{"id":15779867,"url":"https://github.com/rgl/spire-vagrant","last_synced_at":"2025-03-14T08:32:35.298Z","repository":{"id":139753299,"uuid":"423224632","full_name":"rgl/spire-vagrant","owner":"rgl","description":"SPIFFE/SPIRE playground","archived":false,"fork":false,"pushed_at":"2024-03-31T20:45:10.000Z","size":239,"stargazers_count":4,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-12-31T11:06:13.956Z","etag":null,"topics":["spiffe","spire","tpm","tpm2"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rgl.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-10-31T18:08:33.000Z","updated_at":"2023-09-21T13:24:34.000Z","dependencies_parsed_at":"2023-12-08T15:07:24.140Z","dependency_job_id":"3c4b0e0e-dcf9-44aa-8522-3e598c842397","html_url":"https://github.com/rgl/spire-vagrant","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rgl%2Fspire-vagrant","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rgl%2Fspire-vagrant/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rgl%2Fspire-vagrant/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rgl%2Fspire-vagrant/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rgl","download_url":"https://codeload.github.com/rgl/spire-vagrant/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243547613,"owners_count":20308739,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["spiffe","spire","tpm","tpm2"],"created_at":"2024-10-04T18:21:44.661Z","updated_at":"2025-03-14T08:32:34.966Z","avatar_url":"https://github.com/rgl.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# About\n\nThis is a [SPIFFE](https://spiffe.io/)/[SPIRE](https://github.com/spiffe/spire) playground.\n\n# Usage (Ubuntu 22.04)\n\nInstall [Vagrant](https://github.com/hashicorp/vagrant), [vagrant-libvirt](https://github.com/vagrant-libvirt/vagrant-libvirt), [Ubuntu 22.04 base box](https://github.com/rgl/ubuntu-vagrant), and [Windows Server 2022 base box](https://github.com/rgl/windows-vagrant).\n\nCreate the swtpm localca:\n\n```bash\nsudo bash provision-host-swtpm.sh\n```\n\nStart the SPIRE `server`, the `uagent` (Ubuntu), and the `wagent` (Windows) agent nodes:\n\n```bash\nvagrant up --no-destroy-on-error --no-tty\n```\n\nEnter the `server` node and register the workloads entries:\n\n```bash\nvagrant ssh server\nsudo -i\n\n# register example unix workload SPIFFE IDs entries (for agents that use\n# a TPM DevID to authenticate in spire-server).\ntrust_domain=\"$(hostname --domain)\"\nfor uid in 0 1000; do\n    for agent_spiffe_id_path in /vagrant/share/*-spiffe-id.txt; do\n        spire-server entry create \\\n            -parentID \"$(cat \"$agent_spiffe_id_path\")\" \\\n            -spiffeID \"spiffe://$trust_domain/user-$uid\" \\\n            -selector \"unix:uid:$uid\"\n    done\ndone\n\n# register example docker workload SPIFFE IDs entries (for agents that use\n# a TPM DevID to authenticate in spire-server).\ntrust_domain=\"$(hostname --domain)\"\nfor agent_spiffe_id_path in /vagrant/share/*-spiffe-id.txt; do\n    spire-server entry create \\\n        -parentID \"$(cat \"$agent_spiffe_id_path\")\" \\\n        -spiffeID \"spiffe://$trust_domain/example-server\" \\\n        -selector 'docker:label:com.docker.compose.project:example-docker-workload' \\\n        -selector 'docker:label:com.docker.compose.service:server'\n    spire-server entry create \\\n        -parentID \"$(cat \"$agent_spiffe_id_path\")\" \\\n        -spiffeID \"spiffe://$trust_domain/example-client\" \\\n        -selector 'docker:label:com.docker.compose.project:example-docker-workload' \\\n        -selector 'docker:label:com.docker.compose.service:client'\ndone\n\n# show all\nspire-server entry show\n\n# exit the node.\nexit\nexit\n```\n\nEnter the `uagent0` node and fetch a worload SVID for the current user:\n\n```bash\nvagrant ssh uagent0\n\n# fetch a SVID for the current workload (a unix process running as uid 1000).\ninstall -d -m 700 svid\nspire-agent api fetch x509 -write svid\nopenssl x509 -in svid/svid.0.pem -text -noout\nopenssl x509 -in svid/bundle.0.pem -text -noout\n\n# fetch a SVID for the current workload (a unix process running as uid 0).\nsudo -i\ninstall -d -m 700 svid\nspire-agent api fetch x509 -write svid\nopenssl x509 -in svid/svid.0.pem -text -noout\nopenssl x509 -in svid/bundle.0.pem -text -noout\n\n# exit the node.\nexit\nexit\n```\n\nEnter the `uagent0` node and execute an example docker worload:\n\n```bash\nvagrant ssh uagent0\n\n# build and run example docker workload.\ncd /vagrant/example-docker-workload\ndocker compose up --build\n```\n\nIn another shell, enter the `uagent0` node try the example docker worload:\n\n```bash\nvagrant ssh uagent0\n\n# use example docker workload to see their SPIFFE IDs.\nhttp localhost:8080\n\n# dump the example server workload certificate.\n# NB this will be a certificate for the server SPIFFE ID (e.g.\n#    spiffe://spire.test/example-server) URI X509 SAN (Subject\n#    Alternative Name). To include a DNS X509 SAN you would have to register\n#    the workload with, e.g., -dns example-server.spire.test.\ntrust_domain=\"$(hostname --domain)\"\nopenssl s_client -connect localhost:8443 -servername $trust_domain \u003c/dev/null 2\u003e/dev/null | openssl x509 -noout -text\n```\n\nList this repository dependencies (and which have newer versions):\n\n```bash\nexport GITHUB_COM_TOKEN='YOUR_GITHUB_PERSONAL_TOKEN'\n./renovate.sh\n```\n\n# Notes\n\n* The initial SPIFFE trust bundle must be distributed to the nodes using some out-of-band method.\n* An agent SPIFFE ID can only be known after the devid-provisioning-agent provisions the TPM DevID.\n* A workload can have one or more SPIFFE IDs, like the [example-docker-workload](example-docker-workload), which will have the IDs: `spiffe://spire.test/user-0` and `spiffe://spire.test/example-server` (or `spiffe://spire.test/example-client`).\n\n# Reference\n\n* [SPIRE Quickstart](https://spiffe.io/docs/latest/try/spire101/)\n* [SPIFFE: In Theory and in Practice](https://www.youtube.com/watch?v=DXE6CDJjDV4)\n* [Bridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster Authentication](https://www.youtube.com/watch?v=sjKNsnEYmiU)\n* [Securing Edge Systems with TPM 2.0 and SPIRE](https://www.youtube.com/watch?v=3KmvHLHxeRU)\n* DevID Node Attestator (TPM 2.0)\n  * [Server plugin: NodeAttestor \"tpm_devid\"](https://github.com/spiffe/spire/blob/v1.9.2/doc/plugin_server_nodeattestor_tpm_devid.md)\n  * [Agent plugin: NodeAttestor \"tpm_devid\"](https://github.com/spiffe/spire/blob/v1.9.2/doc/plugin_agent_nodeattestor_tpm_devid.md)\n  * [Hints about testing the DevID Node Attestator](https://github.com/spiffe/spire/pull/2111#issuecomment-811967536)\n  * [TPM 2.0 Keys for Device Identity and Attestation](https://trustedcomputinggroup.org/wp-content/uploads/TCG_IWG_DevID_v1r2_02dec2020.pdf)\n  * [devid-provisioning-tool](https://github.com/HewlettPackard/devid-provisioning-tool)\n* [Docker Workload Attestor](https://github.com/spiffe/spire/blob/v1.9.2/doc/plugin_agent_workloadattestor_docker.md)\n* [go-spiffe spiffe-http example](https://github.com/spiffe/go-spiffe/tree/v2.1.7/v2/examples/spiffe-http)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frgl%2Fspire-vagrant","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frgl%2Fspire-vagrant","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frgl%2Fspire-vagrant/lists"}