diff --git a/.goreleaser.yaml b/.goreleaser.yaml new file mode 100644 index 0000000000..3e3a3955c1 --- /dev/null +++ b/.goreleaser.yaml @@ -0,0 +1,24 @@ +project_name: spire-agent + +builds: + - binary: "opt/spire-agent/spire-agent" + main: ./cmd/spire-agent/ + id: spire-agent + goos: + - linux + goarch: + - amd64 + - arm64 + +archives: + - id: "spire-agent" + builds: + - "spire-agent" + name_template: "{{.ProjectName}}_{{.Version}}_{{.Os}}_{{.Arch}}" + files: + - src: ./packaging/spire-agent.service + dst: /usr/lib/systemd/system + strip_parent: true + - src: ./packaging/spire-agent.conf + dst: /opt/spire-agent/conf/ + strip_parent: true diff --git a/Makefile b/Makefile index f71238e065..739f6c9445 100644 --- a/Makefile +++ b/Makefile @@ -568,3 +568,14 @@ $(protoc_gen_go_spire_bin): | go-check $(E)rm -rf $(protoc_gen_go_spire_base_dir) $(E)mkdir -p $(protoc_gen_go_spire_dir) $(E)GOBIN=$(protoc_gen_go_spire_dir) $(go_path) go install github.com/accuknox/spire-plugin-sdk/cmd/protoc-gen-go-spire@$(protoc_gen_go_spire_version) + +.PHONY: local-release +local-release: build +ifeq (, $(shell which goreleaser)) + @{ \ + set -e ;\ + go install github.com/goreleaser/goreleaser@latest ;\ + } +endif + cd $(CURDIR); VERSION=$(shell git describe --tags --always --dirty) goreleaser release --clean --skip=publish --skip=sign --skip=validate --snapshot + diff --git a/packaging/kmux-config.yaml b/packaging/kmux-config.yaml new file mode 100644 index 0000000000..e611166a93 --- /dev/null +++ b/packaging/kmux-config.yaml @@ -0,0 +1,7 @@ +kmux: + sink: + stream: knox-gateway + +knox-gateway: + # dev + server: "knox-gw.stage.accuknox.com:3000" diff --git a/packaging/spire-agent.conf b/packaging/spire-agent.conf new file mode 100644 index 0000000000..444a6432f8 --- /dev/null +++ b/packaging/spire-agent.conf @@ -0,0 +1,42 @@ +agent { + data_dir = "/opt/spire-data" + log_level = "DEBUG" + trust_domain = "accuknox.com" + join_token = "{{.JoinToken}}" + insecure_bootstrap = true + + # spire-server address + server_address = "{{.SpireHostAddr}}" + server_port = "{{.SpireHostPort}}" + #trust_bundle_url = "{{.SpireTrustBundleURL}}" + + # exposing spire-agent + agent_address = "0.0.0.0" + agent_port = "9091" + socket_path ="/var/run/spire/agent.sock" +} + +plugins { + NodeAttestor "join_token" { + plugin_data { + } + } + KeyManager "disk" { + plugin_data { + directory = "/opt/spire-data" + } + } + WorkloadAttestor "systemd" { + plugin_data { + container_id_cgroup_matchers = [] + } + } +} + +health_checks { + listener_enabled = true + bind_address = "0.0.0.0" + bind_port = "9090" + live_path = "/live" + ready_path = "/ready" +} diff --git a/packaging/spire-agent.service b/packaging/spire-agent.service new file mode 100644 index 0000000000..600ba7d948 --- /dev/null +++ b/packaging/spire-agent.service @@ -0,0 +1,12 @@ +[Unit] +Description=Spire-Agent + +[Service] +User=root +KillMode=process +WorkingDirectory=/opt/spire-agent/ +Environment=run -config /opt/spire-agent/conf/spire-agent.conf +ExecStart=/opt/spire-agent/spire-agent + +[Install] +WantedBy=multi-user.target