Skip to content

Commit 645d46f

Browse files
uhthomasuhthomas
committed
feat(k8s/magiclove): spire
1 parent 5b0d5c1 commit 645d46f

27 files changed

+852
-52
lines changed

‎k8s/magiclove/BUILD.bazel‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ cue_export(
5656
"//k8s/magiclove/smartctl_exporter:cue_smartctl_exporter_library",
5757
"//k8s/magiclove/snapshot_controller:cue_snapshot_controller_library",
5858
"//k8s/magiclove/speedtest_exporter:cue_speedtest_exporter_library",
59+
"//k8s/magiclove/spire:cue_spire_library",
5960
"//k8s/magiclove/thomas:cue_thomas_library",
6061
"//k8s/magiclove/vector:cue_vector_library",
6162
"//k8s/magiclove/victoria_logs:cue_victoria_logs_library",

‎k8s/magiclove/list.cue‎

Lines changed: 2 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ import (
3838
"github.com/uhthomas/automata/k8s/magiclove/smartctl_exporter"
3939
"github.com/uhthomas/automata/k8s/magiclove/snapshot_controller"
4040
"github.com/uhthomas/automata/k8s/magiclove/speedtest_exporter"
41+
"github.com/uhthomas/automata/k8s/magiclove/spire"
4142
"github.com/uhthomas/automata/k8s/magiclove/thomas"
4243
// "github.com/uhthomas/automata/k8s/magiclove/trivy_system"
4344
"github.com/uhthomas/automata/k8s/magiclove/vector"
@@ -113,6 +114,7 @@ _items: [
113114
smartctl_exporter.#List.items,
114115
snapshot_controller.#List.items,
115116
speedtest_exporter.#List.items,
117+
spire.#List.items,
116118
thomas.#List.items,
117119
// trivy_system.#List.items,
118120
// vector.#List.items,
@@ -124,56 +126,4 @@ _items: [
124126
wireguard_operator.#List.items,
125127
]
126128

127-
// _items: [
128-
// magiclove.#ApplySetList.items,
129-
// magiclove.#ClusterIssuerList.items,
130-
// magiclove.#ClusterSecretStoreList.items,
131-
// magiclove.#CustomResourceDefinitionList.items,
132-
// magiclove.#GatewayClassList.items,
133-
// backup.#List.items,
134-
// cert_manager_csi_driver.#List.items,
135-
// cert_manager.#List.items,
136-
// cilium.#List.items,
137-
// cilium_secrets.#List.items,
138-
// dcgm_exporter.#List.items,
139-
// default.#List.items,
140-
// emqx.#List.items,
141-
// emqx_exporter.#List.items,
142-
// external_dns.#List.items,
143-
// external_secrets.#List.items,
144-
// // fluent_bit.#List.items,
145-
// frigate.#List.items,
146-
// gateway_api.#List.items,
147-
// grafana.#List.items,
148-
// grafana_operator.#List.items,
149-
// home_assistant.#List.items,
150-
// karma.#List.items,
151-
// kube_state_metrics.#List.items,
152-
// kube_system.#List.items,
153-
// media.#List.items,
154-
// metrics_server.#List.items,
155-
// minecraft.#List.items,
156-
// node_exporter.#List.items,
157-
// // node_feature_discovery.#List.items,
158-
// node_problem_detector.#List.items,
159-
// nvidia_device_plugin.#List.items,
160-
// onepassword_connect.#List.items,
161-
// ping_exporter.#List.items,
162-
// rook_ceph.#List.items,
163-
// scrutiny.#List.items,
164-
// smartctl_exporter.#List.items,
165-
// snapshot_controller.#List.items,
166-
// speedtest_exporter.#List.items,
167-
// tailscale.#List.items,
168-
// thomas.#List.items,
169-
// // trivy_system.#List.items,
170-
// vector.#List.items,
171-
// victoria_logs.#List.items,
172-
// vm_operator.#List.items,
173-
// vm.#List.items,
174-
// volsync_system.#List.items,
175-
// wireguard.#List.items,
176-
// wireguard_operator.#List.items,
177-
// ]
178-
179129
#List

‎k8s/magiclove/spire/BUILD.bazel‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
load("@com_github_tnarg_rules_cue//cue:cue.bzl", "cue_library")
2+
3+
cue_library(
4+
name = "cue_spire_library",
5+
srcs = [
6+
"config_map_list.cue",
7+
"list.cue",
8+
"namespace_list.cue",
9+
],
10+
importpath = "github.com/uhthomas/automata/k8s/magiclove/spire",
11+
visibility = ["//visibility:public"],
12+
deps = [
13+
"//cue.mod/gen/k8s.io/api/core/v1:cue_v1_library",
14+
"//k8s/magiclove/spire/agent:cue_agent_library",
15+
"//k8s/magiclove/spire/client:cue_client_library",
16+
"//k8s/magiclove/spire/server:cue_server_library",
17+
],
18+
)

‎k8s/magiclove/spire/README.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Spire
2+
3+
[https://spiffe.io/docs/latest/try/getting-started-k8s/](https://spiffe.io/docs/latest/try/getting-started-k8s/)
4+
5+
The CSI driver would be nice.
6+
7+
[https://github.com/spiffe/spiffe-csi](https://github.com/spiffe/spiffe-csi)
8+
9+
```sh
10+
❯ k exec -it sts/spire-server -- \
11+
/opt/spire/bin/spire-server entry create \
12+
-spiffeID spiffe://spire-magiclove.hipparcos.net/ns/spire/sa/spire-agent \
13+
-selector k8s_sat:cluster:magiclove \
14+
-selector k8s_sat:agent_ns:spire \
15+
-selector k8s_sat:agent_sa:spire-agent \
16+
-node
17+
Entry ID : b313a13a-bf78-4c92-9dd7-e1eee47658f0
18+
SPIFFE ID : spiffe://spire-magiclove.hipparcos.net/ns/spire/sa/spire-agent
19+
Parent ID : spiffe://spire-magiclove.hipparcos.net/spire/server
20+
Revision : 0
21+
X509-SVID TTL : default
22+
JWT-SVID TTL : default
23+
Selector : k8s_sat:agent_ns:spire
24+
Selector : k8s_sat:agent_sa:spire-agent
25+
Selector : k8s_sat:cluster:magiclove
26+
```
27+
28+
```sh
29+
❯ k exec -it sts/spire-server -- \
30+
/opt/spire/bin/spire-server entry create \
31+
-spiffeID spiffe://spire-magiclove.hipparcos.net/ns/default/sa/default \
32+
-parentID spiffe://spire-magiclove.hipparcos.net/ns/spire/sa/spire-agent \
33+
-selector k8s:ns:spire \
34+
-selector k8s:sa:default
35+
Entry ID : 95074358-a44a-4a66-9404-77a8fae994e2
36+
SPIFFE ID : spiffe://spire-magiclove.hipparcos.net/ns/default/sa/default
37+
Parent ID : spiffe://spire-magiclove.hipparcos.net/ns/spire/sa/spire-agent
38+
Revision : 0
39+
X509-SVID TTL : default
40+
JWT-SVID TTL : default
41+
Selector : k8s:ns:spire
42+
Selector : k8s:sa:default
43+
```
44+
45+
```sh
46+
❯ k exec -it deploy/spire-client -- /opt/spire/bin/spire-agent api fetch -socketPath /run/spire/sockets/agent.sock
47+
Received 1 svid after 87.184133ms
48+
49+
SPIFFE ID: spiffe://spire-magiclove.hipparcos.net/ns/default/sa/default
50+
SVID Valid After: 2025-01-16 01:31:24 +0000 UTC
51+
SVID Valid Until: 2025-01-16 02:31:34 +0000 UTC
52+
CA #1 Valid After: 2025-01-16 00:02:26 +0000 UTC
53+
CA #1 Valid Until: 2025-01-17 00:02:36 +0000 UTC
54+
```

‎k8s/magiclove/spire/agent/BUILD.bazel‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
load("@com_github_tnarg_rules_cue//cue:cue.bzl", "cue_library")
2+
3+
cue_library(
4+
name = "cue_agent_library",
5+
srcs = [
6+
"cluster_role_binding_list.cue",
7+
"cluster_role_list.cue",
8+
"config_map_list.cue",
9+
"daemon_set_list.cue",
10+
"list.cue",
11+
"service_account_list.cue",
12+
],
13+
importpath = "github.com/uhthomas/automata/k8s/magiclove/spire/agent",
14+
visibility = ["//visibility:public"],
15+
deps = [
16+
"//cue.mod/gen/k8s.io/api/apps/v1:cue_v1_library",
17+
"//cue.mod/gen/k8s.io/api/core/v1:cue_v1_library",
18+
"//cue.mod/gen/k8s.io/api/rbac/v1:cue_v1_library",
19+
],
20+
)

‎k8s/magiclove/spire/agent/cluster_role_binding_list.cue‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
package agent
2+
3+
import rbacv1 "k8s.io/api/rbac/v1"
4+
5+
#ClusterRoleBindingList: rbacv1.#ClusterRoleBindingList & {
6+
apiVersion: "rbac.authorization.k8s.io/v1"
7+
kind: "ClusterRoleBindingList"
8+
items: [...{
9+
apiVersion: "rbac.authorization.k8s.io/v1"
10+
kind: "ClusterRoleBinding"
11+
}]
12+
}
13+
14+
#ClusterRoleBindingList: items: [{
15+
subjects: [{
16+
kind: rbacv1.#ServiceAccountKind
17+
name: #Name
18+
namespace: #Namespace
19+
}]
20+
roleRef: {
21+
apiGroup: rbacv1.#GroupName
22+
kind: "ClusterRole"
23+
name: #Name
24+
}
25+
}]

‎k8s/magiclove/spire/agent/cluster_role_list.cue‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
package agent
2+
3+
import (
4+
"k8s.io/api/core/v1"
5+
rbacv1 "k8s.io/api/rbac/v1"
6+
)
7+
8+
#ClusterRoleList: rbacv1.#ClusterRoleList & {
9+
apiVersion: "rbac.authorization.k8s.io/v1"
10+
kind: "ClusterRoleList"
11+
items: [...{
12+
apiVersion: "rbac.authorization.k8s.io/v1"
13+
kind: "ClusterRole"
14+
}]
15+
}
16+
17+
#ClusterRoleList: items: [{
18+
rules: [{
19+
apiGroups: [v1.#GroupName]
20+
resources: ["pods", "nodes", "nodes/proxy"]
21+
verbs: ["get"]
22+
}]
23+
}]

‎k8s/magiclove/spire/agent/config_map_list.cue‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
package agent
2+
3+
import "k8s.io/api/core/v1"
4+
5+
#ConfigMapList: v1.#ConfigMapList & {
6+
apiVersion: "v1"
7+
kind: "ConfigMapList"
8+
items: [...{
9+
apiVersion: "v1"
10+
kind: "ConfigMap"
11+
}]
12+
}
13+
14+
#ConfigMapList: items: [{
15+
metadata: name: "spire-agent"
16+
data: "agent.conf": """
17+
agent {
18+
data_dir = "/run/spire"
19+
log_level = "DEBUG"
20+
server_address = "spire-server"
21+
server_port = "8081"
22+
socket_path = "/run/spire/sockets/agent.sock"
23+
trust_bundle_path = "/run/spire/bundle/bundle.crt"
24+
trust_domain = "spire-magiclove.hipparcos.net"
25+
}
26+
27+
plugins {
28+
NodeAttestor "k8s_sat" {
29+
plugin_data {
30+
cluster = "magiclove"
31+
}
32+
}
33+
34+
KeyManager "memory" {
35+
plugin_data {
36+
}
37+
}
38+
39+
WorkloadAttestor "k8s" {
40+
plugin_data {
41+
# Defaults to the secure kubelet port by default.
42+
# Minikube does not have a cert in the cluster CA bundle that
43+
# can authenticate the kubelet cert, so skip validation.
44+
skip_kubelet_verification = true
45+
node_name_env = "MY_NODE_NAME"
46+
}
47+
}
48+
49+
WorkloadAttestor "unix" {
50+
plugin_data {
51+
}
52+
}
53+
}
54+
55+
health_checks {
56+
listener_enabled = true
57+
bind_address = "0.0.0.0"
58+
bind_port = "8080"
59+
live_path = "/live"
60+
ready_path = "/ready"
61+
}
62+
63+
"""
64+
}]

‎k8s/magiclove/spire/agent/daemon_set_list.cue‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
package agent
2+
3+
import (
4+
appsv1 "k8s.io/api/apps/v1"
5+
"k8s.io/api/core/v1"
6+
)
7+
8+
#DaemonSetList: appsv1.#DaemonSetList & {
9+
apiVersion: "apps/v1"
10+
kind: "DaemonSetList"
11+
items: [...{
12+
apiVersion: "apps/v1"
13+
kind: "DaemonSet"
14+
}]
15+
}
16+
17+
#DaemonSetList: items: [{
18+
spec: {
19+
selector: matchLabels: "app.kubernetes.io/name": #Name
20+
template: {
21+
metadata:
22+
labels: "app.kubernetes.io/name": #Name
23+
spec: {
24+
volumes: [{
25+
name: "spire-config"
26+
configMap: name: #Name
27+
}, {
28+
name: "spire-bundle"
29+
configMap: name: "spire-bundle"
30+
}, {
31+
name: "spire-agent-socket"
32+
hostPath: {
33+
path: "/run/spire/sockets"
34+
type: v1.#HostPathDirectoryOrCreate
35+
}
36+
}]
37+
containers: [{
38+
name: "spire-agent"
39+
image: "ghcr.io/spiffe/spire-agent:\(#Version)"
40+
args: ["-config", "/run/spire/config/agent.conf"]
41+
ports: [{
42+
name: "healthz"
43+
containerPort: 8080
44+
}]
45+
env: [{
46+
name: "MY_NODE_NAME"
47+
valueFrom: fieldRef: fieldPath: "status.hostIP"
48+
}]
49+
volumeMounts: [{
50+
name: "spire-config"
51+
mountPath: "/run/spire/config"
52+
readOnly: true
53+
}, {
54+
name: "spire-bundle"
55+
mountPath: "/run/spire/bundle"
56+
}, {
57+
name: "spire-agent-socket"
58+
mountPath: "/run/spire/sockets"
59+
}]
60+
livenessProbe: {
61+
httpGet: {
62+
path: "/live"
63+
port: "healthz"
64+
}
65+
failureThreshold: 2
66+
initialDelaySeconds: 15
67+
periodSeconds: 60
68+
timeoutSeconds: 3
69+
}
70+
readinessProbe: {
71+
httpGet: {
72+
path: "/ready"
73+
port: "healthz"
74+
}
75+
initialDelaySeconds: 5
76+
periodSeconds: 5
77+
}
78+
securityContext: privileged: true
79+
}]
80+
serviceAccountName: #Name
81+
hostPID: true
82+
}
83+
}
84+
}
85+
}]

0 commit comments

Comments
 (0)