panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use chart-testing ci/*-values.yaml for testing

Browse Source 
This also enables the refactor to have multiple root level charts.

Resolves #100

Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
2023-07-19 22:48:19 +02:00
parent a4c1de7b30
commit 06ddb7cd3f
47 changed files with 133 additions and 465 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/kind/conf/kind-config.yaml
+1
View File
@@ -15,3 +15,4 @@ kubeadmConfigPatches:
# admission-control-config-file: /etc/kubernetes/pki/admctrl/admission-control.yaml
nodes:
- role: control-plane
- role: worker
.github/tests/charts.sh
-6
View File
@@ -1,6 +0,0 @@
#!/usr/bin/env bash
REPOS=$(jq -r '.[] | "export " + ("HELM_REPO_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .repo' .github/tests/charts.json)
VERSIONS=$(jq -r '.[] | "export " + ("VERSION_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .version' .github/tests/charts.json)
eval "$REPOS"
eval "$VERSIONS"
.github/tests/upstream-authority-disk/create-cert.sh → .github/tests/create-cert.sh
View File
.github/tests/production-external-mysql/mysql-values.yaml → .github/tests/dependencies/mysql.yaml
+5
View File
@@ -5,3 +5,8 @@ primary:
drop: [ALL]
seccompProfile:
type: RuntimeDefault
auth:
database: spire-server
username: spire
password: sp1ff3Test
rootPassword: sp1ff3TestPassword
.github/tests/production-external-postgresql/postgresql-values.yaml → .github/tests/dependencies/postgresql.yaml
+5
View File
@@ -6,3 +6,8 @@ primary:
drop: [ALL]
seccompProfile:
type: RuntimeDefault
auth:
database: spire-server
username: spire
password: sp1ff3Test
postgresPassword: sp1ff3TestPassword
.github/tests/upstream-authority-disk/example-org.key → .github/tests/example-org.key
View File
.github/tests/upstream-authority-disk/example-org.pem → .github/tests/example-org.pem
View File
.github/tests/extras/post-install.sh
-17
View File
@@ -1,17 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [[ "$1" -ne 0 ]]; then
get_namespace_details "${scenario}"
fi
.github/tests/federation-bundle-endpoint/post-install.sh
-17
View File
@@ -1,17 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [[ "$1" -ne 0 ]]; then
get_namespace_details "${scenario}"
fi
.github/tests/namespace-override/post-install.sh
-19
View File
@@ -1,19 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status spire-server spire-system
if [[ "$1" -ne 0 ]]; then
get_namespace_details spire-server
get_namespace_details spire-systen
fi
.github/tests/namespace-override/pre-install.sh
-4
View File
@@ -1,4 +0,0 @@
#!/usr/bin/env bash
kubectl create namespace "spire-system"
kubectl create namespace "spire-server"
.github/tests/no-spire-controller-manager/post-install.sh → .github/tests/post-install.sh
Regular → Executable
+1 -6
View File
@@ -7,11 +7,6 @@ SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
source "${SCRIPTPATH}/common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [[ "$1" -ne 0 ]]; then
get_namespace_details "${scenario}"
fi
.github/tests/pre-install.sh
Executable
+53
View File
@@ -0,0 +1,53 @@
#!/usr/bin/env bash
set -xe
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
DEPS="${SCRIPTPATH}/dependencies"
# Set repo and version env variables
REPOS=$(jq -r '.[] | "export " + ("HELM_REPO_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .repo' "${SCRIPTPATH}/charts.json")
VERSIONS=$(jq -r '.[] | "export " + ("VERSION_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .version' "${SCRIPTPATH}/charts.json")
eval "$REPOS"
eval "$VERSIONS"
helm_install=(helm upgrade --install --create-namespace)
# namespace override
kubectl create namespace spire-system || true
kubectl create namespace spire-server || true
# nginx ingress
"${helm_install[@]}" ingress-nginx ingress-nginx --version "${VERSION_INGRESS_NGINX}" --repo "${HELM_REPO_INGRESS_NGINX}" \
--namespace ingress-nginx \
--set controller.extraArgs.enable-ssl-passthrough='' \
--wait
kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller
# prometheus
"${helm_install[@]}" kube-prometheus-stack kube-prometheus-stack \
--namespace prometheus \
--version "${VERSION_KUBE_PROMETHEUS_STACK}" \
--repo "${HELM_REPO_KUBE_PROMETHEUS_STACK}" \
--wait
# cert-manager
"${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \
--namespace cert-manager \
--set installCRDs=true \
--wait
# external database
# mysql
"${helm_install[@]}" mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \
--namespace mysql \
--values "${DEPS}/mysql.yaml" \
--wait
# postgres
"${helm_install[@]}" postgresql postgresql --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \
--namespace postgresql \
--values "${DEPS}/postgresql.yaml" \
--wait
.github/tests/production-example/install.sh
-13
View File
@@ -1,13 +0,0 @@
#!/usr/bin/env bash
set -xe
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
helm install \
--namespace spire-server \
--values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
spire charts/spire --wait
helm test spire --namespace spire-server
.github/tests/production-example/post-install.sh
-18
View File
@@ -1,18 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status spire-server spire-system
if [[ "$1" -ne 0 ]]; then
get_namespace_details spire-server
get_namespace_details spire-system
fi
.github/tests/production-example/pre-install.sh
-6
View File
@@ -1,6 +0,0 @@
#!/usr/bin/env bash
kubectl create namespace spire-system
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
kubectl create namespace spire-server
kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted
.github/tests/production-external-mysql/install.sh
-44
View File
@@ -1,44 +0,0 @@
#!/usr/bin/env bash
set -xe
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT")
DB=spire
DBUSER=spire
DBPW=$(uuidgen)
DBROOTPW=$(uuidgen)
# Generate random settings to make sure things come up with random settings.
cat <<EOF > /tmp/$$-db-values.yaml
auth:
database: ${DB}
username: ${DBUSER}
password: ${DBPW}
rootPassword: ${DBROOTPW}
EOF
cat <<EOF > /tmp/$$-spire-values.yaml
spire-server:
dataStore:
sql:
databaseType: mysql
databaseName: ${DB}
username: ${DBUSER}
password: ${DBPW}
host: mysql
port: 3306
EOF
helm install mysql mysql --namespace "spire-server" --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \
--values "${SCRIPTPATH}/mysql-values.yaml" \
--values /tmp/$$-db-values.yaml --wait
helm install \
--namespace "spire-server" \
--values /tmp/$$-spire-values.yaml \
--values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
spire charts/spire --wait
helm test spire --namespace "spire-server"
.github/tests/production-external-mysql/post-install.sh
-18
View File
@@ -1,18 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status spire-server spire-system
if [[ "$1" -ne 0 ]]; then
get_namespace_details spire-server
get_namespace_details spire-system
fi
.github/tests/production-external-mysql/pre-install.sh
-6
View File
@@ -1,6 +0,0 @@
#!/usr/bin/env bash
kubectl create namespace spire-system
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
kubectl create namespace spire-server
kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted
.github/tests/production-external-postgresql/install.sh
-46
View File
@@ -1,46 +0,0 @@
#!/usr/bin/env bash
set -xe
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT")
DB=$(uuidgen)
DBUSER=$(uuidgen)
DBPW=$(uuidgen)
DBPGPW=$(uuidgen)
# Generate random settings to make sure things come up with random settings.
cat > /tmp/$$-db-values.yaml <<EOF
auth:
database: ${DB}
username: ${DBUSER}
password: ${DBPW}
postgresPassword: ${DBPGPW}
EOF
cat > /tmp/$$-spire-values.yaml <<EOF
spire-server:
dataStore:
sql:
databaseType: postgres
databaseName: ${DB}
username: ${DBUSER}
password: ${DBPW}
host: postgresql
port: 5432
options:
- sslmode: disable
EOF
helm install postgresql postgresql --namespace "spire-server" --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \
--values "${SCRIPTPATH}/postgresql-values.yaml" \
--values /tmp/$$-db-values.yaml --wait
helm install \
--namespace "spire-server" \
--values /tmp/$$-spire-values.yaml \
--values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
spire charts/spire --wait
helm test spire --namespace "spire-server"
.github/tests/production-external-postgresql/post-install.sh
-18
View File
@@ -1,18 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status spire-server spire-system
if [[ "$1" -ne 0 ]]; then
get_namespace_details spire-server
get_namespace_details spire-system
fi
.github/tests/production-external-postgresql/pre-install.sh
-6
View File
@@ -1,6 +0,0 @@
#!/usr/bin/env bash
kubectl create namespace spire-system
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
kubectl create namespace spire-server
kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted
.github/tests/prometheus/post-install.sh
-17
View File
@@ -1,17 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [[ "$1" -ne 0 ]]; then
get_namespace_details "${scenario}"
fi
.github/tests/prometheus/pre-install.sh
-11
View File
@@ -1,11 +0,0 @@
#!/usr/bin/env bash
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
helm install kube-prometheus-stack kube-prometheus-stack \
--version "${VERSION_KUBE_PROMETHEUS_STACK}" \
--repo "${HELM_REPO_KUBE_PROMETHEUS_STACK}" \
-n "${scenario}" \
--wait
.github/tests/spire-oidc-insecure/post-install.sh
-17
View File
@@ -1,17 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [[ "$1" -ne 0 ]]; then
get_namespace_details "${scenario}"
fi
.github/tests/spire-oidc-insecure/pre-install.sh
-8
View File
@@ -1,8 +0,0 @@
#!/usr/bin/env bash
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
helm install ingress-nginx ingress-nginx --version "${VERSION_INGRESS_NGINX}" --repo "${HELM_REPO_INGRESS_NGINX}" -n "$scenario" --set controller.extraArgs.enable-ssl-passthrough=
kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller -n "$scenario"
.github/tests/tornjak/install.sh
-13
View File
@@ -1,13 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT")
helm install \
--namespace spire-server \
--values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
--values "${SCRIPTPATH}/../../../examples/tornjak/values.yaml" \
spire charts/spire --wait
helm test spire -n spire-server
.github/tests/tornjak/post-install.sh
-23
View File
@@ -1,23 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status spire-server spire-system
kubectl rollout status --watch --timeout 180s --namespace spire-server deployments.apps spire-tornjak-frontend
kubectl -n spire-server get deploy spire-tornjak-frontend
kubectl -n spire-server get service spire-tornjak-frontend
if [[ "$1" -ne 0 ]]; then
get_namespace_details spire-server
get_namespace_details spire-system
fi
.github/tests/tornjak/pre-install.sh
-6
View File
@@ -1,6 +0,0 @@
#!/usr/bin/env bash
kubectl create namespace spire-system
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
kubectl create namespace spire-server
kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted
.github/tests/upstream-authority-cert-manager/post-install.sh
-17
View File
@@ -1,17 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT=$(readlink -f "$0")
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [ "$1" != '0' ]; then
get_namespace_details "${scenario}"
fi
.github/tests/upstream-authority-cert-manager/pre-install.sh
-7
View File
@@ -1,7 +0,0 @@
#!/usr/bin/env bash
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
helm install cert-manager cert-manager --namespace cert-manager --create-namespace --version "$VERSION_CERT_MANAGER" --set installCRDs=true --repo "$HELM_REPO_CERT_MANAGER" --wait
.github/tests/upstream-authority-disk/post-install.sh
-17
View File
@@ -1,17 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT=$(readlink -f "$0")
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [ "$1" != '0' ]; then
get_namespace_details "${scenario}"
fi
.github/workflows/helm-chart-ci-ignore.yaml
-22
View File
@@ -24,28 +24,8 @@ jobs:
steps:
- run: 'echo "Skipping checks"'
build-matrix:
name: Build matrix
runs-on: ubuntu-22.04
steps:
- name: Checkout
uses: actions/[email protected]
- id: set-matrix
name: Collect all tests
run: |
tests="$(echo -e "default\n$(find .github/tests -maxdepth 1 -type d | grep -Ev 'tests$' | xargs -I % basename % | sort | uniq)")"
tests_json="$(echo "$tests" | jq -c --slurp --raw-input 'split("\n") | map(select(. != ""))')"
echo "tests=$tests_json" >> $GITHUB_OUTPUT
outputs:
tests: ${{ steps.set-matrix.outputs.tests }}
test:
runs-on: ubuntu-22.04
needs:
- build-matrix
strategy:
matrix:
@@ -53,8 +33,6 @@ jobs:
- v1.27.2
- v1.26.4
- v1.25.9
values:
- ${{ fromJson(needs.build-matrix.outputs.tests) }}
steps:
- run: 'echo "Skipping tests"'
.github/workflows/helm-chart-ci.yaml
+10 -51
View File
@@ -117,32 +117,11 @@ jobs:
outputs:
changed: ${{ steps.list-changed.outputs.changed }}
build-matrix:
name: Build matrix
runs-on: ubuntu-22.04
needs: [lint-chart]
steps:
- name: Checkout
uses: actions/[email protected]
- id: set-matrix
name: Collect all tests
run: |
tests="$(echo -e "default\n$(find .github/tests -maxdepth 1 -type d | grep -Ev 'tests$' | xargs -I % basename % | sort | uniq)")"
tests_json="$(echo "$tests" | jq -c --slurp --raw-input 'split("\n") | map(select(. != ""))')"
echo "tests=$tests_json" >> $GITHUB_OUTPUT
outputs:
tests: ${{ steps.set-matrix.outputs.tests }}
test:
runs-on: ubuntu-22.04
needs:
- lint-chart
- build-matrix
strategy:
fail-fast: false
@@ -155,8 +134,6 @@ jobs:
- v1.27.2
- v1.26.4
- v1.25.9
values:
- ${{ fromJson(needs.build-matrix.outputs.tests) }}
steps:
- name: Checkout
@@ -188,34 +165,16 @@ jobs:
config: .github/kind/conf/kind-config.yaml
verbosity: 1
- name: Setup Test dependencies
run: ./pre-install.sh
working-directory: .github/tests
- name: Run chart-testing (install)
run: |
post-install() {
[ -x "${TEST_DIR}/post-install.sh" ] && "${TEST_DIR}/post-install.sh" $1
exit $1
}
trap 'post-install $? $LINENO' EXIT
export scenario="$(basename "${TEST_DIR}")"
export EXTRA_HELM_ARGS=""
source .github/tests/charts.sh
[ "${scenario}" != "default" ] && kubectl create namespace "${scenario}"
[ -x "${TEST_DIR}/pre-install.sh" ] && "${TEST_DIR}/pre-install.sh"
[ -f "${TEST_DIR}/.env" ] && source "${TEST_DIR}/.env"
if [ -x "${TEST_DIR}/install.sh" ]; then
"${TEST_DIR}/install.sh"
else
ct install --debug \
--charts "charts/spire" \
--namespace "${scenario}" \
ct install --config ct.yaml \
--target-branch ${{ github.base_ref }} \
--exclude-deprecated \
--skip-clean-up \
${{ (matrix.values != 'default' && '--helm-extra-set-args "--values=${TEST_DIR}/values.yaml ${EXTRA_HELM_ARGS}"') || '' }}
fi
env:
TEST_DIR: .github/tests/${{ matrix.values }}
- name: Test summary
if: always()
run: ./post-install.sh
working-directory: .github/tests
Makefile
+21 -4
View File
@@ -2,7 +2,6 @@ TARGET_BRANCH ?= main
.PHONY: help
help: ## Display this help.
@$(MAKE) help
@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf " \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
##@ Linting:
@@ -31,7 +30,25 @@ clean-lingering-resources:
&>/dev/null || true
.PHONY: test
test: ## Run tests using Helm chart-testing (ensure to run on dedicated test cluster)
test: install-test-dependencies ## Run tests using Helm chart-testing (ensure to run on dedicated test cluster)
@echo Running tests…
@ct install --debug \
--charts charts/spire
@ct install --config ct.yaml
.PHONY: install-test-dependencies
install-test-dependencies: ## Install test dependency resources
@echo Installing test dependencies…
@.github/tests/pre-install.sh
.PHONY: cleanup-test-dependencies
cleanup-test-dependencies: ## Cleans up all test dependencies resources
@echo Uninstalling test dependencies…
@helm uninstall -n cert-manager cert-manager 2>/dev/null || true
@kubectl delete ns cert-manager 2>/dev/null || true
@helm uninstall -n prometheus kube-prometheus-stack 2>/dev/null || true
@kubectl delete ns prometheus 2>/dev/null || true
@helm uninstall -n mysql mysql 2>/dev/null|| true
@kubectl delete ns mysql 2>/dev/null || true
@helm uninstall -n postgresql postgresql 2>/dev/null || true
@kubectl delete ns postgresql 2>/dev/null || true
@helm uninstall -n ingress-nginx ingress-nginx 2>/dev/null || true
@kubectl delete ns ingress-nginx 2>/dev/null || true
charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
+1 -1
View File
@@ -33,7 +33,7 @@ spec:
- name: curl-ingress
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
command: ['curl']
args: ['-s', '-f', 'http://{{ index .Values.config.additionalDomains 0 }}/.well-known/openid-configuration']
args: ['-s', '-f', 'http://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
securityContext:
{{- toYaml .Values.securityContext | nindent 8 }}
{{- end }}
charts/spire/ci/external-mysql-values.yaml
+11
View File
@@ -0,0 +1,11 @@
spire-server:
dataStore:
sql:
databaseType: mysql
databaseName: spire-server
username: spire
password: sp1ff3Test
host: mysql.mysql
port: 3306
options:
- parseTime: true
charts/spire/ci/external-postgres-values.yaml
+11
View File
@@ -0,0 +1,11 @@
spire-server:
dataStore:
sql:
databaseType: postgres
databaseName: spire-server
username: spire
password: sp1ff3Test
host: postgresql.postgresql
port: 5432
options:
- sslmode: disable
.github/tests/extras/values.yaml → charts/spire/ci/extras-values.yaml
View File
.github/tests/federation-bundle-endpoint/values.yaml → charts/spire/ci/federation-bundle-endpoint-values.yaml
View File
.github/tests/namespace-override/values.yaml → charts/spire/ci/namespace-override-values.yaml
View File
.github/tests/no-spire-controller-manager/values.yaml → charts/spire/ci/no-spire-controller-manager-values.yaml
View File
.github/tests/spire-oidc-insecure/values.yaml → charts/spire/ci/oidc-values.yaml
+5 -4
View File
@@ -8,14 +8,14 @@ spire-server:
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
hosts:
- host: ingress-nginx-controller.spire-oidc-insecure
- host: ingress-nginx-controller.ingress-nginx
paths:
- path: /
pathType: Prefix
spire-agent:
server:
address: ingress-nginx-controller.spire-oidc-insecure
address: ingress-nginx-controller.ingress-nginx
port: 443
spiffe-oidc-discovery-provider:
@@ -26,7 +26,8 @@ spiffe-oidc-discovery-provider:
config:
additionalDomains:
- ingress-nginx-controller
- ingress-nginx-controller.ingress-nginx
- ingress-nginx-controller.ingress-nginx.svc.cluster.local
acme:
tosAccepted: false
@@ -35,7 +36,7 @@ spiffe-oidc-discovery-provider:
enabled: true
className: nginx
hosts:
- host: ingress-nginx-controller
- host: ingress-nginx-controller.ingress-nginx.svc.cluster.local
paths:
- path: /
pathType: Prefix
.github/tests/prometheus/values.yaml → charts/spire/ci/prometheus-values.yaml
View File
charts/spire/ci/tornjak-values.yaml
+6
View File
@@ -0,0 +1,6 @@
spire-server:
tornjak:
enabled: true
tornjak-frontend:
enabled: true
.github/tests/upstream-authority-cert-manager/values.yaml → charts/spire/ci/upstream-authority-cert-manager-values.yaml
View File
.github/tests/upstream-authority-disk/values.yaml → charts/spire/ci/upstream-authority-disk-values.yaml
View File