117 lines
3.1 KiB
Bash
Executable File
117 lines
3.1 KiB
Bash
Executable File
#!/bin/bash
|
|
#
|
|
# install_spire.sh - Downloads, configures, and provides instructions for SPIRE server and agent.
|
|
#
|
|
set -euo pipefail
|
|
|
|
# --- Configuration ---
|
|
# Please verify the latest version from https://github.com/spiffe/spire/releases
|
|
SPIRE_VERSION="1.15.3"
|
|
ARCH="linux-amd64-musl"
|
|
TRUST_DOMAIN="vauco.no"
|
|
SERVER_BIND_ADDRESS="0.0.0.0"
|
|
SERVER_BIND_PORT="8081"
|
|
|
|
# --- Script Start ---
|
|
|
|
# 1. Download and unpack SPIRE binaries
|
|
echo "--- Downloading SPIRE v${SPIRE_VERSION} ---"
|
|
if [ -d "spire-${SPIRE_VERSION}" ]; then
|
|
echo "SPIRE directory already exists. Skipping download."
|
|
else
|
|
wget https://github.com/spiffe/spire/releases/download/v${SPIRE_VERSION}/spire-${SPIRE_VERSION}-${ARCH}.tar.gz
|
|
tar -xzf spire-${SPIRE_VERSION}-${ARCH}.tar.gz
|
|
rm spire-${SPIRE_VERSION}-${ARCH}.tar.gz
|
|
fi
|
|
|
|
cd spire-${SPIRE_VERSION}
|
|
|
|
# 2. Create SPIRE server configuration
|
|
echo "--- Creating SPIRE server config (conf/server/server.conf) ---"
|
|
cat > conf/server/server.conf <<EOF
|
|
server {
|
|
bind_address = "${SERVER_BIND_ADDRESS}"
|
|
bind_port = "${SERVER_BIND_PORT}"
|
|
trust_domain = "${TRUST_DOMAIN}"
|
|
data_dir = "./data"
|
|
log_level = "INFO"
|
|
ca_subject = {
|
|
country = ["NO"],
|
|
organization = ["Vauco"],
|
|
common_name = "",
|
|
}
|
|
}
|
|
|
|
plugins {
|
|
NodeAttestor "gcp_iit" {
|
|
plugin_data {}
|
|
}
|
|
KeyManager "memory" {
|
|
plugin_data {}
|
|
}
|
|
Notifier "noop" {
|
|
plugin_data {}
|
|
}
|
|
# This configures SPIRE to use the certificates created by step-ca as a signing authority.
|
|
# This is a basic integration. For a production setup, you might chain it as an UpstreamAuthority.
|
|
UpstreamAuthority "disk" {
|
|
plugin_data {
|
|
cert_file_path = "/home/chris_christiansen/.step/certs/intermediate_ca.crt"
|
|
key_file_path = "/home/chris_christiansen/.step/secrets/intermediate_ca_key"
|
|
}
|
|
}
|
|
}
|
|
EOF
|
|
|
|
# 3. Create SPIRE agent configuration
|
|
echo "--- Creating SPIRE agent config (conf/agent/agent.conf) ---"
|
|
cat > conf/agent/agent.conf <<EOF
|
|
agent {
|
|
data_dir = "./data"
|
|
log_level = "INFO"
|
|
server_address = "127.0.0.1"
|
|
server_port = "${SERVER_BIND_PORT}"
|
|
trust_bundle_path = "./conf/root.crt" # The agent will fetch this on startup
|
|
trust_domain = "${TRUST_DOMAIN}"
|
|
}
|
|
|
|
plugins {
|
|
NodeAttestor "gcp_iit" {
|
|
plugin_data {}
|
|
}
|
|
KeyManager "memory" {
|
|
plugin_data = {}
|
|
}
|
|
WorkloadAttestor "unix" {
|
|
plugin_data {
|
|
discover_workloads = true
|
|
}
|
|
}
|
|
}
|
|
EOF
|
|
|
|
cd ..
|
|
|
|
echo ""
|
|
echo "✅ SPIRE installation script and configuration templates have been created."
|
|
|
|
echo ""
|
|
|
|
echo "--- Next Steps ---"
|
|
|
|
echo "1. Review the generated configuration files in 'spire-${SPIRE_VERSION}/conf/'"
|
|
|
|
echo "2. Manually run the SPIRE server from your terminal:"
|
|
|
|
echo " cd spire-${SPIRE_VERSION} && ./bin/spire-server run"
|
|
|
|
echo "3. In another terminal, fetch the trust bundle for the agent:"
|
|
|
|
echo " cd spire-${SPIRE_VERSION} && ./bin/spire-server bundle show > ./conf/agent/root.crt"
|
|
|
|
echo "4. Run the SPIRE agent:"
|
|
|
|
echo " cd spire-${SPIRE_VERSION} && sudo ./bin/spire-agent run"
|
|
|
|
echo "5. Create registration entries for your workloads."
|