panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'main' into release

Browse Source
This commit is contained in:
Faisal Memon
2023-11-09 14:22:14 -08:00
parent e458ca371f 06d8cd2ae5
commit 2108f80f48
88 changed files with 1377 additions and 869 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/tests/charts.json
+5 -5
View File
@@ -2,26 +2,26 @@
{ {
"name": "kube-prometheus-stack", "name": "kube-prometheus-stack",
"repo": "https://prometheus-community.github.io/helm-charts", "repo": "https://prometheus-community.github.io/helm-charts",
"version": "51.8.0" "version": "52.1.0"
}, },
{ {
"name": "cert-manager", "name": "cert-manager",
"repo": "https://charts.jetstack.io", "repo": "https://charts.jetstack.io",
"version": "v1.13.1" "version": "v1.13.2"
}, },
{ {
"name": "ingress-nginx", "name": "ingress-nginx",
"repo": "https://kubernetes.github.io/ingress-nginx", "repo": "https://kubernetes.github.io/ingress-nginx",
"version": "4.8.2" "version": "4.8.3"
}, },
{ {
"name": "mysql", "name": "mysql",
"repo": "https://charts.bitnami.com/bitnami", "repo": "https://charts.bitnami.com/bitnami",
"version": "9.12.5" "version": "9.14.1"
}, },
{ {
"name": "postgresql", "name": "postgresql",
"repo": "https://charts.bitnami.com/bitnami", "repo": "https://charts.bitnami.com/bitnami",
"version": "13.1.5" "version": "13.2.1"
} }
] ]
.github/tests/common.sh
+2
View File
@@ -1,5 +1,7 @@
#!/usr/bin/env bash #!/usr/bin/env bash
GITHUB_STEP_SUMMARY="${GITHUB_STEP_SUMMARY:-/tmp/summary}"
get_namespace_details () { get_namespace_details () {
cat <<EOF >>"$GITHUB_STEP_SUMMARY" cat <<EOF >>"$GITHUB_STEP_SUMMARY"
### Namespace $1 ### Namespace $1
.github/tests/dependencies/spire-root-server-values.yaml
+8 -2
View File
@@ -2,11 +2,17 @@ global:
spire: spire:
clusterName: production clusterName: production
trustDomain: production.other trustDomain: production.other
jwtIssuer: oidc-discovery.production.other
spire-server: spire-server:
controllerManager: controllerManager:
enabled: false identities:
namespaceSelector:
kubernetes.io/metadata.name: spire-server
podSelector:
app.kubernetes.io/component: server
app.kubernetes.io/instance: spire
app.kubernetes.io/name: server
downstream: true
nodeAttestor: nodeAttestor:
k8sPsat: k8sPsat:
serviceAccountAllowList: serviceAccountAllowList:
.github/workflows/check-versions.yaml
+1 -1
View File
@@ -20,7 +20,7 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/[email protected].0 uses: actions/[email protected].1
- name: Set up Helm - name: Set up Helm
uses: azure/[email protected] uses: azure/[email protected]
.github/workflows/helm-chart-ci-ignore.yaml
+1 -1
View File
@@ -43,7 +43,7 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/[email protected].0 uses: actions/[email protected].1
- id: set-matrix - id: set-matrix
name: Collect all examples name: Collect all examples
.github/workflows/helm-chart-ci.yaml
+8 -8
View File
@@ -32,7 +32,7 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/[email protected].0 uses: actions/[email protected].1
- name: Verify Docs updated - name: Verify Docs updated
run: ./helm-docs.sh run: ./helm-docs.sh
@@ -94,7 +94,7 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/[email protected].0 uses: actions/[email protected].1
with: with:
fetch-depth: 0 fetch-depth: 0
@@ -109,7 +109,7 @@ jobs:
python-version: ${{ env.PYTHON_VERSION }} python-version: ${{ env.PYTHON_VERSION }}
- name: Setup chart-testing - name: Setup chart-testing
uses: helm/chart-testing-action@v2.4.0 uses: helm/chart-testing-action@v2.6.1
with: with:
version: ${{ env.CHART_TESTING_VERSION }} version: ${{ env.CHART_TESTING_VERSION }}
@@ -136,7 +136,7 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/[email protected].0 uses: actions/[email protected].1
with: with:
fetch-depth: 0 fetch-depth: 0
@@ -151,7 +151,7 @@ jobs:
python-version: ${{ env.PYTHON_VERSION }} python-version: ${{ env.PYTHON_VERSION }}
- name: Setup chart-testing - name: Setup chart-testing
uses: helm/chart-testing-action@v2.4.0 uses: helm/chart-testing-action@v2.6.1
with: with:
version: ${{ env.CHART_TESTING_VERSION }} version: ${{ env.CHART_TESTING_VERSION }}
@@ -185,7 +185,7 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/[email protected].0 uses: actions/[email protected].1
- id: set-matrix - id: set-matrix
name: Collect all examples name: Collect all examples
@@ -217,7 +217,7 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/[email protected].0 uses: actions/[email protected].1
- name: Set up Helm - name: Set up Helm
uses: azure/[email protected] uses: azure/[email protected]
@@ -261,7 +261,7 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/[email protected].0 uses: actions/[email protected].1
- name: Set up Helm - name: Set up Helm
uses: azure/[email protected] uses: azure/[email protected]
.github/workflows/helm-release.yaml
+3 -3
View File
@@ -19,7 +19,7 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/[email protected].0 uses: actions/[email protected].1
with: with:
fetch-depth: 0 fetch-depth: 0
@@ -29,7 +29,7 @@ jobs:
git config user.email "[email protected]" git config user.email "[email protected]"
- name: Setup cosign - name: Setup cosign
uses: sigstore/cosign-installer@v3.1.2 uses: sigstore/cosign-installer@v3.2.0
with: with:
cosign-release: v2.2.0 cosign-release: v2.2.0
@@ -39,7 +39,7 @@ jobs:
version: v3.10.3 version: v3.10.3
- name: Run chart-releaser - name: Run chart-releaser
uses: helm/chart-releaser-action@v1.5.0 uses: helm/chart-releaser-action@v1.6.0
env: env:
CR_TOKEN: '${{ secrets.GITHUB_TOKEN }}' CR_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
.github/workflows/shellcheck.yaml
+1 -1
View File
@@ -21,7 +21,7 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/[email protected].0 uses: actions/[email protected].1
- name: Run Shellcheck - name: Run Shellcheck
uses: ludeeus/[email protected] uses: ludeeus/[email protected]
CODE-OF-CONDUCT.md
+3 -3
View File
@@ -1,8 +1,8 @@
### Contributor Code of Conduct # Contributor Code of Conduct
We follow the [CNCF Contributor Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md). Additionally, we commit to the following guidelines as detailed on the [Linkerd Code of Conduct](https://github.com/linkerd/linkerd/wiki/Linkerd-code-of-conduct): We follow the [CNCF Contributor Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md). Additionally, we commit to the following guidelines as detailed on the [Linkerd Code of Conduct](https://github.com/linkerd/linkerd/wiki/Linkerd-code-of-conduct):
### Community Guidelines ## Community Guidelines
- Our goal is to foster an inclusive and diverse community of technology enthusiasts. - Our goal is to foster an inclusive and diverse community of technology enthusiasts.
@@ -14,6 +14,6 @@ We follow the [CNCF Contributor Code of Conduct](https://github.com/cncf/foundat
- We do our best to avoid [subtle-isms](https://www.recurse.com/manual#sub-sec-social-rules): small actions that make others feel uncomfortable. If you witness a subtle-ism, you may respectfully point it out to the person publicly or privately, or you may ask a moderator to say something. Accidentally saying something biased is common, expected, and readily forgiven. It is not in and of itself a bannable offense. - We do our best to avoid [subtle-isms](https://www.recurse.com/manual#sub-sec-social-rules): small actions that make others feel uncomfortable. If you witness a subtle-ism, you may respectfully point it out to the person publicly or privately, or you may ask a moderator to say something. Accidentally saying something biased is common, expected, and readily forgiven. It is not in and of itself a bannable offense.
### Moderation ## Moderation
- If you feel any of SPIFFE's communication channels require moderation, please e-mail the [SPIFFE Steering Committee (SSC)](mailto:[email protected]). - If you feel any of SPIFFE's communication channels require moderation, please e-mail the [SPIFFE Steering Committee (SSC)](mailto:[email protected]).
CONTRIBUTING.md
+3 -2
View File
@@ -38,7 +38,8 @@ git rebase main
Our CI pipeline takes care of the majority of the testing of this Chart. Other ways for you to test are by running `make test` locally using: Our CI pipeline takes care of the majority of the testing of this Chart. Other ways for you to test are by running `make test` locally using:
> **Warning**: Ensure to run the test on a dedicated k8s cluster that does not have Spire installed yet. > [!Warning]
> Ensure to run the test on a dedicated k8s cluster that does not have Spire installed yet.
```shell ```shell
make test make test
@@ -48,7 +49,7 @@ Another approach to testing the chart is by installing one of the examples in yo
## Generating documentation ## Generating documentation
Any changes to Chart.yaml or values.yaml require an update of the README.md. This update can easily be generated using [readme-generator](https://github.com/bitnami-labs/readme-generator-for-helm). Any changes to Chart.yaml or values.yaml require an update of the README.md. This update can easily be generated using [readme-generator][].
```shell ```shell
./helm-docs.sh ./helm-docs.sh
FAQ.md
+9 -3
View File
@@ -36,7 +36,8 @@ helm repo add spiffe https://spiffe.github.io/helm-charts-hardened
If you uninstall the SPIRE chart before all users of the CSI driver are removed, Pods will get stuck in a terminating state waiting for the driver, that no longer is installed, to unmount the volumes for the Pod. In order to fix this, reinstall the chart and remove all affected workloads that are not part of the SPIRE helm chart itself, before attempting to remove SPIRE again. If you uninstall the SPIRE chart before all users of the CSI driver are removed, Pods will get stuck in a terminating state waiting for the driver, that no longer is installed, to unmount the volumes for the Pod. In order to fix this, reinstall the chart and remove all affected workloads that are not part of the SPIRE helm chart itself, before attempting to remove SPIRE again.
You can discover Pods that use the driver with the following command: You can discover Pods that use the driver with the following command:
```
```shell
kubectl get pods --all-namespaces -o go-template='{{range .items}}{{$nn := printf "%s %s" .metadata.namespace .metadata.name}}{{range .spec.volumes}}{{if .csi.driver}}{{if eq .csi.driver "csi.spiffe.io"}}{{printf "%s\n" $nn}}{{end}}{{end}}{{end}}{{end}}' kubectl get pods --all-namespaces -o go-template='{{range .items}}{{$nn := printf "%s %s" .metadata.namespace .metadata.name}}{{range .spec.volumes}}{{if .csi.driver}}{{if eq .csi.driver "csi.spiffe.io"}}{{printf "%s\n" $nn}}{{end}}{{end}}{{end}}{{end}}'
``` ```
@@ -44,17 +45,20 @@ kubectl get pods --all-namespaces -o go-template='{{range .items}}{{$nn := print
If you uninstall the SPIFFE CSI driver manually before removing the chart, Pods can still be using the driver and are unable to unmount the CSI volume. If you uninstall the SPIFFE CSI driver manually before removing the chart, Pods can still be using the driver and are unable to unmount the CSI volume.
To resolve, reinstall the chart before trying to remove it again. To resolve, reinstall the chart before trying to remove it again.
## The PSAT plugin is not working ## The PSAT plugin is not working
The chart requires `Projected Service Account Tokens` which has to be enabled on your Kubernetes API server. In most cases this is already done for you. The chart requires `Projected Service Account Tokens` which has to be enabled on your Kubernetes API server. In most cases this is already done for you.
> **Note**: This is enabled by default with newer versions as shown by the existence of: > [!Note]
> This is enabled by default with newer versions as shown by the existence of:
> >
> ```yaml
> - --service-account-issuer > - --service-account-issuer
> - --service-account-key-file > - --service-account-key-file
> - --service-account-signing-key-file > - --service-account-signing-key-file
> ```
See [Service Account Token Volume Projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) in the Kubernetes docs for more details. See [Service Account Token Volume Projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) in the Kubernetes docs for more details.
@@ -64,7 +68,9 @@ command to SSH into the Docker Desktop K8s VM.
```bash ```bash
docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh
``` ```
Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml` Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml`
```yaml ```yaml
spec: spec:
containers: containers:
README.md
+7 -18
View File
@@ -1,4 +1,7 @@
> **Note**: All the helm charts in this repo are beta. We encourage you to try them out and contribute. The API may change as we move towards a production ready release. > [!Note]
> Things to consider:
> 1. We do not support running out of the git main branch. This is where development happens. Please use released versions via the published repo or git tags.
> 2. All the helm charts in this repo are beta. We encourage you to try them out and contribute. The API may change as we move towards a production ready release.
# SPIFFE Helm Charts # SPIFFE Helm Charts
@@ -8,24 +11,10 @@
A suite of [Helm Charts](https://helm.sh/docs) for standardized installations of SPIRE components in Kubernetes environments. A suite of [Helm Charts](https://helm.sh/docs) for standardized installations of SPIRE components in Kubernetes environments.
## Add Helm repository ## How to install or upgrade
```bash You most likely want to do an integrated setup based on the spire chart.
helm repo add spiffe https://spiffe.github.io/helm-charts/ See the [Instructions](https://artifacthub.io/packages/helm/spiffe/spire).
helm repo update
```
## Dependencies and Version Compatibility
Unless otherwise noted in an application chart README, the following dependencies will follow these prescribed version compatibility rules.
| Dependency | Supported Versions |
|:-----------|:-------------------|
| SPIRE | `1.8.2` |
| Helm | `3.x` |
| Kubernetes | `1.22+` |
> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. *The first version we tested this chart with is `1.22`.*
## Contributing ## Contributing
charts/spire-crds/README.md
+3 -2
View File
@@ -7,6 +7,7 @@ A Helm chart to install the SPIRE CRDS.
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire> **Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
## Maintainers ## Maintainers
| Name | Email | Url | | Name | Email | Url |
| ---- | ------ | --- | | ---- | ------ | --- |
| marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> | | marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
@@ -16,8 +17,8 @@ A Helm chart to install the SPIRE CRDS.
## Source Code ## Source Code
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire> * <https://github.com/spiffe/helm-charts/tree/main/charts/spire-crds>
<!-- The Parameters section is generated using helm-docs.sh --> <!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
## Parameters ## Parameters
charts/spire-crds/templates/spire.spiffe.io_clusterfederatedtrustdomains.yaml
+9
View File
@@ -65,6 +65,9 @@ spec:
description: BundleEndpointURL is the URL of the bundle endpoint. description: BundleEndpointURL is the URL of the bundle endpoint.
It must be an HTTPS URL and cannot contain userinfo (i.e. username/password). It must be an HTTPS URL and cannot contain userinfo (i.e. username/password).
type: string type: string
className:
description: Set the class of controller to handle this object.
type: string
trustDomain: trustDomain:
description: TrustDomain is the name of the trust domain to federate description: TrustDomain is the name of the trust domain to federate
with (e.g. example.org) with (e.g. example.org)
@@ -89,3 +92,9 @@ spec:
storage: true storage: true
subresources: subresources:
status: {} status: {}
status:
acceptedNames:
kind: ""
plural: ""
conditions: []
storedVersions: []
charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml
+13
View File
@@ -41,6 +41,10 @@ spec:
access the SPIRE administrative APIs. Extra care should be taken access the SPIRE administrative APIs. Extra care should be taken
to only apply this SPIFFE ID to admin workloads. to only apply this SPIFFE ID to admin workloads.
type: boolean type: boolean
autoPopulateDNSNames:
description: AutoPopulateDNSNames indicates whether or not to auto
populate service DNS names.
type: boolean
dnsNameTemplates: dnsNameTemplates:
description: DNSNameTemplate represents templates for extra DNS names description: DNSNameTemplate represents templates for extra DNS names
that are applicable to SVIDs minted for this ClusterSPIFFEID. The that are applicable to SVIDs minted for this ClusterSPIFFEID. The
@@ -53,6 +57,9 @@ spec:
description: Downstream indicates that the entry describes a downstream description: Downstream indicates that the entry describes a downstream
SPIRE server. SPIRE server.
type: boolean type: boolean
className:
description: Set the class of controller to handle this object.
type: string
federatesWith: federatesWith:
description: FederatesWith is a list of trust domain names that workloads description: FederatesWith is a list of trust domain names that workloads
that obtain this SPIFFE ID will federate with. that obtain this SPIFFE ID will federate with.
@@ -224,3 +231,9 @@ spec:
storage: true storage: true
subresources: subresources:
status: {} status: {}
status:
acceptedNames:
kind: ""
plural: ""
conditions: []
storedVersions: []
charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml
+9
View File
@@ -39,6 +39,9 @@ spec:
properties: properties:
admin: admin:
type: boolean type: boolean
className:
description: Set the class of controller to handle this object.
type: string
dnsNames: dnsNames:
items: items:
type: string type: string
@@ -90,3 +93,9 @@ spec:
storage: true storage: true
subresources: subresources:
status: {} status: {}
status:
acceptedNames:
kind: ""
plural: ""
conditions: []
storedVersions: []
charts/spire/Chart.yaml
+2 -2
View File
@@ -3,8 +3,8 @@ name: spire
description: > description: >
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
type: application type: application
version: 0.14.0 version: 0.15.0
appVersion: "1.8.2" appVersion: "1.8.4"
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
sources: sources:
charts/spire/README.md
+72 -49
View File
@@ -1,27 +1,82 @@
# spire # spire
![Version: 0.14.0](https://img.shields.io/badge/Version-0.13.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) ![Version: 0.15.0](https://img.shields.io/badge/Version-0.13.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire> **Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
## Install notes
To do a quick non production install suitable for quick testing in something like minikube:
```shell
helm install -n spire-server spire-crds --repo https://spiffe.github.io/helm-charts-hardened/ --create-namespace
helm install -n spire-server spire --repo https://spiffe.github.io/helm-charts-hardened/
```
To customize, start with a base values file and edit as needed:
```shell
curl -o your-values.yaml https://raw.githubusercontent.com/spiffe/helm-charts-hardened/main/examples/production/example-your-values.yaml
```
Then:
```shell
helm install -n spire-server spire --repo https://spiffe.github.io/helm-charts-hardened/ -f your-values.yaml
```
For production installs, please see [the production example](https://github.com/spiffe/helm-charts-hardened/tree/main/examples/production).
## Upgrade notes
### 0.15.X
The spire-crds chart has been updated. Please ensure you have upgraded spire-crds before upgrading the spire chart.
The chart now supports multiple parallel installs of spire-controller-manager. Each install will handle all custom resources with a matching `className` field. By default this is set to `Release.Namespace-Release.Name` and the controller manager will only pick up custom resources with this `className`.
If you have not loaded any SPIRE custom resources yourself, the upgrade process will be transparent. If you have loaded your own SPIRE custom resources, set `spire-server.controllerManager.watchClassless=true` until you can update your SPIRE custom resources to have the `className` for the instance specified.
### 0.14.X
If coming from a chart version before 0.15.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart
run the following:
Replace the spire-server namespace in the commands below with the namespace you want to install the spire-crds chart in.
```shell
kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
helm install -n spire-server spire-crds charts/spire-crds
```
## Version support ## Version support
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`). > [!Warning]
> This Chart is still in development and still subject to change the API (`values.yaml`).
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although > Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
> we do aim for as much stability as possible. > we do aim for as much stability as possible.
| Dependency | Supported Versions | | Dependency | Supported Versions |
|:-----------|:-------------------| |:-----------|:-------------------|
| SPIRE | `1.5.3+`, `1.6.3+` |
| Helm | `3.x` | | Helm | `3.x` |
| Kubernetes | `1.22+` | | Kubernetes | `1.22+` |
> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. > [!Note]
> For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden.
## FAQ ## FAQ
For any issues see our [FAQ](../../FAQ.md)… For any issues see our [FAQ](../../FAQ.md)…
## Usage ## Usage
@@ -83,57 +138,25 @@ Now you can interact with the Spire agent socket from your own application. The
| file://./charts/spire-server | spire-server | 0.1.0 | | file://./charts/spire-server | spire-server | 0.1.0 |
| file://./charts/tornjak-frontend | tornjak-frontend | 0.1.0 | | file://./charts/tornjak-frontend | tornjak-frontend | 0.1.0 |
## Install notes
To do a quick non production install:
```shell
kubectl create namespace spire-system
helm install -n spire-system spire-crds charts/spire-crds
helm install -n spire-system spire charts/spire
For production installs, please see [the production example](examples/production/).
## Upgrade notes
0.14.X:
If coming from a chart version before 0.14.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart
run the following:
```shell
# Replace the spire-server namespace in the commands below with the namespace you want to install the spire-crds chart in.
kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
helm install -n spire-server spire-crds charts/spire-crds
```
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. --> <!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
## Parameters ## Parameters
### Global parameters ### Global parameters
| Name | Description | Value | | Name | Description | Value |
| --------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ---------------------------- | | --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- |
| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` | | `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` |
| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` | | `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` |
| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` | | `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` |
| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens | `oidc-discovery.example.org` | | `global.spire.jwtIssuer` | The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset | `""` |
| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` | | `global.spire.trustDomain` | The trust domain for Spire install | `example.org` |
| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` | | `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` |
| `global.spire.image.registry` | Override all Spire image registries at once | `""` | | `global.spire.image.registry` | Override all Spire image registries at once | `""` |
| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` | | `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` |
| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | | `global.spire.ingressControllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | | `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
### Spire server parameters ### Spire server parameters
charts/spire/README.md.gotmpl
-75
View File
@@ -1,75 +0,0 @@
{{ template "chart.header" . }}
<!-- This README.md is generated. Please edit README.md.gotmpl -->
{{ template "chart.deprecationWarning" . }}
{{ template "chart.badgesSection" . }}
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
{{ template "chart.description" . }}
{{ template "chart.homepageLine" . }}
## Version support
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
> we do aim for as much stability as possible.
| Dependency | Supported Versions |
|:-----------|:-------------------|
| SPIRE | `1.5.3+`, `1.6.3+` |
| Helm | `3.x` |
| Kubernetes | `1.22+` |
> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden.
## FAQ
For any issues see our [FAQ](../../FAQ.md)…
## Usage
To utilize Spire in your own workloads you should add the following to your workload:
```diff
apiVersion: v1
kind: Pod
metadata:
name: my-app
spec:
containers:
- name: my-app
image: "my-app:latest"
imagePullPolicy: Always
+ volumeMounts:
+ - name: spiffe-workload-api
+ mountPath: /spiffe-workload-api
+ readOnly: true
resources:
requests:
cpu: 200m
memory: 32Mi
limits:
cpu: 500m
memory: 64Mi
+ volumes:
+ - name: spiffe-workload-api
+ csi:
+ driver: "csi.spiffe.io"
+ readOnly: true
```
Now you can interact with the Spire agent socket from your own application. The socket is mounted on `/spiffe-workload-api/spire-agent.sock`.
{{ template "chart.maintainersSection" . }}
{{ template "chart.sourcesSection" . }}
{{ template "chart.requirementsHeader" . }}
{{ template "chart.requirementsTable" . }}
{{ template "chart.valuesSection" . }}
----------------------------------------------
charts/spire/charts/spiffe-csi-driver/README.md
+43 -37
View File
@@ -1,14 +1,13 @@
# spiffe-csi-driver # spiffe-csi-driver
<!-- This README.md is generated. Please edit README.md.gotmpl -->
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.2.3](https://img.shields.io/badge/AppVersion-0.2.3-informational?style=flat-square) ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.2.3](https://img.shields.io/badge/AppVersion-0.2.3-informational?style=flat-square)
A Helm chart to install the SPIFFE CSI driver. A Helm chart to install the SPIFFE CSI driver.
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire> **Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
> **Note**: The recommended version is `0.2.3` to support arm64 nodes. If running with any > [!Note]
> The recommended version is `0.2.3` to support arm64 nodes. If running with any
> prior version to `0.2.3` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. > prior version to `0.2.3` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
## Maintainers ## Maintainers
@@ -24,41 +23,48 @@ A Helm chart to install the SPIFFE CSI driver.
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire> * <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
## Parameters ## Parameters
### SPIFFE CSI Driver Chart parameters ### SPIFFE CSI Driver Chart parameters
| Name | Description | Value | | Name | Description | Value |
| ---------------------------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------- | | ---------------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
| `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` | | `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` |
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` | | `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` |
| `image.pullPolicy` | The image pull policy | `IfNotPresent` | | `image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `resources` | Resource requests and limits for spiffe-csi-driver | `{}` | | `resources` | Resource requests and limits for spiffe-csi-driver | `{}` |
| `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` | | `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` |
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | | `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
| `livenessProbe.timeoutSeconds` | Timeout value in seconds for livenessProbe | `5` | | `livenessProbe.timeoutSeconds` | Timeout value in seconds for livenessProbe | `5` |
| `imagePullSecrets` | Image pull secret details for spiffe-csi-driver | `[]` | | `imagePullSecrets` | Image pull secret details for spiffe-csi-driver | `[]` |
| `nameOverride` | Name override for spiffe-csi-driver | `""` | | `nameOverride` | Name override for spiffe-csi-driver | `""` |
| `namespaceOverride` | Namespace to install spiffe-csi-driver | `""` | | `namespaceOverride` | Namespace to install spiffe-csi-driver | `""` |
| `fullnameOverride` | Full name override for spiffe-csi-driver | `""` | | `fullnameOverride` | Full name override for spiffe-csi-driver | `""` |
| `serviceAccount.create` | Specifies whether a service account should be created | `true` | | `csiDriverLabels` | Labels to apply to the CSIDriver | `{}` |
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | | `initContainers` | Init Containers to apply to the CSI Driver DaemonSet | `[]` |
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | | `serviceAccount.create` | Specifies whether a service account should be created | `true` |
| `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` | | `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
| `podSecurityContext` | Security context for CSI driver pods | `{}` | | `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
| `securityContext.readOnlyRootFilesystem` | Flag for read only root filesystem | `true` | | `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` |
| `securityContext.privileged` | Flag for specifying privileged mode | `true` | | `podSecurityContext` | Security context for CSI driver pods | `{}` |
| `nodeSelector` | Node selector for CSI driver pods | `{}` | | `securityContext.readOnlyRootFilesystem` | Flag for read only root filesystem | `true` |
| `tolerations` | Tolerations for CSI driver pods | `[]` | | `securityContext.privileged` | Flag for specifying privileged mode | `true` |
| `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | | `nodeSelector` | Node selector for CSI driver pods | `{}` |
| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` | | `tolerations` | Tolerations for CSI driver pods | `[]` |
| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
| `nodeDriverRegistrar.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` |
| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.0` | | `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` | | `nodeDriverRegistrar.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | | `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.0` |
| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` | | `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` |
| `priorityClassName` | Priority class assigned to daemonset pods | `""` | | `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` |
| `priorityClassName` | Priority class assigned to daemonset pods | `""` |
| `restrictedScc.enabled` | Enables the creation of a SecurityContextConstraint based on the restricted SCC with CSI volume support | `false` |
| `restrictedScc.name` | Set the name of the restricted SCC with CSI support | `""` |
| `restrictedScc.version` | Version of the restricted SCC | `2` |
charts/spire/charts/spiffe-csi-driver/README.md.gotmpl
-24
View File
@@ -1,24 +0,0 @@
{{ template "chart.header" . }}
<!-- This README.md is generated. Please edit README.md.gotmpl -->
{{ template "chart.deprecationWarning" . }}
{{ template "chart.badgesSection" . }}
{{ template "chart.description" . }}
{{ template "chart.homepageLine" . }}
> **Note**: The recommended version is `0.2.3` to support arm64 nodes. If running with any
> prior version to `0.2.3` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
{{ template "chart.maintainersSection" . }}
{{ template "chart.sourcesSection" . }}
{{ template "chart.requirementsSection" . }}
{{ template "chart.valuesSection" . }}
----------------------------------------------
charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
+4
View File
@@ -36,6 +36,10 @@ spec:
{{- if .Values.priorityClassName }} {{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }}
{{- end }} {{- end }}
{{- with .Values.initContainers }}
initContainers:
{{- toYaml . | nindent 8 }}
{{- end }}
containers: containers:
# This is the container which runs the SPIFFE CSI driver. # This is the container which runs the SPIFFE CSI driver.
- name: {{ .Chart.Name }} - name: {{ .Chart.Name }}
charts/spire/charts/spiffe-csi-driver/templates/scc-restricted-csi.yaml
+61
View File
@@ -0,0 +1,61 @@
{{- if and .Values.global.openshift .Values.restrictedScc.enabled }}
{{- $name := default (printf "restricted-%scsi" (eq (.Values.restrictedScc.version | toString) "2" | ternary "v2-" "")) .Values.restrictedScc.name -}}
{{- $v2Description := "This is the most restrictive SCC and it is used by default for authenticated users. On top of the legacy 'restricted' SCC, it also requires to drop ALL capabilities and does not allow privilege escalation binaries. It will also default the seccomp profile to runtime/default if unset, otherwise this seccomp profile is required." -}}
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
allowHostPorts: false
priority: null
requiredDropCapabilities:
{{- if eq (.Values.restrictedScc.version | toString) "2" }}
- ALL
{{- else }}
- KILL
- MKNOD
- SETUID
- SETGID
{{- end }}
allowPrivilegedContainer: false
runAsUser:
type: MustRunAsRange
users: []
allowHostDirVolumePlugin: false
{{- if eq (.Values.restrictedScc.version | toString) "2" }}
seccompProfiles:
- runtime/default
{{- end }}
allowHostIPC: false
seLinuxContext:
type: MustRunAs
readOnlyRootFilesystem: false
metadata:
name: {{ $name }}
annotations:
kubernetes.io/description: >-
{{ $name }} denies access to all host features and requires pods to be
run with a UID, and SELinux context that are allocated to the namespace.
{{ eq (.Values.restrictedScc.version | toString) "2" | ternary $v2Description "" }}
fsGroup:
type: MustRunAs
groups: []
defaultAddCapabilities: null
supplementalGroups:
type: RunAsAny
volumes:
- configMap
- csi
- downwardAPI
- emptyDir
- ephemeral
- persistentVolumeClaim
- projected
- secret
allowHostPID: false
allowHostNetwork: false
allowPrivilegeEscalation: {{ eq (.Values.restrictedScc.version | toString) "2" | ternary false true }}
{{- if eq (.Values.restrictedScc.version | toString) "2" }}
allowedCapabilities:
- NET_BIND_SERVICE
{{ else}}
allowedCapabilities: null
{{- end }}
{{- end }}
charts/spire/charts/spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml
+30
View File
@@ -0,0 +1,30 @@
{{- if eq (.Values.global.openshift | toString) "true" }}
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
name: {{ include "spiffe-csi-driver.fullname" . }}
readOnlyRootFilesystem: true
runAsUser:
type: RunAsAny
seLinuxContext:
type: RunAsAny
supplementalGroups:
type: RunAsAny
users:
- system:serviceaccount:{{ include "spiffe-csi-driver.namespace" . }}:{{ include "spiffe-csi-driver.serviceAccountName" . }}
volumes:
- configmap
- hostPath
- secret
allowHostDirVolumePlugin: true
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: true
allowPrivilegedContainer: true
fsGroup:
type: RunAsAny
groups: []
{{ end }}
charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml
+5
View File
@@ -2,6 +2,11 @@ apiVersion: storage.k8s.io/v1
kind: CSIDriver kind: CSIDriver
metadata: metadata:
name: {{ .Values.pluginName | quote }} name: {{ .Values.pluginName | quote }}
{{- with .Values.csiDriverLabels }}
labels:
{{- toYaml . | nindent 4 }}
{{- end }}
spec: spec:
# Only ephemeral, inline volumes are supported. There is no need for a # Only ephemeral, inline volumes are supported. There is no need for a
# controller to provision and attach volumes. # controller to provision and attach volumes.
charts/spire/charts/spiffe-csi-driver/values.yaml
+15
View File
@@ -58,6 +58,12 @@ namespaceOverride: ""
## @param fullnameOverride Full name override for spiffe-csi-driver ## @param fullnameOverride Full name override for spiffe-csi-driver
fullnameOverride: "" fullnameOverride: ""
## @param csiDriverLabels Labels to apply to the CSIDriver
csiDriverLabels: {}
## @param initContainers Init Containers to apply to the CSI Driver DaemonSet
initContainers: []
## @param serviceAccount.create Specifies whether a service account should be created ## @param serviceAccount.create Specifies whether a service account should be created
## @param serviceAccount.annotations Annotations to add to the service account ## @param serviceAccount.annotations Annotations to add to the service account
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated. ## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
@@ -126,3 +132,12 @@ kubeletPath: /var/lib/kubelet
## @param priorityClassName Priority class assigned to daemonset pods ## @param priorityClassName Priority class assigned to daemonset pods
priorityClassName: "" priorityClassName: ""
restrictedScc:
## @param restrictedScc.enabled Enables the creation of a SecurityContextConstraint based on the restricted SCC with CSI volume support
enabled: false
## @param restrictedScc.name Set the name of the restricted SCC with CSI support
name: ""
## @param restrictedScc.version Version of the restricted SCC
version: 2
charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider
description: A Helm chart to install the SPIFFE OIDC discovery provider. description: A Helm chart to install the SPIFFE OIDC discovery provider.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.8.2" appVersion: "1.8.4"
keywords: ["spiffe", "oidc"] keywords: ["spiffe", "oidc"]
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
sources: sources:
charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+105 -101
View File
@@ -1,14 +1,13 @@
# spiffe-oidc-discovery-provider # spiffe-oidc-discovery-provider
<!-- This README.md is generated. Please edit README.md.gotmpl -->
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square)
A Helm chart to install the SPIFFE OIDC discovery provider. A Helm chart to install the SPIFFE OIDC discovery provider.
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire> **Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
> **Note**: Minimum Spire version is `1.5.3`. > [!Note]
> Minimum Spire version is `1.5.3`.
> The recommended version is `1.6.0` to support arm64 nodes. If running with any > The recommended version is `1.6.0` to support arm64 nodes. If running with any
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. > prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
@@ -25,105 +24,110 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire> * <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
## Parameters ## Parameters
### Chart parameters ### Chart parameters
| Name | Description | Value | | Name | Description | Value |
| ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | | ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | | `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
| `replicaCount` | Replica count | `1` | | `replicaCount` | Replica count | `1` |
| `namespaceOverride` | Namespace override | `""` | | `namespaceOverride` | Namespace override | `""` |
| `annotations` | Annotations for the deployment | `{}` | | `annotations` | Annotations for the deployment | `{}` |
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `image.repository` | The repository within the registry | `spiffe/oidc-discovery-provider` | | `image.repository` | The repository within the registry | `spiffe/oidc-discovery-provider` |
| `image.pullPolicy` | The image pull policy | `IfNotPresent` | | `image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `resources` | Resource requests and limits | `{}` | | `resources` | Resource requests and limits | `{}` |
| `service.type` | Service type | `ClusterIP` | | `service.type` | Service type | `ClusterIP` |
| `service.port` | Service port | `80` | | `service.port` | Service port | `80` |
| `service.annotations` | Annotations for service resource | `{}` | | `service.annotations` | Annotations for service resource | `{}` |
| `configMap.annotations` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | `{}` | | `configMap.annotations` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | `{}` |
| `podSecurityContext` | Pod security context for OIDC discovery provider pods | `{}` | | `podSecurityContext` | Pod security context for OIDC discovery provider pods | `{}` |
| `securityContext` | Security context for OIDC discovery provider deployment | `{}` | | `securityContext` | Security context for OIDC discovery provider deployment | `{}` |
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | | `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | | `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | | `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | | `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` |
| `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` | | `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` |
| `insecureScheme.enabled` | Flag to enable insecure schema | `false` | | `insecureScheme.enabled` | Flag to enable insecure schema | `false` |
| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from | `docker.io` | | `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` | | `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` |
| `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.2-alpine` | | `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.2-alpine` |
| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | | `insecureScheme.nginx.resources` | Resource requests and limits | `{}` |
| `jwtIssuer` | Path to JWT issuer | `https://oidc-discovery.example.org` | | `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` |
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | | `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` | | `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` |
| `config.acme.tosAccepted` | Flag for Terms of Service acceptance | `false` | | `config.acme.tosAccepted` | Flag for Terms of Service acceptance | `false` |
| `config.acme.cacheDir` | Path for cache directory | `/run/spire` | | `config.acme.cacheDir` | Path for cache directory | `/run/spire` |
| `config.acme.directoryUrl` | URL for acme directory | `https://acme-v02.api.letsencrypt.org/directory` | | `config.acme.directoryUrl` | URL for acme directory | `https://acme-v02.api.letsencrypt.org/directory` |
| `config.acme.emailAddress` | Email address for registration | `[email protected]` | | `config.acme.emailAddress` | Email address for registration | `[email protected]` |
| `imagePullSecrets` | Image pull secret names | `[]` | | `imagePullSecrets` | Image pull secret names | `[]` |
| `nameOverride` | Name override | `""` | | `nameOverride` | Name override | `""` |
| `fullnameOverride` | Full name override | `""` | | `fullnameOverride` | Full name override | `""` |
| `serviceAccount.create` | Specifies whether a service account should be created | `true` | | `serviceAccount.create` | Specifies whether a service account should be created | `true` |
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | | `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | | `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
| `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | | `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
| `autoscaling.enabled` | Flag to enable autoscaling | `false` | | `autoscaling.enabled` | Flag to enable autoscaling | `false` |
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` | | `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` | | `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` |
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` | | `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` |
| `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` | | `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` |
| `nodeSelector` | Node selector | `{}` | | `nodeSelector` | Node selector | `{}` |
| `tolerations` | iist of tolerations | `[]` | | `tolerations` | iist of tolerations | `[]` |
| `affinity` | Node affinity | `{}` | | `affinity` | Node affinity | `{}` |
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | | `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
| `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` | | `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` |
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | | `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | | `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | | `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the helm release | `""` | | `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the helm release | `""` |
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | | `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
| `telemetry.prometheus.nginxExporter.image.registry` | The OCI registry to pull the image from | `docker.io` | | `telemetry.prometheus.nginxExporter.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `telemetry.prometheus.nginxExporter.image.repository` | The repository within the registry | `nginx/nginx-prometheus-exporter` | | `telemetry.prometheus.nginxExporter.image.repository` | The repository within the registry | `nginx/nginx-prometheus-exporter` |
| `telemetry.prometheus.nginxExporter.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `telemetry.prometheus.nginxExporter.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `telemetry.prometheus.nginxExporter.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `telemetry.prometheus.nginxExporter.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `telemetry.prometheus.nginxExporter.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.11.0` | | `telemetry.prometheus.nginxExporter.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.11.0` |
| `telemetry.prometheus.nginxExporter.resources` | Resource requests and limits | `{}` | | `telemetry.prometheus.nginxExporter.resources` | Resource requests and limits | `{}` |
| `ingress.enabled` | Flag to enable ingress | `false` | | `ingress.enabled` | Flag to enable ingress | `false` |
| `ingress.className` | Ingress class name | `""` | | `ingress.className` | Ingress class name | `""` |
| `ingress.annotations` | Annotations for ingress object | `{}` | | `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
| `ingress.hosts` | Host paths for ingress object | `[]` | | `ingress.annotations` | Annotations for ingress object | `{}` |
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` | | `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `oidc-discovery` |
| `tests.hostAliases` | List of host aliases for testing | `[]` | | `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` | | `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
| `tests.tls.customCA` | Custom CA value for tests | `""` | | `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.hostAliases` | List of host aliases for testing | `[]` |
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.tls.customCA` | Custom CA value for tests | `""` |
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | | `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` |
| `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:57151ad9f998c9394c9ba8b66c83f70cbfe3d4b733c166c9856e0d8fb273bfd0` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` |
| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.busybox.image.repository` | The repository within the registry | `busybox` | | `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d1fc4d296994f28d7e0264c933a12ba75c9a80478ff1eb4b6f692bb91a073a4c` |
| `tests.busybox.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` |
| `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` | | `tests.busybox.image.repository` | The repository within the registry | `busybox` |
| `tests.agent.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.agent.image.repository` | The repository within the registry | `spiffe/spire-agent` | | `tests.busybox.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tests.agent.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` |
| `tests.agent.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `tests.agent.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `tests.agent.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `tests.agent.image.repository` | The repository within the registry | `spiffe/spire-agent` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.agent.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | | `tests.agent.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.agent.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
charts/spire/charts/spiffe-oidc-discovery-provider/README.md.gotmpl
-25
View File
@@ -1,25 +0,0 @@
{{ template "chart.header" . }}
<!-- This README.md is generated. Please edit README.md.gotmpl -->
{{ template "chart.deprecationWarning" . }}
{{ template "chart.badgesSection" . }}
{{ template "chart.description" . }}
{{ template "chart.homepageLine" . }}
> **Note**: Minimum Spire version is `1.5.3`.
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
{{ template "chart.maintainersSection" . }}
{{ template "chart.sourcesSection" . }}
{{ template "chart.requirementsSection" . }}
{{ template "chart.valuesSection" . }}
----------------------------------------------
charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml
+12 -2
View File
@@ -1,5 +1,15 @@
{{- if .Values.ingress.enabled -}} {{- if .Values.ingress.enabled -}}
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
{{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . }} {{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . }}
{{- $tlsSection := true }}
{{- $annotations := deepCopy .Values.ingress.annotations }}
{{- if eq $ingressControllerType "ingress-nginx" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
{{- else if eq $ingressControllerType "openshift" }}
{{- $_ := set $annotations "route.openshift.io/termination" "edge" }}
{{- $tlsSection = false }}
{{- end }}
apiVersion: networking.k8s.io/v1 apiVersion: networking.k8s.io/v1
kind: Ingress kind: Ingress
metadata: metadata:
@@ -7,10 +17,10 @@ metadata:
namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }} namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
labels: labels:
{{ include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} {{ include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
{{- with .Values.ingress.annotations }} {{- with $annotations }}
annotations: annotations:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
spec: spec:
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }} {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
{{- end }} {{- end }}
charts/spire/charts/spiffe-oidc-discovery-provider/templates/scc-spire-oidc-discovery-provider.yaml
+38
View File
@@ -0,0 +1,38 @@
{{- if eq (.Values.global.openshift | toString) "true" }}
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
readOnlyRootFilesystem: true
runAsUser:
type: RunAsAny
seLinuxContext:
type: RunAsAny
supplementalGroups:
type: RunAsAny
users:
- system:serviceaccount:{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}
- system:serviceaccount:{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete
volumes:
- configMap
- hostPath
- projected
- secret
- ephemeral
- downwardAPI
- csi
- emptyDir
allowHostDirVolumePlugin: true
allowHostIPC: true
allowHostNetwork: true
allowHostPID: true
allowHostPorts: true
allowPrivilegeEscalation: true
allowPrivilegedContainer: true
fsGroup:
type: RunAsAny
groups: []
seccompProfiles:
- '*'
{{ end }}
charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
+8 -4
View File
@@ -1,4 +1,8 @@
{{ $values := merge .Values }} {{- $values := merge .Values }}
{{- $host := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.ingress) }}
{{- if gt (len .Values.ingress.hosts) 0 }}
{{- $host = (index .Values.ingress.hosts 0).host }}
{{- end }}
apiVersion: v1 apiVersion: v1
kind: Pod kind: Pod
metadata: metadata:
@@ -36,9 +40,9 @@ spec:
command: ['curl'] command: ['curl']
{{- if dig "tests" "tls" "enabled" false $values }} {{- if dig "tests" "tls" "enabled" false $values }}
{{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }} {{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
args: ['-s', '-f', '--cacert', '/ca/ca.crt', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration'] args: ['-s', '-f', '--cacert', '/ca/ca.crt', 'https://{{ $host }}/.well-known/openid-configuration']
{{- else }} {{- else }}
args: ['-s', '-f', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration'] args: ['-s', '-f', 'https://{{ $host }}/.well-known/openid-configuration']
{{- end }} {{- end }}
{{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }} {{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
volumeMounts: volumeMounts:
@@ -46,7 +50,7 @@ spec:
mountPath: /ca mountPath: /ca
{{- end }} {{- end }}
{{- else }} {{- else }}
args: ['-s', '-f', 'http://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration'] args: ['-s', '-f', 'http://{{ $host }}/.well-known/openid-configuration']
{{- end }} {{- end }}
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 8 }} {{- toYaml .Values.securityContext | nindent 8 }}
charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+22 -13
View File
@@ -9,10 +9,10 @@ global: {}
## @param agentSocketName The name of the spire-agent unix socket ## @param agentSocketName The name of the spire-agent unix socket
agentSocketName: spire-agent.sock agentSocketName: spire-agent.sock
## @param replicaCount Replica count ## @param replicaCount Replica count
replicaCount: 1 replicaCount: 1
## @param namespaceOverride Namespace override ## @param namespaceOverride Namespace override
namespaceOverride: "" namespaceOverride: ""
## @param annotations [object] Annotations for the deployment ## @param annotations [object] Annotations for the deployment
@@ -125,8 +125,8 @@ insecureScheme:
# cpu: 100m # cpu: 100m
# memory: 64Mi # memory: 64Mi
## @param jwtIssuer Path to JWT issuer ## @param jwtIssuer Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset
jwtIssuer: https://oidc-discovery.example.org jwtIssuer: ""
config: config:
## @param config.logLevel The log level, valid values are "debug", "info", "warn", and "error" ## @param config.logLevel The log level, valid values are "debug", "info", "warn", and "error"
@@ -241,6 +241,8 @@ ingress:
enabled: false enabled: false
## @param ingress.className Ingress class name ## @param ingress.className Ingress class name
className: "" className: ""
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
controllerType: ""
## @param ingress.annotations [object] Annotations for ingress object ## @param ingress.annotations [object] Annotations for ingress object
annotations: {} annotations: {}
# kubernetes.io/ingress.class: nginx # kubernetes.io/ingress.class: nginx
@@ -248,13 +250,20 @@ ingress:
# nginx.ingress.kubernetes.io/ssl-redirect: "true" # nginx.ingress.kubernetes.io/ssl-redirect: "true"
# nginx.ingress.kubernetes.io/force-ssl-redirect: "true" # nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
## @param ingress.hosts [array] Host paths for ingress object ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
hosts: host: "oidc-discovery"
- host: oidc-discovery.example.org
paths: ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
- path: / tlsSecret: ""
pathType: Prefix
## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress ## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
hosts: []
# - host: oidc-discovery.example.org
# paths:
# - path: /
# pathType: Prefix
## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
tls: [] tls: []
# - secretName: chart-example-tls # - secretName: chart-example-tls
# hosts: # hosts:
@@ -280,7 +289,7 @@ tests:
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
version: "" version: ""
tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214
toolkit: toolkit:
## @param tests.toolkit.image.registry The OCI registry to pull the image from ## @param tests.toolkit.image.registry The OCI registry to pull the image from
@@ -294,7 +303,7 @@ tests:
repository: chainguard/slim-toolkit-debug repository: chainguard/slim-toolkit-debug
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
version: "" version: ""
tag: latest@sha256:57151ad9f998c9394c9ba8b66c83f70cbfe3d4b733c166c9856e0d8fb273bfd0 tag: latest@sha256:d1fc4d296994f28d7e0264c933a12ba75c9a80478ff1eb4b6f692bb91a073a4c
busybox: busybox:
## @param tests.busybox.image.registry The OCI registry to pull the image from ## @param tests.busybox.image.registry The OCI registry to pull the image from
charts/spire/charts/spire-agent/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spire-agent
description: A Helm chart to install the SPIRE agent. description: A Helm chart to install the SPIRE agent.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.8.2" appVersion: "1.8.4"
keywords: ["spiffe", "spire-agent"] keywords: ["spiffe", "spire-agent"]
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
sources: sources:
charts/spire/charts/spire-agent/README.md
+8 -6
View File
@@ -1,14 +1,13 @@
# spire-agent # spire-agent
<!-- This README.md is generated. Please edit README.md.gotmpl -->
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square)
A Helm chart to install the SPIRE agent. A Helm chart to install the SPIRE agent.
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire> **Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
> **Note**: Minimum Spire version is `1.5.3`. > [!Note]
> Minimum Spire version is `1.5.3`.
> The recommended version is `1.6.0` to support arm64 nodes. If running with any > The recommended version is `1.6.0` to support arm64 nodes. If running with any
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. > prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
@@ -25,6 +24,8 @@ A Helm chart to install the SPIRE agent.
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire> * <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
## Parameters ## Parameters
### Chart parameters ### Chart parameters
@@ -59,7 +60,7 @@ A Helm chart to install the SPIRE agent.
| `server.address` | Address for Spire server | `""` | | `server.address` | Address for Spire server | `""` |
| `server.port` | Port number for Spire server | `8081` | | `server.port` | Port number for Spire server | `8081` |
| `server.namespaceOverride` | Override the namespace for Spire server | `""` | | `server.namespaceOverride` | Override the namespace for Spire server | `""` |
| `healthChecks.port` | override the host port used for health checking | `9980` | | `healthChecks.port` | override the host port used for health checking | `9982` |
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | | `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` | | `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | | `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
@@ -68,13 +69,13 @@ A Helm chart to install the SPIRE agent.
| `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` | | `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` |
| `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `waitForIt.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `waitForIt.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5b836d1a4c652ec1c56bdd4a05a43349e2eeff50cf7fdb45a356f0ddc578573b` | | `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c58a76f9241187615ab081ec73db6aeea6939369fba995206343bd9fb1975378` |
| `waitForIt.resources` | Resource requests and limits | `{}` | | `waitForIt.resources` | Resource requests and limits | `{}` |
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
| `fsGroupFix.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `fsGroupFix.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` | | `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` |
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
@@ -92,6 +93,7 @@ A Helm chart to install the SPIRE agent.
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | | `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | | `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
| `priorityClassName` | Priority class assigned to daemonset pods | `""` | | `priorityClassName` | Priority class assigned to daemonset pods | `""` |
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` | | `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` |
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` | | `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
charts/spire/charts/spire-agent/README.md.gotmpl
-25
View File
@@ -1,25 +0,0 @@
{{ template "chart.header" . }}
<!-- This README.md is generated. Please edit README.md.gotmpl -->
{{ template "chart.deprecationWarning" . }}
{{ template "chart.badgesSection" . }}
{{ template "chart.description" . }}
{{ template "chart.homepageLine" . }}
> **Note**: Minimum Spire version is `1.5.3`.
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
{{ template "chart.maintainersSection" . }}
{{ template "chart.sourcesSection" . }}
{{ template "chart.requirementsSection" . }}
{{ template "chart.valuesSection" . }}
----------------------------------------------
charts/spire/charts/spire-agent/templates/daemonset.yaml
+4
View File
@@ -71,6 +71,10 @@ spec:
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.image.pullPolicy }} imagePullPolicy: {{ .Values.image.pullPolicy }}
args: ["-config", "/run/spire/config/agent.conf"] args: ["-config", "/run/spire/config/agent.conf"]
{{- if gt (len .Values.extraEnvVars) 0 }}
env:
{{- toYaml .Values.extraEnvVars | nindent 12 }}
{{- end }}
ports: ports:
- containerPort: {{ .Values.healthChecks.port }} - containerPort: {{ .Values.healthChecks.port }}
name: healthz name: healthz
charts/spire/charts/spire-agent/templates/scc-spire-agent.yaml
+31
View File
@@ -0,0 +1,31 @@
{{- if eq (.Values.global.openshift | toString) "true" }}
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
name: {{ include "spire-agent.fullname" . }}
readOnlyRootFilesystem: true
runAsUser:
type: RunAsAny
seLinuxContext:
type: RunAsAny
supplementalGroups:
type: RunAsAny
users:
- system:serviceaccount:{{ include "spire-agent.namespace" . }}:{{ include "spire-agent.serviceAccountName" . }}
volumes:
- configMap
- hostPath
- projected
- secret
allowHostDirVolumePlugin: true
allowHostIPC: true
allowHostNetwork: true
allowHostPID: true
allowHostPorts: true
allowPrivilegeEscalation: true
allowPrivilegedContainer: true
fsGroup:
type: RunAsAny
groups: []
{{ end }}
charts/spire/charts/spire-agent/values.yaml
+9 -6
View File
@@ -22,13 +22,13 @@ image:
## @param imagePullSecrets [array] Pull secrets for images ## @param imagePullSecrets [array] Pull secrets for images
imagePullSecrets: [] imagePullSecrets: []
## @param nameOverride Name override ## @param nameOverride Name override
nameOverride: "" nameOverride: ""
## @param namespaceOverride Namespace override ## @param namespaceOverride Namespace override
namespaceOverride: "" namespaceOverride: ""
## @param fullnameOverride Fullname override ## @param fullnameOverride Fullname override
fullnameOverride: "" fullnameOverride: ""
serviceAccount: serviceAccount:
@@ -106,7 +106,7 @@ server:
healthChecks: healthChecks:
## @param healthChecks.port override the host port used for health checking ## @param healthChecks.port override the host port used for health checking
port: 9980 port: 9982
## @param livenessProbe.initialDelaySeconds Initial delay seconds for probe ## @param livenessProbe.initialDelaySeconds Initial delay seconds for probe
## @param livenessProbe.periodSeconds Period seconds for probe ## @param livenessProbe.periodSeconds Period seconds for probe
@@ -134,7 +134,7 @@ waitForIt:
repository: chainguard/wait-for-it repository: chainguard/wait-for-it
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
version: "" version: ""
tag: latest@sha256:5b836d1a4c652ec1c56bdd4a05a43349e2eeff50cf7fdb45a356f0ddc578573b tag: latest@sha256:c58a76f9241187615ab081ec73db6aeea6939369fba995206343bd9fb1975378
## @param waitForIt.resources [object] Resource requests and limits ## @param waitForIt.resources [object] Resource requests and limits
resources: {} resources: {}
@@ -153,7 +153,7 @@ fsGroupFix:
repository: chainguard/bash repository: chainguard/bash
pullPolicy: Always pullPolicy: Always
version: "" version: ""
tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {} resources: {}
@@ -204,6 +204,9 @@ socketPath: /run/spire/agent-sockets/spire-agent.sock
## @param priorityClassName Priority class assigned to daemonset pods ## @param priorityClassName Priority class assigned to daemonset pods
priorityClassName: "" priorityClassName: ""
## @param extraEnvVars [array] Extra environment variables to be added to the Spire Agent container
extraEnvVars: []
## @param extraVolumes [array] Extra volumes to be mounted on Spire Agent pods ## @param extraVolumes [array] Extra volumes to be mounted on Spire Agent pods
extraVolumes: [] extraVolumes: []
charts/spire/charts/spire-server/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spire-server
description: A Helm chart to install the SPIRE server. description: A Helm chart to install the SPIRE server.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.8.2" appVersion: "1.8.4"
keywords: ["spiffe", "spire-server", "spire-controller-manager"] keywords: ["spiffe", "spire-server", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
sources: sources:
charts/spire/charts/spire-server/README.md
+80 -56
View File
@@ -1,14 +1,13 @@
# spire-server # spire-server
<!-- This README.md is generated. Please edit README.md.gotmpl -->
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square)
A Helm chart to install the SPIRE server. A Helm chart to install the SPIRE server.
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire> **Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
> **Note**: Minimum Spire version is `1.5.3`. > [!Note]
> Minimum Spire version is `1.5.3`.
> The recommended version is `1.6.0` to support arm64 nodes. If running with any > The recommended version is `1.6.0` to support arm64 nodes. If running with any
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. > prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
> >
@@ -39,7 +38,8 @@ When Tornjak is enabled, it is exposed on both http and https (if TLS server cer
In addition, you can configure a `client certificate authority`, this will make Tornjak backend verify Client certificates signed by this authority to enable mTLS authentication. In addition, you can configure a `client certificate authority`, this will make Tornjak backend verify Client certificates signed by this authority to enable mTLS authentication.
**Warning**: For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access. > [!Important]
> For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access.
### Tornjak with TLS Connection Type ### Tornjak with TLS Connection Type
@@ -47,13 +47,13 @@ TLS connection requires Tornjak to have access to TLS key and certificate.
Complete instruction on creating your own TLS certificate can be found [here](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md). Complete instruction on creating your own TLS certificate can be found [here](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md).
TLS Certificate and the private key must be provided to Tornjak via *TLS Secret*. Prior to deploying this Helm chart, create TLS Secret in the deployment namespace (e.g. `spire-server`) TLS Certificate and the private key must be provided to Tornjak via *TLS Secret*. Prior to deploying this Helm chart, create TLS Secret in the deployment namespace (e.g. `spire-server`)
```console ```shell
kubectl -n spire-server create secret tls tornjak-tls-secret --cert=client.crt --key=client.key kubectl -n spire-server create secret tls tornjak-tls-secret --cert=client.crt --key=client.key
``` ```
Once the charts are deployed, you can test the TLS connection with the following command (assuming localhost): Once the charts are deployed, you can test the TLS connection with the following command (assuming localhost):
```console ```shell
curl --cacert CA/rootCA.crt https://localhost:10443 curl --cacert CA/rootCA.crt https://localhost:10443
``` ```
@@ -67,13 +67,13 @@ Follow the steps to [create user CA for mTLS](https://github.com/spiffe/tornjak/
Here is an example using a *Secret* in `spire-server` namespace: Here is an example using a *Secret* in `spire-server` namespace:
```console ```shell
kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt" kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt"
``` ```
Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost): Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost):
```console ```shell
curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhost:10443 curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhost:10443
``` ```
@@ -81,6 +81,8 @@ curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhos
In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above. In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above.
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
## Parameters ## Parameters
### Chart parameters ### Chart parameters
@@ -140,7 +142,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `dataStore.sql.externalSecret.name` | The name of the secret object | `""` | | `dataStore.sql.externalSecret.name` | The name of the secret object | `""` |
| `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` | | `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | | `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
| `jwtIssuer` | The JWT issuer domain | `https://oidc-discovery.example.org` | | `jwtIssuer` | The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset | `""` |
| `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` | | `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` |
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | | `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
| `bundleConfigMap` | Set the trust domain to be used for the SPIFFE identifiers | `spire-bundle` | | `bundleConfigMap` | Set the trust domain to be used for the SPIFFE identifiers | `spire-bundle` |
@@ -150,9 +152,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` | | `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` |
| `federation.ingress.enabled` | Flag to enable ingress for federation | `false` | | `federation.ingress.enabled` | Flag to enable ingress for federation | `false` |
| `federation.ingress.className` | Ingress class name for federation | `""` | | `federation.ingress.className` | Ingress class name for federation | `""` |
| `federation.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` | | `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
| `federation.ingress.hosts` | Host paths for ingress object | `[]` | | `federation.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server-federation` |
| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` | | `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
| `federation.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
| `ca_subject.country` | Country for Spire server CA | `ARPA` | | `ca_subject.country` | Country for Spire server CA | `ARPA` |
| `ca_subject.organization` | Organization for Spire server CA | `Example` | | `ca_subject.organization` | Organization for Spire server CA | `Example` |
| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` | | `ca_subject.common_name` | Common Name for Spire server CA | `example.org` |
@@ -212,13 +217,15 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` | | `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` | | `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
| `controllerManager.enabled` | Flag to enable controller manager | `false` | | `controllerManager.enabled` | Flag to enable controller manager | `false` |
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | | `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
| `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` | | `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` |
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.3.0` | | `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.0` |
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
| `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.securityContext` | Security context | `{}` |
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
@@ -232,6 +239,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.identities.namespaceSelector` | Selector for namespacs to issue identity | `{}` | | `controllerManager.identities.namespaceSelector` | Selector for namespacs to issue identity | `{}` |
| `controllerManager.identities.dnsNameTemplates` | DNS name template for issued identities | `[]` | | `controllerManager.identities.dnsNameTemplates` | DNS name template for issued identities | `[]` |
| `controllerManager.identities.federatesWith` | Other Spire server URLs for identity federation | `[]` | | `controllerManager.identities.federatesWith` | Other Spire server URLs for identity federation | `[]` |
| `controllerManager.identities.workloadSelectorTemplates` | Templates to produce selectors that apply to a given workload before it will receive an ID | `[]` |
| `controllerManager.identities.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` |
| `controllerManager.identities.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` |
| `controllerManager.identities.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
| `controllerManager.identities.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` |
| `controllerManager.identities.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` |
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` | | `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | | `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
@@ -244,9 +257,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | | `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
| `ingress.enabled` | Flag to enable ingress | `false` | | `ingress.enabled` | Flag to enable ingress | `false` |
| `ingress.className` | Ingress class name | `""` | | `ingress.className` | Ingress class name | `""` |
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
| `ingress.annotations` | Annotations for the ingress object | `{}` | | `ingress.annotations` | Annotations for the ingress object | `{}` |
| `ingress.hosts` | Host paths for ingress object | `[]` | | `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server` |
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` | | `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
| `extraVolumes` | Extra volumes to be mounted | `[]` | | `extraVolumes` | Extra volumes to be mounted | `[]` |
| `extraVolumeMounts` | Extra volume mounts | `[]` | | `extraVolumeMounts` | Extra volume mounts | `[]` |
| `extraContainers` | Additional containers to create | `[]` | | `extraContainers` | Additional containers to create | `[]` |
@@ -257,45 +273,53 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` | | `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` | | `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` |
| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` | | `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` |
| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` |
| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` | ### Tornjak
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` | | Name | Description | Value |
| `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.4.0` | | `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` |
| `tornjak.service.type` | Type of service resource | `ClusterIP` | | `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` | | `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` | | `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tornjak.service.annotations` | Annotations for the service | `{}` | | `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tornjak.ingress.enabled` | Flag to enable ingress for Tornjak backend service | `false` | | `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.4.0` |
| `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` | | `tornjak.service.type` | Type of service resource | `ClusterIP` |
| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` | | `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` |
| `tornjak.ingress.hosts` | Host paths for ingress Tornjak backend service | `[]` | | `tornjak.service.ports.https` | Secure port for tornjak service | `10443` |
| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress | `[]` | | `tornjak.service.annotations` | Annotations for the service | `{}` |
| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` | | `tornjak.ingress.enabled` | Flag to enable ingress for Tornjak backend service | `false` |
| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` | | `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` |
| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` | | `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
| `tornjak.startupProbe.successThreshold` | Success threshold count | `1` | | `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` |
| `tornjak.startupProbe.timeoutSeconds` | Timeout in seconds | `5` | | `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` |
| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | | | `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` | | `tornjak.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` | | `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` | | `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` |
| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` | | `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` |
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` | | `tornjak.startupProbe.periodSeconds` | Period seconds | `10` |
| `tornjak.resources` | Resource requests and limits | `{}` | | `tornjak.startupProbe.successThreshold` | Success threshold count | `1` |
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` | | `tornjak.startupProbe.timeoutSeconds` | Timeout in seconds | `5` |
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` | | `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | |
| `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` | | `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` |
| `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` | | `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` |
| `experimental.enabled` | Allow configuration of experimental features | `false` | | `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` |
| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | | `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` |
| `experimental.featureFlags` | List of developer feature flags | `[]` | | `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
| `tests.hostAliases` | List of host aliases for testing | `[]` | | `tornjak.resources` | Resource requests and limits | `{}` |
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` | | `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
| `tests.tls.customCA` | Custom CA value for tests | `""` | | `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` |
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `experimental.enabled` | Allow configuration of experimental features | `false` |
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` | | `experimental.featureFlags` | List of developer feature flags | `[]` |
| `tests.hostAliases` | List of host aliases for testing | `[]` |
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
| `tests.tls.customCA` | Custom CA value for tests | `""` |
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` |
charts/spire/charts/spire-server/templates/_helpers.tpl
+12 -1
View File
@@ -205,7 +205,10 @@ The code below determines what connection type should be used.
{{- define "spire-server.test.federation-ingress-args" }} {{- define "spire-server.test.federation-ingress-args" }}
{{- $args := list }} {{- $args := list }}
{{- $host := index (index (index .Values.federation.ingress.tls 0) "hosts") 0 }} {{- $host := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.federation.ingress) }}
{{- if gt (len .Values.federation.ingress.tls) 0 }}
{{- $host = index (index (index .Values.federation.ingress.tls 0) "hosts") 0 }}
{{- end }}
{{- if dig "tests" "tls" "enabled" false .Values }} {{- if dig "tests" "tls" "enabled" false .Values }}
{{- if ne (len (dig "tests" "tls" "customCA" "" .Values)) 0 }} {{- if ne (len (dig "tests" "tls" "customCA" "" .Values)) 0 }}
{{- $args = append $args "--cacert" }} {{- $args = append $args "--cacert" }}
@@ -217,3 +220,11 @@ The code below determines what connection type should be used.
{{- end }} {{- end }}
{{ $args | toYaml }} {{ $args | toYaml }}
{{- end -}} {{- end -}}
{{- define "spire-server.controller-manager-class-name" -}}
{{- if .Values.controllerManager.className }}
{{- .Values.controllerManager.className }}
{{- else }}
{{- .Release.Namespace }}-{{ .Release.Name }}
{{- end -}}
{{- end -}}
charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml
+15 -1
View File
@@ -4,7 +4,7 @@
apiVersion: spire.spiffe.io/v1alpha1 apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterSPIFFEID kind: ClusterSPIFFEID
metadata: metadata:
name: {{ include "spire-controller-manager.fullname" $root }}-service-account-based name: {{ $root.Release.Namespace }}-{{ include "spire-controller-manager.fullname" $root }}-service-account-based
namespace: {{ include "spire-server.namespace" $root }} namespace: {{ include "spire-server.namespace" $root }}
spec: spec:
spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }} spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }}
@@ -24,5 +24,19 @@ spec:
dnsNameTemplates: dnsNameTemplates:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
{{- with .identities.workloadSelectorTemplates }}
workloadTSelectoremplates:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .identities.ttl }}
ttl: {{ . | quote }}
{{- end }}
{{- with .identities.jwtTTL }}
jwtTtl: {{ . | quote }}
{{- end }}
admin: {{ .identities.admin }}
downstream: {{ .identities.downstream }}
autoPopulateDNSNames: {{ .identities.autoPopulateDNSNames }}
className: {{ include "spire-server.controller-manager-class-name" $root | quote}}
{{- end }} {{- end }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
+3 -1
View File
@@ -25,7 +25,7 @@ data:
leaderElect: true leaderElect: true
resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
resourceNamespace: {{ include "spire-server.namespace" . }} resourceNamespace: {{ include "spire-server.namespace" . }}
validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
clusterName: {{ include "spire-lib.cluster-name" . }} clusterName: {{ include "spire-lib.cluster-name" . }}
trustDomain: {{ include "spire-lib.trust-domain" . }} trustDomain: {{ include "spire-lib.trust-domain" . }}
ignoreNamespaces: ignoreNamespaces:
@@ -33,4 +33,6 @@ data:
{{- toYaml . | nindent 6 }} {{- toYaml . | nindent 6 }}
{{- end }} {{- end }}
spireServerSocketPath: "/tmp/spire-server/private/api.sock" spireServerSocketPath: "/tmp/spire-server/private/api.sock"
className: {{ include "spire-server.controller-manager-class-name" . | quote}}
watchClassless: {{ .Values.controllerManager.watchClassless | toYaml }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/templates/controller-manager-roles.yaml
+6 -3
View File
@@ -32,7 +32,7 @@ subjects:
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole kind: ClusterRole
metadata: metadata:
name: {{ include "spire-controller-manager.fullname" . }} name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}
rules: rules:
- apiGroups: [""] - apiGroups: [""]
resources: ["namespaces"] resources: ["namespaces"]
@@ -43,6 +43,9 @@ rules:
- apiGroups: [""] - apiGroups: [""]
resources: ["nodes"] resources: ["nodes"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["endpoints"]
verbs: ["get", "list", "watch"]
- apiGroups: [""] - apiGroups: [""]
resources: ["pods"] resources: ["pods"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]
@@ -77,11 +80,11 @@ rules:
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding kind: ClusterRoleBinding
metadata: metadata:
name: {{ include "spire-controller-manager.fullname" . }} name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}
roleRef: roleRef:
apiGroup: rbac.authorization.k8s.io apiGroup: rbac.authorization.k8s.io
kind: ClusterRole kind: ClusterRole
name: {{ include "spire-controller-manager.fullname" . }} name: {{ .Release.Namespace}}-{{ include "spire-controller-manager.fullname" . }}
subjects: subjects:
- kind: ServiceAccount - kind: ServiceAccount
name: {{ include "spire-server.serviceAccountName" . }} name: {{ include "spire-server.serviceAccountName" . }}
charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml
+1 -1
View File
@@ -2,7 +2,7 @@
apiVersion: admissionregistration.k8s.io/v1 apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration kind: ValidatingWebhookConfiguration
metadata: metadata:
name: {{ include "spire-controller-manager.fullname" . }}-webhook name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
webhooks: webhooks:
- admissionReviewVersions: ["v1"] - admissionReviewVersions: ["v1"]
clientConfig: clientConfig:
charts/spire/charts/spire-server/templates/federation-ingress.yaml
+13 -2
View File
@@ -1,6 +1,17 @@
{{- if .Values.federation.enabled }} {{- if .Values.federation.enabled }}
{{- if .Values.federation.ingress.enabled -}} {{- if .Values.federation.ingress.enabled -}}
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.federation.ingress) }}
{{- $svcName := include "spire-server.fullname" . }} {{- $svcName := include "spire-server.fullname" . }}
{{- $tlsSection := true }}
{{- $annotations := deepCopy .Values.federation.ingress.annotations }}
{{- if eq $ingressControllerType "ingress-nginx" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
{{- else if eq $ingressControllerType "openshift" }}
{{- $_ := set $annotations "route.openshift.io/termination" "edge" }}
{{- $tlsSection = false }}
{{- end }}
apiVersion: networking.k8s.io/v1 apiVersion: networking.k8s.io/v1
kind: Ingress kind: Ingress
metadata: metadata:
@@ -8,11 +19,11 @@ metadata:
namespace: {{ include "spire-server.namespace" . }} namespace: {{ include "spire-server.namespace" . }}
labels: labels:
{{ include "spire-server.labels" . | nindent 4 }} {{ include "spire-server.labels" . | nindent 4 }}
{{- with .Values.federation.ingress.annotations }} {{- with $annotations }}
annotations: annotations:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
spec: spec:
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "global" .Values.global) | nindent 2 }} {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
{{- end }} {{- end }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/templates/ingress.yaml
+18 -2
View File
@@ -1,5 +1,21 @@
{{- if .Values.ingress.enabled -}} {{- if .Values.ingress.enabled -}}
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
{{- $fullName := include "spire-server.fullname" . -}} {{- $fullName := include "spire-server.fullname" . -}}
{{- $path := "/" }}
{{- $pathType := "Prefix" }}
{{- $tlsSection := true }}
{{- $annotations := deepCopy .Values.ingress.annotations }}
{{- if eq $ingressControllerType "ingress-nginx" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
{{- else if eq $ingressControllerType "openshift" }}
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
{{- $path = "" }}
{{- $pathType = "ImplementationSpecific" }}
{{- $tlsSection = false }}
{{- end }}
apiVersion: networking.k8s.io/v1 apiVersion: networking.k8s.io/v1
kind: Ingress kind: Ingress
metadata: metadata:
@@ -7,10 +23,10 @@ metadata:
namespace: {{ include "spire-server.namespace" . }} namespace: {{ include "spire-server.namespace" . }}
labels: labels:
{{ include "spire-server.labels" . | nindent 4}} {{ include "spire-server.labels" . | nindent 4}}
{{- with .Values.ingress.annotations }} {{- with $annotations }}
annotations: annotations:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
spec: spec:
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }} {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/templates/post-install-hook.yaml
+2 -2
View File
@@ -22,7 +22,7 @@ metadata:
rules: rules:
- apiGroups: ["admissionregistration.k8s.io"] - apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations"] resources: ["validatingwebhookconfigurations"]
resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}] resourceNames: [{{ printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) | quote }}]
verbs: ["get", "patch"] verbs: ["get", "patch"]
--- ---
kind: ClusterRoleBinding kind: ClusterRoleBinding
@@ -68,7 +68,7 @@ spec:
args: args:
- patch - patch
- validatingwebhookconfiguration - validatingwebhookconfiguration
- {{ include "spire-controller-manager.fullname" . }}-webhook - {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
- --type=strategic - --type=strategic
- -p - -p
- | - |
charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+2 -2
View File
@@ -22,7 +22,7 @@ metadata:
rules: rules:
- apiGroups: ["admissionregistration.k8s.io"] - apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations"] resources: ["validatingwebhookconfigurations"]
resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}] resourceNames: [{{ printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) | quote }}]
verbs: ["get", "patch"] verbs: ["get", "patch"]
--- ---
kind: ClusterRoleBinding kind: ClusterRoleBinding
@@ -68,7 +68,7 @@ spec:
args: args:
- patch - patch
- validatingwebhookconfiguration - validatingwebhookconfiguration
- {{ include "spire-controller-manager.fullname" . }}-webhook - {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
- --type=strategic - --type=strategic
- -p - -p
- | - |
charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+7 -2
View File
@@ -1,4 +1,9 @@
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
{{- $webhookname := printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) }}
{{- $oldwebhookname := printf "%s-webhook" (include "spire-controller-manager.fullname" .) }}
{{- if not (lookup "admissionregistration.k8s.io/v1" "ValidatingWebhookConfiguration" "" $webhookname) }}
{{- $webhookname = $oldwebhookname }}
{{- end }}
{{- if eq (.Values.controllerManager.enabled | toString) "true" }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
apiVersion: v1 apiVersion: v1
@@ -22,7 +27,7 @@ metadata:
rules: rules:
- apiGroups: ["admissionregistration.k8s.io"] - apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations"] resources: ["validatingwebhookconfigurations"]
resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}] resourceNames: [{{ $webhookname | quote }}]
verbs: ["get", "patch"] verbs: ["get", "patch"]
--- ---
kind: ClusterRoleBinding kind: ClusterRoleBinding
@@ -68,7 +73,7 @@ spec:
args: args:
- patch - patch
- validatingwebhookconfiguration - validatingwebhookconfiguration
- {{ include "spire-controller-manager.fullname" . }}-webhook - {{ $webhookname }}
- --type=strategic - --type=strategic
- -p - -p
- | - |
charts/spire/charts/spire-server/templates/statefulset.yaml
+1 -1
View File
@@ -48,10 +48,10 @@ spec:
shareProcessNamespace: true shareProcessNamespace: true
securityContext: securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }} {{- toYaml .Values.podSecurityContext | nindent 8 }}
{{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }}
{{- if .Values.priorityClassName }} {{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }}
{{- end }} {{- end }}
{{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }}
initContainers: initContainers:
{{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }} {{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }}
- name: wait - name: wait
charts/spire/charts/spire-server/templates/tornjak-ingress.yaml
+25 -3
View File
@@ -1,5 +1,27 @@
{{- if .Values.tornjak.ingress.enabled -}} {{- if .Values.tornjak.ingress.enabled -}}
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.tornjak.ingress) }}
{{- $fullName := include "spire-tornjak.fullname" . -}} {{- $fullName := include "spire-tornjak.fullname" . -}}
{{- $path := "/" }}
{{- $pathType := "Prefix" }}
{{- $tlsSection := true }}
{{- $annotations := deepCopy .Values.tornjak.ingress.annotations }}
{{- if eq $ingressControllerType "ingress-nginx" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
{{- if ne (include "spire-tornjak.connectionType" .) "http" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
{{- end }}
{{- else if eq $ingressControllerType "openshift" }}
{{- $tlsSection = false }}
{{- if ne (include "spire-tornjak.connectionType" .) "http" }}
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
{{- $path = "" }}
{{- $pathType = "ImplementationSpecific" }}
{{- else }}
{{- $_ := set $annotations "route.openshift.io/termination" "edge" }}
{{- end }}
{{- end }}
apiVersion: networking.k8s.io/v1 apiVersion: networking.k8s.io/v1
kind: Ingress kind: Ingress
metadata: metadata:
@@ -7,14 +29,14 @@ metadata:
namespace: {{ include "spire-server.namespace" . }} namespace: {{ include "spire-server.namespace" . }}
labels: labels:
{{ include "spire-server.labels" . | nindent 4}} {{ include "spire-server.labels" . | nindent 4}}
{{- with .Values.tornjak.ingress.annotations }} {{- with $annotations }}
annotations: annotations:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
spec: spec:
{{- if eq (include "spire-tornjak.connectionType" .) "http" }} {{- if eq (include "spire-tornjak.connectionType" .) "http" }}
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-http") | nindent 2 }} {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.http "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
{{- else -}} {{- else -}}
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-https") | nindent 2 }} {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.https "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
{{- end -}} {{- end -}}
{{- end }} {{- end }}
charts/spire/charts/spire-server/values.yaml
+72 -26
View File
@@ -174,8 +174,8 @@ dataStore:
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error" ## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
logLevel: info logLevel: info
## @param jwtIssuer The JWT issuer domain ## @param jwtIssuer The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset
jwtIssuer: https://oidc-discovery.example.org jwtIssuer: ""
## @param clusterName Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) ## @param clusterName Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`)
clusterName: example-cluster clusterName: example-cluster
@@ -202,6 +202,8 @@ federation:
enabled: false enabled: false
## @param federation.ingress.className Ingress class name for federation ## @param federation.ingress.className Ingress class name for federation
className: "" className: ""
## @param federation.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
controllerType: ""
## @param federation.ingress.annotations [object] Annotations for the ingress object ## @param federation.ingress.annotations [object] Annotations for the ingress object
annotations: {} annotations: {}
# kubernetes.io/ingress.class: nginx # kubernetes.io/ingress.class: nginx
@@ -209,14 +211,21 @@ federation:
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
# If Profile Type == https_spiffe: # If Profile Type == https_spiffe:
# nginx.ingress.kubernetes.io/ssl-passthrough: "true" # nginx.ingress.kubernetes.io/ssl-passthrough: "true"
## @param federation.ingress.hosts [array] Host paths for ingress object
hosts:
- host: spire-server-federation.example.org
paths:
- path: /
pathType: Prefix
## @param federation.ingress.tls [array] Secrets containining TLS certs to enable https on ingress ## @param federation.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
host: "spire-server-federation"
## @param federation.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
tlsSecret: ""
## @param federation.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
hosts: []
# - host: spire-server-federation.example.org
# paths:
# - path: /
# pathType: Prefix
## @param federation.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
tls: [] tls: []
# - hosts: # - hosts:
# - spire-server-federation.example.org # - spire-server-federation.example.org
@@ -368,6 +377,12 @@ notifier:
controllerManager: controllerManager:
## @param controllerManager.enabled Flag to enable controller manager ## @param controllerManager.enabled Flag to enable controller manager
enabled: false enabled: false
## @param controllerManager.className specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs.
className: ""
## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.
watchClassless: false
installAndUpgradeHook: installAndUpgradeHook:
## @param controllerManager.installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) ## @param controllerManager.installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`)
enabled: true enabled: true
@@ -386,7 +401,7 @@ controllerManager:
repository: spiffe/spire-controller-manager repository: spiffe/spire-controller-manager
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
version: "" version: ""
tag: "0.3.0" tag: "0.4.0"
## @param controllerManager.resources [object] Resource requests and limits for controller manager ## @param controllerManager.resources [object] Resource requests and limits for controller manager
resources: {} resources: {}
@@ -450,6 +465,18 @@ controllerManager:
federatesWith: [] federatesWith: []
# - example.io # - example.io
# - example.ai # - example.ai
## @param controllerManager.identities.workloadSelectorTemplates [array] Templates to produce selectors that apply to a given workload before it will receive an ID
workloadSelectorTemplates: []
## @param controllerManager.identities.ttl Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen.
ttl: ""
## @param controllerManager.identities.jwtTTL Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen.
jwtTTL: ""
## @param controllerManager.identities.admin Indicates any pod matched by this identity will be an admin. Use this with extreme care.
admin: false
## @param controllerManager.identities.downstream Set if this spire instance is a root server and the workloads are downstream servers.
downstream: false
## @param controllerManager.identities.autoPopulateDNSNames Auto populate DNS names from services attached to pods
autoPopulateDNSNames: false
validatingWebhookConfiguration: validatingWebhookConfiguration:
## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued ## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued
@@ -487,6 +514,8 @@ ingress:
enabled: false enabled: false
## @param ingress.className Ingress class name ## @param ingress.className Ingress class name
className: "" className: ""
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
controllerType: ""
## @param ingress.annotations [object] Annotations for the ingress object ## @param ingress.annotations [object] Annotations for the ingress object
annotations: {} annotations: {}
# kubernetes.io/ingress.class: nginx # kubernetes.io/ingress.class: nginx
@@ -494,13 +523,20 @@ ingress:
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
# nginx.ingress.kubernetes.io/ssl-passthrough: "true" # nginx.ingress.kubernetes.io/ssl-passthrough: "true"
## @param ingress.hosts [array] Host paths for ingress object ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
hosts: host: "spire-server"
- host: spire-server.example.org
paths: ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
- path: / tlsSecret: ""
pathType: Prefix
## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress ## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
hosts: []
# - host: spire-server.example.org
# paths:
# - path: /
# pathType: Prefix
## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
tls: [] tls: []
# - secretName: spire-server-tls # - secretName: spire-server-tls
# hosts: # hosts:
@@ -534,7 +570,7 @@ nodeAttestor:
## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor ## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor
serviceAccountAllowList: [] serviceAccountAllowList: []
# tornjak - Tornjak default values ## @section Tornjak
tornjak: tornjak:
## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production) ## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production)
enabled: false enabled: false
@@ -564,18 +600,28 @@ tornjak:
## @param tornjak.ingress.enabled Flag to enable ingress for Tornjak backend service ## @param tornjak.ingress.enabled Flag to enable ingress for Tornjak backend service
## @param tornjak.ingress.className Ingress class name for Tornjak backend service ## @param tornjak.ingress.className Ingress class name for Tornjak backend service
## @param tornjak.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
## @param tornjak.ingress.annotations [object] Annotations for Tornjak backend service ## @param tornjak.ingress.annotations [object] Annotations for Tornjak backend service
## @param tornjak.ingress.hosts [array] Host paths for ingress Tornjak backend service
ingress: ingress:
enabled: false enabled: false
className: "" className: ""
controllerType: ""
annotations: {} annotations: {}
hosts:
- host: tornjak-backend.example.org ## @param tornjak.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
paths: host: "tornjak-backend"
- path: /
pathType: Prefix ## @param tornjak.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
## @param tornjak.ingress.tls [array] Secrets containing TLS certs to enable https on ingress tlsSecret: ""
## @param tornjak.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
hosts: []
# - host: tornjak-backend.example.org
# paths:
# - path: /
# pathType: Prefix
## @param tornjak.ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
tls: [] tls: []
# - secretName: chart-example-tls # - secretName: chart-example-tls
# hosts: # hosts:
@@ -678,4 +724,4 @@ tests:
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
version: "" version: ""
tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214
charts/spire/charts/tornjak-frontend/README.md
+50 -45
View File
@@ -1,7 +1,5 @@
# tornjak-frontend # tornjak-frontend
<!-- This README.md is generated. Please edit README.md.gotmpl -->
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.2.2](https://img.shields.io/badge/AppVersion-v1.2.2-informational?style=flat-square) ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.2.2](https://img.shields.io/badge/AppVersion-v1.2.2-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
@@ -11,7 +9,8 @@ A Helm chart to deploy Tornjak frontend
## Version support ## Version support
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`). > [!Note]
> This Chart is still in development and still subject to change the API (`values.yaml`).
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although > Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
> we do aim for as much stability as possible. > we do aim for as much stability as possible.
@@ -52,49 +51,55 @@ port forwarding. See the chart NOTES output for more details.
* <https://github.com/spiffe/tornjak> * <https://github.com/spiffe/tornjak>
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
## Parameters ## Parameters
### Chart parameters ### Chart parameters
| Name | Description | Value | | Name | Description | Value |
| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | | ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` | | `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` |
| `image.pullPolicy` | The image pull policy | `IfNotPresent` | | `image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `imagePullSecrets` | Pull secrets for images | `[]` | | `imagePullSecrets` | Pull secrets for images | `[]` |
| `nameOverride` | Name override | `""` | | `nameOverride` | Name override | `""` |
| `namespaceOverride` | Namespace override | `""` | | `namespaceOverride` | Namespace override | `""` |
| `fullnameOverride` | Fullname override | `""` | | `fullnameOverride` | Fullname override | `""` |
| `serviceAccount.create` | Specifies whether a service account should be created | `true` | | `serviceAccount.create` | Specifies whether a service account should be created | `true` |
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | | `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | | `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
| `labels` | Labels for tornjak frontend pods | `{}` | | `labels` | Labels for tornjak frontend pods | `{}` |
| `podSecurityContext` | Pod security context | `{}` | | `podSecurityContext` | Pod security context | `{}` |
| `securityContext` | Security context | `{}` | | `securityContext` | Security context | `{}` |
| `service.type` | Service type | `ClusterIP` | | `service.type` | Service type | `ClusterIP` |
| `service.port` | Service port | `3000` | | `service.port` | Service port | `3000` |
| `service.annotations` | Annotations for service resource | `{}` | | `service.annotations` | Annotations for service resource | `{}` |
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | | | `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | |
| `affinity` | Affinity rules | `{}` | | `affinity` | Affinity rules | `{}` |
| `tolerations` | List of tolerations | `[]` | | `tolerations` | List of tolerations | `[]` |
| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` | | `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` |
| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. | `http://localhost:10000/` | | `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If unset, autodetection is atempted. | `""` |
| `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` | | `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` |
| `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` | | `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` |
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | | `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` |
| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | | `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | | `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` | | `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` |
| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` | | `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` |
| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` | | `workingDir` | Path containing the Tornjak frontend within the image | `/usr/src/app` |
| `ingress.className` | Ingress class name for Tornjak frontend service | `""` | | `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` |
| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` | | `ingress.className` | Ingress class name for Tornjak frontend service | `""` |
| `ingress.hosts` | Host paths for ingress Tornjak frontend service | `[]` | | `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress | `[]` | | `ingress.annotations` | Annotations for Tornjak frontend service | `{}` |
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-frontend` |
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` | | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` |
charts/spire/charts/tornjak-frontend/README.md.gotmpl
-54
View File
@@ -1,54 +0,0 @@
{{ template "chart.header" . }}
<!-- This README.md is generated. Please edit README.md.gotmpl -->
{{ template "chart.deprecationWarning" . }}
{{ template "chart.badgesSection" . }}
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
{{ template "chart.description" . }}
{{ template "chart.homepageLine" . }}
## Version support
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
> we do aim for as much stability as possible.
| Dependency | Supported Versions |
|:-----------|:-------------------|
| SPIRE | `1.5.3+`, `1.6.x` |
| Tornjak | `1.0.x` |
| Helm | `3.x` |
## Tornjak
Tornjak is the UI and Control Plane for SPIRE [https://github.com/spiffe/tornjak](https://github.com/spiffe/tornjak) and it is composed of two components:
* [Backend](../spire-server/README.md) - Tornjak APIs that extend SPIRE APIs with Control Plane functionality
* Frontend (this chart) - Tornjak UI
## Prerequisites
This chart requires access to Tornjak Backend (`tornjakFrontend.apiServerURL`).
This URL needs to be reachable from your web browser and can therefore not be a cluster internal URL.
Obtain the URL for Tornjak APIs. If deployed in the same cluster, locally,
Tornjak APIs are typically available at `http://localhost:10000`.
Review Tornjak documentation for more details.
## Usage
Since this is just a demo version, to access Tornjak APIs you can use
port forwarding. See the chart NOTES output for more details.
{{ template "chart.maintainersSection" . }}
{{ template "chart.sourcesSection" . }}
{{ template "chart.requirementsSection" . }}
{{ template "chart.valuesSection" . }}
----------------------------------------------
charts/spire/charts/tornjak-frontend/templates/_helpers.tpl
+3 -2
View File
@@ -78,8 +78,9 @@ Create URL for accessing Tornjak APIs
{{- define "tornjak-frontend.apiURL" -}} {{- define "tornjak-frontend.apiURL" -}}
{{- if .Values.apiServerURL -}} {{- if .Values.apiServerURL -}}
{{- .Values.apiServerURL -}} {{- .Values.apiServerURL -}}
{{- else if .Values.ingress.enabled }}
{{- printf "https://tornjak-backend.%s" (include "spire-lib.trust-domain" .) }}
{{- else }} {{- else }}
{{- $feurl := print "http://localhost:" .Values.service.port }} {{- print "http://localhost:" .Values.service.port }}
{{- $feurl }}
{{- end }} {{- end }}
{{- end }} {{- end }}
charts/spire/charts/tornjak-frontend/templates/deployment.yaml
+2 -2
View File
@@ -53,9 +53,9 @@ spec:
{{- end }} {{- end }}
volumeMounts: volumeMounts:
- name: cache - name: cache
mountPath: /usr/src/app/node_modules/.cache mountPath: {{ .Values.workingDir }}/node_modules/.cache
- name: env - name: env
mountPath: /usr/src/app/build/tmp mountPath: {{ .Values.workingDir }}/build/tmp
{{- with .Values.nodeSelector }} {{- with .Values.nodeSelector }}
nodeSelector: nodeSelector:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
charts/spire/charts/tornjak-frontend/templates/ingress.yaml
+12 -2
View File
@@ -1,5 +1,15 @@
{{- if .Values.ingress.enabled -}} {{- if .Values.ingress.enabled -}}
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
{{- $fullName := include "tornjak-frontend.fullname" . -}} {{- $fullName := include "tornjak-frontend.fullname" . -}}
{{- $tlsSection := true }}
{{- $annotations := deepCopy .Values.ingress.annotations }}
{{- if eq $ingressControllerType "ingress-nginx" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
{{- else if eq $ingressControllerType "openshift" }}
{{- $_ := set $annotations "route.openshift.io/termination" "edge" }}
{{- $tlsSection = false }}
{{- end }}
apiVersion: networking.k8s.io/v1 apiVersion: networking.k8s.io/v1
kind: Ingress kind: Ingress
metadata: metadata:
@@ -7,10 +17,10 @@ metadata:
namespace: {{ include "tornjak-frontend.namespace" . }} namespace: {{ include "tornjak-frontend.namespace" . }}
labels: labels:
{{ include "tornjak-frontend.labels" . | nindent 4}} {{ include "tornjak-frontend.labels" . | nindent 4}}
{{- with .Values.ingress.annotations }} {{- with $annotations }}
annotations: annotations:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
spec: spec:
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }} {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
{{- end }} {{- end }}
charts/spire/charts/tornjak-frontend/values.yaml
+23 -10
View File
@@ -88,8 +88,8 @@ topologySpreadConstraints: []
# cpu: 100m # cpu: 100m
# memory: 512Mi # memory: 512Mi
## @param apiServerURL URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. ## @param apiServerURL URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If unset, autodetection is atempted.
apiServerURL: "http://localhost:10000/" # 👈 Use it for minikube or kind apiServerURL: ""
# SPIRE Healthchecker indicator # SPIRE Healthchecker indicator
spireHealthCheck: spireHealthCheck:
@@ -113,20 +113,33 @@ startupProbe:
failureThreshold: 6 failureThreshold: 6
successThreshold: 1 successThreshold: 1
## @param workingDir Path containing the Tornjak frontend within the image
workingDir: /usr/src/app
## @param ingress.enabled Flag to enable ingress for Tornjak frontend service ## @param ingress.enabled Flag to enable ingress for Tornjak frontend service
## @param ingress.className Ingress class name for Tornjak frontend service ## @param ingress.className Ingress class name for Tornjak frontend service
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
## @param ingress.annotations [object] Annotations for Tornjak frontend service ## @param ingress.annotations [object] Annotations for Tornjak frontend service
## @param ingress.hosts [array] Host paths for ingress Tornjak frontend service
ingress: ingress:
enabled: false enabled: false
className: "" className: ""
controllerType: ""
annotations: {} annotations: {}
hosts:
- host: tornjak-frontend.example.org ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
paths: host: "tornjak-frontend"
- path: /
pathType: Prefix ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress tlsSecret: ""
## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
hosts: []
# - host: tornjak-frontend.example.org
# paths:
# - path: /
# pathType: Prefix
## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
tls: [] tls: []
# - secretName: chart-example-tls # - secretName: chart-example-tls
# hosts: # hosts:
@@ -145,4 +158,4 @@ tests:
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
version: "" version: ""
tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214
charts/spire/templates/NOTES.txt
+10
View File
@@ -21,3 +21,13 @@ Warning: You're using an unsupported plugin. Functionality of this release and f
Warning: You're using an experimental config. Functionality of this release and future upgrades aren't guaranteed to work smoothly. Warning: You're using an experimental config. Functionality of this release and future upgrades aren't guaranteed to work smoothly.
{{- end }} {{- end }}
{{- $className := include "spire-server.controller-manager-class-name" (dict "Values" (index .Values "spire-server") "Release" .Release) }}
{{- if (index .Values "spire-server").controllerManager.enabled }}
{{- if (index .Values "spire-server").controllerManager.watchClassless }}
Spire CR's will be handled if no className is specified or if className is set to "{{ $className }}"
{{- else }}
Spire CR's will be handled only if className is set to "{{ $className }}"
{{- end }}
{{- end }}
charts/spire/templates/_spire-lib.tpl
+65 -1
View File
@@ -17,8 +17,10 @@
{{- define "spire-lib.jwt-issuer" }} {{- define "spire-lib.jwt-issuer" }}
{{- if ne (len (dig "spire" "jwtIssuer" "" .Values.global)) 0 }} {{- if ne (len (dig "spire" "jwtIssuer" "" .Values.global)) 0 }}
{{- .Values.global.spire.jwtIssuer }} {{- .Values.global.spire.jwtIssuer }}
{{- else }} {{- else if ne (len .Values.jwtIssuer) 0 }}
{{- .Values.jwtIssuer }} {{- .Values.jwtIssuer }}
{{- else }}
{{- printf "oidc-discovery.%s" (include "spire-lib.trust-domain" .) }}
{{- end }} {{- end }}
{{- end }} {{- end }}
@@ -61,17 +63,78 @@
{{- end }} {{- end }}
{{- end }} {{- end }}
{{/* Takes in a dictionary with keys:
* global - the standard global object
* ingress - a standard format ingress config object
*/}}
{{- define "spire-lib.ingress-controller-type" }}
{{- $type := "" }}
{{- if ne (len (dig "spire" "ingressControllerType" "" .global)) 0 }}
{{- $type = .global.spire.ingressControllerType }}
{{- else if ne .ingress.controllerType "" }}
{{- $type = .ingress.controllerType }}
{{- else if (dig "openshift" false .global) }}
{{- $type = "openshift" }}
{{- else }}
{{- $type = "other" }}
{{- end }}
{{- if not (has $type (list "ingress-nginx" "openshift" "other")) }}
{{- fail "Unsupported ingress controller type specified. Must be one of [ingress-nginx, openshift, other]" }}
{{- end }}
{{- $type }}
{{- end }}
{{/* Takes in a dictionary with keys:
* ingress - the standardized ingress object
* Values - Chart values
*/}}
{{ define "spire-lib.ingress-calculated-name" }}
{{- $host := .ingress.host }}
{{- if not (contains $host ".") }}
{{- $host = printf "%s.%s" $host (include "spire-lib.trust-domain" .) }}
{{- end }}
{{- $host }}
{{- end }}
{{/* Takes in a dictionary with keys: {{/* Takes in a dictionary with keys:
* ingress - the standardized ingress object * ingress - the standardized ingress object
* svcName - The service to route to * svcName - The service to route to
* port - which port on the service to use * port - which port on the service to use
* path - optional path to set on the rules
* pathType - typical ingress path type
* tlsSection - bool specifying to add by default the tls section to the ingress. Ingress-nginx needs true, openshift needs false.
* Values - Chart values
*/}} */}}
{{ define "spire-lib.ingress-spec" }} {{ define "spire-lib.ingress-spec" }}
{{- $host := include "spire-lib.ingress-calculated-name" . }}
{{- $svcName := .svcName }} {{- $svcName := .svcName }}
{{- $port := .port }} {{- $port := .port }}
{{- with .ingress.className }} {{- with .ingress.className }}
ingressClassName: {{ . | quote }} ingressClassName: {{ . | quote }}
{{- end }} {{- end }}
{{- if eq (add (len .ingress.tls) (len .ingress.hosts)) 0 }}
{{ if or .tlsSection .ingress.tlsSecret }}
tls:
- hosts:
- {{ $host | quote }}
{{- with .ingress.tlsSecret }}
secretName: {{ . | quote }}
{{- end }}
{{- end }}
rules:
- host: {{ $host | quote }}
http:
paths:
- pathType: {{ .pathType }}
{{- with .path }}
path: {{ . }}
{{- end }}
backend:
service:
name: {{ $svcName | quote }}
port:
number: {{ $port }}
{{- else }}
{{- if .ingress.tls }} {{- if .ingress.tls }}
tls: tls:
{{- range .ingress.tls }} {{- range .ingress.tls }}
@@ -98,6 +161,7 @@ rules:
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}
{{- define "spire-lib.kubectl-image" }} {{- define "spire-lib.kubectl-image" }}
{{- $root := deepCopy . }} {{- $root := deepCopy . }}
charts/spire/values.yaml
+5 -2
View File
@@ -13,8 +13,8 @@ global:
bundleConfigMap: "" bundleConfigMap: ""
## @param global.spire.clusterName The name of the k8s cluster for Spire install ## @param global.spire.clusterName The name of the k8s cluster for Spire install
clusterName: example-cluster clusterName: example-cluster
## @param global.spire.jwtIssuer The issuer for Spire JWT tokens ## @param global.spire.jwtIssuer The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset
jwtIssuer: oidc-discovery.example.org jwtIssuer: ""
## @param global.spire.trustDomain The trust domain for Spire install ## @param global.spire.trustDomain The trust domain for Spire install
trustDomain: example.org trustDomain: example.org
## @param global.spire.upstreamServerAddress Set what address to use for the upstream server when using nested spire ## @param global.spire.upstreamServerAddress Set what address to use for the upstream server when using nested spire
@@ -27,6 +27,9 @@ global:
## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production. ## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
strictMode: false strictMode: false
## @param global.spire.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
ingressControllerType: ""
installAndUpgradeHooks: installAndUpgradeHooks:
## @param global.installAndUpgradeHooks.enabled Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) ## @param global.installAndUpgradeHooks.enabled Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`)
enabled: true enabled: true
ct.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ target-branch: main
chart-dirs: chart-dirs:
- charts - charts
chart-repos: chart-repos:
- spiffe=https://spiffe.github.io/helm-charts/ - spiffe=https://spiffe.github.io/helm-charts-hardened/
- bitnami=https://charts.bitnami.com/bitnami - bitnami=https://charts.bitnami.com/bitnami
- ingress-nginx=https://kubernetes.github.io/ingress-nginx - ingress-nginx=https://kubernetes.github.io/ingress-nginx
exclude-deprecated: true exclude-deprecated: true
examples/external-mysql/run-tests.sh
+17 -4
View File
@@ -12,11 +12,24 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
# shellcheck source=/dev/null # shellcheck source=/dev/null
source "${TESTDIR}/common.sh" source "${TESTDIR}/common.sh"
CLEANUP=1
for i in "$@"; do
case $i in
-c)
CLEANUP=0
shift # past argument=value
;;
esac
done
teardown() { teardown() {
helm uninstall --namespace "spire-server" spire 2>/dev/null || true if [ "${CLEANUP}" -eq 1 ]; then
helm uninstall --namespace mysql mysql 2>/dev/null || true helm uninstall --namespace "spire-server" spire 2>/dev/null || true
kubectl delete ns spire-server 2>/dev/null || true helm uninstall --namespace mysql mysql 2>/dev/null || true
kubectl delete ns spire-system 2>/dev/null || true kubectl delete ns spire-server 2>/dev/null || true
kubectl delete ns spire-system 2>/dev/null || true
fi
} }
trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
examples/external-postgresql/run-tests.sh
+17 -4
View File
@@ -12,11 +12,24 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
# shellcheck source=/dev/null # shellcheck source=/dev/null
source "${TESTDIR}/common.sh" source "${TESTDIR}/common.sh"
CLEANUP=1
for i in "$@"; do
case $i in
-c)
CLEANUP=0
shift # past argument=value
;;
esac
done
teardown() { teardown() {
helm uninstall --namespace "spire-server" spire 2>/dev/null || true if [ "${CLEANUP}" -eq 1 ]; then
helm uninstall --namespace "spire-server" postgresql 2>/dev/null || true helm uninstall --namespace "spire-server" spire 2>/dev/null || true
kubectl delete ns spire-server 2>/dev/null || true helm uninstall --namespace "spire-server" postgresql 2>/dev/null || true
kubectl delete ns spire-system 2>/dev/null || true kubectl delete ns spire-server 2>/dev/null || true
kubectl delete ns spire-system 2>/dev/null || true
fi
} }
trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
examples/nested/run-tests.sh
+19 -10
View File
@@ -12,13 +12,26 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
# shellcheck source=/dev/null # shellcheck source=/dev/null
source "${TESTDIR}/common.sh" source "${TESTDIR}/common.sh"
teardown() { CLEANUP=1
helm uninstall --namespace spire-server spire 2>/dev/null || true
kubectl delete ns spire-server 2>/dev/null || true
kubectl delete ns spire-system 2>/dev/null || true
helm uninstall --namespace mysql spire-root-server 2>/dev/null || true for i in "$@"; do
kubectl delete ns spire-root-server 2>/dev/null || true case $i in
-c)
CLEANUP=0
shift # past argument=value
;;
esac
done
teardown() {
if [ "${CLEANUP}" -eq 1 ]; then
helm uninstall --namespace spire-server spire 2>/dev/null || true
kubectl delete ns spire-server 2>/dev/null || true
kubectl delete ns spire-system 2>/dev/null || true
helm uninstall --namespace mysql spire-root-server 2>/dev/null || true
kubectl delete ns spire-root-server 2>/dev/null || true
fi
} }
trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
@@ -33,10 +46,6 @@ helm upgrade --install --create-namespace spire charts/spire \
--values "${DEPS}/spire-root-server-values.yaml" \ --values "${DEPS}/spire-root-server-values.yaml" \
--wait --wait
kubectl get nodes -o go-template='{{range .items}}{{printf "%s\n" .metadata.uid}}{{end}}' | while read -r line; do
kubectl exec -t spire-server-0 -n "spire-root-server" -- spire-server entry create -spiffeID spiffe://production.other/production/nested-spire -parentID "spiffe://production.other/spire/agent/k8s_psat/production/$line" -selector k8s:pod-label:app.kubernetes.io/name:server -downstream
done
helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \ helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \
--wait spire charts/spire --wait spire charts/spire
helm test --namespace spire-server spire helm test --namespace spire-server spire
examples/openshift/README.md
+80
View File
@@ -0,0 +1,80 @@
# Recommended setup for installing Spire on Openshift
> [!Note]
> This functionality is under development. It works but has no automated testing and will have security tightened in the future.
This deployment works only with Openshift version 4.13 or higher. Get the Openshift platform here: [try.openshift.com](try.openshift.com)
To be consistent with the rest of the Spire helm-charts,
we deploy Spire across 2 namespaces.
```shell
kubectl create namespace "spire-system"
kubectl create namespace "spire-server"
#Note, the first install requires privilege due to helm ordering issue. After install it can be safely tightened back up.
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=privileged
kubectl label namespace "spire-system" security.openshift.io/scc.podSecurityLabelSync=false
kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
kubectl label namespace "spire-system" pod-security.kubernetes.io/warn=privileged --overwrite
kubectl label namespace "spire-system" pod-security.kubernetes.io/audit=privileged --overwrite
helm upgrade --install --namespace spire-server spire-crds charts/spire-crds
```
Obtain you ingress subdomain:
```shell
appdomain=$(oc get cm -n openshift-config-managed console-public -o go-template="{{ .data.consoleURL }}" | sed 's@https://@@; s/^[^.]*\.//')
echo "$appdomain"
```
Update the `example-your-values.yaml` file with your subdomain.
> [!Note]
> The location of the apps subdomain may be different in certain environments_
## Standard Deployment
```shell
helm upgrade --install --namespace spire-server spire charts/spire \
--values examples/production/values.yaml \
--values examples/openshift/openshift-values.yaml \
--values examples/production/example-your-values.yaml \
--render-subchart-notes
```
## IBM Cloud Deployment
Openshift on IBM Cloud requires additional configuration:
```shell
helm upgrade --install --namespace spire-server spire charts/spire \
--values examples/production/values.yaml \
--values examples/openshift/openshift-values.yaml \
--set spiffe-csi-driver.kubeletPath=/var/data/kubelet \
--set spiffe-csi-driver.restrictedScc.enabled=true \
--values examples/production/example-your-values.yaml \
--render-subchart-notes
```
## Feature Customization
Additional features such as tornjak can be enabled by including their example values files before --values examples/production/example-your-values.yaml
For example:
```shell
--values examples/openshift/openshift-values.yaml \
--values examples/tornjak/values.yaml \
--values examples/production/example-your-values.yaml \
```
## Finish install
Once installed, the namespace security can be tightened back up.
```shell
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted --overwrite
```
examples/openshift/openshift-values.yaml
+82
View File
@@ -0,0 +1,82 @@
global:
openshift: true
telemetry:
prometheus:
enabled: true
spire-server:
tornjak:
image:
registry: ghcr.io
repository: spiffe/tornjak-backend
tag: ubi-v1.4.1
nodeAttestor:
k8sPsat:
serviceAccountAllowList: ["spire-system:spire-agent"]
notifier:
k8sbundle:
namespace: spire-system
podSecurityContext:
# These are unset so that openshift can automatically assign its own restricted uids to the pods
runAsUser: null
runAsGroup: null
fsGroup: null
spire-agent:
podSecurityContext:
runAsUser: null
runAsGroup: null
fsGroup: null
# Talk from the agent to kubelet based on hostname instead of localhost
extraEnvVars:
- name: MY_NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
upstream-spire-agent:
podSecurityContext:
runAsUser: null
runAsGroup: null
fsGroup: null
spiffe-oidc-discovery-provider:
podSecurityContext:
runAsUser: null
runAsGroup: null
fsGroup: null
tornjak-frontend:
workingDir: /opt/app-root/src
image:
registry: ghcr.io
repository: spiffe/tornjak-frontend
tag: ubi-v1.4.1
podSecurityContext:
runAsUser: null
runAsGroup: null
fsGroup: null
spiffe-csi-driver:
csiDriverLabels:
security.openshift.io/csi-ephemeral-volume-profile: restricted
initContainers:
- terminationMessagePath: /dev/termination-log
name: set-context
command:
- chcon
- '-Rvt'
- container_file_t
- spire-agent-socket/
securityContext:
capabilities:
drop:
- all
privileged: true
imagePullPolicy: Always
volumeMounts:
- name: spire-agent-socket-dir
mountPath: /spire-agent-socket
terminationMessagePolicy: File
image: 'registry.access.redhat.com/ubi9:latest'
examples/production/README.md
+8 -3
View File
@@ -20,7 +20,7 @@ If your using ingress-nginx and want to expose the spiffe oidc discovery provide
cluster, add the following to the end of the helm upgrade example: cluster, add the following to the end of the helm upgrade example:
```shell ```shell
-f values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml -f values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml
``` ```
If you want to expose your spire-server outside of Kubernetes and are using ingress-nginx, add following values file when running `helm template/install/upgrade`. If you want to expose your spire-server outside of Kubernetes and are using ingress-nginx, add following values file when running `helm template/install/upgrade`.
@@ -28,21 +28,25 @@ If you want to expose your spire-server outside of Kubernetes and are using ingr
```shell ```shell
-f values-expose-spire-server-ingress-nginx.yaml -f values-expose-spire-server-ingress-nginx.yaml
``` ```
For example: For example:
```shell ```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-spire-server-ingress-nginx.yaml helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-spire-server-ingress-nginx.yaml
``` ```
If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx
you have two options as described here: you have two options as described here:
https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles [github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles](https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles)
If you chose profile https_web, use: If you chose profile https_web, use:
```shell ```shell
-f values-expose-federation-https-web-ingress-nginx.yaml -f values-expose-federation-https-web-ingress-nginx.yaml
``` ```
For example: For example:
```shell ```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-web-ingress-nginx.yaml helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-web-ingress-nginx.yaml
``` ```
@@ -52,10 +56,11 @@ If you chose profile https_spiffe, use:
```shell ```shell
-f values-expose-federation-https-spiffe-ingress-nginx.yaml -f values-expose-federation-https-spiffe-ingress-nginx.yaml
``` ```
For example: For example:
```shell ```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-spiffe-ingress-nginx.yaml helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-spiffe-ingress-nginx.yaml
``` ```
See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup. See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
examples/production/example-your-values.yaml
+10 -33
View File
@@ -2,7 +2,6 @@ global:
spire: spire:
clusterName: production clusterName: production
trustDomain: production.other trustDomain: production.other
jwtIssuer: oidc-discovery.production.other
spire-server: spire-server:
ca_subject: ca_subject:
@@ -10,36 +9,14 @@ spire-server:
organization: Production organization: Production
common_name: production.other common_name: production.other
ingress: # ingress:
hosts: # host: spire-server
- host: spire-server.production.other # federation:
paths: # ingress:
- path: / # host: spire-server-federation
pathType: Prefix # tlsSecret: tls-cert
tls:
- hosts:
- spire-server.production.other
federation:
ingress:
hosts:
- host: spire-server-federation.production.other
paths:
- path: /
pathType: Prefix
tls:
- hosts:
- spire-server-federation.production.other
secretName: tls-cert
spiffe-oidc-discovery-provider:
ingress:
hosts:
- host: oidc-discovery.production.other
paths:
- path: /
pathType: Prefix
tls:
- secretName: tls-cert
hosts:
- oidc-discovery.production.other
# spiffe-oidc-discovery-provider:
# ingress:
# host: oidc-discovery
# tlsSecret: tls-cert
examples/production/run-tests.sh
+39 -40
View File
@@ -2,7 +2,7 @@
set -xe set -xe
UPGRADE_VERSION=v0.13.0 UPGRADE_VERSION=v0.14.0
UPGRADE_REPO=https://spiffe.github.io/helm-charts-hardened UPGRADE_REPO=https://spiffe.github.io/helm-charts-hardened
SCRIPT="$(readlink -f "$0")" SCRIPT="$(readlink -f "$0")"
@@ -48,30 +48,43 @@ teardown() {
trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
kubectl create namespace spire-system 2>/dev/null || true if [[ -n "$UPGRADE_ARGS" ]]; then
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true pushd "${SCRIPTPATH}"
kubectl create namespace "${ns}" 2>/dev/null || true git clone https://github.com/spiffe/helm-charts-hardened "${UPGRADE_VERSION}"
kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true pushd "${UPGRADE_VERSION}"
git checkout "${UPGRADE_VERSION/v/spire-}"
helm install --create-namespace -n spire-system spire-crds charts/spire-crds
./examples/production/run-tests.sh -c
popd
popd
# Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.)
helm upgrade -n spire-system spire-crds charts/spire-crds --wait
else
"${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \ kubectl create namespace spire-system 2>/dev/null || true
--namespace cert-manager \ kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true
--create-namespace \ kubectl create namespace "${ns}" 2>/dev/null || true
--set installCRDs=true \ kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true
--wait
kubectl apply -f "${DEPS}/testcert.yaml" -n spire-server "${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \
--namespace cert-manager \
--create-namespace \
--set installCRDs=true \
--wait
"${helm_install[@]}" ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \ kubectl apply -f "${DEPS}/testcert.yaml" -n spire-server
--namespace ingress-nginx \
--create-namespace \
--set controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP \
--set controller.ingressClassResource.default=true \
--wait
ip=$(kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ .spec.clusterIP }}') "${helm_install[@]}" ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \
echo "$ip" oidc-discovery.production.other --namespace ingress-nginx \
--create-namespace \
--set controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP \
--set controller.ingressClassResource.default=true \
--wait
cat > /tmp/dummydns <<EOF ip=$(kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ .spec.clusterIP }}')
echo "$ip" oidc-discovery.production.other
cat > /tmp/dummydns <<EOF
spiffe-oidc-discovery-provider: spiffe-oidc-discovery-provider:
tests: tests:
hostAliases: hostAliases:
@@ -91,18 +104,21 @@ spire-server:
- "spire-server-federation.production.other" - "spire-server-federation.production.other"
EOF EOF
fi
install_and_test() { install_and_test() {
# Can't pass an array to a function. We completely control the string so its safe. # Can't pass an array to a function. We completely control the string so its safe.
# shellcheck disable=SC2086 # shellcheck disable=SC2086
"${helm_install[@]}" spire "$1" \ "${helm_install[@]}" spire "$1" \
--namespace "${ns}" \ --namespace "${ns}" \
--values "${SCRIPTPATH}/values.yaml" \ --values "${SCRIPTPATH}/values.yaml" \
--values "${SCRIPTPATH}/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml" \ --values "${SCRIPTPATH}/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml" \
--values "${SCRIPTPATH}/values-export-spire-server-ingress-nginx.yaml" \ --values "${SCRIPTPATH}/values-expose-spire-server-ingress-nginx.yaml" \
--values "${SCRIPTPATH}/values-export-federation-https-web-ingress-nginx.yaml" \ --values "${SCRIPTPATH}/values-expose-federation-https-web-ingress-nginx.yaml" \
--values /tmp/dummydns \ --values /tmp/dummydns \
--set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \ --set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \
--set spire-agent.server.address=spire-server.production.other,spire-agent.server.port=443 \ --set spire-agent.server.address=spire-server.production.other,spire-agent.server.port=443 \
--set spire-server.federation.ingress.tlsSecret=tls-cert,spiffe-oidc-discovery-provider.ingress.tlsSecret=tls-cert \
--values "${SCRIPTPATH}/example-your-values.yaml" \ --values "${SCRIPTPATH}/example-your-values.yaml" \
$2 \ $2 \
--wait --wait
@@ -110,23 +126,6 @@ install_and_test() {
helm test --namespace "${ns}" spire helm test --namespace "${ns}" spire
} }
if [[ -n "$UPGRADE_ARGS" ]]; then
install_and_test spire "$UPGRADE_ARGS"
# Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.)
kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
helm upgrade --install -n spire-server spire-crds charts/spire-crds
fi
install_and_test charts/spire "" install_and_test charts/spire ""
if helm get manifest -n spire-server spire | grep -i example; then if helm get manifest -n spire-server spire | grep -i example; then
examples/production/values-export-federation-https-spiffe-ingress-nginx.yaml
-25
View File
@@ -1,25 +0,0 @@
spire-server:
federation:
enabled: true
ingress:
enabled: true
annotations:
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
# Optional settings you may put in your own values.
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
# className: nginx
hosts:
- host: spire-server-federation.example.org
paths:
- path: /
pathType: Prefix
tls:
- hosts:
- spire-server-federation.example.org
examples/production/values-export-federation-https-web-ingress-nginx.yaml
-28
View File
@@ -1,28 +0,0 @@
spire-server:
tests:
tls:
enabled: true
federation:
enabled: true
ingress:
enabled: true
annotations:
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
# Optional settings you may put in your own values.
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
# className: nginx
hosts:
- host: spire-server-federation.example.org
paths:
- path: /
pathType: Prefix
tls:
- hosts:
- spire-server-federation.example.org
secretName: spire-server-federation-tls
examples/production/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml
-27
View File
@@ -1,27 +0,0 @@
spiffe-oidc-discovery-provider:
tests:
tls:
enabled: true
ingress:
enabled: true
annotations:
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
# Optional settings you may put in your own values.
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
# className: nginx
# You must override these in your own values file with the appropriate hostname
# and secret or it wont start.
hosts:
- host: oidc-discovery.example.org
paths:
- path: /
pathType: Prefix
tls:
- secretName: tls-cert
hosts:
- oidc-discovery.example.org
examples/production/values-export-spire-server-ingress-nginx.yaml
-25
View File
@@ -1,25 +0,0 @@
spire-server:
ingress:
enabled: true
annotations:
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
# Optional settings you may put in your own values.
# kubernetes.io/tls-acme: "true"
# kubernetes.io/ingress.class: nginx
# className: nginx
# You must override these in your own values file with the appropriate hostname
# and secret or it wont start.
hosts:
- host: spire-server.example.org
paths:
- path: /
pathType: Prefix
tls:
- hosts:
- spire-server.example.org
examples/production/values-expose-federation-https-spiffe-ingress-nginx.yaml
+10
View File
@@ -0,0 +1,10 @@
spire-server:
federation:
enabled: true
ingress:
enabled: true
controllerType: ingress-nginx
annotations:
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
# className: nginx
examples/production/values-expose-federation-https-web-ingress-nginx.yaml
+13
View File
@@ -0,0 +1,13 @@
spire-server:
tests:
tls:
enabled: true
federation:
enabled: true
ingress:
enabled: true
controllerType: ingress-nginx
# className: nginx
tlsSecret: spire-server-federation-tls
examples/production/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml
+12
View File
@@ -0,0 +1,12 @@
spiffe-oidc-discovery-provider:
tests:
tls:
enabled: true
ingress:
enabled: true
controllerType: ingress-nginx
# className: nginx
# You must override these in your own values file with the appropriate secret or it wont start.
tlsSecret: tls-cert
examples/production/values-expose-spire-server-ingress-nginx.yaml
+6
View File
@@ -0,0 +1,6 @@
spire-server:
ingress:
enabled: true
controllerType: ingress-nginx
# className: nginx
examples/tornjak/README.md
+2 -1
View File
@@ -1,6 +1,7 @@
# Recommended setup to deploy Tornjak # Recommended setup to deploy Tornjak
> **Warning**: The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production. > [!Warning]
> The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production.
To install Spire with the least privileges possible we deploy spire across 2 namespaces. To install Spire with the least privileges possible we deploy spire across 2 namespaces.
examples/tornjak/run-tests.sh
+15 -2
View File
@@ -12,9 +12,22 @@ source "${TESTDIR}/common.sh"
helm_install=(helm upgrade --install --create-namespace) helm_install=(helm upgrade --install --create-namespace)
ns=spire-system ns=spire-system
CLEANUP=1
for i in "$@"; do
case $i in
-c)
CLEANUP=0
shift # past argument=value
;;
esac
done
teardown() { teardown() {
helm uninstall --namespace "${ns}" spire 2>/dev/null || true if [ "${CLEANUP}" -eq 1 ]; then
kubectl delete ns "${ns}" 2>/dev/null || true helm uninstall --namespace "${ns}" spire 2>/dev/null || true
kubectl delete ns "${ns}" 2>/dev/null || true
fi
} }
trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
examples/tornjak/values.yaml
-1
View File
@@ -7,7 +7,6 @@ tornjak-frontend:
service: service:
type: ClusterIP type: ClusterIP
port: 3000 port: 3000
apiServerURL: "http://localhost:10000/"
resources: resources:
requests: requests:
cpu: 50m cpu: 50m
helm-docs.sh
+1 -1
View File
@@ -3,7 +3,7 @@
set -euo pipefail set -euo pipefail
SCRIPTPATH=$(dirname "$0") SCRIPTPATH=$(dirname "$0")
README_GENERATOR_VERSION="2.5.1" README_GENERATOR_VERSION="2.6.0"
README_GENERATOR_EXE="readme-generator" README_GENERATOR_EXE="readme-generator"
if ! hash "${README_GENERATOR_EXE}" 2>/dev/null; then if ! hash "${README_GENERATOR_EXE}" 2>/dev/null; then
project/openshift.md
+38
View File
@@ -0,0 +1,38 @@
# OpenShift notes for K8S developers
## SecurityContexts
OpenShift automatically generates uid/gid's for pods. They should not be set to get this behavior.
## CSIDriver issues
A workload in a restricted namespace can not access a csidriver that isn't labeled:
```yaml
security.openshift.io/csi-ephemeral-volume-profile: restricted
```
If the CSIDriver doesn't exist, the workload is blocked from being uploaded into the cluster. This runs into ordering issues with helm install as it always loads regular workloads before CSIDriver objects.
## Pod Security Standard
Pod Security Standard (PSS) rules are automatically generated on openshift. Details at [https://docs.openshift.com/container-platform/4.13/authentication/understanding-and-managing-pod-security-admission.html](https://docs.openshift.com/container-platform/4.13/authentication/understanding-and-managing-pod-security-admission.html)
The defaults though are too chatty. It puts audit/warn still at restricted.
## Ingress
Ingress objects automatically create Role objects in the same namespace, when the ingress object is viewed as valid by openshift, if not it is ignored. A missing Role object is a sure sign that something is wrong in the Ingress.
Some things to watch out for.
When the ingress is annotated:
```yaml
"route.openshift.io/termination": "passthrough"
```
The ingress object can not have a path specified and the pathType needs to be ImplementationSpecific
Also, unless a secretName is specified, it can not have a tls section.
release-chart.sh
+2 -1
View File
@@ -117,7 +117,8 @@ git push -u origin --force-with-lease
cat <<EOF | gh pr create --base main --body-file - "${dry_run}" cat <<EOF | gh pr create --base main --body-file - "${dry_run}"
Please review the below changelog to ensure this matches up with the semantic version being applied. Please review the below changelog to ensure this matches up with the semantic version being applied.
> **Note**: **Maintainers** ensure to run following after merging this PR to trigger the release workflow: > [!Note]
> **Maintainers** ensure to run following after merging this PR to trigger the release workflow:
> >
> \`\`\`shell > \`\`\`shell
> git checkout main > git checkout main
tests/go.mod
+7 -7
View File
@@ -4,8 +4,8 @@ go 1.20
require ( require (
github.com/onsi/ginkgo/v2 v2.13.0 github.com/onsi/ginkgo/v2 v2.13.0
github.com/onsi/gomega v1.28.0 github.com/onsi/gomega v1.30.0
helm.sh/helm/v3 v3.13.1 helm.sh/helm/v3 v3.13.2
) )
require ( require (
@@ -25,7 +25,7 @@ require (
github.com/gogo/protobuf v1.3.2 // indirect github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/protobuf v1.5.3 // indirect github.com/golang/protobuf v1.5.3 // indirect
github.com/google/gnostic-models v0.6.8 // indirect github.com/google/gnostic-models v0.6.8 // indirect
github.com/google/go-cmp v0.5.9 // indirect github.com/google/go-cmp v0.6.0 // indirect
github.com/google/gofuzz v1.2.0 // indirect github.com/google/gofuzz v1.2.0 // indirect
github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect
github.com/google/uuid v1.3.0 // indirect github.com/google/uuid v1.3.0 // indirect
@@ -45,11 +45,11 @@ require (
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
github.com/xeipuuv/gojsonschema v1.2.0 // indirect github.com/xeipuuv/gojsonschema v1.2.0 // indirect
golang.org/x/crypto v0.13.0 // indirect golang.org/x/crypto v0.14.0 // indirect
golang.org/x/net v0.14.0 // indirect golang.org/x/net v0.17.0 // indirect
golang.org/x/oauth2 v0.8.0 // indirect golang.org/x/oauth2 v0.8.0 // indirect
golang.org/x/sys v0.12.0 // indirect golang.org/x/sys v0.13.0 // indirect
golang.org/x/term v0.12.0 // indirect golang.org/x/term v0.13.0 // indirect
golang.org/x/text v0.13.0 // indirect golang.org/x/text v0.13.0 // indirect
golang.org/x/time v0.3.0 // indirect golang.org/x/time v0.3.0 // indirect
golang.org/x/tools v0.12.0 // indirect golang.org/x/tools v0.12.0 // indirect
tests/go.sum
+14 -14
View File
@@ -41,8 +41,8 @@ github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiu
github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I= github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U= github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38= github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0= github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -87,8 +87,8 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4= github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4=
github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o= github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o=
github.com/onsi/gomega v1.28.0 h1:i2rg/p9n/UqIDAMFUJ6qIUUMcsqOuUHgbpbu235Vr1c= github.com/onsi/gomega v1.30.0 h1:hvMK7xYz4D3HapigLTeGdId/NcfQx1VHMJc60ew99+8=
github.com/onsi/gomega v1.28.0/go.mod h1:A1H2JE76sI14WIP57LMKj7FVfCHx3g3BcZVjJG8bjX8= github.com/onsi/gomega v1.30.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -127,8 +127,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4= golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
golang.org/x/crypto v0.13.0 h1:mvySKfSWJ+UKUii46M40LOvyWfN0s2U+46/jDd0e6Ck= golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc= golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
@@ -141,8 +141,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY= golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
golang.org/x/net v0.14.0 h1:BONx9s002vGdD9umnlX1Po8vOZmrgH34qlHcD1MfK14= golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI= golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
golang.org/x/oauth2 v0.8.0 h1:6dkIjl3j3LtZ/O3sTgZTMsLKSftL/B8Zgq4huOIIUu8= golang.org/x/oauth2 v0.8.0 h1:6dkIjl3j3LtZ/O3sTgZTMsLKSftL/B8Zgq4huOIIUu8=
golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE= golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -158,13 +158,13 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o= golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc= golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
golang.org/x/term v0.12.0 h1:/ZfYdc3zq+q02Rv9vGqTeSItdzZTSNDmfTi0mBAuidU= golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU= golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -205,8 +205,8 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C
gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
helm.sh/helm/v3 v3.13.1 h1:DG+XLGzBJeZvMLlMbm6bPDLV1dGaVW9eZsDoUd1/LM0= helm.sh/helm/v3 v3.13.2 h1:IcO9NgmmpetJODLZhR3f3q+6zzyXVKlRizKFwbi7K8w=
helm.sh/helm/v3 v3.13.1/go.mod h1:TdQRMiq46CSWcc68Hb0uVhvAWusaN90YwAV54cz6JzU= helm.sh/helm/v3 v3.13.2/go.mod h1:GIHDwZggaTGbedevTlrQ6DB++LBN6yuQdeGj0HNaDx0=
k8s.io/api v0.28.2 h1:9mpl5mOb6vXZvqbQmankOfPIGiudghwCoLl1EYfUZbw= k8s.io/api v0.28.2 h1:9mpl5mOb6vXZvqbQmankOfPIGiudghwCoLl1EYfUZbw=
k8s.io/api v0.28.2/go.mod h1:RVnJBsjU8tcMq7C3iaRSGMeaKt2TWEUXcpIt/90fjEg= k8s.io/api v0.28.2/go.mod h1:RVnJBsjU8tcMq7C3iaRSGMeaKt2TWEUXcpIt/90fjEg=
k8s.io/apiextensions-apiserver v0.28.2 h1:J6/QRWIKV2/HwBhHRVITMLYoypCoPY1ftigDM0Kn+QU= k8s.io/apiextensions-apiserver v0.28.2 h1:J6/QRWIKV2/HwBhHRVITMLYoypCoPY1ftigDM0Kn+QU=