Skip to content

Commit 13bf900

Browse files
gngramgngram
committed
updates from code review
Signed-off-by: Ganga Ram <Ganga.Ram@tii.ae>
1 parent bbbbc0f commit 13bf900

File tree

4 files changed

+113
-219
lines changed

4 files changed

+113
-219
lines changed

‎modules/common/security/spire/agent.nix‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,6 @@ in
141141
enable = true;
142142
serviceConfig = {
143143
Type = "oneshot";
144-
User = "root";
145144
ExecStart = "${script}";
146145
Restart = "no";
147146
RemainAfterExit = true;

‎modules/common/security/spire/create-workload-entries.nix‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
# SPDX-FileCopyrightText: 2022-2026 TII (SSRC) and the Ghaf contributors
2+
# SPDX-License-Identifier: Apache-2.0
3+
{
4+
pkgs,
5+
lib,
6+
config,
7+
spire-package,
8+
socketPath,
9+
spireAgentVMs,
10+
}:
11+
let
12+
inherit (lib) escapeShellArg concatMapStringsSep;
13+
in
14+
pkgs.writeShellApplication {
15+
name = "spire-create-workload-entries";
16+
runtimeInputs = [
17+
pkgs.coreutils
18+
pkgs.gawk
19+
pkgs.gnugrep
20+
spire-package
21+
];
22+
text = ''
23+
SOCKET="${socketPath}"
24+
echo "=== SPIRE Workload Entry Creator ==="
25+
26+
# Wait for server
27+
echo "Waiting for SPIRE server..."
28+
while true; do
29+
if spire-server healthcheck -socketPath "$SOCKET" >/dev/null 2>&1; then
30+
echo "Server ready"
31+
break
32+
fi
33+
sleep 2
34+
done
35+
36+
create_entry() {
37+
local parentID="$1"
38+
local spiffeID="$2"
39+
local is_node="$3"
40+
shift 3
41+
local selectors=("$@")
42+
43+
if spire-server entry show -socketPath "$SOCKET" -spiffeID "$spiffeID" >/dev/null 2>&1; then
44+
echo "Entry exists: $spiffeID"
45+
return
46+
fi
47+
48+
echo "Creating entry: $spiffeID"
49+
local cmd=(spire-server entry create -socketPath "$SOCKET" -spiffeID "$spiffeID")
50+
51+
if [ "$is_node" = "true" ]; then
52+
cmd+=(-node)
53+
else
54+
cmd+=(-parentID "$parentID")
55+
fi
56+
57+
for s in "''${selectors[@]}"; do
58+
cmd+=(-selector "$s")
59+
done
60+
61+
"''${cmd[@]}"
62+
}
63+
64+
${concatMapStringsSep "\n" (
65+
vmName:
66+
let
67+
agentCfg = config.ghaf.common.spire.agents.${vmName};
68+
agentSpiffeID = "spiffe://${config.ghaf.common.spire.server.trustDomain}/${vmName}";
69+
70+
nodeEntryCmd =
71+
if (agentCfg.nodeAttestationMode == "x509pop") then
72+
''
73+
create_entry "" ${escapeShellArg agentSpiffeID} "true" "x509pop:subject:cn:${escapeShellArg vmName}"
74+
''
75+
else
76+
"";
77+
78+
workloadCmds = concatMapStringsSep "\n" (
79+
workload:
80+
let
81+
workloadSpiffeID = "spiffe://${config.ghaf.common.spire.server.trustDomain}/${vmName}/${workload.name}";
82+
selectors = concatMapStringsSep " " escapeShellArg workload.selectors;
83+
in
84+
''
85+
create_entry ${escapeShellArg agentSpiffeID} ${escapeShellArg workloadSpiffeID} "false" ${selectors}
86+
''
87+
) agentCfg.workloads;
88+
in
89+
nodeEntryCmd + workloadCmds
90+
) spireAgentVMs}
91+
92+
echo "Node and workload entries created successfully."
93+
'';
94+
}

‎modules/common/security/spire/server.nix‎

Lines changed: 19 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@
99
let
1010
cfg = config.ghaf.security.spire.server;
1111
inherit (lib)
12-
escapeShellArg
1312
filterAttrs
1413
getExe
1514
mkIf
@@ -108,10 +107,16 @@ let
108107
echo "Agent ${vm} already registered, skipping token generation"
109108
else
110109
echo "Generating new token for ${vm}"
111-
token="$(spire-server token generate \
112-
-socketPath ${socketPath} \
113-
-spiffeID spiffe://${cfg.trustDomain}/${vm} \
114-
| awk '/^Token:/ {print $2}')"
110+
output=$(spire-server token generate -socketPath "${socketPath}" -spiffeID "spiffe://${cfg.trustDomain}/${vm}")
111+
112+
# Check if the command actually worked
113+
if [ $? -ne 0 ]; then
114+
echo "Error: SPIRE token generation failed!" >&2
115+
exit 1
116+
fi
117+
118+
# Extract the token from the successful output
119+
token=$(echo "$output" | awk '/^Token:/ {print $2}')
115120
116121
printf '%s\n' "$token" > "$tokenFile"
117122
chmod 0644 "$tokenFile"
@@ -157,92 +162,15 @@ let
157162
'';
158163
};
159164

160-
createEntryFunc = ''
161-
create_entry() {
162-
local parentID="$1"
163-
local spiffeID="$2"
164-
local is_node="$3"
165-
shift 3
166-
local selectors=("$@")
167-
168-
if spire-server entry show -socketPath "$SOCKET" -spiffeID "$spiffeID" >/dev/null 2>&1; then
169-
echo "Entry exists: $spiffeID"
170-
return
171-
fi
172-
173-
echo "Creating entry: $spiffeID"
174-
local cmd=(spire-server entry create -socketPath "$SOCKET" -spiffeID "$spiffeID")
175-
176-
if [ "$is_node" = "true" ]; then
177-
cmd+=(-node)
178-
else
179-
cmd+=(-parentID "$parentID")
180-
fi
181-
182-
for s in "''${selectors[@]}"; do
183-
cmd+=(-selector "$s")
184-
done
185-
186-
"''${cmd[@]}"
187-
}
188-
'';
189-
190-
createEntries = concatMapStringsSep "\n" (
191-
vmName:
192-
let
193-
agentCfg = config.ghaf.common.spire.agents.${vmName};
194-
agentSpiffeID = "spiffe://${config.ghaf.common.spire.server.trustDomain}/${vmName}";
195-
196-
nodeEntryCmd =
197-
if (agentCfg.nodeAttestationMode == "x509pop") then
198-
''
199-
create_entry "" ${escapeShellArg agentSpiffeID} "true" "x509pop:subject:cn:${escapeShellArg vmName}"
200-
''
201-
else
202-
"";
203-
204-
workloadCmds = concatMapStringsSep "\n" (
205-
workload:
206-
let
207-
workloadSpiffeID = "spiffe://${config.ghaf.common.spire.server.trustDomain}/${vmName}/${workload.name}";
208-
selectors = concatMapStringsSep " " escapeShellArg workload.selectors;
209-
in
210-
''
211-
create_entry ${escapeShellArg agentSpiffeID} ${escapeShellArg workloadSpiffeID} "false" ${selectors}
212-
''
213-
) agentCfg.workloads;
214-
in
215-
nodeEntryCmd + workloadCmds
216-
) spireAgentVMs;
217-
218-
spireCreateWorkloadEntriesApp = pkgs.writeShellApplication {
219-
name = "spire-create-workload-entries";
220-
runtimeInputs = [
221-
pkgs.coreutils
222-
pkgs.gawk
223-
pkgs.gnugrep
165+
spireCreateWorkloadEntriesApp = import ./create-workload-entries.nix {
166+
inherit
167+
pkgs
168+
lib
169+
config
224170
spire-package
225-
];
226-
text = ''
227-
SOCKET="${socketPath}"
228-
echo "=== SPIRE Workload Entry Creator ==="
229-
230-
# Wait for server
231-
echo "Waiting for SPIRE server..."
232-
while true; do
233-
if spire-server healthcheck -socketPath "$SOCKET" >/dev/null 2>&1; then
234-
echo "Server ready"
235-
break
236-
fi
237-
sleep 2
238-
done
239-
240-
${createEntryFunc}
241-
242-
${createEntries}
243-
244-
echo "Done"
245-
'';
171+
socketPath
172+
spireAgentVMs
173+
;
246174
};
247175
in
248176
{
@@ -305,8 +233,7 @@ in
305233
after = [ "local-fs.target" ];
306234
serviceConfig = {
307235
Type = "oneshot";
308-
User = "root";
309-
ExecStart = "${pkgs.rsync}/bin/rsync --chown=root:root --chmod=g+rx /etc/givc/ca-cert.pem ${caCertPath}";
236+
ExecStart = "${pkgs.rsync}/bin/rsync --chmod=g+rx /etc/givc/ca-cert.pem ${caCertPath}";
310237
Restart = "no";
311238
};
312239
};
@@ -324,7 +251,6 @@ in
324251
serviceConfig = {
325252
Type = "oneshot";
326253
RemainAfterExit = true;
327-
User = "root";
328254
ExecStart = getExe spireGenerateJoinTokensApp;
329255
};
330256
};
@@ -336,7 +262,6 @@ in
336262

337263
serviceConfig = {
338264
Type = "oneshot";
339-
User = "root";
340265
ExecStart = getExe spirePublishBundleApp;
341266
};
342267
};
@@ -352,7 +277,6 @@ in
352277
serviceConfig = {
353278
Type = "oneshot";
354279
RemainAfterExit = true;
355-
User = "root";
356280
ExecStart = getExe spireCreateWorkloadEntriesApp;
357281
};
358282
};

‎modules/common/services/yubikey.nix.orig‎

Lines changed: 0 additions & 123 deletions
This file was deleted.

0 commit comments

Comments
 (0)