From 255106da84b8653aad48bb954be588501780d7ce Mon Sep 17 00:00:00 2001 From: Alan Cha Date: Wed, 2 Jul 2025 17:42:18 -0400 Subject: [PATCH] Update to Tornjak 2.1.0 (#597) * Update to Tornjak 2.1.0 Signed-off-by: Alan Cha * Address comments Signed-off-by: Alan Cha * Fix Tornjak tests Signed-off-by: Alan Cha * revert namespace change Signed-off-by: Alan Cha --------- Signed-off-by: Alan Cha --- charts/spire/charts/spire-server/README.md | 2 +- .../templates/tests/test-tornjak-connection.yaml | 4 ++-- .../charts/spire-server/templates/tornjak-config.yaml | 11 ++++------- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/Chart.yaml | 2 +- examples/tornjak/README.md | 2 +- 6 files changed, 10 insertions(+), 13 deletions(-) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index e2ddab5..fc2f6c3 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -428,7 +428,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` | | `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tornjak.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `""` | -| `tornjak.image.defaultTag` | Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift. | `v1.6.0` | +| `tornjak.image.defaultTag` | Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift. | `v2.1.0` | | `tornjak.service.type` | Type of service resource | `ClusterIP` | | `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` | | `tornjak.service.ports.https` | Secure port for tornjak service | `10443` | diff --git a/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml index c259f12..946a64e 100644 --- a/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml +++ b/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml @@ -17,13 +17,13 @@ spec: - name: curl-tornjak-backend image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} command: ['curl'] - args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.servicename" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.ports.http }}/api/tornjak/serverinfo'] + args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.servicename" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.ports.http }}/api/v1/tornjak/serverinfo'] securityContext: {{- include "spire-lib.securitycontext" . | nindent 8 }} - name: curl-tornjak-backend-and-spire image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} command: ['curl'] - args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.servicename" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.ports.http }}/api/healthcheck'] + args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.servicename" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.ports.http }}/api/v1/spire/healthcheck'] securityContext: {{- include "spire-lib.securitycontext" . | nindent 8 }} restartPolicy: Never diff --git a/charts/spire/charts/spire-server/templates/tornjak-config.yaml b/charts/spire/charts/spire-server/templates/tornjak-config.yaml index ec7b2e6..203e8d3 100644 --- a/charts/spire/charts/spire-server/templates/tornjak-config.yaml +++ b/charts/spire/charts/spire-server/templates/tornjak-config.yaml @@ -10,25 +10,22 @@ data: spire_socket_path = "unix:///tmp/spire-server/private/api.sock" # socket to communicate with SPIRE server {{- if eq (include "spire-tornjak.connectionType" .) "http" }} http { - enabled = true # if true, opens HTTP server port = "10000" # if HTTP enabled, opens HTTP listen port at specified container port } {{- end }} {{- if eq (include "spire-tornjak.connectionType" .) "tls" }} - tls { - enabled = true + https { port = "10443" # container port for TLS connection cert = "/opt/spire/server/tls.crt" # TLS server cert key = "/opt/spire/server/tls.key" # TLS server key } {{- end }} {{- if eq (include "spire-tornjak.connectionType" .) "mtls" }} - mtls { - enabled = true + https { port = "10443" # container port for mTLS connection cert = "/opt/spire/server/tls.crt" # mTLS server cert key = "/opt/spire/server/tls.key" # mTLS server key - ca = "/opt/spire/user/ca.crt" # mTLS user CA + client_ca = "/opt/spire/user/ca.crt" # mTLS user CA } {{- end }} } @@ -43,7 +40,7 @@ data: } {{- end }} {{- if ne .Values.tornjak.config.userManagement.issuer "" }} - UserManagement "KeycloakAuth" { + Authenticator "Keycloak" { plugin_data { issuer = "{{ .Values.tornjak.config.userManagement.issuer }}" audience = "{{ .Values.tornjak.config.userManagement.audience }}" diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 79dceec..b80d2f5 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1047,7 +1047,7 @@ tornjak: repository: spiffe/tornjak-backend pullPolicy: IfNotPresent tag: "" - defaultTag: "v1.6.0" + defaultTag: "v2.1.0" service: ## @param tornjak.service.type Type of service resource diff --git a/charts/spire/charts/tornjak-frontend/Chart.yaml b/charts/spire/charts/tornjak-frontend/Chart.yaml index 2d67db3..31dbe0e 100644 --- a/charts/spire/charts/tornjak-frontend/Chart.yaml +++ b/charts/spire/charts/tornjak-frontend/Chart.yaml @@ -3,7 +3,7 @@ name: tornjak-frontend description: A Helm chart to deploy Tornjak frontend type: application version: 0.1.0 -appVersion: "v1.6.0" +appVersion: "v2.1.0" home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: - https://github.com/spiffe/tornjak diff --git a/examples/tornjak/README.md b/examples/tornjak/README.md index 32a74e2..4f3be3f 100644 --- a/examples/tornjak/README.md +++ b/examples/tornjak/README.md @@ -29,7 +29,7 @@ helm upgrade --install -n spire-mgmt spire spire \ --render-subchart-notes # test the Tornjak deployment -helm test spire -n spire-server +helm test spire -n spire-mgmt ``` Port forward the Tornjak backend (APIs) and Tornjak frontend (UI) services. Execute these commands in separate consoles.