Add basic CSI driver for the spiffe-helper

.github/tests/charts.json

@@ -23,5 +23,10 @@
     "name": "postgresql",
     "repo": "https://charts.bitnami.com/bitnami",
     "version": "16.0.3"
+  },
+  {
+    "name": "kyverno",
+    "repo": "https://kyverno.github.io/kyverno",
+    "version": "3.1.1"
   }
 ]

.github/tests/pre-install.sh

@@ -47,3 +47,8 @@ kubectl wait --namespace ingress-nginx --for=condition=ready --timeout 60s pod -
   --namespace postgresql \
   --values "${DEPS}/postgresql.yaml" \
   --wait
+
+# kyverno
+"${helm_install[@]}" kyverno kyverno --version "$VERSION_KYVERNO" --repo "$HELM_REPO_KYVERNO" \
+  --namespace kyverno-system \
+  --wait

charts/spiffe-helper-csi-driver/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/spiffe-helper-csi-driver/Chart.yaml

@@ -0,0 +1,26 @@
+apiVersion: v2
+name: spiffe-helper-csi-driver
+description: >
+  A Helm chart for deploying the Spiffe Helper CSI Drier
+type: application
+version: 0.1.0
+appVersion: "0.0.1"
+keywords: ["spiffe-helper-csi-driver"]
+home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
+sources:
+  - https://github.com/spiffe/helm-charts/tree/main/charts/spire
+icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
+maintainers:
+  - name: marcofranssen
+    email: [email protected]
+    url: https://marcofranssen.nl
+  - name: kfox1111
+    email: [email protected]
+  - name: faisal-memon
+    email: [email protected]
+  - name: edwbuck
+    email: [email protected]
+dependencies:
+  - name: spire-lib
+    repository: file://../spire/charts/spire-lib
+    version: 0.1.0

charts/spiffe-helper-csi-driver/README.md

@@ -0,0 +1,56 @@
+# spire-helper-csi-driver
+
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square)
+
+A *prototype* Helm chart to install the SPIFFE HELPER CSI Driver. It is useful only for testing at this point. Please do not use in production.
+
+**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
+
+## Maintainers
+
+| Name | Email | Url |
+| ---- | ------ | --- |
+| marcofranssen | <[email protected]> | <https://marcofranssen.nl> |
+| kfox1111 | <[email protected]> |  |
+| faisal-memon | <[email protected]> |  |
+| edwbuck | <[email protected]> |  |
+
+## Source Code
+
+* <https://github.com/spiffe/helm-charts/tree/main/charts/spiffe-helpe-csi-driver>
+
+## Prereqs:
+
+Your cluster needs to have Kyverno installed. You can do that by running something like the following:
+
+```
+helm upgrade --install --create-namespace kyverno kyverno -n kyverno --repo https://kyverno.github.io/kyverno/ --version 3.1.1
+```
+
+You also need SPIRE installed. You can do that by running something like the following for a non production test cluster:
+
+```
+helm install -n spire-server spire-crds spire-crds --repo https://spiffe.github.io/helm-charts-hardened/ --create-namespace
+helm install -n spire-server spire spire --repo https://spiffe.github.io/helm-charts-hardened/
+```
+
+## Build Instructions
+
+Until there is an official release of this chart, before you can use it out of git, you have to run
+```
+cd charts/spiffe-helper-csi-driver
+helm dep up
+```
+
+## Install Instructions
+```
+helm install -n spire-server spiffe-helper-csi-driver charts/spiffe-helper-csi-driver
+```
+
+## Example usage
+
+See the examples/good directory for different ways of using the driver.
+
+<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
+
+## Parameters

charts/spiffe-helper-csi-driver/examples/bad/test-pod.yaml

@@ -0,0 +1,50 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: bad-test
+spec:
+  # shareProcessNamespace: true
+  # hostPID: true
+  containers:
+  - name: nginx
+    image: nginx
+    command:
+    - /bin/sh
+    - -c
+    - |
+      echo $$$$ > $$SPIFFE_HELPER_PID_CERTS
+      cat > /etc/nginx/conf.d/ssl.conf <<EOF
+      server {
+          listen       443 ssl;
+          server_name  localhost;
+          ssl_certificate     /certs/tls.crt;
+          ssl_certificate_key /certs/tls.key;
+          location / {
+              root   /usr/share/nginx/html;
+              index  index.html index.htm;
+          }
+          error_page   500 502 503 504  /50x.html;
+          location = /50x.html {
+              root   /usr/share/nginx/html;
+          }
+      }
+      EOF
+      exec nginx -g "daemon off;"
+    volumeMounts:
+    - name: certs
+      mountPath: /certs
+    ports:
+    - containerPort: 443
+  volumes:
+  - name: certs
+    csi:
+      driver: helper.spiffe.io
+      volumeAttributes:
+        renewSignal: SIGHUP
+        pidContainer: nginx
+
+        addIntermediatesToBundle: "true"
+
+        svidFileName: tls.crt
+        svidKeyFileName: tls.key
+        svidBundleFileName: ca.pem

charts/spiffe-helper-csi-driver/examples/good/custom-sidecar-pod.yaml

@@ -0,0 +1,34 @@
+# NOTE:
+#   This example shows how you can use a custom image for your sidecar
+#   enabling you to run specific commands whenever a certificate is updated.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: custom-sidecar
+spec:
+  containers:
+  - name: busybox
+    image: busybox
+    command:
+    - /bin/sh
+    - -c
+    - 'while true; do sleep 1000; done'
+    volumeMounts:
+    - name: certs
+      mountPath: /certs
+  - name: sidecar
+    image: mysql
+    env:
+    - name: some-setting
+      value: foo
+  volumes:
+  - name: certs
+    csi:
+      driver: helper.spiffe.io
+      volumeAttributes:
+        customSidecar: sidecar
+        cmd: "bash"
+        cmdArgs: "-c \"echo rolled. Could do a mysql cli command here.\""
+        svidBundleFileName: ca.pem
+        svidFileName: tls.crt
+        svidKeyFileName: tls.key

charts/spiffe-helper-csi-driver/examples/good/nginx.yaml

@@ -0,0 +1,49 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+spec:
+  shareProcessNamespace: true
+  containers:
+  - name: nginx
+    image: nginx
+    command:
+    - /bin/sh
+    - -c
+    - |
+      echo $$$$ > $$SPIFFE_HELPER_PID_CERTS
+      cat > /etc/nginx/conf.d/ssl.conf <<EOF
+      server {
+          listen       443 ssl;
+          server_name  localhost;
+          ssl_certificate     /certs/tls.crt;
+          ssl_certificate_key /certs/tls.key;
+          location / {
+              root   /usr/share/nginx/html;
+              index  index.html index.htm;
+          }
+          error_page   500 502 503 504  /50x.html;
+          location = /50x.html {
+              root   /usr/share/nginx/html;
+          }
+      }
+      EOF
+      exec nginx -g "daemon off;"
+    volumeMounts:
+    - name: certs
+      mountPath: /certs
+    ports:
+    - containerPort: 443
+  volumes:
+  - name: certs
+    csi:
+      driver: helper.spiffe.io
+      volumeAttributes:
+        renewSignal: SIGHUP
+        pidContainer: nginx
+
+        addIntermediatesToBundle: "true"
+
+        svidFileName: tls.crt
+        svidKeyFileName: tls.key
+        svidBundleFileName: ca.pem