panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update to Tornjak 2.1.0 (#597)

Browse Source 
* Update to Tornjak 2.1.0

Signed-off-by: Alan Cha <[email protected]>

* Address comments

Signed-off-by: Alan Cha <[email protected]>

* Fix Tornjak tests

Signed-off-by: Alan Cha <[email protected]>

* revert namespace change

Signed-off-by: Alan Cha <[email protected]>

---------

Signed-off-by: Alan Cha <[email protected]>
This commit is contained in:
Alan Cha
2025-07-02 14:42:18 -07:00
committed by GitHub
parent f37d681bc2
commit 255106da84
6 changed files with 10 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+1 -1
View File
@@ -428,7 +428,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` | | `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tornjak.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `""` | | `tornjak.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `""` |
| `tornjak.image.defaultTag` | Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift. | `v1.6.0` | | `tornjak.image.defaultTag` | Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift. | `v2.1.0` |
| `tornjak.service.type` | Type of service resource | `ClusterIP` | | `tornjak.service.type` | Type of service resource | `ClusterIP` |
| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` | | `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` |
| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` | | `tornjak.service.ports.https` | Secure port for tornjak service | `10443` |
charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
+2 -2
View File
@@ -17,13 +17,13 @@ spec:
- name: curl-tornjak-backend - name: curl-tornjak-backend
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
command: ['curl'] command: ['curl']
args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.servicename" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.ports.http }}/api/tornjak/serverinfo'] args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.servicename" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.ports.http }}/api/v1/tornjak/serverinfo']
securityContext: securityContext:
{{- include "spire-lib.securitycontext" . | nindent 8 }} {{- include "spire-lib.securitycontext" . | nindent 8 }}
- name: curl-tornjak-backend-and-spire - name: curl-tornjak-backend-and-spire
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
command: ['curl'] command: ['curl']
args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.servicename" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.ports.http }}/api/healthcheck'] args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.servicename" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.ports.http }}/api/v1/spire/healthcheck']
securityContext: securityContext:
{{- include "spire-lib.securitycontext" . | nindent 8 }} {{- include "spire-lib.securitycontext" . | nindent 8 }}
restartPolicy: Never restartPolicy: Never
charts/spire/charts/spire-server/templates/tornjak-config.yaml
+4 -7
View File
@@ -10,25 +10,22 @@ data:
spire_socket_path = "unix:///tmp/spire-server/private/api.sock" # socket to communicate with SPIRE server spire_socket_path = "unix:///tmp/spire-server/private/api.sock" # socket to communicate with SPIRE server
{{- if eq (include "spire-tornjak.connectionType" .) "http" }} {{- if eq (include "spire-tornjak.connectionType" .) "http" }}
http { http {
enabled = true # if true, opens HTTP server
port = "10000" # if HTTP enabled, opens HTTP listen port at specified container port port = "10000" # if HTTP enabled, opens HTTP listen port at specified container port
} }
{{- end }} {{- end }}
{{- if eq (include "spire-tornjak.connectionType" .) "tls" }} {{- if eq (include "spire-tornjak.connectionType" .) "tls" }}
tls { https {
enabled = true
port = "10443" # container port for TLS connection port = "10443" # container port for TLS connection
cert = "/opt/spire/server/tls.crt" # TLS server cert cert = "/opt/spire/server/tls.crt" # TLS server cert
key = "/opt/spire/server/tls.key" # TLS server key key = "/opt/spire/server/tls.key" # TLS server key
} }
{{- end }} {{- end }}
{{- if eq (include "spire-tornjak.connectionType" .) "mtls" }} {{- if eq (include "spire-tornjak.connectionType" .) "mtls" }}
mtls { https {
enabled = true
port = "10443" # container port for mTLS connection port = "10443" # container port for mTLS connection
cert = "/opt/spire/server/tls.crt" # mTLS server cert cert = "/opt/spire/server/tls.crt" # mTLS server cert
key = "/opt/spire/server/tls.key" # mTLS server key key = "/opt/spire/server/tls.key" # mTLS server key
ca = "/opt/spire/user/ca.crt" # mTLS user CA client_ca = "/opt/spire/user/ca.crt" # mTLS user CA
} }
{{- end }} {{- end }}
} }
@@ -43,7 +40,7 @@ data:
} }
{{- end }} {{- end }}
{{- if ne .Values.tornjak.config.userManagement.issuer "" }} {{- if ne .Values.tornjak.config.userManagement.issuer "" }}
UserManagement "KeycloakAuth" { Authenticator "Keycloak" {
plugin_data { plugin_data {
issuer = "{{ .Values.tornjak.config.userManagement.issuer }}" issuer = "{{ .Values.tornjak.config.userManagement.issuer }}"
audience = "{{ .Values.tornjak.config.userManagement.audience }}" audience = "{{ .Values.tornjak.config.userManagement.audience }}"
charts/spire/charts/spire-server/values.yaml
+1 -1
View File
@@ -1047,7 +1047,7 @@ tornjak:
repository: spiffe/tornjak-backend repository: spiffe/tornjak-backend
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: "" tag: ""
defaultTag: "v1.6.0" defaultTag: "v2.1.0"
service: service:
## @param tornjak.service.type Type of service resource ## @param tornjak.service.type Type of service resource
charts/spire/charts/tornjak-frontend/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: tornjak-frontend
description: A Helm chart to deploy Tornjak frontend description: A Helm chart to deploy Tornjak frontend
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "v1.6.0" appVersion: "v2.1.0"
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
- https://github.com/spiffe/tornjak - https://github.com/spiffe/tornjak
examples/tornjak/README.md
+1 -1
View File
@@ -29,7 +29,7 @@ helm upgrade --install -n spire-mgmt spire spire \
--render-subchart-notes --render-subchart-notes
# test the Tornjak deployment # test the Tornjak deployment
helm test spire -n spire-server helm test spire -n spire-mgmt
``` ```
Port forward the Tornjak backend (APIs) and Tornjak frontend (UI) services. Execute these commands in separate consoles. Port forward the Tornjak backend (APIs) and Tornjak frontend (UI) services. Execute these commands in separate consoles.