Skip to content

Commit 4d5b8b4

Browse files
tellieretelliere
committed
first k8s plan for hpcs
1 parent 9a21fa9 commit 4d5b8b4

16 files changed

+457
-4
lines changed

‎k8s/hpcs-namespace.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: hpcs

‎k8s/hpcs-server-account.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: hpcs-server
5+
namespace: hpcs

‎k8s/hpcs-server-configmap.yaml

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: hpcs-server
5+
namespace: hpcs
6+
data:
7+
hpcs-server.conf: |
8+
[spire-server]
9+
address = localhost
10+
port = 8081
11+
trust-domain = hpcs
12+
pre-command = ""
13+
spire-server-bin = spire-server
14+
socket-path = /var/run/sockets/server/api.sock
15+
16+
[spire-agent]
17+
spire-agent-socket = /run/sockets/agent/agent.sock
18+
19+
[vault]
20+
url = http://vault:8200
21+
server-role = hpcs-server
22+
23+
agent.conf: |
24+
agent {
25+
data_dir = "./data/agent"
26+
log_level = "DEBUG"
27+
trust_domain = "hpcs"
28+
server_address = "spire-server"
29+
server_port = 8081
30+
socket_path = "/var/run/sockets/agent/agent.sock"
31+
admin_socket_path = "/var/run/sockets/admin/admin.sock"
32+
33+
# Insecure bootstrap is NOT appropriate for production use but is ok for
34+
# simple testing/evaluation purposes.
35+
insecure_bootstrap = true
36+
}
37+
38+
plugins {
39+
KeyManager "disk" {
40+
plugin_data {
41+
directory = "./data/agent"
42+
}
43+
}
44+
45+
NodeAttestor "k8s_psat" {
46+
plugin_data {
47+
cluster = "docker-desktop"
48+
}
49+
}
50+
51+
WorkloadAttestor "k8s" {
52+
plugin_data {
53+
}
54+
}
55+
56+
WorkloadAttestor "unix" {
57+
plugin_data {
58+
discover_workload_path = true
59+
}
60+
}
61+
}

‎k8s/hpcs-server-service.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Service definition for spire-oidc (expose the OIDC socket)
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: hpcs-server
6+
namespace: hpcs
7+
spec:
8+
clusterIP: None
9+
selector:
10+
app: hpcs-server
11+
ports:
12+
- name: https
13+
port: 10080
14+
targetPort: hpcs-server

‎k8s/hpcs-server-statefulset.yaml

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
apiVersion: apps/v1
2+
kind: StatefulSet
3+
metadata:
4+
name: hpcs-server
5+
namespace: hpcs
6+
labels:
7+
app: hpcs-server
8+
spec:
9+
replicas: 1
10+
selector:
11+
matchLabels:
12+
app: hpcs-server
13+
serviceName: hpcs-server
14+
template:
15+
metadata:
16+
namespace: hpcs
17+
labels:
18+
app: hpcs-server
19+
spec:
20+
serviceAccountName: hpcs-server
21+
shareProcessNamespace: true
22+
containers:
23+
- name: hpcs-server
24+
image: ghcr.io/cscfi/hpcs/server:k8s_plan
25+
ports:
26+
- containerPort: 10080
27+
name: hpcs-server
28+
volumeMounts:
29+
- name: hpcs-server-configs
30+
mountPath: /tmp/
31+
readOnly: false
32+
- name: hpcs-spire-sockets
33+
mountPath: /var/run/sockets
34+
readOnly: false
35+
- name: hpcs-spire-agent-token
36+
mountPath: /var/run/secrets/tokens
37+
readOnly: true
38+
volumes:
39+
- name: hpcs-server-configs
40+
configMap:
41+
name: hpcs-server
42+
- name: hpcs-spire-sockets
43+
hostPath:
44+
path: /run/spire/sockets
45+
type: DirectoryOrCreate
46+
- name: hpcs-spire-agent-token
47+
projected:
48+
sources:
49+
- serviceAccountToken:
50+
path: spire-agent
51+
expirationSeconds: 7200
52+
audience: spire-server
53+
volumeClaimTemplates:
54+
- metadata:
55+
name: spire-agent-data
56+
namespace: hpcs
57+
spec:
58+
accessModes:
59+
- ReadWriteOnce
60+
resources:
61+
requests:
62+
storage: 1Gi

‎k8s/hpcs-spire-account.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: hpcs-spire
5+
namespace: hpcs

‎k8s/spire-oidc-configmap.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: spire-oidc
5+
namespace: hpcs
6+
data:
7+
oidc-discovery-provider.conf: |
8+
log_level = "debug"
9+
domains = ["spire-oidc"]
10+
listen_socket_path = "/tmp/spire-server/private/oidc-api.sock"
11+
12+
server_api {
13+
address = "unix:///tmp/spire-server/private/api.sock"
14+
}
15+
16+
health_checks {}

‎k8s/spire-oidc-service.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Service definition for spire-oidc (expose the OIDC socket)
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: spire-oidc
6+
namespace: hpcs
7+
spec:
8+
type: LoadBalancer
9+
selector:
10+
app: spire-server
11+
ports:
12+
- name: https
13+
port: 443
14+
targetPort: hpcs-nginx

‎k8s/spire-server-account.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: spire-server
5+
namespace: hpcs

‎k8s/spire-server-cluster-role.yaml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# ClusterRole to allow spire-server node attestor to query Token Review API
2+
# and to be able to push certificate bundles to a configmap
3+
kind: ClusterRole
4+
apiVersion: rbac.authorization.k8s.io/v1
5+
metadata:
6+
name: spire-server-trust-role
7+
rules:
8+
- apiGroups: ["authentication.k8s.io"]
9+
resources: ["tokenreviews"]
10+
verbs: ["create"]
11+
- apiGroups: [""]
12+
resources: ["configmaps","pods","nodes"]
13+
verbs: ["patch", "get", "list"]
14+
15+
---
16+
# Binds above cluster role to spire-server service account
17+
kind: ClusterRoleBinding
18+
apiVersion: rbac.authorization.k8s.io/v1
19+
metadata:
20+
name: spire-server-trust-role-binding
21+
subjects:
22+
- kind: ServiceAccount
23+
name: spire-server
24+
namespace: hpcs
25+
roleRef:
26+
kind: ClusterRole
27+
name: spire-server-trust-role
28+
apiGroup: rbac.authorization.k8s.io

‎k8s/spire-server-configmap.yaml

+73
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
apiVersion: v1
2+
3+
kind: ConfigMap
4+
metadata:
5+
name: spire-bundle
6+
namespace: hpcs
7+
8+
---
9+
apiVersion: v1
10+
kind: ConfigMap
11+
metadata:
12+
name: spire-server
13+
namespace: hpcs
14+
data:
15+
server.conf: |
16+
server {
17+
bind_address = "0.0.0.0"
18+
bind_port = "8081"
19+
socket_path = "/tmp/spire-server/private/api.sock"
20+
trust_domain = "hpcs"
21+
data_dir = "/run/spire/data"
22+
log_level = "DEBUG"
23+
ca_key_type = "rsa-2048"
24+
25+
jwt_issuer = "spire-server"
26+
default_jwt_svid_ttl = "1h"
27+
28+
ca_subject = {
29+
country = ["US"],
30+
organization = ["SPIFFE"],
31+
common_name = "",
32+
}
33+
}
34+
35+
plugins {
36+
DataStore "sql" {
37+
plugin_data {
38+
database_type = "sqlite3"
39+
connection_string = "/run/spire/data/datastore.sqlite3"
40+
}
41+
}
42+
43+
NodeAttestor "k8s_psat" {
44+
plugin_data {
45+
clusters = {
46+
"docker-desktop" = {
47+
use_token_review_api_validation = true
48+
service_account_allow_list = ["hpcs:hpcs-server"]
49+
}
50+
}
51+
}
52+
}
53+
54+
KeyManager "disk" {
55+
plugin_data {
56+
keys_path = "/run/spire/data/keys.json"
57+
}
58+
}
59+
60+
Notifier "k8sbundle" {
61+
plugin_data {
62+
namespace = "hpcs"
63+
}
64+
}
65+
}
66+
67+
health_checks {
68+
listener_enabled = true
69+
bind_address = "0.0.0.0"
70+
bind_port = "8080"
71+
live_path = "/live"
72+
ready_path = "/ready"
73+
}

‎k8s/spire-server-nginx-configmap.yaml

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: hpcs-nginx
5+
namespace: hpcs
6+
data:
7+
nginx.conf: |
8+
events {}
9+
http {
10+
access_log /tmp/access.log;
11+
error_log /tmp/error.log;
12+
13+
upstream spire-oidc {
14+
server unix:/tmp/spire-server/private/oidc-api.sock;
15+
}
16+
17+
server{
18+
listen 443 ssl;
19+
ssl_certificate /certs/selfsigned.crt;
20+
ssl_certificate_key /certs/selfsigned.key;
21+
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
22+
ssl_ciphers HIGH:!aNULL:!MD5;
23+
location / {
24+
proxy_pass http://spire-oidc;
25+
}
26+
}
27+
}

‎k8s/spire-server-service.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Service definition for spire server
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: spire-server
6+
namespace: hpcs
7+
spec:
8+
type: LoadBalancer
9+
selector:
10+
app: spire-server
11+
ports:
12+
- name: tcp-spire
13+
port: 8081
14+
targetPort: spire-server

0 commit comments

Comments
 (0)