feat(spire): auto-provision commented server.conf and agent.conf on boot via spire-init
This commit is contained in:
parent
edf66037ca
commit
3210eb2528
146
infra/setup.ts
146
infra/setup.ts
@ -145,10 +145,149 @@ export function generateSpireDockerCompose(): string {
|
||||
return `version: "3.8"
|
||||
|
||||
services:
|
||||
spire-init:
|
||||
image: \${REG}/library/alpine:3.20
|
||||
restart: "no"
|
||||
volumes:
|
||||
- spire-server-conf:/opt/spire/server/conf
|
||||
- spire-server-data:/opt/spire/server/data
|
||||
- spire-agent-conf:/opt/spire/agent/conf
|
||||
- spire-agent-data:/opt/spire/agent/data
|
||||
entrypoint:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
mkdir -p /opt/spire/server/conf /opt/spire/server/data /opt/spire/agent/conf /opt/spire/agent/data
|
||||
if [ ! -f /opt/spire/server/conf/server.conf ]; then
|
||||
echo "Writing default SPIRE server.conf..."
|
||||
cat << 'EOF' > /opt/spire/server/conf/server.conf
|
||||
# ==============================================================================
|
||||
# SPIRE Server Configuration
|
||||
# Auth-Yes Identity & Access Management Fabric
|
||||
# ==============================================================================
|
||||
# This configuration defines the root SPIFFE trust authority for your cluster.
|
||||
# You can customize trust domains, certificate TTLs, and datastore plugins below.
|
||||
# ==============================================================================
|
||||
|
||||
server {
|
||||
# Network binding: 0.0.0.0 listens on all internal mesh interfaces.
|
||||
bind_address = "0.0.0.0"
|
||||
bind_port = "8081"
|
||||
|
||||
# Trust Domain: Identifies the root cryptographic security domain.
|
||||
# SPIFFE IDs will be generated in the format: spiffe://<trust_domain>/<workload>
|
||||
trust_domain = "system.local"
|
||||
|
||||
# Directory where SPIRE server persists runtime data, datastore, and keys.
|
||||
data_dir = "/opt/spire/data"
|
||||
|
||||
# Logging verbosity: DEBUG, INFO, WARN, ERROR
|
||||
log_level = "INFO"
|
||||
|
||||
# Certificate Authority (CA) Time-to-Live (default: 30 days)
|
||||
ca_ttl = "720h"
|
||||
|
||||
# Default Workload SVID Time-to-Live (default: 1 hour for high-security rotation)
|
||||
default_x509_svid_ttl = "1h"
|
||||
}
|
||||
|
||||
plugins {
|
||||
# ----------------------------------------------------------------------------
|
||||
# DataStore Plugin: Persists SPIFFE registrations, entries, and nodes.
|
||||
# Default: Embedded SQLite3 datastore inside /opt/spire/data.
|
||||
# ----------------------------------------------------------------------------
|
||||
DataStore "sql" {
|
||||
plugin_data {
|
||||
database_type = "sqlite3"
|
||||
connection_string = "/opt/spire/data/datastore.sqlite3"
|
||||
}
|
||||
}
|
||||
|
||||
# ----------------------------------------------------------------------------
|
||||
# NodeAttestor Plugin: Verifies identity of SPIRE agents joining the cluster.
|
||||
# 'join_token' allows dynamic 1-time token enrollment for agents.
|
||||
# ----------------------------------------------------------------------------
|
||||
NodeAttestor "join_token" {
|
||||
plugin_data {}
|
||||
}
|
||||
|
||||
# ----------------------------------------------------------------------------
|
||||
# KeyManager Plugin: Securely stores the server CA private keys on disk.
|
||||
# ----------------------------------------------------------------------------
|
||||
KeyManager "disk" {
|
||||
plugin_data {
|
||||
keys_path = "/opt/spire/data/keys.json"
|
||||
}
|
||||
}
|
||||
}
|
||||
EOF
|
||||
fi
|
||||
|
||||
if [ ! -f /opt/spire/agent/conf/agent.conf ]; then
|
||||
echo "Writing default SPIRE agent.conf..."
|
||||
cat << 'EOF' > /opt/spire/agent/conf/agent.conf
|
||||
# ==============================================================================
|
||||
# SPIRE Agent Configuration
|
||||
# Auth-Yes Identity & Access Management Fabric
|
||||
# ==============================================================================
|
||||
# The SPIRE Agent runs as a local node daemon, attesting workloads (e.g. Docker
|
||||
# containers) and serving the Workload API UNIX domain socket.
|
||||
# ==============================================================================
|
||||
|
||||
agent {
|
||||
# Directory where the SPIRE agent caches SVIDs, bundles, and keys.
|
||||
data_dir = "/opt/spire/data"
|
||||
|
||||
# Logging verbosity: DEBUG, INFO, WARN, ERROR
|
||||
log_level = "INFO"
|
||||
|
||||
# Address and port of the SPIRE Server container within the internal network.
|
||||
server_address = "spire-server"
|
||||
server_port = "8081"
|
||||
|
||||
# UNIX Domain Socket Path exposed to workloads for zero-trust identity fetching.
|
||||
socket_path = "/var/run/spire/agent.sock"
|
||||
|
||||
# Must match the SPIRE Server's trust_domain.
|
||||
trust_domain = "system.local"
|
||||
}
|
||||
|
||||
plugins {
|
||||
# ----------------------------------------------------------------------------
|
||||
# NodeAttestor Plugin: Authenticates this agent with the SPIRE Server.
|
||||
# ----------------------------------------------------------------------------
|
||||
NodeAttestor "join_token" {
|
||||
plugin_data {}
|
||||
}
|
||||
|
||||
# ----------------------------------------------------------------------------
|
||||
# KeyManager Plugin: Stores node-level private keys on disk.
|
||||
# ----------------------------------------------------------------------------
|
||||
KeyManager "disk" {
|
||||
plugin_data {
|
||||
directory = "/opt/spire/data"
|
||||
}
|
||||
}
|
||||
|
||||
# ----------------------------------------------------------------------------
|
||||
# WorkloadAttestor Plugin: Inspects running containers on Docker / Podman
|
||||
# to grant SPIFFE SVIDs based on container image, labels, or names.
|
||||
# ----------------------------------------------------------------------------
|
||||
WorkloadAttestor "docker" {
|
||||
plugin_data {}
|
||||
}
|
||||
}
|
||||
EOF
|
||||
fi
|
||||
echo "SPIRE bootstrap configuration initialized successfully."
|
||||
|
||||
spire-server:
|
||||
image: \${GHCR_REG}/spiffe/spire-server:1.9.3
|
||||
container_name: spire-server
|
||||
hostname: spire-server
|
||||
depends_on:
|
||||
spire-init:
|
||||
condition: service_completed_successfully
|
||||
networks:
|
||||
- auth-internal-net
|
||||
volumes:
|
||||
@ -161,6 +300,11 @@ services:
|
||||
container_name: spire-agent
|
||||
hostname: spire-agent
|
||||
pid: host
|
||||
depends_on:
|
||||
spire-server:
|
||||
condition: service_started
|
||||
spire-init:
|
||||
condition: service_completed_successfully
|
||||
networks:
|
||||
- auth-internal-net
|
||||
volumes:
|
||||
@ -169,8 +313,6 @@ services:
|
||||
- spire-agent-conf:/opt/spire/conf:ro
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
command: ["-config", "/opt/spire/conf/agent.conf"]
|
||||
depends_on:
|
||||
- spire-server
|
||||
|
||||
volumes:
|
||||
spire-server-data:
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user