panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use chart-testing ci/*-values.yaml for testing

Browse Source 
This also enables the refactor to have multiple root level charts.

Resolves #100

Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
2023-07-19 22:48:19 +02:00
parent a4c1de7b30
commit 06ddb7cd3f
47 changed files with 133 additions and 465 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
+1 -1
View File
@@ -33,7 +33,7 @@ spec:
- name: curl-ingress
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
command: ['curl']
args: ['-s', '-f', 'http://{{ index .Values.config.additionalDomains 0 }}/.well-known/openid-configuration']
args: ['-s', '-f', 'http://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
securityContext:
{{- toYaml .Values.securityContext | nindent 8 }}
{{- end }}
charts/spire/ci/external-mysql-values.yaml
+11
View File
@@ -0,0 +1,11 @@
spire-server:
dataStore:
sql:
databaseType: mysql
databaseName: spire-server
username: spire
password: sp1ff3Test
host: mysql.mysql
port: 3306
options:
- parseTime: true
charts/spire/ci/external-postgres-values.yaml
+11
View File
@@ -0,0 +1,11 @@
spire-server:
dataStore:
sql:
databaseType: postgres
databaseName: spire-server
username: spire
password: sp1ff3Test
host: postgresql.postgresql
port: 5432
options:
- sslmode: disable
charts/spire/ci/extras-values.yaml
+61
View File
@@ -0,0 +1,61 @@
spire-agent:
initContainers:
- name: extra-init
image: cgr.dev/chainguard/busybox:latest-glibc
command:
- sh
- -xec
- |
echo 'hi there' > /extra/file
volumeMounts:
- name: extra
mountPath: /extra
extraContainers:
- name: extra
image: cgr.dev/chainguard/busybox:latest-glibc
command:
- sh
- -xec
- |
[ -f /extra/file ]
while true; do sleep 1000; done
volumeMounts:
- name: extra
mountPath: /extra
extraVolumeMounts:
- name: extra
mountPath: /extra
extraVolumes:
- name: extra
emptyDir: {}
spire-server:
initContainers:
- name: extra-init
image: cgr.dev/chainguard/busybox:latest-glibc
command:
- sh
- -xec
- |
echo 'hi there' > /extra/file
volumeMounts:
- name: extra
mountPath: /extra
extraContainers:
- name: extra
image: cgr.dev/chainguard/busybox:latest-glibc
command:
- sh
- -xec
- |
[ -f /extra/file ]
while true; do sleep 1000; done
volumeMounts:
- name: extra
mountPath: /extra
extraVolumeMounts:
- name: extra
mountPath: /extra
extraVolumes:
- name: extra
emptyDir: {}
charts/spire/ci/federation-bundle-endpoint-values.yaml
+3
View File
@@ -0,0 +1,3 @@
spire-server:
federation:
enabled: true
charts/spire/ci/namespace-override-values.yaml
+27
View File
@@ -0,0 +1,27 @@
spiffe-oidc-discovery-provider:
enabled: true
namespaceOverride: spire-server
insecureScheme:
enabled: true
spire-server:
namespaceOverride: spire-server
nodeAttestor:
k8sPsat:
serviceAccountAllowList: ["spire-system:spire-agent"]
notifier:
k8sbundle:
namespace: spire-system
spiffe-csi-driver:
enabled: true
namespaceOverride: spire-system
spire-agent:
enabled: true
namespaceOverride: spire-system
serviceAccount:
# -- The name of the service account to use.
name: spire-agent
server:
namespaceOverride: spire-server
charts/spire/ci/no-spire-controller-manager-values.yaml
+3
View File
@@ -0,0 +1,3 @@
spire-server:
controllerManager:
enabled: false
charts/spire/ci/oidc-values.yaml
+42
View File
@@ -0,0 +1,42 @@
spire-server:
ingress:
enabled: true
className: "nginx"
annotations:
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
hosts:
- host: ingress-nginx-controller.ingress-nginx
paths:
- path: /
pathType: Prefix
spire-agent:
server:
address: ingress-nginx-controller.ingress-nginx
port: 443
spiffe-oidc-discovery-provider:
enabled: true
insecureScheme:
enabled: true
config:
additionalDomains:
- ingress-nginx-controller.ingress-nginx
- ingress-nginx-controller.ingress-nginx.svc.cluster.local
acme:
tosAccepted: false
ingress:
enabled: true
className: nginx
hosts:
- host: ingress-nginx-controller.ingress-nginx.svc.cluster.local
paths:
- path: /
pathType: Prefix
charts/spire/ci/prometheus-values.yaml
+13
View File
@@ -0,0 +1,13 @@
global:
telemetry:
prometheus:
enabled: true
podMonitor:
enabled: true
labels:
release: kube-prometheus-stack
spiffe-oidc-discovery-provider:
enabled: true
insecureScheme:
enabled: true
charts/spire/ci/tornjak-values.yaml
+6
View File
@@ -0,0 +1,6 @@
spire-server:
tornjak:
enabled: true
tornjak-frontend:
enabled: true
charts/spire/ci/upstream-authority-cert-manager-values.yaml
+6
View File
@@ -0,0 +1,6 @@
spire-server:
upstreamAuthority:
certManager:
enabled: true
ca:
create: true
charts/spire/ci/upstream-authority-disk-values.yaml
+58
View File
@@ -0,0 +1,58 @@
server:
config:
upstreamAuthority:
disk:
enabled: true
secret:
data:
# This cert is generated using create-cert.sh and should only be used for the test
certificate: |
-----BEGIN CERTIFICATE-----
MIIDBDCCAewCCQCK4mz8rTwvHDANBgkqhkiG9w0BAQsFADBEMQswCQYDVQQGEwJO
TDEPMA0GA1UECgwGU1BJRkZFMQ4wDAYDVQQLDAVTUElSRTEUMBIGA1UEAwwLZXhh
bXBsZS5vcmcwHhcNMjMwMjIwMTAwNTA5WhcNMjQwMjIwMTAwNTA5WjBEMQswCQYD
VQQGEwJOTDEPMA0GA1UECgwGU1BJRkZFMQ4wDAYDVQQLDAVTUElSRTEUMBIGA1UE
AwwLZXhhbXBsZS5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4
1hcad074AFQlQiM9j54tuh1yCpRfO2pFPOwESqT/gYrnAMfl24nI28FaC/gZWmhD
5VZrThY8QlLesk7iyDmrvB6VMMs5di40C5XE11FLf+efS1CpD9atqLyBQ1tjB0yZ
zIPZFP97HRI4DQb7BXqgOmDEnJ5gk6IleBsomQlDwyu9TXgUd8c4SEFgrxHMjfyb
ZN3dKzw4jCB3SrEqouaSq7eelCe0q58y4Lq8fkD+Zc2GrRJ0K5y3eMoRzp5ByK8Q
YPm8AJgFVTS9kCs+HROqC+Y7WqracUiEHCDWY1HG5IbdC9GSNdPDu2GHUxFWtKhh
Pw+I7iuu3jF5LRikLtDpAgMBAAEwDQYJKoZIhvcNAQELBQADggEBACK0PQa7+2za
GOacBqbmeycEJmiSZYEi1sMbgjFjmROcW+wyzWZDvMlDSS2z22B6Cp7qS5ZY3T7H
ZMVbpRkkNMF9h+51cTFoUlppgFEEqIXRkE+Jejs5Fq2FvgSdx/2LJZkTzt4Rlo07
UiP4nlHhsEVPRNPuus/MfoA2RZYfGJt+4eLXqjS6TAcccfGqVcMmq/FjjZjzWY5w
gYXC5ID4NB54N7ag0iBltcZ+OnYWlhReTOxih9yZXq8lRzE2Ny5aA2ztM9YfDuYu
ATU9T+cfd9UTu8PPNPLuXLgVr1P+1JOApzq1EA0fjDq4L6FzMqgoumWFV3kXHwop
m27t/52Pu8U=
-----END CERTIFICATE-----
# This key is generated using create-cert.sh and should only be used for the test
key: |
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC41hcad074AFQl
QiM9j54tuh1yCpRfO2pFPOwESqT/gYrnAMfl24nI28FaC/gZWmhD5VZrThY8QlLe
sk7iyDmrvB6VMMs5di40C5XE11FLf+efS1CpD9atqLyBQ1tjB0yZzIPZFP97HRI4
DQb7BXqgOmDEnJ5gk6IleBsomQlDwyu9TXgUd8c4SEFgrxHMjfybZN3dKzw4jCB3
SrEqouaSq7eelCe0q58y4Lq8fkD+Zc2GrRJ0K5y3eMoRzp5ByK8QYPm8AJgFVTS9
kCs+HROqC+Y7WqracUiEHCDWY1HG5IbdC9GSNdPDu2GHUxFWtKhhPw+I7iuu3jF5
LRikLtDpAgMBAAECggEAQNS+98Z/SVd8LDFdgPs95RYRu+1gC2MgrDZpJjw0UXZT
jSDl/Iabdns1/2qRU/s09ROc0zhpbitpO7lZGAxYxhbOt0+NCJOeMx0ZJBjN5+hu
Cp51JUdr6i90JvbEOCDYSl3EpUDLN5iDymsvVp6eW1L+nBe/KWq/Bdtx0zSSXlSe
sdlQenZ6JcsLBqOwSzSkvG4DBH097pYhePzLOLyZ+watyaD5QoKUg1n2jtqCEBxG
2QV2D0UJVgkJrsytc9LRqIBVqKvwD3GkRtQcIlg4Cf3oWmFrwkVE0wYikLtnzfGt
GJ1dee1enHkexjwjD4RUd2Es1XDPmQNNZ9a2LrfynQKBgQDou2+8SdB60eyt2KwH
58Jeh+L/2nTt0VkiczsTp1RgXg+ZKWNuudmTlPR40Yg52uhDKec7Yb9XXfyuTXvL
v3lXYmsjFutj12u3pAEFWj63O7NpJ9R9vnyjwa1lwMQ3Ps9gp2pJmHtMy0alLMqt
H+yEYlbS0DexIclVOQMkcNkzpwKBgQDLUM2ddShG+SYZiC6eDtZU6DXjMdncdDp8
koTh+cJLL1tqqbmVRSBkWuhqlH6nenbnSLCZ+pbZ22bXJ8Jl/LXwmCpyUzt71wbQ
li+eGEvgGSZ4PV4JsqV7j70VD0BpxtJUFBT+6Zq2+Lns7ZgisHfvHyydRSai4+pp
4tCDvK6o7wKBgET/vSLPp5WiQ09PW8GEPqYUF4LPW7deR9Tk4PD0vRlNCcbY9HfR
deZBVTG0vXSZqB6xf7KlSjs2zEFJC5jejbUQor7mfqc9KNxrLTpPBSUB+DEG9ALL
xNwwAZ6XRhUy8/yt5d8n6/ZalflGjFhDjLW7Cg66WKiVYcF4g6v8IQklAoGBAKGS
MCRuQzjLrGRj3bAL2HYXJyPKrPhNgWEXyvQN2EKJettzz6B5E7nMqKByK4iKgM1h
7b4f7xtoCPz4grsrraZqNmkuDbpncen3QBYh9sI7GmA5XG7Wgj2ER93hhe3Ja8IX
R2wgVqwLUy2ezuTaWiU0H+9HUeHmv5WwAsZ9/ksPAoGBALmfyzS8J1jfkjMLhwvQ
vaS7UzPEufeJb/vg2WMd31TRc6fMcGZKwCvjE3z2xLewU+DwSynqjdRZn4mOt+sm
5LOMBdOTK6nEoVbGdCktYM8BpgxFSBaQ7oJDVRaHOOs7cauCOz7NCCd/e6q//S6L
wS6zVciWfFotxYTyTyj0WiiT
-----END PRIVATE KEY-----