diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 02f1c77..31501de 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,26 +2,26 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "51.8.0" + "version": "52.1.0" }, { "name": "cert-manager", "repo": "https://charts.jetstack.io", - "version": "v1.13.1" + "version": "v1.13.2" }, { "name": "ingress-nginx", "repo": "https://kubernetes.github.io/ingress-nginx", - "version": "4.8.2" + "version": "4.8.3" }, { "name": "mysql", "repo": "https://charts.bitnami.com/bitnami", - "version": "9.12.5" + "version": "9.14.1" }, { "name": "postgresql", "repo": "https://charts.bitnami.com/bitnami", - "version": "13.1.5" + "version": "13.2.1" } ] diff --git a/.github/tests/common.sh b/.github/tests/common.sh index c550721..3fa18df 100755 --- a/.github/tests/common.sh +++ b/.github/tests/common.sh @@ -1,5 +1,7 @@ #!/usr/bin/env bash +GITHUB_STEP_SUMMARY="${GITHUB_STEP_SUMMARY:-/tmp/summary}" + get_namespace_details () { cat <>"$GITHUB_STEP_SUMMARY" ### Namespace $1 diff --git a/.github/tests/dependencies/spire-root-server-values.yaml b/.github/tests/dependencies/spire-root-server-values.yaml index f588366..400a10c 100644 --- a/.github/tests/dependencies/spire-root-server-values.yaml +++ b/.github/tests/dependencies/spire-root-server-values.yaml @@ -2,11 +2,17 @@ global: spire: clusterName: production trustDomain: production.other - jwtIssuer: oidc-discovery.production.other spire-server: controllerManager: - enabled: false + identities: + namespaceSelector: + kubernetes.io/metadata.name: spire-server + podSelector: + app.kubernetes.io/component: server + app.kubernetes.io/instance: spire + app.kubernetes.io/name: server + downstream: true nodeAttestor: k8sPsat: serviceAccountAllowList: diff --git a/.github/workflows/check-versions.yaml b/.github/workflows/check-versions.yaml index 7a39ffc..766fe14 100644 --- a/.github/workflows/check-versions.yaml +++ b/.github/workflows/check-versions.yaml @@ -20,7 +20,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 - name: Set up Helm uses: azure/setup-helm@v3.5 diff --git a/.github/workflows/helm-chart-ci-ignore.yaml b/.github/workflows/helm-chart-ci-ignore.yaml index 3e88952..07841e4 100644 --- a/.github/workflows/helm-chart-ci-ignore.yaml +++ b/.github/workflows/helm-chart-ci-ignore.yaml @@ -43,7 +43,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 - id: set-matrix name: Collect all examples diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index 32ae4fb..e2a2abd 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -32,7 +32,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 - name: Verify Docs updated run: ./helm-docs.sh @@ -94,7 +94,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 with: fetch-depth: 0 @@ -109,7 +109,7 @@ jobs: python-version: ${{ env.PYTHON_VERSION }} - name: Setup chart-testing - uses: helm/chart-testing-action@v2.4.0 + uses: helm/chart-testing-action@v2.6.1 with: version: ${{ env.CHART_TESTING_VERSION }} @@ -136,7 +136,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 with: fetch-depth: 0 @@ -151,7 +151,7 @@ jobs: python-version: ${{ env.PYTHON_VERSION }} - name: Setup chart-testing - uses: helm/chart-testing-action@v2.4.0 + uses: helm/chart-testing-action@v2.6.1 with: version: ${{ env.CHART_TESTING_VERSION }} @@ -185,7 +185,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 - id: set-matrix name: Collect all examples @@ -217,7 +217,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 - name: Set up Helm uses: azure/setup-helm@v3.5 @@ -261,7 +261,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 - name: Set up Helm uses: azure/setup-helm@v3.5 diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml index b700d43..99b3508 100644 --- a/.github/workflows/helm-release.yaml +++ b/.github/workflows/helm-release.yaml @@ -19,7 +19,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 with: fetch-depth: 0 @@ -29,7 +29,7 @@ jobs: git config user.email "$GITHUB_ACTOR@users.noreply.github.com" - name: Setup cosign - uses: sigstore/cosign-installer@v3.1.2 + uses: sigstore/cosign-installer@v3.2.0 with: cosign-release: v2.2.0 @@ -39,7 +39,7 @@ jobs: version: v3.10.3 - name: Run chart-releaser - uses: helm/chart-releaser-action@v1.5.0 + uses: helm/chart-releaser-action@v1.6.0 env: CR_TOKEN: '${{ secrets.GITHUB_TOKEN }}' diff --git a/.github/workflows/shellcheck.yaml b/.github/workflows/shellcheck.yaml index 9840317..7e5b19e 100644 --- a/.github/workflows/shellcheck.yaml +++ b/.github/workflows/shellcheck.yaml @@ -21,7 +21,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 - name: Run Shellcheck uses: ludeeus/action-shellcheck@2.0.0 diff --git a/CODE-OF-CONDUCT.md b/CODE-OF-CONDUCT.md index e758eac..19a1b34 100644 --- a/CODE-OF-CONDUCT.md +++ b/CODE-OF-CONDUCT.md @@ -1,8 +1,8 @@ -### Contributor Code of Conduct +# Contributor Code of Conduct We follow the [CNCF Contributor Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md). Additionally, we commit to the following guidelines as detailed on the [Linkerd Code of Conduct](https://github.com/linkerd/linkerd/wiki/Linkerd-code-of-conduct): -### Community Guidelines +## Community Guidelines - Our goal is to foster an inclusive and diverse community of technology enthusiasts. @@ -14,6 +14,6 @@ We follow the [CNCF Contributor Code of Conduct](https://github.com/cncf/foundat - We do our best to avoid [subtle-isms](https://www.recurse.com/manual#sub-sec-social-rules): small actions that make others feel uncomfortable. If you witness a subtle-ism, you may respectfully point it out to the person publicly or privately, or you may ask a moderator to say something. Accidentally saying something biased is common, expected, and readily forgiven. It is not in and of itself a bannable offense. -### Moderation +## Moderation - If you feel any of SPIFFE's communication channels require moderation, please e-mail the [SPIFFE Steering Committee (SSC)](mailto:ssc@spiffe.io). diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 005d03c..1d4a7ae 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -38,7 +38,8 @@ git rebase main Our CI pipeline takes care of the majority of the testing of this Chart. Other ways for you to test are by running `make test` locally using: -> **Warning**: Ensure to run the test on a dedicated k8s cluster that does not have Spire installed yet. +> [!Warning] +> Ensure to run the test on a dedicated k8s cluster that does not have Spire installed yet. ```shell make test @@ -48,7 +49,7 @@ Another approach to testing the chart is by installing one of the examples in yo ## Generating documentation -Any changes to Chart.yaml or values.yaml require an update of the README.md. This update can easily be generated using [readme-generator](https://github.com/bitnami-labs/readme-generator-for-helm). +Any changes to Chart.yaml or values.yaml require an update of the README.md. This update can easily be generated using [readme-generator][]. ```shell ./helm-docs.sh diff --git a/FAQ.md b/FAQ.md index 25313ea..eda231e 100644 --- a/FAQ.md +++ b/FAQ.md @@ -36,7 +36,8 @@ helm repo add spiffe https://spiffe.github.io/helm-charts-hardened If you uninstall the SPIRE chart before all users of the CSI driver are removed, Pods will get stuck in a terminating state waiting for the driver, that no longer is installed, to unmount the volumes for the Pod. In order to fix this, reinstall the chart and remove all affected workloads that are not part of the SPIRE helm chart itself, before attempting to remove SPIRE again. You can discover Pods that use the driver with the following command: -``` + +```shell kubectl get pods --all-namespaces -o go-template='{{range .items}}{{$nn := printf "%s %s" .metadata.namespace .metadata.name}}{{range .spec.volumes}}{{if .csi.driver}}{{if eq .csi.driver "csi.spiffe.io"}}{{printf "%s\n" $nn}}{{end}}{{end}}{{end}}{{end}}' ``` @@ -44,17 +45,20 @@ kubectl get pods --all-namespaces -o go-template='{{range .items}}{{$nn := print If you uninstall the SPIFFE CSI driver manually before removing the chart, Pods can still be using the driver and are unable to unmount the CSI volume. -To resolve, reinstall the chart before trying to remove it again. +To resolve, reinstall the chart before trying to remove it again. ## The PSAT plugin is not working The chart requires `Projected Service Account Tokens` which has to be enabled on your Kubernetes API server. In most cases this is already done for you. -> **Note**: This is enabled by default with newer versions as shown by the existence of: +> [!Note] +> This is enabled by default with newer versions as shown by the existence of: > +> ```yaml > - --service-account-issuer > - --service-account-key-file > - --service-account-signing-key-file +> ``` See [Service Account Token Volume Projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) in the Kubernetes docs for more details. @@ -64,7 +68,9 @@ command to SSH into the Docker Desktop K8s VM. ```bash docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh ``` + Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml` + ```yaml spec: containers: diff --git a/README.md b/README.md index 19c83cf..ea0704a 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,7 @@ -> **Note**: All the helm charts in this repo are beta. We encourage you to try them out and contribute. The API may change as we move towards a production ready release. +> [!Note] +> Things to consider: +> 1. We do not support running out of the git main branch. This is where development happens. Please use released versions via the published repo or git tags. +> 2. All the helm charts in this repo are beta. We encourage you to try them out and contribute. The API may change as we move towards a production ready release. # SPIFFE Helm Charts @@ -8,24 +11,10 @@ A suite of [Helm Charts](https://helm.sh/docs) for standardized installations of SPIRE components in Kubernetes environments. -## Add Helm repository +## How to install or upgrade -```bash -helm repo add spiffe https://spiffe.github.io/helm-charts/ -helm repo update -``` - -## Dependencies and Version Compatibility - -Unless otherwise noted in an application chart README, the following dependencies will follow these prescribed version compatibility rules. - -| Dependency | Supported Versions | -|:-----------|:-------------------| -| SPIRE | `1.8.2` | -| Helm | `3.x` | -| Kubernetes | `1.22+` | - -> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. *The first version we tested this chart with is `1.22`.* +You most likely want to do an integrated setup based on the spire chart. +See the [Instructions](https://artifacthub.io/packages/helm/spiffe/spire). ## Contributing diff --git a/charts/spire-crds/README.md b/charts/spire-crds/README.md index 7eb21c2..9f69df4 100644 --- a/charts/spire-crds/README.md +++ b/charts/spire-crds/README.md @@ -7,6 +7,7 @@ A Helm chart to install the SPIRE CRDS. **Homepage:** ## Maintainers + | Name | Email | Url | | ---- | ------ | --- | | marcofranssen | | | @@ -16,8 +17,8 @@ A Helm chart to install the SPIRE CRDS. ## Source Code -* +* - + ## Parameters diff --git a/charts/spire-crds/templates/spire.spiffe.io_clusterfederatedtrustdomains.yaml b/charts/spire-crds/templates/spire.spiffe.io_clusterfederatedtrustdomains.yaml index 6380ac4..112249f 100644 --- a/charts/spire-crds/templates/spire.spiffe.io_clusterfederatedtrustdomains.yaml +++ b/charts/spire-crds/templates/spire.spiffe.io_clusterfederatedtrustdomains.yaml @@ -65,6 +65,9 @@ spec: description: BundleEndpointURL is the URL of the bundle endpoint. It must be an HTTPS URL and cannot contain userinfo (i.e. username/password). type: string + className: + description: Set the class of controller to handle this object. + type: string trustDomain: description: TrustDomain is the name of the trust domain to federate with (e.g. example.org) @@ -89,3 +92,9 @@ spec: storage: true subresources: status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml b/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml index d630c73..951fa0e 100644 --- a/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml +++ b/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml @@ -41,6 +41,10 @@ spec: access the SPIRE administrative APIs. Extra care should be taken to only apply this SPIFFE ID to admin workloads. type: boolean + autoPopulateDNSNames: + description: AutoPopulateDNSNames indicates whether or not to auto + populate service DNS names. + type: boolean dnsNameTemplates: description: DNSNameTemplate represents templates for extra DNS names that are applicable to SVIDs minted for this ClusterSPIFFEID. The @@ -53,6 +57,9 @@ spec: description: Downstream indicates that the entry describes a downstream SPIRE server. type: boolean + className: + description: Set the class of controller to handle this object. + type: string federatesWith: description: FederatesWith is a list of trust domain names that workloads that obtain this SPIFFE ID will federate with. @@ -224,3 +231,9 @@ spec: storage: true subresources: status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml b/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml index 3e2e35c..bfdde50 100644 --- a/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml +++ b/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml @@ -39,6 +39,9 @@ spec: properties: admin: type: boolean + className: + description: Set the class of controller to handle this object. + type: string dnsNames: items: type: string @@ -90,3 +93,9 @@ spec: storage: true subresources: status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index dba8bd3..188efc3 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -3,8 +3,8 @@ name: spire description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.14.0 -appVersion: "1.8.2" +version: 0.15.0 +appVersion: "1.8.4" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index aa89c4b..9d62bfc 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,27 +1,82 @@ # spire -![Version: 0.14.0](https://img.shields.io/badge/Version-0.13.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) +![Version: 0.15.0](https://img.shields.io/badge/Version-0.13.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. **Homepage:** +## Install notes + +To do a quick non production install suitable for quick testing in something like minikube: + +```shell +helm install -n spire-server spire-crds --repo https://spiffe.github.io/helm-charts-hardened/ --create-namespace +helm install -n spire-server spire --repo https://spiffe.github.io/helm-charts-hardened/ +``` + +To customize, start with a base values file and edit as needed: + +```shell +curl -o your-values.yaml https://raw.githubusercontent.com/spiffe/helm-charts-hardened/main/examples/production/example-your-values.yaml +``` + +Then: + +```shell +helm install -n spire-server spire --repo https://spiffe.github.io/helm-charts-hardened/ -f your-values.yaml +``` + +For production installs, please see [the production example](https://github.com/spiffe/helm-charts-hardened/tree/main/examples/production). + +## Upgrade notes + +### 0.15.X + +The spire-crds chart has been updated. Please ensure you have upgraded spire-crds before upgrading the spire chart. + +The chart now supports multiple parallel installs of spire-controller-manager. Each install will handle all custom resources with a matching `className` field. By default this is set to `Release.Namespace-Release.Name` and the controller manager will only pick up custom resources with this `className`. + +If you have not loaded any SPIRE custom resources yourself, the upgrade process will be transparent. If you have loaded your own SPIRE custom resources, set `spire-server.controllerManager.watchClassless=true` until you can update your SPIRE custom resources to have the `className` for the instance specified. + +### 0.14.X + +If coming from a chart version before 0.15.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart +run the following: + +Replace the spire-server namespace in the commands below with the namespace you want to install the spire-crds chart in. + +```shell +kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" +kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" +kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" +kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" +kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" +kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" +kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" +kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" +kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" +helm install -n spire-server spire-crds charts/spire-crds +``` + ## Version support -> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`). +> [!Warning] +> This Chart is still in development and still subject to change the API (`values.yaml`). > Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although > we do aim for as much stability as possible. | Dependency | Supported Versions | |:-----------|:-------------------| -| SPIRE | `1.5.3+`, `1.6.3+` | | Helm | `3.x` | | Kubernetes | `1.22+` | -> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. +> [!Note] +> For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. ## FAQ + For any issues see our [FAQ](../../FAQ.md)… ## Usage @@ -83,57 +138,25 @@ Now you can interact with the Spire agent socket from your own application. The | file://./charts/spire-server | spire-server | 0.1.0 | | file://./charts/tornjak-frontend | tornjak-frontend | 0.1.0 | -## Install notes - -To do a quick non production install: - -```shell -kubectl create namespace spire-system -helm install -n spire-system spire-crds charts/spire-crds -helm install -n spire-system spire charts/spire - -For production installs, please see [the production example](examples/production/). - -## Upgrade notes - -0.14.X: - -If coming from a chart version before 0.14.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart -run the following: - -```shell -# Replace the spire-server namespace in the commands below with the namespace you want to install the spire-crds chart in. - -kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" -kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" -kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" -kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" -kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" -kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" -kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" -kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" -kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" -helm install -n spire-server spire-crds charts/spire-crds -``` - ## Parameters ### Global parameters -| Name | Description | Value | -| --------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ---------------------------- | -| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` | -| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` | -| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` | -| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens | `oidc-discovery.example.org` | -| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` | -| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` | -| `global.spire.image.registry` | Override all Spire image registries at once | `""` | -| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` | -| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | -| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | +| Name | Description | Value | +| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | +| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` | +| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` | +| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` | +| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset | `""` | +| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` | +| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` | +| `global.spire.image.registry` | Override all Spire image registries at once | `""` | +| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` | +| `global.spire.ingressControllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | +| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | +| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | ### Spire server parameters diff --git a/charts/spire/README.md.gotmpl b/charts/spire/README.md.gotmpl deleted file mode 100644 index 5939f32..0000000 --- a/charts/spire/README.md.gotmpl +++ /dev/null @@ -1,75 +0,0 @@ -{{ template "chart.header" . }} - - - -{{ template "chart.deprecationWarning" . }} - -{{ template "chart.badgesSection" . }} -[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) - -{{ template "chart.description" . }} - -{{ template "chart.homepageLine" . }} - -## Version support - -> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`). -> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although -> we do aim for as much stability as possible. - -| Dependency | Supported Versions | -|:-----------|:-------------------| -| SPIRE | `1.5.3+`, `1.6.3+` | -| Helm | `3.x` | -| Kubernetes | `1.22+` | - -> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. - -## FAQ -For any issues see our [FAQ](../../FAQ.md)… - -## Usage - -To utilize Spire in your own workloads you should add the following to your workload: - -```diff - apiVersion: v1 - kind: Pod - metadata: - name: my-app - spec: - containers: - - name: my-app - image: "my-app:latest" - imagePullPolicy: Always -+ volumeMounts: -+ - name: spiffe-workload-api -+ mountPath: /spiffe-workload-api -+ readOnly: true - resources: - requests: - cpu: 200m - memory: 32Mi - limits: - cpu: 500m - memory: 64Mi -+ volumes: -+ - name: spiffe-workload-api -+ csi: -+ driver: "csi.spiffe.io" -+ readOnly: true -``` - -Now you can interact with the Spire agent socket from your own application. The socket is mounted on `/spiffe-workload-api/spire-agent.sock`. - -{{ template "chart.maintainersSection" . }} - -{{ template "chart.sourcesSection" . }} - -{{ template "chart.requirementsHeader" . }} - -{{ template "chart.requirementsTable" . }} - -{{ template "chart.valuesSection" . }} - ----------------------------------------------- diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index c3e96fe..2b2b115 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -1,14 +1,13 @@ # spiffe-csi-driver - - ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.2.3](https://img.shields.io/badge/AppVersion-0.2.3-informational?style=flat-square) A Helm chart to install the SPIFFE CSI driver. **Homepage:** -> **Note**: The recommended version is `0.2.3` to support arm64 nodes. If running with any +> [!Note] +> The recommended version is `0.2.3` to support arm64 nodes. If running with any > prior version to `0.2.3` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. ## Maintainers @@ -24,41 +23,48 @@ A Helm chart to install the SPIFFE CSI driver. * + + ## Parameters ### SPIFFE CSI Driver Chart parameters -| Name | Description | Value | -| ---------------------------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------- | -| `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` | -| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` | -| `image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `resources` | Resource requests and limits for spiffe-csi-driver | `{}` | -| `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` | -| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | -| `livenessProbe.timeoutSeconds` | Timeout value in seconds for livenessProbe | `5` | -| `imagePullSecrets` | Image pull secret details for spiffe-csi-driver | `[]` | -| `nameOverride` | Name override for spiffe-csi-driver | `""` | -| `namespaceOverride` | Namespace to install spiffe-csi-driver | `""` | -| `fullnameOverride` | Full name override for spiffe-csi-driver | `""` | -| `serviceAccount.create` | Specifies whether a service account should be created | `true` | -| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | -| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | -| `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` | -| `podSecurityContext` | Security context for CSI driver pods | `{}` | -| `securityContext.readOnlyRootFilesystem` | Flag for read only root filesystem | `true` | -| `securityContext.privileged` | Flag for specifying privileged mode | `true` | -| `nodeSelector` | Node selector for CSI driver pods | `{}` | -| `tolerations` | Tolerations for CSI driver pods | `[]` | -| `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | -| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` | -| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `nodeDriverRegistrar.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.0` | -| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` | -| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | -| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` | -| `priorityClassName` | Priority class assigned to daemonset pods | `""` | +| Name | Description | Value | +| ---------------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------------------------- | +| `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `resources` | Resource requests and limits for spiffe-csi-driver | `{}` | +| `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | +| `livenessProbe.timeoutSeconds` | Timeout value in seconds for livenessProbe | `5` | +| `imagePullSecrets` | Image pull secret details for spiffe-csi-driver | `[]` | +| `nameOverride` | Name override for spiffe-csi-driver | `""` | +| `namespaceOverride` | Namespace to install spiffe-csi-driver | `""` | +| `fullnameOverride` | Full name override for spiffe-csi-driver | `""` | +| `csiDriverLabels` | Labels to apply to the CSIDriver | `{}` | +| `initContainers` | Init Containers to apply to the CSI Driver DaemonSet | `[]` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | +| `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` | +| `podSecurityContext` | Security context for CSI driver pods | `{}` | +| `securityContext.readOnlyRootFilesystem` | Flag for read only root filesystem | `true` | +| `securityContext.privileged` | Flag for specifying privileged mode | `true` | +| `nodeSelector` | Node selector for CSI driver pods | `{}` | +| `tolerations` | Tolerations for CSI driver pods | `[]` | +| `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | +| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` | +| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `nodeDriverRegistrar.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.0` | +| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` | +| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | +| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` | +| `priorityClassName` | Priority class assigned to daemonset pods | `""` | +| `restrictedScc.enabled` | Enables the creation of a SecurityContextConstraint based on the restricted SCC with CSI volume support | `false` | +| `restrictedScc.name` | Set the name of the restricted SCC with CSI support | `""` | +| `restrictedScc.version` | Version of the restricted SCC | `2` | diff --git a/charts/spire/charts/spiffe-csi-driver/README.md.gotmpl b/charts/spire/charts/spiffe-csi-driver/README.md.gotmpl deleted file mode 100644 index 657bce3..0000000 --- a/charts/spire/charts/spiffe-csi-driver/README.md.gotmpl +++ /dev/null @@ -1,24 +0,0 @@ -{{ template "chart.header" . }} - - - -{{ template "chart.deprecationWarning" . }} - -{{ template "chart.badgesSection" . }} - -{{ template "chart.description" . }} - -{{ template "chart.homepageLine" . }} - -> **Note**: The recommended version is `0.2.3` to support arm64 nodes. If running with any -> prior version to `0.2.3` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. - -{{ template "chart.maintainersSection" . }} - -{{ template "chart.sourcesSection" . }} - -{{ template "chart.requirementsSection" . }} - -{{ template "chart.valuesSection" . }} - ----------------------------------------------- diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml index 2031f7f..7d5339e 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -36,6 +36,10 @@ spec: {{- if .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }} {{- end }} + {{- with .Values.initContainers }} + initContainers: + {{- toYaml . | nindent 8 }} + {{- end }} containers: # This is the container which runs the SPIFFE CSI driver. - name: {{ .Chart.Name }} diff --git a/charts/spire/charts/spiffe-csi-driver/templates/scc-restricted-csi.yaml b/charts/spire/charts/spiffe-csi-driver/templates/scc-restricted-csi.yaml new file mode 100644 index 0000000..5e94562 --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/scc-restricted-csi.yaml @@ -0,0 +1,61 @@ +{{- if and .Values.global.openshift .Values.restrictedScc.enabled }} +{{- $name := default (printf "restricted-%scsi" (eq (.Values.restrictedScc.version | toString) "2" | ternary "v2-" "")) .Values.restrictedScc.name -}} +{{- $v2Description := "This is the most restrictive SCC and it is used by default for authenticated users. On top of the legacy 'restricted' SCC, it also requires to drop ALL capabilities and does not allow privilege escalation binaries. It will also default the seccomp profile to runtime/default if unset, otherwise this seccomp profile is required." -}} +apiVersion: security.openshift.io/v1 +kind: SecurityContextConstraints +allowHostPorts: false +priority: null +requiredDropCapabilities: +{{- if eq (.Values.restrictedScc.version | toString) "2" }} + - ALL +{{- else }} + - KILL + - MKNOD + - SETUID + - SETGID +{{- end }} +allowPrivilegedContainer: false +runAsUser: + type: MustRunAsRange +users: [] +allowHostDirVolumePlugin: false +{{- if eq (.Values.restrictedScc.version | toString) "2" }} +seccompProfiles: + - runtime/default +{{- end }} +allowHostIPC: false +seLinuxContext: + type: MustRunAs +readOnlyRootFilesystem: false +metadata: + name: {{ $name }} + annotations: + kubernetes.io/description: >- + {{ $name }} denies access to all host features and requires pods to be + run with a UID, and SELinux context that are allocated to the namespace. + {{ eq (.Values.restrictedScc.version | toString) "2" | ternary $v2Description "" }} +fsGroup: + type: MustRunAs +groups: [] +defaultAddCapabilities: null +supplementalGroups: + type: RunAsAny +volumes: + - configMap + - csi + - downwardAPI + - emptyDir + - ephemeral + - persistentVolumeClaim + - projected + - secret +allowHostPID: false +allowHostNetwork: false +allowPrivilegeEscalation: {{ eq (.Values.restrictedScc.version | toString) "2" | ternary false true }} +{{- if eq (.Values.restrictedScc.version | toString) "2" }} +allowedCapabilities: + - NET_BIND_SERVICE +{{ else}} +allowedCapabilities: null +{{- end }} +{{- end }} diff --git a/charts/spire/charts/spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml b/charts/spire/charts/spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml new file mode 100644 index 0000000..73ef6fa --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml @@ -0,0 +1,30 @@ +{{- if eq (.Values.global.openshift | toString) "true" }} +apiVersion: security.openshift.io/v1 +kind: SecurityContextConstraints +metadata: + name: {{ include "spiffe-csi-driver.fullname" . }} +readOnlyRootFilesystem: true +runAsUser: + type: RunAsAny +seLinuxContext: + type: RunAsAny +supplementalGroups: + type: RunAsAny +users: + - system:serviceaccount:{{ include "spiffe-csi-driver.namespace" . }}:{{ include "spiffe-csi-driver.serviceAccountName" . }} +volumes: + - configmap + - hostPath + - secret +allowHostDirVolumePlugin: true +allowHostIPC: false +allowHostNetwork: false +allowHostPID: false +allowHostPorts: false +allowPrivilegeEscalation: true +allowPrivilegedContainer: true +fsGroup: + type: RunAsAny +groups: [] + +{{ end }} diff --git a/charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml b/charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml index 4c1d51d..95d0086 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml @@ -2,6 +2,11 @@ apiVersion: storage.k8s.io/v1 kind: CSIDriver metadata: name: {{ .Values.pluginName | quote }} + {{- with .Values.csiDriverLabels }} + labels: + {{- toYaml . | nindent 4 }} + {{- end }} + spec: # Only ephemeral, inline volumes are supported. There is no need for a # controller to provision and attach volumes. diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index 6664072..aa4e943 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -58,6 +58,12 @@ namespaceOverride: "" ## @param fullnameOverride Full name override for spiffe-csi-driver fullnameOverride: "" +## @param csiDriverLabels Labels to apply to the CSIDriver +csiDriverLabels: {} + +## @param initContainers Init Containers to apply to the CSI Driver DaemonSet +initContainers: [] + ## @param serviceAccount.create Specifies whether a service account should be created ## @param serviceAccount.annotations Annotations to add to the service account ## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated. @@ -126,3 +132,12 @@ kubeletPath: /var/lib/kubelet ## @param priorityClassName Priority class assigned to daemonset pods priorityClassName: "" + +restrictedScc: + ## @param restrictedScc.enabled Enables the creation of a SecurityContextConstraint based on the restricted SCC with CSI volume support + enabled: false + + ## @param restrictedScc.name Set the name of the restricted SCC with CSI support + name: "" + ## @param restrictedScc.version Version of the restricted SCC + version: 2 diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml index 0d446fc..d38ddbf 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml @@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider description: A Helm chart to install the SPIFFE OIDC discovery provider. type: application version: 0.1.0 -appVersion: "1.8.2" +appVersion: "1.8.4" keywords: ["spiffe", "oidc"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 3bab4ad..38d9e86 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -1,14 +1,13 @@ # spiffe-oidc-discovery-provider - - ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) A Helm chart to install the SPIFFE OIDC discovery provider. **Homepage:** -> **Note**: Minimum Spire version is `1.5.3`. +> [!Note] +> Minimum Spire version is `1.5.3`. > The recommended version is `1.6.0` to support arm64 nodes. If running with any > prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. @@ -25,105 +24,110 @@ A Helm chart to install the SPIFFE OIDC discovery provider. * + + ## Parameters ### Chart parameters -| Name | Description | Value | -| ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | -| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | -| `replicaCount` | Replica count | `1` | -| `namespaceOverride` | Namespace override | `""` | -| `annotations` | Annotations for the deployment | `{}` | -| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `image.repository` | The repository within the registry | `spiffe/oidc-discovery-provider` | -| `image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `resources` | Resource requests and limits | `{}` | -| `service.type` | Service type | `ClusterIP` | -| `service.port` | Service port | `80` | -| `service.annotations` | Annotations for service resource | `{}` | -| `configMap.annotations` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | `{}` | -| `podSecurityContext` | Pod security context for OIDC discovery provider pods | `{}` | -| `securityContext` | Security context for OIDC discovery provider deployment | `{}` | -| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | -| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | -| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | -| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | -| `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` | -| `insecureScheme.enabled` | Flag to enable insecure schema | `false` | -| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from | `docker.io` | -| `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` | -| `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.2-alpine` | -| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | -| `jwtIssuer` | Path to JWT issuer | `https://oidc-discovery.example.org` | -| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | -| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` | -| `config.acme.tosAccepted` | Flag for Terms of Service acceptance | `false` | -| `config.acme.cacheDir` | Path for cache directory | `/run/spire` | -| `config.acme.directoryUrl` | URL for acme directory | `https://acme-v02.api.letsencrypt.org/directory` | -| `config.acme.emailAddress` | Email address for registration | `letsencrypt@example.org` | -| `imagePullSecrets` | Image pull secret names | `[]` | -| `nameOverride` | Name override | `""` | -| `fullnameOverride` | Full name override | `""` | -| `serviceAccount.create` | Specifies whether a service account should be created | `true` | -| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | -| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | -| `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | -| `autoscaling.enabled` | Flag to enable autoscaling | `false` | -| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` | -| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` | -| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` | -| `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` | -| `nodeSelector` | Node selector | `{}` | -| `tolerations` | iist of tolerations | `[]` | -| `affinity` | Node affinity | `{}` | -| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | -| `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` | -| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | -| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | -| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | -| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the helm release | `""` | -| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | -| `telemetry.prometheus.nginxExporter.image.registry` | The OCI registry to pull the image from | `docker.io` | -| `telemetry.prometheus.nginxExporter.image.repository` | The repository within the registry | `nginx/nginx-prometheus-exporter` | -| `telemetry.prometheus.nginxExporter.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `telemetry.prometheus.nginxExporter.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `telemetry.prometheus.nginxExporter.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.11.0` | -| `telemetry.prometheus.nginxExporter.resources` | Resource requests and limits | `{}` | -| `ingress.enabled` | Flag to enable ingress | `false` | -| `ingress.className` | Ingress class name | `""` | -| `ingress.annotations` | Annotations for ingress object | `{}` | -| `ingress.hosts` | Host paths for ingress object | `[]` | -| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` | -| `tests.hostAliases` | List of host aliases for testing | `[]` | -| `tests.tls.enabled` | Flag for enabling tls for tests | `false` | -| `tests.tls.customCA` | Custom CA value for tests | `""` | -| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | -| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` | -| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | -| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:57151ad9f998c9394c9ba8b66c83f70cbfe3d4b733c166c9856e0d8fb273bfd0` | -| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` | -| `tests.busybox.image.repository` | The repository within the registry | `busybox` | -| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.busybox.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` | -| `tests.agent.image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `tests.agent.image.repository` | The repository within the registry | `spiffe/spire-agent` | -| `tests.agent.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.agent.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.agent.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | -| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | -| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| Name | Description | Value | +| ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | +| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | +| `replicaCount` | Replica count | `1` | +| `namespaceOverride` | Namespace override | `""` | +| `annotations` | Annotations for the deployment | `{}` | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/oidc-discovery-provider` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `resources` | Resource requests and limits | `{}` | +| `service.type` | Service type | `ClusterIP` | +| `service.port` | Service port | `80` | +| `service.annotations` | Annotations for service resource | `{}` | +| `configMap.annotations` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | `{}` | +| `podSecurityContext` | Pod security context for OIDC discovery provider pods | `{}` | +| `securityContext` | Security context for OIDC discovery provider deployment | `{}` | +| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | +| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | +| `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` | +| `insecureScheme.enabled` | Flag to enable insecure schema | `false` | +| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from | `docker.io` | +| `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` | +| `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.2-alpine` | +| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | +| `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` | +| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | +| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` | +| `config.acme.tosAccepted` | Flag for Terms of Service acceptance | `false` | +| `config.acme.cacheDir` | Path for cache directory | `/run/spire` | +| `config.acme.directoryUrl` | URL for acme directory | `https://acme-v02.api.letsencrypt.org/directory` | +| `config.acme.emailAddress` | Email address for registration | `letsencrypt@example.org` | +| `imagePullSecrets` | Image pull secret names | `[]` | +| `nameOverride` | Name override | `""` | +| `fullnameOverride` | Full name override | `""` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | +| `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | +| `autoscaling.enabled` | Flag to enable autoscaling | `false` | +| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` | +| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` | +| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` | +| `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` | +| `nodeSelector` | Node selector | `{}` | +| `tolerations` | iist of tolerations | `[]` | +| `affinity` | Node affinity | `{}` | +| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | +| `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` | +| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | +| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | +| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | +| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the helm release | `""` | +| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | +| `telemetry.prometheus.nginxExporter.image.registry` | The OCI registry to pull the image from | `docker.io` | +| `telemetry.prometheus.nginxExporter.image.repository` | The repository within the registry | `nginx/nginx-prometheus-exporter` | +| `telemetry.prometheus.nginxExporter.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `telemetry.prometheus.nginxExporter.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `telemetry.prometheus.nginxExporter.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.11.0` | +| `telemetry.prometheus.nginxExporter.resources` | Resource requests and limits | `{}` | +| `ingress.enabled` | Flag to enable ingress | `false` | +| `ingress.className` | Ingress class name | `""` | +| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | +| `ingress.annotations` | Annotations for ingress object | `{}` | +| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `oidc-discovery` | +| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | +| `tests.hostAliases` | List of host aliases for testing | `[]` | +| `tests.tls.enabled` | Flag for enabling tls for tests | `false` | +| `tests.tls.customCA` | Custom CA value for tests | `""` | +| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | +| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` | +| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | +| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d1fc4d296994f28d7e0264c933a12ba75c9a80478ff1eb4b6f692bb91a073a4c` | +| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` | +| `tests.busybox.image.repository` | The repository within the registry | `busybox` | +| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.busybox.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` | +| `tests.agent.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `tests.agent.image.repository` | The repository within the registry | `spiffe/spire-agent` | +| `tests.agent.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.agent.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.agent.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | +| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | +| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md.gotmpl b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md.gotmpl deleted file mode 100644 index f9dafb6..0000000 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md.gotmpl +++ /dev/null @@ -1,25 +0,0 @@ -{{ template "chart.header" . }} - - - -{{ template "chart.deprecationWarning" . }} - -{{ template "chart.badgesSection" . }} - -{{ template "chart.description" . }} - -{{ template "chart.homepageLine" . }} - -> **Note**: Minimum Spire version is `1.5.3`. -> The recommended version is `1.6.0` to support arm64 nodes. If running with any -> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. - -{{ template "chart.maintainersSection" . }} - -{{ template "chart.sourcesSection" . }} - -{{ template "chart.requirementsSection" . }} - -{{ template "chart.valuesSection" . }} - ----------------------------------------------- diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml index f71db7d..6f5913e 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml @@ -1,5 +1,15 @@ {{- if .Values.ingress.enabled -}} +{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }} {{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . }} +{{- $tlsSection := true }} +{{- $annotations := deepCopy .Values.ingress.annotations }} +{{- if eq $ingressControllerType "ingress-nginx" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }} +{{- else if eq $ingressControllerType "openshift" }} +{{- $_ := set $annotations "route.openshift.io/termination" "edge" }} +{{- $tlsSection = false }} +{{- end }} apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -7,10 +17,10 @@ metadata: namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }} labels: {{ include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} - {{- with .Values.ingress.annotations }} + {{- with $annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} spec: - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }} {{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/scc-spire-oidc-discovery-provider.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/scc-spire-oidc-discovery-provider.yaml new file mode 100644 index 0000000..71c147c --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/scc-spire-oidc-discovery-provider.yaml @@ -0,0 +1,38 @@ +{{- if eq (.Values.global.openshift | toString) "true" }} +apiVersion: security.openshift.io/v1 +kind: SecurityContextConstraints +metadata: + name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} +readOnlyRootFilesystem: true +runAsUser: + type: RunAsAny +seLinuxContext: + type: RunAsAny +supplementalGroups: + type: RunAsAny +users: + - system:serviceaccount:{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }} + - system:serviceaccount:{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete +volumes: + - configMap + - hostPath + - projected + - secret + - ephemeral + - downwardAPI + - csi + - emptyDir +allowHostDirVolumePlugin: true +allowHostIPC: true +allowHostNetwork: true +allowHostPID: true +allowHostPorts: true +allowPrivilegeEscalation: true +allowPrivilegedContainer: true +fsGroup: + type: RunAsAny +groups: [] +seccompProfiles: + - '*' + +{{ end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml index af9063e..73a8b35 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml @@ -1,4 +1,8 @@ -{{ $values := merge .Values }} +{{- $values := merge .Values }} +{{- $host := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.ingress) }} +{{- if gt (len .Values.ingress.hosts) 0 }} +{{- $host = (index .Values.ingress.hosts 0).host }} +{{- end }} apiVersion: v1 kind: Pod metadata: @@ -36,9 +40,9 @@ spec: command: ['curl'] {{- if dig "tests" "tls" "enabled" false $values }} {{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }} - args: ['-s', '-f', '--cacert', '/ca/ca.crt', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration'] + args: ['-s', '-f', '--cacert', '/ca/ca.crt', 'https://{{ $host }}/.well-known/openid-configuration'] {{- else }} - args: ['-s', '-f', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration'] + args: ['-s', '-f', 'https://{{ $host }}/.well-known/openid-configuration'] {{- end }} {{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }} volumeMounts: @@ -46,7 +50,7 @@ spec: mountPath: /ca {{- end }} {{- else }} - args: ['-s', '-f', 'http://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration'] + args: ['-s', '-f', 'http://{{ $host }}/.well-known/openid-configuration'] {{- end }} securityContext: {{- toYaml .Values.securityContext | nindent 8 }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index c6377e2..9b47296 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -9,10 +9,10 @@ global: {} ## @param agentSocketName The name of the spire-agent unix socket agentSocketName: spire-agent.sock -## @param replicaCount Replica count +## @param replicaCount Replica count replicaCount: 1 -## @param namespaceOverride Namespace override +## @param namespaceOverride Namespace override namespaceOverride: "" ## @param annotations [object] Annotations for the deployment @@ -125,8 +125,8 @@ insecureScheme: # cpu: 100m # memory: 64Mi -## @param jwtIssuer Path to JWT issuer -jwtIssuer: https://oidc-discovery.example.org +## @param jwtIssuer Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset +jwtIssuer: "" config: ## @param config.logLevel The log level, valid values are "debug", "info", "warn", and "error" @@ -241,6 +241,8 @@ ingress: enabled: false ## @param ingress.className Ingress class name className: "" + ## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. + controllerType: "" ## @param ingress.annotations [object] Annotations for ingress object annotations: {} # kubernetes.io/ingress.class: nginx @@ -248,13 +250,20 @@ ingress: # nginx.ingress.kubernetes.io/ssl-redirect: "true" # nginx.ingress.kubernetes.io/force-ssl-redirect: "true" - ## @param ingress.hosts [array] Host paths for ingress object - hosts: - - host: oidc-discovery.example.org - paths: - - path: / - pathType: Prefix - ## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress + ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. + host: "oidc-discovery" + + ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. + tlsSecret: "" + + ## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. + hosts: [] + # - host: oidc-discovery.example.org + # paths: + # - path: / + # pathType: Prefix + + ## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. tls: [] # - secretName: chart-example-tls # hosts: @@ -280,7 +289,7 @@ tests: repository: chainguard/bash pullPolicy: IfNotPresent version: "" - tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c + tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214 toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -294,7 +303,7 @@ tests: repository: chainguard/slim-toolkit-debug pullPolicy: IfNotPresent version: "" - tag: latest@sha256:57151ad9f998c9394c9ba8b66c83f70cbfe3d4b733c166c9856e0d8fb273bfd0 + tag: latest@sha256:d1fc4d296994f28d7e0264c933a12ba75c9a80478ff1eb4b6f692bb91a073a4c busybox: ## @param tests.busybox.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml index 6d411b5..514744f 100644 --- a/charts/spire/charts/spire-agent/Chart.yaml +++ b/charts/spire/charts/spire-agent/Chart.yaml @@ -3,7 +3,7 @@ name: spire-agent description: A Helm chart to install the SPIRE agent. type: application version: 0.1.0 -appVersion: "1.8.2" +appVersion: "1.8.4" keywords: ["spiffe", "spire-agent"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 52f27d1..976eca7 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -1,14 +1,13 @@ # spire-agent - - ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) A Helm chart to install the SPIRE agent. **Homepage:** -> **Note**: Minimum Spire version is `1.5.3`. +> [!Note] +> Minimum Spire version is `1.5.3`. > The recommended version is `1.6.0` to support arm64 nodes. If running with any > prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. @@ -25,6 +24,8 @@ A Helm chart to install the SPIRE agent. * + + ## Parameters ### Chart parameters @@ -59,7 +60,7 @@ A Helm chart to install the SPIRE agent. | `server.address` | Address for Spire server | `""` | | `server.port` | Port number for Spire server | `8081` | | `server.namespaceOverride` | Override the namespace for Spire server | `""` | -| `healthChecks.port` | override the host port used for health checking | `9980` | +| `healthChecks.port` | override the host port used for health checking | `9982` | | `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | | `livenessProbe.periodSeconds` | Period seconds for probe | `60` | | `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | @@ -68,13 +69,13 @@ A Helm chart to install the SPIRE agent. | `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` | | `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `waitForIt.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5b836d1a4c652ec1c56bdd4a05a43349e2eeff50cf7fdb45a356f0ddc578573b` | +| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c58a76f9241187615ab081ec73db6aeea6939369fba995206343bd9fb1975378` | | `waitForIt.resources` | Resource requests and limits | `{}` | | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | | `fsGroupFix.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | @@ -92,6 +93,7 @@ A Helm chart to install the SPIRE agent. | `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | | `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | | `priorityClassName` | Priority class assigned to daemonset pods | `""` | +| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | | `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` | | `extraContainers` | Additional containers to create with Spire Agent pods | `[]` | diff --git a/charts/spire/charts/spire-agent/README.md.gotmpl b/charts/spire/charts/spire-agent/README.md.gotmpl deleted file mode 100644 index f9dafb6..0000000 --- a/charts/spire/charts/spire-agent/README.md.gotmpl +++ /dev/null @@ -1,25 +0,0 @@ -{{ template "chart.header" . }} - - - -{{ template "chart.deprecationWarning" . }} - -{{ template "chart.badgesSection" . }} - -{{ template "chart.description" . }} - -{{ template "chart.homepageLine" . }} - -> **Note**: Minimum Spire version is `1.5.3`. -> The recommended version is `1.6.0` to support arm64 nodes. If running with any -> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. - -{{ template "chart.maintainersSection" . }} - -{{ template "chart.sourcesSection" . }} - -{{ template "chart.requirementsSection" . }} - -{{ template "chart.valuesSection" . }} - ----------------------------------------------- diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index c463212..57c3a31 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -71,6 +71,10 @@ spec: image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: ["-config", "/run/spire/config/agent.conf"] + {{- if gt (len .Values.extraEnvVars) 0 }} + env: + {{- toYaml .Values.extraEnvVars | nindent 12 }} + {{- end }} ports: - containerPort: {{ .Values.healthChecks.port }} name: healthz diff --git a/charts/spire/charts/spire-agent/templates/scc-spire-agent.yaml b/charts/spire/charts/spire-agent/templates/scc-spire-agent.yaml new file mode 100644 index 0000000..b92549b --- /dev/null +++ b/charts/spire/charts/spire-agent/templates/scc-spire-agent.yaml @@ -0,0 +1,31 @@ +{{- if eq (.Values.global.openshift | toString) "true" }} +apiVersion: security.openshift.io/v1 +kind: SecurityContextConstraints +metadata: + name: {{ include "spire-agent.fullname" . }} +readOnlyRootFilesystem: true +runAsUser: + type: RunAsAny +seLinuxContext: + type: RunAsAny +supplementalGroups: + type: RunAsAny +users: + - system:serviceaccount:{{ include "spire-agent.namespace" . }}:{{ include "spire-agent.serviceAccountName" . }} +volumes: + - configMap + - hostPath + - projected + - secret +allowHostDirVolumePlugin: true +allowHostIPC: true +allowHostNetwork: true +allowHostPID: true +allowHostPorts: true +allowPrivilegeEscalation: true +allowPrivilegedContainer: true +fsGroup: + type: RunAsAny +groups: [] + +{{ end }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index d5fe56f..5b2f44e 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -22,13 +22,13 @@ image: ## @param imagePullSecrets [array] Pull secrets for images imagePullSecrets: [] -## @param nameOverride Name override +## @param nameOverride Name override nameOverride: "" -## @param namespaceOverride Namespace override +## @param namespaceOverride Namespace override namespaceOverride: "" -## @param fullnameOverride Fullname override +## @param fullnameOverride Fullname override fullnameOverride: "" serviceAccount: @@ -106,7 +106,7 @@ server: healthChecks: ## @param healthChecks.port override the host port used for health checking - port: 9980 + port: 9982 ## @param livenessProbe.initialDelaySeconds Initial delay seconds for probe ## @param livenessProbe.periodSeconds Period seconds for probe @@ -134,7 +134,7 @@ waitForIt: repository: chainguard/wait-for-it pullPolicy: IfNotPresent version: "" - tag: latest@sha256:5b836d1a4c652ec1c56bdd4a05a43349e2eeff50cf7fdb45a356f0ddc578573b + tag: latest@sha256:c58a76f9241187615ab081ec73db6aeea6939369fba995206343bd9fb1975378 ## @param waitForIt.resources [object] Resource requests and limits resources: {} @@ -153,7 +153,7 @@ fsGroupFix: repository: chainguard/bash pullPolicy: Always version: "" - tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c + tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214 ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -204,6 +204,9 @@ socketPath: /run/spire/agent-sockets/spire-agent.sock ## @param priorityClassName Priority class assigned to daemonset pods priorityClassName: "" +## @param extraEnvVars [array] Extra environment variables to be added to the Spire Agent container +extraEnvVars: [] + ## @param extraVolumes [array] Extra volumes to be mounted on Spire Agent pods extraVolumes: [] diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml index 2335de4..a150171 100644 --- a/charts/spire/charts/spire-server/Chart.yaml +++ b/charts/spire/charts/spire-server/Chart.yaml @@ -3,7 +3,7 @@ name: spire-server description: A Helm chart to install the SPIRE server. type: application version: 0.1.0 -appVersion: "1.8.2" +appVersion: "1.8.4" keywords: ["spiffe", "spire-server", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 2b09965..4bf91ec 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -1,14 +1,13 @@ # spire-server - - ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) A Helm chart to install the SPIRE server. **Homepage:** -> **Note**: Minimum Spire version is `1.5.3`. +> [!Note] +> Minimum Spire version is `1.5.3`. > The recommended version is `1.6.0` to support arm64 nodes. If running with any > prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. > @@ -39,7 +38,8 @@ When Tornjak is enabled, it is exposed on both http and https (if TLS server cer In addition, you can configure a `client certificate authority`, this will make Tornjak backend verify Client certificates signed by this authority to enable mTLS authentication. -**Warning**: For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access. +> [!Important] +> For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access. ### Tornjak with TLS Connection Type @@ -47,13 +47,13 @@ TLS connection requires Tornjak to have access to TLS key and certificate. Complete instruction on creating your own TLS certificate can be found [here](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md). TLS Certificate and the private key must be provided to Tornjak via *TLS Secret*. Prior to deploying this Helm chart, create TLS Secret in the deployment namespace (e.g. `spire-server`) -```console +```shell kubectl -n spire-server create secret tls tornjak-tls-secret --cert=client.crt --key=client.key ``` Once the charts are deployed, you can test the TLS connection with the following command (assuming localhost): -```console +```shell curl --cacert CA/rootCA.crt https://localhost:10443 ``` @@ -67,13 +67,13 @@ Follow the steps to [create user CA for mTLS](https://github.com/spiffe/tornjak/ Here is an example using a *Secret* in `spire-server` namespace: -```console +```shell kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt" ``` Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost): -```console +```shell curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhost:10443 ``` @@ -81,6 +81,8 @@ curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhos In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above. + + ## Parameters ### Chart parameters @@ -140,7 +142,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `dataStore.sql.externalSecret.name` | The name of the secret object | `""` | | `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` | | `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | -| `jwtIssuer` | The JWT issuer domain | `https://oidc-discovery.example.org` | +| `jwtIssuer` | The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset | `""` | | `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` | | `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | | `bundleConfigMap` | Set the trust domain to be used for the SPIFFE identifiers | `spire-bundle` | @@ -150,9 +152,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` | | `federation.ingress.enabled` | Flag to enable ingress for federation | `false` | | `federation.ingress.className` | Ingress class name for federation | `""` | +| `federation.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | | `federation.ingress.annotations` | Annotations for the ingress object | `{}` | -| `federation.ingress.hosts` | Host paths for ingress object | `[]` | -| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` | +| `federation.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server-federation` | +| `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `federation.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `ca_subject.country` | Country for Spire server CA | `ARPA` | | `ca_subject.organization` | Organization for Spire server CA | `Example` | | `ca_subject.common_name` | Common Name for Spire server CA | `example.org` | @@ -212,13 +217,15 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` | | `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` | | `controllerManager.enabled` | Flag to enable controller manager | `false` | +| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` | +| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` | | `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | | `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` | | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.3.0` | +| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.0` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | @@ -232,6 +239,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.identities.namespaceSelector` | Selector for namespacs to issue identity | `{}` | | `controllerManager.identities.dnsNameTemplates` | DNS name template for issued identities | `[]` | | `controllerManager.identities.federatesWith` | Other Spire server URLs for identity federation | `[]` | +| `controllerManager.identities.workloadSelectorTemplates` | Templates to produce selectors that apply to a given workload before it will receive an ID | `[]` | +| `controllerManager.identities.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` | +| `controllerManager.identities.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` | +| `controllerManager.identities.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` | +| `controllerManager.identities.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` | +| `controllerManager.identities.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` | | `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | @@ -244,9 +257,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | | `ingress.enabled` | Flag to enable ingress | `false` | | `ingress.className` | Ingress class name | `""` | +| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | | `ingress.annotations` | Annotations for the ingress object | `{}` | -| `ingress.hosts` | Host paths for ingress object | `[]` | -| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` | +| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server` | +| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `extraVolumes` | Extra volumes to be mounted | `[]` | | `extraVolumeMounts` | Extra volume mounts | `[]` | | `extraContainers` | Additional containers to create | `[]` | @@ -257,45 +273,53 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` | | `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` | | `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` | -| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` | -| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` | -| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.4.0` | -| `tornjak.service.type` | Type of service resource | `ClusterIP` | -| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` | -| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` | -| `tornjak.service.annotations` | Annotations for the service | `{}` | -| `tornjak.ingress.enabled` | Flag to enable ingress for Tornjak backend service | `false` | -| `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` | -| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` | -| `tornjak.ingress.hosts` | Host paths for ingress Tornjak backend service | `[]` | -| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress | `[]` | -| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` | -| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` | -| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` | -| `tornjak.startupProbe.successThreshold` | Success threshold count | `1` | -| `tornjak.startupProbe.timeoutSeconds` | Timeout in seconds | `5` | -| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | | -| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` | -| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` | -| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` | -| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` | -| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` | -| `tornjak.resources` | Resource requests and limits | `{}` | -| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` | -| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` | -| `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` | -| `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` | -| `experimental.enabled` | Allow configuration of experimental features | `false` | -| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | -| `experimental.featureFlags` | List of developer feature flags | `[]` | -| `tests.hostAliases` | List of host aliases for testing | `[]` | -| `tests.tls.enabled` | Flag for enabling tls for tests | `false` | -| `tests.tls.customCA` | Custom CA value for tests | `""` | -| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | -| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` | + +### Tornjak + +| Name | Description | Value | +| ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | +| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` | +| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` | +| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.4.0` | +| `tornjak.service.type` | Type of service resource | `ClusterIP` | +| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` | +| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` | +| `tornjak.service.annotations` | Annotations for the service | `{}` | +| `tornjak.ingress.enabled` | Flag to enable ingress for Tornjak backend service | `false` | +| `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` | +| `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | +| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` | +| `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` | +| `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `tornjak.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | +| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` | +| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` | +| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` | +| `tornjak.startupProbe.successThreshold` | Success threshold count | `1` | +| `tornjak.startupProbe.timeoutSeconds` | Timeout in seconds | `5` | +| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | | +| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` | +| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` | +| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` | +| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` | +| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` | +| `tornjak.resources` | Resource requests and limits | `{}` | +| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` | +| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` | +| `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` | +| `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` | +| `experimental.enabled` | Allow configuration of experimental features | `false` | +| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | +| `experimental.featureFlags` | List of developer feature flags | `[]` | +| `tests.hostAliases` | List of host aliases for testing | `[]` | +| `tests.tls.enabled` | Flag for enabling tls for tests | `false` | +| `tests.tls.customCA` | Custom CA value for tests | `""` | +| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | +| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` | diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index d4d503e..3652f54 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -205,7 +205,10 @@ The code below determines what connection type should be used. {{- define "spire-server.test.federation-ingress-args" }} {{- $args := list }} -{{- $host := index (index (index .Values.federation.ingress.tls 0) "hosts") 0 }} +{{- $host := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.federation.ingress) }} +{{- if gt (len .Values.federation.ingress.tls) 0 }} +{{- $host = index (index (index .Values.federation.ingress.tls 0) "hosts") 0 }} +{{- end }} {{- if dig "tests" "tls" "enabled" false .Values }} {{- if ne (len (dig "tests" "tls" "customCA" "" .Values)) 0 }} {{- $args = append $args "--cacert" }} @@ -217,3 +220,11 @@ The code below determines what connection type should be used. {{- end }} {{ $args | toYaml }} {{- end -}} + +{{- define "spire-server.controller-manager-class-name" -}} +{{- if .Values.controllerManager.className }} +{{- .Values.controllerManager.className }} +{{- else }} +{{- .Release.Namespace }}-{{ .Release.Name }} +{{- end -}} +{{- end -}} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml index 69c7c6f..77cca5e 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml @@ -4,7 +4,7 @@ apiVersion: spire.spiffe.io/v1alpha1 kind: ClusterSPIFFEID metadata: - name: {{ include "spire-controller-manager.fullname" $root }}-service-account-based + name: {{ $root.Release.Namespace }}-{{ include "spire-controller-manager.fullname" $root }}-service-account-based namespace: {{ include "spire-server.namespace" $root }} spec: spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }} @@ -24,5 +24,19 @@ spec: dnsNameTemplates: {{- toYaml . | nindent 4 }} {{- end }} + {{- with .identities.workloadSelectorTemplates }} + workloadTSelectoremplates: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .identities.ttl }} + ttl: {{ . | quote }} + {{- end }} + {{- with .identities.jwtTTL }} + jwtTtl: {{ . | quote }} + {{- end }} + admin: {{ .identities.admin }} + downstream: {{ .identities.downstream }} + autoPopulateDNSNames: {{ .identities.autoPopulateDNSNames }} + className: {{ include "spire-server.controller-manager-class-name" $root | quote}} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml index 7184ff0..60f728a 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -25,7 +25,7 @@ data: leaderElect: true resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io resourceNamespace: {{ include "spire-server.namespace" . }} - validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook + validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook clusterName: {{ include "spire-lib.cluster-name" . }} trustDomain: {{ include "spire-lib.trust-domain" . }} ignoreNamespaces: @@ -33,4 +33,6 @@ data: {{- toYaml . | nindent 6 }} {{- end }} spireServerSocketPath: "/tmp/spire-server/private/api.sock" + className: {{ include "spire-server.controller-manager-class-name" . | quote}} + watchClassless: {{ .Values.controllerManager.watchClassless | toYaml }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml index e9cbc5d..551b680 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml @@ -32,7 +32,7 @@ subjects: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ include "spire-controller-manager.fullname" . }} + name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }} rules: - apiGroups: [""] resources: ["namespaces"] @@ -43,6 +43,9 @@ rules: - apiGroups: [""] resources: ["nodes"] verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["endpoints"] + verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["pods"] verbs: ["get", "list", "watch"] @@ -77,11 +80,11 @@ rules: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: {{ include "spire-controller-manager.fullname" . }} + name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: {{ include "spire-controller-manager.fullname" . }} + name: {{ .Release.Namespace}}-{{ include "spire-controller-manager.fullname" . }} subjects: - kind: ServiceAccount name: {{ include "spire-server.serviceAccountName" . }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml index 0622736..40e9493 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml @@ -2,7 +2,7 @@ apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: - name: {{ include "spire-controller-manager.fullname" . }}-webhook + name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook webhooks: - admissionReviewVersions: ["v1"] clientConfig: diff --git a/charts/spire/charts/spire-server/templates/federation-ingress.yaml b/charts/spire/charts/spire-server/templates/federation-ingress.yaml index e7d0fea..009deaa 100644 --- a/charts/spire/charts/spire-server/templates/federation-ingress.yaml +++ b/charts/spire/charts/spire-server/templates/federation-ingress.yaml @@ -1,6 +1,17 @@ {{- if .Values.federation.enabled }} {{- if .Values.federation.ingress.enabled -}} +{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.federation.ingress) }} {{- $svcName := include "spire-server.fullname" . }} +{{- $tlsSection := true }} +{{- $annotations := deepCopy .Values.federation.ingress.annotations }} +{{- if eq $ingressControllerType "ingress-nginx" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }} +{{- else if eq $ingressControllerType "openshift" }} +{{- $_ := set $annotations "route.openshift.io/termination" "edge" }} +{{- $tlsSection = false }} +{{- end }} apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -8,11 +19,11 @@ metadata: namespace: {{ include "spire-server.namespace" . }} labels: {{ include "spire-server.labels" . | nindent 4 }} - {{- with .Values.federation.ingress.annotations }} + {{- with $annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} spec: - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "global" .Values.global) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/ingress.yaml b/charts/spire/charts/spire-server/templates/ingress.yaml index 56da8c8..2648350 100644 --- a/charts/spire/charts/spire-server/templates/ingress.yaml +++ b/charts/spire/charts/spire-server/templates/ingress.yaml @@ -1,5 +1,21 @@ {{- if .Values.ingress.enabled -}} +{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }} {{- $fullName := include "spire-server.fullname" . -}} +{{- $path := "/" }} +{{- $pathType := "Prefix" }} +{{- $tlsSection := true }} +{{- $annotations := deepCopy .Values.ingress.annotations }} +{{- if eq $ingressControllerType "ingress-nginx" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }} +{{- else if eq $ingressControllerType "openshift" }} +{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }} +{{- $path = "" }} +{{- $pathType = "ImplementationSpecific" }} +{{- $tlsSection = false }} +{{- end }} apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -7,10 +23,10 @@ metadata: namespace: {{ include "spire-server.namespace" . }} labels: {{ include "spire-server.labels" . | nindent 4}} - {{- with .Values.ingress.annotations }} + {{- with $annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} spec: - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml index dbbb7bd..77b6470 100644 --- a/charts/spire/charts/spire-server/templates/post-install-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml @@ -22,7 +22,7 @@ metadata: rules: - apiGroups: ["admissionregistration.k8s.io"] resources: ["validatingwebhookconfigurations"] - resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}] + resourceNames: [{{ printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) | quote }}] verbs: ["get", "patch"] --- kind: ClusterRoleBinding @@ -68,7 +68,7 @@ spec: args: - patch - validatingwebhookconfiguration - - {{ include "spire-controller-manager.fullname" . }}-webhook + - {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook - --type=strategic - -p - | diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml index ff2883b..d1b255f 100644 --- a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml @@ -22,7 +22,7 @@ metadata: rules: - apiGroups: ["admissionregistration.k8s.io"] resources: ["validatingwebhookconfigurations"] - resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}] + resourceNames: [{{ printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) | quote }}] verbs: ["get", "patch"] --- kind: ClusterRoleBinding @@ -68,7 +68,7 @@ spec: args: - patch - validatingwebhookconfiguration - - {{ include "spire-controller-manager.fullname" . }}-webhook + - {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook - --type=strategic - -p - | diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml index db53b27..a72e043 100644 --- a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml @@ -1,4 +1,9 @@ {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} +{{- $webhookname := printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) }} +{{- $oldwebhookname := printf "%s-webhook" (include "spire-controller-manager.fullname" .) }} +{{- if not (lookup "admissionregistration.k8s.io/v1" "ValidatingWebhookConfiguration" "" $webhookname) }} +{{- $webhookname = $oldwebhookname }} +{{- end }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} apiVersion: v1 @@ -22,7 +27,7 @@ metadata: rules: - apiGroups: ["admissionregistration.k8s.io"] resources: ["validatingwebhookconfigurations"] - resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}] + resourceNames: [{{ $webhookname | quote }}] verbs: ["get", "patch"] --- kind: ClusterRoleBinding @@ -68,7 +73,7 @@ spec: args: - patch - validatingwebhookconfiguration - - {{ include "spire-controller-manager.fullname" . }}-webhook + - {{ $webhookname }} - --type=strategic - -p - | diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index aef398c..ca26abb 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -48,10 +48,10 @@ spec: shareProcessNamespace: true securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} - {{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }} {{- if .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }} {{- end }} + {{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }} initContainers: {{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }} - name: wait diff --git a/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml b/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml index ac0dfb5..8fa0451 100644 --- a/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml +++ b/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml @@ -1,5 +1,27 @@ {{- if .Values.tornjak.ingress.enabled -}} +{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.tornjak.ingress) }} {{- $fullName := include "spire-tornjak.fullname" . -}} +{{- $path := "/" }} +{{- $pathType := "Prefix" }} +{{- $tlsSection := true }} +{{- $annotations := deepCopy .Values.tornjak.ingress.annotations }} +{{- if eq $ingressControllerType "ingress-nginx" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }} +{{- if ne (include "spire-tornjak.connectionType" .) "http" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }} +{{- end }} +{{- else if eq $ingressControllerType "openshift" }} +{{- $tlsSection = false }} +{{- if ne (include "spire-tornjak.connectionType" .) "http" }} +{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }} +{{- $path = "" }} +{{- $pathType = "ImplementationSpecific" }} +{{- else }} +{{- $_ := set $annotations "route.openshift.io/termination" "edge" }} +{{- end }} +{{- end }} apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -7,14 +29,14 @@ metadata: namespace: {{ include "spire-server.namespace" . }} labels: {{ include "spire-server.labels" . | nindent 4}} - {{- with .Values.tornjak.ingress.annotations }} + {{- with $annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} spec: {{- if eq (include "spire-tornjak.connectionType" .) "http" }} - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-http") | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.http "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }} {{- else -}} - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-https") | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.https "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }} {{- end -}} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 5dfd1bf..80315fa 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -174,8 +174,8 @@ dataStore: ## @param logLevel The log level, valid values are "debug", "info", "warn", and "error" logLevel: info -## @param jwtIssuer The JWT issuer domain -jwtIssuer: https://oidc-discovery.example.org +## @param jwtIssuer The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset +jwtIssuer: "" ## @param clusterName Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) clusterName: example-cluster @@ -202,6 +202,8 @@ federation: enabled: false ## @param federation.ingress.className Ingress class name for federation className: "" + ## @param federation.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. + controllerType: "" ## @param federation.ingress.annotations [object] Annotations for the ingress object annotations: {} # kubernetes.io/ingress.class: nginx @@ -209,14 +211,21 @@ federation: # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" # If Profile Type == https_spiffe: # nginx.ingress.kubernetes.io/ssl-passthrough: "true" - ## @param federation.ingress.hosts [array] Host paths for ingress object - hosts: - - host: spire-server-federation.example.org - paths: - - path: / - pathType: Prefix - ## @param federation.ingress.tls [array] Secrets containining TLS certs to enable https on ingress + ## @param federation.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. + host: "spire-server-federation" + + ## @param federation.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. + tlsSecret: "" + + ## @param federation.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. + hosts: [] + # - host: spire-server-federation.example.org + # paths: + # - path: / + # pathType: Prefix + + ## @param federation.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. tls: [] # - hosts: # - spire-server-federation.example.org @@ -368,6 +377,12 @@ notifier: controllerManager: ## @param controllerManager.enabled Flag to enable controller manager enabled: false + + ## @param controllerManager.className specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. + className: "" + ## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. + watchClassless: false + installAndUpgradeHook: ## @param controllerManager.installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) enabled: true @@ -386,7 +401,7 @@ controllerManager: repository: spiffe/spire-controller-manager pullPolicy: IfNotPresent version: "" - tag: "0.3.0" + tag: "0.4.0" ## @param controllerManager.resources [object] Resource requests and limits for controller manager resources: {} @@ -450,6 +465,18 @@ controllerManager: federatesWith: [] # - example.io # - example.ai + ## @param controllerManager.identities.workloadSelectorTemplates [array] Templates to produce selectors that apply to a given workload before it will receive an ID + workloadSelectorTemplates: [] + ## @param controllerManager.identities.ttl Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. + ttl: "" + ## @param controllerManager.identities.jwtTTL Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. + jwtTTL: "" + ## @param controllerManager.identities.admin Indicates any pod matched by this identity will be an admin. Use this with extreme care. + admin: false + ## @param controllerManager.identities.downstream Set if this spire instance is a root server and the workloads are downstream servers. + downstream: false + ## @param controllerManager.identities.autoPopulateDNSNames Auto populate DNS names from services attached to pods + autoPopulateDNSNames: false validatingWebhookConfiguration: ## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued @@ -487,6 +514,8 @@ ingress: enabled: false ## @param ingress.className Ingress class name className: "" + ## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. + controllerType: "" ## @param ingress.annotations [object] Annotations for the ingress object annotations: {} # kubernetes.io/ingress.class: nginx @@ -494,13 +523,20 @@ ingress: # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" # nginx.ingress.kubernetes.io/ssl-passthrough: "true" - ## @param ingress.hosts [array] Host paths for ingress object - hosts: - - host: spire-server.example.org - paths: - - path: / - pathType: Prefix - ## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress + ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. + host: "spire-server" + + ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. + tlsSecret: "" + + ## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. + hosts: [] + # - host: spire-server.example.org + # paths: + # - path: / + # pathType: Prefix + + ## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. tls: [] # - secretName: spire-server-tls # hosts: @@ -534,7 +570,7 @@ nodeAttestor: ## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor serviceAccountAllowList: [] -# tornjak - Tornjak default values +## @section Tornjak tornjak: ## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production) enabled: false @@ -564,18 +600,28 @@ tornjak: ## @param tornjak.ingress.enabled Flag to enable ingress for Tornjak backend service ## @param tornjak.ingress.className Ingress class name for Tornjak backend service + ## @param tornjak.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. ## @param tornjak.ingress.annotations [object] Annotations for Tornjak backend service - ## @param tornjak.ingress.hosts [array] Host paths for ingress Tornjak backend service ingress: enabled: false className: "" + controllerType: "" annotations: {} - hosts: - - host: tornjak-backend.example.org - paths: - - path: / - pathType: Prefix - ## @param tornjak.ingress.tls [array] Secrets containing TLS certs to enable https on ingress + + ## @param tornjak.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. + host: "tornjak-backend" + + ## @param tornjak.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. + tlsSecret: "" + + ## @param tornjak.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. + hosts: [] + # - host: tornjak-backend.example.org + # paths: + # - path: / + # pathType: Prefix + + ## @param tornjak.ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. tls: [] # - secretName: chart-example-tls # hosts: @@ -678,4 +724,4 @@ tests: repository: chainguard/bash pullPolicy: IfNotPresent version: "" - tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c + tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214 diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index e8ac2d3..38239d4 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -1,7 +1,5 @@ # tornjak-frontend - - ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.2.2](https://img.shields.io/badge/AppVersion-v1.2.2-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) @@ -11,7 +9,8 @@ A Helm chart to deploy Tornjak frontend ## Version support -> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`). +> [!Note] +> This Chart is still in development and still subject to change the API (`values.yaml`). > Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although > we do aim for as much stability as possible. @@ -52,49 +51,55 @@ port forwarding. See the chart NOTES output for more details. * + + ## Parameters ### Chart parameters -| Name | Description | Value | -| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | -| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` | -| `image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `imagePullSecrets` | Pull secrets for images | `[]` | -| `nameOverride` | Name override | `""` | -| `namespaceOverride` | Namespace override | `""` | -| `fullnameOverride` | Fullname override | `""` | -| `serviceAccount.create` | Specifies whether a service account should be created | `true` | -| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | -| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | -| `labels` | Labels for tornjak frontend pods | `{}` | -| `podSecurityContext` | Pod security context | `{}` | -| `securityContext` | Security context | `{}` | -| `service.type` | Service type | `ClusterIP` | -| `service.port` | Service port | `3000` | -| `service.annotations` | Annotations for service resource | `{}` | -| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | | -| `affinity` | Affinity rules | `{}` | -| `tolerations` | List of tolerations | `[]` | -| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` | -| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. | `http://localhost:10000/` | -| `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` | -| `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` | -| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | -| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | -| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | -| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` | -| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` | -| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` | -| `ingress.className` | Ingress class name for Tornjak frontend service | `""` | -| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` | -| `ingress.hosts` | Host paths for ingress Tornjak frontend service | `[]` | -| `ingress.tls` | Secrets containing TLS certs to enable https on ingress | `[]` | -| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | -| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` | +| Name | Description | Value | +| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `imagePullSecrets` | Pull secrets for images | `[]` | +| `nameOverride` | Name override | `""` | +| `namespaceOverride` | Namespace override | `""` | +| `fullnameOverride` | Fullname override | `""` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | +| `labels` | Labels for tornjak frontend pods | `{}` | +| `podSecurityContext` | Pod security context | `{}` | +| `securityContext` | Security context | `{}` | +| `service.type` | Service type | `ClusterIP` | +| `service.port` | Service port | `3000` | +| `service.annotations` | Annotations for service resource | `{}` | +| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | | +| `affinity` | Affinity rules | `{}` | +| `tolerations` | List of tolerations | `[]` | +| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` | +| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If unset, autodetection is atempted. | `""` | +| `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` | +| `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` | +| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | +| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` | +| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` | +| `workingDir` | Path containing the Tornjak frontend within the image | `/usr/src/app` | +| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` | +| `ingress.className` | Ingress class name for Tornjak frontend service | `""` | +| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | +| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` | +| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-frontend` | +| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | +| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | +| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` | diff --git a/charts/spire/charts/tornjak-frontend/README.md.gotmpl b/charts/spire/charts/tornjak-frontend/README.md.gotmpl deleted file mode 100644 index c980a92..0000000 --- a/charts/spire/charts/tornjak-frontend/README.md.gotmpl +++ /dev/null @@ -1,54 +0,0 @@ -{{ template "chart.header" . }} - - - -{{ template "chart.deprecationWarning" . }} - -{{ template "chart.badgesSection" . }} -[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) - -{{ template "chart.description" . }} - -{{ template "chart.homepageLine" . }} - -## Version support - -> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`). -> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although -> we do aim for as much stability as possible. - -| Dependency | Supported Versions | -|:-----------|:-------------------| -| SPIRE | `1.5.3+`, `1.6.x` | -| Tornjak | `1.0.x` | -| Helm | `3.x` | - -## Tornjak - -Tornjak is the UI and Control Plane for SPIRE [https://github.com/spiffe/tornjak](https://github.com/spiffe/tornjak) and it is composed of two components: - -* [Backend](../spire-server/README.md) - Tornjak APIs that extend SPIRE APIs with Control Plane functionality -* Frontend (this chart) - Tornjak UI - -## Prerequisites - -This chart requires access to Tornjak Backend (`tornjakFrontend.apiServerURL`). -This URL needs to be reachable from your web browser and can therefore not be a cluster internal URL. - -Obtain the URL for Tornjak APIs. If deployed in the same cluster, locally, -Tornjak APIs are typically available at `http://localhost:10000`. -Review Tornjak documentation for more details. - -## Usage - -Since this is just a demo version, to access Tornjak APIs you can use -port forwarding. See the chart NOTES output for more details. - -{{ template "chart.maintainersSection" . }} - -{{ template "chart.sourcesSection" . }} - -{{ template "chart.requirementsSection" . }} - -{{ template "chart.valuesSection" . }} ----------------------------------------------- diff --git a/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl b/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl index 0dadaeb..fd7a92b 100644 --- a/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl +++ b/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl @@ -78,8 +78,9 @@ Create URL for accessing Tornjak APIs {{- define "tornjak-frontend.apiURL" -}} {{- if .Values.apiServerURL -}} {{- .Values.apiServerURL -}} +{{- else if .Values.ingress.enabled }} +{{- printf "https://tornjak-backend.%s" (include "spire-lib.trust-domain" .) }} {{- else }} -{{- $feurl := print "http://localhost:" .Values.service.port }} -{{- $feurl }} +{{- print "http://localhost:" .Values.service.port }} {{- end }} {{- end }} diff --git a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml index c7ba337..a1c4f42 100644 --- a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml +++ b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml @@ -53,9 +53,9 @@ spec: {{- end }} volumeMounts: - name: cache - mountPath: /usr/src/app/node_modules/.cache + mountPath: {{ .Values.workingDir }}/node_modules/.cache - name: env - mountPath: /usr/src/app/build/tmp + mountPath: {{ .Values.workingDir }}/build/tmp {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} diff --git a/charts/spire/charts/tornjak-frontend/templates/ingress.yaml b/charts/spire/charts/tornjak-frontend/templates/ingress.yaml index 1d14de2..c6b2e9a 100644 --- a/charts/spire/charts/tornjak-frontend/templates/ingress.yaml +++ b/charts/spire/charts/tornjak-frontend/templates/ingress.yaml @@ -1,5 +1,15 @@ {{- if .Values.ingress.enabled -}} +{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }} {{- $fullName := include "tornjak-frontend.fullname" . -}} +{{- $tlsSection := true }} +{{- $annotations := deepCopy .Values.ingress.annotations }} +{{- if eq $ingressControllerType "ingress-nginx" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }} +{{- else if eq $ingressControllerType "openshift" }} +{{- $_ := set $annotations "route.openshift.io/termination" "edge" }} +{{- $tlsSection = false }} +{{- end }} apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -7,10 +17,10 @@ metadata: namespace: {{ include "tornjak-frontend.namespace" . }} labels: {{ include "tornjak-frontend.labels" . | nindent 4}} - {{- with .Values.ingress.annotations }} + {{- with $annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} spec: - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }} {{- end }} diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index b76959f..7917df4 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -88,8 +88,8 @@ topologySpreadConstraints: [] # cpu: 100m # memory: 512Mi -## @param apiServerURL URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. -apiServerURL: "http://localhost:10000/" # 👈 Use it for minikube or kind +## @param apiServerURL URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If unset, autodetection is atempted. +apiServerURL: "" # SPIRE Healthchecker indicator spireHealthCheck: @@ -113,20 +113,33 @@ startupProbe: failureThreshold: 6 successThreshold: 1 +## @param workingDir Path containing the Tornjak frontend within the image +workingDir: /usr/src/app + ## @param ingress.enabled Flag to enable ingress for Tornjak frontend service ## @param ingress.className Ingress class name for Tornjak frontend service +## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. ## @param ingress.annotations [object] Annotations for Tornjak frontend service -## @param ingress.hosts [array] Host paths for ingress Tornjak frontend service ingress: enabled: false className: "" + controllerType: "" annotations: {} - hosts: - - host: tornjak-frontend.example.org - paths: - - path: / - pathType: Prefix - ## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress + + ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. + host: "tornjak-frontend" + + ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. + tlsSecret: "" + + ## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. + hosts: [] + # - host: tornjak-frontend.example.org + # paths: + # - path: / + # pathType: Prefix + + ## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. tls: [] # - secretName: chart-example-tls # hosts: @@ -145,4 +158,4 @@ tests: repository: chainguard/bash pullPolicy: IfNotPresent version: "" - tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c + tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214 diff --git a/charts/spire/templates/NOTES.txt b/charts/spire/templates/NOTES.txt index 5da926b..6da2681 100644 --- a/charts/spire/templates/NOTES.txt +++ b/charts/spire/templates/NOTES.txt @@ -21,3 +21,13 @@ Warning: You're using an unsupported plugin. Functionality of this release and f Warning: You're using an experimental config. Functionality of this release and future upgrades aren't guaranteed to work smoothly. {{- end }} +{{- $className := include "spire-server.controller-manager-class-name" (dict "Values" (index .Values "spire-server") "Release" .Release) }} +{{- if (index .Values "spire-server").controllerManager.enabled }} +{{- if (index .Values "spire-server").controllerManager.watchClassless }} + +Spire CR's will be handled if no className is specified or if className is set to "{{ $className }}" +{{- else }} + +Spire CR's will be handled only if className is set to "{{ $className }}" +{{- end }} +{{- end }} diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/templates/_spire-lib.tpl index 12e854d..2208abe 100644 --- a/charts/spire/templates/_spire-lib.tpl +++ b/charts/spire/templates/_spire-lib.tpl @@ -17,8 +17,10 @@ {{- define "spire-lib.jwt-issuer" }} {{- if ne (len (dig "spire" "jwtIssuer" "" .Values.global)) 0 }} {{- .Values.global.spire.jwtIssuer }} -{{- else }} +{{- else if ne (len .Values.jwtIssuer) 0 }} {{- .Values.jwtIssuer }} +{{- else }} +{{- printf "oidc-discovery.%s" (include "spire-lib.trust-domain" .) }} {{- end }} {{- end }} @@ -61,17 +63,78 @@ {{- end }} {{- end }} +{{/* Takes in a dictionary with keys: + * global - the standard global object + * ingress - a standard format ingress config object +*/}} +{{- define "spire-lib.ingress-controller-type" }} +{{- $type := "" }} +{{- if ne (len (dig "spire" "ingressControllerType" "" .global)) 0 }} +{{- $type = .global.spire.ingressControllerType }} +{{- else if ne .ingress.controllerType "" }} +{{- $type = .ingress.controllerType }} +{{- else if (dig "openshift" false .global) }} +{{- $type = "openshift" }} +{{- else }} +{{- $type = "other" }} +{{- end }} +{{- if not (has $type (list "ingress-nginx" "openshift" "other")) }} +{{- fail "Unsupported ingress controller type specified. Must be one of [ingress-nginx, openshift, other]" }} +{{- end }} +{{- $type }} +{{- end }} + +{{/* Takes in a dictionary with keys: + * ingress - the standardized ingress object + * Values - Chart values +*/}} +{{ define "spire-lib.ingress-calculated-name" }} +{{- $host := .ingress.host }} +{{- if not (contains $host ".") }} +{{- $host = printf "%s.%s" $host (include "spire-lib.trust-domain" .) }} +{{- end }} +{{- $host }} +{{- end }} + {{/* Takes in a dictionary with keys: * ingress - the standardized ingress object * svcName - The service to route to * port - which port on the service to use + * path - optional path to set on the rules + * pathType - typical ingress path type + * tlsSection - bool specifying to add by default the tls section to the ingress. Ingress-nginx needs true, openshift needs false. + * Values - Chart values */}} {{ define "spire-lib.ingress-spec" }} +{{- $host := include "spire-lib.ingress-calculated-name" . }} {{- $svcName := .svcName }} {{- $port := .port }} {{- with .ingress.className }} ingressClassName: {{ . | quote }} {{- end }} +{{- if eq (add (len .ingress.tls) (len .ingress.hosts)) 0 }} +{{ if or .tlsSection .ingress.tlsSecret }} +tls: + - hosts: + - {{ $host | quote }} +{{- with .ingress.tlsSecret }} + secretName: {{ . | quote }} +{{- end }} +{{- end }} +rules: + - host: {{ $host | quote }} + http: + paths: + - pathType: {{ .pathType }} + {{- with .path }} + path: {{ . }} + {{- end }} + backend: + service: + name: {{ $svcName | quote }} + port: + number: {{ $port }} +{{- else }} {{- if .ingress.tls }} tls: {{- range .ingress.tls }} @@ -98,6 +161,7 @@ rules: {{- end }} {{- end }} {{- end }} +{{- end }} {{- define "spire-lib.kubectl-image" }} {{- $root := deepCopy . }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index bcb9c45..77e769c 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -13,8 +13,8 @@ global: bundleConfigMap: "" ## @param global.spire.clusterName The name of the k8s cluster for Spire install clusterName: example-cluster - ## @param global.spire.jwtIssuer The issuer for Spire JWT tokens - jwtIssuer: oidc-discovery.example.org + ## @param global.spire.jwtIssuer The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset + jwtIssuer: "" ## @param global.spire.trustDomain The trust domain for Spire install trustDomain: example.org ## @param global.spire.upstreamServerAddress Set what address to use for the upstream server when using nested spire @@ -27,6 +27,9 @@ global: ## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production. strictMode: false + ## @param global.spire.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. + ingressControllerType: "" + installAndUpgradeHooks: ## @param global.installAndUpgradeHooks.enabled Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) enabled: true diff --git a/ct.yaml b/ct.yaml index affa496..d796424 100644 --- a/ct.yaml +++ b/ct.yaml @@ -3,7 +3,7 @@ target-branch: main chart-dirs: - charts chart-repos: - - spiffe=https://spiffe.github.io/helm-charts/ + - spiffe=https://spiffe.github.io/helm-charts-hardened/ - bitnami=https://charts.bitnami.com/bitnami - ingress-nginx=https://kubernetes.github.io/ingress-nginx exclude-deprecated: true diff --git a/examples/external-mysql/run-tests.sh b/examples/external-mysql/run-tests.sh index 6815b29..aeaf627 100755 --- a/examples/external-mysql/run-tests.sh +++ b/examples/external-mysql/run-tests.sh @@ -12,11 +12,24 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh" # shellcheck source=/dev/null source "${TESTDIR}/common.sh" +CLEANUP=1 + +for i in "$@"; do + case $i in + -c) + CLEANUP=0 + shift # past argument=value + ;; + esac +done + teardown() { - helm uninstall --namespace "spire-server" spire 2>/dev/null || true - helm uninstall --namespace mysql mysql 2>/dev/null || true - kubectl delete ns spire-server 2>/dev/null || true - kubectl delete ns spire-system 2>/dev/null || true + if [ "${CLEANUP}" -eq 1 ]; then + helm uninstall --namespace "spire-server" spire 2>/dev/null || true + helm uninstall --namespace mysql mysql 2>/dev/null || true + kubectl delete ns spire-server 2>/dev/null || true + kubectl delete ns spire-system 2>/dev/null || true + fi } trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT diff --git a/examples/external-postgresql/run-tests.sh b/examples/external-postgresql/run-tests.sh index 388da84..8cfe700 100755 --- a/examples/external-postgresql/run-tests.sh +++ b/examples/external-postgresql/run-tests.sh @@ -12,11 +12,24 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh" # shellcheck source=/dev/null source "${TESTDIR}/common.sh" +CLEANUP=1 + +for i in "$@"; do + case $i in + -c) + CLEANUP=0 + shift # past argument=value + ;; + esac +done + teardown() { - helm uninstall --namespace "spire-server" spire 2>/dev/null || true - helm uninstall --namespace "spire-server" postgresql 2>/dev/null || true - kubectl delete ns spire-server 2>/dev/null || true - kubectl delete ns spire-system 2>/dev/null || true + if [ "${CLEANUP}" -eq 1 ]; then + helm uninstall --namespace "spire-server" spire 2>/dev/null || true + helm uninstall --namespace "spire-server" postgresql 2>/dev/null || true + kubectl delete ns spire-server 2>/dev/null || true + kubectl delete ns spire-system 2>/dev/null || true + fi } trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT diff --git a/examples/nested/run-tests.sh b/examples/nested/run-tests.sh index 0bace5d..407715e 100755 --- a/examples/nested/run-tests.sh +++ b/examples/nested/run-tests.sh @@ -12,13 +12,26 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh" # shellcheck source=/dev/null source "${TESTDIR}/common.sh" -teardown() { - helm uninstall --namespace spire-server spire 2>/dev/null || true - kubectl delete ns spire-server 2>/dev/null || true - kubectl delete ns spire-system 2>/dev/null || true +CLEANUP=1 - helm uninstall --namespace mysql spire-root-server 2>/dev/null || true - kubectl delete ns spire-root-server 2>/dev/null || true +for i in "$@"; do + case $i in + -c) + CLEANUP=0 + shift # past argument=value + ;; + esac +done + +teardown() { + if [ "${CLEANUP}" -eq 1 ]; then + helm uninstall --namespace spire-server spire 2>/dev/null || true + kubectl delete ns spire-server 2>/dev/null || true + kubectl delete ns spire-system 2>/dev/null || true + + helm uninstall --namespace mysql spire-root-server 2>/dev/null || true + kubectl delete ns spire-root-server 2>/dev/null || true + fi } trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT @@ -33,10 +46,6 @@ helm upgrade --install --create-namespace spire charts/spire \ --values "${DEPS}/spire-root-server-values.yaml" \ --wait -kubectl get nodes -o go-template='{{range .items}}{{printf "%s\n" .metadata.uid}}{{end}}' | while read -r line; do - kubectl exec -t spire-server-0 -n "spire-root-server" -- spire-server entry create -spiffeID spiffe://production.other/production/nested-spire -parentID "spiffe://production.other/spire/agent/k8s_psat/production/$line" -selector k8s:pod-label:app.kubernetes.io/name:server -downstream -done - helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \ --wait spire charts/spire helm test --namespace spire-server spire diff --git a/examples/openshift/README.md b/examples/openshift/README.md new file mode 100644 index 0000000..1e51815 --- /dev/null +++ b/examples/openshift/README.md @@ -0,0 +1,80 @@ +# Recommended setup for installing Spire on Openshift + +> [!Note] +> This functionality is under development. It works but has no automated testing and will have security tightened in the future. + +This deployment works only with Openshift version 4.13 or higher. Get the Openshift platform here: [try.openshift.com](try.openshift.com) + +To be consistent with the rest of the Spire helm-charts, +we deploy Spire across 2 namespaces. + +```shell +kubectl create namespace "spire-system" +kubectl create namespace "spire-server" + +#Note, the first install requires privilege due to helm ordering issue. After install it can be safely tightened back up. +kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=privileged + +kubectl label namespace "spire-system" security.openshift.io/scc.podSecurityLabelSync=false +kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged +kubectl label namespace "spire-system" pod-security.kubernetes.io/warn=privileged --overwrite +kubectl label namespace "spire-system" pod-security.kubernetes.io/audit=privileged --overwrite + +helm upgrade --install --namespace spire-server spire-crds charts/spire-crds +``` + +Obtain you ingress subdomain: + +```shell +appdomain=$(oc get cm -n openshift-config-managed console-public -o go-template="{{ .data.consoleURL }}" | sed 's@https://@@; s/^[^.]*\.//') +echo "$appdomain" +``` + +Update the `example-your-values.yaml` file with your subdomain. + +> [!Note] +> The location of the apps subdomain may be different in certain environments_ + +## Standard Deployment + +```shell +helm upgrade --install --namespace spire-server spire charts/spire \ +--values examples/production/values.yaml \ +--values examples/openshift/openshift-values.yaml \ +--values examples/production/example-your-values.yaml \ +--render-subchart-notes +``` + +## IBM Cloud Deployment + +Openshift on IBM Cloud requires additional configuration: + +```shell +helm upgrade --install --namespace spire-server spire charts/spire \ +--values examples/production/values.yaml \ +--values examples/openshift/openshift-values.yaml \ +--set spiffe-csi-driver.kubeletPath=/var/data/kubelet \ +--set spiffe-csi-driver.restrictedScc.enabled=true \ +--values examples/production/example-your-values.yaml \ +--render-subchart-notes +``` + +## Feature Customization + +Additional features such as tornjak can be enabled by including their example values files before --values examples/production/example-your-values.yaml + +For example: + +```shell +--values examples/openshift/openshift-values.yaml \ +--values examples/tornjak/values.yaml \ +--values examples/production/example-your-values.yaml \ +``` + +## Finish install + +Once installed, the namespace security can be tightened back up. + +```shell +kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted --overwrite +``` diff --git a/examples/openshift/openshift-values.yaml b/examples/openshift/openshift-values.yaml new file mode 100644 index 0000000..5d9ae79 --- /dev/null +++ b/examples/openshift/openshift-values.yaml @@ -0,0 +1,82 @@ +global: + openshift: true + telemetry: + prometheus: + enabled: true + +spire-server: + tornjak: + image: + registry: ghcr.io + repository: spiffe/tornjak-backend + tag: ubi-v1.4.1 + + nodeAttestor: + k8sPsat: + serviceAccountAllowList: ["spire-system:spire-agent"] + notifier: + k8sbundle: + namespace: spire-system + podSecurityContext: + # These are unset so that openshift can automatically assign its own restricted uids to the pods + runAsUser: null + runAsGroup: null + fsGroup: null + +spire-agent: + podSecurityContext: + runAsUser: null + runAsGroup: null + fsGroup: null + # Talk from the agent to kubelet based on hostname instead of localhost + extraEnvVars: + - name: MY_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + +upstream-spire-agent: + podSecurityContext: + runAsUser: null + runAsGroup: null + fsGroup: null + +spiffe-oidc-discovery-provider: + podSecurityContext: + runAsUser: null + runAsGroup: null + fsGroup: null + +tornjak-frontend: + workingDir: /opt/app-root/src + image: + registry: ghcr.io + repository: spiffe/tornjak-frontend + tag: ubi-v1.4.1 + podSecurityContext: + runAsUser: null + runAsGroup: null + fsGroup: null + +spiffe-csi-driver: + csiDriverLabels: + security.openshift.io/csi-ephemeral-volume-profile: restricted + initContainers: + - terminationMessagePath: /dev/termination-log + name: set-context + command: + - chcon + - '-Rvt' + - container_file_t + - spire-agent-socket/ + securityContext: + capabilities: + drop: + - all + privileged: true + imagePullPolicy: Always + volumeMounts: + - name: spire-agent-socket-dir + mountPath: /spire-agent-socket + terminationMessagePolicy: File + image: 'registry.access.redhat.com/ubi9:latest' diff --git a/examples/production/README.md b/examples/production/README.md index a8561e6..21119c2 100644 --- a/examples/production/README.md +++ b/examples/production/README.md @@ -20,7 +20,7 @@ If your using ingress-nginx and want to expose the spiffe oidc discovery provide cluster, add the following to the end of the helm upgrade example: ```shell --f values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml +-f values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml ``` If you want to expose your spire-server outside of Kubernetes and are using ingress-nginx, add following values file when running `helm template/install/upgrade`. @@ -28,21 +28,25 @@ If you want to expose your spire-server outside of Kubernetes and are using ingr ```shell -f values-expose-spire-server-ingress-nginx.yaml ``` + For example: + ```shell helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-spire-server-ingress-nginx.yaml ``` If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx you have two options as described here: -https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles +[github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles](https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles) If you chose profile https_web, use: ```shell -f values-expose-federation-https-web-ingress-nginx.yaml ``` + For example: + ```shell helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-web-ingress-nginx.yaml ``` @@ -52,10 +56,11 @@ If you chose profile https_spiffe, use: ```shell -f values-expose-federation-https-spiffe-ingress-nginx.yaml ``` + For example: + ```shell helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-spiffe-ingress-nginx.yaml ``` See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup. - diff --git a/examples/production/example-your-values.yaml b/examples/production/example-your-values.yaml index be5efa3..7c3a830 100644 --- a/examples/production/example-your-values.yaml +++ b/examples/production/example-your-values.yaml @@ -2,7 +2,6 @@ global: spire: clusterName: production trustDomain: production.other - jwtIssuer: oidc-discovery.production.other spire-server: ca_subject: @@ -10,36 +9,14 @@ spire-server: organization: Production common_name: production.other - ingress: - hosts: - - host: spire-server.production.other - paths: - - path: / - pathType: Prefix - tls: - - hosts: - - spire-server.production.other - federation: - ingress: - hosts: - - host: spire-server-federation.production.other - paths: - - path: / - pathType: Prefix - tls: - - hosts: - - spire-server-federation.production.other - secretName: tls-cert - -spiffe-oidc-discovery-provider: - ingress: - hosts: - - host: oidc-discovery.production.other - paths: - - path: / - pathType: Prefix - tls: - - secretName: tls-cert - hosts: - - oidc-discovery.production.other +# ingress: +# host: spire-server +# federation: +# ingress: +# host: spire-server-federation +# tlsSecret: tls-cert +# spiffe-oidc-discovery-provider: +# ingress: +# host: oidc-discovery +# tlsSecret: tls-cert diff --git a/examples/production/run-tests.sh b/examples/production/run-tests.sh index 8fed83a..5ef92b6 100755 --- a/examples/production/run-tests.sh +++ b/examples/production/run-tests.sh @@ -2,7 +2,7 @@ set -xe -UPGRADE_VERSION=v0.13.0 +UPGRADE_VERSION=v0.14.0 UPGRADE_REPO=https://spiffe.github.io/helm-charts-hardened SCRIPT="$(readlink -f "$0")" @@ -48,30 +48,43 @@ teardown() { trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT -kubectl create namespace spire-system 2>/dev/null || true -kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true -kubectl create namespace "${ns}" 2>/dev/null || true -kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true +if [[ -n "$UPGRADE_ARGS" ]]; then + pushd "${SCRIPTPATH}" + git clone https://github.com/spiffe/helm-charts-hardened "${UPGRADE_VERSION}" + pushd "${UPGRADE_VERSION}" + git checkout "${UPGRADE_VERSION/v/spire-}" + helm install --create-namespace -n spire-system spire-crds charts/spire-crds + ./examples/production/run-tests.sh -c + popd + popd + # Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.) + helm upgrade -n spire-system spire-crds charts/spire-crds --wait +else -"${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \ - --namespace cert-manager \ - --create-namespace \ - --set installCRDs=true \ - --wait + kubectl create namespace spire-system 2>/dev/null || true + kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true + kubectl create namespace "${ns}" 2>/dev/null || true + kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true -kubectl apply -f "${DEPS}/testcert.yaml" -n spire-server + "${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \ + --namespace cert-manager \ + --create-namespace \ + --set installCRDs=true \ + --wait -"${helm_install[@]}" ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \ - --namespace ingress-nginx \ - --create-namespace \ - --set controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP \ - --set controller.ingressClassResource.default=true \ - --wait + kubectl apply -f "${DEPS}/testcert.yaml" -n spire-server -ip=$(kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ .spec.clusterIP }}') -echo "$ip" oidc-discovery.production.other + "${helm_install[@]}" ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \ + --namespace ingress-nginx \ + --create-namespace \ + --set controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP \ + --set controller.ingressClassResource.default=true \ + --wait -cat > /tmp/dummydns < /tmp/dummydns < **Warning**: The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production. +> [!Warning] +> The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production. To install Spire with the least privileges possible we deploy spire across 2 namespaces. diff --git a/examples/tornjak/run-tests.sh b/examples/tornjak/run-tests.sh index e4449cd..f911ee0 100755 --- a/examples/tornjak/run-tests.sh +++ b/examples/tornjak/run-tests.sh @@ -12,9 +12,22 @@ source "${TESTDIR}/common.sh" helm_install=(helm upgrade --install --create-namespace) ns=spire-system +CLEANUP=1 + +for i in "$@"; do + case $i in + -c) + CLEANUP=0 + shift # past argument=value + ;; + esac +done + teardown() { - helm uninstall --namespace "${ns}" spire 2>/dev/null || true - kubectl delete ns "${ns}" 2>/dev/null || true + if [ "${CLEANUP}" -eq 1 ]; then + helm uninstall --namespace "${ns}" spire 2>/dev/null || true + kubectl delete ns "${ns}" 2>/dev/null || true + fi } trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT diff --git a/examples/tornjak/values.yaml b/examples/tornjak/values.yaml index a407265..6ba0015 100644 --- a/examples/tornjak/values.yaml +++ b/examples/tornjak/values.yaml @@ -7,7 +7,6 @@ tornjak-frontend: service: type: ClusterIP port: 3000 - apiServerURL: "http://localhost:10000/" resources: requests: cpu: 50m diff --git a/helm-docs.sh b/helm-docs.sh index 91cc2bb..43bfde7 100755 --- a/helm-docs.sh +++ b/helm-docs.sh @@ -3,7 +3,7 @@ set -euo pipefail SCRIPTPATH=$(dirname "$0") -README_GENERATOR_VERSION="2.5.1" +README_GENERATOR_VERSION="2.6.0" README_GENERATOR_EXE="readme-generator" if ! hash "${README_GENERATOR_EXE}" 2>/dev/null; then diff --git a/project/openshift.md b/project/openshift.md new file mode 100644 index 0000000..b47ddef --- /dev/null +++ b/project/openshift.md @@ -0,0 +1,38 @@ +# OpenShift notes for K8S developers + +## SecurityContexts + +OpenShift automatically generates uid/gid's for pods. They should not be set to get this behavior. + +## CSIDriver issues + +A workload in a restricted namespace can not access a csidriver that isn't labeled: + +```yaml +security.openshift.io/csi-ephemeral-volume-profile: restricted +``` + +If the CSIDriver doesn't exist, the workload is blocked from being uploaded into the cluster. This runs into ordering issues with helm install as it always loads regular workloads before CSIDriver objects. + +## Pod Security Standard + +Pod Security Standard (PSS) rules are automatically generated on openshift. Details at [https://docs.openshift.com/container-platform/4.13/authentication/understanding-and-managing-pod-security-admission.html](https://docs.openshift.com/container-platform/4.13/authentication/understanding-and-managing-pod-security-admission.html) + +The defaults though are too chatty. It puts audit/warn still at restricted. + +## Ingress + +Ingress objects automatically create Role objects in the same namespace, when the ingress object is viewed as valid by openshift, if not it is ignored. A missing Role object is a sure sign that something is wrong in the Ingress. + +Some things to watch out for. + +When the ingress is annotated: + +```yaml + "route.openshift.io/termination": "passthrough" +``` + +The ingress object can not have a path specified and the pathType needs to be ImplementationSpecific + +Also, unless a secretName is specified, it can not have a tls section. + diff --git a/release-chart.sh b/release-chart.sh index 54eedf2..ee856cd 100755 --- a/release-chart.sh +++ b/release-chart.sh @@ -117,7 +117,8 @@ git push -u origin --force-with-lease cat < **Note**: **Maintainers** ensure to run following after merging this PR to trigger the release workflow: +> [!Note] +> **Maintainers** ensure to run following after merging this PR to trigger the release workflow: > > \`\`\`shell > git checkout main diff --git a/tests/go.mod b/tests/go.mod index cc6e234..b6cc037 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -4,8 +4,8 @@ go 1.20 require ( github.com/onsi/ginkgo/v2 v2.13.0 - github.com/onsi/gomega v1.28.0 - helm.sh/helm/v3 v3.13.1 + github.com/onsi/gomega v1.30.0 + helm.sh/helm/v3 v3.13.2 ) require ( @@ -25,7 +25,7 @@ require ( github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/protobuf v1.5.3 // indirect github.com/google/gnostic-models v0.6.8 // indirect - github.com/google/go-cmp v0.5.9 // indirect + github.com/google/go-cmp v0.6.0 // indirect github.com/google/gofuzz v1.2.0 // indirect github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect github.com/google/uuid v1.3.0 // indirect @@ -45,11 +45,11 @@ require ( github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect github.com/xeipuuv/gojsonschema v1.2.0 // indirect - golang.org/x/crypto v0.13.0 // indirect - golang.org/x/net v0.14.0 // indirect + golang.org/x/crypto v0.14.0 // indirect + golang.org/x/net v0.17.0 // indirect golang.org/x/oauth2 v0.8.0 // indirect - golang.org/x/sys v0.12.0 // indirect - golang.org/x/term v0.12.0 // indirect + golang.org/x/sys v0.13.0 // indirect + golang.org/x/term v0.13.0 // indirect golang.org/x/text v0.13.0 // indirect golang.org/x/time v0.3.0 // indirect golang.org/x/tools v0.12.0 // indirect diff --git a/tests/go.sum b/tests/go.sum index ffeb68f..693fb29 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -41,8 +41,8 @@ github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiu github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I= github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U= github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38= -github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= +github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= +github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0= github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= @@ -87,8 +87,8 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4= github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o= -github.com/onsi/gomega v1.28.0 h1:i2rg/p9n/UqIDAMFUJ6qIUUMcsqOuUHgbpbu235Vr1c= -github.com/onsi/gomega v1.28.0/go.mod h1:A1H2JE76sI14WIP57LMKj7FVfCHx3g3BcZVjJG8bjX8= +github.com/onsi/gomega v1.30.0 h1:hvMK7xYz4D3HapigLTeGdId/NcfQx1VHMJc60ew99+8= +github.com/onsi/gomega v1.30.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= @@ -127,8 +127,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4= -golang.org/x/crypto v0.13.0 h1:mvySKfSWJ+UKUii46M40LOvyWfN0s2U+46/jDd0e6Ck= -golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc= +golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc= +golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= @@ -141,8 +141,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY= -golang.org/x/net v0.14.0 h1:BONx9s002vGdD9umnlX1Po8vOZmrgH34qlHcD1MfK14= -golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI= +golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM= +golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE= golang.org/x/oauth2 v0.8.0 h1:6dkIjl3j3LtZ/O3sTgZTMsLKSftL/B8Zgq4huOIIUu8= golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -158,13 +158,13 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o= -golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE= +golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc= -golang.org/x/term v0.12.0 h1:/ZfYdc3zq+q02Rv9vGqTeSItdzZTSNDmfTi0mBAuidU= -golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU= +golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek= +golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= @@ -205,8 +205,8 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -helm.sh/helm/v3 v3.13.1 h1:DG+XLGzBJeZvMLlMbm6bPDLV1dGaVW9eZsDoUd1/LM0= -helm.sh/helm/v3 v3.13.1/go.mod h1:TdQRMiq46CSWcc68Hb0uVhvAWusaN90YwAV54cz6JzU= +helm.sh/helm/v3 v3.13.2 h1:IcO9NgmmpetJODLZhR3f3q+6zzyXVKlRizKFwbi7K8w= +helm.sh/helm/v3 v3.13.2/go.mod h1:GIHDwZggaTGbedevTlrQ6DB++LBN6yuQdeGj0HNaDx0= k8s.io/api v0.28.2 h1:9mpl5mOb6vXZvqbQmankOfPIGiudghwCoLl1EYfUZbw= k8s.io/api v0.28.2/go.mod h1:RVnJBsjU8tcMq7C3iaRSGMeaKt2TWEUXcpIt/90fjEg= k8s.io/apiextensions-apiserver v0.28.2 h1:J6/QRWIKV2/HwBhHRVITMLYoypCoPY1ftigDM0Kn+QU=