From 1bf3aa77ef3d225c5b3c5a5b7f82f1cb4cdfb97a Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 11 Apr 2024 12:29:28 -0700 Subject: [PATCH] Default spire-server port 443 (#308) Changes the default service port for the spire-server to 443 to allow easier switching between internal access and external access through an ingress controller. Signed-off-by: Kevin Fox Signed-off-by: Faisal Memon Co-authored-by: Faisal Memon --- charts/spire/README.md | 5 ++++- charts/spire/charts/spire-agent/README.md | 2 +- charts/spire/charts/spire-agent/values.yaml | 2 +- charts/spire/charts/spire-server/README.md | 4 ++-- charts/spire/charts/spire-server/values.yaml | 4 ++-- 5 files changed, 10 insertions(+), 7 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index e72a79f..22d8879 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -77,7 +77,10 @@ We only support upgrading one major version at a time. Version skipping isn't su ### 0.20.X -This release configures the entries managed by the spire-controller-manager to move into their own managed space within SPIRE. This should be transparent. In a future release, we will +- The default service port for the spire-server was changed to be port 443 to allow easier switching between internal access and external access through an ingress controller. For most users, this will be a transparent +change. + +- This release configures the entries managed by the spire-controller-manager to move into their own managed space within SPIRE. This should be transparent. In a future release, we will disable cleanup by default of the old space. This release lays the groundwork for future support for manually created entries in the SPIRE database without the spire-controller-manager destroying them. It is supported in this release by manually setting spire-server.controllerManager.entryIDPrefixCleanup=false after successfully upgrading to the chart without the setting and waiting for a spire-controller-manager sync. diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 9556614..85d87a2 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -57,7 +57,7 @@ A Helm chart to install the SPIRE agent. | `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` | | `disableReattestToRenew` | Deprecated: Allow agent to renew certificate when it expires rather than reattest | `false` | | `server.address` | Address for Spire server | `""` | -| `server.port` | Port number for Spire server | `8081` | +| `server.port` | Port number for Spire server | `443` | | `server.namespaceOverride` | Override the namespace for Spire server | `""` | | `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` | | `healthChecks.port` | override the host port used for health checking | `9982` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index f9ab02d..be1b1d9 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -113,7 +113,7 @@ upstream: false ## server: address: "" - port: 8081 + port: 443 namespaceOverride: "" nameOverride: "" diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 78100c8..5e503cc 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -101,7 +101,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `securityContext` | Security context | `{}` | | `priorityClassName` | Priority class assigned to statefulset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `service.type` | Type of the Spire server service created | `ClusterIP` | -| `service.port` | Port for the created service | `8081` | +| `service.port` | Port for the created service | `443` | | `service.annotations` | Annotations to add to the service object | `{}` | | `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` | | `resources` | Resource requests and limits | `{}` | @@ -215,7 +215,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | | | `upstreamAuthority.spire.server.nameOverride` | Override the name for upstream Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` | | `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` | -| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `8081` | +| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `443` | | `upstreamAuthority.vault.enabled` | Enable Hashicorp Vault as upstream CA | `false` | | `upstreamAuthority.vault.vaultAddr` | The URL of the Vault server. (e.g., https://vault.example.com:8443/) | `""` | | `upstreamAuthority.vault.namespace` | Name of the Vault namespace. This is only available in the Vault Enterprise. | `""` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 4411597..1e38cbd 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -75,7 +75,7 @@ priorityClassName: "" ## service: type: ClusterIP - port: 8081 + port: 443 annotations: {} configMap: @@ -403,7 +403,7 @@ upstreamAuthority: ## @param upstreamAuthority.spire.server.address Address for upstream Spire server address: "" ## @param upstreamAuthority.spire.server.port Port for upstream Spire server - port: 8081 + port: 443 vault: ## @param upstreamAuthority.vault.enabled Enable Hashicorp Vault as upstream CA enabled: false