/readiness
189-
# probes.
190171
apiVersion: apps/v1
191172
kind: StatefulSet
192173
metadata:
@@ -262,7 +243,6 @@ spec:
262243

263244
---
264245

265-
# Service definition for SPIRE server defining the gRPC port.
266246
apiVersion: v1
267247
kind: Service
268248
metadata:

‎k8s/k8s-workload-registrar/mode-reconcile/test.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ trap cleanup EXIT
2222
cleanup
2323
set_env
2424

25-
NODE_SPIFFE_ID="spiffe://example.org/k8s-workload-registrar/example-cluster/node/"
25+
NODE_SPIFFE_ID="spiffe://example.org/k8s-workload-registrar/demo-cluster/node/"
2626
AGENT_SPIFFE_ID="spiffe://example.org/agent"
2727
WORKLOAD_SPIFFE_ID="spiffe://example.org/example-workload"
2828

‎k8s/k8s-workload-registrar/mode-webhook/k8s/admctrl/kubeconfig.yaml

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
# KubeConfig with client credentials for the API Server to use to call the
2-
# K8S Workload Registrar service
31
apiVersion: v1
42
kind: Config
53
users:

‎k8s/k8s-workload-registrar/mode-webhook/k8s/k8s-workload-registrar-secret.yaml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
# Kubernetes Secret containing the K8S Workload Registrar server key
21
apiVersion: v1
32
kind: Secret
43
metadata:

‎k8s/k8s-workload-registrar/mode-webhook/k8s/spire-agent.yaml

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
# ServiceAccount for the SPIRE agent
21
apiVersion: v1
32
kind: ServiceAccount
43
metadata:
@@ -7,7 +6,6 @@ metadata:
76

87
---
98

10-
# Required cluster role to allow spire-agent to query k8s API server
119
kind: ClusterRole
1210
apiVersion: rbac.authorization.k8s.io/v1
1311
metadata:
@@ -19,7 +17,6 @@ rules:
1917

2018
---
2119

22-
# Binds above cluster role to spire-agent service account
2320
kind: ClusterRoleBinding
2421
apiVersion: rbac.authorization.k8s.io/v1
2522
metadata:
@@ -35,9 +32,6 @@ roleRef:
3532

3633
---
3734

38-
# ConfigMap for the SPIRE agent featuring:
39-
# 1) PSAT node attestation
40-
# 2) K8S Workload Attestation over the secure kubelet port
4135
apiVersion: v1
4236
kind: ConfigMap
4337
metadata:
@@ -58,7 +52,7 @@ data:
5852
plugins {
5953
NodeAttestor "k8s_psat" {
6054
plugin_data {
61-
cluster = "example-cluster"
55+
cluster = "demo-cluster"
6256
}
6357
}
6458
@@ -109,7 +103,6 @@ spec:
109103
annotations:
110104
spiffe.io/spiffe-id: "testing/agent"
111105
spec:
112-
# hostPID is required for K8S Workload Attestation.
113106
hostPID: true
114107
hostNetwork: true
115108
dnsPolicy: ClusterFirstWithHostNet

0 commit comments

Comments
 (0)