panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Cleanup documentation

Browse Source 
Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
2023-11-08 13:11:58 +01:00
parent 37cd9f25e2
commit 0320c3f755
25 changed files with 130 additions and 300 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CODE-OF-CONDUCT.md
+3 -3
View File
@@ -1,8 +1,8 @@
### Contributor Code of Conduct # Contributor Code of Conduct
We follow the [CNCF Contributor Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md). Additionally, we commit to the following guidelines as detailed on the [Linkerd Code of Conduct](https://github.com/linkerd/linkerd/wiki/Linkerd-code-of-conduct): We follow the [CNCF Contributor Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md). Additionally, we commit to the following guidelines as detailed on the [Linkerd Code of Conduct](https://github.com/linkerd/linkerd/wiki/Linkerd-code-of-conduct):
### Community Guidelines ## Community Guidelines
- Our goal is to foster an inclusive and diverse community of technology enthusiasts. - Our goal is to foster an inclusive and diverse community of technology enthusiasts.
@@ -14,6 +14,6 @@ We follow the [CNCF Contributor Code of Conduct](https://github.com/cncf/foundat
- We do our best to avoid [subtle-isms](https://www.recurse.com/manual#sub-sec-social-rules): small actions that make others feel uncomfortable. If you witness a subtle-ism, you may respectfully point it out to the person publicly or privately, or you may ask a moderator to say something. Accidentally saying something biased is common, expected, and readily forgiven. It is not in and of itself a bannable offense. - We do our best to avoid [subtle-isms](https://www.recurse.com/manual#sub-sec-social-rules): small actions that make others feel uncomfortable. If you witness a subtle-ism, you may respectfully point it out to the person publicly or privately, or you may ask a moderator to say something. Accidentally saying something biased is common, expected, and readily forgiven. It is not in and of itself a bannable offense.
### Moderation ## Moderation
- If you feel any of SPIFFE's communication channels require moderation, please e-mail the [SPIFFE Steering Committee (SSC)](mailto:[email protected]). - If you feel any of SPIFFE's communication channels require moderation, please e-mail the [SPIFFE Steering Committee (SSC)](mailto:[email protected]).
CONTRIBUTING.md
+3 -2
View File
@@ -38,7 +38,8 @@ git rebase main
Our CI pipeline takes care of the majority of the testing of this Chart. Other ways for you to test are by running `make test` locally using: Our CI pipeline takes care of the majority of the testing of this Chart. Other ways for you to test are by running `make test` locally using:
> **Warning**: Ensure to run the test on a dedicated k8s cluster that does not have Spire installed yet. > [!Warning]
> Ensure to run the test on a dedicated k8s cluster that does not have Spire installed yet.
```shell ```shell
make test make test
@@ -48,7 +49,7 @@ Another approach to testing the chart is by installing one of the examples in yo
## Generating documentation ## Generating documentation
Any changes to Chart.yaml or values.yaml require an update of the README.md. This update can easily be generated using [readme-generator](https://github.com/bitnami-labs/readme-generator-for-helm). Any changes to Chart.yaml or values.yaml require an update of the README.md. This update can easily be generated using [readme-generator][].
```shell ```shell
./helm-docs.sh ./helm-docs.sh
FAQ.md
+8 -2
View File
@@ -36,7 +36,8 @@ helm repo add spiffe https://spiffe.github.io/helm-charts-hardened
If you uninstall the SPIRE chart before all users of the CSI driver are removed, Pods will get stuck in a terminating state waiting for the driver, that no longer is installed, to unmount the volumes for the Pod. In order to fix this, reinstall the chart and remove all affected workloads that are not part of the SPIRE helm chart itself, before attempting to remove SPIRE again. If you uninstall the SPIRE chart before all users of the CSI driver are removed, Pods will get stuck in a terminating state waiting for the driver, that no longer is installed, to unmount the volumes for the Pod. In order to fix this, reinstall the chart and remove all affected workloads that are not part of the SPIRE helm chart itself, before attempting to remove SPIRE again.
You can discover Pods that use the driver with the following command: You can discover Pods that use the driver with the following command:
```
```shell
kubectl get pods --all-namespaces -o go-template='{{range .items}}{{$nn := printf "%s %s" .metadata.namespace .metadata.name}}{{range .spec.volumes}}{{if .csi.driver}}{{if eq .csi.driver "csi.spiffe.io"}}{{printf "%s\n" $nn}}{{end}}{{end}}{{end}}{{end}}' kubectl get pods --all-namespaces -o go-template='{{range .items}}{{$nn := printf "%s %s" .metadata.namespace .metadata.name}}{{range .spec.volumes}}{{if .csi.driver}}{{if eq .csi.driver "csi.spiffe.io"}}{{printf "%s\n" $nn}}{{end}}{{end}}{{end}}{{end}}'
``` ```
@@ -50,11 +51,14 @@ To resolve, reinstall the chart before trying to remove it again.
The chart requires `Projected Service Account Tokens` which has to be enabled on your Kubernetes API server. In most cases this is already done for you. The chart requires `Projected Service Account Tokens` which has to be enabled on your Kubernetes API server. In most cases this is already done for you.
> **Note**: This is enabled by default with newer versions as shown by the existence of: > [!Note]
> This is enabled by default with newer versions as shown by the existence of:
> >
> ```yaml
> - --service-account-issuer > - --service-account-issuer
> - --service-account-key-file > - --service-account-key-file
> - --service-account-signing-key-file > - --service-account-signing-key-file
> ```
See [Service Account Token Volume Projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) in the Kubernetes docs for more details. See [Service Account Token Volume Projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) in the Kubernetes docs for more details.
@@ -64,7 +68,9 @@ command to SSH into the Docker Desktop K8s VM.
```bash ```bash
docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh
``` ```
Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml` Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml`
```yaml ```yaml
spec: spec:
containers: containers:
README.md
+1 -1
View File
@@ -14,7 +14,7 @@ A suite of [Helm Charts](https://helm.sh/docs) for standardized installations of
## How to install or upgrade ## How to install or upgrade
You most likely want to do an integrated setup based on the spire chart. You most likely want to do an integrated setup based on the spire chart.
[Instructions](https://artifacthub.io/packages/helm/spiffe/spire) See the [Instructions](https://artifacthub.io/packages/helm/spiffe/spire).
## Contributing ## Contributing
charts/spire-crds/README.md
+3 -2
View File
@@ -7,6 +7,7 @@ A Helm chart to install the SPIRE CRDS.
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire> **Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
## Maintainers ## Maintainers
| Name | Email | Url | | Name | Email | Url |
| ---- | ------ | --- | | ---- | ------ | --- |
| marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> | | marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
@@ -16,8 +17,8 @@ A Helm chart to install the SPIRE CRDS.
## Source Code ## Source Code
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire> * <https://github.com/spiffe/helm-charts/tree/main/charts/spire-crds>
<!-- The Parameters section is generated using helm-docs.sh --> <!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
## Parameters ## Parameters
charts/spire/README.md
+5 -2
View File
@@ -62,7 +62,8 @@ helm install -n spire-server spire-crds charts/spire-crds
## Version support ## Version support
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`). > [!Warning]
> This Chart is still in development and still subject to change the API (`values.yaml`).
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although > Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
> we do aim for as much stability as possible. > we do aim for as much stability as possible.
@@ -71,9 +72,11 @@ helm install -n spire-server spire-crds charts/spire-crds
| Helm | `3.x` | | Helm | `3.x` |
| Kubernetes | `1.22+` | | Kubernetes | `1.22+` |
> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. > [!Note]
> For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden.
## FAQ ## FAQ
For any issues see our [FAQ](../../FAQ.md)… For any issues see our [FAQ](../../FAQ.md)…
## Usage ## Usage
charts/spire/README.md.gotmpl
-75
View File
@@ -1,75 +0,0 @@
{{ template "chart.header" . }}
<!-- This README.md is generated. Please edit README.md.gotmpl -->
{{ template "chart.deprecationWarning" . }}
{{ template "chart.badgesSection" . }}
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
{{ template "chart.description" . }}
{{ template "chart.homepageLine" . }}
## Version support
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
> we do aim for as much stability as possible.
| Dependency | Supported Versions |
|:-----------|:-------------------|
| SPIRE | `1.8.4` |
| Helm | `3.x` |
| Kubernetes | `1.22+` |
> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden.
## FAQ
For any issues see our [FAQ](../../FAQ.md)…
## Usage
To utilize Spire in your own workloads you should add the following to your workload:
```diff
apiVersion: v1
kind: Pod
metadata:
name: my-app
spec:
containers:
- name: my-app
image: "my-app:latest"
imagePullPolicy: Always
+ volumeMounts:
+ - name: spiffe-workload-api
+ mountPath: /spiffe-workload-api
+ readOnly: true
resources:
requests:
cpu: 200m
memory: 32Mi
limits:
cpu: 500m
memory: 64Mi
+ volumes:
+ - name: spiffe-workload-api
+ csi:
+ driver: "csi.spiffe.io"
+ readOnly: true
```
Now you can interact with the Spire agent socket from your own application. The socket is mounted on `/spiffe-workload-api/spire-agent.sock`.
{{ template "chart.maintainersSection" . }}
{{ template "chart.sourcesSection" . }}
{{ template "chart.requirementsHeader" . }}
{{ template "chart.requirementsTable" . }}
{{ template "chart.valuesSection" . }}
----------------------------------------------
charts/spire/charts/spiffe-csi-driver/README.md
+4 -3
View File
@@ -1,14 +1,13 @@
# spiffe-csi-driver # spiffe-csi-driver
<!-- This README.md is generated. Please edit README.md.gotmpl -->
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.2.3](https://img.shields.io/badge/AppVersion-0.2.3-informational?style=flat-square) ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.2.3](https://img.shields.io/badge/AppVersion-0.2.3-informational?style=flat-square)
A Helm chart to install the SPIFFE CSI driver. A Helm chart to install the SPIFFE CSI driver.
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire> **Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
> **Note**: The recommended version is `0.2.3` to support arm64 nodes. If running with any > [!Note]
> The recommended version is `0.2.3` to support arm64 nodes. If running with any
> prior version to `0.2.3` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. > prior version to `0.2.3` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
## Maintainers ## Maintainers
@@ -24,6 +23,8 @@ A Helm chart to install the SPIFFE CSI driver.
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire> * <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
## Parameters ## Parameters
### SPIFFE CSI Driver Chart parameters ### SPIFFE CSI Driver Chart parameters
charts/spire/charts/spiffe-csi-driver/README.md.gotmpl
-24
View File
@@ -1,24 +0,0 @@
{{ template "chart.header" . }}
<!-- This README.md is generated. Please edit README.md.gotmpl -->
{{ template "chart.deprecationWarning" . }}
{{ template "chart.badgesSection" . }}
{{ template "chart.description" . }}
{{ template "chart.homepageLine" . }}
> **Note**: The recommended version is `0.2.3` to support arm64 nodes. If running with any
> prior version to `0.2.3` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
{{ template "chart.maintainersSection" . }}
{{ template "chart.sourcesSection" . }}
{{ template "chart.requirementsSection" . }}
{{ template "chart.valuesSection" . }}
----------------------------------------------
charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+4 -3
View File
@@ -1,14 +1,13 @@
# spiffe-oidc-discovery-provider # spiffe-oidc-discovery-provider
<!-- This README.md is generated. Please edit README.md.gotmpl -->
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square)
A Helm chart to install the SPIFFE OIDC discovery provider. A Helm chart to install the SPIFFE OIDC discovery provider.
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire> **Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
> **Note**: Minimum Spire version is `1.5.3`. > [!Note]
> Minimum Spire version is `1.5.3`.
> The recommended version is `1.6.0` to support arm64 nodes. If running with any > The recommended version is `1.6.0` to support arm64 nodes. If running with any
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. > prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
@@ -25,6 +24,8 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire> * <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
## Parameters ## Parameters
### Chart parameters ### Chart parameters
charts/spire/charts/spiffe-oidc-discovery-provider/README.md.gotmpl
-25
View File
@@ -1,25 +0,0 @@
{{ template "chart.header" . }}
<!-- This README.md is generated. Please edit README.md.gotmpl -->
{{ template "chart.deprecationWarning" . }}
{{ template "chart.badgesSection" . }}
{{ template "chart.description" . }}
{{ template "chart.homepageLine" . }}
> **Note**: Minimum Spire version is `1.5.3`.
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
{{ template "chart.maintainersSection" . }}
{{ template "chart.sourcesSection" . }}
{{ template "chart.requirementsSection" . }}
{{ template "chart.valuesSection" . }}
----------------------------------------------
charts/spire/charts/spire-agent/README.md
+4 -3
View File
@@ -1,14 +1,13 @@
# spire-agent # spire-agent
<!-- This README.md is generated. Please edit README.md.gotmpl -->
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square)
A Helm chart to install the SPIRE agent. A Helm chart to install the SPIRE agent.
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire> **Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
> **Note**: Minimum Spire version is `1.5.3`. > [!Note]
> Minimum Spire version is `1.5.3`.
> The recommended version is `1.6.0` to support arm64 nodes. If running with any > The recommended version is `1.6.0` to support arm64 nodes. If running with any
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. > prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
@@ -25,6 +24,8 @@ A Helm chart to install the SPIRE agent.
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire> * <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
## Parameters ## Parameters
### Chart parameters ### Chart parameters
charts/spire/charts/spire-agent/README.md.gotmpl
-25
View File
@@ -1,25 +0,0 @@
{{ template "chart.header" . }}
<!-- This README.md is generated. Please edit README.md.gotmpl -->
{{ template "chart.deprecationWarning" . }}
{{ template "chart.badgesSection" . }}
{{ template "chart.description" . }}
{{ template "chart.homepageLine" . }}
> **Note**: Minimum Spire version is `1.5.3`.
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
{{ template "chart.maintainersSection" . }}
{{ template "chart.sourcesSection" . }}
{{ template "chart.requirementsSection" . }}
{{ template "chart.valuesSection" . }}
----------------------------------------------
charts/spire/charts/spire-server/README.md
+15 -8
View File
@@ -1,14 +1,13 @@
# spire-server # spire-server
<!-- This README.md is generated. Please edit README.md.gotmpl -->
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square)
A Helm chart to install the SPIRE server. A Helm chart to install the SPIRE server.
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire> **Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
> **Note**: Minimum Spire version is `1.5.3`. > [!Note]
> Minimum Spire version is `1.5.3`.
> The recommended version is `1.6.0` to support arm64 nodes. If running with any > The recommended version is `1.6.0` to support arm64 nodes. If running with any
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. > prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
> >
@@ -39,7 +38,8 @@ When Tornjak is enabled, it is exposed on both http and https (if TLS server cer
In addition, you can configure a `client certificate authority`, this will make Tornjak backend verify Client certificates signed by this authority to enable mTLS authentication. In addition, you can configure a `client certificate authority`, this will make Tornjak backend verify Client certificates signed by this authority to enable mTLS authentication.
**Warning**: For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access. > [!Important]
> For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access.
### Tornjak with TLS Connection Type ### Tornjak with TLS Connection Type
@@ -47,13 +47,13 @@ TLS connection requires Tornjak to have access to TLS key and certificate.
Complete instruction on creating your own TLS certificate can be found [here](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md). Complete instruction on creating your own TLS certificate can be found [here](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md).
TLS Certificate and the private key must be provided to Tornjak via *TLS Secret*. Prior to deploying this Helm chart, create TLS Secret in the deployment namespace (e.g. `spire-server`) TLS Certificate and the private key must be provided to Tornjak via *TLS Secret*. Prior to deploying this Helm chart, create TLS Secret in the deployment namespace (e.g. `spire-server`)
```console ```shell
kubectl -n spire-server create secret tls tornjak-tls-secret --cert=client.crt --key=client.key kubectl -n spire-server create secret tls tornjak-tls-secret --cert=client.crt --key=client.key
``` ```
Once the charts are deployed, you can test the TLS connection with the following command (assuming localhost): Once the charts are deployed, you can test the TLS connection with the following command (assuming localhost):
```console ```shell
curl --cacert CA/rootCA.crt https://localhost:10443 curl --cacert CA/rootCA.crt https://localhost:10443
``` ```
@@ -67,13 +67,13 @@ Follow the steps to [create user CA for mTLS](https://github.com/spiffe/tornjak/
Here is an example using a *Secret* in `spire-server` namespace: Here is an example using a *Secret* in `spire-server` namespace:
```console ```shell
kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt" kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt"
``` ```
Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost): Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost):
```console ```shell
curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhost:10443 curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhost:10443
``` ```
@@ -81,6 +81,8 @@ curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhos
In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above. In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above.
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
## Parameters ## Parameters
### Chart parameters ### Chart parameters
@@ -271,6 +273,11 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` | | `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` | | `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` |
| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` | | `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` |
### Tornjak
| Name | Description | Value |
| ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` | | `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` |
| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` | | `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
charts/spire/charts/spire-server/values.yaml
+1 -1
View File
@@ -570,7 +570,7 @@ nodeAttestor:
## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor ## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor
serviceAccountAllowList: [] serviceAccountAllowList: []
# tornjak - Tornjak default values ## @section Tornjak
tornjak: tornjak:
## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production) ## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production)
enabled: false enabled: false
charts/spire/charts/tornjak-frontend/README.md
+4 -3
View File
@@ -1,7 +1,5 @@
# tornjak-frontend # tornjak-frontend
<!-- This README.md is generated. Please edit README.md.gotmpl -->
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.2.2](https://img.shields.io/badge/AppVersion-v1.2.2-informational?style=flat-square) ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.2.2](https://img.shields.io/badge/AppVersion-v1.2.2-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
@@ -11,7 +9,8 @@ A Helm chart to deploy Tornjak frontend
## Version support ## Version support
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`). > [!Note]
> This Chart is still in development and still subject to change the API (`values.yaml`).
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although > Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
> we do aim for as much stability as possible. > we do aim for as much stability as possible.
@@ -52,6 +51,8 @@ port forwarding. See the chart NOTES output for more details.
* <https://github.com/spiffe/tornjak> * <https://github.com/spiffe/tornjak>
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
## Parameters ## Parameters
### Chart parameters ### Chart parameters
charts/spire/charts/tornjak-frontend/README.md.gotmpl
-54
View File
@@ -1,54 +0,0 @@
{{ template "chart.header" . }}
<!-- This README.md is generated. Please edit README.md.gotmpl -->
{{ template "chart.deprecationWarning" . }}
{{ template "chart.badgesSection" . }}
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
{{ template "chart.description" . }}
{{ template "chart.homepageLine" . }}
## Version support
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
> we do aim for as much stability as possible.
| Dependency | Supported Versions |
|:-----------|:-------------------|
| SPIRE | `1.5.3+`, `1.6.x` |
| Tornjak | `1.0.x` |
| Helm | `3.x` |
## Tornjak
Tornjak is the UI and Control Plane for SPIRE [https://github.com/spiffe/tornjak](https://github.com/spiffe/tornjak) and it is composed of two components:
* [Backend](../spire-server/README.md) - Tornjak APIs that extend SPIRE APIs with Control Plane functionality
* Frontend (this chart) - Tornjak UI
## Prerequisites
This chart requires access to Tornjak Backend (`tornjakFrontend.apiServerURL`).
This URL needs to be reachable from your web browser and can therefore not be a cluster internal URL.
Obtain the URL for Tornjak APIs. If deployed in the same cluster, locally,
Tornjak APIs are typically available at `http://localhost:10000`.
Review Tornjak documentation for more details.
## Usage
Since this is just a demo version, to access Tornjak APIs you can use
port forwarding. See the chart NOTES output for more details.
{{ template "chart.maintainersSection" . }}
{{ template "chart.sourcesSection" . }}
{{ template "chart.requirementsSection" . }}
{{ template "chart.valuesSection" . }}
----------------------------------------------
examples/openshift/README.md
+7 -3
View File
@@ -1,6 +1,7 @@
# Recommended setup for installing Spire on Openshift # Recommended setup for installing Spire on Openshift
> **Note**: This functionality is under development. It works but has no automated testing and will have security tightened in the future. > [!Note]
> This functionality is under development. It works but has no automated testing and will have security tightened in the future.
This deployment works only with Openshift version 4.13 or higher. Get the Openshift platform here: [try.openshift.com](try.openshift.com) This deployment works only with Openshift version 4.13 or higher. Get the Openshift platform here: [try.openshift.com](try.openshift.com)
@@ -31,7 +32,8 @@ echo "$appdomain"
Update the `example-your-values.yaml` file with your subdomain. Update the `example-your-values.yaml` file with your subdomain.
_Note: The location of the apps subdomain may be different in certain environments_ > [!Note]
> The location of the apps subdomain may be different in certain environments_
## Standard Deployment ## Standard Deployment
@@ -62,7 +64,8 @@ helm upgrade --install --namespace spire-server spire charts/spire \
Additional features such as tornjak can be enabled by including their example values files before --values examples/production/example-your-values.yaml Additional features such as tornjak can be enabled by including their example values files before --values examples/production/example-your-values.yaml
For example: For example:
```
```shell
--values examples/openshift/openshift-values.yaml \ --values examples/openshift/openshift-values.yaml \
--values examples/tornjak/values.yaml \ --values examples/tornjak/values.yaml \
--values examples/production/example-your-values.yaml \ --values examples/production/example-your-values.yaml \
@@ -71,6 +74,7 @@ For example:
## Finish install ## Finish install
Once installed, the namespace security can be tightened back up. Once installed, the namespace security can be tightened back up.
```shell ```shell
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted --overwrite kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted --overwrite
``` ```
examples/production/README.md
+7 -2
View File
@@ -28,21 +28,25 @@ If you want to expose your spire-server outside of Kubernetes and are using ingr
```shell ```shell
-f values-expose-spire-server-ingress-nginx.yaml -f values-expose-spire-server-ingress-nginx.yaml
``` ```
For example: For example:
```shell ```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-spire-server-ingress-nginx.yaml helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-spire-server-ingress-nginx.yaml
``` ```
If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx
you have two options as described here: you have two options as described here:
https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles [github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles](https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles)
If you chose profile https_web, use: If you chose profile https_web, use:
```shell ```shell
-f values-expose-federation-https-web-ingress-nginx.yaml -f values-expose-federation-https-web-ingress-nginx.yaml
``` ```
For example: For example:
```shell ```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-web-ingress-nginx.yaml helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-web-ingress-nginx.yaml
``` ```
@@ -52,10 +56,11 @@ If you chose profile https_spiffe, use:
```shell ```shell
-f values-expose-federation-https-spiffe-ingress-nginx.yaml -f values-expose-federation-https-spiffe-ingress-nginx.yaml
``` ```
For example: For example:
```shell ```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-spiffe-ingress-nginx.yaml helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-spiffe-ingress-nginx.yaml
``` ```
See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup. See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
examples/tornjak/README.md
+2 -1
View File
@@ -1,6 +1,7 @@
# Recommended setup to deploy Tornjak # Recommended setup to deploy Tornjak
> **Warning**: The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production. > [!Warning]
> The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production.
To install Spire with the least privileges possible we deploy spire across 2 namespaces. To install Spire with the least privileges possible we deploy spire across 2 namespaces.
helm-docs.sh
+1 -1
View File
@@ -3,7 +3,7 @@
set -euo pipefail set -euo pipefail
SCRIPTPATH=$(dirname "$0") SCRIPTPATH=$(dirname "$0")
README_GENERATOR_VERSION="2.5.1" README_GENERATOR_VERSION="2.6.0"
README_GENERATOR_EXE="readme-generator" README_GENERATOR_EXE="readme-generator"
if ! hash "${README_GENERATOR_EXE}" 2>/dev/null; then if ! hash "${README_GENERATOR_EXE}" 2>/dev/null; then
release-chart.sh
+2 -1
View File
@@ -117,7 +117,8 @@ git push -u origin --force-with-lease
cat <<EOF | gh pr create --base main --body-file - "${dry_run}" cat <<EOF | gh pr create --base main --body-file - "${dry_run}"
Please review the below changelog to ensure this matches up with the semantic version being applied. Please review the below changelog to ensure this matches up with the semantic version being applied.
> **Note**: **Maintainers** ensure to run following after merging this PR to trigger the release workflow: > [!Note]
> **Maintainers** ensure to run following after merging this PR to trigger the release workflow:
> >
> \`\`\`shell > \`\`\`shell
> git checkout main > git checkout main