Skip to content

Commit 6efb800

Browse files
tellieretelliere
committed
temp commit
1 parent e859010 commit 6efb800

8 files changed

+279
-0
lines changed

‎k8s/hpcs-nginx-service.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Service definition for the admission webhook
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: hpcs-nginx
6+
namespace: spire
7+
spec:
8+
type: LoadBalancer
9+
selector:
10+
app: spire-server
11+
ports:
12+
- name: https
13+
port: 443
14+
targetPort: hpcs-nginx

‎k8s/nginx-configmap.yaml

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: hpcs-nginx
5+
namespace: spire
6+
data:
7+
nginx.conf: |
8+
events {}
9+
http {
10+
access_log /tmp/access.log;
11+
error_log /tmp/error.log;
12+
server {
13+
listen 443 ssl;
14+
server_name localhost;
15+
ssl_certificate /certs/selfsigned.crt;
16+
ssl_certificate_key /certs/selfsigned.key;
17+
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
18+
ssl_ciphers HIGH:!aNULL:!MD5;
19+
location / {
20+
proxy_pass http://unix:/run/server.sock ;
21+
}
22+
}
23+
}

‎k8s/server-account.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: spire-server
5+
namespace: spire

‎k8s/server-cluster-role.yaml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# ClusterRole to allow spire-server node attestor to query Token Review API
2+
# and to be able to push certificate bundles to a configmap
3+
kind: ClusterRole
4+
apiVersion: rbac.authorization.k8s.io/v1
5+
metadata:
6+
name: spire-server-trust-role
7+
rules:
8+
- apiGroups: ["authentication.k8s.io"]
9+
resources: ["tokenreviews"]
10+
verbs: ["create"]
11+
- apiGroups: [""]
12+
resources: ["configmaps"]
13+
verbs: ["patch", "get", "list"]
14+
15+
---
16+
# Binds above cluster role to spire-server service account
17+
kind: ClusterRoleBinding
18+
apiVersion: rbac.authorization.k8s.io/v1
19+
metadata:
20+
name: spire-server-trust-role-binding
21+
subjects:
22+
- kind: ServiceAccount
23+
name: spire-server
24+
namespace: spire
25+
roleRef:
26+
kind: ClusterRole
27+
name: spire-server-trust-role
28+
apiGroup: rbac.authorization.k8s.io

‎k8s/server-configmap.yaml

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
apiVersion: v1
2+
3+
kind: ConfigMap
4+
metadata:
5+
name: spire-bundle
6+
namespace: spire
7+
8+
---
9+
apiVersion: v1
10+
kind: ConfigMap
11+
metadata:
12+
name: spire-server
13+
namespace: spire
14+
data:
15+
server.conf: |
16+
server {
17+
bind_address = "0.0.0.0"
18+
bind_port = "8081"
19+
socket_path = "/tmp/spire-server/private/api.sock"
20+
trust_domain = "lumi-hpcs"
21+
data_dir = "/run/spire/data"
22+
log_level = "DEBUG"
23+
ca_key_type = "rsa-2048"
24+
25+
jwt_issuer = "spire-server"
26+
default_jwt_svid_ttl = "1h"
27+
28+
ca_subject = {
29+
country = ["US"],
30+
organization = ["SPIFFE"],
31+
common_name = "",
32+
}
33+
}
34+
35+
plugins {
36+
DataStore "sql" {
37+
plugin_data {
38+
database_type = "sqlite3"
39+
connection_string = "/run/spire/data/datastore.sqlite3"
40+
}
41+
}
42+
43+
NodeAttestor "k8s_sat" {
44+
plugin_data {
45+
clusters = {
46+
"cluster" = {
47+
use_token_review_api_validation = true
48+
service_account_allow_list = ["spire:spire-agent"]
49+
}
50+
}
51+
}
52+
}
53+
54+
KeyManager "disk" {
55+
plugin_data {
56+
keys_path = "/run/spire/data/keys.json"
57+
}
58+
}
59+
60+
Notifier "k8sbundle" {
61+
plugin_data {
62+
}
63+
}
64+
}
65+
66+
health_checks {
67+
listener_enabled = true
68+
bind_address = "0.0.0.0"
69+
bind_port = "8080"
70+
live_path = "/live"
71+
ready_path = "/ready"
72+
}

‎k8s/server-statefulset.yaml

+119
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
apiVersion: apps/v1
2+
kind: StatefulSet
3+
metadata:
4+
name: spire-server
5+
namespace: spire
6+
labels:
7+
app: spire-server
8+
spec:
9+
replicas: 1
10+
selector:
11+
matchLabels:
12+
app: spire-server
13+
serviceName: spire-server
14+
template:
15+
metadata:
16+
namespace: spire
17+
labels:
18+
app: spire-server
19+
spec:
20+
serviceAccountName: spire-server
21+
shareProcessNamespace: true
22+
containers:
23+
- name: hpcs-nginx
24+
image: nginx
25+
ports:
26+
- containerPort: 443
27+
name: hpcs-nginx
28+
volumeMounts:
29+
- name: nginx-config
30+
mountPath: /etc/nginx/
31+
readOnly: true
32+
- name: spire-server-socket
33+
mountPath: /tmp/spire-server/private
34+
readOnly: false
35+
- name: nginx-certs
36+
mountPath: /certs
37+
readOnly: true
38+
- name: spire-server
39+
image: ghcr.io/spiffe/spire-server:1.9.0
40+
args:
41+
- -config
42+
- /run/spire/config/server.conf
43+
ports:
44+
- containerPort: 8081
45+
volumeMounts:
46+
- name: spire-config
47+
mountPath: /run/spire/config
48+
readOnly: true
49+
- name: spire-data
50+
mountPath: /run/spire/data
51+
readOnly: false
52+
- name: spire-server-socket
53+
mountPath: /tmp/spire-server/private
54+
readOnly: false
55+
livenessProbe:
56+
httpGet:
57+
path: /live
58+
port: 8080
59+
failureThreshold: 2
60+
initialDelaySeconds: 15
61+
periodSeconds: 60
62+
timeoutSeconds: 3
63+
readinessProbe:
64+
httpGet:
65+
path: /ready
66+
port: 8080
67+
initialDelaySeconds: 5
68+
periodSeconds: 5
69+
- name: spire-oidc
70+
image: ghcr.io/spiffe/oidc-discovery-provider:1.9.0
71+
args:
72+
- -config
73+
- /run/spire/oidc/config/oidc-discovery-provider.conf
74+
volumeMounts:
75+
- name: spire-server-socket
76+
mountPath: /tmp/spire-server/private
77+
readOnly: true
78+
- name: spire-oidc-config
79+
mountPath: /run/spire/oidc/config/
80+
readOnly: true
81+
- name: spire-data
82+
mountPath: /run/spire/data
83+
readOnly: false
84+
readinessProbe:
85+
httpGet:
86+
path: /keys # TODO: Change this to /ready when using 1.5.2+
87+
port: 8008
88+
failureThreshold: 5
89+
initialDelaySeconds: 5
90+
periodSeconds: 5
91+
timeoutSeconds: 3
92+
volumes:
93+
- name: nginx-config
94+
configMap:
95+
name: hpcs-nginx
96+
- name: spire-config
97+
configMap:
98+
name: spire-server
99+
- name: spire-server-socket
100+
hostPath:
101+
path: /run/spire/sockets/server
102+
type: DirectoryOrCreate
103+
- name: spire-oidc-config
104+
configMap:
105+
name: oidc-discovery-provider
106+
- name: nginx-certs
107+
hostPath:
108+
path: /Users/telliere/LUMI-SD/nginx.conf.d
109+
type: DirectoryOrCreate
110+
volumeClaimTemplates:
111+
- metadata:
112+
name: spire-data
113+
namespace: spire
114+
spec:
115+
accessModes:
116+
- ReadWriteOnce
117+
resources:
118+
requests:
119+
storage: 1Gi

‎k8s/spire-namespace.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: spire

‎k8s/spire-oidc-configmap.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: oidc-discovery-provider
5+
namespace: spire
6+
data:
7+
oidc-discovery-provider.conf: |
8+
log_level = "debug"
9+
domains = ["spire-oidc"]
10+
listen_socket_path = "/server.sock"
11+
12+
server_api {
13+
address = "unix:///tmp/spire-server/private/api.sock"
14+
}

0 commit comments

Comments
 (0)