Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update the documentation of the docker workload attestor based on the #5040 contribution #5220

Merged
merged 2 commits into from
Jun 18, 2024
Merged

Update the documentation of the docker workload attestor based on the #5040 contribution #5220

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8fcce3e
Update plugin_agent_workloadattestor_docker.md based on #5040 contrib…
amartinezfayo Jun 13, 2024
e933783
Merge branch 'main' into update-docker-attestor-md
MarcosDY Jun 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 28 additions & 5 deletions doc/plugin_agent_workloadattestor_docker.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,11 +27,11 @@ A sample configuration:
Since selectors are created dynamically based on the container's docker labels, there isn't a list of known selectors.
Instead, each of the container's labels are used in creating the list of selectors.

| Selector | Example | Description |
|-------------------|-------------------------------------|------------------------------------------------------------------------|
| `docker:label` | `docker:label:com.example.name:foo` | The key:value pair of each of the container's labels. |
| `docker:env` | `docker:env:VAR=val` | The raw string value of each of the container's environment variables. |
| `docker:image_id` | `docker:image_id:77af4d6b9913` | The image id of the container. |
| Selector | Example | Description |
|-------------------|----------------------------------------------------|------------------------------------------------------------------------|
| `docker:label` | `docker:label:com.example.name:foo` | The key:value pair of each of the container's labels. |
| `docker:env` | `docker:env:VAR=val` | The raw string value of each of the container's environment variables. |
| `docker:image_id` | `docker:image_id:envoyproxy/envoy:contrib-v1.29.1` | The image name and version of the container. |

## Container ID CGroup Matchers

Expand Down Expand Up @@ -63,6 +63,29 @@ language that enforces a forward slash-delimited schema.

## Example

### Image ID

Example of an image_id selector for an Envoy proxy container. First run `docker images` to see the images available:

```shell
$ docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
prom/prometheus latest 1d3b7f56885b 2 weeks ago 262MB
spiffe.io latest 02acdde06edc 2 weeks ago 1.17GB
ghcr.io/spiffe/spire-agent 1.9.1 622ce7acc7e8 4 weeks ago 57.9MB
ghcr.io/spiffe/spire-server 1.9.1 e3b24c3cd9e1 4 weeks ago 103MB
envoyproxy/envoy contrib-v1.29.1 644f45f6626c 7 weeks ago 181MB
```

Then u4se the `REPOSITORY:TAG` as the selector, not the `IMAGE ID` column.

```shell
$ spire-server entry create \
-parentID spiffe://example.org/host \
-spiffeID spiffe://example.org/host/foo \
-selector docker:image_id:envoyproxy/envoy:contrib-v1.29.1
```

### Labels

If a workload container is started with `docker run --label com.example.name=foo [...]`, then workload registration would occur as:
Expand Down
Loading