From cf226a73d551da9a8aa3dd1f13795884d7bde3c2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 18 Oct 2023 21:17:40 +0000 Subject: [PATCH 01/36] Bump actions/checkout from 4.1.0 to 4.1.1 (#42) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.0 to 4.1.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4.1.0...v4.1.1) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Faisal Memon --- .github/workflows/check-versions.yaml | 2 +- .github/workflows/helm-chart-ci-ignore.yaml | 2 +- .github/workflows/helm-chart-ci.yaml | 12 ++++++------ .github/workflows/helm-release.yaml | 2 +- .github/workflows/shellcheck.yaml | 2 +- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/check-versions.yaml b/.github/workflows/check-versions.yaml index 7a39ffc..766fe14 100644 --- a/.github/workflows/check-versions.yaml +++ b/.github/workflows/check-versions.yaml @@ -20,7 +20,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 - name: Set up Helm uses: azure/setup-helm@v3.5 diff --git a/.github/workflows/helm-chart-ci-ignore.yaml b/.github/workflows/helm-chart-ci-ignore.yaml index 3e88952..07841e4 100644 --- a/.github/workflows/helm-chart-ci-ignore.yaml +++ b/.github/workflows/helm-chart-ci-ignore.yaml @@ -43,7 +43,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 - id: set-matrix name: Collect all examples diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index 32ae4fb..8cb9016 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -32,7 +32,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 - name: Verify Docs updated run: ./helm-docs.sh @@ -94,7 +94,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 with: fetch-depth: 0 @@ -136,7 +136,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 with: fetch-depth: 0 @@ -185,7 +185,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 - id: set-matrix name: Collect all examples @@ -217,7 +217,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 - name: Set up Helm uses: azure/setup-helm@v3.5 @@ -261,7 +261,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 - name: Set up Helm uses: azure/setup-helm@v3.5 diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml index b700d43..bc854b5 100644 --- a/.github/workflows/helm-release.yaml +++ b/.github/workflows/helm-release.yaml @@ -19,7 +19,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 with: fetch-depth: 0 diff --git a/.github/workflows/shellcheck.yaml b/.github/workflows/shellcheck.yaml index 9840317..7e5b19e 100644 --- a/.github/workflows/shellcheck.yaml +++ b/.github/workflows/shellcheck.yaml @@ -21,7 +21,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4.1.0 + uses: actions/checkout@v4.1.1 - name: Run Shellcheck uses: ludeeus/action-shellcheck@2.0.0 From 5025025fdcc1f3b1eb604a14676fc9758e548eaf Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Wed, 18 Oct 2023 14:28:00 -0700 Subject: [PATCH 02/36] Fix doc missing end tag (#46) Signed-off-by: Kevin Fox Co-authored-by: Faisal Memon --- charts/spire/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/charts/spire/README.md b/charts/spire/README.md index aa89c4b..9dd5f3e 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -91,6 +91,7 @@ To do a quick non production install: kubectl create namespace spire-system helm install -n spire-system spire-crds charts/spire-crds helm install -n spire-system spire charts/spire +``` For production installs, please see [the production example](examples/production/). From a4199035db58d65afa7092ae84ee421ab83ff498 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 23 Oct 2023 13:32:18 -0700 Subject: [PATCH 03/36] Bump github.com/onsi/gomega from 1.28.0 to 1.28.1 in /tests (#53) Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.28.0 to 1.28.1. - [Release notes](https://github.com/onsi/gomega/releases) - [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md) - [Commits](https://github.com/onsi/gomega/compare/v1.28.0...v1.28.1) --- updated-dependencies: - dependency-name: github.com/onsi/gomega dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- tests/go.mod | 12 ++++++------ tests/go.sum | 24 ++++++++++++------------ 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/tests/go.mod b/tests/go.mod index cc6e234..792dc2d 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -4,7 +4,7 @@ go 1.20 require ( github.com/onsi/ginkgo/v2 v2.13.0 - github.com/onsi/gomega v1.28.0 + github.com/onsi/gomega v1.28.1 helm.sh/helm/v3 v3.13.1 ) @@ -25,7 +25,7 @@ require ( github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/protobuf v1.5.3 // indirect github.com/google/gnostic-models v0.6.8 // indirect - github.com/google/go-cmp v0.5.9 // indirect + github.com/google/go-cmp v0.6.0 // indirect github.com/google/gofuzz v1.2.0 // indirect github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect github.com/google/uuid v1.3.0 // indirect @@ -45,11 +45,11 @@ require ( github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect github.com/xeipuuv/gojsonschema v1.2.0 // indirect - golang.org/x/crypto v0.13.0 // indirect - golang.org/x/net v0.14.0 // indirect + golang.org/x/crypto v0.14.0 // indirect + golang.org/x/net v0.17.0 // indirect golang.org/x/oauth2 v0.8.0 // indirect - golang.org/x/sys v0.12.0 // indirect - golang.org/x/term v0.12.0 // indirect + golang.org/x/sys v0.13.0 // indirect + golang.org/x/term v0.13.0 // indirect golang.org/x/text v0.13.0 // indirect golang.org/x/time v0.3.0 // indirect golang.org/x/tools v0.12.0 // indirect diff --git a/tests/go.sum b/tests/go.sum index ffeb68f..c2ed9c8 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -41,8 +41,8 @@ github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiu github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I= github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U= github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38= -github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= +github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= +github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0= github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= @@ -87,8 +87,8 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4= github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o= -github.com/onsi/gomega v1.28.0 h1:i2rg/p9n/UqIDAMFUJ6qIUUMcsqOuUHgbpbu235Vr1c= -github.com/onsi/gomega v1.28.0/go.mod h1:A1H2JE76sI14WIP57LMKj7FVfCHx3g3BcZVjJG8bjX8= +github.com/onsi/gomega v1.28.1 h1:MijcGUbfYuznzK/5R4CPNoUP/9Xvuo20sXfEm6XxoTA= +github.com/onsi/gomega v1.28.1/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= @@ -127,8 +127,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4= -golang.org/x/crypto v0.13.0 h1:mvySKfSWJ+UKUii46M40LOvyWfN0s2U+46/jDd0e6Ck= -golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc= +golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc= +golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= @@ -141,8 +141,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY= -golang.org/x/net v0.14.0 h1:BONx9s002vGdD9umnlX1Po8vOZmrgH34qlHcD1MfK14= -golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI= +golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM= +golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE= golang.org/x/oauth2 v0.8.0 h1:6dkIjl3j3LtZ/O3sTgZTMsLKSftL/B8Zgq4huOIIUu8= golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -158,13 +158,13 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o= -golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE= +golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc= -golang.org/x/term v0.12.0 h1:/ZfYdc3zq+q02Rv9vGqTeSItdzZTSNDmfTi0mBAuidU= -golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU= +golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek= +golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= From 0b174345ab515edb55040552ebca395e94f09d79 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 23 Oct 2023 20:40:30 +0000 Subject: [PATCH 04/36] Bump test chart dependencies (#54) Signed-off-by: GitHub Co-authored-by: marcofranssen Co-authored-by: Faisal Memon --- .github/tests/charts.json | 2 +- charts/spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- charts/spire/charts/spire-agent/README.md | 2 +- charts/spire/charts/spire-agent/values.yaml | 2 +- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 9 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 02f1c77..91180db 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "51.8.0" + "version": "51.10.0" }, { "name": "cert-manager", diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 3bab4ad..d8b5906 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -106,12 +106,12 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:57151ad9f998c9394c9ba8b66c83f70cbfe3d4b733c166c9856e0d8fb273bfd0` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:6881d2c00c5178d98b97ae5c73d2b22b8d751f6c73f97a85ab0436c9a82602cd` | | `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` | | `tests.busybox.image.repository` | The repository within the registry | `busybox` | | `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index c6377e2..d899eae 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -280,7 +280,7 @@ tests: repository: chainguard/bash pullPolicy: IfNotPresent version: "" - tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c + tag: latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2 toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -294,7 +294,7 @@ tests: repository: chainguard/slim-toolkit-debug pullPolicy: IfNotPresent version: "" - tag: latest@sha256:57151ad9f998c9394c9ba8b66c83f70cbfe3d4b733c166c9856e0d8fb273bfd0 + tag: latest@sha256:6881d2c00c5178d98b97ae5c73d2b22b8d751f6c73f97a85ab0436c9a82602cd busybox: ## @param tests.busybox.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 52f27d1..d200d9b 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -74,7 +74,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | | `fsGroupFix.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index d5fe56f..0897979 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -153,7 +153,7 @@ fsGroupFix: repository: chainguard/bash pullPolicy: Always version: "" - tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c + tag: latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2 ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 2b09965..2c0f5f2 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -298,4 +298,4 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 5dfd1bf..cf0b77f 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -678,4 +678,4 @@ tests: repository: chainguard/bash pullPolicy: IfNotPresent version: "" - tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c + tag: latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2 diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index e8ac2d3..1969cc4 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -97,4 +97,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index b76959f..27d81b2 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -145,4 +145,4 @@ tests: repository: chainguard/bash pullPolicy: IfNotPresent version: "" - tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c + tag: latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2 From 7924323a8f0485cd87c07410a44a0846c2ea7d4a Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Tue, 24 Oct 2023 13:18:53 -0700 Subject: [PATCH 05/36] Specify ingress controller type (#43) * Specify ingress controller type Signed-off-by: Kevin Fox * Fix indenting, docs Signed-off-by: Kevin Fox * Fix spacing Signed-off-by: Kevin Fox * Fix missing brackets Signed-off-by: Kevin Fox * Fix missing brackets Signed-off-by: Kevin Fox * Add ingress-nginx support Signed-off-by: Kevin Fox * Use the right example values for test version to upgrade from. Signed-off-by: Kevin Fox * Fix var in wrong location Signed-off-by: Kevin Fox * Fix missing arg Signed-off-by: Kevin Fox * Try this to checkout the right version Signed-off-by: Kevin Fox * Switch to upgrading from 0.14.0 Signed-off-by: Kevin Fox * Install crds Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Apply suggestions from code review Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix docs Signed-off-by: Kevin Fox * Enable unset ingress controller type to use with openshift later Signed-off-by: Kevin Fox * Fix docs after merge issue Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon --- charts/spire/README.md | 25 +-- .../spiffe-oidc-discovery-provider/README.md | 198 +++++++++--------- .../templates/ingress.yaml | 8 +- .../values.yaml | 2 + charts/spire/charts/spire-server/README.md | 3 + .../templates/federation-ingress.yaml | 9 +- .../spire-server/templates/ingress.yaml | 10 +- .../templates/tornjak-ingress.yaml | 10 + charts/spire/charts/spire-server/values.yaml | 6 + .../spire/charts/tornjak-frontend/README.md | 85 ++++---- .../tornjak-frontend/templates/ingress.yaml | 8 +- .../spire/charts/tornjak-frontend/values.yaml | 2 + charts/spire/templates/_spire-lib.tpl | 19 ++ charts/spire/values.yaml | 3 + examples/production/run-tests.sh | 71 +++---- ...federation-https-spiffe-ingress-nginx.yaml | 8 +- ...rt-federation-https-web-ingress-nginx.yaml | 9 +- ...oidc-discovery-provider-ingress-nginx.yaml | 8 +- ...ues-export-spire-server-ingress-nginx.yaml | 10 +- 19 files changed, 270 insertions(+), 224 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 9dd5f3e..e54be82 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -123,18 +123,19 @@ helm install -n spire-server spire-crds charts/spire-crds ### Global parameters -| Name | Description | Value | -| --------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ---------------------------- | -| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` | -| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` | -| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` | -| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens | `oidc-discovery.example.org` | -| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` | -| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` | -| `global.spire.image.registry` | Override all Spire image registries at once | `""` | -| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` | -| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | -| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | +| Name | Description | Value | +| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | +| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` | +| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` | +| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` | +| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens | `oidc-discovery.example.org` | +| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` | +| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` | +| `global.spire.image.registry` | Override all Spire image registries at once | `""` | +| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` | +| `global.spire.ingressControllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | +| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | +| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | ### Spire server parameters diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index d8b5906..ba182f8 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -29,101 +29,103 @@ A Helm chart to install the SPIFFE OIDC discovery provider. ### Chart parameters -| Name | Description | Value | -| ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | -| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | -| `replicaCount` | Replica count | `1` | -| `namespaceOverride` | Namespace override | `""` | -| `annotations` | Annotations for the deployment | `{}` | -| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `image.repository` | The repository within the registry | `spiffe/oidc-discovery-provider` | -| `image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `resources` | Resource requests and limits | `{}` | -| `service.type` | Service type | `ClusterIP` | -| `service.port` | Service port | `80` | -| `service.annotations` | Annotations for service resource | `{}` | -| `configMap.annotations` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | `{}` | -| `podSecurityContext` | Pod security context for OIDC discovery provider pods | `{}` | -| `securityContext` | Security context for OIDC discovery provider deployment | `{}` | -| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | -| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | -| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | -| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | -| `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` | -| `insecureScheme.enabled` | Flag to enable insecure schema | `false` | -| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from | `docker.io` | -| `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` | -| `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.2-alpine` | -| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | -| `jwtIssuer` | Path to JWT issuer | `https://oidc-discovery.example.org` | -| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | -| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` | -| `config.acme.tosAccepted` | Flag for Terms of Service acceptance | `false` | -| `config.acme.cacheDir` | Path for cache directory | `/run/spire` | -| `config.acme.directoryUrl` | URL for acme directory | `https://acme-v02.api.letsencrypt.org/directory` | -| `config.acme.emailAddress` | Email address for registration | `letsencrypt@example.org` | -| `imagePullSecrets` | Image pull secret names | `[]` | -| `nameOverride` | Name override | `""` | -| `fullnameOverride` | Full name override | `""` | -| `serviceAccount.create` | Specifies whether a service account should be created | `true` | -| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | -| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | -| `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | -| `autoscaling.enabled` | Flag to enable autoscaling | `false` | -| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` | -| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` | -| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` | -| `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` | -| `nodeSelector` | Node selector | `{}` | -| `tolerations` | iist of tolerations | `[]` | -| `affinity` | Node affinity | `{}` | -| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | -| `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` | -| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | -| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | -| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | -| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the helm release | `""` | -| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | -| `telemetry.prometheus.nginxExporter.image.registry` | The OCI registry to pull the image from | `docker.io` | -| `telemetry.prometheus.nginxExporter.image.repository` | The repository within the registry | `nginx/nginx-prometheus-exporter` | -| `telemetry.prometheus.nginxExporter.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `telemetry.prometheus.nginxExporter.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `telemetry.prometheus.nginxExporter.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.11.0` | -| `telemetry.prometheus.nginxExporter.resources` | Resource requests and limits | `{}` | -| `ingress.enabled` | Flag to enable ingress | `false` | -| `ingress.className` | Ingress class name | `""` | -| `ingress.annotations` | Annotations for ingress object | `{}` | -| `ingress.hosts` | Host paths for ingress object | `[]` | -| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` | -| `tests.hostAliases` | List of host aliases for testing | `[]` | -| `tests.tls.enabled` | Flag for enabling tls for tests | `false` | -| `tests.tls.customCA` | Custom CA value for tests | `""` | -| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | -| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2` | -| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | -| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:6881d2c00c5178d98b97ae5c73d2b22b8d751f6c73f97a85ab0436c9a82602cd` | -| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` | -| `tests.busybox.image.repository` | The repository within the registry | `busybox` | -| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.busybox.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` | -| `tests.agent.image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `tests.agent.image.repository` | The repository within the registry | `spiffe/spire-agent` | -| `tests.agent.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.agent.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.agent.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | -| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | -| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| Name | Description | Value | +| ----------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | +| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | +| `replicaCount` | Replica count | `1` | +| `namespaceOverride` | Namespace override | `""` | +| `annotations` | Annotations for the deployment | `{}` | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/oidc-discovery-provider` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `resources` | Resource requests and limits | `{}` | +| `service.type` | Service type | `ClusterIP` | +| `service.port` | Service port | `80` | +| `service.annotations` | Annotations for service resource | `{}` | +| `configMap.annotations` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | `{}` | +| `podSecurityContext` | Pod security context for OIDC discovery provider pods | `{}` | +| `securityContext` | Security context for OIDC discovery provider deployment | `{}` | +| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | +| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | +| `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` | +| `insecureScheme.enabled` | Flag to enable insecure schema | `false` | +| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from | `docker.io` | +| `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` | +| `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.2-alpine` | +| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | +| `jwtIssuer` | Path to JWT issuer | `https://oidc-discovery.example.org` | +| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | +| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` | +| `config.acme.tosAccepted` | Flag for Terms of Service acceptance | `false` | +| `config.acme.cacheDir` | Path for cache directory | `/run/spire` | +| `config.acme.directoryUrl` | URL for acme directory | `https://acme-v02.api.letsencrypt.org/directory` | +| `config.acme.emailAddress` | Email address for registration | `letsencrypt@example.org` | +| `imagePullSecrets` | Image pull secret names | `[]` | +| `nameOverride` | Name override | `""` | +| `fullnameOverride` | Full name override | `""` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | +| `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | +| `autoscaling.enabled` | Flag to enable autoscaling | `false` | +| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` | +| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` | +| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` | +| `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` | +| `nodeSelector` | Node selector | `{}` | +| `tolerations` | iist of tolerations | `[]` | +| `affinity` | Node affinity | `{}` | +| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | +| `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` | +| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | +| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | +| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | +| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the helm release | `""` | +| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | +| `telemetry.prometheus.nginxExporter.image.registry` | The OCI registry to pull the image from | `docker.io` | +| `telemetry.prometheus.nginxExporter.image.repository` | The repository within the registry | `nginx/nginx-prometheus-exporter` | +| `telemetry.prometheus.nginxExporter.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `telemetry.prometheus.nginxExporter.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `telemetry.prometheus.nginxExporter.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.11.0` | +| `telemetry.prometheus.nginxExporter.resources` | Resource requests and limits | `{}` | +| `ingress.enabled` | Flag to enable ingress | `false` | +| `ingress.className` | Ingress class name | `""` | +| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | +| `ingress.annotations` | Annotations for ingress object | `{}` | +| `ingress.hosts` | Host paths for ingress object | `[]` | +| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` | +| `tests.hostAliases` | List of host aliases for testing | `[]` | +| `tests.tls.enabled` | Flag for enabling tls for tests | `false` | +| `tests.tls.customCA` | Custom CA value for tests | `""` | +| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | +| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2` | +| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | +| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:6881d2c00c5178d98b97ae5c73d2b22b8d751f6c73f97a85ab0436c9a82602cd` | +| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` | +| `tests.busybox.image.repository` | The repository within the registry | `busybox` | +| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.busybox.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` | +| `tests.agent.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `tests.agent.image.repository` | The repository within the registry | `spiffe/spire-agent` | +| `tests.agent.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.agent.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.agent.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | +| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | +| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | + diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml index f71db7d..aad0f5d 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml @@ -1,5 +1,11 @@ {{- if .Values.ingress.enabled -}} +{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }} {{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . }} +{{- $annotations := deepCopy .Values.ingress.annotations }} +{{- if eq $ingressControllerType "ingress-nginx" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }} +{{- end }} apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -7,7 +13,7 @@ metadata: namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }} labels: {{ include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} - {{- with .Values.ingress.annotations }} + {{- with $annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index d899eae..c94fe2a 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -241,6 +241,8 @@ ingress: enabled: false ## @param ingress.className Ingress class name className: "" + ## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. + controllerType: "" ## @param ingress.annotations [object] Annotations for ingress object annotations: {} # kubernetes.io/ingress.class: nginx diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 2c0f5f2..f4a7829 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -150,6 +150,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` | | `federation.ingress.enabled` | Flag to enable ingress for federation | `false` | | `federation.ingress.className` | Ingress class name for federation | `""` | +| `federation.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | | `federation.ingress.annotations` | Annotations for the ingress object | `{}` | | `federation.ingress.hosts` | Host paths for ingress object | `[]` | | `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` | @@ -244,6 +245,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | | `ingress.enabled` | Flag to enable ingress | `false` | | `ingress.className` | Ingress class name | `""` | +| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | | `ingress.annotations` | Annotations for the ingress object | `{}` | | `ingress.hosts` | Host paths for ingress object | `[]` | | `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` | @@ -269,6 +271,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tornjak.service.annotations` | Annotations for the service | `{}` | | `tornjak.ingress.enabled` | Flag to enable ingress for Tornjak backend service | `false` | | `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` | +| `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | | `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` | | `tornjak.ingress.hosts` | Host paths for ingress Tornjak backend service | `[]` | | `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress | `[]` | diff --git a/charts/spire/charts/spire-server/templates/federation-ingress.yaml b/charts/spire/charts/spire-server/templates/federation-ingress.yaml index e7d0fea..b4735e1 100644 --- a/charts/spire/charts/spire-server/templates/federation-ingress.yaml +++ b/charts/spire/charts/spire-server/templates/federation-ingress.yaml @@ -1,6 +1,13 @@ {{- if .Values.federation.enabled }} {{- if .Values.federation.ingress.enabled -}} +{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.federation.ingress) }} {{- $svcName := include "spire-server.fullname" . }} +{{- $annotations := deepCopy .Values.federation.ingress.annotations }} +{{- if eq $ingressControllerType "ingress-nginx" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }} +{{- end }} apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -8,7 +15,7 @@ metadata: namespace: {{ include "spire-server.namespace" . }} labels: {{ include "spire-server.labels" . | nindent 4 }} - {{- with .Values.federation.ingress.annotations }} + {{- with $annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/ingress.yaml b/charts/spire/charts/spire-server/templates/ingress.yaml index 56da8c8..15346d5 100644 --- a/charts/spire/charts/spire-server/templates/ingress.yaml +++ b/charts/spire/charts/spire-server/templates/ingress.yaml @@ -1,5 +1,13 @@ {{- if .Values.ingress.enabled -}} +{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }} {{- $fullName := include "spire-server.fullname" . -}} +{{- $annotations := deepCopy .Values.ingress.annotations }} +{{- if eq $ingressControllerType "ingress-nginx" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }} +{{- end }} apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -7,7 +15,7 @@ metadata: namespace: {{ include "spire-server.namespace" . }} labels: {{ include "spire-server.labels" . | nindent 4}} - {{- with .Values.ingress.annotations }} + {{- with $annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml b/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml index ac0dfb5..856a89d 100644 --- a/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml +++ b/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml @@ -1,5 +1,15 @@ {{- if .Values.tornjak.ingress.enabled -}} +{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.tornjak.ingress) }} {{- $fullName := include "spire-tornjak.fullname" . -}} +{{- $annotations := deepCopy .Values.ingress.annotations }} +{{- if eq $ingressControllerType "ingress-nginx" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }} +{{- if ne (include "spire-tornjak.connectionType" .) "http" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }} +{{- end }} +{{- end }} apiVersion: networking.k8s.io/v1 kind: Ingress metadata: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index cf0b77f..5266c84 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -202,6 +202,8 @@ federation: enabled: false ## @param federation.ingress.className Ingress class name for federation className: "" + ## @param federation.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. + controllerType: "" ## @param federation.ingress.annotations [object] Annotations for the ingress object annotations: {} # kubernetes.io/ingress.class: nginx @@ -487,6 +489,8 @@ ingress: enabled: false ## @param ingress.className Ingress class name className: "" + ## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. + controllerType: "" ## @param ingress.annotations [object] Annotations for the ingress object annotations: {} # kubernetes.io/ingress.class: nginx @@ -564,11 +568,13 @@ tornjak: ## @param tornjak.ingress.enabled Flag to enable ingress for Tornjak backend service ## @param tornjak.ingress.className Ingress class name for Tornjak backend service + ## @param tornjak.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. ## @param tornjak.ingress.annotations [object] Annotations for Tornjak backend service ## @param tornjak.ingress.hosts [array] Host paths for ingress Tornjak backend service ingress: enabled: false className: "" + controllerType: "" annotations: {} hosts: - host: tornjak-backend.example.org diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 1969cc4..e7d8fb6 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -56,45 +56,46 @@ port forwarding. See the chart NOTES output for more details. ### Chart parameters -| Name | Description | Value | -| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | -| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` | -| `image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `imagePullSecrets` | Pull secrets for images | `[]` | -| `nameOverride` | Name override | `""` | -| `namespaceOverride` | Namespace override | `""` | -| `fullnameOverride` | Fullname override | `""` | -| `serviceAccount.create` | Specifies whether a service account should be created | `true` | -| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | -| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | -| `labels` | Labels for tornjak frontend pods | `{}` | -| `podSecurityContext` | Pod security context | `{}` | -| `securityContext` | Security context | `{}` | -| `service.type` | Service type | `ClusterIP` | -| `service.port` | Service port | `3000` | -| `service.annotations` | Annotations for service resource | `{}` | -| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | | -| `affinity` | Affinity rules | `{}` | -| `tolerations` | List of tolerations | `[]` | -| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` | -| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. | `http://localhost:10000/` | -| `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` | -| `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` | -| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | -| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | -| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | -| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` | -| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` | -| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` | -| `ingress.className` | Ingress class name for Tornjak frontend service | `""` | -| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` | -| `ingress.hosts` | Host paths for ingress Tornjak frontend service | `[]` | -| `ingress.tls` | Secrets containing TLS certs to enable https on ingress | `[]` | -| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | -| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2` | +| Name | Description | Value | +| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `imagePullSecrets` | Pull secrets for images | `[]` | +| `nameOverride` | Name override | `""` | +| `namespaceOverride` | Namespace override | `""` | +| `fullnameOverride` | Fullname override | `""` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | +| `labels` | Labels for tornjak frontend pods | `{}` | +| `podSecurityContext` | Pod security context | `{}` | +| `securityContext` | Security context | `{}` | +| `service.type` | Service type | `ClusterIP` | +| `service.port` | Service port | `3000` | +| `service.annotations` | Annotations for service resource | `{}` | +| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | | +| `affinity` | Affinity rules | `{}` | +| `tolerations` | List of tolerations | `[]` | +| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` | +| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. | `http://localhost:10000/` | +| `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` | +| `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` | +| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | +| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` | +| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` | +| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` | +| `ingress.className` | Ingress class name for Tornjak frontend service | `""` | +| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | +| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` | +| `ingress.hosts` | Host paths for ingress Tornjak frontend service | `[]` | +| `ingress.tls` | Secrets containing TLS certs to enable https on ingress | `[]` | +| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | +| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2` | diff --git a/charts/spire/charts/tornjak-frontend/templates/ingress.yaml b/charts/spire/charts/tornjak-frontend/templates/ingress.yaml index 1d14de2..6a9a3af 100644 --- a/charts/spire/charts/tornjak-frontend/templates/ingress.yaml +++ b/charts/spire/charts/tornjak-frontend/templates/ingress.yaml @@ -1,5 +1,11 @@ {{- if .Values.ingress.enabled -}} +{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }} {{- $fullName := include "tornjak-frontend.fullname" . -}} +{{- $annotations := deepCopy .Values.ingress.annotations }} +{{- if eq $ingressControllerType "ingress-nginx" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }} +{{- end }} apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -7,7 +13,7 @@ metadata: namespace: {{ include "tornjak-frontend.namespace" . }} labels: {{ include "tornjak-frontend.labels" . | nindent 4}} - {{- with .Values.ingress.annotations }} + {{- with $annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 27d81b2..ba9f2b1 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -115,11 +115,13 @@ startupProbe: ## @param ingress.enabled Flag to enable ingress for Tornjak frontend service ## @param ingress.className Ingress class name for Tornjak frontend service +## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. ## @param ingress.annotations [object] Annotations for Tornjak frontend service ## @param ingress.hosts [array] Host paths for ingress Tornjak frontend service ingress: enabled: false className: "" + controllerType: "" annotations: {} hosts: - host: tornjak-frontend.example.org diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/templates/_spire-lib.tpl index 12e854d..05ed708 100644 --- a/charts/spire/templates/_spire-lib.tpl +++ b/charts/spire/templates/_spire-lib.tpl @@ -61,6 +61,25 @@ {{- end }} {{- end }} +{{/* Takes in a dictionary with keys: + * global - the standard global object + * ingress - a standard format ingress config object +*/}} +{{- define "spire-lib.ingress-controller-type" }} +{{- $type := "" }} +{{- if ne (len (dig "spire" "ingressControllerType" "" .global)) 0 }} +{{- $type = .global.spire.ingressControllerType }} +{{- else if ne .ingress.controllerType "" }} +{{- $type = .ingress.controllerType }} +{{- else }} +{{- $type = "other" }} +{{- end }} +{{- if not (has $type (list "other" "ingress-nginx")) }} +{{- fail "Unsupported ingress controller type specified. Must be one of [other, ingress-nginx]" }} +{{- end }} +{{- $type }} +{{- end }} + {{/* Takes in a dictionary with keys: * ingress - the standardized ingress object * svcName - The service to route to diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index bcb9c45..af56f82 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -27,6 +27,9 @@ global: ## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production. strictMode: false + ## @param global.spire.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. + ingressControllerType: "" + installAndUpgradeHooks: ## @param global.installAndUpgradeHooks.enabled Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) enabled: true diff --git a/examples/production/run-tests.sh b/examples/production/run-tests.sh index 8fed83a..185e93d 100755 --- a/examples/production/run-tests.sh +++ b/examples/production/run-tests.sh @@ -2,7 +2,7 @@ set -xe -UPGRADE_VERSION=v0.13.0 +UPGRADE_VERSION=v0.14.0 UPGRADE_REPO=https://spiffe.github.io/helm-charts-hardened SCRIPT="$(readlink -f "$0")" @@ -48,30 +48,42 @@ teardown() { trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT -kubectl create namespace spire-system 2>/dev/null || true -kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true -kubectl create namespace "${ns}" 2>/dev/null || true -kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true +if [[ -n "$UPGRADE_ARGS" ]]; then + pushd "${SCRIPTPATH}" + git clone https://github.com/spiffe/helm-charts-hardened "${UPGRADE_VERSION}" + pushd "${UPGRADE_VERSION}" + git checkout "${UPGRADE_VERSION/v/spire-}" + helm install --create-namespace -n spire-system spire-crds charts/spire-crds + ./examples/production/run-tests.sh -c + popd + popd + # Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.) +else -"${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \ - --namespace cert-manager \ - --create-namespace \ - --set installCRDs=true \ - --wait + kubectl create namespace spire-system 2>/dev/null || true + kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true + kubectl create namespace "${ns}" 2>/dev/null || true + kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true -kubectl apply -f "${DEPS}/testcert.yaml" -n spire-server + "${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \ + --namespace cert-manager \ + --create-namespace \ + --set installCRDs=true \ + --wait -"${helm_install[@]}" ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \ - --namespace ingress-nginx \ - --create-namespace \ - --set controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP \ - --set controller.ingressClassResource.default=true \ - --wait + kubectl apply -f "${DEPS}/testcert.yaml" -n spire-server -ip=$(kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ .spec.clusterIP }}') -echo "$ip" oidc-discovery.production.other + "${helm_install[@]}" ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \ + --namespace ingress-nginx \ + --create-namespace \ + --set controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP \ + --set controller.ingressClassResource.default=true \ + --wait -cat > /tmp/dummydns < /tmp/dummydns < Date: Wed, 25 Oct 2023 10:54:16 +0200 Subject: [PATCH 06/36] Update helm-charts repository URL (#58) --- README.md | 2 +- ct.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 19c83cf..5e81039 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ A suite of [Helm Charts](https://helm.sh/docs) for standardized installations of ## Add Helm repository ```bash -helm repo add spiffe https://spiffe.github.io/helm-charts/ +helm repo add spiffe https://spiffe.github.io/helm-charts-hardened/ helm repo update ``` diff --git a/ct.yaml b/ct.yaml index affa496..d796424 100644 --- a/ct.yaml +++ b/ct.yaml @@ -3,7 +3,7 @@ target-branch: main chart-dirs: - charts chart-repos: - - spiffe=https://spiffe.github.io/helm-charts/ + - spiffe=https://spiffe.github.io/helm-charts-hardened/ - bitnami=https://charts.bitnami.com/bitnami - ingress-nginx=https://kubernetes.github.io/ingress-nginx exclude-deprecated: true From fb64f8d2d09e35a619167d8db92c34582c700377 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 26 Oct 2023 03:29:07 +0000 Subject: [PATCH 07/36] Bump github.com/onsi/gomega from 1.28.1 to 1.29.0 in /tests (#61) --- tests/go.mod | 2 +- tests/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/go.mod b/tests/go.mod index 792dc2d..e737d82 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -4,7 +4,7 @@ go 1.20 require ( github.com/onsi/ginkgo/v2 v2.13.0 - github.com/onsi/gomega v1.28.1 + github.com/onsi/gomega v1.29.0 helm.sh/helm/v3 v3.13.1 ) diff --git a/tests/go.sum b/tests/go.sum index c2ed9c8..c99db9c 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -87,8 +87,8 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4= github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o= -github.com/onsi/gomega v1.28.1 h1:MijcGUbfYuznzK/5R4CPNoUP/9Xvuo20sXfEm6XxoTA= -github.com/onsi/gomega v1.28.1/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ= +github.com/onsi/gomega v1.29.0 h1:KIA/t2t5UBzoirT4H9tsML45GEbo3ouUnBHsCfD2tVg= +github.com/onsi/gomega v1.29.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= From 9bd7f43056cb6f3d9adaa11accb94a1782e88d1d Mon Sep 17 00:00:00 2001 From: Andrew Block Date: Wed, 25 Oct 2023 12:26:22 -0500 Subject: [PATCH 08/36] Added environment variable to spire-agent to inject node name Signed-off-by: Andrew Block --- charts/spire/README.md | 2 +- charts/spire/charts/spire-agent/README.md | 1 + charts/spire/charts/spire-agent/templates/daemonset.yaml | 4 ++++ charts/spire/charts/spire-agent/values.yaml | 3 +++ 4 files changed, 9 insertions(+), 1 deletion(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index e54be82..51bb60e 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.14.0](https://img.shields.io/badge/Version-0.13.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) +![Version: 0.14.0](https://img.shields.io/badge/Version-0.14.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index d200d9b..aa3aca8 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -92,6 +92,7 @@ A Helm chart to install the SPIRE agent. | `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | | `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | | `priorityClassName` | Priority class assigned to daemonset pods | `""` | +| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | | `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` | | `extraContainers` | Additional containers to create with Spire Agent pods | `[]` | diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index c463212..57c3a31 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -71,6 +71,10 @@ spec: image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: ["-config", "/run/spire/config/agent.conf"] + {{- if gt (len .Values.extraEnvVars) 0 }} + env: + {{- toYaml .Values.extraEnvVars | nindent 12 }} + {{- end }} ports: - containerPort: {{ .Values.healthChecks.port }} name: healthz diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 0897979..f2ada59 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -204,6 +204,9 @@ socketPath: /run/spire/agent-sockets/spire-agent.sock ## @param priorityClassName Priority class assigned to daemonset pods priorityClassName: "" +## @param extraEnvVars [array] Extra environment variables to be added to the Spire Agent container +extraEnvVars: [] + ## @param extraVolumes [array] Extra volumes to be mounted on Spire Agent pods extraVolumes: [] From 02d445c87bd52f1dc8264a135157e1b779bca869 Mon Sep 17 00:00:00 2001 From: Mariusz Sabath Date: Thu, 26 Oct 2023 16:08:15 -0400 Subject: [PATCH 09/36] Update charts/spire/README.md Co-authored-by: kfox1111 Signed-off-by: Mariusz Sabath --- charts/spire/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 51bb60e..e54be82 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.14.0](https://img.shields.io/badge/Version-0.14.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) +![Version: 0.14.0](https://img.shields.io/badge/Version-0.13.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. From b813807f165adcc7aca05df0cf227d11db96b494 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 26 Oct 2023 15:13:54 -0700 Subject: [PATCH 10/36] Update docs to simplify, clarify, and prioritize ease of install/upgrade (#62) * Update docs to simplify, clarify, and prioritize ease of install/upgrade Signed-off-by: Kevin Fox * Apply suggestions from code review Co-authored-by: Marco Franssen Signed-off-by: kfox1111 * Incorperate feedback Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Marco Franssen --- README.md | 25 ++++--------- charts/spire/README.md | 80 ++++++++++++++++++++++++------------------ 2 files changed, 52 insertions(+), 53 deletions(-) diff --git a/README.md b/README.md index 5e81039..48077bd 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,7 @@ -> **Note**: All the helm charts in this repo are beta. We encourage you to try them out and contribute. The API may change as we move towards a production ready release. +> [!Note] +> Things to consider: +> 1. We do not support running out of the git main branch. This is where development happens. Please use released versions via the published repo or git tags. +> 2. All the helm charts in this repo are beta. We encourage you to try them out and contribute. The API may change as we move towards a production ready release. # SPIFFE Helm Charts @@ -8,24 +11,10 @@ A suite of [Helm Charts](https://helm.sh/docs) for standardized installations of SPIRE components in Kubernetes environments. -## Add Helm repository +## How to install or upgrade -```bash -helm repo add spiffe https://spiffe.github.io/helm-charts-hardened/ -helm repo update -``` - -## Dependencies and Version Compatibility - -Unless otherwise noted in an application chart README, the following dependencies will follow these prescribed version compatibility rules. - -| Dependency | Supported Versions | -|:-----------|:-------------------| -| SPIRE | `1.8.2` | -| Helm | `3.x` | -| Kubernetes | `1.22+` | - -> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. *The first version we tested this chart with is `1.22`.* +You most likely want to do an integrated setup based on the spire chart. +[Instructions](https://artifacthub.io/packages/helm/spiffe/spire) ## Contributing diff --git a/charts/spire/README.md b/charts/spire/README.md index e54be82..80d54f7 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -7,6 +7,51 @@ A Helm chart for deploying the complete Spire stack including: spire-server, spi **Homepage:** +## Install notes + +To do a quick non production install suitable for quick testing in something like minikube: + +```shell +helm install -n spire-server spire-crds --repo https://spiffe.github.io/helm-charts-hardened/ --create-namespace +helm install -n spire-server spire --repo https://spiffe.github.io/helm-charts-hardened/ +``` + +To customize, start with a base values file and edit as needed: + +```shell +curl -o your-values.yaml https://raw.githubusercontent.com/spiffe/helm-charts-hardened/main/examples/production/example-your-values.yaml +``` + +Then: + +```shell +helm install -n spire-server spire --repo https://spiffe.github.io/helm-charts-hardened/ -f your-values.yaml +``` + +For production installs, please see [the production example](https://github.com/spiffe/helm-charts-hardened/tree/main/examples/production). + +## Upgrade notes + +### 0.14.X + +If coming from a chart version before 0.14.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart +run the following: + +Replace the spire-server namespace in the commands below with the namespace you want to install the spire-crds chart in. + +```shell +kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" +kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" +kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" +kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" +kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" +kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" +kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" +kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" +kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" +helm install -n spire-server spire-crds charts/spire-crds +``` + ## Version support > **Note**: This Chart is still in development and still subject to change the API (`values.yaml`). @@ -15,7 +60,6 @@ A Helm chart for deploying the complete Spire stack including: spire-server, spi | Dependency | Supported Versions | |:-----------|:-------------------| -| SPIRE | `1.5.3+`, `1.6.3+` | | Helm | `3.x` | | Kubernetes | `1.22+` | @@ -83,40 +127,6 @@ Now you can interact with the Spire agent socket from your own application. The | file://./charts/spire-server | spire-server | 0.1.0 | | file://./charts/tornjak-frontend | tornjak-frontend | 0.1.0 | -## Install notes - -To do a quick non production install: - -```shell -kubectl create namespace spire-system -helm install -n spire-system spire-crds charts/spire-crds -helm install -n spire-system spire charts/spire -``` - -For production installs, please see [the production example](examples/production/). - -## Upgrade notes - -0.14.X: - -If coming from a chart version before 0.14.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart -run the following: - -```shell -# Replace the spire-server namespace in the commands below with the namespace you want to install the spire-crds chart in. - -kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" -kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" -kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" -kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" -kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" -kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" -kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" -kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" -kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" -helm install -n spire-server spire-crds charts/spire-crds -``` - ## Parameters From d50d78d9a063fed6dba964cbd8d7b0bfed15566f Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Sat, 28 Oct 2023 11:47:55 -0700 Subject: [PATCH 11/36] Fix ingress annotation variable for tornjak server (#66) --- charts/spire/charts/spire-server/templates/tornjak-ingress.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml b/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml index 856a89d..435e9b7 100644 --- a/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml +++ b/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml @@ -17,7 +17,7 @@ metadata: namespace: {{ include "spire-server.namespace" . }} labels: {{ include "spire-server.labels" . | nindent 4}} - {{- with .Values.tornjak.ingress.annotations }} + {{- with $annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} From 09ebfc9ee3a8aaed82d22e7bcf74dedaf72705b3 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 30 Oct 2023 09:30:10 -0700 Subject: [PATCH 12/36] Bump test chart dependencies (#68) Signed-off-by: GitHub Co-authored-by: marcofranssen --- .github/tests/charts.json | 6 +++--- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- charts/spire/charts/spire-agent/README.md | 4 ++-- charts/spire/charts/spire-agent/values.yaml | 4 ++-- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 9 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 91180db..5e485bd 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "51.10.0" + "version": "52.1.0" }, { "name": "cert-manager", @@ -12,12 +12,12 @@ { "name": "ingress-nginx", "repo": "https://kubernetes.github.io/ingress-nginx", - "version": "4.8.2" + "version": "4.8.3" }, { "name": "mysql", "repo": "https://charts.bitnami.com/bitnami", - "version": "9.12.5" + "version": "9.14.1" }, { "name": "postgresql", diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index ba182f8..fb76684 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -107,12 +107,12 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:6881d2c00c5178d98b97ae5c73d2b22b8d751f6c73f97a85ab0436c9a82602cd` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c3bb333d1d8a0e6262aa6e0b1e01e2833822ab0a9812d2668a23869888ebf0be` | | `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` | | `tests.busybox.image.repository` | The repository within the registry | `busybox` | | `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index c94fe2a..8cc1007 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -282,7 +282,7 @@ tests: repository: chainguard/bash pullPolicy: IfNotPresent version: "" - tag: latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2 + tag: latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -296,7 +296,7 @@ tests: repository: chainguard/slim-toolkit-debug pullPolicy: IfNotPresent version: "" - tag: latest@sha256:6881d2c00c5178d98b97ae5c73d2b22b8d751f6c73f97a85ab0436c9a82602cd + tag: latest@sha256:c3bb333d1d8a0e6262aa6e0b1e01e2833822ab0a9812d2668a23869888ebf0be busybox: ## @param tests.busybox.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index aa3aca8..82e150e 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -68,13 +68,13 @@ A Helm chart to install the SPIRE agent. | `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` | | `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `waitForIt.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5b836d1a4c652ec1c56bdd4a05a43349e2eeff50cf7fdb45a356f0ddc578573b` | +| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b76360b5316b33f89c3edc15967cfedf323c21766a8ce29750bff2b38178455f` | | `waitForIt.resources` | Resource requests and limits | `{}` | | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | | `fsGroupFix.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index f2ada59..de857f9 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -134,7 +134,7 @@ waitForIt: repository: chainguard/wait-for-it pullPolicy: IfNotPresent version: "" - tag: latest@sha256:5b836d1a4c652ec1c56bdd4a05a43349e2eeff50cf7fdb45a356f0ddc578573b + tag: latest@sha256:b76360b5316b33f89c3edc15967cfedf323c21766a8ce29750bff2b38178455f ## @param waitForIt.resources [object] Resource requests and limits resources: {} @@ -153,7 +153,7 @@ fsGroupFix: repository: chainguard/bash pullPolicy: Always version: "" - tag: latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2 + tag: latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index f4a7829..e27e8a3 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -301,4 +301,4 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 5266c84..844c52c 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -684,4 +684,4 @@ tests: repository: chainguard/bash pullPolicy: IfNotPresent version: "" - tag: latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2 + tag: latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index e7d8fb6..5c6272b 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -98,4 +98,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index ba9f2b1..7b259eb 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -147,4 +147,4 @@ tests: repository: chainguard/bash pullPolicy: IfNotPresent version: "" - tag: latest@sha256:985a0c0ab82bd243bab1827fb48f8e11c8ec331391aad95d1a2f42b3810c1ec2 + tag: latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c From b354413f62ccfd63488df05987514e493cfb1bf9 Mon Sep 17 00:00:00 2001 From: Inverse Integral Date: Mon, 30 Oct 2023 18:32:48 +0100 Subject: [PATCH 13/36] Fix incorrect nesting of priorityClassName (#67) Signed-off-by: Inverse Integral Signed-off-by: kfox1111 Co-authored-by: kfox1111 --- charts/spire/charts/spire-server/templates/statefulset.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index aef398c..ca26abb 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -48,10 +48,10 @@ spec: shareProcessNamespace: true securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} - {{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }} {{- if .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }} {{- end }} + {{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }} initContainers: {{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }} - name: wait From ed23d8b71440bebbef528e4a9f85e0cded9c3981 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Mon, 30 Oct 2023 15:16:17 -0700 Subject: [PATCH 14/36] Simple ingress support (#48) Co-authored-by: Faisal Memon --- .../spiffe-oidc-discovery-provider/README.md | 7 +- .../templates/ingress.yaml | 2 +- .../templates/tests/test-connection.yaml | 12 ++-- .../values.yaml | 21 ++++-- charts/spire/charts/spire-server/README.md | 18 ++++-- .../spire-server/templates/_helpers.tpl | 5 +- .../templates/federation-ingress.yaml | 2 +- .../spire-server/templates/ingress.yaml | 2 +- .../templates/tornjak-ingress.yaml | 4 +- charts/spire/charts/spire-server/values.yaml | 64 +++++++++++++------ .../spire/charts/tornjak-frontend/README.md | 6 +- .../tornjak-frontend/templates/ingress.yaml | 2 +- .../spire/charts/tornjak-frontend/values.yaml | 22 +++++-- charts/spire/templates/_spire-lib.tpl | 34 ++++++++++ examples/production/example-your-values.yaml | 41 +++--------- examples/production/run-tests.sh | 1 + ...federation-https-spiffe-ingress-nginx.yaml | 9 --- ...rt-federation-https-web-ingress-nginx.yaml | 10 +-- ...oidc-discovery-provider-ingress-nginx.yaml | 13 +--- ...ues-export-spire-server-ingress-nginx.yaml | 11 ---- 20 files changed, 158 insertions(+), 128 deletions(-) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index fb76684..796597e 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -98,8 +98,10 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `ingress.className` | Ingress class name | `""` | | `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | | `ingress.annotations` | Annotations for ingress object | `{}` | -| `ingress.hosts` | Host paths for ingress object | `[]` | -| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` | +| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `oidc-discovery` | +| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `tests.hostAliases` | List of host aliases for testing | `[]` | | `tests.tls.enabled` | Flag for enabling tls for tests | `false` | | `tests.tls.customCA` | Custom CA value for tests | `""` | @@ -128,4 +130,3 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | - diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml index aad0f5d..9cbd7c2 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml @@ -18,5 +18,5 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "Values" .Values) | nindent 2 }} {{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml index af9063e..73a8b35 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml @@ -1,4 +1,8 @@ -{{ $values := merge .Values }} +{{- $values := merge .Values }} +{{- $host := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.ingress) }} +{{- if gt (len .Values.ingress.hosts) 0 }} +{{- $host = (index .Values.ingress.hosts 0).host }} +{{- end }} apiVersion: v1 kind: Pod metadata: @@ -36,9 +40,9 @@ spec: command: ['curl'] {{- if dig "tests" "tls" "enabled" false $values }} {{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }} - args: ['-s', '-f', '--cacert', '/ca/ca.crt', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration'] + args: ['-s', '-f', '--cacert', '/ca/ca.crt', 'https://{{ $host }}/.well-known/openid-configuration'] {{- else }} - args: ['-s', '-f', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration'] + args: ['-s', '-f', 'https://{{ $host }}/.well-known/openid-configuration'] {{- end }} {{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }} volumeMounts: @@ -46,7 +50,7 @@ spec: mountPath: /ca {{- end }} {{- else }} - args: ['-s', '-f', 'http://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration'] + args: ['-s', '-f', 'http://{{ $host }}/.well-known/openid-configuration'] {{- end }} securityContext: {{- toYaml .Values.securityContext | nindent 8 }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 8cc1007..8b11f46 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -250,13 +250,20 @@ ingress: # nginx.ingress.kubernetes.io/ssl-redirect: "true" # nginx.ingress.kubernetes.io/force-ssl-redirect: "true" - ## @param ingress.hosts [array] Host paths for ingress object - hosts: - - host: oidc-discovery.example.org - paths: - - path: / - pathType: Prefix - ## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress + ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. + host: "oidc-discovery" + + ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. + tlsSecret: "" + + ## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. + hosts: [] + # - host: oidc-discovery.example.org + # paths: + # - path: / + # pathType: Prefix + + ## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. tls: [] # - secretName: chart-example-tls # hosts: diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index e27e8a3..bd2ff79 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -152,8 +152,10 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `federation.ingress.className` | Ingress class name for federation | `""` | | `federation.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | | `federation.ingress.annotations` | Annotations for the ingress object | `{}` | -| `federation.ingress.hosts` | Host paths for ingress object | `[]` | -| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` | +| `federation.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server-federation` | +| `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `federation.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `ca_subject.country` | Country for Spire server CA | `ARPA` | | `ca_subject.organization` | Organization for Spire server CA | `Example` | | `ca_subject.common_name` | Common Name for Spire server CA | `example.org` | @@ -247,8 +249,10 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `ingress.className` | Ingress class name | `""` | | `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | | `ingress.annotations` | Annotations for the ingress object | `{}` | -| `ingress.hosts` | Host paths for ingress object | `[]` | -| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` | +| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server` | +| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `extraVolumes` | Extra volumes to be mounted | `[]` | | `extraVolumeMounts` | Extra volume mounts | `[]` | | `extraContainers` | Additional containers to create | `[]` | @@ -273,8 +277,10 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` | | `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | | `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` | -| `tornjak.ingress.hosts` | Host paths for ingress Tornjak backend service | `[]` | -| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress | `[]` | +| `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` | +| `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `tornjak.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` | | `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` | | `tornjak.startupProbe.periodSeconds` | Period seconds | `10` | diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index d4d503e..0f0521b 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -205,7 +205,10 @@ The code below determines what connection type should be used. {{- define "spire-server.test.federation-ingress-args" }} {{- $args := list }} -{{- $host := index (index (index .Values.federation.ingress.tls 0) "hosts") 0 }} +{{- $host := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.federation.ingress) }} +{{- if gt (len .Values.federation.ingress.tls) 0 }} +{{- $host = index (index (index .Values.federation.ingress.tls 0) "hosts") 0 }} +{{- end }} {{- if dig "tests" "tls" "enabled" false .Values }} {{- if ne (len (dig "tests" "tls" "customCA" "" .Values)) 0 }} {{- $args = append $args "--cacert" }} diff --git a/charts/spire/charts/spire-server/templates/federation-ingress.yaml b/charts/spire/charts/spire-server/templates/federation-ingress.yaml index b4735e1..e09d096 100644 --- a/charts/spire/charts/spire-server/templates/federation-ingress.yaml +++ b/charts/spire/charts/spire-server/templates/federation-ingress.yaml @@ -20,6 +20,6 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "global" .Values.global) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "Values" .Values) | nindent 2 }} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/ingress.yaml b/charts/spire/charts/spire-server/templates/ingress.yaml index 15346d5..dbcdb39 100644 --- a/charts/spire/charts/spire-server/templates/ingress.yaml +++ b/charts/spire/charts/spire-server/templates/ingress.yaml @@ -20,5 +20,5 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "Values" .Values) | nindent 2 }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml b/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml index 435e9b7..8d10558 100644 --- a/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml +++ b/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml @@ -23,8 +23,8 @@ metadata: {{- end }} spec: {{- if eq (include "spire-tornjak.connectionType" .) "http" }} - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-http") | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-http" "Values" .Values) | nindent 2 }} {{- else -}} - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-https") | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-https" "Values" .Values) | nindent 2 }} {{- end -}} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 844c52c..3342e70 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -211,14 +211,21 @@ federation: # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" # If Profile Type == https_spiffe: # nginx.ingress.kubernetes.io/ssl-passthrough: "true" - ## @param federation.ingress.hosts [array] Host paths for ingress object - hosts: - - host: spire-server-federation.example.org - paths: - - path: / - pathType: Prefix - ## @param federation.ingress.tls [array] Secrets containining TLS certs to enable https on ingress + ## @param federation.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. + host: "spire-server-federation" + + ## @param federation.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. + tlsSecret: "" + + ## @param federation.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. + hosts: [] + # - host: spire-server-federation.example.org + # paths: + # - path: / + # pathType: Prefix + + ## @param federation.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. tls: [] # - hosts: # - spire-server-federation.example.org @@ -498,13 +505,20 @@ ingress: # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" # nginx.ingress.kubernetes.io/ssl-passthrough: "true" - ## @param ingress.hosts [array] Host paths for ingress object - hosts: - - host: spire-server.example.org - paths: - - path: / - pathType: Prefix - ## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress + ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. + host: "spire-server" + + ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. + tlsSecret: "" + + ## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. + hosts: [] + # - host: spire-server.example.org + # paths: + # - path: / + # pathType: Prefix + + ## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. tls: [] # - secretName: spire-server-tls # hosts: @@ -570,18 +584,26 @@ tornjak: ## @param tornjak.ingress.className Ingress class name for Tornjak backend service ## @param tornjak.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. ## @param tornjak.ingress.annotations [object] Annotations for Tornjak backend service - ## @param tornjak.ingress.hosts [array] Host paths for ingress Tornjak backend service ingress: enabled: false className: "" controllerType: "" annotations: {} - hosts: - - host: tornjak-backend.example.org - paths: - - path: / - pathType: Prefix - ## @param tornjak.ingress.tls [array] Secrets containing TLS certs to enable https on ingress + + ## @param tornjak.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. + host: "tornjak-backend" + + ## @param tornjak.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. + tlsSecret: "" + + ## @param tornjak.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. + hosts: [] + # - host: tornjak-backend.example.org + # paths: + # - path: / + # pathType: Prefix + + ## @param tornjak.ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. tls: [] # - secretName: chart-example-tls # hosts: diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 5c6272b..4c6710d 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -92,8 +92,10 @@ port forwarding. See the chart NOTES output for more details. | `ingress.className` | Ingress class name for Tornjak frontend service | `""` | | `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | | `ingress.annotations` | Annotations for Tornjak frontend service | `{}` | -| `ingress.hosts` | Host paths for ingress Tornjak frontend service | `[]` | -| `ingress.tls` | Secrets containing TLS certs to enable https on ingress | `[]` | +| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-frontend` | +| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/tornjak-frontend/templates/ingress.yaml b/charts/spire/charts/tornjak-frontend/templates/ingress.yaml index 6a9a3af..142c28e 100644 --- a/charts/spire/charts/tornjak-frontend/templates/ingress.yaml +++ b/charts/spire/charts/tornjak-frontend/templates/ingress.yaml @@ -18,5 +18,5 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "Values" .Values) | nindent 2 }} {{- end }} diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 7b259eb..2965f06 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -117,18 +117,26 @@ startupProbe: ## @param ingress.className Ingress class name for Tornjak frontend service ## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. ## @param ingress.annotations [object] Annotations for Tornjak frontend service -## @param ingress.hosts [array] Host paths for ingress Tornjak frontend service ingress: enabled: false className: "" controllerType: "" annotations: {} - hosts: - - host: tornjak-frontend.example.org - paths: - - path: / - pathType: Prefix - ## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress + + ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. + host: "tornjak-frontend" + + ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. + tlsSecret: "" + + ## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. + hosts: [] + # - host: tornjak-frontend.example.org + # paths: + # - path: / + # pathType: Prefix + + ## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. tls: [] # - secretName: chart-example-tls # hosts: diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/templates/_spire-lib.tpl index 05ed708..f703258 100644 --- a/charts/spire/templates/_spire-lib.tpl +++ b/charts/spire/templates/_spire-lib.tpl @@ -80,17 +80,50 @@ {{- $type }} {{- end }} +{{/* Takes in a dictionary with keys: + * ingress - the standardized ingress object + * Values - Chart values +*/}} +{{ define "spire-lib.ingress-calculated-name" }} +{{- $host := .ingress.host }} +{{- if not (contains $host ".") }} +{{- $host = printf "%s.%s" $host (include "spire-lib.trust-domain" .) }} +{{- end }} +{{- $host }} +{{- end }} + {{/* Takes in a dictionary with keys: * ingress - the standardized ingress object * svcName - The service to route to * port - which port on the service to use + * Values - Chart values */}} {{ define "spire-lib.ingress-spec" }} +{{- $host := include "spire-lib.ingress-calculated-name" . }} {{- $svcName := .svcName }} {{- $port := .port }} {{- with .ingress.className }} ingressClassName: {{ . | quote }} {{- end }} +{{- if eq (add (len .ingress.tls) (len .ingress.hosts)) 0 }} +tls: + - hosts: + - {{ $host | quote }} +{{- with .ingress.tlsSecret }} + secretName: {{ . | quote }} +{{- end }} +rules: + - host: {{ $host | quote }} + http: + paths: + - path: "/" + pathType: Prefix + backend: + service: + name: {{ $svcName | quote }} + port: + number: {{ $port }} +{{- else }} {{- if .ingress.tls }} tls: {{- range .ingress.tls }} @@ -117,6 +150,7 @@ rules: {{- end }} {{- end }} {{- end }} +{{- end }} {{- define "spire-lib.kubectl-image" }} {{- $root := deepCopy . }} diff --git a/examples/production/example-your-values.yaml b/examples/production/example-your-values.yaml index be5efa3..68b7b63 100644 --- a/examples/production/example-your-values.yaml +++ b/examples/production/example-your-values.yaml @@ -10,36 +10,15 @@ spire-server: organization: Production common_name: production.other - ingress: - hosts: - - host: spire-server.production.other - paths: - - path: / - pathType: Prefix - tls: - - hosts: - - spire-server.production.other - federation: - ingress: - hosts: - - host: spire-server-federation.production.other - paths: - - path: / - pathType: Prefix - tls: - - hosts: - - spire-server-federation.production.other - secretName: tls-cert +# ingress: +# host: spire-server +# federation: +# ingress: +# host: spire-server-federation +# tlsSecret: tls-cert -spiffe-oidc-discovery-provider: - ingress: - hosts: - - host: oidc-discovery.production.other - paths: - - path: / - pathType: Prefix - tls: - - secretName: tls-cert - hosts: - - oidc-discovery.production.other +# spiffe-oidc-discovery-provider: +# ingress: +# host: oidc-discovery +# tlsSecret: tls-cert diff --git a/examples/production/run-tests.sh b/examples/production/run-tests.sh index 185e93d..e48a127 100755 --- a/examples/production/run-tests.sh +++ b/examples/production/run-tests.sh @@ -117,6 +117,7 @@ install_and_test() { --values /tmp/dummydns \ --set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \ --set spire-agent.server.address=spire-server.production.other,spire-agent.server.port=443 \ + --set spire-server.federation.ingress.tlsSecret=tls-cert,spiffe-oidc-discovery-provider.ingress.tlsSecret=tls-cert \ --values "${SCRIPTPATH}/example-your-values.yaml" \ $2 \ --wait diff --git a/examples/production/values-export-federation-https-spiffe-ingress-nginx.yaml b/examples/production/values-export-federation-https-spiffe-ingress-nginx.yaml index c50044e..2a95d89 100644 --- a/examples/production/values-export-federation-https-spiffe-ingress-nginx.yaml +++ b/examples/production/values-export-federation-https-spiffe-ingress-nginx.yaml @@ -8,12 +8,3 @@ spire-server: nginx.ingress.kubernetes.io/ssl-passthrough: "true" # className: nginx - - hosts: - - host: spire-server-federation.example.org - paths: - - path: / - pathType: Prefix - tls: - - hosts: - - spire-server-federation.example.org diff --git a/examples/production/values-export-federation-https-web-ingress-nginx.yaml b/examples/production/values-export-federation-https-web-ingress-nginx.yaml index 49aeaf1..c2c3879 100644 --- a/examples/production/values-export-federation-https-web-ingress-nginx.yaml +++ b/examples/production/values-export-federation-https-web-ingress-nginx.yaml @@ -10,12 +10,4 @@ spire-server: # className: nginx - hosts: - - host: spire-server-federation.example.org - paths: - - path: / - pathType: Prefix - tls: - - hosts: - - spire-server-federation.example.org - secretName: spire-server-federation-tls + tlsSecret: spire-server-federation-tls diff --git a/examples/production/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml b/examples/production/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml index f292414..51e3887 100644 --- a/examples/production/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml +++ b/examples/production/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml @@ -8,14 +8,5 @@ spiffe-oidc-discovery-provider: # className: nginx - # You must override these in your own values file with the appropriate hostname - # and secret or it wont start. - hosts: - - host: oidc-discovery.example.org - paths: - - path: / - pathType: Prefix - tls: - - secretName: tls-cert - hosts: - - oidc-discovery.example.org + # You must override these in your own values file with the appropriate secret or it wont start. + tlsSecret: tls-cert diff --git a/examples/production/values-export-spire-server-ingress-nginx.yaml b/examples/production/values-export-spire-server-ingress-nginx.yaml index 3fb0b5d..b951f6e 100644 --- a/examples/production/values-export-spire-server-ingress-nginx.yaml +++ b/examples/production/values-export-spire-server-ingress-nginx.yaml @@ -4,14 +4,3 @@ spire-server: controllerType: ingress-nginx # className: nginx - - # You must override these in your own values file with the appropriate hostname - # and secret or it wont start. - hosts: - - host: spire-server.example.org - paths: - - path: / - pathType: Prefix - tls: - - hosts: - - spire-server.example.org From 3b016841daf3ca8914c457e702a2a287709a27fc Mon Sep 17 00:00:00 2001 From: Mariusz Sabath Date: Tue, 31 Oct 2023 12:27:23 -0400 Subject: [PATCH 15/36] Support Openshift deployment (#13) * Add support for SPIRE deployment on OpenShift 4.13 Signed-off-by: Mariusz Sabath Co-authored-by: Trilok Geer Co-authored-by: Andrew Block * Render README Signed-off-by: Mariusz Sabath * Fix tornjak HTTP/HTTPS port values Signed-off-by: Mariusz Sabath * Update Frontend README Signed-off-by: Mariusz Sabath * Add env. variable to Agent to inject node name Signed-off-by: Mariusz Sabath * Implement Marco's suggestion on CSI CSS version Signed-off-by: Mariusz Sabath * Add MY_NODE_NAME env. variable to agent for openshift example Signed-off-by: Mariusz Sabath * Move Openshift examples to dedicated directory Signed-off-by: Mariusz Sabath * Simplified the install instructions Signed-off-by: Mariusz Sabath * Suggested changes Signed-off-by: Kevin Fox * Apply suggestions from code review Co-authored-by: Andrew Block Signed-off-by: kfox1111 * Update docs, fix default for backwards compat Signed-off-by: Kevin Fox * Don't recommend experimental features by default, dont debug helm install by default and explain how to add additional features Signed-off-by: Kevin Fox * Add notes about openshift to the project for other reviewers. Signed-off-by: Kevin Fox * Fix incorrectly reverted change Signed-off-by: Kevin Fox * Correct notes Signed-off-by: Kevin Fox * Update default Signed-off-by: Kevin Fox * Fix issue created from bad merge conflict resolution Signed-off-by: kfox1111 * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 Signed-off-by: Mariusz Sabath * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 Signed-off-by: Mariusz Sabath * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 Signed-off-by: Mariusz Sabath * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 Signed-off-by: Mariusz Sabath --------- Signed-off-by: Mariusz Sabath Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Trilok Geer Co-authored-by: Andrew Block Co-authored-by: Kevin Fox --- .../spire/charts/spiffe-csi-driver/README.md | 73 +++++++++-------- .../templates/daemonset.yaml | 4 + .../templates/scc-restricted-csi.yaml | 61 ++++++++++++++ .../templates/scc-spiffe-csi-driver.yaml | 30 +++++++ .../templates/spiffe-csi-driver.yaml | 5 ++ .../charts/spiffe-csi-driver/values.yaml | 15 ++++ .../scc-spire-oidc-discovery-provider.yaml | 38 +++++++++ charts/spire/charts/spire-agent/README.md | 2 +- .../templates/scc-spire-agent.yaml | 31 +++++++ charts/spire/charts/spire-agent/values.yaml | 2 +- .../templates/tornjak-ingress.yaml | 4 +- .../spire/charts/tornjak-frontend/README.md | 1 + .../templates/deployment.yaml | 4 +- .../spire/charts/tornjak-frontend/values.yaml | 3 + examples/openshift/README.md | 76 +++++++++++++++++ examples/openshift/openshift-values.yaml | 82 +++++++++++++++++++ examples/production/example-your-values.yaml | 3 + project/openshift.md | 38 +++++++++ 18 files changed, 432 insertions(+), 40 deletions(-) create mode 100644 charts/spire/charts/spiffe-csi-driver/templates/scc-restricted-csi.yaml create mode 100644 charts/spire/charts/spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml create mode 100644 charts/spire/charts/spiffe-oidc-discovery-provider/templates/scc-spire-oidc-discovery-provider.yaml create mode 100644 charts/spire/charts/spire-agent/templates/scc-spire-agent.yaml create mode 100644 examples/openshift/README.md create mode 100644 examples/openshift/openshift-values.yaml create mode 100644 project/openshift.md diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index c3e96fe..1e1150d 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -28,37 +28,42 @@ A Helm chart to install the SPIFFE CSI driver. ### SPIFFE CSI Driver Chart parameters -| Name | Description | Value | -| ---------------------------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------- | -| `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` | -| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` | -| `image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `resources` | Resource requests and limits for spiffe-csi-driver | `{}` | -| `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` | -| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | -| `livenessProbe.timeoutSeconds` | Timeout value in seconds for livenessProbe | `5` | -| `imagePullSecrets` | Image pull secret details for spiffe-csi-driver | `[]` | -| `nameOverride` | Name override for spiffe-csi-driver | `""` | -| `namespaceOverride` | Namespace to install spiffe-csi-driver | `""` | -| `fullnameOverride` | Full name override for spiffe-csi-driver | `""` | -| `serviceAccount.create` | Specifies whether a service account should be created | `true` | -| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | -| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | -| `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` | -| `podSecurityContext` | Security context for CSI driver pods | `{}` | -| `securityContext.readOnlyRootFilesystem` | Flag for read only root filesystem | `true` | -| `securityContext.privileged` | Flag for specifying privileged mode | `true` | -| `nodeSelector` | Node selector for CSI driver pods | `{}` | -| `tolerations` | Tolerations for CSI driver pods | `[]` | -| `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | -| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` | -| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `nodeDriverRegistrar.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.0` | -| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` | -| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | -| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` | -| `priorityClassName` | Priority class assigned to daemonset pods | `""` | +| Name | Description | Value | +| ---------------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------------------------- | +| `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `resources` | Resource requests and limits for spiffe-csi-driver | `{}` | +| `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | +| `livenessProbe.timeoutSeconds` | Timeout value in seconds for livenessProbe | `5` | +| `imagePullSecrets` | Image pull secret details for spiffe-csi-driver | `[]` | +| `nameOverride` | Name override for spiffe-csi-driver | `""` | +| `namespaceOverride` | Namespace to install spiffe-csi-driver | `""` | +| `fullnameOverride` | Full name override for spiffe-csi-driver | `""` | +| `csiDriverLabels` | Labels to apply to the CSIDriver | `{}` | +| `initContainers` | Init Containers to apply to the CSI Driver DaemonSet | `[]` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | +| `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` | +| `podSecurityContext` | Security context for CSI driver pods | `{}` | +| `securityContext.readOnlyRootFilesystem` | Flag for read only root filesystem | `true` | +| `securityContext.privileged` | Flag for specifying privileged mode | `true` | +| `nodeSelector` | Node selector for CSI driver pods | `{}` | +| `tolerations` | Tolerations for CSI driver pods | `[]` | +| `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | +| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` | +| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `nodeDriverRegistrar.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.0` | +| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` | +| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | +| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` | +| `priorityClassName` | Priority class assigned to daemonset pods | `""` | +| `restrictedScc.enabled` | Enables the creation of a SecurityContextConstraint based on the restricted SCC with CSI volume support | `false` | +| `restrictedScc.name` | Set the name of the restricted SCC with CSI support | `""` | +| `restrictedScc.version` | Version of the restricted SCC | `2` | diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml index 2031f7f..7d5339e 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -36,6 +36,10 @@ spec: {{- if .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }} {{- end }} + {{- with .Values.initContainers }} + initContainers: + {{- toYaml . | nindent 8 }} + {{- end }} containers: # This is the container which runs the SPIFFE CSI driver. - name: {{ .Chart.Name }} diff --git a/charts/spire/charts/spiffe-csi-driver/templates/scc-restricted-csi.yaml b/charts/spire/charts/spiffe-csi-driver/templates/scc-restricted-csi.yaml new file mode 100644 index 0000000..5e94562 --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/scc-restricted-csi.yaml @@ -0,0 +1,61 @@ +{{- if and .Values.global.openshift .Values.restrictedScc.enabled }} +{{- $name := default (printf "restricted-%scsi" (eq (.Values.restrictedScc.version | toString) "2" | ternary "v2-" "")) .Values.restrictedScc.name -}} +{{- $v2Description := "This is the most restrictive SCC and it is used by default for authenticated users. On top of the legacy 'restricted' SCC, it also requires to drop ALL capabilities and does not allow privilege escalation binaries. It will also default the seccomp profile to runtime/default if unset, otherwise this seccomp profile is required." -}} +apiVersion: security.openshift.io/v1 +kind: SecurityContextConstraints +allowHostPorts: false +priority: null +requiredDropCapabilities: +{{- if eq (.Values.restrictedScc.version | toString) "2" }} + - ALL +{{- else }} + - KILL + - MKNOD + - SETUID + - SETGID +{{- end }} +allowPrivilegedContainer: false +runAsUser: + type: MustRunAsRange +users: [] +allowHostDirVolumePlugin: false +{{- if eq (.Values.restrictedScc.version | toString) "2" }} +seccompProfiles: + - runtime/default +{{- end }} +allowHostIPC: false +seLinuxContext: + type: MustRunAs +readOnlyRootFilesystem: false +metadata: + name: {{ $name }} + annotations: + kubernetes.io/description: >- + {{ $name }} denies access to all host features and requires pods to be + run with a UID, and SELinux context that are allocated to the namespace. + {{ eq (.Values.restrictedScc.version | toString) "2" | ternary $v2Description "" }} +fsGroup: + type: MustRunAs +groups: [] +defaultAddCapabilities: null +supplementalGroups: + type: RunAsAny +volumes: + - configMap + - csi + - downwardAPI + - emptyDir + - ephemeral + - persistentVolumeClaim + - projected + - secret +allowHostPID: false +allowHostNetwork: false +allowPrivilegeEscalation: {{ eq (.Values.restrictedScc.version | toString) "2" | ternary false true }} +{{- if eq (.Values.restrictedScc.version | toString) "2" }} +allowedCapabilities: + - NET_BIND_SERVICE +{{ else}} +allowedCapabilities: null +{{- end }} +{{- end }} diff --git a/charts/spire/charts/spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml b/charts/spire/charts/spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml new file mode 100644 index 0000000..73ef6fa --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml @@ -0,0 +1,30 @@ +{{- if eq (.Values.global.openshift | toString) "true" }} +apiVersion: security.openshift.io/v1 +kind: SecurityContextConstraints +metadata: + name: {{ include "spiffe-csi-driver.fullname" . }} +readOnlyRootFilesystem: true +runAsUser: + type: RunAsAny +seLinuxContext: + type: RunAsAny +supplementalGroups: + type: RunAsAny +users: + - system:serviceaccount:{{ include "spiffe-csi-driver.namespace" . }}:{{ include "spiffe-csi-driver.serviceAccountName" . }} +volumes: + - configmap + - hostPath + - secret +allowHostDirVolumePlugin: true +allowHostIPC: false +allowHostNetwork: false +allowHostPID: false +allowHostPorts: false +allowPrivilegeEscalation: true +allowPrivilegedContainer: true +fsGroup: + type: RunAsAny +groups: [] + +{{ end }} diff --git a/charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml b/charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml index 4c1d51d..95d0086 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml @@ -2,6 +2,11 @@ apiVersion: storage.k8s.io/v1 kind: CSIDriver metadata: name: {{ .Values.pluginName | quote }} + {{- with .Values.csiDriverLabels }} + labels: + {{- toYaml . | nindent 4 }} + {{- end }} + spec: # Only ephemeral, inline volumes are supported. There is no need for a # controller to provision and attach volumes. diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index 6664072..aa4e943 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -58,6 +58,12 @@ namespaceOverride: "" ## @param fullnameOverride Full name override for spiffe-csi-driver fullnameOverride: "" +## @param csiDriverLabels Labels to apply to the CSIDriver +csiDriverLabels: {} + +## @param initContainers Init Containers to apply to the CSI Driver DaemonSet +initContainers: [] + ## @param serviceAccount.create Specifies whether a service account should be created ## @param serviceAccount.annotations Annotations to add to the service account ## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated. @@ -126,3 +132,12 @@ kubeletPath: /var/lib/kubelet ## @param priorityClassName Priority class assigned to daemonset pods priorityClassName: "" + +restrictedScc: + ## @param restrictedScc.enabled Enables the creation of a SecurityContextConstraint based on the restricted SCC with CSI volume support + enabled: false + + ## @param restrictedScc.name Set the name of the restricted SCC with CSI support + name: "" + ## @param restrictedScc.version Version of the restricted SCC + version: 2 diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/scc-spire-oidc-discovery-provider.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/scc-spire-oidc-discovery-provider.yaml new file mode 100644 index 0000000..71c147c --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/scc-spire-oidc-discovery-provider.yaml @@ -0,0 +1,38 @@ +{{- if eq (.Values.global.openshift | toString) "true" }} +apiVersion: security.openshift.io/v1 +kind: SecurityContextConstraints +metadata: + name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} +readOnlyRootFilesystem: true +runAsUser: + type: RunAsAny +seLinuxContext: + type: RunAsAny +supplementalGroups: + type: RunAsAny +users: + - system:serviceaccount:{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }} + - system:serviceaccount:{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete +volumes: + - configMap + - hostPath + - projected + - secret + - ephemeral + - downwardAPI + - csi + - emptyDir +allowHostDirVolumePlugin: true +allowHostIPC: true +allowHostNetwork: true +allowHostPID: true +allowHostPorts: true +allowPrivilegeEscalation: true +allowPrivilegedContainer: true +fsGroup: + type: RunAsAny +groups: [] +seccompProfiles: + - '*' + +{{ end }} diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 82e150e..5719008 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -59,7 +59,7 @@ A Helm chart to install the SPIRE agent. | `server.address` | Address for Spire server | `""` | | `server.port` | Port number for Spire server | `8081` | | `server.namespaceOverride` | Override the namespace for Spire server | `""` | -| `healthChecks.port` | override the host port used for health checking | `9980` | +| `healthChecks.port` | override the host port used for health checking | `9982` | | `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | | `livenessProbe.periodSeconds` | Period seconds for probe | `60` | | `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | diff --git a/charts/spire/charts/spire-agent/templates/scc-spire-agent.yaml b/charts/spire/charts/spire-agent/templates/scc-spire-agent.yaml new file mode 100644 index 0000000..b92549b --- /dev/null +++ b/charts/spire/charts/spire-agent/templates/scc-spire-agent.yaml @@ -0,0 +1,31 @@ +{{- if eq (.Values.global.openshift | toString) "true" }} +apiVersion: security.openshift.io/v1 +kind: SecurityContextConstraints +metadata: + name: {{ include "spire-agent.fullname" . }} +readOnlyRootFilesystem: true +runAsUser: + type: RunAsAny +seLinuxContext: + type: RunAsAny +supplementalGroups: + type: RunAsAny +users: + - system:serviceaccount:{{ include "spire-agent.namespace" . }}:{{ include "spire-agent.serviceAccountName" . }} +volumes: + - configMap + - hostPath + - projected + - secret +allowHostDirVolumePlugin: true +allowHostIPC: true +allowHostNetwork: true +allowHostPID: true +allowHostPorts: true +allowPrivilegeEscalation: true +allowPrivilegedContainer: true +fsGroup: + type: RunAsAny +groups: [] + +{{ end }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index de857f9..0011f7b 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -106,7 +106,7 @@ server: healthChecks: ## @param healthChecks.port override the host port used for health checking - port: 9980 + port: 9982 ## @param livenessProbe.initialDelaySeconds Initial delay seconds for probe ## @param livenessProbe.periodSeconds Period seconds for probe diff --git a/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml b/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml index 8d10558..7b0752c 100644 --- a/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml +++ b/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml @@ -23,8 +23,8 @@ metadata: {{- end }} spec: {{- if eq (include "spire-tornjak.connectionType" .) "http" }} - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-http" "Values" .Values) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.http "Values" .Values) | nindent 2 }} {{- else -}} - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-https" "Values" .Values) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.https "Values" .Values) | nindent 2 }} {{- end -}} {{- end }} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 4c6710d..21d7093 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -88,6 +88,7 @@ port forwarding. See the chart NOTES output for more details. | `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | | `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` | | `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` | +| `workingDir` | Path containing the Tornjak frontend within the image | `/usr/src/app` | | `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` | | `ingress.className` | Ingress class name for Tornjak frontend service | `""` | | `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | diff --git a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml index c7ba337..a1c4f42 100644 --- a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml +++ b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml @@ -53,9 +53,9 @@ spec: {{- end }} volumeMounts: - name: cache - mountPath: /usr/src/app/node_modules/.cache + mountPath: {{ .Values.workingDir }}/node_modules/.cache - name: env - mountPath: /usr/src/app/build/tmp + mountPath: {{ .Values.workingDir }}/build/tmp {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 2965f06..cf3c0ec 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -113,6 +113,9 @@ startupProbe: failureThreshold: 6 successThreshold: 1 +## @param workingDir Path containing the Tornjak frontend within the image +workingDir: /usr/src/app + ## @param ingress.enabled Flag to enable ingress for Tornjak frontend service ## @param ingress.className Ingress class name for Tornjak frontend service ## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. diff --git a/examples/openshift/README.md b/examples/openshift/README.md new file mode 100644 index 0000000..da3d5b2 --- /dev/null +++ b/examples/openshift/README.md @@ -0,0 +1,76 @@ +# Recommended setup for installing Spire on Openshift + +> **Note**: This functionality is under development. It works but has no automated testing and will have security tightened in the future. + +This deployment works only with Openshift version 4.13 or higher. Get the Openshift platform here: [try.openshift.com](try.openshift.com) + +To be consistent with the rest of the Spire helm-charts, +we deploy Spire across 2 namespaces. + +```shell +kubectl create namespace "spire-system" +kubectl create namespace "spire-server" + +#Note, the first install requires privilege due to helm ordering issue. After install it can be safely tightened back up. +kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=privileged + +kubectl label namespace "spire-system" security.openshift.io/scc.podSecurityLabelSync=false +kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged +kubectl label namespace "spire-system" pod-security.kubernetes.io/warn=privileged --overwrite +kubectl label namespace "spire-system" pod-security.kubernetes.io/audit=privileged --overwrite + +helm upgrade --install --namespace spire-server spire-crds charts/spire-crds +``` + +Obtain you ingress subdomain: + +```shell +appdomain=$(oc get cm -n openshift-config-managed console-public -o go-template="{{ .data.consoleURL }}" | sed 's@https://@@; s/^[^.]*\.//') +echo "$appdomain" +``` + +Update the `example-your-values.yaml` file with your subdomain. + +_Note: The location of the apps subdomain may be different in certain environments_ + +## Standard Deployment + +```shell +helm upgrade --install --namespace spire-server spire charts/spire \ +--values examples/production/values.yaml \ +--values examples/openshift/openshift-values.yaml \ +--values examples/production/example-your-values.yaml \ +--render-subchart-notes +``` + +## IBM Cloud Deployment + +Openshift on IBM Cloud requires additional configuration: + +```shell +helm upgrade --install --namespace spire-server spire charts/spire \ +--values examples/production/values.yaml \ +--values examples/openshift/openshift-values.yaml \ +--set spiffe-csi-driver.kubeletPath=/var/data/kubelet \ +--set spiffe-csi-driver.restrictedScc.enabled=true \ +--values examples/production/example-your-values.yaml \ +--render-subchart-notes +``` + +## Feature Customization + +Additional features such as tornjak can be enabled by including their example values files before --values examples/production/example-your-values.yaml + +For example: +``` +--values examples/openshift/openshift-values.yaml \ +--values examples/tornjak/values.yaml \ +--values examples/production/example-your-values.yaml \ +``` + +## Finish install + +Once installed, the namespace security can be tightened back up. +```shell +kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted --overwrite +``` diff --git a/examples/openshift/openshift-values.yaml b/examples/openshift/openshift-values.yaml new file mode 100644 index 0000000..5d9ae79 --- /dev/null +++ b/examples/openshift/openshift-values.yaml @@ -0,0 +1,82 @@ +global: + openshift: true + telemetry: + prometheus: + enabled: true + +spire-server: + tornjak: + image: + registry: ghcr.io + repository: spiffe/tornjak-backend + tag: ubi-v1.4.1 + + nodeAttestor: + k8sPsat: + serviceAccountAllowList: ["spire-system:spire-agent"] + notifier: + k8sbundle: + namespace: spire-system + podSecurityContext: + # These are unset so that openshift can automatically assign its own restricted uids to the pods + runAsUser: null + runAsGroup: null + fsGroup: null + +spire-agent: + podSecurityContext: + runAsUser: null + runAsGroup: null + fsGroup: null + # Talk from the agent to kubelet based on hostname instead of localhost + extraEnvVars: + - name: MY_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + +upstream-spire-agent: + podSecurityContext: + runAsUser: null + runAsGroup: null + fsGroup: null + +spiffe-oidc-discovery-provider: + podSecurityContext: + runAsUser: null + runAsGroup: null + fsGroup: null + +tornjak-frontend: + workingDir: /opt/app-root/src + image: + registry: ghcr.io + repository: spiffe/tornjak-frontend + tag: ubi-v1.4.1 + podSecurityContext: + runAsUser: null + runAsGroup: null + fsGroup: null + +spiffe-csi-driver: + csiDriverLabels: + security.openshift.io/csi-ephemeral-volume-profile: restricted + initContainers: + - terminationMessagePath: /dev/termination-log + name: set-context + command: + - chcon + - '-Rvt' + - container_file_t + - spire-agent-socket/ + securityContext: + capabilities: + drop: + - all + privileged: true + imagePullPolicy: Always + volumeMounts: + - name: spire-agent-socket-dir + mountPath: /spire-agent-socket + terminationMessagePolicy: File + image: 'registry.access.redhat.com/ubi9:latest' diff --git a/examples/production/example-your-values.yaml b/examples/production/example-your-values.yaml index 68b7b63..67eaaed 100644 --- a/examples/production/example-your-values.yaml +++ b/examples/production/example-your-values.yaml @@ -22,3 +22,6 @@ spire-server: # host: oidc-discovery # tlsSecret: tls-cert +tornjak-frontend: + apiServerURL: https://tornjak-backend.production.other/ + diff --git a/project/openshift.md b/project/openshift.md new file mode 100644 index 0000000..b47ddef --- /dev/null +++ b/project/openshift.md @@ -0,0 +1,38 @@ +# OpenShift notes for K8S developers + +## SecurityContexts + +OpenShift automatically generates uid/gid's for pods. They should not be set to get this behavior. + +## CSIDriver issues + +A workload in a restricted namespace can not access a csidriver that isn't labeled: + +```yaml +security.openshift.io/csi-ephemeral-volume-profile: restricted +``` + +If the CSIDriver doesn't exist, the workload is blocked from being uploaded into the cluster. This runs into ordering issues with helm install as it always loads regular workloads before CSIDriver objects. + +## Pod Security Standard + +Pod Security Standard (PSS) rules are automatically generated on openshift. Details at [https://docs.openshift.com/container-platform/4.13/authentication/understanding-and-managing-pod-security-admission.html](https://docs.openshift.com/container-platform/4.13/authentication/understanding-and-managing-pod-security-admission.html) + +The defaults though are too chatty. It puts audit/warn still at restricted. + +## Ingress + +Ingress objects automatically create Role objects in the same namespace, when the ingress object is viewed as valid by openshift, if not it is ignored. A missing Role object is a sure sign that something is wrong in the Ingress. + +Some things to watch out for. + +When the ingress is annotated: + +```yaml + "route.openshift.io/termination": "passthrough" +``` + +The ingress object can not have a path specified and the pathType needs to be ImplementationSpecific + +Also, unless a secretName is specified, it can not have a tls section. + From 6a6aa1c8505d9170c5ef6bd75b2917fc398fac48 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Tue, 31 Oct 2023 09:44:52 -0700 Subject: [PATCH 16/36] Cosign download fix (#72) --- .github/workflows/helm-chart-ci.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index 8cb9016..60e6688 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -109,7 +109,7 @@ jobs: python-version: ${{ env.PYTHON_VERSION }} - name: Setup chart-testing - uses: helm/chart-testing-action@v2.4.0 + uses: helm/chart-testing-action@v2.6.0 with: version: ${{ env.CHART_TESTING_VERSION }} @@ -151,7 +151,7 @@ jobs: python-version: ${{ env.PYTHON_VERSION }} - name: Setup chart-testing - uses: helm/chart-testing-action@v2.4.0 + uses: helm/chart-testing-action@v2.6.0 with: version: ${{ env.CHART_TESTING_VERSION }} From f08ebd344e6e7fa0b66dcc12e5ce16b21f9e6aa7 Mon Sep 17 00:00:00 2001 From: Mariusz Sabath Date: Thu, 2 Nov 2023 12:38:33 -0400 Subject: [PATCH 17/36] Patch Tornjak ingress (#74) * Fix the tornjak backend tornjak Signed-off-by: Mariusz Sabath * Revert "Fix the tornjak backend tornjak" This reverts commit cef5505fab940af34be8cfef3e210f020c2f36a1. Signed-off-by: Mariusz Sabath * Fix the tornjak backend tornjak Signed-off-by: Mariusz Sabath --------- Signed-off-by: Mariusz Sabath --- charts/spire/charts/spire-server/templates/tornjak-ingress.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml b/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml index 7b0752c..f669c70 100644 --- a/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml +++ b/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml @@ -1,7 +1,7 @@ {{- if .Values.tornjak.ingress.enabled -}} {{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.tornjak.ingress) }} {{- $fullName := include "spire-tornjak.fullname" . -}} -{{- $annotations := deepCopy .Values.ingress.annotations }} +{{- $annotations := deepCopy .Values.tornjak.ingress.annotations }} {{- if eq $ingressControllerType "ingress-nginx" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }} From 2dce90f44e812291a607869267c64b7a4a4c1808 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 2 Nov 2023 23:12:20 -0700 Subject: [PATCH 18/36] Bump helm/chart-releaser-action from 1.5.0 to 1.6.0 (#75) Bumps [helm/chart-releaser-action](https://github.com/helm/chart-releaser-action) from 1.5.0 to 1.6.0. - [Release notes](https://github.com/helm/chart-releaser-action/releases) - [Commits](https://github.com/helm/chart-releaser-action/compare/v1.5.0...v1.6.0) --- updated-dependencies: - dependency-name: helm/chart-releaser-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/helm-release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml index bc854b5..0c560d2 100644 --- a/.github/workflows/helm-release.yaml +++ b/.github/workflows/helm-release.yaml @@ -39,7 +39,7 @@ jobs: version: v3.10.3 - name: Run chart-releaser - uses: helm/chart-releaser-action@v1.5.0 + uses: helm/chart-releaser-action@v1.6.0 env: CR_TOKEN: '${{ secrets.GITHUB_TOKEN }}' From 81cc2dc573d6cc9269e0ee421e405c5b2002b4d0 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Fri, 3 Nov 2023 13:16:14 -0700 Subject: [PATCH 19/36] Ingress type openshift (#52) * Specify ingress controller type Signed-off-by: Kevin Fox * Fix indenting, docs Signed-off-by: Kevin Fox * Fix spacing Signed-off-by: Kevin Fox * Fix missing brackets Signed-off-by: Kevin Fox * Fix missing brackets Signed-off-by: Kevin Fox * Add ingress-nginx support Signed-off-by: Kevin Fox * Use the right example values for test version to upgrade from. Signed-off-by: Kevin Fox * Fix var in wrong location Signed-off-by: Kevin Fox * Fix missing arg Signed-off-by: Kevin Fox * Try this to checkout the right version Signed-off-by: Kevin Fox * Switch to upgrading from 0.14.0 Signed-off-by: Kevin Fox * Install crds Signed-off-by: Kevin Fox * Simple ingress support For a lot of situations, ingress rules can be derived from trustDomain. Change the code to generate rules by default for the user. Signed-off-by: Kevin Fox * Add upgrade test fix from 43 Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Fix test Signed-off-by: Kevin Fox * Apply suggestions from code review Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix docs Signed-off-by: Kevin Fox * Enable unset ingress controller type to use with openshift later Signed-off-by: Kevin Fox * Openshift ingress controller type support Signed-off-by: Kevin Fox * Fix missing end tag Signed-off-by: Kevin Fox * Fix merge conflicts Signed-off-by: Kevin Fox * Fix doc merge conflicts Signed-off-by: Kevin Fox * Apply suggestions from code review Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Update docs Signed-off-by: Kevin Fox * Apply suggestions from code review Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix docs Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Fix merge conflicts Signed-off-by: Kevin Fox * Fix automatically generated rules on openshift Signed-off-by: Kevin Fox * Fix formatting Signed-off-by: Kevin Fox * Fix pathType Signed-off-by: Kevin Fox * Make openshift edge rules work Signed-off-by: Kevin Fox * Fix var scoping Signed-off-by: Kevin Fox * Fix docs Signed-off-by: Kevin Fox * Fix issue created during merge conflict Signed-off-by: Kevin Fox * Fix docs Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon Co-authored-by: Mariusz Sabath --- charts/spire/README.md | 26 +-- .../spiffe-oidc-discovery-provider/README.md | 202 +++++++++--------- .../templates/ingress.yaml | 6 +- .../values.yaml | 2 +- charts/spire/charts/spire-server/README.md | 6 +- .../templates/federation-ingress.yaml | 6 +- .../spire-server/templates/ingress.yaml | 10 +- .../templates/tornjak-ingress.yaml | 16 +- charts/spire/charts/spire-server/values.yaml | 6 +- .../spire/charts/tornjak-frontend/README.md | 92 ++++---- .../tornjak-frontend/templates/ingress.yaml | 6 +- .../spire/charts/tornjak-frontend/values.yaml | 2 +- charts/spire/templates/_spire-lib.tpl | 17 +- charts/spire/values.yaml | 2 +- 14 files changed, 220 insertions(+), 179 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 80d54f7..82d0589 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -133,19 +133,19 @@ Now you can interact with the Spire agent socket from your own application. The ### Global parameters -| Name | Description | Value | -| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` | -| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` | -| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` | -| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens | `oidc-discovery.example.org` | -| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` | -| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` | -| `global.spire.image.registry` | Override all Spire image registries at once | `""` | -| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` | -| `global.spire.ingressControllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | -| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | -| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | +| Name | Description | Value | +| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | +| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` | +| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` | +| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` | +| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens | `oidc-discovery.example.org` | +| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` | +| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` | +| `global.spire.image.registry` | Override all Spire image registries at once | `""` | +| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` | +| `global.spire.ingressControllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | +| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | +| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | ### Spire server parameters diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 796597e..6afd42c 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -29,104 +29,104 @@ A Helm chart to install the SPIFFE OIDC discovery provider. ### Chart parameters -| Name | Description | Value | -| ----------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | -| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | -| `replicaCount` | Replica count | `1` | -| `namespaceOverride` | Namespace override | `""` | -| `annotations` | Annotations for the deployment | `{}` | -| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `image.repository` | The repository within the registry | `spiffe/oidc-discovery-provider` | -| `image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `resources` | Resource requests and limits | `{}` | -| `service.type` | Service type | `ClusterIP` | -| `service.port` | Service port | `80` | -| `service.annotations` | Annotations for service resource | `{}` | -| `configMap.annotations` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | `{}` | -| `podSecurityContext` | Pod security context for OIDC discovery provider pods | `{}` | -| `securityContext` | Security context for OIDC discovery provider deployment | `{}` | -| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | -| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | -| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | -| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | -| `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` | -| `insecureScheme.enabled` | Flag to enable insecure schema | `false` | -| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from | `docker.io` | -| `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` | -| `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.2-alpine` | -| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | -| `jwtIssuer` | Path to JWT issuer | `https://oidc-discovery.example.org` | -| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | -| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` | -| `config.acme.tosAccepted` | Flag for Terms of Service acceptance | `false` | -| `config.acme.cacheDir` | Path for cache directory | `/run/spire` | -| `config.acme.directoryUrl` | URL for acme directory | `https://acme-v02.api.letsencrypt.org/directory` | -| `config.acme.emailAddress` | Email address for registration | `letsencrypt@example.org` | -| `imagePullSecrets` | Image pull secret names | `[]` | -| `nameOverride` | Name override | `""` | -| `fullnameOverride` | Full name override | `""` | -| `serviceAccount.create` | Specifies whether a service account should be created | `true` | -| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | -| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | -| `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | -| `autoscaling.enabled` | Flag to enable autoscaling | `false` | -| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` | -| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` | -| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` | -| `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` | -| `nodeSelector` | Node selector | `{}` | -| `tolerations` | iist of tolerations | `[]` | -| `affinity` | Node affinity | `{}` | -| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | -| `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` | -| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | -| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | -| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | -| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the helm release | `""` | -| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | -| `telemetry.prometheus.nginxExporter.image.registry` | The OCI registry to pull the image from | `docker.io` | -| `telemetry.prometheus.nginxExporter.image.repository` | The repository within the registry | `nginx/nginx-prometheus-exporter` | -| `telemetry.prometheus.nginxExporter.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `telemetry.prometheus.nginxExporter.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `telemetry.prometheus.nginxExporter.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.11.0` | -| `telemetry.prometheus.nginxExporter.resources` | Resource requests and limits | `{}` | -| `ingress.enabled` | Flag to enable ingress | `false` | -| `ingress.className` | Ingress class name | `""` | -| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | -| `ingress.annotations` | Annotations for ingress object | `{}` | -| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `oidc-discovery` | -| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | -| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | -| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | -| `tests.hostAliases` | List of host aliases for testing | `[]` | -| `tests.tls.enabled` | Flag for enabling tls for tests | `false` | -| `tests.tls.customCA` | Custom CA value for tests | `""` | -| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | -| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c` | -| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | -| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c3bb333d1d8a0e6262aa6e0b1e01e2833822ab0a9812d2668a23869888ebf0be` | -| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` | -| `tests.busybox.image.repository` | The repository within the registry | `busybox` | -| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.busybox.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` | -| `tests.agent.image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `tests.agent.image.repository` | The repository within the registry | `spiffe/spire-agent` | -| `tests.agent.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.agent.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.agent.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | -| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | -| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| Name | Description | Value | +| ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | +| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | +| `replicaCount` | Replica count | `1` | +| `namespaceOverride` | Namespace override | `""` | +| `annotations` | Annotations for the deployment | `{}` | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/oidc-discovery-provider` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `resources` | Resource requests and limits | `{}` | +| `service.type` | Service type | `ClusterIP` | +| `service.port` | Service port | `80` | +| `service.annotations` | Annotations for service resource | `{}` | +| `configMap.annotations` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | `{}` | +| `podSecurityContext` | Pod security context for OIDC discovery provider pods | `{}` | +| `securityContext` | Security context for OIDC discovery provider deployment | `{}` | +| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | +| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | +| `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` | +| `insecureScheme.enabled` | Flag to enable insecure schema | `false` | +| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from | `docker.io` | +| `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` | +| `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.2-alpine` | +| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | +| `jwtIssuer` | Path to JWT issuer | `https://oidc-discovery.example.org` | +| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | +| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` | +| `config.acme.tosAccepted` | Flag for Terms of Service acceptance | `false` | +| `config.acme.cacheDir` | Path for cache directory | `/run/spire` | +| `config.acme.directoryUrl` | URL for acme directory | `https://acme-v02.api.letsencrypt.org/directory` | +| `config.acme.emailAddress` | Email address for registration | `letsencrypt@example.org` | +| `imagePullSecrets` | Image pull secret names | `[]` | +| `nameOverride` | Name override | `""` | +| `fullnameOverride` | Full name override | `""` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | +| `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | +| `autoscaling.enabled` | Flag to enable autoscaling | `false` | +| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` | +| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` | +| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` | +| `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` | +| `nodeSelector` | Node selector | `{}` | +| `tolerations` | iist of tolerations | `[]` | +| `affinity` | Node affinity | `{}` | +| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | +| `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` | +| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | +| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | +| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | +| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the helm release | `""` | +| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | +| `telemetry.prometheus.nginxExporter.image.registry` | The OCI registry to pull the image from | `docker.io` | +| `telemetry.prometheus.nginxExporter.image.repository` | The repository within the registry | `nginx/nginx-prometheus-exporter` | +| `telemetry.prometheus.nginxExporter.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `telemetry.prometheus.nginxExporter.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `telemetry.prometheus.nginxExporter.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.11.0` | +| `telemetry.prometheus.nginxExporter.resources` | Resource requests and limits | `{}` | +| `ingress.enabled` | Flag to enable ingress | `false` | +| `ingress.className` | Ingress class name | `""` | +| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | +| `ingress.annotations` | Annotations for ingress object | `{}` | +| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `oidc-discovery` | +| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | +| `tests.hostAliases` | List of host aliases for testing | `[]` | +| `tests.tls.enabled` | Flag for enabling tls for tests | `false` | +| `tests.tls.customCA` | Custom CA value for tests | `""` | +| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | +| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c` | +| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | +| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c3bb333d1d8a0e6262aa6e0b1e01e2833822ab0a9812d2668a23869888ebf0be` | +| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` | +| `tests.busybox.image.repository` | The repository within the registry | `busybox` | +| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.busybox.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` | +| `tests.agent.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `tests.agent.image.repository` | The repository within the registry | `spiffe/spire-agent` | +| `tests.agent.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.agent.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.agent.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | +| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | +| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml index 9cbd7c2..6f5913e 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml @@ -1,10 +1,14 @@ {{- if .Values.ingress.enabled -}} {{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }} {{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . }} +{{- $tlsSection := true }} {{- $annotations := deepCopy .Values.ingress.annotations }} {{- if eq $ingressControllerType "ingress-nginx" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }} +{{- else if eq $ingressControllerType "openshift" }} +{{- $_ := set $annotations "route.openshift.io/termination" "edge" }} +{{- $tlsSection = false }} {{- end }} apiVersion: networking.k8s.io/v1 kind: Ingress @@ -18,5 +22,5 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "Values" .Values) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }} {{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 8b11f46..dd87136 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -241,7 +241,7 @@ ingress: enabled: false ## @param ingress.className Ingress class name className: "" - ## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. + ## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. controllerType: "" ## @param ingress.annotations [object] Annotations for ingress object annotations: {} diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index bd2ff79..6b5e4a7 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -150,7 +150,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` | | `federation.ingress.enabled` | Flag to enable ingress for federation | `false` | | `federation.ingress.className` | Ingress class name for federation | `""` | -| `federation.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | +| `federation.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | | `federation.ingress.annotations` | Annotations for the ingress object | `{}` | | `federation.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server-federation` | | `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | @@ -247,7 +247,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | | `ingress.enabled` | Flag to enable ingress | `false` | | `ingress.className` | Ingress class name | `""` | -| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | +| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | | `ingress.annotations` | Annotations for the ingress object | `{}` | | `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server` | | `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | @@ -275,7 +275,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tornjak.service.annotations` | Annotations for the service | `{}` | | `tornjak.ingress.enabled` | Flag to enable ingress for Tornjak backend service | `false` | | `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` | -| `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | +| `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | | `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` | | `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` | | `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | diff --git a/charts/spire/charts/spire-server/templates/federation-ingress.yaml b/charts/spire/charts/spire-server/templates/federation-ingress.yaml index e09d096..009deaa 100644 --- a/charts/spire/charts/spire-server/templates/federation-ingress.yaml +++ b/charts/spire/charts/spire-server/templates/federation-ingress.yaml @@ -2,11 +2,15 @@ {{- if .Values.federation.ingress.enabled -}} {{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.federation.ingress) }} {{- $svcName := include "spire-server.fullname" . }} +{{- $tlsSection := true }} {{- $annotations := deepCopy .Values.federation.ingress.annotations }} {{- if eq $ingressControllerType "ingress-nginx" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }} +{{- else if eq $ingressControllerType "openshift" }} +{{- $_ := set $annotations "route.openshift.io/termination" "edge" }} +{{- $tlsSection = false }} {{- end }} apiVersion: networking.k8s.io/v1 kind: Ingress @@ -20,6 +24,6 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "Values" .Values) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/ingress.yaml b/charts/spire/charts/spire-server/templates/ingress.yaml index dbcdb39..2648350 100644 --- a/charts/spire/charts/spire-server/templates/ingress.yaml +++ b/charts/spire/charts/spire-server/templates/ingress.yaml @@ -1,12 +1,20 @@ {{- if .Values.ingress.enabled -}} {{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }} {{- $fullName := include "spire-server.fullname" . -}} +{{- $path := "/" }} +{{- $pathType := "Prefix" }} +{{- $tlsSection := true }} {{- $annotations := deepCopy .Values.ingress.annotations }} {{- if eq $ingressControllerType "ingress-nginx" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }} +{{- else if eq $ingressControllerType "openshift" }} +{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }} +{{- $path = "" }} +{{- $pathType = "ImplementationSpecific" }} +{{- $tlsSection = false }} {{- end }} apiVersion: networking.k8s.io/v1 kind: Ingress @@ -20,5 +28,5 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "Values" .Values) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml b/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml index f669c70..8fa0451 100644 --- a/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml +++ b/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml @@ -1,6 +1,9 @@ {{- if .Values.tornjak.ingress.enabled -}} {{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.tornjak.ingress) }} {{- $fullName := include "spire-tornjak.fullname" . -}} +{{- $path := "/" }} +{{- $pathType := "Prefix" }} +{{- $tlsSection := true }} {{- $annotations := deepCopy .Values.tornjak.ingress.annotations }} {{- if eq $ingressControllerType "ingress-nginx" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }} @@ -9,6 +12,15 @@ {{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }} {{- end }} +{{- else if eq $ingressControllerType "openshift" }} +{{- $tlsSection = false }} +{{- if ne (include "spire-tornjak.connectionType" .) "http" }} +{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }} +{{- $path = "" }} +{{- $pathType = "ImplementationSpecific" }} +{{- else }} +{{- $_ := set $annotations "route.openshift.io/termination" "edge" }} +{{- end }} {{- end }} apiVersion: networking.k8s.io/v1 kind: Ingress @@ -23,8 +35,8 @@ metadata: {{- end }} spec: {{- if eq (include "spire-tornjak.connectionType" .) "http" }} - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.http "Values" .Values) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.http "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }} {{- else -}} - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.https "Values" .Values) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.https "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }} {{- end -}} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 3342e70..5d9a7c2 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -202,7 +202,7 @@ federation: enabled: false ## @param federation.ingress.className Ingress class name for federation className: "" - ## @param federation.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. + ## @param federation.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. controllerType: "" ## @param federation.ingress.annotations [object] Annotations for the ingress object annotations: {} @@ -496,7 +496,7 @@ ingress: enabled: false ## @param ingress.className Ingress class name className: "" - ## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. + ## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. controllerType: "" ## @param ingress.annotations [object] Annotations for the ingress object annotations: {} @@ -582,7 +582,7 @@ tornjak: ## @param tornjak.ingress.enabled Flag to enable ingress for Tornjak backend service ## @param tornjak.ingress.className Ingress class name for Tornjak backend service - ## @param tornjak.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. + ## @param tornjak.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. ## @param tornjak.ingress.annotations [object] Annotations for Tornjak backend service ingress: enabled: false diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 21d7093..4e90cae 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -56,49 +56,49 @@ port forwarding. See the chart NOTES output for more details. ### Chart parameters -| Name | Description | Value | -| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | -| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` | -| `image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `imagePullSecrets` | Pull secrets for images | `[]` | -| `nameOverride` | Name override | `""` | -| `namespaceOverride` | Namespace override | `""` | -| `fullnameOverride` | Fullname override | `""` | -| `serviceAccount.create` | Specifies whether a service account should be created | `true` | -| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | -| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | -| `labels` | Labels for tornjak frontend pods | `{}` | -| `podSecurityContext` | Pod security context | `{}` | -| `securityContext` | Security context | `{}` | -| `service.type` | Service type | `ClusterIP` | -| `service.port` | Service port | `3000` | -| `service.annotations` | Annotations for service resource | `{}` | -| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | | -| `affinity` | Affinity rules | `{}` | -| `tolerations` | List of tolerations | `[]` | -| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` | -| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. | `http://localhost:10000/` | -| `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` | -| `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` | -| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | -| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | -| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | -| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` | -| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` | -| `workingDir` | Path containing the Tornjak frontend within the image | `/usr/src/app` | -| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` | -| `ingress.className` | Ingress class name for Tornjak frontend service | `""` | -| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | -| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` | -| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-frontend` | -| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | -| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | -| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | -| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | -| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c` | +| Name | Description | Value | +| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `imagePullSecrets` | Pull secrets for images | `[]` | +| `nameOverride` | Name override | `""` | +| `namespaceOverride` | Namespace override | `""` | +| `fullnameOverride` | Fullname override | `""` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | +| `labels` | Labels for tornjak frontend pods | `{}` | +| `podSecurityContext` | Pod security context | `{}` | +| `securityContext` | Security context | `{}` | +| `service.type` | Service type | `ClusterIP` | +| `service.port` | Service port | `3000` | +| `service.annotations` | Annotations for service resource | `{}` | +| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | | +| `affinity` | Affinity rules | `{}` | +| `tolerations` | List of tolerations | `[]` | +| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` | +| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. | `http://localhost:10000/` | +| `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` | +| `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` | +| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | +| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` | +| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` | +| `workingDir` | Path containing the Tornjak frontend within the image | `/usr/src/app` | +| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` | +| `ingress.className` | Ingress class name for Tornjak frontend service | `""` | +| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | +| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` | +| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-frontend` | +| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | +| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | +| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c` | diff --git a/charts/spire/charts/tornjak-frontend/templates/ingress.yaml b/charts/spire/charts/tornjak-frontend/templates/ingress.yaml index 142c28e..c6b2e9a 100644 --- a/charts/spire/charts/tornjak-frontend/templates/ingress.yaml +++ b/charts/spire/charts/tornjak-frontend/templates/ingress.yaml @@ -1,10 +1,14 @@ {{- if .Values.ingress.enabled -}} {{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }} {{- $fullName := include "tornjak-frontend.fullname" . -}} +{{- $tlsSection := true }} {{- $annotations := deepCopy .Values.ingress.annotations }} {{- if eq $ingressControllerType "ingress-nginx" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }} +{{- else if eq $ingressControllerType "openshift" }} +{{- $_ := set $annotations "route.openshift.io/termination" "edge" }} +{{- $tlsSection = false }} {{- end }} apiVersion: networking.k8s.io/v1 kind: Ingress @@ -18,5 +22,5 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "Values" .Values) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }} {{- end }} diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index cf3c0ec..e93d9a2 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -118,7 +118,7 @@ workingDir: /usr/src/app ## @param ingress.enabled Flag to enable ingress for Tornjak frontend service ## @param ingress.className Ingress class name for Tornjak frontend service -## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. +## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. ## @param ingress.annotations [object] Annotations for Tornjak frontend service ingress: enabled: false diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/templates/_spire-lib.tpl index f703258..ced7001 100644 --- a/charts/spire/templates/_spire-lib.tpl +++ b/charts/spire/templates/_spire-lib.tpl @@ -71,11 +71,13 @@ {{- $type = .global.spire.ingressControllerType }} {{- else if ne .ingress.controllerType "" }} {{- $type = .ingress.controllerType }} +{{- else if (dig "openshift" false .global) }} +{{- $type = "openshift" }} {{- else }} {{- $type = "other" }} {{- end }} -{{- if not (has $type (list "other" "ingress-nginx")) }} -{{- fail "Unsupported ingress controller type specified. Must be one of [other, ingress-nginx]" }} +{{- if not (has $type (list "ingress-nginx" "openshift" "other")) }} +{{- fail "Unsupported ingress controller type specified. Must be one of [ingress-nginx, openshift, other]" }} {{- end }} {{- $type }} {{- end }} @@ -96,6 +98,9 @@ * ingress - the standardized ingress object * svcName - The service to route to * port - which port on the service to use + * path - optional path to set on the rules + * pathType - typical ingress path type + * tlsSection - bool specifying to add by default the tls section to the ingress. Ingress-nginx needs true, openshift needs false. * Values - Chart values */}} {{ define "spire-lib.ingress-spec" }} @@ -106,18 +111,22 @@ ingressClassName: {{ . | quote }} {{- end }} {{- if eq (add (len .ingress.tls) (len .ingress.hosts)) 0 }} +{{ if or .tlsSection .ingress.tlsSecret }} tls: - hosts: - {{ $host | quote }} {{- with .ingress.tlsSecret }} secretName: {{ . | quote }} {{- end }} +{{- end }} rules: - host: {{ $host | quote }} http: paths: - - path: "/" - pathType: Prefix + - pathType: {{ .pathType }} + {{- with .path }} + path: {{ . }} + {{- end }} backend: service: name: {{ $svcName | quote }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index af56f82..23f47ba 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -27,7 +27,7 @@ global: ## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production. strictMode: false - ## @param global.spire.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. + ## @param global.spire.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. ingressControllerType: "" installAndUpgradeHooks: From d6583be17956ca2ba5132f5d9663357b3bbe9d06 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Sun, 5 Nov 2023 05:10:16 -0800 Subject: [PATCH 20/36] Add missing no cleanup flags to example tests (#79) --- examples/external-mysql/run-tests.sh | 21 +++++++++++++++---- examples/external-postgresql/run-tests.sh | 21 +++++++++++++++---- examples/nested/run-tests.sh | 25 +++++++++++++++++------ examples/tornjak/run-tests.sh | 17 +++++++++++++-- 4 files changed, 68 insertions(+), 16 deletions(-) diff --git a/examples/external-mysql/run-tests.sh b/examples/external-mysql/run-tests.sh index 6815b29..aeaf627 100755 --- a/examples/external-mysql/run-tests.sh +++ b/examples/external-mysql/run-tests.sh @@ -12,11 +12,24 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh" # shellcheck source=/dev/null source "${TESTDIR}/common.sh" +CLEANUP=1 + +for i in "$@"; do + case $i in + -c) + CLEANUP=0 + shift # past argument=value + ;; + esac +done + teardown() { - helm uninstall --namespace "spire-server" spire 2>/dev/null || true - helm uninstall --namespace mysql mysql 2>/dev/null || true - kubectl delete ns spire-server 2>/dev/null || true - kubectl delete ns spire-system 2>/dev/null || true + if [ "${CLEANUP}" -eq 1 ]; then + helm uninstall --namespace "spire-server" spire 2>/dev/null || true + helm uninstall --namespace mysql mysql 2>/dev/null || true + kubectl delete ns spire-server 2>/dev/null || true + kubectl delete ns spire-system 2>/dev/null || true + fi } trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT diff --git a/examples/external-postgresql/run-tests.sh b/examples/external-postgresql/run-tests.sh index 388da84..8cfe700 100755 --- a/examples/external-postgresql/run-tests.sh +++ b/examples/external-postgresql/run-tests.sh @@ -12,11 +12,24 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh" # shellcheck source=/dev/null source "${TESTDIR}/common.sh" +CLEANUP=1 + +for i in "$@"; do + case $i in + -c) + CLEANUP=0 + shift # past argument=value + ;; + esac +done + teardown() { - helm uninstall --namespace "spire-server" spire 2>/dev/null || true - helm uninstall --namespace "spire-server" postgresql 2>/dev/null || true - kubectl delete ns spire-server 2>/dev/null || true - kubectl delete ns spire-system 2>/dev/null || true + if [ "${CLEANUP}" -eq 1 ]; then + helm uninstall --namespace "spire-server" spire 2>/dev/null || true + helm uninstall --namespace "spire-server" postgresql 2>/dev/null || true + kubectl delete ns spire-server 2>/dev/null || true + kubectl delete ns spire-system 2>/dev/null || true + fi } trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT diff --git a/examples/nested/run-tests.sh b/examples/nested/run-tests.sh index 0bace5d..c394c56 100755 --- a/examples/nested/run-tests.sh +++ b/examples/nested/run-tests.sh @@ -12,13 +12,26 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh" # shellcheck source=/dev/null source "${TESTDIR}/common.sh" -teardown() { - helm uninstall --namespace spire-server spire 2>/dev/null || true - kubectl delete ns spire-server 2>/dev/null || true - kubectl delete ns spire-system 2>/dev/null || true +CLEANUP=1 - helm uninstall --namespace mysql spire-root-server 2>/dev/null || true - kubectl delete ns spire-root-server 2>/dev/null || true +for i in "$@"; do + case $i in + -c) + CLEANUP=0 + shift # past argument=value + ;; + esac +done + +teardown() { + if [ "${CLEANUP}" -eq 1 ]; then + helm uninstall --namespace spire-server spire 2>/dev/null || true + kubectl delete ns spire-server 2>/dev/null || true + kubectl delete ns spire-system 2>/dev/null || true + + helm uninstall --namespace mysql spire-root-server 2>/dev/null || true + kubectl delete ns spire-root-server 2>/dev/null || true + fi } trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT diff --git a/examples/tornjak/run-tests.sh b/examples/tornjak/run-tests.sh index e4449cd..f911ee0 100755 --- a/examples/tornjak/run-tests.sh +++ b/examples/tornjak/run-tests.sh @@ -12,9 +12,22 @@ source "${TESTDIR}/common.sh" helm_install=(helm upgrade --install --create-namespace) ns=spire-system +CLEANUP=1 + +for i in "$@"; do + case $i in + -c) + CLEANUP=0 + shift # past argument=value + ;; + esac +done + teardown() { - helm uninstall --namespace "${ns}" spire 2>/dev/null || true - kubectl delete ns "${ns}" 2>/dev/null || true + if [ "${CLEANUP}" -eq 1 ]; then + helm uninstall --namespace "${ns}" spire 2>/dev/null || true + kubectl delete ns "${ns}" 2>/dev/null || true + fi } trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT From 9b31f3d40b39c88b103bb2efd3177ec1bd9049dc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 6 Nov 2023 04:07:09 +0000 Subject: [PATCH 21/36] Bump helm/chart-testing-action from 2.6.0 to 2.6.1 Bumps [helm/chart-testing-action](https://github.com/helm/chart-testing-action) from 2.6.0 to 2.6.1. - [Release notes](https://github.com/helm/chart-testing-action/releases) - [Commits](https://github.com/helm/chart-testing-action/compare/v2.6.0...v2.6.1) --- updated-dependencies: - dependency-name: helm/chart-testing-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/helm-chart-ci.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index 60e6688..e2a2abd 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -109,7 +109,7 @@ jobs: python-version: ${{ env.PYTHON_VERSION }} - name: Setup chart-testing - uses: helm/chart-testing-action@v2.6.0 + uses: helm/chart-testing-action@v2.6.1 with: version: ${{ env.CHART_TESTING_VERSION }} @@ -151,7 +151,7 @@ jobs: python-version: ${{ env.PYTHON_VERSION }} - name: Setup chart-testing - uses: helm/chart-testing-action@v2.6.0 + uses: helm/chart-testing-action@v2.6.1 with: version: ${{ env.CHART_TESTING_VERSION }} From 3778597e72f2bfb6270bf52cc36e836daa6be029 Mon Sep 17 00:00:00 2001 From: Kevin Fox Date: Sat, 4 Nov 2023 08:14:09 -0700 Subject: [PATCH 22/36] Add missing ClusterSPIFFEID fields There are a few options in the CRD not available via the chart. Sync them to the chart. Signed-off-by: Kevin Fox --- charts/spire/charts/spire-server/README.md | 4 ++++ .../templates/controller-manager-cluster-ids.yaml | 11 +++++++++++ charts/spire/charts/spire-server/values.yaml | 8 ++++++++ 3 files changed, 23 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 6b5e4a7..b44c2cf 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -235,6 +235,10 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.identities.namespaceSelector` | Selector for namespacs to issue identity | `{}` | | `controllerManager.identities.dnsNameTemplates` | DNS name template for issued identities | `[]` | | `controllerManager.identities.federatesWith` | Other Spire server URLs for identity federation | `[]` | +| `controllerManager.identities.workloadSelectorTemplates` | Templates to produce selectors that apply to a given workload before it will receive an ID | `[]` | +| `controllerManager.identities.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` | +| `controllerManager.identities.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` | +| `controllerManager.identities.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` | | `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml index 69c7c6f..02e0648 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml @@ -24,5 +24,16 @@ spec: dnsNameTemplates: {{- toYaml . | nindent 4 }} {{- end }} + {{- with .identities.workloadSelectorTemplates }} + workloadTSelectoremplates: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .identities.ttl }} + ttl: {{ . | quote }} + {{- end }} + {{- with .identities.jwtTTL }} + jwtTtl: {{ . | quote }} + {{- end }} + admin: {{ .identities.admin }} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 5d9a7c2..347bc4f 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -459,6 +459,14 @@ controllerManager: federatesWith: [] # - example.io # - example.ai + ## @param controllerManager.identities.workloadSelectorTemplates [array] Templates to produce selectors that apply to a given workload before it will receive an ID + workloadSelectorTemplates: [] + ## @param controllerManager.identities.ttl Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. + ttl: "" + ## @param controllerManager.identities.jwtTTL Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. + jwtTTL: "" + ## @param controllerManager.identities.admin Indicates any pod matched by this identity will be an admin. Use this with extreme care. + admin: false validatingWebhookConfiguration: ## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued From a7e8785420ddb41aaf50cd59f1086906a89c8cb3 Mon Sep 17 00:00:00 2001 From: Kevin Fox Date: Sat, 4 Nov 2023 08:27:46 -0700 Subject: [PATCH 23/36] Add another missing one Signed-off-by: Kevin Fox --- charts/spire/charts/spire-server/README.md | 1 + .../spire-server/templates/controller-manager-cluster-ids.yaml | 1 + charts/spire/charts/spire-server/values.yaml | 2 ++ 3 files changed, 4 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index b44c2cf..a0860c4 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -239,6 +239,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.identities.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` | | `controllerManager.identities.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` | | `controllerManager.identities.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` | +| `controllerManager.identities.downstream` | | Set if this spire instance is a root server and the workloads are downstream servers. | `false` | | `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml index 02e0648..0535f52 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml @@ -35,5 +35,6 @@ spec: jwtTtl: {{ . | quote }} {{- end }} admin: {{ .identities.admin }} + downstream: {{ .identities.downstream }} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 347bc4f..cf7b96b 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -467,6 +467,8 @@ controllerManager: jwtTTL: "" ## @param controllerManager.identities.admin Indicates any pod matched by this identity will be an admin. Use this with extreme care. admin: false + ## @param controllerManager.identities.downstream | Set if this spire instance is a root server and the workloads are downstream servers. + downstream: false validatingWebhookConfiguration: ## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued From f7b61406fe0d8176aa1ce09d75f10968a7721ba1 Mon Sep 17 00:00:00 2001 From: Kevin Fox Date: Sat, 4 Nov 2023 08:45:49 -0700 Subject: [PATCH 24/36] Fix docs Signed-off-by: Kevin Fox --- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index a0860c4..6187f52 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -239,7 +239,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.identities.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` | | `controllerManager.identities.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` | | `controllerManager.identities.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` | -| `controllerManager.identities.downstream` | | Set if this spire instance is a root server and the workloads are downstream servers. | `false` | +| `controllerManager.identities.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` | | `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index cf7b96b..cc6f88d 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -467,7 +467,7 @@ controllerManager: jwtTTL: "" ## @param controllerManager.identities.admin Indicates any pod matched by this identity will be an admin. Use this with extreme care. admin: false - ## @param controllerManager.identities.downstream | Set if this spire instance is a root server and the workloads are downstream servers. + ## @param controllerManager.identities.downstream Set if this spire instance is a root server and the workloads are downstream servers. downstream: false validatingWebhookConfiguration: From 0ed6d9244db79d4ad23978eba0866a805c4a79db Mon Sep 17 00:00:00 2001 From: marcofranssen Date: Mon, 6 Nov 2023 08:01:59 +0000 Subject: [PATCH 25/36] Bump test chart dependencies Signed-off-by: GitHub --- .github/tests/charts.json | 4 ++-- charts/spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- charts/spire/charts/spire-agent/README.md | 4 ++-- charts/spire/charts/spire-agent/values.yaml | 4 ++-- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 9 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 5e485bd..31501de 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -7,7 +7,7 @@ { "name": "cert-manager", "repo": "https://charts.jetstack.io", - "version": "v1.13.1" + "version": "v1.13.2" }, { "name": "ingress-nginx", @@ -22,6 +22,6 @@ { "name": "postgresql", "repo": "https://charts.bitnami.com/bitnami", - "version": "13.1.5" + "version": "13.2.1" } ] diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 6afd42c..968de3c 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -109,12 +109,12 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c3bb333d1d8a0e6262aa6e0b1e01e2833822ab0a9812d2668a23869888ebf0be` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d1fc4d296994f28d7e0264c933a12ba75c9a80478ff1eb4b6f692bb91a073a4c` | | `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` | | `tests.busybox.image.repository` | The repository within the registry | `busybox` | | `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index dd87136..ebdfa57 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -289,7 +289,7 @@ tests: repository: chainguard/bash pullPolicy: IfNotPresent version: "" - tag: latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c + tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214 toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -303,7 +303,7 @@ tests: repository: chainguard/slim-toolkit-debug pullPolicy: IfNotPresent version: "" - tag: latest@sha256:c3bb333d1d8a0e6262aa6e0b1e01e2833822ab0a9812d2668a23869888ebf0be + tag: latest@sha256:d1fc4d296994f28d7e0264c933a12ba75c9a80478ff1eb4b6f692bb91a073a4c busybox: ## @param tests.busybox.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 5719008..d2a55e5 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -68,13 +68,13 @@ A Helm chart to install the SPIRE agent. | `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` | | `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `waitForIt.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b76360b5316b33f89c3edc15967cfedf323c21766a8ce29750bff2b38178455f` | +| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c58a76f9241187615ab081ec73db6aeea6939369fba995206343bd9fb1975378` | | `waitForIt.resources` | Resource requests and limits | `{}` | | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | | `fsGroupFix.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 0011f7b..8e9561a 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -134,7 +134,7 @@ waitForIt: repository: chainguard/wait-for-it pullPolicy: IfNotPresent version: "" - tag: latest@sha256:b76360b5316b33f89c3edc15967cfedf323c21766a8ce29750bff2b38178455f + tag: latest@sha256:c58a76f9241187615ab081ec73db6aeea6939369fba995206343bd9fb1975378 ## @param waitForIt.resources [object] Resource requests and limits resources: {} @@ -153,7 +153,7 @@ fsGroupFix: repository: chainguard/bash pullPolicy: Always version: "" - tag: latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c + tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214 ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 6187f52..3b130a1 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -312,4 +312,4 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index cc6f88d..5a557ad 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -716,4 +716,4 @@ tests: repository: chainguard/bash pullPolicy: IfNotPresent version: "" - tag: latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c + tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214 diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 4e90cae..c6cdd55 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index e93d9a2..6b204e4 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -158,4 +158,4 @@ tests: repository: chainguard/bash pullPolicy: IfNotPresent version: "" - tag: latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c + tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214 From edf2381aad0948eb743483e97d31791e80dd11cf Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 7 Nov 2023 22:56:47 -0800 Subject: [PATCH 26/36] Bump sigstore/cosign-installer from 3.1.2 to 3.2.0 (#85) Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.1.2 to 3.2.0. - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](https://github.com/sigstore/cosign-installer/compare/v3.1.2...v3.2.0) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/helm-release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml index 0c560d2..99b3508 100644 --- a/.github/workflows/helm-release.yaml +++ b/.github/workflows/helm-release.yaml @@ -29,7 +29,7 @@ jobs: git config user.email "$GITHUB_ACTOR@users.noreply.github.com" - name: Setup cosign - uses: sigstore/cosign-installer@v3.1.2 + uses: sigstore/cosign-installer@v3.2.0 with: cosign-release: v2.2.0 From 805d8696d01231738758a01bfba37aee3cc2bf3b Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Wed, 8 Nov 2023 02:43:19 -0800 Subject: [PATCH 27/36] spire-controller-manager 0.4.0 support (#60) Co-authored-by: Marco Franssen Co-authored-by: Faisal Memon --- .github/tests/common.sh | 2 ++ .../dependencies/spire-root-server-values.yaml | 9 ++++++++- ...pire.spiffe.io_clusterfederatedtrustdomains.yaml | 9 +++++++++ .../templates/spire.spiffe.io_clusterspiffeids.yaml | 13 +++++++++++++ .../spire.spiffe.io_clusterstaticentries.yaml | 9 +++++++++ charts/spire/README.md | 8 ++++++++ charts/spire/charts/spire-server/README.md | 5 ++++- .../charts/spire-server/templates/_helpers.tpl | 8 ++++++++ .../templates/controller-manager-cluster-ids.yaml | 4 +++- .../templates/controller-manager-configmap.yaml | 4 +++- .../templates/controller-manager-roles.yaml | 9 ++++++--- .../templates/controller-manager-webhook.yaml | 2 +- .../spire-server/templates/post-install-hook.yaml | 4 ++-- .../spire-server/templates/post-upgrade-hook.yaml | 4 ++-- .../spire-server/templates/pre-upgrade-hook.yaml | 9 +++++++-- charts/spire/charts/spire-server/values.yaml | 10 +++++++++- charts/spire/templates/NOTES.txt | 10 ++++++++++ examples/nested/run-tests.sh | 4 ---- examples/production/run-tests.sh | 1 + 19 files changed, 105 insertions(+), 19 deletions(-) diff --git a/.github/tests/common.sh b/.github/tests/common.sh index c550721..3fa18df 100755 --- a/.github/tests/common.sh +++ b/.github/tests/common.sh @@ -1,5 +1,7 @@ #!/usr/bin/env bash +GITHUB_STEP_SUMMARY="${GITHUB_STEP_SUMMARY:-/tmp/summary}" + get_namespace_details () { cat <>"$GITHUB_STEP_SUMMARY" ### Namespace $1 diff --git a/.github/tests/dependencies/spire-root-server-values.yaml b/.github/tests/dependencies/spire-root-server-values.yaml index f588366..43c97d0 100644 --- a/.github/tests/dependencies/spire-root-server-values.yaml +++ b/.github/tests/dependencies/spire-root-server-values.yaml @@ -6,7 +6,14 @@ global: spire-server: controllerManager: - enabled: false + identities: + namespaceSelector: + kubernetes.io/metadata.name: spire-server + podSelector: + app.kubernetes.io/component: server + app.kubernetes.io/instance: spire + app.kubernetes.io/name: server + downstream: true nodeAttestor: k8sPsat: serviceAccountAllowList: diff --git a/charts/spire-crds/templates/spire.spiffe.io_clusterfederatedtrustdomains.yaml b/charts/spire-crds/templates/spire.spiffe.io_clusterfederatedtrustdomains.yaml index 6380ac4..112249f 100644 --- a/charts/spire-crds/templates/spire.spiffe.io_clusterfederatedtrustdomains.yaml +++ b/charts/spire-crds/templates/spire.spiffe.io_clusterfederatedtrustdomains.yaml @@ -65,6 +65,9 @@ spec: description: BundleEndpointURL is the URL of the bundle endpoint. It must be an HTTPS URL and cannot contain userinfo (i.e. username/password). type: string + className: + description: Set the class of controller to handle this object. + type: string trustDomain: description: TrustDomain is the name of the trust domain to federate with (e.g. example.org) @@ -89,3 +92,9 @@ spec: storage: true subresources: status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml b/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml index d630c73..951fa0e 100644 --- a/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml +++ b/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml @@ -41,6 +41,10 @@ spec: access the SPIRE administrative APIs. Extra care should be taken to only apply this SPIFFE ID to admin workloads. type: boolean + autoPopulateDNSNames: + description: AutoPopulateDNSNames indicates whether or not to auto + populate service DNS names. + type: boolean dnsNameTemplates: description: DNSNameTemplate represents templates for extra DNS names that are applicable to SVIDs minted for this ClusterSPIFFEID. The @@ -53,6 +57,9 @@ spec: description: Downstream indicates that the entry describes a downstream SPIRE server. type: boolean + className: + description: Set the class of controller to handle this object. + type: string federatesWith: description: FederatesWith is a list of trust domain names that workloads that obtain this SPIFFE ID will federate with. @@ -224,3 +231,9 @@ spec: storage: true subresources: status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml b/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml index 3e2e35c..bfdde50 100644 --- a/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml +++ b/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml @@ -39,6 +39,9 @@ spec: properties: admin: type: boolean + className: + description: Set the class of controller to handle this object. + type: string dnsNames: items: type: string @@ -90,3 +93,9 @@ spec: storage: true subresources: status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/spire/README.md b/charts/spire/README.md index 82d0589..2f203e2 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -32,6 +32,14 @@ For production installs, please see [the production example](https://github.com/ ## Upgrade notes +### 0.15.X + +The spire-crds chart has been updated. Please ensure you have upgraded spire-crds before upgrading the spire chart. + +The chart now supports multiple parallel installs of spire-controller-manager. Each install will handle all custom resources with a matching `className` field. By default this is set to `Release.Namespace-Release.Name` and the controller manager will only pick up custom resources with this `className`. + +If you have not loaded any SPIRE custom resources yourself, the upgrade process will be transparent. If you have loaded your own SPIRE custom resources, set `spire-server.controllerManager.watchClassless=true` until you can update your SPIRE custom resources to have the `className` for the instance specified. + ### 0.14.X If coming from a chart version before 0.14.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 3b130a1..726bcb5 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -215,13 +215,15 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` | | `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` | | `controllerManager.enabled` | Flag to enable controller manager | `false` | +| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` | +| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` | | `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | | `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` | | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.3.0` | +| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.0` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | @@ -240,6 +242,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.identities.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` | | `controllerManager.identities.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` | | `controllerManager.identities.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` | +| `controllerManager.identities.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` | | `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index 0f0521b..3652f54 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -220,3 +220,11 @@ The code below determines what connection type should be used. {{- end }} {{ $args | toYaml }} {{- end -}} + +{{- define "spire-server.controller-manager-class-name" -}} +{{- if .Values.controllerManager.className }} +{{- .Values.controllerManager.className }} +{{- else }} +{{- .Release.Namespace }}-{{ .Release.Name }} +{{- end -}} +{{- end -}} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml index 0535f52..77cca5e 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml @@ -4,7 +4,7 @@ apiVersion: spire.spiffe.io/v1alpha1 kind: ClusterSPIFFEID metadata: - name: {{ include "spire-controller-manager.fullname" $root }}-service-account-based + name: {{ $root.Release.Namespace }}-{{ include "spire-controller-manager.fullname" $root }}-service-account-based namespace: {{ include "spire-server.namespace" $root }} spec: spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }} @@ -36,5 +36,7 @@ spec: {{- end }} admin: {{ .identities.admin }} downstream: {{ .identities.downstream }} + autoPopulateDNSNames: {{ .identities.autoPopulateDNSNames }} + className: {{ include "spire-server.controller-manager-class-name" $root | quote}} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml index 7184ff0..60f728a 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -25,7 +25,7 @@ data: leaderElect: true resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io resourceNamespace: {{ include "spire-server.namespace" . }} - validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook + validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook clusterName: {{ include "spire-lib.cluster-name" . }} trustDomain: {{ include "spire-lib.trust-domain" . }} ignoreNamespaces: @@ -33,4 +33,6 @@ data: {{- toYaml . | nindent 6 }} {{- end }} spireServerSocketPath: "/tmp/spire-server/private/api.sock" + className: {{ include "spire-server.controller-manager-class-name" . | quote}} + watchClassless: {{ .Values.controllerManager.watchClassless | toYaml }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml index e9cbc5d..551b680 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml @@ -32,7 +32,7 @@ subjects: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ include "spire-controller-manager.fullname" . }} + name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }} rules: - apiGroups: [""] resources: ["namespaces"] @@ -43,6 +43,9 @@ rules: - apiGroups: [""] resources: ["nodes"] verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["endpoints"] + verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["pods"] verbs: ["get", "list", "watch"] @@ -77,11 +80,11 @@ rules: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: {{ include "spire-controller-manager.fullname" . }} + name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: {{ include "spire-controller-manager.fullname" . }} + name: {{ .Release.Namespace}}-{{ include "spire-controller-manager.fullname" . }} subjects: - kind: ServiceAccount name: {{ include "spire-server.serviceAccountName" . }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml index 0622736..40e9493 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml @@ -2,7 +2,7 @@ apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: - name: {{ include "spire-controller-manager.fullname" . }}-webhook + name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook webhooks: - admissionReviewVersions: ["v1"] clientConfig: diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml index dbbb7bd..77b6470 100644 --- a/charts/spire/charts/spire-server/templates/post-install-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml @@ -22,7 +22,7 @@ metadata: rules: - apiGroups: ["admissionregistration.k8s.io"] resources: ["validatingwebhookconfigurations"] - resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}] + resourceNames: [{{ printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) | quote }}] verbs: ["get", "patch"] --- kind: ClusterRoleBinding @@ -68,7 +68,7 @@ spec: args: - patch - validatingwebhookconfiguration - - {{ include "spire-controller-manager.fullname" . }}-webhook + - {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook - --type=strategic - -p - | diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml index ff2883b..d1b255f 100644 --- a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml @@ -22,7 +22,7 @@ metadata: rules: - apiGroups: ["admissionregistration.k8s.io"] resources: ["validatingwebhookconfigurations"] - resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}] + resourceNames: [{{ printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) | quote }}] verbs: ["get", "patch"] --- kind: ClusterRoleBinding @@ -68,7 +68,7 @@ spec: args: - patch - validatingwebhookconfiguration - - {{ include "spire-controller-manager.fullname" . }}-webhook + - {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook - --type=strategic - -p - | diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml index db53b27..a72e043 100644 --- a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml @@ -1,4 +1,9 @@ {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} +{{- $webhookname := printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) }} +{{- $oldwebhookname := printf "%s-webhook" (include "spire-controller-manager.fullname" .) }} +{{- if not (lookup "admissionregistration.k8s.io/v1" "ValidatingWebhookConfiguration" "" $webhookname) }} +{{- $webhookname = $oldwebhookname }} +{{- end }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} apiVersion: v1 @@ -22,7 +27,7 @@ metadata: rules: - apiGroups: ["admissionregistration.k8s.io"] resources: ["validatingwebhookconfigurations"] - resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}] + resourceNames: [{{ $webhookname | quote }}] verbs: ["get", "patch"] --- kind: ClusterRoleBinding @@ -68,7 +73,7 @@ spec: args: - patch - validatingwebhookconfiguration - - {{ include "spire-controller-manager.fullname" . }}-webhook + - {{ $webhookname }} - --type=strategic - -p - | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 5a557ad..63c6647 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -377,6 +377,12 @@ notifier: controllerManager: ## @param controllerManager.enabled Flag to enable controller manager enabled: false + + ## @param controllerManager.className specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. + className: "" + ## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. + watchClassless: false + installAndUpgradeHook: ## @param controllerManager.installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) enabled: true @@ -395,7 +401,7 @@ controllerManager: repository: spiffe/spire-controller-manager pullPolicy: IfNotPresent version: "" - tag: "0.3.0" + tag: "0.4.0" ## @param controllerManager.resources [object] Resource requests and limits for controller manager resources: {} @@ -469,6 +475,8 @@ controllerManager: admin: false ## @param controllerManager.identities.downstream Set if this spire instance is a root server and the workloads are downstream servers. downstream: false + ## @param controllerManager.identities.autoPopulateDNSNames Auto populate DNS names from services attached to pods + autoPopulateDNSNames: false validatingWebhookConfiguration: ## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued diff --git a/charts/spire/templates/NOTES.txt b/charts/spire/templates/NOTES.txt index 5da926b..6da2681 100644 --- a/charts/spire/templates/NOTES.txt +++ b/charts/spire/templates/NOTES.txt @@ -21,3 +21,13 @@ Warning: You're using an unsupported plugin. Functionality of this release and f Warning: You're using an experimental config. Functionality of this release and future upgrades aren't guaranteed to work smoothly. {{- end }} +{{- $className := include "spire-server.controller-manager-class-name" (dict "Values" (index .Values "spire-server") "Release" .Release) }} +{{- if (index .Values "spire-server").controllerManager.enabled }} +{{- if (index .Values "spire-server").controllerManager.watchClassless }} + +Spire CR's will be handled if no className is specified or if className is set to "{{ $className }}" +{{- else }} + +Spire CR's will be handled only if className is set to "{{ $className }}" +{{- end }} +{{- end }} diff --git a/examples/nested/run-tests.sh b/examples/nested/run-tests.sh index c394c56..407715e 100755 --- a/examples/nested/run-tests.sh +++ b/examples/nested/run-tests.sh @@ -46,10 +46,6 @@ helm upgrade --install --create-namespace spire charts/spire \ --values "${DEPS}/spire-root-server-values.yaml" \ --wait -kubectl get nodes -o go-template='{{range .items}}{{printf "%s\n" .metadata.uid}}{{end}}' | while read -r line; do - kubectl exec -t spire-server-0 -n "spire-root-server" -- spire-server entry create -spiffeID spiffe://production.other/production/nested-spire -parentID "spiffe://production.other/spire/agent/k8s_psat/production/$line" -selector k8s:pod-label:app.kubernetes.io/name:server -downstream -done - helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \ --wait spire charts/spire helm test --namespace spire-server spire diff --git a/examples/production/run-tests.sh b/examples/production/run-tests.sh index e48a127..5ad1764 100755 --- a/examples/production/run-tests.sh +++ b/examples/production/run-tests.sh @@ -58,6 +58,7 @@ if [[ -n "$UPGRADE_ARGS" ]]; then popd popd # Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.) + helm upgrade -n spire-system spire-crds charts/spire-crds --wait else kubectl create namespace spire-system 2>/dev/null || true From bd7879a84c3dfbdcd674252d3a5e25e56ee616e1 Mon Sep 17 00:00:00 2001 From: Mariusz Sabath Date: Tue, 7 Nov 2023 16:54:10 -0500 Subject: [PATCH 28/36] Fix the typo in the production ingress README Signed-off-by: Mariusz Sabath --- examples/production/README.md | 2 +- ...=> values-expose-federation-https-spiffe-ingress-nginx.yaml} | 0 ...ml => values-expose-federation-https-web-ingress-nginx.yaml} | 0 ...es-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml} | 0 ...nginx.yaml => values-expose-spire-server-ingress-nginx.yaml} | 0 5 files changed, 1 insertion(+), 1 deletion(-) rename examples/production/{values-export-federation-https-spiffe-ingress-nginx.yaml => values-expose-federation-https-spiffe-ingress-nginx.yaml} (100%) rename examples/production/{values-export-federation-https-web-ingress-nginx.yaml => values-expose-federation-https-web-ingress-nginx.yaml} (100%) rename examples/production/{values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml => values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml} (100%) rename examples/production/{values-export-spire-server-ingress-nginx.yaml => values-expose-spire-server-ingress-nginx.yaml} (100%) diff --git a/examples/production/README.md b/examples/production/README.md index a8561e6..9d8d937 100644 --- a/examples/production/README.md +++ b/examples/production/README.md @@ -20,7 +20,7 @@ If your using ingress-nginx and want to expose the spiffe oidc discovery provide cluster, add the following to the end of the helm upgrade example: ```shell --f values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml +-f values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml ``` If you want to expose your spire-server outside of Kubernetes and are using ingress-nginx, add following values file when running `helm template/install/upgrade`. diff --git a/examples/production/values-export-federation-https-spiffe-ingress-nginx.yaml b/examples/production/values-expose-federation-https-spiffe-ingress-nginx.yaml similarity index 100% rename from examples/production/values-export-federation-https-spiffe-ingress-nginx.yaml rename to examples/production/values-expose-federation-https-spiffe-ingress-nginx.yaml diff --git a/examples/production/values-export-federation-https-web-ingress-nginx.yaml b/examples/production/values-expose-federation-https-web-ingress-nginx.yaml similarity index 100% rename from examples/production/values-export-federation-https-web-ingress-nginx.yaml rename to examples/production/values-expose-federation-https-web-ingress-nginx.yaml diff --git a/examples/production/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml b/examples/production/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml similarity index 100% rename from examples/production/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml rename to examples/production/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml diff --git a/examples/production/values-export-spire-server-ingress-nginx.yaml b/examples/production/values-expose-spire-server-ingress-nginx.yaml similarity index 100% rename from examples/production/values-export-spire-server-ingress-nginx.yaml rename to examples/production/values-expose-spire-server-ingress-nginx.yaml From 37cd9f25e25806d515e01f2726d58c434ec94d63 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Wed, 8 Nov 2023 03:26:21 -0800 Subject: [PATCH 29/36] Update to SPIRE 1.8.4 (#84) --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md.gotmpl | 2 +- charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml | 2 +- charts/spire/charts/spire-agent/Chart.yaml | 2 +- charts/spire/charts/spire-server/Chart.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index dba8bd3..eb46d46 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -4,7 +4,7 @@ description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application version: 0.14.0 -appVersion: "1.8.2" +appVersion: "1.8.4" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/README.md.gotmpl b/charts/spire/README.md.gotmpl index 5939f32..2ffb5e8 100644 --- a/charts/spire/README.md.gotmpl +++ b/charts/spire/README.md.gotmpl @@ -19,7 +19,7 @@ | Dependency | Supported Versions | |:-----------|:-------------------| -| SPIRE | `1.5.3+`, `1.6.3+` | +| SPIRE | `1.8.4` | | Helm | `3.x` | | Kubernetes | `1.22+` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml index 0d446fc..d38ddbf 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml @@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider description: A Helm chart to install the SPIFFE OIDC discovery provider. type: application version: 0.1.0 -appVersion: "1.8.2" +appVersion: "1.8.4" keywords: ["spiffe", "oidc"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml index 6d411b5..514744f 100644 --- a/charts/spire/charts/spire-agent/Chart.yaml +++ b/charts/spire/charts/spire-agent/Chart.yaml @@ -3,7 +3,7 @@ name: spire-agent description: A Helm chart to install the SPIRE agent. type: application version: 0.1.0 -appVersion: "1.8.2" +appVersion: "1.8.4" keywords: ["spiffe", "spire-agent"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml index 2335de4..a150171 100644 --- a/charts/spire/charts/spire-server/Chart.yaml +++ b/charts/spire/charts/spire-server/Chart.yaml @@ -3,7 +3,7 @@ name: spire-server description: A Helm chart to install the SPIRE server. type: application version: 0.1.0 -appVersion: "1.8.2" +appVersion: "1.8.4" keywords: ["spiffe", "spire-server", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: From 0320c3f75541be672fa5df4e97f3e29872d3e6f0 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Wed, 8 Nov 2023 11:54:57 +0100 Subject: [PATCH 30/36] Cleanup documentation Signed-off-by: Marco Franssen --- CODE-OF-CONDUCT.md | 6 +- CONTRIBUTING.md | 5 +- FAQ.md | 12 +- README.md | 2 +- charts/spire-crds/README.md | 5 +- charts/spire/README.md | 9 +- charts/spire/README.md.gotmpl | 75 ------------ .../spire/charts/spiffe-csi-driver/README.md | 7 +- .../charts/spiffe-csi-driver/README.md.gotmpl | 24 ---- .../spiffe-oidc-discovery-provider/README.md | 7 +- .../README.md.gotmpl | 25 ---- .../values.yaml | 6 +- charts/spire/charts/spire-agent/README.md | 7 +- .../spire/charts/spire-agent/README.md.gotmpl | 25 ---- charts/spire/charts/spire-agent/values.yaml | 6 +- charts/spire/charts/spire-server/README.md | 113 ++++++++++-------- charts/spire/charts/spire-server/values.yaml | 6 +- .../spire/charts/tornjak-frontend/README.md | 7 +- .../charts/tornjak-frontend/README.md.gotmpl | 54 --------- .../spire/charts/tornjak-frontend/values.yaml | 2 +- examples/openshift/README.md | 10 +- examples/production/README.md | 9 +- examples/tornjak/README.md | 3 +- helm-docs.sh | 2 +- release-chart.sh | 3 +- 25 files changed, 130 insertions(+), 300 deletions(-) delete mode 100644 charts/spire/README.md.gotmpl delete mode 100644 charts/spire/charts/spiffe-csi-driver/README.md.gotmpl delete mode 100644 charts/spire/charts/spiffe-oidc-discovery-provider/README.md.gotmpl delete mode 100644 charts/spire/charts/spire-agent/README.md.gotmpl delete mode 100644 charts/spire/charts/tornjak-frontend/README.md.gotmpl diff --git a/CODE-OF-CONDUCT.md b/CODE-OF-CONDUCT.md index e758eac..19a1b34 100644 --- a/CODE-OF-CONDUCT.md +++ b/CODE-OF-CONDUCT.md @@ -1,8 +1,8 @@ -### Contributor Code of Conduct +# Contributor Code of Conduct We follow the [CNCF Contributor Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md). Additionally, we commit to the following guidelines as detailed on the [Linkerd Code of Conduct](https://github.com/linkerd/linkerd/wiki/Linkerd-code-of-conduct): -### Community Guidelines +## Community Guidelines - Our goal is to foster an inclusive and diverse community of technology enthusiasts. @@ -14,6 +14,6 @@ We follow the [CNCF Contributor Code of Conduct](https://github.com/cncf/foundat - We do our best to avoid [subtle-isms](https://www.recurse.com/manual#sub-sec-social-rules): small actions that make others feel uncomfortable. If you witness a subtle-ism, you may respectfully point it out to the person publicly or privately, or you may ask a moderator to say something. Accidentally saying something biased is common, expected, and readily forgiven. It is not in and of itself a bannable offense. -### Moderation +## Moderation - If you feel any of SPIFFE's communication channels require moderation, please e-mail the [SPIFFE Steering Committee (SSC)](mailto:ssc@spiffe.io). diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 005d03c..1d4a7ae 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -38,7 +38,8 @@ git rebase main Our CI pipeline takes care of the majority of the testing of this Chart. Other ways for you to test are by running `make test` locally using: -> **Warning**: Ensure to run the test on a dedicated k8s cluster that does not have Spire installed yet. +> [!Warning] +> Ensure to run the test on a dedicated k8s cluster that does not have Spire installed yet. ```shell make test @@ -48,7 +49,7 @@ Another approach to testing the chart is by installing one of the examples in yo ## Generating documentation -Any changes to Chart.yaml or values.yaml require an update of the README.md. This update can easily be generated using [readme-generator](https://github.com/bitnami-labs/readme-generator-for-helm). +Any changes to Chart.yaml or values.yaml require an update of the README.md. This update can easily be generated using [readme-generator][]. ```shell ./helm-docs.sh diff --git a/FAQ.md b/FAQ.md index 25313ea..eda231e 100644 --- a/FAQ.md +++ b/FAQ.md @@ -36,7 +36,8 @@ helm repo add spiffe https://spiffe.github.io/helm-charts-hardened If you uninstall the SPIRE chart before all users of the CSI driver are removed, Pods will get stuck in a terminating state waiting for the driver, that no longer is installed, to unmount the volumes for the Pod. In order to fix this, reinstall the chart and remove all affected workloads that are not part of the SPIRE helm chart itself, before attempting to remove SPIRE again. You can discover Pods that use the driver with the following command: -``` + +```shell kubectl get pods --all-namespaces -o go-template='{{range .items}}{{$nn := printf "%s %s" .metadata.namespace .metadata.name}}{{range .spec.volumes}}{{if .csi.driver}}{{if eq .csi.driver "csi.spiffe.io"}}{{printf "%s\n" $nn}}{{end}}{{end}}{{end}}{{end}}' ``` @@ -44,17 +45,20 @@ kubectl get pods --all-namespaces -o go-template='{{range .items}}{{$nn := print If you uninstall the SPIFFE CSI driver manually before removing the chart, Pods can still be using the driver and are unable to unmount the CSI volume. -To resolve, reinstall the chart before trying to remove it again. +To resolve, reinstall the chart before trying to remove it again. ## The PSAT plugin is not working The chart requires `Projected Service Account Tokens` which has to be enabled on your Kubernetes API server. In most cases this is already done for you. -> **Note**: This is enabled by default with newer versions as shown by the existence of: +> [!Note] +> This is enabled by default with newer versions as shown by the existence of: > +> ```yaml > - --service-account-issuer > - --service-account-key-file > - --service-account-signing-key-file +> ``` See [Service Account Token Volume Projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) in the Kubernetes docs for more details. @@ -64,7 +68,9 @@ command to SSH into the Docker Desktop K8s VM. ```bash docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh ``` + Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml` + ```yaml spec: containers: diff --git a/README.md b/README.md index 48077bd..ea0704a 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,7 @@ A suite of [Helm Charts](https://helm.sh/docs) for standardized installations of ## How to install or upgrade You most likely want to do an integrated setup based on the spire chart. -[Instructions](https://artifacthub.io/packages/helm/spiffe/spire) +See the [Instructions](https://artifacthub.io/packages/helm/spiffe/spire). ## Contributing diff --git a/charts/spire-crds/README.md b/charts/spire-crds/README.md index 7eb21c2..9f69df4 100644 --- a/charts/spire-crds/README.md +++ b/charts/spire-crds/README.md @@ -7,6 +7,7 @@ A Helm chart to install the SPIRE CRDS. **Homepage:** ## Maintainers + | Name | Email | Url | | ---- | ------ | --- | | marcofranssen | | | @@ -16,8 +17,8 @@ A Helm chart to install the SPIRE CRDS. ## Source Code -* +* - + ## Parameters diff --git a/charts/spire/README.md b/charts/spire/README.md index 2f203e2..a4756a1 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -36,7 +36,7 @@ For production installs, please see [the production example](https://github.com/ The spire-crds chart has been updated. Please ensure you have upgraded spire-crds before upgrading the spire chart. -The chart now supports multiple parallel installs of spire-controller-manager. Each install will handle all custom resources with a matching `className` field. By default this is set to `Release.Namespace-Release.Name` and the controller manager will only pick up custom resources with this `className`. +The chart now supports multiple parallel installs of spire-controller-manager. Each install will handle all custom resources with a matching `className` field. By default this is set to `Release.Namespace-Release.Name` and the controller manager will only pick up custom resources with this `className`. If you have not loaded any SPIRE custom resources yourself, the upgrade process will be transparent. If you have loaded your own SPIRE custom resources, set `spire-server.controllerManager.watchClassless=true` until you can update your SPIRE custom resources to have the `className` for the instance specified. @@ -62,7 +62,8 @@ helm install -n spire-server spire-crds charts/spire-crds ## Version support -> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`). +> [!Warning] +> This Chart is still in development and still subject to change the API (`values.yaml`). > Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although > we do aim for as much stability as possible. @@ -71,9 +72,11 @@ helm install -n spire-server spire-crds charts/spire-crds | Helm | `3.x` | | Kubernetes | `1.22+` | -> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. +> [!Note] +> For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. ## FAQ + For any issues see our [FAQ](../../FAQ.md)… ## Usage diff --git a/charts/spire/README.md.gotmpl b/charts/spire/README.md.gotmpl deleted file mode 100644 index 2ffb5e8..0000000 --- a/charts/spire/README.md.gotmpl +++ /dev/null @@ -1,75 +0,0 @@ -{{ template "chart.header" . }} - - - -{{ template "chart.deprecationWarning" . }} - -{{ template "chart.badgesSection" . }} -[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) - -{{ template "chart.description" . }} - -{{ template "chart.homepageLine" . }} - -## Version support - -> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`). -> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although -> we do aim for as much stability as possible. - -| Dependency | Supported Versions | -|:-----------|:-------------------| -| SPIRE | `1.8.4` | -| Helm | `3.x` | -| Kubernetes | `1.22+` | - -> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. - -## FAQ -For any issues see our [FAQ](../../FAQ.md)… - -## Usage - -To utilize Spire in your own workloads you should add the following to your workload: - -```diff - apiVersion: v1 - kind: Pod - metadata: - name: my-app - spec: - containers: - - name: my-app - image: "my-app:latest" - imagePullPolicy: Always -+ volumeMounts: -+ - name: spiffe-workload-api -+ mountPath: /spiffe-workload-api -+ readOnly: true - resources: - requests: - cpu: 200m - memory: 32Mi - limits: - cpu: 500m - memory: 64Mi -+ volumes: -+ - name: spiffe-workload-api -+ csi: -+ driver: "csi.spiffe.io" -+ readOnly: true -``` - -Now you can interact with the Spire agent socket from your own application. The socket is mounted on `/spiffe-workload-api/spire-agent.sock`. - -{{ template "chart.maintainersSection" . }} - -{{ template "chart.sourcesSection" . }} - -{{ template "chart.requirementsHeader" . }} - -{{ template "chart.requirementsTable" . }} - -{{ template "chart.valuesSection" . }} - ----------------------------------------------- diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index 1e1150d..2b2b115 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -1,14 +1,13 @@ # spiffe-csi-driver - - ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.2.3](https://img.shields.io/badge/AppVersion-0.2.3-informational?style=flat-square) A Helm chart to install the SPIFFE CSI driver. **Homepage:** -> **Note**: The recommended version is `0.2.3` to support arm64 nodes. If running with any +> [!Note] +> The recommended version is `0.2.3` to support arm64 nodes. If running with any > prior version to `0.2.3` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. ## Maintainers @@ -24,6 +23,8 @@ A Helm chart to install the SPIFFE CSI driver. * + + ## Parameters ### SPIFFE CSI Driver Chart parameters diff --git a/charts/spire/charts/spiffe-csi-driver/README.md.gotmpl b/charts/spire/charts/spiffe-csi-driver/README.md.gotmpl deleted file mode 100644 index 657bce3..0000000 --- a/charts/spire/charts/spiffe-csi-driver/README.md.gotmpl +++ /dev/null @@ -1,24 +0,0 @@ -{{ template "chart.header" . }} - - - -{{ template "chart.deprecationWarning" . }} - -{{ template "chart.badgesSection" . }} - -{{ template "chart.description" . }} - -{{ template "chart.homepageLine" . }} - -> **Note**: The recommended version is `0.2.3` to support arm64 nodes. If running with any -> prior version to `0.2.3` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. - -{{ template "chart.maintainersSection" . }} - -{{ template "chart.sourcesSection" . }} - -{{ template "chart.requirementsSection" . }} - -{{ template "chart.valuesSection" . }} - ----------------------------------------------- diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 968de3c..d5cbe79 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -1,14 +1,13 @@ # spiffe-oidc-discovery-provider - - ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) A Helm chart to install the SPIFFE OIDC discovery provider. **Homepage:** -> **Note**: Minimum Spire version is `1.5.3`. +> [!Note] +> Minimum Spire version is `1.5.3`. > The recommended version is `1.6.0` to support arm64 nodes. If running with any > prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. @@ -25,6 +24,8 @@ A Helm chart to install the SPIFFE OIDC discovery provider. * + + ## Parameters ### Chart parameters diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md.gotmpl b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md.gotmpl deleted file mode 100644 index f9dafb6..0000000 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md.gotmpl +++ /dev/null @@ -1,25 +0,0 @@ -{{ template "chart.header" . }} - - - -{{ template "chart.deprecationWarning" . }} - -{{ template "chart.badgesSection" . }} - -{{ template "chart.description" . }} - -{{ template "chart.homepageLine" . }} - -> **Note**: Minimum Spire version is `1.5.3`. -> The recommended version is `1.6.0` to support arm64 nodes. If running with any -> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. - -{{ template "chart.maintainersSection" . }} - -{{ template "chart.sourcesSection" . }} - -{{ template "chart.requirementsSection" . }} - -{{ template "chart.valuesSection" . }} - ----------------------------------------------- diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index ebdfa57..19bb438 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -9,10 +9,10 @@ global: {} ## @param agentSocketName The name of the spire-agent unix socket agentSocketName: spire-agent.sock -## @param replicaCount Replica count +## @param replicaCount Replica count replicaCount: 1 -## @param namespaceOverride Namespace override +## @param namespaceOverride Namespace override namespaceOverride: "" ## @param annotations [object] Annotations for the deployment @@ -250,7 +250,7 @@ ingress: # nginx.ingress.kubernetes.io/ssl-redirect: "true" # nginx.ingress.kubernetes.io/force-ssl-redirect: "true" - ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. + ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. host: "oidc-discovery" ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index d2a55e5..976eca7 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -1,14 +1,13 @@ # spire-agent - - ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) A Helm chart to install the SPIRE agent. **Homepage:** -> **Note**: Minimum Spire version is `1.5.3`. +> [!Note] +> Minimum Spire version is `1.5.3`. > The recommended version is `1.6.0` to support arm64 nodes. If running with any > prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. @@ -25,6 +24,8 @@ A Helm chart to install the SPIRE agent. * + + ## Parameters ### Chart parameters diff --git a/charts/spire/charts/spire-agent/README.md.gotmpl b/charts/spire/charts/spire-agent/README.md.gotmpl deleted file mode 100644 index f9dafb6..0000000 --- a/charts/spire/charts/spire-agent/README.md.gotmpl +++ /dev/null @@ -1,25 +0,0 @@ -{{ template "chart.header" . }} - - - -{{ template "chart.deprecationWarning" . }} - -{{ template "chart.badgesSection" . }} - -{{ template "chart.description" . }} - -{{ template "chart.homepageLine" . }} - -> **Note**: Minimum Spire version is `1.5.3`. -> The recommended version is `1.6.0` to support arm64 nodes. If running with any -> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. - -{{ template "chart.maintainersSection" . }} - -{{ template "chart.sourcesSection" . }} - -{{ template "chart.requirementsSection" . }} - -{{ template "chart.valuesSection" . }} - ----------------------------------------------- diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 8e9561a..5b2f44e 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -22,13 +22,13 @@ image: ## @param imagePullSecrets [array] Pull secrets for images imagePullSecrets: [] -## @param nameOverride Name override +## @param nameOverride Name override nameOverride: "" -## @param namespaceOverride Namespace override +## @param namespaceOverride Namespace override namespaceOverride: "" -## @param fullnameOverride Fullname override +## @param fullnameOverride Fullname override fullnameOverride: "" serviceAccount: diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 726bcb5..70c61d7 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -1,14 +1,13 @@ # spire-server - - ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) A Helm chart to install the SPIRE server. **Homepage:** -> **Note**: Minimum Spire version is `1.5.3`. +> [!Note] +> Minimum Spire version is `1.5.3`. > The recommended version is `1.6.0` to support arm64 nodes. If running with any > prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. > @@ -39,7 +38,8 @@ When Tornjak is enabled, it is exposed on both http and https (if TLS server cer In addition, you can configure a `client certificate authority`, this will make Tornjak backend verify Client certificates signed by this authority to enable mTLS authentication. -**Warning**: For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access. +> [!Important] +> For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access. ### Tornjak with TLS Connection Type @@ -47,13 +47,13 @@ TLS connection requires Tornjak to have access to TLS key and certificate. Complete instruction on creating your own TLS certificate can be found [here](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md). TLS Certificate and the private key must be provided to Tornjak via *TLS Secret*. Prior to deploying this Helm chart, create TLS Secret in the deployment namespace (e.g. `spire-server`) -```console +```shell kubectl -n spire-server create secret tls tornjak-tls-secret --cert=client.crt --key=client.key ``` Once the charts are deployed, you can test the TLS connection with the following command (assuming localhost): -```console +```shell curl --cacert CA/rootCA.crt https://localhost:10443 ``` @@ -67,13 +67,13 @@ Follow the steps to [create user CA for mTLS](https://github.com/spiffe/tornjak/ Here is an example using a *Secret* in `spire-server` namespace: -```console +```shell kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt" ``` Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost): -```console +```shell curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhost:10443 ``` @@ -81,6 +81,8 @@ curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhos In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above. + + ## Parameters ### Chart parameters @@ -271,48 +273,53 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` | | `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` | | `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` | -| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` | -| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` | -| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.4.0` | -| `tornjak.service.type` | Type of service resource | `ClusterIP` | -| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` | -| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` | -| `tornjak.service.annotations` | Annotations for the service | `{}` | -| `tornjak.ingress.enabled` | Flag to enable ingress for Tornjak backend service | `false` | -| `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` | -| `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | -| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` | -| `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` | -| `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | -| `tornjak.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | -| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | -| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` | -| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` | -| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` | -| `tornjak.startupProbe.successThreshold` | Success threshold count | `1` | -| `tornjak.startupProbe.timeoutSeconds` | Timeout in seconds | `5` | -| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | | -| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` | -| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` | -| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` | -| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` | -| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` | -| `tornjak.resources` | Resource requests and limits | `{}` | -| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` | -| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` | -| `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` | -| `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` | -| `experimental.enabled` | Allow configuration of experimental features | `false` | -| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | -| `experimental.featureFlags` | List of developer feature flags | `[]` | -| `tests.hostAliases` | List of host aliases for testing | `[]` | -| `tests.tls.enabled` | Flag for enabling tls for tests | `false` | -| `tests.tls.customCA` | Custom CA value for tests | `""` | -| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | -| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` | + +### Tornjak + +| Name | Description | Value | +| ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | +| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` | +| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` | +| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.4.0` | +| `tornjak.service.type` | Type of service resource | `ClusterIP` | +| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` | +| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` | +| `tornjak.service.annotations` | Annotations for the service | `{}` | +| `tornjak.ingress.enabled` | Flag to enable ingress for Tornjak backend service | `false` | +| `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` | +| `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | +| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` | +| `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` | +| `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `tornjak.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | +| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` | +| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` | +| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` | +| `tornjak.startupProbe.successThreshold` | Success threshold count | `1` | +| `tornjak.startupProbe.timeoutSeconds` | Timeout in seconds | `5` | +| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | | +| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` | +| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` | +| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` | +| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` | +| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` | +| `tornjak.resources` | Resource requests and limits | `{}` | +| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` | +| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` | +| `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` | +| `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` | +| `experimental.enabled` | Allow configuration of experimental features | `false` | +| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | +| `experimental.featureFlags` | List of developer feature flags | `[]` | +| `tests.hostAliases` | List of host aliases for testing | `[]` | +| `tests.tls.enabled` | Flag for enabling tls for tests | `false` | +| `tests.tls.customCA` | Custom CA value for tests | `""` | +| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | +| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 63c6647..c86bf00 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -212,7 +212,7 @@ federation: # If Profile Type == https_spiffe: # nginx.ingress.kubernetes.io/ssl-passthrough: "true" - ## @param federation.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. + ## @param federation.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. host: "spire-server-federation" ## @param federation.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. @@ -523,7 +523,7 @@ ingress: # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" # nginx.ingress.kubernetes.io/ssl-passthrough: "true" - ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. + ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. host: "spire-server" ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. @@ -570,7 +570,7 @@ nodeAttestor: ## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor serviceAccountAllowList: [] -# tornjak - Tornjak default values +## @section Tornjak tornjak: ## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production) enabled: false diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index c6cdd55..e8df4a2 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -1,7 +1,5 @@ # tornjak-frontend - - ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.2.2](https://img.shields.io/badge/AppVersion-v1.2.2-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) @@ -11,7 +9,8 @@ A Helm chart to deploy Tornjak frontend ## Version support -> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`). +> [!Note] +> This Chart is still in development and still subject to change the API (`values.yaml`). > Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although > we do aim for as much stability as possible. @@ -52,6 +51,8 @@ port forwarding. See the chart NOTES output for more details. * + + ## Parameters ### Chart parameters diff --git a/charts/spire/charts/tornjak-frontend/README.md.gotmpl b/charts/spire/charts/tornjak-frontend/README.md.gotmpl deleted file mode 100644 index c980a92..0000000 --- a/charts/spire/charts/tornjak-frontend/README.md.gotmpl +++ /dev/null @@ -1,54 +0,0 @@ -{{ template "chart.header" . }} - - - -{{ template "chart.deprecationWarning" . }} - -{{ template "chart.badgesSection" . }} -[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) - -{{ template "chart.description" . }} - -{{ template "chart.homepageLine" . }} - -## Version support - -> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`). -> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although -> we do aim for as much stability as possible. - -| Dependency | Supported Versions | -|:-----------|:-------------------| -| SPIRE | `1.5.3+`, `1.6.x` | -| Tornjak | `1.0.x` | -| Helm | `3.x` | - -## Tornjak - -Tornjak is the UI and Control Plane for SPIRE [https://github.com/spiffe/tornjak](https://github.com/spiffe/tornjak) and it is composed of two components: - -* [Backend](../spire-server/README.md) - Tornjak APIs that extend SPIRE APIs with Control Plane functionality -* Frontend (this chart) - Tornjak UI - -## Prerequisites - -This chart requires access to Tornjak Backend (`tornjakFrontend.apiServerURL`). -This URL needs to be reachable from your web browser and can therefore not be a cluster internal URL. - -Obtain the URL for Tornjak APIs. If deployed in the same cluster, locally, -Tornjak APIs are typically available at `http://localhost:10000`. -Review Tornjak documentation for more details. - -## Usage - -Since this is just a demo version, to access Tornjak APIs you can use -port forwarding. See the chart NOTES output for more details. - -{{ template "chart.maintainersSection" . }} - -{{ template "chart.sourcesSection" . }} - -{{ template "chart.requirementsSection" . }} - -{{ template "chart.valuesSection" . }} ----------------------------------------------- diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 6b204e4..34ddb7e 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -126,7 +126,7 @@ ingress: controllerType: "" annotations: {} - ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. + ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. host: "tornjak-frontend" ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. diff --git a/examples/openshift/README.md b/examples/openshift/README.md index da3d5b2..1e51815 100644 --- a/examples/openshift/README.md +++ b/examples/openshift/README.md @@ -1,6 +1,7 @@ # Recommended setup for installing Spire on Openshift -> **Note**: This functionality is under development. It works but has no automated testing and will have security tightened in the future. +> [!Note] +> This functionality is under development. It works but has no automated testing and will have security tightened in the future. This deployment works only with Openshift version 4.13 or higher. Get the Openshift platform here: [try.openshift.com](try.openshift.com) @@ -31,7 +32,8 @@ echo "$appdomain" Update the `example-your-values.yaml` file with your subdomain. -_Note: The location of the apps subdomain may be different in certain environments_ +> [!Note] +> The location of the apps subdomain may be different in certain environments_ ## Standard Deployment @@ -62,7 +64,8 @@ helm upgrade --install --namespace spire-server spire charts/spire \ Additional features such as tornjak can be enabled by including their example values files before --values examples/production/example-your-values.yaml For example: -``` + +```shell --values examples/openshift/openshift-values.yaml \ --values examples/tornjak/values.yaml \ --values examples/production/example-your-values.yaml \ @@ -71,6 +74,7 @@ For example: ## Finish install Once installed, the namespace security can be tightened back up. + ```shell kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted --overwrite ``` diff --git a/examples/production/README.md b/examples/production/README.md index a8561e6..2982094 100644 --- a/examples/production/README.md +++ b/examples/production/README.md @@ -28,21 +28,25 @@ If you want to expose your spire-server outside of Kubernetes and are using ingr ```shell -f values-expose-spire-server-ingress-nginx.yaml ``` + For example: + ```shell helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-spire-server-ingress-nginx.yaml ``` If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx you have two options as described here: -https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles +[github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles](https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles) If you chose profile https_web, use: ```shell -f values-expose-federation-https-web-ingress-nginx.yaml ``` + For example: + ```shell helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-web-ingress-nginx.yaml ``` @@ -52,10 +56,11 @@ If you chose profile https_spiffe, use: ```shell -f values-expose-federation-https-spiffe-ingress-nginx.yaml ``` + For example: + ```shell helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-spiffe-ingress-nginx.yaml ``` See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup. - diff --git a/examples/tornjak/README.md b/examples/tornjak/README.md index 913ccc8..cbe7418 100644 --- a/examples/tornjak/README.md +++ b/examples/tornjak/README.md @@ -1,6 +1,7 @@ # Recommended setup to deploy Tornjak -> **Warning**: The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production. +> [!Warning] +> The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production. To install Spire with the least privileges possible we deploy spire across 2 namespaces. diff --git a/helm-docs.sh b/helm-docs.sh index 91cc2bb..43bfde7 100755 --- a/helm-docs.sh +++ b/helm-docs.sh @@ -3,7 +3,7 @@ set -euo pipefail SCRIPTPATH=$(dirname "$0") -README_GENERATOR_VERSION="2.5.1" +README_GENERATOR_VERSION="2.6.0" README_GENERATOR_EXE="readme-generator" if ! hash "${README_GENERATOR_EXE}" 2>/dev/null; then diff --git a/release-chart.sh b/release-chart.sh index 54eedf2..ee856cd 100755 --- a/release-chart.sh +++ b/release-chart.sh @@ -117,7 +117,8 @@ git push -u origin --force-with-lease cat < **Note**: **Maintainers** ensure to run following after merging this PR to trigger the release workflow: +> [!Note] +> **Maintainers** ensure to run following after merging this PR to trigger the release workflow: > > \`\`\`shell > git checkout main From aaeca009c2d0cda5e239ba26617bcb1cb453a5a3 Mon Sep 17 00:00:00 2001 From: Kevin Fox Date: Wed, 8 Nov 2023 04:50:05 -0800 Subject: [PATCH 31/36] Fix tests after renaming files Signed-off-by: Kevin Fox --- examples/production/run-tests.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/examples/production/run-tests.sh b/examples/production/run-tests.sh index 5ad1764..5ef92b6 100755 --- a/examples/production/run-tests.sh +++ b/examples/production/run-tests.sh @@ -112,9 +112,9 @@ install_and_test() { "${helm_install[@]}" spire "$1" \ --namespace "${ns}" \ --values "${SCRIPTPATH}/values.yaml" \ - --values "${SCRIPTPATH}/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml" \ - --values "${SCRIPTPATH}/values-export-spire-server-ingress-nginx.yaml" \ - --values "${SCRIPTPATH}/values-export-federation-https-web-ingress-nginx.yaml" \ + --values "${SCRIPTPATH}/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml" \ + --values "${SCRIPTPATH}/values-expose-spire-server-ingress-nginx.yaml" \ + --values "${SCRIPTPATH}/values-expose-federation-https-web-ingress-nginx.yaml" \ --values /tmp/dummydns \ --set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \ --set spire-agent.server.address=spire-server.production.other,spire-agent.server.port=443 \ From 1de838e4999cbe7e0e5a8c3f7c16ee6cea042f0c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 8 Nov 2023 22:00:38 -0800 Subject: [PATCH 32/36] Bump helm.sh/helm/v3 from 3.13.1 to 3.13.2 in /tests (#91) --- tests/go.mod | 2 +- tests/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/go.mod b/tests/go.mod index e737d82..ff16a43 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -5,7 +5,7 @@ go 1.20 require ( github.com/onsi/ginkgo/v2 v2.13.0 github.com/onsi/gomega v1.29.0 - helm.sh/helm/v3 v3.13.1 + helm.sh/helm/v3 v3.13.2 ) require ( diff --git a/tests/go.sum b/tests/go.sum index c99db9c..cd67a83 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -205,8 +205,8 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -helm.sh/helm/v3 v3.13.1 h1:DG+XLGzBJeZvMLlMbm6bPDLV1dGaVW9eZsDoUd1/LM0= -helm.sh/helm/v3 v3.13.1/go.mod h1:TdQRMiq46CSWcc68Hb0uVhvAWusaN90YwAV54cz6JzU= +helm.sh/helm/v3 v3.13.2 h1:IcO9NgmmpetJODLZhR3f3q+6zzyXVKlRizKFwbi7K8w= +helm.sh/helm/v3 v3.13.2/go.mod h1:GIHDwZggaTGbedevTlrQ6DB++LBN6yuQdeGj0HNaDx0= k8s.io/api v0.28.2 h1:9mpl5mOb6vXZvqbQmankOfPIGiudghwCoLl1EYfUZbw= k8s.io/api v0.28.2/go.mod h1:RVnJBsjU8tcMq7C3iaRSGMeaKt2TWEUXcpIt/90fjEg= k8s.io/apiextensions-apiserver v0.28.2 h1:J6/QRWIKV2/HwBhHRVITMLYoypCoPY1ftigDM0Kn+QU= From de8cbc809fb9558aaa0645b255e79a79c29c6c35 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 9 Nov 2023 06:08:36 +0000 Subject: [PATCH 33/36] Bump github.com/onsi/gomega from 1.29.0 to 1.30.0 in /tests (#90) --- tests/go.mod | 2 +- tests/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/go.mod b/tests/go.mod index ff16a43..b6cc037 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -4,7 +4,7 @@ go 1.20 require ( github.com/onsi/ginkgo/v2 v2.13.0 - github.com/onsi/gomega v1.29.0 + github.com/onsi/gomega v1.30.0 helm.sh/helm/v3 v3.13.2 ) diff --git a/tests/go.sum b/tests/go.sum index cd67a83..693fb29 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -87,8 +87,8 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4= github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o= -github.com/onsi/gomega v1.29.0 h1:KIA/t2t5UBzoirT4H9tsML45GEbo3ouUnBHsCfD2tVg= -github.com/onsi/gomega v1.29.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ= +github.com/onsi/gomega v1.30.0 h1:hvMK7xYz4D3HapigLTeGdId/NcfQx1VHMJc60ew99+8= +github.com/onsi/gomega v1.30.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= From f2758a8b2b275daf90c2e3906f25b277707908df Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 9 Nov 2023 12:31:48 -0800 Subject: [PATCH 34/36] Autogen jwtIssuer (#88) * Autogen jwtIssuer Unset a default for jwtIssuer and global.spire.jwtIssuer. When unset, generate it to the default of oidc-discovery.$trustDomain so in many cases the user doesn't need to set it at all. Signed-off-by: Kevin Fox * Apply suggestions from code review Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix docs Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Mariusz Sabath Co-authored-by: Faisal Memon --- .../spire-root-server-values.yaml | 1 - charts/spire/README.md | 26 +++++++++---------- .../spiffe-oidc-discovery-provider/README.md | 2 +- .../values.yaml | 4 +-- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 4 +-- charts/spire/templates/_spire-lib.tpl | 4 ++- charts/spire/values.yaml | 4 +-- examples/production/example-your-values.yaml | 1 - 9 files changed, 24 insertions(+), 24 deletions(-) diff --git a/.github/tests/dependencies/spire-root-server-values.yaml b/.github/tests/dependencies/spire-root-server-values.yaml index 43c97d0..400a10c 100644 --- a/.github/tests/dependencies/spire-root-server-values.yaml +++ b/.github/tests/dependencies/spire-root-server-values.yaml @@ -2,7 +2,6 @@ global: spire: clusterName: production trustDomain: production.other - jwtIssuer: oidc-discovery.production.other spire-server: controllerManager: diff --git a/charts/spire/README.md b/charts/spire/README.md index a4756a1..4521238 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -144,19 +144,19 @@ Now you can interact with the Spire agent socket from your own application. The ### Global parameters -| Name | Description | Value | -| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` | -| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` | -| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` | -| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens | `oidc-discovery.example.org` | -| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` | -| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` | -| `global.spire.image.registry` | Override all Spire image registries at once | `""` | -| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` | -| `global.spire.ingressControllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | -| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | -| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | +| Name | Description | Value | +| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | +| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` | +| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` | +| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` | +| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset | `""` | +| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` | +| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` | +| `global.spire.image.registry` | Override all Spire image registries at once | `""` | +| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` | +| `global.spire.ingressControllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | +| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | +| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | ### Spire server parameters diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index d5cbe79..38d9e86 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -60,7 +60,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.2-alpine` | | `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | -| `jwtIssuer` | Path to JWT issuer | `https://oidc-discovery.example.org` | +| `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` | | `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | | `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` | | `config.acme.tosAccepted` | Flag for Terms of Service acceptance | `false` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 19bb438..9b47296 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -125,8 +125,8 @@ insecureScheme: # cpu: 100m # memory: 64Mi -## @param jwtIssuer Path to JWT issuer -jwtIssuer: https://oidc-discovery.example.org +## @param jwtIssuer Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset +jwtIssuer: "" config: ## @param config.logLevel The log level, valid values are "debug", "info", "warn", and "error" diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 70c61d7..4bf91ec 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -142,7 +142,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `dataStore.sql.externalSecret.name` | The name of the secret object | `""` | | `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` | | `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | -| `jwtIssuer` | The JWT issuer domain | `https://oidc-discovery.example.org` | +| `jwtIssuer` | The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset | `""` | | `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` | | `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | | `bundleConfigMap` | Set the trust domain to be used for the SPIFFE identifiers | `spire-bundle` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index c86bf00..80315fa 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -174,8 +174,8 @@ dataStore: ## @param logLevel The log level, valid values are "debug", "info", "warn", and "error" logLevel: info -## @param jwtIssuer The JWT issuer domain -jwtIssuer: https://oidc-discovery.example.org +## @param jwtIssuer The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset +jwtIssuer: "" ## @param clusterName Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) clusterName: example-cluster diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/templates/_spire-lib.tpl index ced7001..2208abe 100644 --- a/charts/spire/templates/_spire-lib.tpl +++ b/charts/spire/templates/_spire-lib.tpl @@ -17,8 +17,10 @@ {{- define "spire-lib.jwt-issuer" }} {{- if ne (len (dig "spire" "jwtIssuer" "" .Values.global)) 0 }} {{- .Values.global.spire.jwtIssuer }} -{{- else }} +{{- else if ne (len .Values.jwtIssuer) 0 }} {{- .Values.jwtIssuer }} +{{- else }} +{{- printf "oidc-discovery.%s" (include "spire-lib.trust-domain" .) }} {{- end }} {{- end }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 23f47ba..77e769c 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -13,8 +13,8 @@ global: bundleConfigMap: "" ## @param global.spire.clusterName The name of the k8s cluster for Spire install clusterName: example-cluster - ## @param global.spire.jwtIssuer The issuer for Spire JWT tokens - jwtIssuer: oidc-discovery.example.org + ## @param global.spire.jwtIssuer The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset + jwtIssuer: "" ## @param global.spire.trustDomain The trust domain for Spire install trustDomain: example.org ## @param global.spire.upstreamServerAddress Set what address to use for the upstream server when using nested spire diff --git a/examples/production/example-your-values.yaml b/examples/production/example-your-values.yaml index 67eaaed..ee92f79 100644 --- a/examples/production/example-your-values.yaml +++ b/examples/production/example-your-values.yaml @@ -2,7 +2,6 @@ global: spire: clusterName: production trustDomain: production.other - jwtIssuer: oidc-discovery.production.other spire-server: ca_subject: From 6c0a4fbb86e922528fc316ac5218be496c18e110 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 9 Nov 2023 13:07:52 -0800 Subject: [PATCH 35/36] Auto tornjak url (#89) * Autogen jwtIssuer Unset a default for jwtIssuer and global.spire.jwtIssuer. When unset, generate it to the default of oidc-discovery.$trustDomain so in many cases the user doesn't need to set it at all. Signed-off-by: Kevin Fox * Autogen tornjak's apiServerURL Unset the default tornjak apiServerURL. When unset, default to https://tornjak-backend.$trustDomain so in many cases users don't have to set it. Signed-off-by: Kevin Fox * Do more autodetection Signed-off-by: Kevin Fox * Apply suggestions from code review Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix docs Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Mariusz Sabath Co-authored-by: Faisal Memon --- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/templates/_helpers.tpl | 5 +++-- charts/spire/charts/tornjak-frontend/values.yaml | 4 ++-- examples/production/example-your-values.yaml | 4 ---- examples/tornjak/values.yaml | 1 - 5 files changed, 6 insertions(+), 10 deletions(-) diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index e8df4a2..38239d4 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -81,7 +81,7 @@ port forwarding. See the chart NOTES output for more details. | `affinity` | Affinity rules | `{}` | | `tolerations` | List of tolerations | `[]` | | `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` | -| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. | `http://localhost:10000/` | +| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If unset, autodetection is atempted. | `""` | | `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` | | `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` | | `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | diff --git a/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl b/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl index 0dadaeb..fd7a92b 100644 --- a/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl +++ b/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl @@ -78,8 +78,9 @@ Create URL for accessing Tornjak APIs {{- define "tornjak-frontend.apiURL" -}} {{- if .Values.apiServerURL -}} {{- .Values.apiServerURL -}} +{{- else if .Values.ingress.enabled }} +{{- printf "https://tornjak-backend.%s" (include "spire-lib.trust-domain" .) }} {{- else }} -{{- $feurl := print "http://localhost:" .Values.service.port }} -{{- $feurl }} +{{- print "http://localhost:" .Values.service.port }} {{- end }} {{- end }} diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 34ddb7e..7917df4 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -88,8 +88,8 @@ topologySpreadConstraints: [] # cpu: 100m # memory: 512Mi -## @param apiServerURL URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. -apiServerURL: "http://localhost:10000/" # 👈 Use it for minikube or kind +## @param apiServerURL URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If unset, autodetection is atempted. +apiServerURL: "" # SPIRE Healthchecker indicator spireHealthCheck: diff --git a/examples/production/example-your-values.yaml b/examples/production/example-your-values.yaml index ee92f79..7c3a830 100644 --- a/examples/production/example-your-values.yaml +++ b/examples/production/example-your-values.yaml @@ -20,7 +20,3 @@ spire-server: # ingress: # host: oidc-discovery # tlsSecret: tls-cert - -tornjak-frontend: - apiServerURL: https://tornjak-backend.production.other/ - diff --git a/examples/tornjak/values.yaml b/examples/tornjak/values.yaml index a407265..6ba0015 100644 --- a/examples/tornjak/values.yaml +++ b/examples/tornjak/values.yaml @@ -7,7 +7,6 @@ tornjak-frontend: service: type: ClusterIP port: 3000 - apiServerURL: "http://localhost:10000/" resources: requests: cpu: 50m From 06d8cd2ae5ba7c97c56df0bb37f982fcf9d4a6b3 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Thu, 9 Nov 2023 13:10:16 -0800 Subject: [PATCH 36/36] Bump spire Helm Chart version from 0.14.0 to 0.15.0 * 6c0a4fb Auto tornjak url (#89) * f2758a8 Autogen jwtIssuer (#88) * 93c20c6 Merge pull request #83 from spiffe/doc-ingress-patch * c662b0c Merge branch 'main' into doc-ingress-patch * de8cbc8 Bump github.com/onsi/gomega from 1.29.0 to 1.30.0 in /tests (#90) * 1de838e Bump helm.sh/helm/v3 from 3.13.1 to 3.13.2 in /tests (#91) * daf9d55 Merge branch 'main' into doc-ingress-patch * aaeca00 Fix tests after renaming files * 0320c3f Cleanup documentation * 37cd9f2 Update to SPIRE 1.8.4 (#84) * bd7879a Fix the typo in the production ingress README * 805d869 spire-controller-manager 0.4.0 support (#60) * edf2381 Bump sigstore/cosign-installer from 3.1.2 to 3.2.0 (#85) * 0ed6d92 Bump test chart dependencies * f7b6140 Fix docs * a7e8785 Add another missing one * 3778597 Add missing ClusterSPIFFEID fields * 9b31f3d Bump helm/chart-testing-action from 2.6.0 to 2.6.1 * d6583be Add missing no cleanup flags to example tests (#79) * 81cc2dc Ingress type openshift (#52) * 2dce90f Bump helm/chart-releaser-action from 1.5.0 to 1.6.0 (#75) * f08ebd3 Patch Tornjak ingress (#74) * 6a6aa1c Cosign download fix (#72) * 3b01684 Support Openshift deployment (#13) * ed23d8b Simple ingress support (#48) * b354413 Fix incorrect nesting of priorityClassName (#67) * 09ebfc9 Bump test chart dependencies (#68) * d50d78d Fix ingress annotation variable for tornjak server (#66) * b813807 Update docs to simplify, clarify, and prioritize ease of install/upgrade (#62) * 5ad35bd Merge pull request #59 from sabre1041/spire-agent-nodename * 02d445c Update charts/spire/README.md * 9bd7f43 Added environment variable to spire-agent to inject node name * fb64f8d Bump github.com/onsi/gomega from 1.28.1 to 1.29.0 in /tests (#61) * 30d0f59 Update helm-charts repository URL (#58) * 7924323 Specify ingress controller type (#43) * 0b17434 Bump test chart dependencies (#54) * a419903 Bump github.com/onsi/gomega from 1.28.0 to 1.28.1 in /tests (#53) * 5025025 Fix doc missing end tag (#46) * cf226a7 Bump actions/checkout from 4.1.0 to 4.1.1 (#42) Signed-off-by: Faisal Memon --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index eb46d46..188efc3 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -3,7 +3,7 @@ name: spire description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.14.0 +version: 0.15.0 appVersion: "1.8.4" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire diff --git a/charts/spire/README.md b/charts/spire/README.md index 4521238..9d62bfc 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.14.0](https://img.shields.io/badge/Version-0.13.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) +![Version: 0.15.0](https://img.shields.io/badge/Version-0.13.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. @@ -42,7 +42,7 @@ If you have not loaded any SPIRE custom resources yourself, the upgrade process ### 0.14.X -If coming from a chart version before 0.14.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart +If coming from a chart version before 0.15.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart run the following: Replace the spire-server namespace in the commands below with the namespace you want to install the spire-crds chart in.