-
Notifications
You must be signed in to change notification settings - Fork 33
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Add support for SPIRE deployment on OpenShift 4.13 Signed-off-by: Mariusz Sabath <[email protected]> Co-authored-by: Trilok Geer <[email protected]> Co-authored-by: Andrew Block <[email protected]> * Render README Signed-off-by: Mariusz Sabath <[email protected]> * Fix tornjak HTTP/HTTPS port values Signed-off-by: Mariusz Sabath <[email protected]> * Update Frontend README Signed-off-by: Mariusz Sabath <[email protected]> * Add env. variable to Agent to inject node name Signed-off-by: Mariusz Sabath <[email protected]> * Implement Marco's suggestion on CSI CSS version Signed-off-by: Mariusz Sabath <[email protected]> * Add MY_NODE_NAME env. variable to agent for openshift example Signed-off-by: Mariusz Sabath <[email protected]> * Move Openshift examples to dedicated directory Signed-off-by: Mariusz Sabath <[email protected]> * Simplified the install instructions Signed-off-by: Mariusz Sabath <[email protected]> * Suggested changes Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Andrew Block <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Update docs, fix default for backwards compat Signed-off-by: Kevin Fox <[email protected]> * Don't recommend experimental features by default, dont debug helm install by default and explain how to add additional features Signed-off-by: Kevin Fox <[email protected]> * Add notes about openshift to the project for other reviewers. Signed-off-by: Kevin Fox <[email protected]> * Fix incorrectly reverted change Signed-off-by: Kevin Fox <[email protected]> * Correct notes Signed-off-by: Kevin Fox <[email protected]> * Update default Signed-off-by: Kevin Fox <[email protected]> * Fix issue created from bad merge conflict resolution Signed-off-by: kfox1111 <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> --------- Signed-off-by: Mariusz Sabath <[email protected]> Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Trilok Geer <[email protected]> Co-authored-by: Andrew Block <[email protected]> Co-authored-by: Kevin Fox <[email protected]>
- Loading branch information
4 people
authored
Oct 31, 2023
1 parent
ed23d8b
commit 3b01684
Showing
18 changed files
with
432 additions
and
40 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
61 changes: 61 additions & 0 deletions
61
charts/spire/charts/spiffe-csi-driver/templates/scc-restricted-csi.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| {{- if and .Values.global.openshift .Values.restrictedScc.enabled }} | ||
| {{- $name := default (printf "restricted-%scsi" (eq (.Values.restrictedScc.version | toString) "2" | ternary "v2-" "")) .Values.restrictedScc.name -}} | ||
| {{- $v2Description := "This is the most restrictive SCC and it is used by default for authenticated users. On top of the legacy 'restricted' SCC, it also requires to drop ALL capabilities and does not allow privilege escalation binaries. It will also default the seccomp profile to runtime/default if unset, otherwise this seccomp profile is required." -}} | ||
| apiVersion: security.openshift.io/v1 | ||
| kind: SecurityContextConstraints | ||
| allowHostPorts: false | ||
| priority: null | ||
| requiredDropCapabilities: | ||
| {{- if eq (.Values.restrictedScc.version | toString) "2" }} | ||
| - ALL | ||
| {{- else }} | ||
| - KILL | ||
| - MKNOD | ||
| - SETUID | ||
| - SETGID | ||
| {{- end }} | ||
| allowPrivilegedContainer: false | ||
| runAsUser: | ||
| type: MustRunAsRange | ||
| users: [] | ||
| allowHostDirVolumePlugin: false | ||
| {{- if eq (.Values.restrictedScc.version | toString) "2" }} | ||
| seccompProfiles: | ||
| - runtime/default | ||
| {{- end }} | ||
| allowHostIPC: false | ||
| seLinuxContext: | ||
| type: MustRunAs | ||
| readOnlyRootFilesystem: false | ||
| metadata: | ||
| name: {{ $name }} | ||
| annotations: | ||
| kubernetes.io/description: >- | ||
| {{ $name }} denies access to all host features and requires pods to be | ||
| run with a UID, and SELinux context that are allocated to the namespace. | ||
| {{ eq (.Values.restrictedScc.version | toString) "2" | ternary $v2Description "" }} | ||
| fsGroup: | ||
| type: MustRunAs | ||
| groups: [] | ||
| defaultAddCapabilities: null | ||
| supplementalGroups: | ||
| type: RunAsAny | ||
| volumes: | ||
| - configMap | ||
| - csi | ||
| - downwardAPI | ||
| - emptyDir | ||
| - ephemeral | ||
| - persistentVolumeClaim | ||
| - projected | ||
| - secret | ||
| allowHostPID: false | ||
| allowHostNetwork: false | ||
| allowPrivilegeEscalation: {{ eq (.Values.restrictedScc.version | toString) "2" | ternary false true }} | ||
| {{- if eq (.Values.restrictedScc.version | toString) "2" }} | ||
| allowedCapabilities: | ||
| - NET_BIND_SERVICE | ||
| {{ else}} | ||
| allowedCapabilities: null | ||
| {{- end }} | ||
| {{- end }} |
30 changes: 30 additions & 0 deletions
30
charts/spire/charts/spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| {{- if eq (.Values.global.openshift | toString) "true" }} | ||
| apiVersion: security.openshift.io/v1 | ||
| kind: SecurityContextConstraints | ||
| metadata: | ||
| name: {{ include "spiffe-csi-driver.fullname" . }} | ||
| readOnlyRootFilesystem: true | ||
| runAsUser: | ||
| type: RunAsAny | ||
| seLinuxContext: | ||
| type: RunAsAny | ||
| supplementalGroups: | ||
| type: RunAsAny | ||
| users: | ||
| - system:serviceaccount:{{ include "spiffe-csi-driver.namespace" . }}:{{ include "spiffe-csi-driver.serviceAccountName" . }} | ||
| volumes: | ||
| - configmap | ||
| - hostPath | ||
| - secret | ||
| allowHostDirVolumePlugin: true | ||
| allowHostIPC: false | ||
| allowHostNetwork: false | ||
| allowHostPID: false | ||
| allowHostPorts: false | ||
| allowPrivilegeEscalation: true | ||
| allowPrivilegedContainer: true | ||
| fsGroup: | ||
| type: RunAsAny | ||
| groups: [] | ||
|
|
||
| {{ end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
38 changes: 38 additions & 0 deletions
38
...re/charts/spiffe-oidc-discovery-provider/templates/scc-spire-oidc-discovery-provider.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| {{- if eq (.Values.global.openshift | toString) "true" }} | ||
| apiVersion: security.openshift.io/v1 | ||
| kind: SecurityContextConstraints | ||
| metadata: | ||
| name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} | ||
| readOnlyRootFilesystem: true | ||
| runAsUser: | ||
| type: RunAsAny | ||
| seLinuxContext: | ||
| type: RunAsAny | ||
| supplementalGroups: | ||
| type: RunAsAny | ||
| users: | ||
| - system:serviceaccount:{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }} | ||
| - system:serviceaccount:{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete | ||
| volumes: | ||
| - configMap | ||
| - hostPath | ||
| - projected | ||
| - secret | ||
| - ephemeral | ||
| - downwardAPI | ||
| - csi | ||
| - emptyDir | ||
| allowHostDirVolumePlugin: true | ||
| allowHostIPC: true | ||
| allowHostNetwork: true | ||
| allowHostPID: true | ||
| allowHostPorts: true | ||
| allowPrivilegeEscalation: true | ||
| allowPrivilegedContainer: true | ||
| fsGroup: | ||
| type: RunAsAny | ||
| groups: [] | ||
| seccompProfiles: | ||
| - '*' | ||
|
|
||
| {{ end }} |
Oops, something went wrong.