From 6ad2165eb680378e22df3192a43e1b25f0f9d89c Mon Sep 17 00:00:00 2001 From: Wayne Starr Date: Thu, 18 May 2023 16:19:20 -0500 Subject: [PATCH 1/6] feat(fulcio/add-env): Add additional env variables Support GCP credentials for external cloud provider workloads Co-authored-by: saisatish karra Signed-off-by: Wayne Starr --- charts/fulcio/Chart.yaml | 2 +- charts/fulcio/README.md | 4 +- charts/fulcio/templates/fulcio-configmap.yaml | 1 + .../fulcio/templates/fulcio-deployment.yaml | 27 +- charts/fulcio/values.yaml | 5 + fulcio_gen.yaml | 607 ++++++++++++++++++ 6 files changed, 637 insertions(+), 9 deletions(-) create mode 100644 fulcio_gen.yaml diff --git a/charts/fulcio/Chart.yaml b/charts/fulcio/Chart.yaml index e515b011..da1e7cb5 100644 --- a/charts/fulcio/Chart.yaml +++ b/charts/fulcio/Chart.yaml @@ -5,7 +5,7 @@ description: | type: application -version: 2.5.0 +version: 2.6.0 appVersion: 1.6.0 keywords: diff --git a/charts/fulcio/README.md b/charts/fulcio/README.md index e6a6f0d9..dbc024cd 100644 --- a/charts/fulcio/README.md +++ b/charts/fulcio/README.md @@ -2,7 +2,7 @@ -![Version: 2.5.0](https://img.shields.io/badge/Version-2.5.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.0](https://img.shields.io/badge/AppVersion-1.6.0-informational?style=flat-square) +![Version: 2.6.0](https://img.shields.io/badge/Version-2.6.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.0](https://img.shields.io/badge/AppVersion-1.6.0-informational?style=flat-square) Fulcio is a free code signing Certificate Authority, built to make short-lived certificates available to anyone. @@ -115,12 +115,14 @@ helm uninstall [RELEASE_NAME] | server.affinity | object | `{}` | | | server.args.aws_hsm_root_ca_path | string | `nil` | | | server.args.certificateAuthority | string | `"fileca"` | | +| server.args.creds | string | `""` | | | server.args.ct_log_url | string | `""` | | | server.args.disable_ct_log | bool | `false` | | | server.args.gcp_private_ca_parent | string | `"projects/test/locations/us-east1/caPools/test"` | | | server.args.grpcPort | int | `5554` | | | server.args.hsm_caroot_id | string | `nil` | | | server.args.port | int | `5555` | | +| server.env.GOOGLE_APPLICATION_CREDENTIALS | string | `"/etc/fulcio-config/cloud_credentials"` | | | server.grpcSvcPort | int | `5554` | | | server.image.pullPolicy | string | `"IfNotPresent"` | | | server.image.registry | string | `"gcr.io"` | | diff --git a/charts/fulcio/templates/fulcio-configmap.yaml b/charts/fulcio/templates/fulcio-configmap.yaml index 00c5d5fd..afdcc324 100644 --- a/charts/fulcio/templates/fulcio-configmap.yaml +++ b/charts/fulcio/templates/fulcio-configmap.yaml @@ -20,3 +20,4 @@ data: {{- if (eq .Values.server.args.certificateAuthority "kmsca")}} chain.pem: {{.Values.server.args.kms_cert_chain | quote }} {{- end }} + cloud_credentials: {{.Values.server.args.creds | quote }} diff --git a/charts/fulcio/templates/fulcio-deployment.yaml b/charts/fulcio/templates/fulcio-deployment.yaml index 7682b38c..25e0d31e 100644 --- a/charts/fulcio/templates/fulcio-deployment.yaml +++ b/charts/fulcio/templates/fulcio-deployment.yaml @@ -71,14 +71,27 @@ spec: {{- range .Values.server.extraArgs }} - {{ . | quote }} {{- end }} - {{- if eq .Values.server.args.certificateAuthority "fileca" }} +{{- if .Values.server.env }} env: - - name: PASSWORD - valueFrom: - secretKeyRef: - name: {{ .Values.server.secret }} - key: password - {{- end }} +{{- range $key, $value := .Values.server.env }} + - name: "{{ $key }}" + value: "{{ $value }}" +{{- end }} +{{- if eq .Values.server.args.certificateAuthority "fileca" }} + - name: PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Values.server.secret }} + key: password +{{- end }} +{{- else if eq .Values.server.args.certificateAuthority "fileca" }} + env: + - name: PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Values.server.secret }} + key: password +{{- end }} livenessProbe: failureThreshold: 3 httpGet: diff --git a/charts/fulcio/values.yaml b/charts/fulcio/values.yaml index b775c061..ec341896 100644 --- a/charts/fulcio/values.yaml +++ b/charts/fulcio/values.yaml @@ -23,9 +23,14 @@ server: # crane digest gcr.io/projectsigstore/fulcio:v1.6.0 # -- v1.6.0 version: sha256:9030be23f59405100bc8d24ce2ca493b9d430639ef49b448541a840b3bfd7771 + env: + # Valid values: path to workload identity config or service account key JSON file + GOOGLE_APPLICATION_CREDENTIALS: /etc/fulcio-config/cloud_credentials args: port: 5555 grpcPort: 5554 + # valid values: GCP workload identity config json for trusted external cloud providers + creds: "" # Valid values: googleca, pkcs11ca, aws-hsm-root-ca-path, fileca, kmsca certificateAuthority: fileca # kms_resource: gcpkms://.... diff --git a/fulcio_gen.yaml b/fulcio_gen.yaml new file mode 100644 index 00000000..812544ec --- /dev/null +++ b/fulcio_gen.yaml @@ -0,0 +1,607 @@ +--- +# Source: fulcio/charts/ctlog/templates/namespace.yaml +apiVersion: v1 +kind: Namespace +metadata: + name: ctlog-system +--- +# Source: fulcio/charts/ctlog/templates/createctconfig-serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: release-name-ctlog-createctconfig + namespace: ctlog-system + labels: + helm.sh/chart: ctlog-0.2.37 + app.kubernetes.io/name: ctlog + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "0.3.0" + app.kubernetes.io/managed-by: Helm + annotations: + {} +--- +# Source: fulcio/charts/ctlog/templates/createtree-serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: ctlog-createtree + namespace: ctlog-system + labels: + helm.sh/chart: ctlog-0.2.37 + app.kubernetes.io/name: ctlog + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "0.3.0" + app.kubernetes.io/managed-by: Helm + annotations: + {} +--- +# Source: fulcio/charts/ctlog/templates/ctlog-serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: ctlog + namespace: ctlog-system + labels: + helm.sh/chart: ctlog-0.2.37 + app.kubernetes.io/name: ctlog + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "0.3.0" + app.kubernetes.io/managed-by: Helm + annotations: + {} +--- +# Source: fulcio/templates/createcerts-serviceacount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: release-name-fulcio-createcerts + namespace: sigstore + labels: + helm.sh/chart: fulcio-2.4.2 + app.kubernetes.io/name: fulcio + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "1.3.1" + app.kubernetes.io/managed-by: Helm + annotations: + {} +--- +# Source: fulcio/templates/fulcio-serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: release-name-fulcio-server + namespace: sigstore + labels: + helm.sh/chart: fulcio-2.4.2 + app.kubernetes.io/name: fulcio + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "1.3.1" + app.kubernetes.io/managed-by: Helm + annotations: + {} +--- +# Source: fulcio/charts/ctlog/templates/ctlog-configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: ctlog-config + namespace: ctlog-system + labels: + helm.sh/chart: ctlog-0.2.37 + app.kubernetes.io/name: ctlog + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "0.3.0" + app.kubernetes.io/managed-by: Helm +data: + __placeholder: | + ################################################################### + # Just a placeholder so that reapplying this won't overwrite treeID + # if it already exists. This caused grief, do not remove. + ################################################################### +--- +# Source: fulcio/templates/fulcio-configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: release-name-fulcio-server-config + namespace: sigstore + labels: + helm.sh/chart: fulcio-2.4.2 + app.kubernetes.io/name: fulcio + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "1.3.1" + app.kubernetes.io/managed-by: Helm +data: + config.json: |- + { + "OIDCIssuers": { + "https://kubernetes.default.svc": { + "IssuerURL": "https://kubernetes.default.svc", + "ClientID": "sigstore", + "Type": "kubernetes" + } + }, + "MetaIssuers": { + "https://kubernetes.*.svc": { + "ClientID": "sigstore", + "Type": "kubernetes" + } + } + } + cloud_credentials: "" +--- +# Source: fulcio/charts/ctlog/templates/cm-operator-role.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: ctlog-cm-operator + namespace: ctlog-system + labels: + helm.sh/chart: ctlog-0.2.37 + app.kubernetes.io/name: ctlog + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "0.3.0" + app.kubernetes.io/managed-by: Helm +rules: + - apiGroups: [""] # "" indicates the core API group + resources: ["configmaps"] + resourceNames: ["ctlog-config"] + verbs: ["get", "update"] +--- +# Source: fulcio/charts/ctlog/templates/secret-operator-role.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: ctlog-secret-operator + namespace: ctlog-system + labels: + helm.sh/chart: ctlog-0.2.37 + app.kubernetes.io/name: ctlog + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "0.3.0" + app.kubernetes.io/managed-by: Helm +rules: + - apiGroups: [""] # "" indicates the core API group + resources: ["configmaps"] + resourceNames: ["ctlog-config"] + verbs: ["get", "update"] + - apiGroups: [""] # "" indicates the core API group + resources: ["secrets"] + verbs: ["create", "get", "update"] +--- +# Source: fulcio/templates/secret-operator-role.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: release-name-fulcio-server-secret-operator + namespace: sigstore + labels: + helm.sh/chart: fulcio-2.4.2 + app.kubernetes.io/name: fulcio + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "1.3.1" + app.kubernetes.io/managed-by: Helm +rules: + - apiGroups: [""] # "" indicates the core API group + resources: ["secrets"] + verbs: ["create", "get", "update"] +--- +# Source: fulcio/charts/ctlog/templates/cm-operator-rolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: ctlog-cm-operator + namespace: ctlog-system + labels: + helm.sh/chart: ctlog-0.2.37 + app.kubernetes.io/name: ctlog + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "0.3.0" + app.kubernetes.io/managed-by: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: ctlog-cm-operator +subjects: + - kind: ServiceAccount + name: ctlog-createtree + namespace: ctlog-system +--- +# Source: fulcio/charts/ctlog/templates/secret-operator-rolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: ctlog-secret-operator + namespace: ctlog-system + labels: + helm.sh/chart: ctlog-0.2.37 + app.kubernetes.io/name: ctlog + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "0.3.0" + app.kubernetes.io/managed-by: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: ctlog-secret-operator +subjects: + - kind: ServiceAccount + name: release-name-ctlog-createctconfig + namespace: ctlog-system +--- +# Source: fulcio/templates/secret-operator-rolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: release-name-fulcio-server-secret-operator + namespace: sigstore + labels: + helm.sh/chart: fulcio-2.4.2 + app.kubernetes.io/name: fulcio + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "1.3.1" + app.kubernetes.io/managed-by: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: release-name-fulcio-server-secret-operator +subjects: + - kind: ServiceAccount + name: release-name-fulcio-createcerts + namespace: sigstore +--- +# Source: fulcio/charts/ctlog/templates/ctlog-service.yaml +apiVersion: v1 +kind: Service +metadata: + labels: + helm.sh/chart: ctlog-0.2.37 + app.kubernetes.io/name: ctlog + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "0.3.0" + app.kubernetes.io/managed-by: Helm + name: ctlog + namespace: ctlog-system +spec: + ports: + - name: 6962-tcp + port: 80 + protocol: TCP + targetPort: 6962 + - name: 6963-tcp + port: 6963 + protocol: TCP + targetPort: 6963 + selector: + app.kubernetes.io/name: ctlog + app.kubernetes.io/instance: release-name + type: "ClusterIP" +--- +# Source: fulcio/templates/fulcio-service.yaml +apiVersion: v1 +kind: Service +metadata: + labels: + helm.sh/chart: fulcio-2.4.2 + app.kubernetes.io/name: fulcio + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "1.3.1" + app.kubernetes.io/managed-by: Helm + name: release-name-fulcio-server + namespace: sigstore +spec: + ports: + - name: http + port: 80 + protocol: TCP + targetPort: 5555 + - name: grpc + port: 5554 + protocol: TCP + targetPort: 5554 + - name: 2112-tcp + port: 2112 + protocol: TCP + targetPort: 2112 + selector: + app.kubernetes.io/name: fulcio + app.kubernetes.io/instance: release-name + type: "ClusterIP" +--- +# Source: fulcio/charts/ctlog/templates/ctlog-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: ctlog + namespace: ctlog-system + labels: + helm.sh/chart: ctlog-0.2.37 + app.kubernetes.io/name: ctlog + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "0.3.0" + app.kubernetes.io/managed-by: Helm +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: ctlog + app.kubernetes.io/instance: release-name + template: + metadata: + annotations: + checksum/config: b94af4d324905711b8078a98d1acf2688381fe98eeef567be31295a879f6eadd + prometheus.io/path: /metrics + prometheus.io/port: "6963" + prometheus.io/scrape: "true" + labels: + app.kubernetes.io/name: ctlog + app.kubernetes.io/instance: release-name + spec: + serviceAccountName: ctlog + containers: + - name: ctlog + image: "ghcr.io/sigstore/scaffolding/ct_server@sha256:7c791d3b7c15e817807f07d4cdb00406529a114702ad448ee857e1d0fc5fb5a9" + imagePullPolicy: "IfNotPresent" + args: + - "--http_endpoint=0.0.0.0:6962" + - "--metrics_endpoint=0.0.0.0:6963" + - "--log_config=/ctfe-keys/config" + - "--alsologtostderr" + volumeMounts: + - name: keys + mountPath: "/ctfe-keys" + readOnly: true + ports: + - containerPort: 6962 + protocol: TCP + - containerPort: 6963 + protocol: TCP + securityContext: + runAsNonRoot: true + runAsUser: 65533 + volumes: + - name: keys + secret: + secretName: ctlog-secret +--- +# Source: fulcio/templates/fulcio-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: release-name-fulcio-server + namespace: sigstore + labels: + helm.sh/chart: fulcio-2.4.2 + app.kubernetes.io/name: fulcio + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "1.3.1" + app.kubernetes.io/managed-by: Helm +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: fulcio + app.kubernetes.io/instance: release-name + template: + metadata: + annotations: + checksum/config: da411967324f350f169be60798759837cbbeedc571c9bb27a670752103d1b40d + labels: + app.kubernetes.io/name: fulcio + app.kubernetes.io/instance: release-name + spec: + serviceAccountName: release-name-fulcio-server + # This doesn't actually use Kubernetes credentials, so don't mount them in. + automountServiceAccountToken: true + containers: + - name: release-name-fulcio-server + image: "gcr.io/projectsigstore/fulcio@sha256:c920be2d367214562cda7d53d3af3529edf2dfd9326b24909ece450092b97b18" + imagePullPolicy: "IfNotPresent" + ports: + - containerPort: 5555 + protocol: TCP + - containerPort: 5554 + protocol: TCP + - containerPort: 2112 + protocol: TCP + args: + - "serve" + - "--port=5555" + - "--grpc-port=5554" + - "--ca=fileca" + - "--fileca-key" + - "/var/run/fulcio-secrets/key.pem" + - "--fileca-cert" + - "/var/run/fulcio-secrets/cert.pem" + - "--fileca-key-passwd" + - "$(PASSWORD)" + - "--ct-log-url=http://ctlog.ctlog-system.svc/fulcio" + env: + - name: "GOOGLE_APPLICATION_CREDENTIALS" + value: "/etc/fulcio-config/cloud_credentials" + - name: PASSWORD + valueFrom: + secretKeyRef: + name: fulcio-server-secret + key: password + volumeMounts: + - name: fulcio-config + mountPath: /etc/fulcio-config + - name: oidc-info + mountPath: /var/run/fulcio + - name: fulcio-cert + mountPath: "/var/run/fulcio-secrets" + readOnly: true + securityContext: + runAsNonRoot: true + runAsUser: 65533 + volumes: + - name: fulcio-config + configMap: + name: release-name-fulcio-server-config + - name: oidc-info + projected: + sources: + - configMap: + name: kube-root-ca.crt + items: + - key: ca.crt + path: ca.crt + mode: 0666 + - name: fulcio-cert + secret: + secretName: fulcio-server-secret + items: + - key: private + path: key.pem + - key: cert + path: cert.pem +--- +# Source: fulcio/charts/ctlog/templates/createctconfig-job.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: release-name-ctlog-createctconfig + namespace: ctlog-system + labels: + helm.sh/chart: ctlog-0.2.37 + app.kubernetes.io/name: ctlog + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "0.3.0" + app.kubernetes.io/managed-by: Helm +spec: + ttlSecondsAfterFinished: 3600 + backoffLimit: 6 + template: + spec: + serviceAccountName: release-name-ctlog-createctconfig + restartPolicy: Never + automountServiceAccountToken: true + initContainers: + - name: "wait-for-createtree-configmap" + image: "docker.io/curlimages/curl@sha256:dca6e1b1c8e7b8b8e7be4e79fc78a858d12fd56245cb31bfa281dbf7c73a6498" + imagePullPolicy: IfNotPresent + command: ["sh", "-c", "until curl --fail --header \"Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)\" --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt --max-time 10 https://kubernetes.default.svc/api/v1/namespaces/$(NAMESPACE)/configmaps/ctlog-config | grep '\"treeID\":'; do echo waiting for Configmap ctlog-config; sleep 5; done;"] + env: + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + containers: + - name: release-name-ctlog-createctconfig + image: "ghcr.io/sigstore/scaffolding/createctconfig@sha256:024e3451af712070a807124f82c5a8a9c84343c17ec17a2d2832229a6ac0cb0e" + imagePullPolicy: "IfNotPresent" + args: [ + "--configmap=ctlog-config", + "--secret=ctlog-secret", + "--pubkeysecret=ctlog-public-key", + "--fulcio-url=http://fulcio-server.fulcio-system.svc", + "--trillian-server=trillian-logserver.trillian-system:8091", + "--log-prefix=fulcio" + ] + env: + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + securityContext: + runAsNonRoot: true + runAsUser: 65533 +--- +# Source: fulcio/charts/ctlog/templates/createtree-job.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: ctlog-createtree + namespace: ctlog-system + labels: + helm.sh/chart: ctlog-0.2.37 + app.kubernetes.io/name: ctlog + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "0.3.0" + app.kubernetes.io/managed-by: Helm +spec: + ttlSecondsAfterFinished: 3600 + template: + spec: + serviceAccountName: ctlog-createtree + restartPolicy: Never + automountServiceAccountToken: true + containers: + - name: ctlog-createtree + image: "ghcr.io/sigstore/scaffolding/createtree@sha256:d5776d8a43632291e1c5a22a9266608db0daa0a11663445d701e327f2205974c" + imagePullPolicy: "IfNotPresent" + env: + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + args: [ + "--namespace=$(NAMESPACE)", + "--configmap=ctlog-config", + "--display_name=ctlog-tree", + "--admin_server=trillian-logserver.trillian-system:8091" + ] + securityContext: + runAsNonRoot: true + runAsUser: 65533 +--- +# Source: fulcio/templates/createcerts-job.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: release-name-fulcio-createcerts + namespace: sigstore + labels: + helm.sh/chart: fulcio-2.4.2 + app.kubernetes.io/name: fulcio + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "1.3.1" + app.kubernetes.io/managed-by: Helm +spec: + ttlSecondsAfterFinished: 3600 + template: + spec: + serviceAccountName: release-name-fulcio-createcerts + restartPolicy: Never + automountServiceAccountToken: true + containers: + - name: release-name-fulcio-createcerts + image: "ghcr.io/sigstore/scaffolding/createcerts@sha256:73e7ac35d0e5169bd14a5cb6caed2e7d44277dec3d1de92e08f4d055523089a1" + imagePullPolicy: "IfNotPresent" + args: ["--secret=fulcio-server-secret"] + env: + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + securityContext: + runAsNonRoot: true + runAsUser: 65533 +--- +# Source: fulcio/templates/fulcio-http-ingress.yaml +apiVersion: "networking.k8s.io/v1" +kind: Ingress +metadata: + labels: + helm.sh/chart: fulcio-2.4.2 + app.kubernetes.io/name: fulcio + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "1.3.1" + app.kubernetes.io/managed-by: Helm + name: release-name-fulcio-server-http + namespace: sigstore + annotations: + {} +spec: + ingressClassName: nginx + rules: + - host: "fulcio.localhost" + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: release-name-fulcio-server + port: + number: 80 From a7b1fd4a3ab799b475ee2770e27843cef42bb83b Mon Sep 17 00:00:00 2001 From: Wayne Starr Date: Fri, 19 May 2023 09:02:19 -0500 Subject: [PATCH 2/6] fix(helm): make env variable optional Co-authored-by: saisatish karra Signed-off-by: Wayne Starr --- charts/fulcio/values.yaml | 6 +- fulcio_gen.yaml | 607 -------------------------------------- 2 files changed, 3 insertions(+), 610 deletions(-) delete mode 100644 fulcio_gen.yaml diff --git a/charts/fulcio/values.yaml b/charts/fulcio/values.yaml index ec341896..07e94e09 100644 --- a/charts/fulcio/values.yaml +++ b/charts/fulcio/values.yaml @@ -23,9 +23,9 @@ server: # crane digest gcr.io/projectsigstore/fulcio:v1.6.0 # -- v1.6.0 version: sha256:9030be23f59405100bc8d24ce2ca493b9d430639ef49b448541a840b3bfd7771 - env: - # Valid values: path to workload identity config or service account key JSON file - GOOGLE_APPLICATION_CREDENTIALS: /etc/fulcio-config/cloud_credentials + # env: + # # Valid values: path to workload identity config or service account key JSON file + # GOOGLE_APPLICATION_CREDENTIALS: /etc/fulcio-config/cloud_credentials args: port: 5555 grpcPort: 5554 diff --git a/fulcio_gen.yaml b/fulcio_gen.yaml deleted file mode 100644 index 812544ec..00000000 --- a/fulcio_gen.yaml +++ /dev/null @@ -1,607 +0,0 @@ ---- -# Source: fulcio/charts/ctlog/templates/namespace.yaml -apiVersion: v1 -kind: Namespace -metadata: - name: ctlog-system ---- -# Source: fulcio/charts/ctlog/templates/createctconfig-serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: release-name-ctlog-createctconfig - namespace: ctlog-system - labels: - helm.sh/chart: ctlog-0.2.37 - app.kubernetes.io/name: ctlog - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "0.3.0" - app.kubernetes.io/managed-by: Helm - annotations: - {} ---- -# Source: fulcio/charts/ctlog/templates/createtree-serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: ctlog-createtree - namespace: ctlog-system - labels: - helm.sh/chart: ctlog-0.2.37 - app.kubernetes.io/name: ctlog - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "0.3.0" - app.kubernetes.io/managed-by: Helm - annotations: - {} ---- -# Source: fulcio/charts/ctlog/templates/ctlog-serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: ctlog - namespace: ctlog-system - labels: - helm.sh/chart: ctlog-0.2.37 - app.kubernetes.io/name: ctlog - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "0.3.0" - app.kubernetes.io/managed-by: Helm - annotations: - {} ---- -# Source: fulcio/templates/createcerts-serviceacount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: release-name-fulcio-createcerts - namespace: sigstore - labels: - helm.sh/chart: fulcio-2.4.2 - app.kubernetes.io/name: fulcio - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "1.3.1" - app.kubernetes.io/managed-by: Helm - annotations: - {} ---- -# Source: fulcio/templates/fulcio-serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: release-name-fulcio-server - namespace: sigstore - labels: - helm.sh/chart: fulcio-2.4.2 - app.kubernetes.io/name: fulcio - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "1.3.1" - app.kubernetes.io/managed-by: Helm - annotations: - {} ---- -# Source: fulcio/charts/ctlog/templates/ctlog-configmap.yaml -apiVersion: v1 -kind: ConfigMap -metadata: - name: ctlog-config - namespace: ctlog-system - labels: - helm.sh/chart: ctlog-0.2.37 - app.kubernetes.io/name: ctlog - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "0.3.0" - app.kubernetes.io/managed-by: Helm -data: - __placeholder: | - ################################################################### - # Just a placeholder so that reapplying this won't overwrite treeID - # if it already exists. This caused grief, do not remove. - ################################################################### ---- -# Source: fulcio/templates/fulcio-configmap.yaml -apiVersion: v1 -kind: ConfigMap -metadata: - name: release-name-fulcio-server-config - namespace: sigstore - labels: - helm.sh/chart: fulcio-2.4.2 - app.kubernetes.io/name: fulcio - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "1.3.1" - app.kubernetes.io/managed-by: Helm -data: - config.json: |- - { - "OIDCIssuers": { - "https://kubernetes.default.svc": { - "IssuerURL": "https://kubernetes.default.svc", - "ClientID": "sigstore", - "Type": "kubernetes" - } - }, - "MetaIssuers": { - "https://kubernetes.*.svc": { - "ClientID": "sigstore", - "Type": "kubernetes" - } - } - } - cloud_credentials: "" ---- -# Source: fulcio/charts/ctlog/templates/cm-operator-role.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: ctlog-cm-operator - namespace: ctlog-system - labels: - helm.sh/chart: ctlog-0.2.37 - app.kubernetes.io/name: ctlog - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "0.3.0" - app.kubernetes.io/managed-by: Helm -rules: - - apiGroups: [""] # "" indicates the core API group - resources: ["configmaps"] - resourceNames: ["ctlog-config"] - verbs: ["get", "update"] ---- -# Source: fulcio/charts/ctlog/templates/secret-operator-role.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: ctlog-secret-operator - namespace: ctlog-system - labels: - helm.sh/chart: ctlog-0.2.37 - app.kubernetes.io/name: ctlog - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "0.3.0" - app.kubernetes.io/managed-by: Helm -rules: - - apiGroups: [""] # "" indicates the core API group - resources: ["configmaps"] - resourceNames: ["ctlog-config"] - verbs: ["get", "update"] - - apiGroups: [""] # "" indicates the core API group - resources: ["secrets"] - verbs: ["create", "get", "update"] ---- -# Source: fulcio/templates/secret-operator-role.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: release-name-fulcio-server-secret-operator - namespace: sigstore - labels: - helm.sh/chart: fulcio-2.4.2 - app.kubernetes.io/name: fulcio - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "1.3.1" - app.kubernetes.io/managed-by: Helm -rules: - - apiGroups: [""] # "" indicates the core API group - resources: ["secrets"] - verbs: ["create", "get", "update"] ---- -# Source: fulcio/charts/ctlog/templates/cm-operator-rolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: ctlog-cm-operator - namespace: ctlog-system - labels: - helm.sh/chart: ctlog-0.2.37 - app.kubernetes.io/name: ctlog - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "0.3.0" - app.kubernetes.io/managed-by: Helm -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: ctlog-cm-operator -subjects: - - kind: ServiceAccount - name: ctlog-createtree - namespace: ctlog-system ---- -# Source: fulcio/charts/ctlog/templates/secret-operator-rolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: ctlog-secret-operator - namespace: ctlog-system - labels: - helm.sh/chart: ctlog-0.2.37 - app.kubernetes.io/name: ctlog - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "0.3.0" - app.kubernetes.io/managed-by: Helm -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: ctlog-secret-operator -subjects: - - kind: ServiceAccount - name: release-name-ctlog-createctconfig - namespace: ctlog-system ---- -# Source: fulcio/templates/secret-operator-rolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: release-name-fulcio-server-secret-operator - namespace: sigstore - labels: - helm.sh/chart: fulcio-2.4.2 - app.kubernetes.io/name: fulcio - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "1.3.1" - app.kubernetes.io/managed-by: Helm -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: release-name-fulcio-server-secret-operator -subjects: - - kind: ServiceAccount - name: release-name-fulcio-createcerts - namespace: sigstore ---- -# Source: fulcio/charts/ctlog/templates/ctlog-service.yaml -apiVersion: v1 -kind: Service -metadata: - labels: - helm.sh/chart: ctlog-0.2.37 - app.kubernetes.io/name: ctlog - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "0.3.0" - app.kubernetes.io/managed-by: Helm - name: ctlog - namespace: ctlog-system -spec: - ports: - - name: 6962-tcp - port: 80 - protocol: TCP - targetPort: 6962 - - name: 6963-tcp - port: 6963 - protocol: TCP - targetPort: 6963 - selector: - app.kubernetes.io/name: ctlog - app.kubernetes.io/instance: release-name - type: "ClusterIP" ---- -# Source: fulcio/templates/fulcio-service.yaml -apiVersion: v1 -kind: Service -metadata: - labels: - helm.sh/chart: fulcio-2.4.2 - app.kubernetes.io/name: fulcio - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "1.3.1" - app.kubernetes.io/managed-by: Helm - name: release-name-fulcio-server - namespace: sigstore -spec: - ports: - - name: http - port: 80 - protocol: TCP - targetPort: 5555 - - name: grpc - port: 5554 - protocol: TCP - targetPort: 5554 - - name: 2112-tcp - port: 2112 - protocol: TCP - targetPort: 2112 - selector: - app.kubernetes.io/name: fulcio - app.kubernetes.io/instance: release-name - type: "ClusterIP" ---- -# Source: fulcio/charts/ctlog/templates/ctlog-deployment.yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: ctlog - namespace: ctlog-system - labels: - helm.sh/chart: ctlog-0.2.37 - app.kubernetes.io/name: ctlog - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "0.3.0" - app.kubernetes.io/managed-by: Helm -spec: - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/name: ctlog - app.kubernetes.io/instance: release-name - template: - metadata: - annotations: - checksum/config: b94af4d324905711b8078a98d1acf2688381fe98eeef567be31295a879f6eadd - prometheus.io/path: /metrics - prometheus.io/port: "6963" - prometheus.io/scrape: "true" - labels: - app.kubernetes.io/name: ctlog - app.kubernetes.io/instance: release-name - spec: - serviceAccountName: ctlog - containers: - - name: ctlog - image: "ghcr.io/sigstore/scaffolding/ct_server@sha256:7c791d3b7c15e817807f07d4cdb00406529a114702ad448ee857e1d0fc5fb5a9" - imagePullPolicy: "IfNotPresent" - args: - - "--http_endpoint=0.0.0.0:6962" - - "--metrics_endpoint=0.0.0.0:6963" - - "--log_config=/ctfe-keys/config" - - "--alsologtostderr" - volumeMounts: - - name: keys - mountPath: "/ctfe-keys" - readOnly: true - ports: - - containerPort: 6962 - protocol: TCP - - containerPort: 6963 - protocol: TCP - securityContext: - runAsNonRoot: true - runAsUser: 65533 - volumes: - - name: keys - secret: - secretName: ctlog-secret ---- -# Source: fulcio/templates/fulcio-deployment.yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: release-name-fulcio-server - namespace: sigstore - labels: - helm.sh/chart: fulcio-2.4.2 - app.kubernetes.io/name: fulcio - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "1.3.1" - app.kubernetes.io/managed-by: Helm -spec: - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/name: fulcio - app.kubernetes.io/instance: release-name - template: - metadata: - annotations: - checksum/config: da411967324f350f169be60798759837cbbeedc571c9bb27a670752103d1b40d - labels: - app.kubernetes.io/name: fulcio - app.kubernetes.io/instance: release-name - spec: - serviceAccountName: release-name-fulcio-server - # This doesn't actually use Kubernetes credentials, so don't mount them in. - automountServiceAccountToken: true - containers: - - name: release-name-fulcio-server - image: "gcr.io/projectsigstore/fulcio@sha256:c920be2d367214562cda7d53d3af3529edf2dfd9326b24909ece450092b97b18" - imagePullPolicy: "IfNotPresent" - ports: - - containerPort: 5555 - protocol: TCP - - containerPort: 5554 - protocol: TCP - - containerPort: 2112 - protocol: TCP - args: - - "serve" - - "--port=5555" - - "--grpc-port=5554" - - "--ca=fileca" - - "--fileca-key" - - "/var/run/fulcio-secrets/key.pem" - - "--fileca-cert" - - "/var/run/fulcio-secrets/cert.pem" - - "--fileca-key-passwd" - - "$(PASSWORD)" - - "--ct-log-url=http://ctlog.ctlog-system.svc/fulcio" - env: - - name: "GOOGLE_APPLICATION_CREDENTIALS" - value: "/etc/fulcio-config/cloud_credentials" - - name: PASSWORD - valueFrom: - secretKeyRef: - name: fulcio-server-secret - key: password - volumeMounts: - - name: fulcio-config - mountPath: /etc/fulcio-config - - name: oidc-info - mountPath: /var/run/fulcio - - name: fulcio-cert - mountPath: "/var/run/fulcio-secrets" - readOnly: true - securityContext: - runAsNonRoot: true - runAsUser: 65533 - volumes: - - name: fulcio-config - configMap: - name: release-name-fulcio-server-config - - name: oidc-info - projected: - sources: - - configMap: - name: kube-root-ca.crt - items: - - key: ca.crt - path: ca.crt - mode: 0666 - - name: fulcio-cert - secret: - secretName: fulcio-server-secret - items: - - key: private - path: key.pem - - key: cert - path: cert.pem ---- -# Source: fulcio/charts/ctlog/templates/createctconfig-job.yaml -apiVersion: batch/v1 -kind: Job -metadata: - name: release-name-ctlog-createctconfig - namespace: ctlog-system - labels: - helm.sh/chart: ctlog-0.2.37 - app.kubernetes.io/name: ctlog - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "0.3.0" - app.kubernetes.io/managed-by: Helm -spec: - ttlSecondsAfterFinished: 3600 - backoffLimit: 6 - template: - spec: - serviceAccountName: release-name-ctlog-createctconfig - restartPolicy: Never - automountServiceAccountToken: true - initContainers: - - name: "wait-for-createtree-configmap" - image: "docker.io/curlimages/curl@sha256:dca6e1b1c8e7b8b8e7be4e79fc78a858d12fd56245cb31bfa281dbf7c73a6498" - imagePullPolicy: IfNotPresent - command: ["sh", "-c", "until curl --fail --header \"Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)\" --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt --max-time 10 https://kubernetes.default.svc/api/v1/namespaces/$(NAMESPACE)/configmaps/ctlog-config | grep '\"treeID\":'; do echo waiting for Configmap ctlog-config; sleep 5; done;"] - env: - - name: NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - containers: - - name: release-name-ctlog-createctconfig - image: "ghcr.io/sigstore/scaffolding/createctconfig@sha256:024e3451af712070a807124f82c5a8a9c84343c17ec17a2d2832229a6ac0cb0e" - imagePullPolicy: "IfNotPresent" - args: [ - "--configmap=ctlog-config", - "--secret=ctlog-secret", - "--pubkeysecret=ctlog-public-key", - "--fulcio-url=http://fulcio-server.fulcio-system.svc", - "--trillian-server=trillian-logserver.trillian-system:8091", - "--log-prefix=fulcio" - ] - env: - - name: NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - securityContext: - runAsNonRoot: true - runAsUser: 65533 ---- -# Source: fulcio/charts/ctlog/templates/createtree-job.yaml -apiVersion: batch/v1 -kind: Job -metadata: - name: ctlog-createtree - namespace: ctlog-system - labels: - helm.sh/chart: ctlog-0.2.37 - app.kubernetes.io/name: ctlog - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "0.3.0" - app.kubernetes.io/managed-by: Helm -spec: - ttlSecondsAfterFinished: 3600 - template: - spec: - serviceAccountName: ctlog-createtree - restartPolicy: Never - automountServiceAccountToken: true - containers: - - name: ctlog-createtree - image: "ghcr.io/sigstore/scaffolding/createtree@sha256:d5776d8a43632291e1c5a22a9266608db0daa0a11663445d701e327f2205974c" - imagePullPolicy: "IfNotPresent" - env: - - name: NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - args: [ - "--namespace=$(NAMESPACE)", - "--configmap=ctlog-config", - "--display_name=ctlog-tree", - "--admin_server=trillian-logserver.trillian-system:8091" - ] - securityContext: - runAsNonRoot: true - runAsUser: 65533 ---- -# Source: fulcio/templates/createcerts-job.yaml -apiVersion: batch/v1 -kind: Job -metadata: - name: release-name-fulcio-createcerts - namespace: sigstore - labels: - helm.sh/chart: fulcio-2.4.2 - app.kubernetes.io/name: fulcio - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "1.3.1" - app.kubernetes.io/managed-by: Helm -spec: - ttlSecondsAfterFinished: 3600 - template: - spec: - serviceAccountName: release-name-fulcio-createcerts - restartPolicy: Never - automountServiceAccountToken: true - containers: - - name: release-name-fulcio-createcerts - image: "ghcr.io/sigstore/scaffolding/createcerts@sha256:73e7ac35d0e5169bd14a5cb6caed2e7d44277dec3d1de92e08f4d055523089a1" - imagePullPolicy: "IfNotPresent" - args: ["--secret=fulcio-server-secret"] - env: - - name: NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - securityContext: - runAsNonRoot: true - runAsUser: 65533 ---- -# Source: fulcio/templates/fulcio-http-ingress.yaml -apiVersion: "networking.k8s.io/v1" -kind: Ingress -metadata: - labels: - helm.sh/chart: fulcio-2.4.2 - app.kubernetes.io/name: fulcio - app.kubernetes.io/instance: release-name - app.kubernetes.io/version: "1.3.1" - app.kubernetes.io/managed-by: Helm - name: release-name-fulcio-server-http - namespace: sigstore - annotations: - {} -spec: - ingressClassName: nginx - rules: - - host: "fulcio.localhost" - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: release-name-fulcio-server - port: - number: 80 From 8b50eed019d09a5ffaec98b6f454566c30d7b749 Mon Sep 17 00:00:00 2001 From: Wayne Starr Date: Sun, 21 May 2023 14:32:00 -0500 Subject: [PATCH 3/6] modify env variable type Co-authored-by: saisatish karra Signed-off-by: Wayne Starr --- charts/fulcio/README.md | 2 +- charts/fulcio/values.yaml | 4 +--- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/charts/fulcio/README.md b/charts/fulcio/README.md index dbc024cd..81e1e1c9 100644 --- a/charts/fulcio/README.md +++ b/charts/fulcio/README.md @@ -122,7 +122,7 @@ helm uninstall [RELEASE_NAME] | server.args.grpcPort | int | `5554` | | | server.args.hsm_caroot_id | string | `nil` | | | server.args.port | int | `5555` | | -| server.env.GOOGLE_APPLICATION_CREDENTIALS | string | `"/etc/fulcio-config/cloud_credentials"` | | +| server.env | object | `{}` | | | server.grpcSvcPort | int | `5554` | | | server.image.pullPolicy | string | `"IfNotPresent"` | | | server.image.registry | string | `"gcr.io"` | | diff --git a/charts/fulcio/values.yaml b/charts/fulcio/values.yaml index 07e94e09..6cf77e22 100644 --- a/charts/fulcio/values.yaml +++ b/charts/fulcio/values.yaml @@ -23,9 +23,7 @@ server: # crane digest gcr.io/projectsigstore/fulcio:v1.6.0 # -- v1.6.0 version: sha256:9030be23f59405100bc8d24ce2ca493b9d430639ef49b448541a840b3bfd7771 - # env: - # # Valid values: path to workload identity config or service account key JSON file - # GOOGLE_APPLICATION_CREDENTIALS: /etc/fulcio-config/cloud_credentials + env: {} args: port: 5555 grpcPort: 5554 From 1490b4573be30c0e575bba35010c26ee80875422 Mon Sep 17 00:00:00 2001 From: Wayne Starr Date: Thu, 25 May 2023 08:33:00 -0500 Subject: [PATCH 4/6] improve naming scheme for extrernal credential config Co-authored-by: saisatish karra Signed-off-by: Wayne Starr --- charts/fulcio/README.md | 2 +- charts/fulcio/templates/fulcio-configmap.yaml | 4 +++- charts/fulcio/values.yaml | 2 +- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/charts/fulcio/README.md b/charts/fulcio/README.md index 81e1e1c9..7af392e6 100644 --- a/charts/fulcio/README.md +++ b/charts/fulcio/README.md @@ -115,7 +115,7 @@ helm uninstall [RELEASE_NAME] | server.affinity | object | `{}` | | | server.args.aws_hsm_root_ca_path | string | `nil` | | | server.args.certificateAuthority | string | `"fileca"` | | -| server.args.creds | string | `""` | | +| server.args.cloud_credential_config | string | `""` | | | server.args.ct_log_url | string | `""` | | | server.args.disable_ct_log | bool | `false` | | | server.args.gcp_private_ca_parent | string | `"projects/test/locations/us-east1/caPools/test"` | | diff --git a/charts/fulcio/templates/fulcio-configmap.yaml b/charts/fulcio/templates/fulcio-configmap.yaml index afdcc324..a54fe005 100644 --- a/charts/fulcio/templates/fulcio-configmap.yaml +++ b/charts/fulcio/templates/fulcio-configmap.yaml @@ -20,4 +20,6 @@ data: {{- if (eq .Values.server.args.certificateAuthority "kmsca")}} chain.pem: {{.Values.server.args.kms_cert_chain | quote }} {{- end }} - cloud_credentials: {{.Values.server.args.creds | quote }} + {{- if .Values.server.args.cloud_credential_config }} + cloud_credential_config: {{.Values.server.args.cloud_credential_config | quote }} + {{- end }} diff --git a/charts/fulcio/values.yaml b/charts/fulcio/values.yaml index 6cf77e22..5a46357b 100644 --- a/charts/fulcio/values.yaml +++ b/charts/fulcio/values.yaml @@ -28,7 +28,7 @@ server: port: 5555 grpcPort: 5554 # valid values: GCP workload identity config json for trusted external cloud providers - creds: "" + cloud_credential_config: "" # Valid values: googleca, pkcs11ca, aws-hsm-root-ca-path, fileca, kmsca certificateAuthority: fileca # kms_resource: gcpkms://.... From 2e84f2ecdd4bd06d69d9640900d46c04bd1acb7a Mon Sep 17 00:00:00 2001 From: Wayne Starr Date: Wed, 24 Jul 2024 13:15:46 -0600 Subject: [PATCH 5/6] Resolve or feedback for env section Signed-off-by: Wayne Starr --- .../fulcio/templates/fulcio-deployment.yaml | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/charts/fulcio/templates/fulcio-deployment.yaml b/charts/fulcio/templates/fulcio-deployment.yaml index 25e0d31e..c88ee236 100644 --- a/charts/fulcio/templates/fulcio-deployment.yaml +++ b/charts/fulcio/templates/fulcio-deployment.yaml @@ -71,27 +71,20 @@ spec: {{- range .Values.server.extraArgs }} - {{ . | quote }} {{- end }} -{{- if .Values.server.env }} + {{- if or .Values.server.env (eq .Values.server.args.certificateAuthority "fileca") }} env: -{{- range $key, $value := .Values.server.env }} + {{- range $key, $value := .Values.server.env }} - name: "{{ $key }}" value: "{{ $value }}" -{{- end }} -{{- if eq .Values.server.args.certificateAuthority "fileca" }} + {{- end }} + {{- if eq .Values.server.args.certificateAuthority "fileca" }} - name: PASSWORD valueFrom: secretKeyRef: name: {{ .Values.server.secret }} key: password -{{- end }} -{{- else if eq .Values.server.args.certificateAuthority "fileca" }} - env: - - name: PASSWORD - valueFrom: - secretKeyRef: - name: {{ .Values.server.secret }} - key: password -{{- end }} + {{- end }} + {{- end }} livenessProbe: failureThreshold: 3 httpGet: From a2f7ddf5869f1f16156067c8047b7646160ddc76 Mon Sep 17 00:00:00 2001 From: Wayne Starr Date: Wed, 24 Jul 2024 13:27:14 -0600 Subject: [PATCH 6/6] Adjust json schema Signed-off-by: Wayne Starr --- charts/fulcio/values.schema.json | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/charts/fulcio/values.schema.json b/charts/fulcio/values.schema.json index f2957120..0c8f75c4 100644 --- a/charts/fulcio/values.schema.json +++ b/charts/fulcio/values.schema.json @@ -189,6 +189,9 @@ "gcp_private_ca_parent": { "type": "string" }, + "cloud_credential_config": { + "type": "string" + }, "grpcPort": { "type": "integer" }, @@ -466,6 +469,10 @@ }, "type": "object" }, + "env": { + "type": "object", + "properties": {} + }, "serviceAccount": { "properties": { "annotations": {