Cleanup documentation

Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
2023-11-08 13:11:58 +01:00
parent 37cd9f25e2
commit 0320c3f755
25 changed files with 130 additions and 300 deletions
+7 -3
View File
@@ -1,6 +1,7 @@
# Recommended setup for installing Spire on Openshift
> **Note**: This functionality is under development. It works but has no automated testing and will have security tightened in the future.
> [!Note]
> This functionality is under development. It works but has no automated testing and will have security tightened in the future.
This deployment works only with Openshift version 4.13 or higher. Get the Openshift platform here: [try.openshift.com](try.openshift.com)
@@ -31,7 +32,8 @@ echo "$appdomain"
Update the `example-your-values.yaml` file with your subdomain.
_Note: The location of the apps subdomain may be different in certain environments_
> [!Note]
> The location of the apps subdomain may be different in certain environments_
## Standard Deployment
@@ -62,7 +64,8 @@ helm upgrade --install --namespace spire-server spire charts/spire \
Additional features such as tornjak can be enabled by including their example values files before --values examples/production/example-your-values.yaml
For example:
```
```shell
--values examples/openshift/openshift-values.yaml \
--values examples/tornjak/values.yaml \
--values examples/production/example-your-values.yaml \
@@ -71,6 +74,7 @@ For example:
## Finish install
Once installed, the namespace security can be tightened back up.
```shell
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted --overwrite
```
+7 -2
View File
@@ -28,21 +28,25 @@ If you want to expose your spire-server outside of Kubernetes and are using ingr
```shell
-f values-expose-spire-server-ingress-nginx.yaml
```
For example:
```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-spire-server-ingress-nginx.yaml
```
If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx
you have two options as described here:
https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles
[github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles](https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles)
If you chose profile https_web, use:
```shell
-f values-expose-federation-https-web-ingress-nginx.yaml
```
For example:
```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-web-ingress-nginx.yaml
```
@@ -52,10 +56,11 @@ If you chose profile https_spiffe, use:
```shell
-f values-expose-federation-https-spiffe-ingress-nginx.yaml
```
For example:
```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-spiffe-ingress-nginx.yaml
```
See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
+2 -1
View File
@@ -1,6 +1,7 @@
# Recommended setup to deploy Tornjak
> **Warning**: The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production.
> [!Warning]
> The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production.
To install Spire with the least privileges possible we deploy spire across 2 namespaces.