Kubernetes datastore plugin for SPIRE server

A SPIRE datastore plugin that enables you to store data using Kubernetes Custom Resource.

Motivation

• Make running SPIRE Server on Kubernetes simpler
• Enables SPIRE Server to run without managing persistent volumes

Installation

Download latest binary and install it to the plugin directory.

$ curl -L -O https://github.com/summerwind/spire-plugin-datastore-k8s/releases/latest/download/spire-plugin-datastore-k8s-linux-amd64.tar.gz
$ tar zxvf spire-plugin-datastore-k8s-linux-amd64.tar.gz
$ mv spire-plugin-datastore-k8s /path/to/plugin

Configuration

The plugin accepts the following configuration options:

Configuration	Description
namespace	Kubernetes namespace to manage custom resources
kubeconfig	Path to configuration file to access kubernetes API

A sample configuration for SPIRE server:

plugins {
  DataStore "k8s" {
    plugin_cmd = "/path/to/plugin"
    plugin_data {
      namespace = "spire"
    }
  }
}

Deploying to Kubernetes

You must create CustomResourceDefinition (CRD) resources in your Kubernetes cluster before you deploy the plugin. Create CRDs as follows:

$ curl -L https://github.com/summerwind/spire-plugin-datastore-k8s/releases/latest/download/crd.yaml | kubectl apply -f -

In addition, the Pod of the SPIRE server must have permissions to manage the resources of the CRDs you created. See example manifest below for more information about permissions.

• spire-server.yaml

Build from soruce

To build a binary from source, first build the container image and get the binary from it.

$ git clone https://github.com/summerwind/spire-plugin-datastore-k8s
$ cd spire-plugin-datastore-k8s
$ docker build --target release -t plugin:latest .
$ docker create -n spire plugin:latest
$ docker cp spire:/opt/spire/bin/spire-plugin-datastore-k8s ./
$ docker rm spire