new quickstart structure (#138)

* new quickstart structure Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * adding statefulset files Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * adding emojis to readme Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * adjusting spacing Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * adjusting code prompts Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * fixing comment spacing Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * fixing typo Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * adjusting spacing Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * adjusted dir paths Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * adding service and removing redundant file Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * separating commands Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * more spacing for README Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * adding more explanation Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * installation links Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * using original server-statefulset Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * fixes for ease of use Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * nit fixes Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * nit fix Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * minor restructuring Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * using console for executable commands Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * fixing images Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * testing shell Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * console Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> * using console Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com> --------- Signed-off-by: Maia Iyer <maia.raj.iyer@gmail.com>
spiffe · Mar 16, 2023 · 57f1ffd · 57f1ffd
1 parent 6eb59e1
commit 57f1ffd
Show file tree

Hide file tree

Showing 21 changed files with 1,125 additions and 297 deletions.
diff --git a/USAGE.md b/USAGE.md
@@ -55,8 +55,6 @@ The above command is an example of how to run the frontend. This creates a UI av
 
 ## Tornjak
 
-WARNING: This is currently an experimental feature. 
-
 This container may be used as an alternative to having a frontend and backend container separately. The backend is configured exactly as the [Tornjak backend] with container arguments, and the frontend is configured exactly as the [Tornjak frontend] with container environment variables. 
 
 An example command:

diff --git a/docs/tornjak-quickstart.md → docs/quickstart/README.md b/docs/tornjak-quickstart.md → docs/quickstart/README.md
diff --git a/docs/quickstart/agent-account.yaml b/docs/quickstart/agent-account.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: spire-agent
+  namespace: spire
diff --git a/docs/quickstart/agent-cluster-role.yaml b/docs/quickstart/agent-cluster-role.yaml
@@ -0,0 +1,24 @@
+# Required cluster role to allow spire-agent to query k8s API server
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: spire-agent-cluster-role
+rules:
+- apiGroups: [""]
+  resources: ["pods","nodes","nodes/proxy"]
+  verbs: ["get"]
+
+---
+# Binds above cluster role to spire-agent service account
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: spire-agent-cluster-role-binding
+subjects:
+- kind: ServiceAccount
+  name: spire-agent
+  namespace: spire
+roleRef:
+  kind: ClusterRole
+  name: spire-agent-cluster-role
+  apiGroup: rbac.authorization.k8s.io
diff --git a/docs/quickstart/agent-configmap.yaml b/docs/quickstart/agent-configmap.yaml
@@ -0,0 +1,52 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: spire-agent
+  namespace: spire
+data:
+  agent.conf: |
+    agent {
+      data_dir = "/run/spire"
+      log_level = "DEBUG"
+      server_address = "spire-server"
+      server_port = "8081"
+      socket_path = "/run/spire/sockets/agent.sock"
+      trust_bundle_path = "/run/spire/bundle/bundle.crt"
+      trust_domain = "example.org"
+    }
+
+    plugins {
+      NodeAttestor "k8s_sat" {
+        plugin_data {
+          # NOTE: Change this to your cluster name
+          cluster = "demo-cluster"
+        }
+      }
+
+      KeyManager "memory" {
+        plugin_data {
+        }
+      }
+
+      WorkloadAttestor "k8s" {
+        plugin_data {
+          # Defaults to the secure kubelet port by default.
+          # Minikube does not have a cert in the cluster CA bundle that
+          # can authenticate the kubelet cert, so skip validation.
+          skip_kubelet_verification = true
+        }
+      }
+
+      WorkloadAttestor "unix" {
+          plugin_data {
+          }
+      }
+    }
+
+    health_checks {
+      listener_enabled = true
+      bind_address = "0.0.0.0"
+      bind_port = "8080"
+      live_path = "/live"
+      ready_path = "/ready"
+    }
diff --git a/docs/quickstart/agent-daemonset.yaml b/docs/quickstart/agent-daemonset.yaml
@@ -0,0 +1,66 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: spire-agent
+  namespace: spire
+  labels:
+    app: spire-agent
+spec:
+  selector:
+    matchLabels:
+      app: spire-agent
+  template:
+    metadata:
+      namespace: spire
+      labels:
+        app: spire-agent
+    spec:
+      hostPID: true
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      serviceAccountName: spire-agent
+      initContainers:
+        - name: init
+          # This is a small image with wait-for-it, choose whatever image
+          # you prefer that waits for a service to be up. This image is built
+          # from https://github.com/lqhl/wait-for-it
+          image: cgr.dev/chainguard/wait-for-it
+          args: ["-t", "30", "spire-server:8081"]
+      containers:
+        - name: spire-agent
+          image: ghcr.io/spiffe/spire-agent:1.5.1
+          args: ["-config", "/run/spire/config/agent.conf"]
+          volumeMounts:
+            - name: spire-config
+              mountPath: /run/spire/config
+              readOnly: true
+            - name: spire-bundle
+              mountPath: /run/spire/bundle
+            - name: spire-agent-socket
+              mountPath: /run/spire/sockets
+              readOnly: false
+          livenessProbe:
+            httpGet:
+              path: /live
+              port: 8080
+            failureThreshold: 2
+            initialDelaySeconds: 15
+            periodSeconds: 60
+            timeoutSeconds: 3
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 5
+      volumes:
+        - name: spire-config
+          configMap:
+            name: spire-agent
+        - name: spire-bundle
+          configMap:
+            name: spire-bundle
+        - name: spire-agent-socket
+          hostPath:
+            path: /run/spire/sockets
+            type: DirectoryOrCreate
diff --git a/docs/quickstart/client-deployment.yaml b/docs/quickstart/client-deployment.yaml
@@ -0,0 +1,32 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: client
+  labels:
+    app: client
+spec:
+  selector:
+    matchLabels:
+      app: client
+  template:
+    metadata:
+      labels:
+        app: client
+    spec:
+      hostPID: true
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      containers:
+        - name: client
+          image: ghcr.io/spiffe/spire-agent:1.5.1
+          command: ["/opt/spire/bin/spire-agent"]
+          args: [ "api", "watch",  "-socketPath", "/run/spire/sockets/agent.sock" ]
+          volumeMounts:
+            - name: spire-agent-socket
+              mountPath: /run/spire/sockets
+              readOnly: true
+      volumes:
+        - name: spire-agent-socket
+          hostPath:
+            path: /run/spire/sockets
+            type: Directory
diff --git a/docs/quickstart/create-node-registration-entry.sh b/docs/quickstart/create-node-registration-entry.sh
@@ -0,0 +1,16 @@
+#/bin/bash
+
+set -e
+
+bb=$(tput bold)
+nn=$(tput sgr0)
+
+
+echo "${bb}Creating registration entry for the node...${nn}"
+kubectl exec -n spire spire-server-0 -- \
+    /opt/spire/bin/spire-server entry create \
+    -node  \
+    -spiffeID spiffe://example.org/ns/spire/sa/spire-agent \
+    -selector k8s_sat:cluster:demo-cluster \
+    -selector k8s_sat:agent_ns:spire \
+    -selector k8s_sat:agent_sa:spire-agent
diff --git a/docs/quickstart/kustomization.yaml b/docs/quickstart/kustomization.yaml
@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: spire
+
+resources:
+- spire-namespace.yaml
+- agent-account.yaml
+- agent-cluster-role.yaml
+- agent-configmap.yaml
+- agent-daemonset.yaml
+- server-account.yaml
+- server-cluster-role.yaml
+- server-configmap.yaml
+- server-service.yaml
+- server-statefulset.yaml
+- spire-bundle-configmap.yaml
+
diff --git a/docs/quickstart/server-account.yaml b/docs/quickstart/server-account.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: spire-server
+  namespace: spire
diff --git a/docs/quickstart/server-cluster-role.yaml b/docs/quickstart/server-cluster-role.yaml
@@ -0,0 +1,49 @@
+# Role (namespace scoped) to be able to push certificate bundles to a configmap
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: spire-server-configmap-role
+  namespace: spire
+rules:
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["patch", "get", "list"]
+---
+# Binds above role to spire-server service account
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: spire-server-configmap-role-binding
+  namespace: spire
+subjects:
+- kind: ServiceAccount
+  name: spire-server
+  namespace: spire
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: spire-server-configmap-role
+---
+# ClusterRole to allow spire-server node attestor to query Token Review API
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: spire-server-trust-role
+rules:
+- apiGroups: ["authentication.k8s.io"]
+  resources: ["tokenreviews"]
+  verbs: ["create"]
+---
+# Binds above cluster role to spire-server service account
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: spire-server-trust-role-binding
+subjects:
+- kind: ServiceAccount
+  name: spire-server
+  namespace: spire
+roleRef:
+  kind: ClusterRole
+  name: spire-server-trust-role
+  apiGroup: rbac.authorization.k8s.io
diff --git a/docs/quickstart/server-configmap.yaml b/docs/quickstart/server-configmap.yaml
@@ -0,0 +1,63 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: spire-server
+  namespace: spire
+data:
+  server.conf: |
+    server {
+      bind_address = "0.0.0.0"
+      bind_port = "8081"
+      socket_path = "/tmp/spire-server/private/api.sock"
+      trust_domain = "example.org"
+      data_dir = "/run/spire/data"
+      log_level = "DEBUG"
+      #AWS requires the use of RSA.  EC cryptography is not supported
+      ca_key_type = "rsa-2048"
+
+      ca_subject = {
+        country = ["US"],
+        organization = ["SPIFFE"],
+        common_name = "",
+      }
+    }
+
+    plugins {
+      DataStore "sql" {
+        plugin_data {
+          database_type = "sqlite3"
+          connection_string = "/run/spire/data/datastore.sqlite3"
+        }
+      }
+
+      NodeAttestor "k8s_sat" {
+        plugin_data {
+          clusters = {
+            # NOTE: Change this to your cluster name
+            "demo-cluster" = {
+              use_token_review_api_validation = true
+              service_account_allow_list = ["spire:spire-agent"]
+            }
+          }
+        }
+      }
+
+      KeyManager "disk" {
+        plugin_data {
+          keys_path = "/run/spire/data/keys.json"
+        }
+      }
+
+      Notifier "k8sbundle" {
+        plugin_data {
+        }
+      }
+    }
+
+    health_checks {
+      listener_enabled = true
+      bind_address = "0.0.0.0"
+      bind_port = "8080"
+      live_path = "/live"
+      ready_path = "/ready"
+    }