From bc260badfca535b00bc792804591ddc22c27f65a Mon Sep 17 00:00:00 2001 From: Sakari Poussa Date: Wed, 29 Jun 2022 10:33:08 +0300 Subject: [PATCH] Make charts --- assets/intel-tcs-issuer/tcs-issuer-0.1.0.tgz | Bin 0 -> 2749 bytes .../tcs-issuer/0.1.0/.helmignore | 23 ++ .../tcs-issuer/0.1.0/Chart.yaml | 13 + .../tcs-issuer/0.1.0/app-readme.md | 11 + .../tcs-issuer/0.1.0/templates/NOTES.txt | 1 + .../0.1.0/templates/tcs_issuer.yaml | 376 ++++++++++++++++++ .../tcs-issuer/0.1.0/values.yaml | 10 + index.yaml | 18 + 8 files changed, 452 insertions(+) create mode 100644 assets/intel-tcs-issuer/tcs-issuer-0.1.0.tgz create mode 100644 charts/intel-tcs-issuer/tcs-issuer/0.1.0/.helmignore create mode 100644 charts/intel-tcs-issuer/tcs-issuer/0.1.0/Chart.yaml create mode 100644 charts/intel-tcs-issuer/tcs-issuer/0.1.0/app-readme.md create mode 100644 charts/intel-tcs-issuer/tcs-issuer/0.1.0/templates/NOTES.txt create mode 100644 charts/intel-tcs-issuer/tcs-issuer/0.1.0/templates/tcs_issuer.yaml create mode 100644 charts/intel-tcs-issuer/tcs-issuer/0.1.0/values.yaml diff --git a/assets/intel-tcs-issuer/tcs-issuer-0.1.0.tgz b/assets/intel-tcs-issuer/tcs-issuer-0.1.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..83e06b337eb0a47a82e7447795d77f1c48f682e7 GIT binary patch literal 2749 zcmV;u3PSZCiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI_9bK5r7&S(CL^TwSwmnkojui;E~$92-w+a~eYj%Q~(I~fo> zB2j?=3xKla#QWQK0Fo9d$#&(~>1B-%5(OL{JUBNTTx6*BnbsAma4#py1XEJ*M|WGI zD2lc=Hr#g(0K@P{N(gsu5 zt65ND5cZv|EoGsQBhlEfm>H%=N_K)uGbv)23_Vhomp`Lm5JX;znkrTrSG5a2ATNMg zYle|jOJN+LnlOs4{l_XnCD5RT15V6Hs=~{q#gH3Q>NpHDX7VZts4PNeM;4lzrB7!p zTd<5;5bc{}LJUzls5w*`6_vuEFpgOj4z_o8c6PRgf7dUEQS|?lmmA)=O7L=gPyY52 z2EpKkA3gCFF+~oi3!|i$h-y9Ae{Qqkd zR*(#>=jT-tgR^cApfRf}w>H6W67@F6wC?p2m zV^yZ@V|m%0B1eOZ-BT%5%0yQpi+J3y?jOrCQQ*X8cKxn9{A;GSQ1%|T8K}BO=LH(Y zsP>i9{Y-yCio*uuhr^#5NMS?0D5HD9Rw{Wmt*!7XyRu!NFwOeyO4S-UMxk)R@N~J9 zmolEmzQ|Ws$uCF^p%k^gmjB(!$8ls*9J2zoAw?O3s5tLQ?pm2WdH!U{NRTSL#snK{ zUg{Ga^RL}w(f{o7q9B4~sFn({vqVz(YlV6q%0j0zN4uZy!x0mNvvX8)NSf~MrW0+5 zsje96!U&gk*>KcX+Gv-EWrB%pxrBeCvR9S+7vQ^<3cjSj`_zV;E}LjXHLabyNfHg! zf!jK8yIRj%qAOeHeV1ioK}NQ65o3?nA}2SG6Ju;(aeJEgZX&A!TG=L6?%>Oe;D+wz zRj>QHzRRGuDw5g2yMR^{$L;db@0duL$W};8lje;Tvs20O5J#4ME39iUdH|i2`Nl-K z$pzeuyL1`w2T1-qImPudpQT={q;Dy^ZWePzZugfG+&zlyk0Gqdz-vc6+vfOKujSls zM+~1m05{~zmuB10zN&;_1qPaBdM0MV%bX0{dyNn--*{W6RC}%mN0B4pCXd~7`|Ci- z#HnUCO%-Y#L%b91tUH=!)zZF@bg2fz?H~%GU|`83M{$ZtF6Fo-FQqauyx7>Nnbp4k zx^exMs8j3q{jsU<&i*kZ$qTwpHr4~3opoaK<%mZtdrQhIEQ_`RxFhXpSuzpBNyJZ+ z5C7PkCUp3oZoQ4RPR>1mN~3b^AJ)GU$(#M@@dv*Cuag)2=!Xx}%WV$3X1IQPqa0H` z7&!1NLa$Hf-k0RpYH?zj-)iZB;3PrbsJpQ|zvM*pPyd#!f*Vg+5veYb+TN_CG&5w) z+MQy0Gb7q*jmQv{p*e7sEs=K9iBvb?o)-lvOFauzudw8DTHxHa)9NDWoG#r?8VcRH zs`asj(G@mv_^E^GdQ|PsYTUZ><+xm+=^w$@rRQOx183))2}@DMKu{NH>$*J{*8>4) zN7qskW>fFB#s{LZ4lf`4Ub4_@I47l_;=~;o_G`J!d~RD_ZuZ(*Gqn-SCv^yWX#>}= zM^;BfJKO{pY1ezS*3bQtiI?AeIC_2f@nHX5uUX5w@#uZ8>C-14*a(7?`pA39DWkQ7 zF7+uh`6~3LtCnz1t+t?;bV+JgSda>U zJLmsi$s+DlLbHSNBTkzszgxyQjoXkq*K|X~?4y}e!|k!S;C~w=^?5fuwqc;rrmG6_ zDuIiOaG_q*r(f|xgCQAQTs-b`KIoi+FT623BJXOKvk3~++GPOU!P>z322FqbB{6vn zVeKO4{iZrbcRd7v31%4KuaJ}J5mG5q8_=Q-MTv^Zbk?>rYh1W-(l#h0DO(w|eQSCj zm^VAXI*Y`agbQYL9}+Dq%QGr^wFMSZO=DP(-m<wO_Yb$$8=CNfl zGhrg6xjYr!DdMp6V>61P*nV{1x&c`eP?Abd6M1%ZG}s@#ljcC7Mq%b0%#Pu!2ut^t zTJLULXW3#<70t=h8$~D{%!P|qRyFR926Cxuyj{Po@lS{fIZLh`LY+RpV#=jm)Awqx z-MqVEh`;wq>YuZ8R1oCI3zi9~@NWCK>Hg2=;{D%^?T7n+U!|N-z`zS$9eq49QlYm7d$K5`fRnu=NSV@J zkTDaw&lS0#+>^yNJd^l9lm4-zu=o(HC|&r-3> zd;TA94Niz+veK~s>b3TQQpsQJq9|Y~lCUOM@)s|dXev_-{|q6i!y|4F7&+XF4I3f-aC2*OatlOsqY*s zLUUl*y|ex;oaT(?P%3GV8Vx3&(T#Dcq0;uz{iWcEhNCzC1cNjelFMuw!13PEEFk^d z>9>cl;dfZ4-~WEv-p?Oj(z`z~NUB4HBUC6ThV``wpHwCn?(;nCUWINz`j^MA&uol? zpSuU?z0s@r-sg_o>;9<}6icJS#q;*?8SEbH>i~{(bWhN1327h#km#wq!JVl(#2VSv zLr3N|gwq^|hJ9_A44j@1l9;cU;m9_Jvj6Ho;vH@{W@wB<8B=p7qzWsgiH~h zVvq&j!tQyc5MJ%+$$EXUR8V~8`A#wIsDE$se<%;-p*)oT+4A22009606=v(706G8w D1L$Z8 literal 0 HcmV?d00001 diff --git a/charts/intel-tcs-issuer/tcs-issuer/0.1.0/.helmignore b/charts/intel-tcs-issuer/tcs-issuer/0.1.0/.helmignore new file mode 100644 index 000000000..0e8a0eb36 --- /dev/null +++ b/charts/intel-tcs-issuer/tcs-issuer/0.1.0/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/intel-tcs-issuer/tcs-issuer/0.1.0/Chart.yaml b/charts/intel-tcs-issuer/tcs-issuer/0.1.0/Chart.yaml new file mode 100644 index 000000000..6d203cd61 --- /dev/null +++ b/charts/intel-tcs-issuer/tcs-issuer/0.1.0/Chart.yaml @@ -0,0 +1,13 @@ +annotations: + catalog.cattle.io/certified: partner + catalog.cattle.io/display-name: Intel Trusted Certificate Issuer + catalog.cattle.io/release-name: tcs-issuer +apiVersion: v2 +appVersion: 0.1.0 +description: A Helm chart for Trusted Certificate Service for Kubernetes Platform +home: https://github.com/intel/trusted-certificate-issuer +icon: https://avatars.githubusercontent.com/u/17888862?s=200&v=4 +kubeVersion: '>= 1.19-0' +name: tcs-issuer +type: application +version: 0.1.0 diff --git a/charts/intel-tcs-issuer/tcs-issuer/0.1.0/app-readme.md b/charts/intel-tcs-issuer/tcs-issuer/0.1.0/app-readme.md new file mode 100644 index 000000000..d091e9ab6 --- /dev/null +++ b/charts/intel-tcs-issuer/tcs-issuer/0.1.0/app-readme.md @@ -0,0 +1,11 @@ +# Trusted Certificate Service + +## Introduction + +Trusted Certificate Service (TCS) is a Kubernetes certificate signing application, which protects the signing keys using Intel's SGX technology. TCS supports [Kubernetes Certificate Signing Request](https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/) and [cert-manager certificate request](https://cert-manager.io/docs/concepts/certificaterequest/) APIs. The APIs provides an easy integration to Kubernetes applications such as Istio. + +## Prerequisites + +- Helm 3.x +- Kubernetes cluster with at least one SGX node (e.g., Azure DCsv3 instance) +- Cert-manager \ No newline at end of file diff --git a/charts/intel-tcs-issuer/tcs-issuer/0.1.0/templates/NOTES.txt b/charts/intel-tcs-issuer/tcs-issuer/0.1.0/templates/NOTES.txt new file mode 100644 index 000000000..c5615c64c --- /dev/null +++ b/charts/intel-tcs-issuer/tcs-issuer/0.1.0/templates/NOTES.txt @@ -0,0 +1 @@ +Thank you for installing {{ .Chart.Name }}. diff --git a/charts/intel-tcs-issuer/tcs-issuer/0.1.0/templates/tcs_issuer.yaml b/charts/intel-tcs-issuer/tcs-issuer/0.1.0/templates/tcs_issuer.yaml new file mode 100644 index 000000000..7f4b1f99b --- /dev/null +++ b/charts/intel-tcs-issuer/tcs-issuer/0.1.0/templates/tcs_issuer.yaml @@ -0,0 +1,376 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: tcs-issuer-serviceaccount + namespace: {{ .Release.Namespace | quote }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: tcs-leader-election-role + namespace: {{ .Release.Namespace | quote }} +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tcs-metrics-reader +rules: +- nonResourceURLs: + - /metrics + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tcs-proxy-role +rules: +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + creationTimestamp: null + name: tcs-role +rules: +- apiGroups: + - '*' + resources: + - secrets + verbs: + - create + - delete + - get + - list + - update + - watch +- apiGroups: + - cert-manager.io + resources: + - certificaterequests + verbs: + - get + - list + - patch + - update + - watch +- apiGroups: + - cert-manager.io + resources: + - certificaterequests/finalizers + verbs: + - update +- apiGroups: + - cert-manager.io + resources: + - certificaterequests/status + verbs: + - get + - patch + - update +- apiGroups: + - certificates.k8s.io + resources: + - certificatesigningrequests + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - certificates.k8s.io + resources: + - certificatesigningrequests/finalizers + verbs: + - update +- apiGroups: + - certificates.k8s.io + resources: + - certificatesigningrequests/status + verbs: + - get + - patch + - update +- apiGroups: + - certificates.k8s.io + resourceNames: + - tcsclusterissuer.tcs.intel.com/* + - tcsissuer.tcs.intel.com/* + resources: + - signers + verbs: + - sign +- apiGroups: + - tcs.intel.com + resources: + - quoteattestations + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - tcs.intel.com + resources: + - quoteattestations/finalizers + verbs: + - update +- apiGroups: + - tcs.intel.com + resources: + - quoteattestations/status + verbs: + - get + - patch + - update +- apiGroups: + - tcs.intel.com + resources: + - tcsclusterissuers + - tcsissuers + verbs: + - get + - list + - patch + - update + - watch +- apiGroups: + - tcs.intel.com + resources: + - tcsclusterissuers/status + - tcsissuers/status + verbs: + - get + - patch + - update +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tcs-leader-election-rolebinding + namespace: {{ .Release.Namespace | quote }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: tcs-leader-election-role +subjects: +- kind: ServiceAccount + name: tcs-issuer-serviceaccount + namespace: {{ .Release.Namespace | quote }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tcs-proxy-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: tcs-proxy-role +subjects: +- kind: ServiceAccount + name: tcs-issuer-serviceaccount + namespace: {{ .Release.Namespace | quote }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tcs-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: tcs-role +subjects: +- kind: ServiceAccount + name: tcs-issuer-serviceaccount + namespace: {{ .Release.Namespace | quote }} +--- +apiVersion: v1 +data: + tcs_issuer_config.yaml: | + apiVersion: controller-runtime.sigs.k8s.io/v1alpha1 + kind: ControllerManagerConfig + health: + healthProbeBindAddress: :8083 + metrics: + bindAddress: 127.0.0.1:8080 + webhook: + port: 9443 + leaderElection: + leaderElect: true + resourceName: bb9c3a43.sgx.intel.com +kind: ConfigMap +metadata: + name: tcs-config + namespace: {{ .Release.Namespace | quote }} +--- +apiVersion: v1 +data: + sopin: V0lwbUJCybc2Oc6M06Vz + userpin: U3BnbGIyTUl3ZV9lSHUy +kind: Secret +metadata: + name: tcs-issuer-pkcs11-conf + namespace: {{ .Release.Namespace | quote }} +type: Opaque +--- +apiVersion: v1 +kind: Service +metadata: + labels: + control-plane: tcs-issuer + name: tcs-metrics-service + namespace: {{ .Release.Namespace | quote }} +spec: + ports: + - name: https + port: 8443 + targetPort: https + selector: + control-plane: tcs-issuer +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + control-plane: tcs-issuer + name: tcs-controller + namespace: {{ .Release.Namespace | quote }} +spec: + replicas: 1 + selector: + matchLabels: + control-plane: tcs-issuer + template: + metadata: + annotations: + sgx.intel.com/quote-provider: aesmd + labels: + control-plane: tcs-issuer + spec: + containers: + - args: + - --leader-elect + - --zap-devel + - --zap-log-level=5 + - --metrics-bind-address=:8082 + - --health-probe-bind-address=:8083 + - --user-pin=$USER_PIN + - --so-pin=$SO_PIN + {{- if .Values.controllerExtraArgs }} + {{- with .Values.controllerExtraArgs }} + {{- tpl . $ | trim | nindent 8 }} + {{- end }} + {{- end }} + command: + - /tcs-issuer + env: + - name: USER_PIN + valueFrom: + secretKeyRef: + key: userpin + name: tcs-issuer-pkcs11-conf + - name: SO_PIN + valueFrom: + secretKeyRef: + key: sopin + name: tcs-issuer-pkcs11-conf + image: "{{ .Values.image.hub }}/{{ .Values.image.name }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + livenessProbe: + httpGet: + path: /healthz + port: 8083 + initialDelaySeconds: 10 + periodSeconds: 180 + name: tcs-issuer + readinessProbe: + httpGet: + path: /readyz + port: 8083 + initialDelaySeconds: 10 + periodSeconds: 5 + resources: + limits: + cpu: 100m + memory: 30Mi + sgx.intel.com/enclave: 1 + sgx.intel.com/epc: 512Ki + requests: + cpu: 100m + memory: 20Mi + sgx.intel.com/enclave: 1 + sgx.intel.com/epc: 512Ki + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /home/tcs-issuer/tokens + name: tokens-dir + initContainers: + - command: + - /bin/chown + - -R + - 5000:5000 + - /home/tcs-issuer/tokens + image: busybox + imagePullPolicy: IfNotPresent + name: init + volumeMounts: + - mountPath: /home/tcs-issuer/tokens + name: tokens-dir + serviceAccountName: tcs-issuer-serviceaccount + terminationGracePeriodSeconds: 10 + volumes: + - hostPath: + path: /var/lib/tcs-issuer/tokens + type: DirectoryOrCreate + name: tokens-dir diff --git a/charts/intel-tcs-issuer/tcs-issuer/0.1.0/values.yaml b/charts/intel-tcs-issuer/tcs-issuer/0.1.0/values.yaml new file mode 100644 index 000000000..2f21cb9b5 --- /dev/null +++ b/charts/intel-tcs-issuer/tcs-issuer/0.1.0/values.yaml @@ -0,0 +1,10 @@ +image: + hub: intel + name: trusted-certificate-issuer + tag: "latest" + pullPolicy: Always + +# Any extra arguments for tcs-controller +controllerExtraArgs: {} +#controllerExtraArgs: |- +# - --csr-full-cert-chain=true diff --git a/index.yaml b/index.yaml index 89484bf33..0d73e406f 100755 --- a/index.yaml +++ b/index.yaml @@ -4636,6 +4636,24 @@ entries: urls: - assets/sysdig/sysdig-1.9.200.tgz version: 1.9.200 + tcs-issuer: + - annotations: + catalog.cattle.io/certified: partner + catalog.cattle.io/display-name: Intel Trusted Certificate Issuer + catalog.cattle.io/release-name: tcs-issuer + apiVersion: v2 + appVersion: 0.1.0 + created: "2022-06-29T10:32:33.302669+03:00" + description: A Helm chart for Trusted Certificate Service for Kubernetes Platform + digest: ac32f402a14d249acb94a7cea9141c7efe5d7761230380c5ac2f508b7df2a638 + home: https://github.com/intel/trusted-certificate-issuer + icon: https://avatars.githubusercontent.com/u/17888862?s=200&v=4 + kubeVersion: '>= 1.19-0' + name: tcs-issuer + type: application + urls: + - assets/intel-tcs-issuer/tcs-issuer-0.1.0.tgz + version: 0.1.0 traefik: - annotations: catalog.cattle.io/certified: partner