Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Attempt at modernizing the sidecar SPIRE integration doc #15574

Merged
Merged
Show file tree
Hide file tree
Changes from 21 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -22,12 +22,14 @@ set -o pipefail
# @setup profile=none

# Install SPIRE configured with k8s Controller Manager
snip_install_spire_with_controller_manager
_wait_for_daemonset spire spire-agent
_wait_for_deployment spire spire-server
snip_install_spire_crds
snip_install_spire_istio_overrides
_wait_for_daemonset spire-server spire-agent
_wait_for_statefulset spire-server spire-server

# Create ClusterSPIFFEID
snip_create_clusterspiffeid
snip_spire_csid_istio_gateway
snip_spire_csid_istio_sidecar

# Install Istio
set +u # Do not exit when value is unset. CHECK_FILE in the IstioOperator might be unset
Expand All @@ -44,19 +46,17 @@ _wait_for_deployment default sleep
# Set spire-server pod variable
snip_set_spire_server_pod_name_var

# Verify registration identities were created for sleep and ingress gateway
_verify_contains snip_verifying_that_identities_were_created_for_workloads_1 "spiffe://example.org/ns/default/sa/sleep"
_verify_contains snip_verifying_that_identities_were_created_for_workloads_1 "spiffe://example.org/ns/istio-system/sa/istio-ingressgateway-service-account"

# Set sleep pod and pod uid variables
snip_set_sleep_pod_vars
snip_set_sleep_pod_var

# Verify sleep workload identity was issued by SPIRE
snip_get_sleep_svid
_verify_contains snip_get_svid_subject "O = SPIRE"

# @cleanup
#
kubectl delete -f samples/security/spire/sleep-spire.yaml
istioctl uninstall --purge --skip-confirmation
kubectl delete ns istio-system
snip_cleanup_spire_1
snip_uninstall_spire
snip_uninstall_spire_crds
Loading