Merge branch 'main' into release
This commit is contained in:
Faisal Memon
@@ -2,26 +2,26 @@
|
||||
{
|
||||
"name": "kube-prometheus-stack",
|
||||
"repo": "https://prometheus-community.github.io/helm-charts",
|
||||
"version": "51.8.0"
|
||||
"version": "52.1.0"
|
||||
},
|
||||
{
|
||||
"name": "cert-manager",
|
||||
"repo": "https://charts.jetstack.io",
|
||||
"version": "v1.13.1"
|
||||
"version": "v1.13.2"
|
||||
},
|
||||
{
|
||||
"name": "ingress-nginx",
|
||||
"repo": "https://kubernetes.github.io/ingress-nginx",
|
||||
"version": "4.8.2"
|
||||
"version": "4.8.3"
|
||||
},
|
||||
{
|
||||
"name": "mysql",
|
||||
"repo": "https://charts.bitnami.com/bitnami",
|
||||
"version": "9.12.5"
|
||||
"version": "9.14.1"
|
||||
},
|
||||
{
|
||||
"name": "postgresql",
|
||||
"repo": "https://charts.bitnami.com/bitnami",
|
||||
"version": "13.1.5"
|
||||
"version": "13.2.1"
|
||||
}
|
||||
]
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
GITHUB_STEP_SUMMARY="${GITHUB_STEP_SUMMARY:-/tmp/summary}"
|
||||
|
||||
get_namespace_details () {
|
||||
cat <<EOF >>"$GITHUB_STEP_SUMMARY"
|
||||
### Namespace $1
|
||||
|
||||
@@ -2,11 +2,17 @@ global:
|
||||
spire:
|
||||
clusterName: production
|
||||
trustDomain: production.other
|
||||
jwtIssuer: oidc-discovery.production.other
|
||||
|
||||
spire-server:
|
||||
controllerManager:
|
||||
enabled: false
|
||||
identities:
|
||||
namespaceSelector:
|
||||
kubernetes.io/metadata.name: spire-server
|
||||
podSelector:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/instance: spire
|
||||
app.kubernetes.io/name: server
|
||||
downstream: true
|
||||
nodeAttestor:
|
||||
k8sPsat:
|
||||
serviceAccountAllowList:
|
||||
|
||||
@@ -20,7 +20,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/[email protected].0
|
||||
uses: actions/[email protected].1
|
||||
|
||||
- name: Set up Helm
|
||||
uses: azure/[email protected]
|
||||
|
||||
@@ -43,7 +43,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/[email protected].0
|
||||
uses: actions/[email protected].1
|
||||
|
||||
- id: set-matrix
|
||||
name: Collect all examples
|
||||
|
||||
@@ -32,7 +32,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/[email protected].0
|
||||
uses: actions/[email protected].1
|
||||
|
||||
- name: Verify Docs updated
|
||||
run: ./helm-docs.sh
|
||||
@@ -94,7 +94,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/[email protected].0
|
||||
uses: actions/[email protected].1
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
@@ -109,7 +109,7 @@ jobs:
|
||||
python-version: ${{ env.PYTHON_VERSION }}
|
||||
|
||||
- name: Setup chart-testing
|
||||
uses: helm/chart-testing-action@v2.4.0
|
||||
uses: helm/chart-testing-action@v2.6.1
|
||||
with:
|
||||
version: ${{ env.CHART_TESTING_VERSION }}
|
||||
|
||||
@@ -136,7 +136,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/[email protected].0
|
||||
uses: actions/[email protected].1
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
@@ -151,7 +151,7 @@ jobs:
|
||||
python-version: ${{ env.PYTHON_VERSION }}
|
||||
|
||||
- name: Setup chart-testing
|
||||
uses: helm/chart-testing-action@v2.4.0
|
||||
uses: helm/chart-testing-action@v2.6.1
|
||||
with:
|
||||
version: ${{ env.CHART_TESTING_VERSION }}
|
||||
|
||||
@@ -185,7 +185,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/[email protected].0
|
||||
uses: actions/[email protected].1
|
||||
|
||||
- id: set-matrix
|
||||
name: Collect all examples
|
||||
@@ -217,7 +217,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/[email protected].0
|
||||
uses: actions/[email protected].1
|
||||
|
||||
- name: Set up Helm
|
||||
uses: azure/[email protected]
|
||||
@@ -261,7 +261,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/[email protected].0
|
||||
uses: actions/[email protected].1
|
||||
|
||||
- name: Set up Helm
|
||||
uses: azure/[email protected]
|
||||
|
||||
@@ -19,7 +19,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/[email protected].0
|
||||
uses: actions/[email protected].1
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
@@ -29,7 +29,7 @@ jobs:
|
||||
git config user.email "[email protected]"
|
||||
|
||||
- name: Setup cosign
|
||||
uses: sigstore/cosign-installer@v3.1.2
|
||||
uses: sigstore/cosign-installer@v3.2.0
|
||||
with:
|
||||
cosign-release: v2.2.0
|
||||
|
||||
@@ -39,7 +39,7 @@ jobs:
|
||||
version: v3.10.3
|
||||
|
||||
- name: Run chart-releaser
|
||||
uses: helm/chart-releaser-action@v1.5.0
|
||||
uses: helm/chart-releaser-action@v1.6.0
|
||||
env:
|
||||
CR_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/[email protected].0
|
||||
uses: actions/[email protected].1
|
||||
|
||||
- name: Run Shellcheck
|
||||
uses: ludeeus/[email protected]
|
||||
|
||||
+3
-3
@@ -1,8 +1,8 @@
|
||||
### Contributor Code of Conduct
|
||||
# Contributor Code of Conduct
|
||||
|
||||
We follow the [CNCF Contributor Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md). Additionally, we commit to the following guidelines as detailed on the [Linkerd Code of Conduct](https://github.com/linkerd/linkerd/wiki/Linkerd-code-of-conduct):
|
||||
|
||||
### Community Guidelines
|
||||
## Community Guidelines
|
||||
|
||||
- Our goal is to foster an inclusive and diverse community of technology enthusiasts.
|
||||
|
||||
@@ -14,6 +14,6 @@ We follow the [CNCF Contributor Code of Conduct](https://github.com/cncf/foundat
|
||||
|
||||
- We do our best to avoid [subtle-isms](https://www.recurse.com/manual#sub-sec-social-rules): small actions that make others feel uncomfortable. If you witness a subtle-ism, you may respectfully point it out to the person publicly or privately, or you may ask a moderator to say something. Accidentally saying something biased is common, expected, and readily forgiven. It is not in and of itself a bannable offense.
|
||||
|
||||
### Moderation
|
||||
## Moderation
|
||||
|
||||
- If you feel any of SPIFFE's communication channels require moderation, please e-mail the [SPIFFE Steering Committee (SSC)](mailto:[email protected]).
|
||||
|
||||
+3
-2
@@ -38,7 +38,8 @@ git rebase main
|
||||
|
||||
Our CI pipeline takes care of the majority of the testing of this Chart. Other ways for you to test are by running `make test` locally using:
|
||||
|
||||
> **Warning**: Ensure to run the test on a dedicated k8s cluster that does not have Spire installed yet.
|
||||
> [!Warning]
|
||||
> Ensure to run the test on a dedicated k8s cluster that does not have Spire installed yet.
|
||||
|
||||
```shell
|
||||
make test
|
||||
@@ -48,7 +49,7 @@ Another approach to testing the chart is by installing one of the examples in yo
|
||||
|
||||
## Generating documentation
|
||||
|
||||
Any changes to Chart.yaml or values.yaml require an update of the README.md. This update can easily be generated using [readme-generator](https://github.com/bitnami-labs/readme-generator-for-helm).
|
||||
Any changes to Chart.yaml or values.yaml require an update of the README.md. This update can easily be generated using [readme-generator][].
|
||||
|
||||
```shell
|
||||
./helm-docs.sh
|
||||
|
||||
@@ -36,7 +36,8 @@ helm repo add spiffe https://spiffe.github.io/helm-charts-hardened
|
||||
If you uninstall the SPIRE chart before all users of the CSI driver are removed, Pods will get stuck in a terminating state waiting for the driver, that no longer is installed, to unmount the volumes for the Pod. In order to fix this, reinstall the chart and remove all affected workloads that are not part of the SPIRE helm chart itself, before attempting to remove SPIRE again.
|
||||
|
||||
You can discover Pods that use the driver with the following command:
|
||||
```
|
||||
|
||||
```shell
|
||||
kubectl get pods --all-namespaces -o go-template='{{range .items}}{{$nn := printf "%s %s" .metadata.namespace .metadata.name}}{{range .spec.volumes}}{{if .csi.driver}}{{if eq .csi.driver "csi.spiffe.io"}}{{printf "%s\n" $nn}}{{end}}{{end}}{{end}}{{end}}'
|
||||
```
|
||||
|
||||
@@ -50,11 +51,14 @@ To resolve, reinstall the chart before trying to remove it again.
|
||||
|
||||
The chart requires `Projected Service Account Tokens` which has to be enabled on your Kubernetes API server. In most cases this is already done for you.
|
||||
|
||||
> **Note**: This is enabled by default with newer versions as shown by the existence of:
|
||||
> [!Note]
|
||||
> This is enabled by default with newer versions as shown by the existence of:
|
||||
>
|
||||
> ```yaml
|
||||
> - --service-account-issuer
|
||||
> - --service-account-key-file
|
||||
> - --service-account-signing-key-file
|
||||
> ```
|
||||
|
||||
See [Service Account Token Volume Projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) in the Kubernetes docs for more details.
|
||||
|
||||
@@ -64,7 +68,9 @@ command to SSH into the Docker Desktop K8s VM.
|
||||
```bash
|
||||
docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh
|
||||
```
|
||||
|
||||
Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml`
|
||||
|
||||
```yaml
|
||||
spec:
|
||||
containers:
|
||||
|
||||
@@ -1,4 +1,7 @@
|
||||
> **Note**: All the helm charts in this repo are beta. We encourage you to try them out and contribute. The API may change as we move towards a production ready release.
|
||||
> [!Note]
|
||||
> Things to consider:
|
||||
> 1. We do not support running out of the git main branch. This is where development happens. Please use released versions via the published repo or git tags.
|
||||
> 2. All the helm charts in this repo are beta. We encourage you to try them out and contribute. The API may change as we move towards a production ready release.
|
||||
|
||||
# SPIFFE Helm Charts
|
||||
|
||||
@@ -8,24 +11,10 @@
|
||||
|
||||
A suite of [Helm Charts](https://helm.sh/docs) for standardized installations of SPIRE components in Kubernetes environments.
|
||||
|
||||
## Add Helm repository
|
||||
## How to install or upgrade
|
||||
|
||||
```bash
|
||||
helm repo add spiffe https://spiffe.github.io/helm-charts/
|
||||
helm repo update
|
||||
```
|
||||
|
||||
## Dependencies and Version Compatibility
|
||||
|
||||
Unless otherwise noted in an application chart README, the following dependencies will follow these prescribed version compatibility rules.
|
||||
|
||||
| Dependency | Supported Versions |
|
||||
|:-----------|:-------------------|
|
||||
| SPIRE | `1.8.2` |
|
||||
| Helm | `3.x` |
|
||||
| Kubernetes | `1.22+` |
|
||||
|
||||
> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. *The first version we tested this chart with is `1.22`.*
|
||||
You most likely want to do an integrated setup based on the spire chart.
|
||||
See the [Instructions](https://artifacthub.io/packages/helm/spiffe/spire).
|
||||
|
||||
## Contributing
|
||||
|
||||
|
||||
@@ -7,6 +7,7 @@ A Helm chart to install the SPIRE CRDS.
|
||||
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
## Maintainers
|
||||
|
||||
| Name | Email | Url |
|
||||
| ---- | ------ | --- |
|
||||
| marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
|
||||
@@ -16,8 +17,8 @@ A Helm chart to install the SPIRE CRDS.
|
||||
|
||||
## Source Code
|
||||
|
||||
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire-crds>
|
||||
|
||||
<!-- The Parameters section is generated using helm-docs.sh -->
|
||||
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||
|
||||
## Parameters
|
||||
|
||||
@@ -65,6 +65,9 @@ spec:
|
||||
description: BundleEndpointURL is the URL of the bundle endpoint.
|
||||
It must be an HTTPS URL and cannot contain userinfo (i.e. username/password).
|
||||
type: string
|
||||
className:
|
||||
description: Set the class of controller to handle this object.
|
||||
type: string
|
||||
trustDomain:
|
||||
description: TrustDomain is the name of the trust domain to federate
|
||||
with (e.g. example.org)
|
||||
@@ -89,3 +92,9 @@ spec:
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
|
||||
@@ -41,6 +41,10 @@ spec:
|
||||
access the SPIRE administrative APIs. Extra care should be taken
|
||||
to only apply this SPIFFE ID to admin workloads.
|
||||
type: boolean
|
||||
autoPopulateDNSNames:
|
||||
description: AutoPopulateDNSNames indicates whether or not to auto
|
||||
populate service DNS names.
|
||||
type: boolean
|
||||
dnsNameTemplates:
|
||||
description: DNSNameTemplate represents templates for extra DNS names
|
||||
that are applicable to SVIDs minted for this ClusterSPIFFEID. The
|
||||
@@ -53,6 +57,9 @@ spec:
|
||||
description: Downstream indicates that the entry describes a downstream
|
||||
SPIRE server.
|
||||
type: boolean
|
||||
className:
|
||||
description: Set the class of controller to handle this object.
|
||||
type: string
|
||||
federatesWith:
|
||||
description: FederatesWith is a list of trust domain names that workloads
|
||||
that obtain this SPIFFE ID will federate with.
|
||||
@@ -224,3 +231,9 @@ spec:
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
|
||||
@@ -39,6 +39,9 @@ spec:
|
||||
properties:
|
||||
admin:
|
||||
type: boolean
|
||||
className:
|
||||
description: Set the class of controller to handle this object.
|
||||
type: string
|
||||
dnsNames:
|
||||
items:
|
||||
type: string
|
||||
@@ -90,3 +93,9 @@ spec:
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
|
||||
@@ -3,8 +3,8 @@ name: spire
|
||||
description: >
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
type: application
|
||||
version: 0.14.0
|
||||
appVersion: "1.8.2"
|
||||
version: 0.15.0
|
||||
appVersion: "1.8.4"
|
||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
+62
-39
@@ -1,27 +1,82 @@
|
||||
# spire
|
||||
|
||||
  
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
|
||||
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
## Install notes
|
||||
|
||||
To do a quick non production install suitable for quick testing in something like minikube:
|
||||
|
||||
```shell
|
||||
helm install -n spire-server spire-crds --repo https://spiffe.github.io/helm-charts-hardened/ --create-namespace
|
||||
helm install -n spire-server spire --repo https://spiffe.github.io/helm-charts-hardened/
|
||||
```
|
||||
|
||||
To customize, start with a base values file and edit as needed:
|
||||
|
||||
```shell
|
||||
curl -o your-values.yaml https://raw.githubusercontent.com/spiffe/helm-charts-hardened/main/examples/production/example-your-values.yaml
|
||||
```
|
||||
|
||||
Then:
|
||||
|
||||
```shell
|
||||
helm install -n spire-server spire --repo https://spiffe.github.io/helm-charts-hardened/ -f your-values.yaml
|
||||
```
|
||||
|
||||
For production installs, please see [the production example](https://github.com/spiffe/helm-charts-hardened/tree/main/examples/production).
|
||||
|
||||
## Upgrade notes
|
||||
|
||||
### 0.15.X
|
||||
|
||||
The spire-crds chart has been updated. Please ensure you have upgraded spire-crds before upgrading the spire chart.
|
||||
|
||||
The chart now supports multiple parallel installs of spire-controller-manager. Each install will handle all custom resources with a matching `className` field. By default this is set to `Release.Namespace-Release.Name` and the controller manager will only pick up custom resources with this `className`.
|
||||
|
||||
If you have not loaded any SPIRE custom resources yourself, the upgrade process will be transparent. If you have loaded your own SPIRE custom resources, set `spire-server.controllerManager.watchClassless=true` until you can update your SPIRE custom resources to have the `className` for the instance specified.
|
||||
|
||||
### 0.14.X
|
||||
|
||||
If coming from a chart version before 0.15.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart
|
||||
run the following:
|
||||
|
||||
Replace the spire-server namespace in the commands below with the namespace you want to install the spire-crds chart in.
|
||||
|
||||
```shell
|
||||
kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
helm install -n spire-server spire-crds charts/spire-crds
|
||||
```
|
||||
|
||||
## Version support
|
||||
|
||||
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
|
||||
> [!Warning]
|
||||
> This Chart is still in development and still subject to change the API (`values.yaml`).
|
||||
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
|
||||
> we do aim for as much stability as possible.
|
||||
|
||||
| Dependency | Supported Versions |
|
||||
|:-----------|:-------------------|
|
||||
| SPIRE | `1.5.3+`, `1.6.3+` |
|
||||
| Helm | `3.x` |
|
||||
| Kubernetes | `1.22+` |
|
||||
|
||||
> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden.
|
||||
> [!Note]
|
||||
> For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden.
|
||||
|
||||
## FAQ
|
||||
|
||||
For any issues see our [FAQ](../../FAQ.md)…
|
||||
|
||||
## Usage
|
||||
@@ -83,39 +138,6 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| file://./charts/spire-server | spire-server | 0.1.0 |
|
||||
| file://./charts/tornjak-frontend | tornjak-frontend | 0.1.0 |
|
||||
|
||||
## Install notes
|
||||
|
||||
To do a quick non production install:
|
||||
|
||||
```shell
|
||||
kubectl create namespace spire-system
|
||||
helm install -n spire-system spire-crds charts/spire-crds
|
||||
helm install -n spire-system spire charts/spire
|
||||
|
||||
For production installs, please see [the production example](examples/production/).
|
||||
|
||||
## Upgrade notes
|
||||
|
||||
0.14.X:
|
||||
|
||||
If coming from a chart version before 0.14.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart
|
||||
run the following:
|
||||
|
||||
```shell
|
||||
# Replace the spire-server namespace in the commands below with the namespace you want to install the spire-crds chart in.
|
||||
|
||||
kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
helm install -n spire-server spire-crds charts/spire-crds
|
||||
```
|
||||
|
||||
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||
|
||||
## Parameters
|
||||
@@ -123,15 +145,16 @@ helm install -n spire-server spire-crds charts/spire-crds
|
||||
### Global parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ---------------------------- |
|
||||
| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- |
|
||||
| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` |
|
||||
| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` |
|
||||
| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` |
|
||||
| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens | `oidc-discovery.example.org` |
|
||||
| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset | `""` |
|
||||
| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` |
|
||||
| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` |
|
||||
| `global.spire.image.registry` | Override all Spire image registries at once | `""` |
|
||||
| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` |
|
||||
| `global.spire.ingressControllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||
| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||
|
||||
|
||||
@@ -1,75 +0,0 @@
|
||||
{{ template "chart.header" . }}
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
{{ template "chart.deprecationWarning" . }}
|
||||
|
||||
{{ template "chart.badgesSection" . }}
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
{{ template "chart.description" . }}
|
||||
|
||||
{{ template "chart.homepageLine" . }}
|
||||
|
||||
## Version support
|
||||
|
||||
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
|
||||
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
|
||||
> we do aim for as much stability as possible.
|
||||
|
||||
| Dependency | Supported Versions |
|
||||
|:-----------|:-------------------|
|
||||
| SPIRE | `1.5.3+`, `1.6.3+` |
|
||||
| Helm | `3.x` |
|
||||
| Kubernetes | `1.22+` |
|
||||
|
||||
> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden.
|
||||
|
||||
## FAQ
|
||||
For any issues see our [FAQ](../../FAQ.md)…
|
||||
|
||||
## Usage
|
||||
|
||||
To utilize Spire in your own workloads you should add the following to your workload:
|
||||
|
||||
```diff
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: my-app
|
||||
spec:
|
||||
containers:
|
||||
- name: my-app
|
||||
image: "my-app:latest"
|
||||
imagePullPolicy: Always
|
||||
+ volumeMounts:
|
||||
+ - name: spiffe-workload-api
|
||||
+ mountPath: /spiffe-workload-api
|
||||
+ readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 64Mi
|
||||
+ volumes:
|
||||
+ - name: spiffe-workload-api
|
||||
+ csi:
|
||||
+ driver: "csi.spiffe.io"
|
||||
+ readOnly: true
|
||||
```
|
||||
|
||||
Now you can interact with the Spire agent socket from your own application. The socket is mounted on `/spiffe-workload-api/spire-agent.sock`.
|
||||
|
||||
{{ template "chart.maintainersSection" . }}
|
||||
|
||||
{{ template "chart.sourcesSection" . }}
|
||||
|
||||
{{ template "chart.requirementsHeader" . }}
|
||||
|
||||
{{ template "chart.requirementsTable" . }}
|
||||
|
||||
{{ template "chart.valuesSection" . }}
|
||||
|
||||
----------------------------------------------
|
||||
@@ -1,14 +1,13 @@
|
||||
# spiffe-csi-driver
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
  
|
||||
|
||||
A Helm chart to install the SPIFFE CSI driver.
|
||||
|
||||
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
> **Note**: The recommended version is `0.2.3` to support arm64 nodes. If running with any
|
||||
> [!Note]
|
||||
> The recommended version is `0.2.3` to support arm64 nodes. If running with any
|
||||
> prior version to `0.2.3` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
||||
|
||||
## Maintainers
|
||||
@@ -24,12 +23,14 @@ A Helm chart to install the SPIFFE CSI driver.
|
||||
|
||||
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||
|
||||
## Parameters
|
||||
|
||||
### SPIFFE CSI Driver Chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------- |
|
||||
| ---------------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
|
||||
| `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` |
|
||||
@@ -44,6 +45,8 @@ A Helm chart to install the SPIFFE CSI driver.
|
||||
| `nameOverride` | Name override for spiffe-csi-driver | `""` |
|
||||
| `namespaceOverride` | Namespace to install spiffe-csi-driver | `""` |
|
||||
| `fullnameOverride` | Full name override for spiffe-csi-driver | `""` |
|
||||
| `csiDriverLabels` | Labels to apply to the CSIDriver | `{}` |
|
||||
| `initContainers` | Init Containers to apply to the CSI Driver DaemonSet | `[]` |
|
||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
||||
@@ -62,3 +65,6 @@ A Helm chart to install the SPIFFE CSI driver.
|
||||
| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||
| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` |
|
||||
| `priorityClassName` | Priority class assigned to daemonset pods | `""` |
|
||||
| `restrictedScc.enabled` | Enables the creation of a SecurityContextConstraint based on the restricted SCC with CSI volume support | `false` |
|
||||
| `restrictedScc.name` | Set the name of the restricted SCC with CSI support | `""` |
|
||||
| `restrictedScc.version` | Version of the restricted SCC | `2` |
|
||||
|
||||
@@ -1,24 +0,0 @@
|
||||
{{ template "chart.header" . }}
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
{{ template "chart.deprecationWarning" . }}
|
||||
|
||||
{{ template "chart.badgesSection" . }}
|
||||
|
||||
{{ template "chart.description" . }}
|
||||
|
||||
{{ template "chart.homepageLine" . }}
|
||||
|
||||
> **Note**: The recommended version is `0.2.3` to support arm64 nodes. If running with any
|
||||
> prior version to `0.2.3` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
||||
|
||||
{{ template "chart.maintainersSection" . }}
|
||||
|
||||
{{ template "chart.sourcesSection" . }}
|
||||
|
||||
{{ template "chart.requirementsSection" . }}
|
||||
|
||||
{{ template "chart.valuesSection" . }}
|
||||
|
||||
----------------------------------------------
|
||||
@@ -36,6 +36,10 @@ spec:
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName }}
|
||||
{{- end }}
|
||||
{{- with .Values.initContainers }}
|
||||
initContainers:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
# This is the container which runs the SPIFFE CSI driver.
|
||||
- name: {{ .Chart.Name }}
|
||||
|
||||
@@ -0,0 +1,61 @@
|
||||
{{- if and .Values.global.openshift .Values.restrictedScc.enabled }}
|
||||
{{- $name := default (printf "restricted-%scsi" (eq (.Values.restrictedScc.version | toString) "2" | ternary "v2-" "")) .Values.restrictedScc.name -}}
|
||||
{{- $v2Description := "This is the most restrictive SCC and it is used by default for authenticated users. On top of the legacy 'restricted' SCC, it also requires to drop ALL capabilities and does not allow privilege escalation binaries. It will also default the seccomp profile to runtime/default if unset, otherwise this seccomp profile is required." -}}
|
||||
apiVersion: security.openshift.io/v1
|
||||
kind: SecurityContextConstraints
|
||||
allowHostPorts: false
|
||||
priority: null
|
||||
requiredDropCapabilities:
|
||||
{{- if eq (.Values.restrictedScc.version | toString) "2" }}
|
||||
- ALL
|
||||
{{- else }}
|
||||
- KILL
|
||||
- MKNOD
|
||||
- SETUID
|
||||
- SETGID
|
||||
{{- end }}
|
||||
allowPrivilegedContainer: false
|
||||
runAsUser:
|
||||
type: MustRunAsRange
|
||||
users: []
|
||||
allowHostDirVolumePlugin: false
|
||||
{{- if eq (.Values.restrictedScc.version | toString) "2" }}
|
||||
seccompProfiles:
|
||||
- runtime/default
|
||||
{{- end }}
|
||||
allowHostIPC: false
|
||||
seLinuxContext:
|
||||
type: MustRunAs
|
||||
readOnlyRootFilesystem: false
|
||||
metadata:
|
||||
name: {{ $name }}
|
||||
annotations:
|
||||
kubernetes.io/description: >-
|
||||
{{ $name }} denies access to all host features and requires pods to be
|
||||
run with a UID, and SELinux context that are allocated to the namespace.
|
||||
{{ eq (.Values.restrictedScc.version | toString) "2" | ternary $v2Description "" }}
|
||||
fsGroup:
|
||||
type: MustRunAs
|
||||
groups: []
|
||||
defaultAddCapabilities: null
|
||||
supplementalGroups:
|
||||
type: RunAsAny
|
||||
volumes:
|
||||
- configMap
|
||||
- csi
|
||||
- downwardAPI
|
||||
- emptyDir
|
||||
- ephemeral
|
||||
- persistentVolumeClaim
|
||||
- projected
|
||||
- secret
|
||||
allowHostPID: false
|
||||
allowHostNetwork: false
|
||||
allowPrivilegeEscalation: {{ eq (.Values.restrictedScc.version | toString) "2" | ternary false true }}
|
||||
{{- if eq (.Values.restrictedScc.version | toString) "2" }}
|
||||
allowedCapabilities:
|
||||
- NET_BIND_SERVICE
|
||||
{{ else}}
|
||||
allowedCapabilities: null
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{- if eq (.Values.global.openshift | toString) "true" }}
|
||||
apiVersion: security.openshift.io/v1
|
||||
kind: SecurityContextConstraints
|
||||
metadata:
|
||||
name: {{ include "spiffe-csi-driver.fullname" . }}
|
||||
readOnlyRootFilesystem: true
|
||||
runAsUser:
|
||||
type: RunAsAny
|
||||
seLinuxContext:
|
||||
type: RunAsAny
|
||||
supplementalGroups:
|
||||
type: RunAsAny
|
||||
users:
|
||||
- system:serviceaccount:{{ include "spiffe-csi-driver.namespace" . }}:{{ include "spiffe-csi-driver.serviceAccountName" . }}
|
||||
volumes:
|
||||
- configmap
|
||||
- hostPath
|
||||
- secret
|
||||
allowHostDirVolumePlugin: true
|
||||
allowHostIPC: false
|
||||
allowHostNetwork: false
|
||||
allowHostPID: false
|
||||
allowHostPorts: false
|
||||
allowPrivilegeEscalation: true
|
||||
allowPrivilegedContainer: true
|
||||
fsGroup:
|
||||
type: RunAsAny
|
||||
groups: []
|
||||
|
||||
{{ end }}
|
||||
@@ -2,6 +2,11 @@ apiVersion: storage.k8s.io/v1
|
||||
kind: CSIDriver
|
||||
metadata:
|
||||
name: {{ .Values.pluginName | quote }}
|
||||
{{- with .Values.csiDriverLabels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
spec:
|
||||
# Only ephemeral, inline volumes are supported. There is no need for a
|
||||
# controller to provision and attach volumes.
|
||||
|
||||
@@ -58,6 +58,12 @@ namespaceOverride: ""
|
||||
## @param fullnameOverride Full name override for spiffe-csi-driver
|
||||
fullnameOverride: ""
|
||||
|
||||
## @param csiDriverLabels Labels to apply to the CSIDriver
|
||||
csiDriverLabels: {}
|
||||
|
||||
## @param initContainers Init Containers to apply to the CSI Driver DaemonSet
|
||||
initContainers: []
|
||||
|
||||
## @param serviceAccount.create Specifies whether a service account should be created
|
||||
## @param serviceAccount.annotations Annotations to add to the service account
|
||||
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
|
||||
@@ -126,3 +132,12 @@ kubeletPath: /var/lib/kubelet
|
||||
|
||||
## @param priorityClassName Priority class assigned to daemonset pods
|
||||
priorityClassName: ""
|
||||
|
||||
restrictedScc:
|
||||
## @param restrictedScc.enabled Enables the creation of a SecurityContextConstraint based on the restricted SCC with CSI volume support
|
||||
enabled: false
|
||||
|
||||
## @param restrictedScc.name Set the name of the restricted SCC with CSI support
|
||||
name: ""
|
||||
## @param restrictedScc.version Version of the restricted SCC
|
||||
version: 2
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider
|
||||
description: A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.8.2"
|
||||
appVersion: "1.8.4"
|
||||
keywords: ["spiffe", "oidc"]
|
||||
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -1,14 +1,13 @@
|
||||
# spiffe-oidc-discovery-provider
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
  
|
||||
|
||||
A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
|
||||
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
> **Note**: Minimum Spire version is `1.5.3`.
|
||||
> [!Note]
|
||||
> Minimum Spire version is `1.5.3`.
|
||||
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
||||
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
||||
|
||||
@@ -25,12 +24,14 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
|
||||
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||
|
||||
## Parameters
|
||||
|
||||
### Chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||
| ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
||||
| `replicaCount` | Replica count | `1` |
|
||||
| `namespaceOverride` | Namespace override | `""` |
|
||||
@@ -59,7 +60,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.2-alpine` |
|
||||
| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` |
|
||||
| `jwtIssuer` | Path to JWT issuer | `https://oidc-discovery.example.org` |
|
||||
| `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` |
|
||||
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||
| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` |
|
||||
| `config.acme.tosAccepted` | Flag for Terms of Service acceptance | `false` |
|
||||
@@ -96,9 +97,12 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `telemetry.prometheus.nginxExporter.resources` | Resource requests and limits | `{}` |
|
||||
| `ingress.enabled` | Flag to enable ingress | `false` |
|
||||
| `ingress.className` | Ingress class name | `""` |
|
||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `ingress.annotations` | Annotations for ingress object | `{}` |
|
||||
| `ingress.hosts` | Host paths for ingress object | `[]` |
|
||||
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
|
||||
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `oidc-discovery` |
|
||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `tests.hostAliases` | List of host aliases for testing | `[]` |
|
||||
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
|
||||
| `tests.tls.customCA` | Custom CA value for tests | `""` |
|
||||
@@ -106,12 +110,12 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` |
|
||||
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` |
|
||||
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:57151ad9f998c9394c9ba8b66c83f70cbfe3d4b733c166c9856e0d8fb273bfd0` |
|
||||
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d1fc4d296994f28d7e0264c933a12ba75c9a80478ff1eb4b6f692bb91a073a4c` |
|
||||
| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` |
|
||||
| `tests.busybox.image.repository` | The repository within the registry | `busybox` |
|
||||
| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
|
||||
@@ -1,25 +0,0 @@
|
||||
{{ template "chart.header" . }}
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
{{ template "chart.deprecationWarning" . }}
|
||||
|
||||
{{ template "chart.badgesSection" . }}
|
||||
|
||||
{{ template "chart.description" . }}
|
||||
|
||||
{{ template "chart.homepageLine" . }}
|
||||
|
||||
> **Note**: Minimum Spire version is `1.5.3`.
|
||||
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
||||
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
||||
|
||||
{{ template "chart.maintainersSection" . }}
|
||||
|
||||
{{ template "chart.sourcesSection" . }}
|
||||
|
||||
{{ template "chart.requirementsSection" . }}
|
||||
|
||||
{{ template "chart.valuesSection" . }}
|
||||
|
||||
----------------------------------------------
|
||||
@@ -1,5 +1,15 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
|
||||
{{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "edge" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
@@ -7,10 +17,10 @@ metadata:
|
||||
namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
|
||||
labels:
|
||||
{{ include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }}
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
|
||||
+38
@@ -0,0 +1,38 @@
|
||||
{{- if eq (.Values.global.openshift | toString) "true" }}
|
||||
apiVersion: security.openshift.io/v1
|
||||
kind: SecurityContextConstraints
|
||||
metadata:
|
||||
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||
readOnlyRootFilesystem: true
|
||||
runAsUser:
|
||||
type: RunAsAny
|
||||
seLinuxContext:
|
||||
type: RunAsAny
|
||||
supplementalGroups:
|
||||
type: RunAsAny
|
||||
users:
|
||||
- system:serviceaccount:{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}
|
||||
- system:serviceaccount:{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete
|
||||
volumes:
|
||||
- configMap
|
||||
- hostPath
|
||||
- projected
|
||||
- secret
|
||||
- ephemeral
|
||||
- downwardAPI
|
||||
- csi
|
||||
- emptyDir
|
||||
allowHostDirVolumePlugin: true
|
||||
allowHostIPC: true
|
||||
allowHostNetwork: true
|
||||
allowHostPID: true
|
||||
allowHostPorts: true
|
||||
allowPrivilegeEscalation: true
|
||||
allowPrivilegedContainer: true
|
||||
fsGroup:
|
||||
type: RunAsAny
|
||||
groups: []
|
||||
seccompProfiles:
|
||||
- '*'
|
||||
|
||||
{{ end }}
|
||||
+8
-4
@@ -1,4 +1,8 @@
|
||||
{{ $values := merge .Values }}
|
||||
{{- $values := merge .Values }}
|
||||
{{- $host := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.ingress) }}
|
||||
{{- if gt (len .Values.ingress.hosts) 0 }}
|
||||
{{- $host = (index .Values.ingress.hosts 0).host }}
|
||||
{{- end }}
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
@@ -36,9 +40,9 @@ spec:
|
||||
command: ['curl']
|
||||
{{- if dig "tests" "tls" "enabled" false $values }}
|
||||
{{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
|
||||
args: ['-s', '-f', '--cacert', '/ca/ca.crt', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
|
||||
args: ['-s', '-f', '--cacert', '/ca/ca.crt', 'https://{{ $host }}/.well-known/openid-configuration']
|
||||
{{- else }}
|
||||
args: ['-s', '-f', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
|
||||
args: ['-s', '-f', 'https://{{ $host }}/.well-known/openid-configuration']
|
||||
{{- end }}
|
||||
{{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
|
||||
volumeMounts:
|
||||
@@ -46,7 +50,7 @@ spec:
|
||||
mountPath: /ca
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
args: ['-s', '-f', 'http://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
|
||||
args: ['-s', '-f', 'http://{{ $host }}/.well-known/openid-configuration']
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 8 }}
|
||||
|
||||
@@ -125,8 +125,8 @@ insecureScheme:
|
||||
# cpu: 100m
|
||||
# memory: 64Mi
|
||||
|
||||
## @param jwtIssuer Path to JWT issuer
|
||||
jwtIssuer: https://oidc-discovery.example.org
|
||||
## @param jwtIssuer Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset
|
||||
jwtIssuer: ""
|
||||
|
||||
config:
|
||||
## @param config.logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
||||
@@ -241,6 +241,8 @@ ingress:
|
||||
enabled: false
|
||||
## @param ingress.className Ingress class name
|
||||
className: ""
|
||||
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
controllerType: ""
|
||||
## @param ingress.annotations [object] Annotations for ingress object
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
@@ -248,13 +250,20 @@ ingress:
|
||||
# nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
|
||||
## @param ingress.hosts [array] Host paths for ingress object
|
||||
hosts:
|
||||
- host: oidc-discovery.example.org
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress
|
||||
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
host: "oidc-discovery"
|
||||
|
||||
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
|
||||
## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||
hosts: []
|
||||
# - host: oidc-discovery.example.org
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
|
||||
## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
@@ -280,7 +289,7 @@ tests:
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c
|
||||
tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214
|
||||
|
||||
toolkit:
|
||||
## @param tests.toolkit.image.registry The OCI registry to pull the image from
|
||||
@@ -294,7 +303,7 @@ tests:
|
||||
repository: chainguard/slim-toolkit-debug
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: latest@sha256:57151ad9f998c9394c9ba8b66c83f70cbfe3d4b733c166c9856e0d8fb273bfd0
|
||||
tag: latest@sha256:d1fc4d296994f28d7e0264c933a12ba75c9a80478ff1eb4b6f692bb91a073a4c
|
||||
|
||||
busybox:
|
||||
## @param tests.busybox.image.registry The OCI registry to pull the image from
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire-agent
|
||||
description: A Helm chart to install the SPIRE agent.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.8.2"
|
||||
appVersion: "1.8.4"
|
||||
keywords: ["spiffe", "spire-agent"]
|
||||
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -1,14 +1,13 @@
|
||||
# spire-agent
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
  
|
||||
|
||||
A Helm chart to install the SPIRE agent.
|
||||
|
||||
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
> **Note**: Minimum Spire version is `1.5.3`.
|
||||
> [!Note]
|
||||
> Minimum Spire version is `1.5.3`.
|
||||
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
||||
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
||||
|
||||
@@ -25,6 +24,8 @@ A Helm chart to install the SPIRE agent.
|
||||
|
||||
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||
|
||||
## Parameters
|
||||
|
||||
### Chart parameters
|
||||
@@ -59,7 +60,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `server.address` | Address for Spire server | `""` |
|
||||
| `server.port` | Port number for Spire server | `8081` |
|
||||
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
||||
| `healthChecks.port` | override the host port used for health checking | `9980` |
|
||||
| `healthChecks.port` | override the host port used for health checking | `9982` |
|
||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
|
||||
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
|
||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
|
||||
@@ -68,13 +69,13 @@ A Helm chart to install the SPIRE agent.
|
||||
| `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` |
|
||||
| `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `waitForIt.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5b836d1a4c652ec1c56bdd4a05a43349e2eeff50cf7fdb45a356f0ddc578573b` |
|
||||
| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c58a76f9241187615ab081ec73db6aeea6939369fba995206343bd9fb1975378` |
|
||||
| `waitForIt.resources` | Resource requests and limits | `{}` |
|
||||
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `fsGroupFix.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` |
|
||||
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
|
||||
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
|
||||
@@ -92,6 +93,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||
| `priorityClassName` | Priority class assigned to daemonset pods | `""` |
|
||||
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
|
||||
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
|
||||
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` |
|
||||
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
|
||||
|
||||
@@ -1,25 +0,0 @@
|
||||
{{ template "chart.header" . }}
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
{{ template "chart.deprecationWarning" . }}
|
||||
|
||||
{{ template "chart.badgesSection" . }}
|
||||
|
||||
{{ template "chart.description" . }}
|
||||
|
||||
{{ template "chart.homepageLine" . }}
|
||||
|
||||
> **Note**: Minimum Spire version is `1.5.3`.
|
||||
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
||||
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
||||
|
||||
{{ template "chart.maintainersSection" . }}
|
||||
|
||||
{{ template "chart.sourcesSection" . }}
|
||||
|
||||
{{ template "chart.requirementsSection" . }}
|
||||
|
||||
{{ template "chart.valuesSection" . }}
|
||||
|
||||
----------------------------------------------
|
||||
@@ -71,6 +71,10 @@ spec:
|
||||
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args: ["-config", "/run/spire/config/agent.conf"]
|
||||
{{- if gt (len .Values.extraEnvVars) 0 }}
|
||||
env:
|
||||
{{- toYaml .Values.extraEnvVars | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.healthChecks.port }}
|
||||
name: healthz
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
{{- if eq (.Values.global.openshift | toString) "true" }}
|
||||
apiVersion: security.openshift.io/v1
|
||||
kind: SecurityContextConstraints
|
||||
metadata:
|
||||
name: {{ include "spire-agent.fullname" . }}
|
||||
readOnlyRootFilesystem: true
|
||||
runAsUser:
|
||||
type: RunAsAny
|
||||
seLinuxContext:
|
||||
type: RunAsAny
|
||||
supplementalGroups:
|
||||
type: RunAsAny
|
||||
users:
|
||||
- system:serviceaccount:{{ include "spire-agent.namespace" . }}:{{ include "spire-agent.serviceAccountName" . }}
|
||||
volumes:
|
||||
- configMap
|
||||
- hostPath
|
||||
- projected
|
||||
- secret
|
||||
allowHostDirVolumePlugin: true
|
||||
allowHostIPC: true
|
||||
allowHostNetwork: true
|
||||
allowHostPID: true
|
||||
allowHostPorts: true
|
||||
allowPrivilegeEscalation: true
|
||||
allowPrivilegedContainer: true
|
||||
fsGroup:
|
||||
type: RunAsAny
|
||||
groups: []
|
||||
|
||||
{{ end }}
|
||||
@@ -106,7 +106,7 @@ server:
|
||||
|
||||
healthChecks:
|
||||
## @param healthChecks.port override the host port used for health checking
|
||||
port: 9980
|
||||
port: 9982
|
||||
|
||||
## @param livenessProbe.initialDelaySeconds Initial delay seconds for probe
|
||||
## @param livenessProbe.periodSeconds Period seconds for probe
|
||||
@@ -134,7 +134,7 @@ waitForIt:
|
||||
repository: chainguard/wait-for-it
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: latest@sha256:5b836d1a4c652ec1c56bdd4a05a43349e2eeff50cf7fdb45a356f0ddc578573b
|
||||
tag: latest@sha256:c58a76f9241187615ab081ec73db6aeea6939369fba995206343bd9fb1975378
|
||||
|
||||
## @param waitForIt.resources [object] Resource requests and limits
|
||||
resources: {}
|
||||
@@ -153,7 +153,7 @@ fsGroupFix:
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
version: ""
|
||||
tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c
|
||||
tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214
|
||||
|
||||
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
@@ -204,6 +204,9 @@ socketPath: /run/spire/agent-sockets/spire-agent.sock
|
||||
## @param priorityClassName Priority class assigned to daemonset pods
|
||||
priorityClassName: ""
|
||||
|
||||
## @param extraEnvVars [array] Extra environment variables to be added to the Spire Agent container
|
||||
extraEnvVars: []
|
||||
|
||||
## @param extraVolumes [array] Extra volumes to be mounted on Spire Agent pods
|
||||
extraVolumes: []
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire-server
|
||||
description: A Helm chart to install the SPIRE server.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.8.2"
|
||||
appVersion: "1.8.4"
|
||||
keywords: ["spiffe", "spire-server", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -1,14 +1,13 @@
|
||||
# spire-server
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
  
|
||||
|
||||
A Helm chart to install the SPIRE server.
|
||||
|
||||
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
> **Note**: Minimum Spire version is `1.5.3`.
|
||||
> [!Note]
|
||||
> Minimum Spire version is `1.5.3`.
|
||||
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
||||
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
||||
>
|
||||
@@ -39,7 +38,8 @@ When Tornjak is enabled, it is exposed on both http and https (if TLS server cer
|
||||
|
||||
In addition, you can configure a `client certificate authority`, this will make Tornjak backend verify Client certificates signed by this authority to enable mTLS authentication.
|
||||
|
||||
**Warning**: For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access.
|
||||
> [!Important]
|
||||
> For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access.
|
||||
|
||||
### Tornjak with TLS Connection Type
|
||||
|
||||
@@ -47,13 +47,13 @@ TLS connection requires Tornjak to have access to TLS key and certificate.
|
||||
Complete instruction on creating your own TLS certificate can be found [here](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md).
|
||||
TLS Certificate and the private key must be provided to Tornjak via *TLS Secret*. Prior to deploying this Helm chart, create TLS Secret in the deployment namespace (e.g. `spire-server`)
|
||||
|
||||
```console
|
||||
```shell
|
||||
kubectl -n spire-server create secret tls tornjak-tls-secret --cert=client.crt --key=client.key
|
||||
```
|
||||
|
||||
Once the charts are deployed, you can test the TLS connection with the following command (assuming localhost):
|
||||
|
||||
```console
|
||||
```shell
|
||||
curl --cacert CA/rootCA.crt https://localhost:10443
|
||||
```
|
||||
|
||||
@@ -67,13 +67,13 @@ Follow the steps to [create user CA for mTLS](https://github.com/spiffe/tornjak/
|
||||
|
||||
Here is an example using a *Secret* in `spire-server` namespace:
|
||||
|
||||
```console
|
||||
```shell
|
||||
kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt"
|
||||
```
|
||||
|
||||
Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost):
|
||||
|
||||
```console
|
||||
```shell
|
||||
curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhost:10443
|
||||
```
|
||||
|
||||
@@ -81,6 +81,8 @@ curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhos
|
||||
|
||||
In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above.
|
||||
|
||||
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||
|
||||
## Parameters
|
||||
|
||||
### Chart parameters
|
||||
@@ -140,7 +142,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `dataStore.sql.externalSecret.name` | The name of the secret object | `""` |
|
||||
| `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
|
||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||
| `jwtIssuer` | The JWT issuer domain | `https://oidc-discovery.example.org` |
|
||||
| `jwtIssuer` | The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset | `""` |
|
||||
| `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` |
|
||||
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||
| `bundleConfigMap` | Set the trust domain to be used for the SPIFFE identifiers | `spire-bundle` |
|
||||
@@ -150,9 +152,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` |
|
||||
| `federation.ingress.enabled` | Flag to enable ingress for federation | `false` |
|
||||
| `federation.ingress.className` | Ingress class name for federation | `""` |
|
||||
| `federation.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||
| `federation.ingress.hosts` | Host paths for ingress object | `[]` |
|
||||
| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
|
||||
| `federation.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server-federation` |
|
||||
| `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `federation.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `ca_subject.country` | Country for Spire server CA | `ARPA` |
|
||||
| `ca_subject.organization` | Organization for Spire server CA | `Example` |
|
||||
| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` |
|
||||
@@ -212,13 +217,15 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
|
||||
| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
||||
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
||||
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
||||
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||
| `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
||||
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.3.0` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.0` |
|
||||
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
||||
| `controllerManager.securityContext` | Security context | `{}` |
|
||||
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
||||
@@ -232,6 +239,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.identities.namespaceSelector` | Selector for namespacs to issue identity | `{}` |
|
||||
| `controllerManager.identities.dnsNameTemplates` | DNS name template for issued identities | `[]` |
|
||||
| `controllerManager.identities.federatesWith` | Other Spire server URLs for identity federation | `[]` |
|
||||
| `controllerManager.identities.workloadSelectorTemplates` | Templates to produce selectors that apply to a given workload before it will receive an ID | `[]` |
|
||||
| `controllerManager.identities.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` |
|
||||
| `controllerManager.identities.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` |
|
||||
| `controllerManager.identities.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
|
||||
| `controllerManager.identities.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` |
|
||||
| `controllerManager.identities.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` |
|
||||
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
|
||||
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
|
||||
@@ -244,9 +257,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||
| `ingress.enabled` | Flag to enable ingress | `false` |
|
||||
| `ingress.className` | Ingress class name | `""` |
|
||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||
| `ingress.hosts` | Host paths for ingress object | `[]` |
|
||||
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
|
||||
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server` |
|
||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `extraVolumes` | Extra volumes to be mounted | `[]` |
|
||||
| `extraVolumeMounts` | Extra volume mounts | `[]` |
|
||||
| `extraContainers` | Additional containers to create | `[]` |
|
||||
@@ -257,6 +273,11 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
|
||||
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` |
|
||||
| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` |
|
||||
|
||||
### Tornjak
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||
| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` |
|
||||
| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
|
||||
@@ -269,9 +290,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tornjak.service.annotations` | Annotations for the service | `{}` |
|
||||
| `tornjak.ingress.enabled` | Flag to enable ingress for Tornjak backend service | `false` |
|
||||
| `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` |
|
||||
| `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` |
|
||||
| `tornjak.ingress.hosts` | Host paths for ingress Tornjak backend service | `[]` |
|
||||
| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress | `[]` |
|
||||
| `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` |
|
||||
| `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `tornjak.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` |
|
||||
| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` |
|
||||
| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` |
|
||||
@@ -298,4 +322,4 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` |
|
||||
|
||||
@@ -205,7 +205,10 @@ The code below determines what connection type should be used.
|
||||
|
||||
{{- define "spire-server.test.federation-ingress-args" }}
|
||||
{{- $args := list }}
|
||||
{{- $host := index (index (index .Values.federation.ingress.tls 0) "hosts") 0 }}
|
||||
{{- $host := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.federation.ingress) }}
|
||||
{{- if gt (len .Values.federation.ingress.tls) 0 }}
|
||||
{{- $host = index (index (index .Values.federation.ingress.tls 0) "hosts") 0 }}
|
||||
{{- end }}
|
||||
{{- if dig "tests" "tls" "enabled" false .Values }}
|
||||
{{- if ne (len (dig "tests" "tls" "customCA" "" .Values)) 0 }}
|
||||
{{- $args = append $args "--cacert" }}
|
||||
@@ -217,3 +220,11 @@ The code below determines what connection type should be used.
|
||||
{{- end }}
|
||||
{{ $args | toYaml }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "spire-server.controller-manager-class-name" -}}
|
||||
{{- if .Values.controllerManager.className }}
|
||||
{{- .Values.controllerManager.className }}
|
||||
{{- else }}
|
||||
{{- .Release.Namespace }}-{{ .Release.Name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
apiVersion: spire.spiffe.io/v1alpha1
|
||||
kind: ClusterSPIFFEID
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" $root }}-service-account-based
|
||||
name: {{ $root.Release.Namespace }}-{{ include "spire-controller-manager.fullname" $root }}-service-account-based
|
||||
namespace: {{ include "spire-server.namespace" $root }}
|
||||
spec:
|
||||
spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }}
|
||||
@@ -24,5 +24,19 @@ spec:
|
||||
dnsNameTemplates:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .identities.workloadSelectorTemplates }}
|
||||
workloadTSelectoremplates:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .identities.ttl }}
|
||||
ttl: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .identities.jwtTTL }}
|
||||
jwtTtl: {{ . | quote }}
|
||||
{{- end }}
|
||||
admin: {{ .identities.admin }}
|
||||
downstream: {{ .identities.downstream }}
|
||||
autoPopulateDNSNames: {{ .identities.autoPopulateDNSNames }}
|
||||
className: {{ include "spire-server.controller-manager-class-name" $root | quote}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -25,7 +25,7 @@ data:
|
||||
leaderElect: true
|
||||
resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
|
||||
resourceNamespace: {{ include "spire-server.namespace" . }}
|
||||
validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
clusterName: {{ include "spire-lib.cluster-name" . }}
|
||||
trustDomain: {{ include "spire-lib.trust-domain" . }}
|
||||
ignoreNamespaces:
|
||||
@@ -33,4 +33,6 @@ data:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
spireServerSocketPath: "/tmp/spire-server/private/api.sock"
|
||||
className: {{ include "spire-server.controller-manager-class-name" . | quote}}
|
||||
watchClassless: {{ .Values.controllerManager.watchClassless | toYaml }}
|
||||
{{- end }}
|
||||
|
||||
@@ -32,7 +32,7 @@ subjects:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["namespaces"]
|
||||
@@ -43,6 +43,9 @@ rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["endpoints"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
@@ -77,11 +80,11 @@ rules:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
name: {{ .Release.Namespace}}-{{ include "spire-controller-manager.fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire-server.serviceAccountName" . }}
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
webhooks:
|
||||
- admissionReviewVersions: ["v1"]
|
||||
clientConfig:
|
||||
|
||||
@@ -1,6 +1,17 @@
|
||||
{{- if .Values.federation.enabled }}
|
||||
{{- if .Values.federation.ingress.enabled -}}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.federation.ingress) }}
|
||||
{{- $svcName := include "spire-server.fullname" . }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.federation.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "edge" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
@@ -8,11 +19,11 @@ metadata:
|
||||
namespace: {{ include "spire-server.namespace" . }}
|
||||
labels:
|
||||
{{ include "spire-server.labels" . | nindent 4 }}
|
||||
{{- with .Values.federation.ingress.annotations }}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "global" .Values.global) | nindent 2 }}
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,5 +1,21 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
|
||||
{{- $fullName := include "spire-server.fullname" . -}}
|
||||
{{- $path := "/" }}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
@@ -7,10 +23,10 @@ metadata:
|
||||
namespace: {{ include "spire-server.namespace" . }}
|
||||
labels:
|
||||
{{ include "spire-server.labels" . | nindent 4}}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }}
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -22,7 +22,7 @@ metadata:
|
||||
rules:
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}]
|
||||
resourceNames: [{{ printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) | quote }}]
|
||||
verbs: ["get", "patch"]
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
@@ -68,7 +68,7 @@ spec:
|
||||
args:
|
||||
- patch
|
||||
- validatingwebhookconfiguration
|
||||
- {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
- {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
- --type=strategic
|
||||
- -p
|
||||
- |
|
||||
|
||||
@@ -22,7 +22,7 @@ metadata:
|
||||
rules:
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}]
|
||||
resourceNames: [{{ printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) | quote }}]
|
||||
verbs: ["get", "patch"]
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
@@ -68,7 +68,7 @@ spec:
|
||||
args:
|
||||
- patch
|
||||
- validatingwebhookconfiguration
|
||||
- {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
- {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
- --type=strategic
|
||||
- -p
|
||||
- |
|
||||
|
||||
@@ -1,4 +1,9 @@
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- $webhookname := printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) }}
|
||||
{{- $oldwebhookname := printf "%s-webhook" (include "spire-controller-manager.fullname" .) }}
|
||||
{{- if not (lookup "admissionregistration.k8s.io/v1" "ValidatingWebhookConfiguration" "" $webhookname) }}
|
||||
{{- $webhookname = $oldwebhookname }}
|
||||
{{- end }}
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
|
||||
apiVersion: v1
|
||||
@@ -22,7 +27,7 @@ metadata:
|
||||
rules:
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}]
|
||||
resourceNames: [{{ $webhookname | quote }}]
|
||||
verbs: ["get", "patch"]
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
@@ -68,7 +73,7 @@ spec:
|
||||
args:
|
||||
- patch
|
||||
- validatingwebhookconfiguration
|
||||
- {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
- {{ $webhookname }}
|
||||
- --type=strategic
|
||||
- -p
|
||||
- |
|
||||
|
||||
@@ -48,10 +48,10 @@ spec:
|
||||
shareProcessNamespace: true
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
{{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName }}
|
||||
{{- end }}
|
||||
{{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }}
|
||||
initContainers:
|
||||
{{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }}
|
||||
- name: wait
|
||||
|
||||
@@ -1,5 +1,27 @@
|
||||
{{- if .Values.tornjak.ingress.enabled -}}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.tornjak.ingress) }}
|
||||
{{- $fullName := include "spire-tornjak.fullname" . -}}
|
||||
{{- $path := "/" }}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.tornjak.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- if ne (include "spire-tornjak.connectionType" .) "http" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- end }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- if ne (include "spire-tornjak.connectionType" .) "http" }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- else }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "edge" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
@@ -7,14 +29,14 @@ metadata:
|
||||
namespace: {{ include "spire-server.namespace" . }}
|
||||
labels:
|
||||
{{ include "spire-server.labels" . | nindent 4}}
|
||||
{{- with .Values.tornjak.ingress.annotations }}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if eq (include "spire-tornjak.connectionType" .) "http" }}
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-http") | nindent 2 }}
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.http "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- else -}}
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-https") | nindent 2 }}
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.https "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
@@ -174,8 +174,8 @@ dataStore:
|
||||
|
||||
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
||||
logLevel: info
|
||||
## @param jwtIssuer The JWT issuer domain
|
||||
jwtIssuer: https://oidc-discovery.example.org
|
||||
## @param jwtIssuer The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset
|
||||
jwtIssuer: ""
|
||||
|
||||
## @param clusterName Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`)
|
||||
clusterName: example-cluster
|
||||
@@ -202,6 +202,8 @@ federation:
|
||||
enabled: false
|
||||
## @param federation.ingress.className Ingress class name for federation
|
||||
className: ""
|
||||
## @param federation.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
controllerType: ""
|
||||
## @param federation.ingress.annotations [object] Annotations for the ingress object
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
@@ -209,14 +211,21 @@ federation:
|
||||
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
# If Profile Type == https_spiffe:
|
||||
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||
## @param federation.ingress.hosts [array] Host paths for ingress object
|
||||
hosts:
|
||||
- host: spire-server-federation.example.org
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
|
||||
## @param federation.ingress.tls [array] Secrets containining TLS certs to enable https on ingress
|
||||
## @param federation.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
host: "spire-server-federation"
|
||||
|
||||
## @param federation.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
|
||||
## @param federation.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||
hosts: []
|
||||
# - host: spire-server-federation.example.org
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
|
||||
## @param federation.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
# - hosts:
|
||||
# - spire-server-federation.example.org
|
||||
@@ -368,6 +377,12 @@ notifier:
|
||||
controllerManager:
|
||||
## @param controllerManager.enabled Flag to enable controller manager
|
||||
enabled: false
|
||||
|
||||
## @param controllerManager.className specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs.
|
||||
className: ""
|
||||
## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.
|
||||
watchClassless: false
|
||||
|
||||
installAndUpgradeHook:
|
||||
## @param controllerManager.installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`)
|
||||
enabled: true
|
||||
@@ -386,7 +401,7 @@ controllerManager:
|
||||
repository: spiffe/spire-controller-manager
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: "0.3.0"
|
||||
tag: "0.4.0"
|
||||
|
||||
## @param controllerManager.resources [object] Resource requests and limits for controller manager
|
||||
resources: {}
|
||||
@@ -450,6 +465,18 @@ controllerManager:
|
||||
federatesWith: []
|
||||
# - example.io
|
||||
# - example.ai
|
||||
## @param controllerManager.identities.workloadSelectorTemplates [array] Templates to produce selectors that apply to a given workload before it will receive an ID
|
||||
workloadSelectorTemplates: []
|
||||
## @param controllerManager.identities.ttl Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen.
|
||||
ttl: ""
|
||||
## @param controllerManager.identities.jwtTTL Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen.
|
||||
jwtTTL: ""
|
||||
## @param controllerManager.identities.admin Indicates any pod matched by this identity will be an admin. Use this with extreme care.
|
||||
admin: false
|
||||
## @param controllerManager.identities.downstream Set if this spire instance is a root server and the workloads are downstream servers.
|
||||
downstream: false
|
||||
## @param controllerManager.identities.autoPopulateDNSNames Auto populate DNS names from services attached to pods
|
||||
autoPopulateDNSNames: false
|
||||
|
||||
validatingWebhookConfiguration:
|
||||
## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued
|
||||
@@ -487,6 +514,8 @@ ingress:
|
||||
enabled: false
|
||||
## @param ingress.className Ingress class name
|
||||
className: ""
|
||||
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
controllerType: ""
|
||||
## @param ingress.annotations [object] Annotations for the ingress object
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
@@ -494,13 +523,20 @@ ingress:
|
||||
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||
|
||||
## @param ingress.hosts [array] Host paths for ingress object
|
||||
hosts:
|
||||
- host: spire-server.example.org
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress
|
||||
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
host: "spire-server"
|
||||
|
||||
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
|
||||
## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||
hosts: []
|
||||
# - host: spire-server.example.org
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
|
||||
## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
# - secretName: spire-server-tls
|
||||
# hosts:
|
||||
@@ -534,7 +570,7 @@ nodeAttestor:
|
||||
## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor
|
||||
serviceAccountAllowList: []
|
||||
|
||||
# tornjak - Tornjak default values
|
||||
## @section Tornjak
|
||||
tornjak:
|
||||
## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production)
|
||||
enabled: false
|
||||
@@ -564,18 +600,28 @@ tornjak:
|
||||
|
||||
## @param tornjak.ingress.enabled Flag to enable ingress for Tornjak backend service
|
||||
## @param tornjak.ingress.className Ingress class name for Tornjak backend service
|
||||
## @param tornjak.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
## @param tornjak.ingress.annotations [object] Annotations for Tornjak backend service
|
||||
## @param tornjak.ingress.hosts [array] Host paths for ingress Tornjak backend service
|
||||
ingress:
|
||||
enabled: false
|
||||
className: ""
|
||||
controllerType: ""
|
||||
annotations: {}
|
||||
hosts:
|
||||
- host: tornjak-backend.example.org
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
## @param tornjak.ingress.tls [array] Secrets containing TLS certs to enable https on ingress
|
||||
|
||||
## @param tornjak.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
host: "tornjak-backend"
|
||||
|
||||
## @param tornjak.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
|
||||
## @param tornjak.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||
hosts: []
|
||||
# - host: tornjak-backend.example.org
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
|
||||
## @param tornjak.ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
@@ -678,4 +724,4 @@ tests:
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c
|
||||
tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214
|
||||
|
||||
@@ -1,7 +1,5 @@
|
||||
# tornjak-frontend
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
@@ -11,7 +9,8 @@ A Helm chart to deploy Tornjak frontend
|
||||
|
||||
## Version support
|
||||
|
||||
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
|
||||
> [!Note]
|
||||
> This Chart is still in development and still subject to change the API (`values.yaml`).
|
||||
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
|
||||
> we do aim for as much stability as possible.
|
||||
|
||||
@@ -52,12 +51,14 @@ port forwarding. See the chart NOTES output for more details.
|
||||
|
||||
* <https://github.com/spiffe/tornjak>
|
||||
|
||||
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||
|
||||
## Parameters
|
||||
|
||||
### Chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||
| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
@@ -80,7 +81,7 @@ port forwarding. See the chart NOTES output for more details.
|
||||
| `affinity` | Affinity rules | `{}` |
|
||||
| `tolerations` | List of tolerations | `[]` |
|
||||
| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` |
|
||||
| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. | `http://localhost:10000/` |
|
||||
| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If unset, autodetection is atempted. | `""` |
|
||||
| `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` |
|
||||
| `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` |
|
||||
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` |
|
||||
@@ -88,13 +89,17 @@ port forwarding. See the chart NOTES output for more details.
|
||||
| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
|
||||
| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` |
|
||||
| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` |
|
||||
| `workingDir` | Path containing the Tornjak frontend within the image | `/usr/src/app` |
|
||||
| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` |
|
||||
| `ingress.className` | Ingress class name for Tornjak frontend service | `""` |
|
||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` |
|
||||
| `ingress.hosts` | Host paths for ingress Tornjak frontend service | `[]` |
|
||||
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress | `[]` |
|
||||
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-frontend` |
|
||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` |
|
||||
|
||||
@@ -1,54 +0,0 @@
|
||||
{{ template "chart.header" . }}
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
{{ template "chart.deprecationWarning" . }}
|
||||
|
||||
{{ template "chart.badgesSection" . }}
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
{{ template "chart.description" . }}
|
||||
|
||||
{{ template "chart.homepageLine" . }}
|
||||
|
||||
## Version support
|
||||
|
||||
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
|
||||
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
|
||||
> we do aim for as much stability as possible.
|
||||
|
||||
| Dependency | Supported Versions |
|
||||
|:-----------|:-------------------|
|
||||
| SPIRE | `1.5.3+`, `1.6.x` |
|
||||
| Tornjak | `1.0.x` |
|
||||
| Helm | `3.x` |
|
||||
|
||||
## Tornjak
|
||||
|
||||
Tornjak is the UI and Control Plane for SPIRE [https://github.com/spiffe/tornjak](https://github.com/spiffe/tornjak) and it is composed of two components:
|
||||
|
||||
* [Backend](../spire-server/README.md) - Tornjak APIs that extend SPIRE APIs with Control Plane functionality
|
||||
* Frontend (this chart) - Tornjak UI
|
||||
|
||||
## Prerequisites
|
||||
|
||||
This chart requires access to Tornjak Backend (`tornjakFrontend.apiServerURL`).
|
||||
This URL needs to be reachable from your web browser and can therefore not be a cluster internal URL.
|
||||
|
||||
Obtain the URL for Tornjak APIs. If deployed in the same cluster, locally,
|
||||
Tornjak APIs are typically available at `http://localhost:10000`.
|
||||
Review Tornjak documentation for more details.
|
||||
|
||||
## Usage
|
||||
|
||||
Since this is just a demo version, to access Tornjak APIs you can use
|
||||
port forwarding. See the chart NOTES output for more details.
|
||||
|
||||
{{ template "chart.maintainersSection" . }}
|
||||
|
||||
{{ template "chart.sourcesSection" . }}
|
||||
|
||||
{{ template "chart.requirementsSection" . }}
|
||||
|
||||
{{ template "chart.valuesSection" . }}
|
||||
----------------------------------------------
|
||||
@@ -78,8 +78,9 @@ Create URL for accessing Tornjak APIs
|
||||
{{- define "tornjak-frontend.apiURL" -}}
|
||||
{{- if .Values.apiServerURL -}}
|
||||
{{- .Values.apiServerURL -}}
|
||||
{{- else if .Values.ingress.enabled }}
|
||||
{{- printf "https://tornjak-backend.%s" (include "spire-lib.trust-domain" .) }}
|
||||
{{- else }}
|
||||
{{- $feurl := print "http://localhost:" .Values.service.port }}
|
||||
{{- $feurl }}
|
||||
{{- print "http://localhost:" .Values.service.port }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -53,9 +53,9 @@ spec:
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: cache
|
||||
mountPath: /usr/src/app/node_modules/.cache
|
||||
mountPath: {{ .Values.workingDir }}/node_modules/.cache
|
||||
- name: env
|
||||
mountPath: /usr/src/app/build/tmp
|
||||
mountPath: {{ .Values.workingDir }}/build/tmp
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
|
||||
@@ -1,5 +1,15 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
|
||||
{{- $fullName := include "tornjak-frontend.fullname" . -}}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "edge" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
@@ -7,10 +17,10 @@ metadata:
|
||||
namespace: {{ include "tornjak-frontend.namespace" . }}
|
||||
labels:
|
||||
{{ include "tornjak-frontend.labels" . | nindent 4}}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }}
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -88,8 +88,8 @@ topologySpreadConstraints: []
|
||||
# cpu: 100m
|
||||
# memory: 512Mi
|
||||
|
||||
## @param apiServerURL URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser.
|
||||
apiServerURL: "http://localhost:10000/" # 👈 Use it for minikube or kind
|
||||
## @param apiServerURL URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If unset, autodetection is atempted.
|
||||
apiServerURL: ""
|
||||
|
||||
# SPIRE Healthchecker indicator
|
||||
spireHealthCheck:
|
||||
@@ -113,20 +113,33 @@ startupProbe:
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
|
||||
## @param workingDir Path containing the Tornjak frontend within the image
|
||||
workingDir: /usr/src/app
|
||||
|
||||
## @param ingress.enabled Flag to enable ingress for Tornjak frontend service
|
||||
## @param ingress.className Ingress class name for Tornjak frontend service
|
||||
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
## @param ingress.annotations [object] Annotations for Tornjak frontend service
|
||||
## @param ingress.hosts [array] Host paths for ingress Tornjak frontend service
|
||||
ingress:
|
||||
enabled: false
|
||||
className: ""
|
||||
controllerType: ""
|
||||
annotations: {}
|
||||
hosts:
|
||||
- host: tornjak-frontend.example.org
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress
|
||||
|
||||
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
host: "tornjak-frontend"
|
||||
|
||||
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
|
||||
## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||
hosts: []
|
||||
# - host: tornjak-frontend.example.org
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
|
||||
## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
@@ -145,4 +158,4 @@ tests:
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c
|
||||
tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214
|
||||
|
||||
@@ -21,3 +21,13 @@ Warning: You're using an unsupported plugin. Functionality of this release and f
|
||||
|
||||
Warning: You're using an experimental config. Functionality of this release and future upgrades aren't guaranteed to work smoothly.
|
||||
{{- end }}
|
||||
{{- $className := include "spire-server.controller-manager-class-name" (dict "Values" (index .Values "spire-server") "Release" .Release) }}
|
||||
{{- if (index .Values "spire-server").controllerManager.enabled }}
|
||||
{{- if (index .Values "spire-server").controllerManager.watchClassless }}
|
||||
|
||||
Spire CR's will be handled if no className is specified or if className is set to "{{ $className }}"
|
||||
{{- else }}
|
||||
|
||||
Spire CR's will be handled only if className is set to "{{ $className }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -17,8 +17,10 @@
|
||||
{{- define "spire-lib.jwt-issuer" }}
|
||||
{{- if ne (len (dig "spire" "jwtIssuer" "" .Values.global)) 0 }}
|
||||
{{- .Values.global.spire.jwtIssuer }}
|
||||
{{- else }}
|
||||
{{- else if ne (len .Values.jwtIssuer) 0 }}
|
||||
{{- .Values.jwtIssuer }}
|
||||
{{- else }}
|
||||
{{- printf "oidc-discovery.%s" (include "spire-lib.trust-domain" .) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -61,17 +63,78 @@
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* Takes in a dictionary with keys:
|
||||
* global - the standard global object
|
||||
* ingress - a standard format ingress config object
|
||||
*/}}
|
||||
{{- define "spire-lib.ingress-controller-type" }}
|
||||
{{- $type := "" }}
|
||||
{{- if ne (len (dig "spire" "ingressControllerType" "" .global)) 0 }}
|
||||
{{- $type = .global.spire.ingressControllerType }}
|
||||
{{- else if ne .ingress.controllerType "" }}
|
||||
{{- $type = .ingress.controllerType }}
|
||||
{{- else if (dig "openshift" false .global) }}
|
||||
{{- $type = "openshift" }}
|
||||
{{- else }}
|
||||
{{- $type = "other" }}
|
||||
{{- end }}
|
||||
{{- if not (has $type (list "ingress-nginx" "openshift" "other")) }}
|
||||
{{- fail "Unsupported ingress controller type specified. Must be one of [ingress-nginx, openshift, other]" }}
|
||||
{{- end }}
|
||||
{{- $type }}
|
||||
{{- end }}
|
||||
|
||||
{{/* Takes in a dictionary with keys:
|
||||
* ingress - the standardized ingress object
|
||||
* Values - Chart values
|
||||
*/}}
|
||||
{{ define "spire-lib.ingress-calculated-name" }}
|
||||
{{- $host := .ingress.host }}
|
||||
{{- if not (contains $host ".") }}
|
||||
{{- $host = printf "%s.%s" $host (include "spire-lib.trust-domain" .) }}
|
||||
{{- end }}
|
||||
{{- $host }}
|
||||
{{- end }}
|
||||
|
||||
{{/* Takes in a dictionary with keys:
|
||||
* ingress - the standardized ingress object
|
||||
* svcName - The service to route to
|
||||
* port - which port on the service to use
|
||||
* path - optional path to set on the rules
|
||||
* pathType - typical ingress path type
|
||||
* tlsSection - bool specifying to add by default the tls section to the ingress. Ingress-nginx needs true, openshift needs false.
|
||||
* Values - Chart values
|
||||
*/}}
|
||||
{{ define "spire-lib.ingress-spec" }}
|
||||
{{- $host := include "spire-lib.ingress-calculated-name" . }}
|
||||
{{- $svcName := .svcName }}
|
||||
{{- $port := .port }}
|
||||
{{- with .ingress.className }}
|
||||
ingressClassName: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- if eq (add (len .ingress.tls) (len .ingress.hosts)) 0 }}
|
||||
{{ if or .tlsSection .ingress.tlsSecret }}
|
||||
tls:
|
||||
- hosts:
|
||||
- {{ $host | quote }}
|
||||
{{- with .ingress.tlsSecret }}
|
||||
secretName: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- host: {{ $host | quote }}
|
||||
http:
|
||||
paths:
|
||||
- pathType: {{ .pathType }}
|
||||
{{- with .path }}
|
||||
path: {{ . }}
|
||||
{{- end }}
|
||||
backend:
|
||||
service:
|
||||
name: {{ $svcName | quote }}
|
||||
port:
|
||||
number: {{ $port }}
|
||||
{{- else }}
|
||||
{{- if .ingress.tls }}
|
||||
tls:
|
||||
{{- range .ingress.tls }}
|
||||
@@ -98,6 +161,7 @@ rules:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-lib.kubectl-image" }}
|
||||
{{- $root := deepCopy . }}
|
||||
|
||||
@@ -13,8 +13,8 @@ global:
|
||||
bundleConfigMap: ""
|
||||
## @param global.spire.clusterName The name of the k8s cluster for Spire install
|
||||
clusterName: example-cluster
|
||||
## @param global.spire.jwtIssuer The issuer for Spire JWT tokens
|
||||
jwtIssuer: oidc-discovery.example.org
|
||||
## @param global.spire.jwtIssuer The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset
|
||||
jwtIssuer: ""
|
||||
## @param global.spire.trustDomain The trust domain for Spire install
|
||||
trustDomain: example.org
|
||||
## @param global.spire.upstreamServerAddress Set what address to use for the upstream server when using nested spire
|
||||
@@ -27,6 +27,9 @@ global:
|
||||
## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
|
||||
strictMode: false
|
||||
|
||||
## @param global.spire.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
ingressControllerType: ""
|
||||
|
||||
installAndUpgradeHooks:
|
||||
## @param global.installAndUpgradeHooks.enabled Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`)
|
||||
enabled: true
|
||||
|
||||
@@ -3,7 +3,7 @@ target-branch: main
|
||||
chart-dirs:
|
||||
- charts
|
||||
chart-repos:
|
||||
- spiffe=https://spiffe.github.io/helm-charts/
|
||||
- spiffe=https://spiffe.github.io/helm-charts-hardened/
|
||||
- bitnami=https://charts.bitnami.com/bitnami
|
||||
- ingress-nginx=https://kubernetes.github.io/ingress-nginx
|
||||
exclude-deprecated: true
|
||||
|
||||
@@ -12,11 +12,24 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
|
||||
# shellcheck source=/dev/null
|
||||
source "${TESTDIR}/common.sh"
|
||||
|
||||
CLEANUP=1
|
||||
|
||||
for i in "$@"; do
|
||||
case $i in
|
||||
-c)
|
||||
CLEANUP=0
|
||||
shift # past argument=value
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
teardown() {
|
||||
if [ "${CLEANUP}" -eq 1 ]; then
|
||||
helm uninstall --namespace "spire-server" spire 2>/dev/null || true
|
||||
helm uninstall --namespace mysql mysql 2>/dev/null || true
|
||||
kubectl delete ns spire-server 2>/dev/null || true
|
||||
kubectl delete ns spire-system 2>/dev/null || true
|
||||
fi
|
||||
}
|
||||
|
||||
trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
|
||||
|
||||
@@ -12,11 +12,24 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
|
||||
# shellcheck source=/dev/null
|
||||
source "${TESTDIR}/common.sh"
|
||||
|
||||
CLEANUP=1
|
||||
|
||||
for i in "$@"; do
|
||||
case $i in
|
||||
-c)
|
||||
CLEANUP=0
|
||||
shift # past argument=value
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
teardown() {
|
||||
if [ "${CLEANUP}" -eq 1 ]; then
|
||||
helm uninstall --namespace "spire-server" spire 2>/dev/null || true
|
||||
helm uninstall --namespace "spire-server" postgresql 2>/dev/null || true
|
||||
kubectl delete ns spire-server 2>/dev/null || true
|
||||
kubectl delete ns spire-system 2>/dev/null || true
|
||||
fi
|
||||
}
|
||||
|
||||
trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
|
||||
|
||||
@@ -12,13 +12,26 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
|
||||
# shellcheck source=/dev/null
|
||||
source "${TESTDIR}/common.sh"
|
||||
|
||||
CLEANUP=1
|
||||
|
||||
for i in "$@"; do
|
||||
case $i in
|
||||
-c)
|
||||
CLEANUP=0
|
||||
shift # past argument=value
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
teardown() {
|
||||
if [ "${CLEANUP}" -eq 1 ]; then
|
||||
helm uninstall --namespace spire-server spire 2>/dev/null || true
|
||||
kubectl delete ns spire-server 2>/dev/null || true
|
||||
kubectl delete ns spire-system 2>/dev/null || true
|
||||
|
||||
helm uninstall --namespace mysql spire-root-server 2>/dev/null || true
|
||||
kubectl delete ns spire-root-server 2>/dev/null || true
|
||||
fi
|
||||
}
|
||||
|
||||
trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
|
||||
@@ -33,10 +46,6 @@ helm upgrade --install --create-namespace spire charts/spire \
|
||||
--values "${DEPS}/spire-root-server-values.yaml" \
|
||||
--wait
|
||||
|
||||
kubectl get nodes -o go-template='{{range .items}}{{printf "%s\n" .metadata.uid}}{{end}}' | while read -r line; do
|
||||
kubectl exec -t spire-server-0 -n "spire-root-server" -- spire-server entry create -spiffeID spiffe://production.other/production/nested-spire -parentID "spiffe://production.other/spire/agent/k8s_psat/production/$line" -selector k8s:pod-label:app.kubernetes.io/name:server -downstream
|
||||
done
|
||||
|
||||
helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \
|
||||
--wait spire charts/spire
|
||||
helm test --namespace spire-server spire
|
||||
|
||||
@@ -0,0 +1,80 @@
|
||||
# Recommended setup for installing Spire on Openshift
|
||||
|
||||
> [!Note]
|
||||
> This functionality is under development. It works but has no automated testing and will have security tightened in the future.
|
||||
|
||||
This deployment works only with Openshift version 4.13 or higher. Get the Openshift platform here: [try.openshift.com](try.openshift.com)
|
||||
|
||||
To be consistent with the rest of the Spire helm-charts,
|
||||
we deploy Spire across 2 namespaces.
|
||||
|
||||
```shell
|
||||
kubectl create namespace "spire-system"
|
||||
kubectl create namespace "spire-server"
|
||||
|
||||
#Note, the first install requires privilege due to helm ordering issue. After install it can be safely tightened back up.
|
||||
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=privileged
|
||||
|
||||
kubectl label namespace "spire-system" security.openshift.io/scc.podSecurityLabelSync=false
|
||||
kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
|
||||
kubectl label namespace "spire-system" pod-security.kubernetes.io/warn=privileged --overwrite
|
||||
kubectl label namespace "spire-system" pod-security.kubernetes.io/audit=privileged --overwrite
|
||||
|
||||
helm upgrade --install --namespace spire-server spire-crds charts/spire-crds
|
||||
```
|
||||
|
||||
Obtain you ingress subdomain:
|
||||
|
||||
```shell
|
||||
appdomain=$(oc get cm -n openshift-config-managed console-public -o go-template="{{ .data.consoleURL }}" | sed 's@https://@@; s/^[^.]*\.//')
|
||||
echo "$appdomain"
|
||||
```
|
||||
|
||||
Update the `example-your-values.yaml` file with your subdomain.
|
||||
|
||||
> [!Note]
|
||||
> The location of the apps subdomain may be different in certain environments_
|
||||
|
||||
## Standard Deployment
|
||||
|
||||
```shell
|
||||
helm upgrade --install --namespace spire-server spire charts/spire \
|
||||
--values examples/production/values.yaml \
|
||||
--values examples/openshift/openshift-values.yaml \
|
||||
--values examples/production/example-your-values.yaml \
|
||||
--render-subchart-notes
|
||||
```
|
||||
|
||||
## IBM Cloud Deployment
|
||||
|
||||
Openshift on IBM Cloud requires additional configuration:
|
||||
|
||||
```shell
|
||||
helm upgrade --install --namespace spire-server spire charts/spire \
|
||||
--values examples/production/values.yaml \
|
||||
--values examples/openshift/openshift-values.yaml \
|
||||
--set spiffe-csi-driver.kubeletPath=/var/data/kubelet \
|
||||
--set spiffe-csi-driver.restrictedScc.enabled=true \
|
||||
--values examples/production/example-your-values.yaml \
|
||||
--render-subchart-notes
|
||||
```
|
||||
|
||||
## Feature Customization
|
||||
|
||||
Additional features such as tornjak can be enabled by including their example values files before --values examples/production/example-your-values.yaml
|
||||
|
||||
For example:
|
||||
|
||||
```shell
|
||||
--values examples/openshift/openshift-values.yaml \
|
||||
--values examples/tornjak/values.yaml \
|
||||
--values examples/production/example-your-values.yaml \
|
||||
```
|
||||
|
||||
## Finish install
|
||||
|
||||
Once installed, the namespace security can be tightened back up.
|
||||
|
||||
```shell
|
||||
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted --overwrite
|
||||
```
|
||||
@@ -0,0 +1,82 @@
|
||||
global:
|
||||
openshift: true
|
||||
telemetry:
|
||||
prometheus:
|
||||
enabled: true
|
||||
|
||||
spire-server:
|
||||
tornjak:
|
||||
image:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/tornjak-backend
|
||||
tag: ubi-v1.4.1
|
||||
|
||||
nodeAttestor:
|
||||
k8sPsat:
|
||||
serviceAccountAllowList: ["spire-system:spire-agent"]
|
||||
notifier:
|
||||
k8sbundle:
|
||||
namespace: spire-system
|
||||
podSecurityContext:
|
||||
# These are unset so that openshift can automatically assign its own restricted uids to the pods
|
||||
runAsUser: null
|
||||
runAsGroup: null
|
||||
fsGroup: null
|
||||
|
||||
spire-agent:
|
||||
podSecurityContext:
|
||||
runAsUser: null
|
||||
runAsGroup: null
|
||||
fsGroup: null
|
||||
# Talk from the agent to kubelet based on hostname instead of localhost
|
||||
extraEnvVars:
|
||||
- name: MY_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
|
||||
upstream-spire-agent:
|
||||
podSecurityContext:
|
||||
runAsUser: null
|
||||
runAsGroup: null
|
||||
fsGroup: null
|
||||
|
||||
spiffe-oidc-discovery-provider:
|
||||
podSecurityContext:
|
||||
runAsUser: null
|
||||
runAsGroup: null
|
||||
fsGroup: null
|
||||
|
||||
tornjak-frontend:
|
||||
workingDir: /opt/app-root/src
|
||||
image:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/tornjak-frontend
|
||||
tag: ubi-v1.4.1
|
||||
podSecurityContext:
|
||||
runAsUser: null
|
||||
runAsGroup: null
|
||||
fsGroup: null
|
||||
|
||||
spiffe-csi-driver:
|
||||
csiDriverLabels:
|
||||
security.openshift.io/csi-ephemeral-volume-profile: restricted
|
||||
initContainers:
|
||||
- terminationMessagePath: /dev/termination-log
|
||||
name: set-context
|
||||
command:
|
||||
- chcon
|
||||
- '-Rvt'
|
||||
- container_file_t
|
||||
- spire-agent-socket/
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- all
|
||||
privileged: true
|
||||
imagePullPolicy: Always
|
||||
volumeMounts:
|
||||
- name: spire-agent-socket-dir
|
||||
mountPath: /spire-agent-socket
|
||||
terminationMessagePolicy: File
|
||||
image: 'registry.access.redhat.com/ubi9:latest'
|
||||
@@ -20,7 +20,7 @@ If your using ingress-nginx and want to expose the spiffe oidc discovery provide
|
||||
cluster, add the following to the end of the helm upgrade example:
|
||||
|
||||
```shell
|
||||
-f values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml
|
||||
-f values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml
|
||||
```
|
||||
|
||||
If you want to expose your spire-server outside of Kubernetes and are using ingress-nginx, add following values file when running `helm template/install/upgrade`.
|
||||
@@ -28,21 +28,25 @@ If you want to expose your spire-server outside of Kubernetes and are using ingr
|
||||
```shell
|
||||
-f values-expose-spire-server-ingress-nginx.yaml
|
||||
```
|
||||
|
||||
For example:
|
||||
|
||||
```shell
|
||||
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-spire-server-ingress-nginx.yaml
|
||||
```
|
||||
|
||||
If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx
|
||||
you have two options as described here:
|
||||
https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles
|
||||
[github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles](https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles)
|
||||
|
||||
If you chose profile https_web, use:
|
||||
|
||||
```shell
|
||||
-f values-expose-federation-https-web-ingress-nginx.yaml
|
||||
```
|
||||
|
||||
For example:
|
||||
|
||||
```shell
|
||||
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-web-ingress-nginx.yaml
|
||||
```
|
||||
@@ -52,10 +56,11 @@ If you chose profile https_spiffe, use:
|
||||
```shell
|
||||
-f values-expose-federation-https-spiffe-ingress-nginx.yaml
|
||||
```
|
||||
|
||||
For example:
|
||||
|
||||
```shell
|
||||
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-spiffe-ingress-nginx.yaml
|
||||
```
|
||||
|
||||
See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
|
||||
|
||||
|
||||
@@ -2,7 +2,6 @@ global:
|
||||
spire:
|
||||
clusterName: production
|
||||
trustDomain: production.other
|
||||
jwtIssuer: oidc-discovery.production.other
|
||||
|
||||
spire-server:
|
||||
ca_subject:
|
||||
@@ -10,36 +9,14 @@ spire-server:
|
||||
organization: Production
|
||||
common_name: production.other
|
||||
|
||||
ingress:
|
||||
hosts:
|
||||
- host: spire-server.production.other
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- spire-server.production.other
|
||||
federation:
|
||||
ingress:
|
||||
hosts:
|
||||
- host: spire-server-federation.production.other
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- spire-server-federation.production.other
|
||||
secretName: tls-cert
|
||||
|
||||
spiffe-oidc-discovery-provider:
|
||||
ingress:
|
||||
hosts:
|
||||
- host: oidc-discovery.production.other
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- secretName: tls-cert
|
||||
hosts:
|
||||
- oidc-discovery.production.other
|
||||
# ingress:
|
||||
# host: spire-server
|
||||
# federation:
|
||||
# ingress:
|
||||
# host: spire-server-federation
|
||||
# tlsSecret: tls-cert
|
||||
|
||||
# spiffe-oidc-discovery-provider:
|
||||
# ingress:
|
||||
# host: oidc-discovery
|
||||
# tlsSecret: tls-cert
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
set -xe
|
||||
|
||||
UPGRADE_VERSION=v0.13.0
|
||||
UPGRADE_VERSION=v0.14.0
|
||||
UPGRADE_REPO=https://spiffe.github.io/helm-charts-hardened
|
||||
|
||||
SCRIPT="$(readlink -f "$0")"
|
||||
@@ -48,30 +48,43 @@ teardown() {
|
||||
|
||||
trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
|
||||
|
||||
kubectl create namespace spire-system 2>/dev/null || true
|
||||
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true
|
||||
kubectl create namespace "${ns}" 2>/dev/null || true
|
||||
kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true
|
||||
if [[ -n "$UPGRADE_ARGS" ]]; then
|
||||
pushd "${SCRIPTPATH}"
|
||||
git clone https://github.com/spiffe/helm-charts-hardened "${UPGRADE_VERSION}"
|
||||
pushd "${UPGRADE_VERSION}"
|
||||
git checkout "${UPGRADE_VERSION/v/spire-}"
|
||||
helm install --create-namespace -n spire-system spire-crds charts/spire-crds
|
||||
./examples/production/run-tests.sh -c
|
||||
popd
|
||||
popd
|
||||
# Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.)
|
||||
helm upgrade -n spire-system spire-crds charts/spire-crds --wait
|
||||
else
|
||||
|
||||
"${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \
|
||||
kubectl create namespace spire-system 2>/dev/null || true
|
||||
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true
|
||||
kubectl create namespace "${ns}" 2>/dev/null || true
|
||||
kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true
|
||||
|
||||
"${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \
|
||||
--namespace cert-manager \
|
||||
--create-namespace \
|
||||
--set installCRDs=true \
|
||||
--wait
|
||||
|
||||
kubectl apply -f "${DEPS}/testcert.yaml" -n spire-server
|
||||
kubectl apply -f "${DEPS}/testcert.yaml" -n spire-server
|
||||
|
||||
"${helm_install[@]}" ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \
|
||||
"${helm_install[@]}" ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \
|
||||
--namespace ingress-nginx \
|
||||
--create-namespace \
|
||||
--set controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP \
|
||||
--set controller.ingressClassResource.default=true \
|
||||
--wait
|
||||
|
||||
ip=$(kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ .spec.clusterIP }}')
|
||||
echo "$ip" oidc-discovery.production.other
|
||||
ip=$(kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ .spec.clusterIP }}')
|
||||
echo "$ip" oidc-discovery.production.other
|
||||
|
||||
cat > /tmp/dummydns <<EOF
|
||||
cat > /tmp/dummydns <<EOF
|
||||
spiffe-oidc-discovery-provider:
|
||||
tests:
|
||||
hostAliases:
|
||||
@@ -91,18 +104,21 @@ spire-server:
|
||||
- "spire-server-federation.production.other"
|
||||
EOF
|
||||
|
||||
fi
|
||||
|
||||
install_and_test() {
|
||||
# Can't pass an array to a function. We completely control the string so its safe.
|
||||
# shellcheck disable=SC2086
|
||||
"${helm_install[@]}" spire "$1" \
|
||||
--namespace "${ns}" \
|
||||
--values "${SCRIPTPATH}/values.yaml" \
|
||||
--values "${SCRIPTPATH}/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml" \
|
||||
--values "${SCRIPTPATH}/values-export-spire-server-ingress-nginx.yaml" \
|
||||
--values "${SCRIPTPATH}/values-export-federation-https-web-ingress-nginx.yaml" \
|
||||
--values "${SCRIPTPATH}/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml" \
|
||||
--values "${SCRIPTPATH}/values-expose-spire-server-ingress-nginx.yaml" \
|
||||
--values "${SCRIPTPATH}/values-expose-federation-https-web-ingress-nginx.yaml" \
|
||||
--values /tmp/dummydns \
|
||||
--set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \
|
||||
--set spire-agent.server.address=spire-server.production.other,spire-agent.server.port=443 \
|
||||
--set spire-server.federation.ingress.tlsSecret=tls-cert,spiffe-oidc-discovery-provider.ingress.tlsSecret=tls-cert \
|
||||
--values "${SCRIPTPATH}/example-your-values.yaml" \
|
||||
$2 \
|
||||
--wait
|
||||
@@ -110,23 +126,6 @@ install_and_test() {
|
||||
helm test --namespace "${ns}" spire
|
||||
}
|
||||
|
||||
if [[ -n "$UPGRADE_ARGS" ]]; then
|
||||
install_and_test spire "$UPGRADE_ARGS"
|
||||
|
||||
# Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.)
|
||||
kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
|
||||
helm upgrade --install -n spire-server spire-crds charts/spire-crds
|
||||
fi
|
||||
|
||||
install_and_test charts/spire ""
|
||||
|
||||
if helm get manifest -n spire-server spire | grep -i example; then
|
||||
|
||||
@@ -1,25 +0,0 @@
|
||||
spire-server:
|
||||
federation:
|
||||
enabled: true
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||
|
||||
# Optional settings you may put in your own values.
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
|
||||
# className: nginx
|
||||
|
||||
hosts:
|
||||
- host: spire-server-federation.example.org
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- spire-server-federation.example.org
|
||||
@@ -1,28 +0,0 @@
|
||||
spire-server:
|
||||
tests:
|
||||
tls:
|
||||
enabled: true
|
||||
federation:
|
||||
enabled: true
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
|
||||
# Optional settings you may put in your own values.
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
|
||||
# className: nginx
|
||||
|
||||
hosts:
|
||||
- host: spire-server-federation.example.org
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- spire-server-federation.example.org
|
||||
secretName: spire-server-federation-tls
|
||||
@@ -1,27 +0,0 @@
|
||||
spiffe-oidc-discovery-provider:
|
||||
tests:
|
||||
tls:
|
||||
enabled: true
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
|
||||
# Optional settings you may put in your own values.
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
|
||||
# className: nginx
|
||||
|
||||
# You must override these in your own values file with the appropriate hostname
|
||||
# and secret or it wont start.
|
||||
hosts:
|
||||
- host: oidc-discovery.example.org
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- secretName: tls-cert
|
||||
hosts:
|
||||
- oidc-discovery.example.org
|
||||
@@ -1,25 +0,0 @@
|
||||
spire-server:
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||
|
||||
# Optional settings you may put in your own values.
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
|
||||
# className: nginx
|
||||
|
||||
# You must override these in your own values file with the appropriate hostname
|
||||
# and secret or it wont start.
|
||||
hosts:
|
||||
- host: spire-server.example.org
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- spire-server.example.org
|
||||
@@ -0,0 +1,10 @@
|
||||
spire-server:
|
||||
federation:
|
||||
enabled: true
|
||||
ingress:
|
||||
enabled: true
|
||||
controllerType: ingress-nginx
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||
|
||||
# className: nginx
|
||||
@@ -0,0 +1,13 @@
|
||||
spire-server:
|
||||
tests:
|
||||
tls:
|
||||
enabled: true
|
||||
federation:
|
||||
enabled: true
|
||||
ingress:
|
||||
enabled: true
|
||||
controllerType: ingress-nginx
|
||||
|
||||
# className: nginx
|
||||
|
||||
tlsSecret: spire-server-federation-tls
|
||||
@@ -0,0 +1,12 @@
|
||||
spiffe-oidc-discovery-provider:
|
||||
tests:
|
||||
tls:
|
||||
enabled: true
|
||||
ingress:
|
||||
enabled: true
|
||||
controllerType: ingress-nginx
|
||||
|
||||
# className: nginx
|
||||
|
||||
# You must override these in your own values file with the appropriate secret or it wont start.
|
||||
tlsSecret: tls-cert
|
||||
@@ -0,0 +1,6 @@
|
||||
spire-server:
|
||||
ingress:
|
||||
enabled: true
|
||||
controllerType: ingress-nginx
|
||||
|
||||
# className: nginx
|
||||
@@ -1,6 +1,7 @@
|
||||
# Recommended setup to deploy Tornjak
|
||||
|
||||
> **Warning**: The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production.
|
||||
> [!Warning]
|
||||
> The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production.
|
||||
|
||||
To install Spire with the least privileges possible we deploy spire across 2 namespaces.
|
||||
|
||||
|
||||
@@ -12,9 +12,22 @@ source "${TESTDIR}/common.sh"
|
||||
helm_install=(helm upgrade --install --create-namespace)
|
||||
ns=spire-system
|
||||
|
||||
CLEANUP=1
|
||||
|
||||
for i in "$@"; do
|
||||
case $i in
|
||||
-c)
|
||||
CLEANUP=0
|
||||
shift # past argument=value
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
teardown() {
|
||||
if [ "${CLEANUP}" -eq 1 ]; then
|
||||
helm uninstall --namespace "${ns}" spire 2>/dev/null || true
|
||||
kubectl delete ns "${ns}" 2>/dev/null || true
|
||||
fi
|
||||
}
|
||||
|
||||
trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
|
||||
|
||||
@@ -7,7 +7,6 @@ tornjak-frontend:
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 3000
|
||||
apiServerURL: "http://localhost:10000/"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPTPATH=$(dirname "$0")
|
||||
README_GENERATOR_VERSION="2.5.1"
|
||||
README_GENERATOR_VERSION="2.6.0"
|
||||
README_GENERATOR_EXE="readme-generator"
|
||||
|
||||
if ! hash "${README_GENERATOR_EXE}" 2>/dev/null; then
|
||||
|
||||
@@ -0,0 +1,38 @@
|
||||
# OpenShift notes for K8S developers
|
||||
|
||||
## SecurityContexts
|
||||
|
||||
OpenShift automatically generates uid/gid's for pods. They should not be set to get this behavior.
|
||||
|
||||
## CSIDriver issues
|
||||
|
||||
A workload in a restricted namespace can not access a csidriver that isn't labeled:
|
||||
|
||||
```yaml
|
||||
security.openshift.io/csi-ephemeral-volume-profile: restricted
|
||||
```
|
||||
|
||||
If the CSIDriver doesn't exist, the workload is blocked from being uploaded into the cluster. This runs into ordering issues with helm install as it always loads regular workloads before CSIDriver objects.
|
||||
|
||||
## Pod Security Standard
|
||||
|
||||
Pod Security Standard (PSS) rules are automatically generated on openshift. Details at [https://docs.openshift.com/container-platform/4.13/authentication/understanding-and-managing-pod-security-admission.html](https://docs.openshift.com/container-platform/4.13/authentication/understanding-and-managing-pod-security-admission.html)
|
||||
|
||||
The defaults though are too chatty. It puts audit/warn still at restricted.
|
||||
|
||||
## Ingress
|
||||
|
||||
Ingress objects automatically create Role objects in the same namespace, when the ingress object is viewed as valid by openshift, if not it is ignored. A missing Role object is a sure sign that something is wrong in the Ingress.
|
||||
|
||||
Some things to watch out for.
|
||||
|
||||
When the ingress is annotated:
|
||||
|
||||
```yaml
|
||||
"route.openshift.io/termination": "passthrough"
|
||||
```
|
||||
|
||||
The ingress object can not have a path specified and the pathType needs to be ImplementationSpecific
|
||||
|
||||
Also, unless a secretName is specified, it can not have a tls section.
|
||||
|
||||
+2
-1
@@ -117,7 +117,8 @@ git push -u origin --force-with-lease
|
||||
cat <<EOF | gh pr create --base main --body-file - "${dry_run}"
|
||||
Please review the below changelog to ensure this matches up with the semantic version being applied.
|
||||
|
||||
> **Note**: **Maintainers** ensure to run following after merging this PR to trigger the release workflow:
|
||||
> [!Note]
|
||||
> **Maintainers** ensure to run following after merging this PR to trigger the release workflow:
|
||||
>
|
||||
> \`\`\`shell
|
||||
> git checkout main
|
||||
|
||||
+7
-7
@@ -4,8 +4,8 @@ go 1.20
|
||||
|
||||
require (
|
||||
github.com/onsi/ginkgo/v2 v2.13.0
|
||||
github.com/onsi/gomega v1.28.0
|
||||
helm.sh/helm/v3 v3.13.1
|
||||
github.com/onsi/gomega v1.30.0
|
||||
helm.sh/helm/v3 v3.13.2
|
||||
)
|
||||
|
||||
require (
|
||||
@@ -25,7 +25,7 @@ require (
|
||||
github.com/gogo/protobuf v1.3.2 // indirect
|
||||
github.com/golang/protobuf v1.5.3 // indirect
|
||||
github.com/google/gnostic-models v0.6.8 // indirect
|
||||
github.com/google/go-cmp v0.5.9 // indirect
|
||||
github.com/google/go-cmp v0.6.0 // indirect
|
||||
github.com/google/gofuzz v1.2.0 // indirect
|
||||
github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect
|
||||
github.com/google/uuid v1.3.0 // indirect
|
||||
@@ -45,11 +45,11 @@ require (
|
||||
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
|
||||
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
|
||||
github.com/xeipuuv/gojsonschema v1.2.0 // indirect
|
||||
golang.org/x/crypto v0.13.0 // indirect
|
||||
golang.org/x/net v0.14.0 // indirect
|
||||
golang.org/x/crypto v0.14.0 // indirect
|
||||
golang.org/x/net v0.17.0 // indirect
|
||||
golang.org/x/oauth2 v0.8.0 // indirect
|
||||
golang.org/x/sys v0.12.0 // indirect
|
||||
golang.org/x/term v0.12.0 // indirect
|
||||
golang.org/x/sys v0.13.0 // indirect
|
||||
golang.org/x/term v0.13.0 // indirect
|
||||
golang.org/x/text v0.13.0 // indirect
|
||||
golang.org/x/time v0.3.0 // indirect
|
||||
golang.org/x/tools v0.12.0 // indirect
|
||||
|
||||
+14
-14
@@ -41,8 +41,8 @@ github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiu
|
||||
github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
|
||||
github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
|
||||
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
|
||||
github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
|
||||
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
|
||||
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
|
||||
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
|
||||
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
|
||||
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||
@@ -87,8 +87,8 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq
|
||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
|
||||
github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4=
|
||||
github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o=
|
||||
github.com/onsi/gomega v1.28.0 h1:i2rg/p9n/UqIDAMFUJ6qIUUMcsqOuUHgbpbu235Vr1c=
|
||||
github.com/onsi/gomega v1.28.0/go.mod h1:A1H2JE76sI14WIP57LMKj7FVfCHx3g3BcZVjJG8bjX8=
|
||||
github.com/onsi/gomega v1.30.0 h1:hvMK7xYz4D3HapigLTeGdId/NcfQx1VHMJc60ew99+8=
|
||||
github.com/onsi/gomega v1.30.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
|
||||
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
|
||||
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
||||
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
||||
@@ -127,8 +127,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
|
||||
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
|
||||
golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
|
||||
golang.org/x/crypto v0.13.0 h1:mvySKfSWJ+UKUii46M40LOvyWfN0s2U+46/jDd0e6Ck=
|
||||
golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
|
||||
golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
|
||||
golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
|
||||
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
|
||||
@@ -141,8 +141,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY
|
||||
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
|
||||
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
|
||||
golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
|
||||
golang.org/x/net v0.14.0 h1:BONx9s002vGdD9umnlX1Po8vOZmrgH34qlHcD1MfK14=
|
||||
golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
|
||||
golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
|
||||
golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
|
||||
golang.org/x/oauth2 v0.8.0 h1:6dkIjl3j3LtZ/O3sTgZTMsLKSftL/B8Zgq4huOIIUu8=
|
||||
golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
|
||||
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
@@ -158,13 +158,13 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
|
||||
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
|
||||
golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
|
||||
golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
|
||||
golang.org/x/term v0.12.0 h1:/ZfYdc3zq+q02Rv9vGqTeSItdzZTSNDmfTi0mBAuidU=
|
||||
golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
|
||||
golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
|
||||
golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
|
||||
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
@@ -205,8 +205,8 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C
|
||||
gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
helm.sh/helm/v3 v3.13.1 h1:DG+XLGzBJeZvMLlMbm6bPDLV1dGaVW9eZsDoUd1/LM0=
|
||||
helm.sh/helm/v3 v3.13.1/go.mod h1:TdQRMiq46CSWcc68Hb0uVhvAWusaN90YwAV54cz6JzU=
|
||||
helm.sh/helm/v3 v3.13.2 h1:IcO9NgmmpetJODLZhR3f3q+6zzyXVKlRizKFwbi7K8w=
|
||||
helm.sh/helm/v3 v3.13.2/go.mod h1:GIHDwZggaTGbedevTlrQ6DB++LBN6yuQdeGj0HNaDx0=
|
||||
k8s.io/api v0.28.2 h1:9mpl5mOb6vXZvqbQmankOfPIGiudghwCoLl1EYfUZbw=
|
||||
k8s.io/api v0.28.2/go.mod h1:RVnJBsjU8tcMq7C3iaRSGMeaKt2TWEUXcpIt/90fjEg=
|
||||
k8s.io/apiextensions-apiserver v0.28.2 h1:J6/QRWIKV2/HwBhHRVITMLYoypCoPY1ftigDM0Kn+QU=
|
||||
|
||||
Reference in New Issue
Block a user