Cleanup documentation
Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
@@ -36,7 +36,7 @@ For production installs, please see [the production example](https://github.com/
|
||||
|
||||
The spire-crds chart has been updated. Please ensure you have upgraded spire-crds before upgrading the spire chart.
|
||||
|
||||
The chart now supports multiple parallel installs of spire-controller-manager. Each install will handle all custom resources with a matching `className` field. By default this is set to `Release.Namespace-Release.Name` and the controller manager will only pick up custom resources with this `className`.
|
||||
The chart now supports multiple parallel installs of spire-controller-manager. Each install will handle all custom resources with a matching `className` field. By default this is set to `Release.Namespace-Release.Name` and the controller manager will only pick up custom resources with this `className`.
|
||||
|
||||
If you have not loaded any SPIRE custom resources yourself, the upgrade process will be transparent. If you have loaded your own SPIRE custom resources, set `spire-server.controllerManager.watchClassless=true` until you can update your SPIRE custom resources to have the `className` for the instance specified.
|
||||
|
||||
@@ -62,7 +62,8 @@ helm install -n spire-server spire-crds charts/spire-crds
|
||||
|
||||
## Version support
|
||||
|
||||
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
|
||||
> [!Warning]
|
||||
> This Chart is still in development and still subject to change the API (`values.yaml`).
|
||||
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
|
||||
> we do aim for as much stability as possible.
|
||||
|
||||
@@ -71,9 +72,11 @@ helm install -n spire-server spire-crds charts/spire-crds
|
||||
| Helm | `3.x` |
|
||||
| Kubernetes | `1.22+` |
|
||||
|
||||
> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden.
|
||||
> [!Note]
|
||||
> For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden.
|
||||
|
||||
## FAQ
|
||||
|
||||
For any issues see our [FAQ](../../FAQ.md)…
|
||||
|
||||
## Usage
|
||||
|
||||
@@ -1,75 +0,0 @@
|
||||
{{ template "chart.header" . }}
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
{{ template "chart.deprecationWarning" . }}
|
||||
|
||||
{{ template "chart.badgesSection" . }}
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
{{ template "chart.description" . }}
|
||||
|
||||
{{ template "chart.homepageLine" . }}
|
||||
|
||||
## Version support
|
||||
|
||||
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
|
||||
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
|
||||
> we do aim for as much stability as possible.
|
||||
|
||||
| Dependency | Supported Versions |
|
||||
|:-----------|:-------------------|
|
||||
| SPIRE | `1.8.4` |
|
||||
| Helm | `3.x` |
|
||||
| Kubernetes | `1.22+` |
|
||||
|
||||
> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden.
|
||||
|
||||
## FAQ
|
||||
For any issues see our [FAQ](../../FAQ.md)…
|
||||
|
||||
## Usage
|
||||
|
||||
To utilize Spire in your own workloads you should add the following to your workload:
|
||||
|
||||
```diff
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: my-app
|
||||
spec:
|
||||
containers:
|
||||
- name: my-app
|
||||
image: "my-app:latest"
|
||||
imagePullPolicy: Always
|
||||
+ volumeMounts:
|
||||
+ - name: spiffe-workload-api
|
||||
+ mountPath: /spiffe-workload-api
|
||||
+ readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 64Mi
|
||||
+ volumes:
|
||||
+ - name: spiffe-workload-api
|
||||
+ csi:
|
||||
+ driver: "csi.spiffe.io"
|
||||
+ readOnly: true
|
||||
```
|
||||
|
||||
Now you can interact with the Spire agent socket from your own application. The socket is mounted on `/spiffe-workload-api/spire-agent.sock`.
|
||||
|
||||
{{ template "chart.maintainersSection" . }}
|
||||
|
||||
{{ template "chart.sourcesSection" . }}
|
||||
|
||||
{{ template "chart.requirementsHeader" . }}
|
||||
|
||||
{{ template "chart.requirementsTable" . }}
|
||||
|
||||
{{ template "chart.valuesSection" . }}
|
||||
|
||||
----------------------------------------------
|
||||
@@ -1,14 +1,13 @@
|
||||
# spiffe-csi-driver
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
  
|
||||
|
||||
A Helm chart to install the SPIFFE CSI driver.
|
||||
|
||||
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
> **Note**: The recommended version is `0.2.3` to support arm64 nodes. If running with any
|
||||
> [!Note]
|
||||
> The recommended version is `0.2.3` to support arm64 nodes. If running with any
|
||||
> prior version to `0.2.3` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
||||
|
||||
## Maintainers
|
||||
@@ -24,6 +23,8 @@ A Helm chart to install the SPIFFE CSI driver.
|
||||
|
||||
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||
|
||||
## Parameters
|
||||
|
||||
### SPIFFE CSI Driver Chart parameters
|
||||
|
||||
@@ -1,24 +0,0 @@
|
||||
{{ template "chart.header" . }}
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
{{ template "chart.deprecationWarning" . }}
|
||||
|
||||
{{ template "chart.badgesSection" . }}
|
||||
|
||||
{{ template "chart.description" . }}
|
||||
|
||||
{{ template "chart.homepageLine" . }}
|
||||
|
||||
> **Note**: The recommended version is `0.2.3` to support arm64 nodes. If running with any
|
||||
> prior version to `0.2.3` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
||||
|
||||
{{ template "chart.maintainersSection" . }}
|
||||
|
||||
{{ template "chart.sourcesSection" . }}
|
||||
|
||||
{{ template "chart.requirementsSection" . }}
|
||||
|
||||
{{ template "chart.valuesSection" . }}
|
||||
|
||||
----------------------------------------------
|
||||
@@ -1,14 +1,13 @@
|
||||
# spiffe-oidc-discovery-provider
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
  
|
||||
|
||||
A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
|
||||
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
> **Note**: Minimum Spire version is `1.5.3`.
|
||||
> [!Note]
|
||||
> Minimum Spire version is `1.5.3`.
|
||||
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
||||
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
||||
|
||||
@@ -25,6 +24,8 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
|
||||
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||
|
||||
## Parameters
|
||||
|
||||
### Chart parameters
|
||||
|
||||
@@ -1,25 +0,0 @@
|
||||
{{ template "chart.header" . }}
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
{{ template "chart.deprecationWarning" . }}
|
||||
|
||||
{{ template "chart.badgesSection" . }}
|
||||
|
||||
{{ template "chart.description" . }}
|
||||
|
||||
{{ template "chart.homepageLine" . }}
|
||||
|
||||
> **Note**: Minimum Spire version is `1.5.3`.
|
||||
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
||||
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
||||
|
||||
{{ template "chart.maintainersSection" . }}
|
||||
|
||||
{{ template "chart.sourcesSection" . }}
|
||||
|
||||
{{ template "chart.requirementsSection" . }}
|
||||
|
||||
{{ template "chart.valuesSection" . }}
|
||||
|
||||
----------------------------------------------
|
||||
@@ -9,10 +9,10 @@ global: {}
|
||||
## @param agentSocketName The name of the spire-agent unix socket
|
||||
agentSocketName: spire-agent.sock
|
||||
|
||||
## @param replicaCount Replica count
|
||||
## @param replicaCount Replica count
|
||||
replicaCount: 1
|
||||
|
||||
## @param namespaceOverride Namespace override
|
||||
## @param namespaceOverride Namespace override
|
||||
namespaceOverride: ""
|
||||
|
||||
## @param annotations [object] Annotations for the deployment
|
||||
@@ -250,7 +250,7 @@ ingress:
|
||||
# nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
|
||||
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
host: "oidc-discovery"
|
||||
|
||||
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
|
||||
@@ -1,14 +1,13 @@
|
||||
# spire-agent
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
  
|
||||
|
||||
A Helm chart to install the SPIRE agent.
|
||||
|
||||
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
> **Note**: Minimum Spire version is `1.5.3`.
|
||||
> [!Note]
|
||||
> Minimum Spire version is `1.5.3`.
|
||||
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
||||
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
||||
|
||||
@@ -25,6 +24,8 @@ A Helm chart to install the SPIRE agent.
|
||||
|
||||
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||
|
||||
## Parameters
|
||||
|
||||
### Chart parameters
|
||||
|
||||
@@ -1,25 +0,0 @@
|
||||
{{ template "chart.header" . }}
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
{{ template "chart.deprecationWarning" . }}
|
||||
|
||||
{{ template "chart.badgesSection" . }}
|
||||
|
||||
{{ template "chart.description" . }}
|
||||
|
||||
{{ template "chart.homepageLine" . }}
|
||||
|
||||
> **Note**: Minimum Spire version is `1.5.3`.
|
||||
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
||||
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
||||
|
||||
{{ template "chart.maintainersSection" . }}
|
||||
|
||||
{{ template "chart.sourcesSection" . }}
|
||||
|
||||
{{ template "chart.requirementsSection" . }}
|
||||
|
||||
{{ template "chart.valuesSection" . }}
|
||||
|
||||
----------------------------------------------
|
||||
@@ -22,13 +22,13 @@ image:
|
||||
## @param imagePullSecrets [array] Pull secrets for images
|
||||
imagePullSecrets: []
|
||||
|
||||
## @param nameOverride Name override
|
||||
## @param nameOverride Name override
|
||||
nameOverride: ""
|
||||
|
||||
## @param namespaceOverride Namespace override
|
||||
## @param namespaceOverride Namespace override
|
||||
namespaceOverride: ""
|
||||
|
||||
## @param fullnameOverride Fullname override
|
||||
## @param fullnameOverride Fullname override
|
||||
fullnameOverride: ""
|
||||
|
||||
serviceAccount:
|
||||
|
||||
@@ -1,14 +1,13 @@
|
||||
# spire-server
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
  
|
||||
|
||||
A Helm chart to install the SPIRE server.
|
||||
|
||||
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
> **Note**: Minimum Spire version is `1.5.3`.
|
||||
> [!Note]
|
||||
> Minimum Spire version is `1.5.3`.
|
||||
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
||||
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
||||
>
|
||||
@@ -39,7 +38,8 @@ When Tornjak is enabled, it is exposed on both http and https (if TLS server cer
|
||||
|
||||
In addition, you can configure a `client certificate authority`, this will make Tornjak backend verify Client certificates signed by this authority to enable mTLS authentication.
|
||||
|
||||
**Warning**: For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access.
|
||||
> [!Important]
|
||||
> For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access.
|
||||
|
||||
### Tornjak with TLS Connection Type
|
||||
|
||||
@@ -47,13 +47,13 @@ TLS connection requires Tornjak to have access to TLS key and certificate.
|
||||
Complete instruction on creating your own TLS certificate can be found [here](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md).
|
||||
TLS Certificate and the private key must be provided to Tornjak via *TLS Secret*. Prior to deploying this Helm chart, create TLS Secret in the deployment namespace (e.g. `spire-server`)
|
||||
|
||||
```console
|
||||
```shell
|
||||
kubectl -n spire-server create secret tls tornjak-tls-secret --cert=client.crt --key=client.key
|
||||
```
|
||||
|
||||
Once the charts are deployed, you can test the TLS connection with the following command (assuming localhost):
|
||||
|
||||
```console
|
||||
```shell
|
||||
curl --cacert CA/rootCA.crt https://localhost:10443
|
||||
```
|
||||
|
||||
@@ -67,13 +67,13 @@ Follow the steps to [create user CA for mTLS](https://github.com/spiffe/tornjak/
|
||||
|
||||
Here is an example using a *Secret* in `spire-server` namespace:
|
||||
|
||||
```console
|
||||
```shell
|
||||
kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt"
|
||||
```
|
||||
|
||||
Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost):
|
||||
|
||||
```console
|
||||
```shell
|
||||
curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhost:10443
|
||||
```
|
||||
|
||||
@@ -81,6 +81,8 @@ curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhos
|
||||
|
||||
In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above.
|
||||
|
||||
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||
|
||||
## Parameters
|
||||
|
||||
### Chart parameters
|
||||
@@ -271,48 +273,53 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
|
||||
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` |
|
||||
| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` |
|
||||
| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` |
|
||||
| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
|
||||
| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.4.0` |
|
||||
| `tornjak.service.type` | Type of service resource | `ClusterIP` |
|
||||
| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` |
|
||||
| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` |
|
||||
| `tornjak.service.annotations` | Annotations for the service | `{}` |
|
||||
| `tornjak.ingress.enabled` | Flag to enable ingress for Tornjak backend service | `false` |
|
||||
| `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` |
|
||||
| `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` |
|
||||
| `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` |
|
||||
| `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `tornjak.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` |
|
||||
| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` |
|
||||
| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` |
|
||||
| `tornjak.startupProbe.successThreshold` | Success threshold count | `1` |
|
||||
| `tornjak.startupProbe.timeoutSeconds` | Timeout in seconds | `5` |
|
||||
| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | |
|
||||
| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` |
|
||||
| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` |
|
||||
| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` |
|
||||
| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` |
|
||||
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
|
||||
| `tornjak.resources` | Resource requests and limits | `{}` |
|
||||
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
|
||||
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
|
||||
| `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` |
|
||||
| `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` |
|
||||
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
||||
| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` |
|
||||
| `experimental.featureFlags` | List of developer feature flags | `[]` |
|
||||
| `tests.hostAliases` | List of host aliases for testing | `[]` |
|
||||
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
|
||||
| `tests.tls.customCA` | Custom CA value for tests | `""` |
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` |
|
||||
|
||||
### Tornjak
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||
| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` |
|
||||
| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
|
||||
| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.4.0` |
|
||||
| `tornjak.service.type` | Type of service resource | `ClusterIP` |
|
||||
| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` |
|
||||
| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` |
|
||||
| `tornjak.service.annotations` | Annotations for the service | `{}` |
|
||||
| `tornjak.ingress.enabled` | Flag to enable ingress for Tornjak backend service | `false` |
|
||||
| `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` |
|
||||
| `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` |
|
||||
| `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` |
|
||||
| `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `tornjak.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` |
|
||||
| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` |
|
||||
| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` |
|
||||
| `tornjak.startupProbe.successThreshold` | Success threshold count | `1` |
|
||||
| `tornjak.startupProbe.timeoutSeconds` | Timeout in seconds | `5` |
|
||||
| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | |
|
||||
| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` |
|
||||
| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` |
|
||||
| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` |
|
||||
| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` |
|
||||
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
|
||||
| `tornjak.resources` | Resource requests and limits | `{}` |
|
||||
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
|
||||
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
|
||||
| `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` |
|
||||
| `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` |
|
||||
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
||||
| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` |
|
||||
| `experimental.featureFlags` | List of developer feature flags | `[]` |
|
||||
| `tests.hostAliases` | List of host aliases for testing | `[]` |
|
||||
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
|
||||
| `tests.tls.customCA` | Custom CA value for tests | `""` |
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` |
|
||||
|
||||
@@ -212,7 +212,7 @@ federation:
|
||||
# If Profile Type == https_spiffe:
|
||||
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||
|
||||
## @param federation.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
## @param federation.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
host: "spire-server-federation"
|
||||
|
||||
## @param federation.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
@@ -523,7 +523,7 @@ ingress:
|
||||
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||
|
||||
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
host: "spire-server"
|
||||
|
||||
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
@@ -570,7 +570,7 @@ nodeAttestor:
|
||||
## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor
|
||||
serviceAccountAllowList: []
|
||||
|
||||
# tornjak - Tornjak default values
|
||||
## @section Tornjak
|
||||
tornjak:
|
||||
## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production)
|
||||
enabled: false
|
||||
|
||||
@@ -1,7 +1,5 @@
|
||||
# tornjak-frontend
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
@@ -11,7 +9,8 @@ A Helm chart to deploy Tornjak frontend
|
||||
|
||||
## Version support
|
||||
|
||||
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
|
||||
> [!Note]
|
||||
> This Chart is still in development and still subject to change the API (`values.yaml`).
|
||||
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
|
||||
> we do aim for as much stability as possible.
|
||||
|
||||
@@ -52,6 +51,8 @@ port forwarding. See the chart NOTES output for more details.
|
||||
|
||||
* <https://github.com/spiffe/tornjak>
|
||||
|
||||
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||
|
||||
## Parameters
|
||||
|
||||
### Chart parameters
|
||||
|
||||
@@ -1,54 +0,0 @@
|
||||
{{ template "chart.header" . }}
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
{{ template "chart.deprecationWarning" . }}
|
||||
|
||||
{{ template "chart.badgesSection" . }}
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
{{ template "chart.description" . }}
|
||||
|
||||
{{ template "chart.homepageLine" . }}
|
||||
|
||||
## Version support
|
||||
|
||||
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
|
||||
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
|
||||
> we do aim for as much stability as possible.
|
||||
|
||||
| Dependency | Supported Versions |
|
||||
|:-----------|:-------------------|
|
||||
| SPIRE | `1.5.3+`, `1.6.x` |
|
||||
| Tornjak | `1.0.x` |
|
||||
| Helm | `3.x` |
|
||||
|
||||
## Tornjak
|
||||
|
||||
Tornjak is the UI and Control Plane for SPIRE [https://github.com/spiffe/tornjak](https://github.com/spiffe/tornjak) and it is composed of two components:
|
||||
|
||||
* [Backend](../spire-server/README.md) - Tornjak APIs that extend SPIRE APIs with Control Plane functionality
|
||||
* Frontend (this chart) - Tornjak UI
|
||||
|
||||
## Prerequisites
|
||||
|
||||
This chart requires access to Tornjak Backend (`tornjakFrontend.apiServerURL`).
|
||||
This URL needs to be reachable from your web browser and can therefore not be a cluster internal URL.
|
||||
|
||||
Obtain the URL for Tornjak APIs. If deployed in the same cluster, locally,
|
||||
Tornjak APIs are typically available at `http://localhost:10000`.
|
||||
Review Tornjak documentation for more details.
|
||||
|
||||
## Usage
|
||||
|
||||
Since this is just a demo version, to access Tornjak APIs you can use
|
||||
port forwarding. See the chart NOTES output for more details.
|
||||
|
||||
{{ template "chart.maintainersSection" . }}
|
||||
|
||||
{{ template "chart.sourcesSection" . }}
|
||||
|
||||
{{ template "chart.requirementsSection" . }}
|
||||
|
||||
{{ template "chart.valuesSection" . }}
|
||||
----------------------------------------------
|
||||
@@ -126,7 +126,7 @@ ingress:
|
||||
controllerType: ""
|
||||
annotations: {}
|
||||
|
||||
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
host: "tornjak-frontend"
|
||||
|
||||
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
|
||||
Reference in New Issue
Block a user