From a6bdb4d1e71935950c2216c1342b0fdf72835982 Mon Sep 17 00:00:00 2001 From: Kevin Fox Date: Thu, 25 May 2023 06:20:52 -0700 Subject: [PATCH 01/38] Add persistence type flag This patch adds a type flag to the persistence settings to enable specifying the backing volume's type. Signed-off-by: Kevin Fox --- charts/spire/README.md | 2 ++ charts/spire/charts/spire-server/README.md | 2 ++ .../charts/spire-server/templates/statefulset.yaml | 14 ++++++++++++++ charts/spire/charts/spire-server/values.yaml | 4 ++++ 4 files changed, 22 insertions(+) diff --git a/charts/spire/README.md b/charts/spire/README.md index 8a0e83a..4c24570 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -372,8 +372,10 @@ Now you can interact with the Spire agent socket from your own application. The | spire-server.nodeSelector | object | `{}` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | | spire-server.notifier.k8sbundle.namespace | string | `""` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | | spire-server.persistence.accessMode | string | `"ReadWriteOnce"` | | +| spire-server.persistence.hostPath | string | `""` | Which path to use on the host when type = hostPath | | spire-server.persistence.size | string | `"1Gi"` | | | spire-server.persistence.storageClass | string | `nil` | | +| spire-server.persistence.type | string | `"pvc"` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | | spire-server.podAnnotations | object | `{}` | | | spire-server.podSecurityContext | object | `{}` | | | spire-server.readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe | diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index f0208c3..bc5da26 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -172,8 +172,10 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | nodeSelector | object | `{}` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | | notifier.k8sbundle.namespace | string | `""` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | | persistence.accessMode | string | `"ReadWriteOnce"` | | +| persistence.hostPath | string | `""` | Which path to use on the host when type = hostPath | | persistence.size | string | `"1Gi"` | | | persistence.storageClass | string | `nil` | | +| persistence.type | string | `"pvc"` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | | podAnnotations | object | `{}` | | | podSecurityContext | object | `{}` | | | readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe | diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 4a5e148..99523af 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -3,6 +3,9 @@ {{- $configSum3 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }} {{- $configSumTornjak := (include (print $.Template.BasePath "/tornjak-config.yaml") . | sha256sum) }} {{- $fullname := include "spire-server.fullname" . }} +{{- if not (has .Values.persistence.type (list "pvc" "hostPath" "emptyDir")) }} +{{- fail "persistence.type must be one of [\"pvc\", \"hostPath\", \"emptyDir\"]" }} +{{- end }} apiVersion: apps/v1 kind: StatefulSet metadata: @@ -285,6 +288,16 @@ spec: {{- if gt (len .Values.extraVolumes) 0 }} {{- toYaml .Values.extraVolumes | nindent 8 }} {{- end }} + {{- if eq .Values.persistence.type "emptyDir" }} + - name: spire-data + emptyDir: {} + {{- else if eq .Values.persistence.type "hostPath" }} + - name: spire-data + hostPath: + path: {{ .Values.persistence.hostPath }} + type: Directory + {{- end }} + {{- if eq .Values.persistence.type "pvc" }} volumeClaimTemplates: - metadata: name: spire-data @@ -297,3 +310,4 @@ spec: {{- if .Values.persistence.storageClass }} storageClassName: {{ .Values.persistence.storageClass }} {{- end }} + {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 3472027..f2843c9 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -101,9 +101,13 @@ readinessProbe: periodSeconds: 5 persistence: + # -- What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) + type: pvc size: 1Gi accessMode: ReadWriteOnce storageClass: null + # -- Which path to use on the host when type = hostPath + hostPath: "" dataStore: sql: From b85ba64dea2bd83b3bab63e9943cb110fa968eba Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 20 Jul 2023 07:29:08 -0700 Subject: [PATCH 02/38] Bump helm/kind-action from 1.7.0 to 1.8.0 (#396) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/helm-chart-ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index f573bc9..12b3150 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -229,7 +229,7 @@ jobs: python-version: ${{ env.PYTHON_VERSION }} - name: Create kind cluster - uses: helm/kind-action@v1.7.0 + uses: helm/kind-action@v1.8.0 # Only build a kind cluster if there are chart changes to test. with: version: ${{ env.KIND_VERSION }} From 7ce67c624c0c8a664e66b208e87aae5ca300e5c4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 20 Jul 2023 07:30:54 -0700 Subject: [PATCH 03/38] Bump actions/checkout from 3.5.2 to 3.5.3 (#395) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/helm-chart-ci.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index 12b3150..e60087f 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -184,7 +184,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3.5.2 + uses: actions/checkout@v3.5.3 - id: set-matrix name: Collect all examples @@ -216,7 +216,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3.5.2 + uses: actions/checkout@v3.5.3 - name: Set up Helm uses: azure/setup-helm@v3.5 From 624ca9cc4992f36cd695cf76cbae4a81fb374ee3 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 20 Jul 2023 15:28:32 -0700 Subject: [PATCH 04/38] Remove misadded lockfile (#400) --- charts/spire/Chart.lock | 18 ------------------ 1 file changed, 18 deletions(-) delete mode 100644 charts/spire/Chart.lock diff --git a/charts/spire/Chart.lock b/charts/spire/Chart.lock deleted file mode 100644 index 88436fe..0000000 --- a/charts/spire/Chart.lock +++ /dev/null @@ -1,18 +0,0 @@ -dependencies: -- name: spire-server - repository: file://./charts/spire-server - version: 0.1.0 -- name: spire-agent - repository: file://./charts/spire-agent - version: 0.1.0 -- name: spiffe-csi-driver - repository: file://./charts/spiffe-csi-driver - version: 0.1.0 -- name: spiffe-oidc-discovery-provider - repository: file://./charts/spiffe-oidc-discovery-provider - version: 0.1.0 -- name: tornjak-frontend - repository: file://./charts/tornjak-frontend - version: 0.1.0 -digest: sha256:0119361a3dd54d1cf088f299ce9adbee55a96c832cb675f57e5e115acf7b17c7 -generated: "2023-07-19T19:13:59.722106+02:00" From 9a6768bca149e3470645899c5afd68bee028fbe1 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Thu, 27 Jul 2023 10:27:57 -0700 Subject: [PATCH 05/38] Add support for disabling container selectors (#399) --- charts/spire/README.md | 1 + charts/spire/charts/spire-agent/README.md | 1 + charts/spire/charts/spire-agent/templates/configmap.yaml | 1 + charts/spire/charts/spire-agent/values.yaml | 2 ++ 4 files changed, 5 insertions(+) diff --git a/charts/spire/README.md b/charts/spire/README.md index 217c8c4..224c379 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -283,6 +283,7 @@ Now you can interact with the Spire agent socket from your own application. The | spire-agent.waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag | | spire-agent.waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | spire-agent.waitForIt.resources | object | `{}` | | +| spire-agent.workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio | | spire-agent.workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped | | spire-agent.workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor | | spire-server.affinity | object | `{}` | | diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index fc4e18e..ce418ef 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -85,6 +85,7 @@ A Helm chart to install the SPIRE agent. | waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag | | waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | waitForIt.resources | object | `{}` | | +| workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio | | workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped | | workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index aa545fc..9adfcc7 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -30,6 +30,7 @@ plugins: # Minikube does not have a cert in the cluster CA bundle that # can authenticate the kubelet cert, so skip validation. skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }} + disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }} {{- if .Values.workloadAttestors.unix.enabled }} - unix: diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 9653d91..06b0bae 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -137,6 +137,8 @@ workloadAttestors: k8s: # -- If true, kubelet certificate verification is skipped skipKubeletVerification: true + # -- Set to true if using holdApplicationUntilProxyStarts in Istio + disableContainerSelectors: false telemetry: prometheus: From af13f1fc643d2b355c3e00fc978fd9ca35953e99 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 27 Jul 2023 11:20:48 -0700 Subject: [PATCH 06/38] Bump test chart dependencies (#401) Bump the Helm charts used in test scenarios to latest available versions. Signed-off-by: GitHub Co-authored-by: marcofranssen Co-authored-by: kfox1111 --- .github/tests/charts.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 9fabf85..e75f434 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "48.1.1" + "version": "48.1.2" }, { "name": "cert-manager", @@ -17,11 +17,11 @@ { "name": "mysql", "repo": "https://charts.bitnami.com/bitnami", - "version": "9.10.6" + "version": "9.10.8" }, { "name": "postgresql", "repo": "https://charts.bitnami.com/bitnami", - "version": "12.6.6" + "version": "12.6.8" } ] From 9f4d4ace845930a12003b7b8418723ff7d1ef88f Mon Sep 17 00:00:00 2001 From: Petr McAllister Date: Thu, 27 Jul 2023 14:27:51 -0700 Subject: [PATCH 07/38] Add aws_pca to the spire-server (#404) This change allows aws_pca to be configured via values of this chart. __Requires 1.7.1 version__ per [bug](https://github.com/spiffe/spire/issues/4351) - this will not work until 1.7.1 is released. --------- Signed-off-by: Petr McAllister Signed-off-by: Petr McAllister Signed-off-by: Kevin Fox Co-authored-by: Marco Franssen Co-authored-by: kfox1111 --- charts/spire/README.md | 8 +++++++ charts/spire/charts/spire-server/README.md | 8 +++++++ .../spire-server/templates/configmap.yaml | 24 +++++++++++++++++++ charts/spire/charts/spire-server/values.yaml | 19 +++++++++++++++ 4 files changed, 59 insertions(+) diff --git a/charts/spire/README.md b/charts/spire/README.md index 224c379..0cc9830 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -421,6 +421,14 @@ Now you can interact with the Spire agent socket from your own application. The | spire-server.tornjak.startupProbe.successThreshold | int | `1` | | | spire-server.tornjak.startupProbe.timeoutSeconds | int | `5` | | | spire-server.trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers | +| spire-server.upstreamAuthority.awsPCA.assumeRoleARN | Optional | `""` | ARN of an IAM role to assume | +| spire-server.upstreamAuthority.awsPCA.caSigningTemplateARN | string | `""` | See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. | +| spire-server.upstreamAuthority.awsPCA.certificateAuthorityARN | string | `""` | ARN of the "upstream" CA certificate | +| spire-server.upstreamAuthority.awsPCA.enabled | bool | `false` | | +| spire-server.upstreamAuthority.awsPCA.endpoint | string | `""` | See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | +| spire-server.upstreamAuthority.awsPCA.region | string | `""` | AWS Region to use | +| spire-server.upstreamAuthority.awsPCA.signingAlgorithm | string | `""` | See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | +| spire-server.upstreamAuthority.awsPCA.supplementalBundlePath | Optional | `""` | Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | | spire-server.upstreamAuthority.certManager.ca.create | bool | `false` | Creates a Cert-Manager CA | | spire-server.upstreamAuthority.certManager.ca.duration | string | `"87600h"` | Duration of the CA. Defaults to 10 years. | | spire-server.upstreamAuthority.certManager.ca.privateKey.algorithm | string | `"ECDSA"` | | diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index bc5da26..d86c34d 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -220,6 +220,14 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | tornjak.startupProbe.successThreshold | int | `1` | | | tornjak.startupProbe.timeoutSeconds | int | `5` | | | trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers | +| upstreamAuthority.awsPCA.assumeRoleARN | Optional | `""` | ARN of an IAM role to assume | +| upstreamAuthority.awsPCA.caSigningTemplateARN | string | `""` | See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. | +| upstreamAuthority.awsPCA.certificateAuthorityARN | string | `""` | ARN of the "upstream" CA certificate | +| upstreamAuthority.awsPCA.enabled | bool | `false` | | +| upstreamAuthority.awsPCA.endpoint | string | `""` | See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | +| upstreamAuthority.awsPCA.region | string | `""` | AWS Region to use | +| upstreamAuthority.awsPCA.signingAlgorithm | string | `""` | See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | +| upstreamAuthority.awsPCA.supplementalBundlePath | Optional | `""` | Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | | upstreamAuthority.certManager.ca.create | bool | `false` | Creates a Cert-Manager CA | | upstreamAuthority.certManager.ca.duration | string | `"87600h"` | Duration of the CA. Defaults to 10 years. | | upstreamAuthority.certManager.ca.privateKey.algorithm | string | `"ECDSA"` | | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 431adb3..231486a 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -99,6 +99,30 @@ plugins: workload_api_socket: "/run/spire/upstream_agent/spire-agent.sock" {{- end }} {{- end }} + + {{- with .Values.upstreamAuthority.awsPCA }} + {{- if eq (.enabled | toString) "true" }} + {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }} + UpstreamAuthority: + - aws_pca: + plugin_data: + region: {{ .region | quote }} + certificate_authority_arn: {{ .certificateAuthorityARN | quote }} + ca_signing_template_arn: {{ .caSigningTemplateARN | default "arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen0/V1" | quote }} + {{- if ne .signingAlgorithm "" }} + signing_algorithm: {{ .signingAlgorithm | quote }} + {{- end }} + {{- if ne .assumeRoleARN "" }} + assume_role_arn: {{ .assumeRoleARN | quote }} + {{- end }} + {{- if ne .endpoint "" }} + endpoint: {{ .endpoint | quote }} + {{- end }} + {{- if ne .supplementalBundlePath "" }} + supplemental_bundle_path: {{ .supplementalBundlePath | quote }} + {{- end }} + {{- end }} + {{- end }} {{- if gt $upstreamAuthorityUsed 1 }} {{- fail "You can only enable a single Upstream Authority." }} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index f2843c9..2c4039b 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -188,6 +188,25 @@ upstreamAuthority: certificate: "" key: "" bundle: "" + awsPCA: + enabled: false + # -- AWS Region to use + region: "" + # -- ARN of the "upstream" CA certificate + certificateAuthorityARN: "" + # -- (Optional) ARN of an IAM role to assume + assumeRoleARN: "" + # -- (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. + # -- See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. + caSigningTemplateARN: "" + # -- (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. + # -- See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. + signingAlgorithm: "" + # -- (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. + # -- See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. + endpoint: "" + # -- (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. + supplementalBundlePath: "" certManager: enabled: false rbac: From 7d94b105ab900b6c6207b9f13a976db47cde20f7 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Fri, 28 Jul 2023 14:01:26 -0700 Subject: [PATCH 08/38] Update spire to 1.7.1 (#412) Signed-off-by: Kevin Fox --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml | 2 +- charts/spire/charts/spiffe-oidc-discovery-provider/README.md | 2 +- charts/spire/charts/spire-agent/Chart.yaml | 2 +- charts/spire/charts/spire-agent/README.md | 2 +- charts/spire/charts/spire-server/Chart.yaml | 2 +- charts/spire/charts/spire-server/README.md | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 46a2532..2558687 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -4,7 +4,7 @@ description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application version: 0.11.0 -appVersion: "1.7.0" +appVersion: "1.7.1" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index 0cc9830..219ab87 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -2,7 +2,7 @@ -![Version: 0.11.0](https://img.shields.io/badge/Version-0.11.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) +![Version: 0.11.0](https://img.shields.io/badge/Version-0.11.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml index 5bd5c3e..6b572f6 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml @@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider description: A Helm chart to install the SPIFFE OIDC discovery provider. type: application version: 0.1.0 -appVersion: "1.7.0" +appVersion: "1.7.1" keywords: ["spiffe", "oidc"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index a4b0917..b23bc23 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -2,7 +2,7 @@ -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) A Helm chart to install the SPIFFE OIDC discovery provider. diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml index 5b585f3..71fbc93 100644 --- a/charts/spire/charts/spire-agent/Chart.yaml +++ b/charts/spire/charts/spire-agent/Chart.yaml @@ -3,7 +3,7 @@ name: spire-agent description: A Helm chart to install the SPIRE agent. type: application version: 0.1.0 -appVersion: "1.7.0" +appVersion: "1.7.1" keywords: ["spiffe", "spire-agent"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index ce418ef..76ffe7f 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -2,7 +2,7 @@ -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) A Helm chart to install the SPIRE agent. diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml index 39460ad..219d6ea 100644 --- a/charts/spire/charts/spire-server/Chart.yaml +++ b/charts/spire/charts/spire-server/Chart.yaml @@ -3,7 +3,7 @@ name: spire-server description: A Helm chart to install the SPIRE server. type: application version: 0.1.0 -appVersion: "1.7.0" +appVersion: "1.7.1" keywords: ["spiffe", "spire-server", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index d86c34d..b97982e 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -2,7 +2,7 @@ -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) A Helm chart to install the SPIRE server. From a09e054d04cd68fcf3090c35ffba5d3d09d80683 Mon Sep 17 00:00:00 2001 From: Drew Wells Date: Mon, 31 Jul 2023 12:54:01 -0500 Subject: [PATCH 09/38] support annotations so oidc can be annotated (#391) Signed-off-by: Drew Wells Signed-off-by: Drew Wells Co-authored-by: Faisal Memon --- charts/spire/README.md | 1 + charts/spire/charts/spiffe-oidc-discovery-provider/README.md | 1 + .../spiffe-oidc-discovery-provider/templates/deployment.yaml | 4 ++++ .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 3 +++ 4 files changed, 9 insertions(+) diff --git a/charts/spire/README.md b/charts/spire/README.md index 219ab87..0defba2 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -156,6 +156,7 @@ Now you can interact with the Spire agent socket from your own application. The | spiffe-csi-driver.tolerations | list | `[]` | | | spiffe-oidc-discovery-provider.affinity | object | `{}` | | | spiffe-oidc-discovery-provider.agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket | +| spiffe-oidc-discovery-provider.annotations | object | `{}` | Annotations for the deployment | | spiffe-oidc-discovery-provider.autoscaling.enabled | bool | `false` | | | spiffe-oidc-discovery-provider.autoscaling.maxReplicas | int | `5` | | | spiffe-oidc-discovery-provider.autoscaling.minReplicas | int | `1` | | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index b23bc23..e477695 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -31,6 +31,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. |-----|------|---------|-------------| | affinity | object | `{}` | | | agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket | +| annotations | object | `{}` | Annotations for the deployment | | autoscaling.enabled | bool | `false` | | | autoscaling.maxReplicas | int | `5` | | | autoscaling.minReplicas | int | `1` | | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml index 4110a83..b5aaa90 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -6,6 +6,10 @@ metadata: namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }} labels: {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} + annotations: + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} spec: {{- if not .Values.autoscaling.enabled }} replicas: {{ .Values.replicaCount }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 07d683a..02d5cc6 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -12,6 +12,9 @@ replicaCount: 1 namespaceOverride: "" +# -- Annotations for the deployment +annotations: {} + image: # -- The OCI registry to pull the image from registry: ghcr.io From a2e5c36cc99eb2b9993df4bd8f668a7bfa681ea8 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 31 Jul 2023 18:00:20 +0000 Subject: [PATCH 10/38] Bump test chart dependencies (#416) Bump the Helm charts used in test scenarios to latest available versions. Signed-off-by: GitHub Co-authored-by: marcofranssen --- .github/tests/charts.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index e75f434..f8fe753 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,12 +2,12 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "48.1.2" + "version": "48.2.2" }, { "name": "cert-manager", "repo": "https://charts.jetstack.io", - "version": "v1.12.2" + "version": "v1.12.3" }, { "name": "ingress-nginx", @@ -17,11 +17,11 @@ { "name": "mysql", "repo": "https://charts.bitnami.com/bitnami", - "version": "9.10.8" + "version": "9.10.9" }, { "name": "postgresql", "repo": "https://charts.bitnami.com/bitnami", - "version": "12.6.8" + "version": "12.7.1" } ] From d2e1606286a19b79f0c22069da08dcb8b6da4e10 Mon Sep 17 00:00:00 2001 From: Drew Wells Date: Wed, 2 Aug 2023 16:22:59 -0500 Subject: [PATCH 11/38] issuer naming should respect issuer_name override (#378) align the spire-server configmap and issuer CR naming --------- Signed-off-by: Drew Wells Signed-off-by: Faisal Memon Co-authored-by: Faisal Memon --- charts/spire/charts/spire-server/templates/configmap.yaml | 2 +- charts/spire/charts/spire-server/templates/issuer.yaml | 7 ++++--- .../spire/charts/spire-server/templates/statefulset.yaml | 2 +- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 231486a..f751e82 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -78,7 +78,7 @@ plugins: UpstreamAuthority: - cert-manager: plugin_data: - issuer_name: {{ default (include "spire-server.fullname" $root) .issuer_name }} + issuer_name: {{ default (include "spire-server.fullname" $root) .issuer_name }}-ca issuer_kind: {{ .issuer_kind | quote }} issuer_group: {{ .issuer_group | quote }} namespace: {{ default $root.Release.Namespace .namespace | quote }} diff --git a/charts/spire/charts/spire-server/templates/issuer.yaml b/charts/spire/charts/spire-server/templates/issuer.yaml index 4ce6c25..1a9afbd 100644 --- a/charts/spire/charts/spire-server/templates/issuer.yaml +++ b/charts/spire/charts/spire-server/templates/issuer.yaml @@ -1,12 +1,13 @@ {{- with .Values.upstreamAuthority.certManager }} {{ if and .enabled .ca.create }} +{{ $issuerName := printf "%s-selfsigned" (default (include "spire-server.fullname" $) .issuer_name) }} {{/* Configuring CA Issuer: https://cert-manager.io/docs/configuration/ca/ */}} apiVersion: cert-manager.io/v1 kind: Issuer metadata: - name: {{ include "spire-server.fullname" $ }}-selfsigned + name: {{ $issuerName }} namespace: {{ include "spire-server.namespace" $ }} labels: {{- include "spire-server.labels" $ | nindent 4}} @@ -38,14 +39,14 @@ spec: renewBefore: {{ . }} {{- end }} issuerRef: - name: {{ include "spire-server.fullname" $ }}-selfsigned + name: {{ $issuerName }} kind: Issuer group: cert-manager.io --- apiVersion: cert-manager.io/v1 kind: Issuer metadata: - name: {{ include "spire-server.fullname" $ }} + name: {{ include "spire-server.fullname" $ }}-ca namespace: {{ include "spire-server.namespace" $ }} spec: ca: diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 99523af..f8cfd71 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -58,7 +58,7 @@ spec: - --timeout=3m - --for=condition=ready - issuer - - {{ include "spire-server.fullname" $ }} + - {{ include "spire-server.fullname" $ }}-ca imagePullPolicy: {{ .Values.tools.kubectl.image.pullPolicy }} {{- end }} {{- if gt (len .Values.initContainers) 0 }} From 1e3039ccb94d141138bd5851292d456b57fd0c76 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Thu, 3 Aug 2023 09:12:03 -0700 Subject: [PATCH 12/38] Bump spire Helm Chart version from 0.11.0 to 0.11.1 (#419) Please review the below changelog to ensure this matches up with the semantic version being applied. **Note**: As this is a patch release we will make a cherry-picked release using a followup PR targetering the release branch. Will cherrypick the following commits into this patch release + the commit bumping this version number. **Changes in this release** * d2e1606 issuer naming should respect issuer_name override (#378) * a09e054 support annotations so oidc can be annotated (#391) * 7d94b10 Update spire to 1.7.1 (#412) * 9a6768b Add support for disabling container selectors (#399) * 624ca9c Remove misadded lockfile (#400) Signed-off-by: Faisal Memon --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 2558687..c21d945 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -3,7 +3,7 @@ name: spire description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.11.0 +version: 0.11.1 appVersion: "1.7.1" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire diff --git a/charts/spire/README.md b/charts/spire/README.md index 0defba2..ff09e53 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -2,7 +2,7 @@ -![Version: 0.11.0](https://img.shields.io/badge/Version-0.11.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) +![Version: 0.11.1](https://img.shields.io/badge/Version-0.11.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. From 7a6e4f8d75aff9b257308f7b858824c5373bf6d0 Mon Sep 17 00:00:00 2001 From: Mariusz Sabath Date: Wed, 9 Aug 2023 10:46:08 -0400 Subject: [PATCH 13/38] Change Tornjak backend default port (#436) --- charts/spire/README.md | 2 +- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/templates/NOTES.txt | 2 +- .../spire/charts/spire-server/templates/statefulset.yaml | 4 ++-- .../charts/spire-server/templates/tornjak-config.yaml | 2 +- charts/spire/charts/spire-server/values.yaml | 8 ++++---- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/README.md.gotmpl | 2 +- 8 files changed, 12 insertions(+), 12 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index ff09e53..079062d 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -414,7 +414,7 @@ Now you can interact with the Spire agent socket from your own application. The | spire-server.tornjak.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | spire-server.tornjak.resources | object | `{}` | | | spire-server.tornjak.service.annotations | object | `{}` | | -| spire-server.tornjak.service.ports | object | `{"http":10080,"https":10443}` | Ports for tornjak | +| spire-server.tornjak.service.ports | object | `{"http":10000,"https":10443}` | Ports for tornjak | | spire-server.tornjak.service.type | string | `"ClusterIP"` | | | spire-server.tornjak.startupProbe.failureThreshold | int | `3` | | | spire-server.tornjak.startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for | diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index b97982e..a46079b 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -212,7 +212,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | tornjak.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | tornjak.resources | object | `{}` | | | tornjak.service.annotations | object | `{}` | | -| tornjak.service.ports | object | `{"http":10080,"https":10443}` | Ports for tornjak | +| tornjak.service.ports | object | `{"http":10000,"https":10443}` | Ports for tornjak | | tornjak.service.type | string | `"ClusterIP"` | | | tornjak.startupProbe.failureThreshold | int | `3` | | | tornjak.startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for | diff --git a/charts/spire/charts/spire-server/templates/NOTES.txt b/charts/spire/charts/spire-server/templates/NOTES.txt index 8de0ce2..1b3053b 100644 --- a/charts/spire/charts/spire-server/templates/NOTES.txt +++ b/charts/spire/charts/spire-server/templates/NOTES.txt @@ -15,7 +15,7 @@ Tornjak runs without authentication and is therefore NOT suitable to run in prod Only use in test environments! Access Tornjak: - kubectl -n {{ include "spire-server.namespace" . }} port-forward service/{{ include "spire-tornjak.servicename" . }} {{ .Values.tornjak.service.ports.http }}:10080 + kubectl -n {{ include "spire-server.namespace" . }} port-forward service/{{ include "spire-tornjak.servicename" . }} {{ .Values.tornjak.service.ports.http }}:10000 {{- if eq (include "spire-tornjak.connectionType" .) "http" }} Open browser to: http://localhost:{{ .Values.tornjak.service.ports.http }} {{- else if eq (include "spire-tornjak.connectionType" .) "tls" }} diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index f8cfd71..c92c4eb 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -183,7 +183,7 @@ spec: httpGet: scheme: HTTP path: /api/tornjak/serverinfo - port: 10080 + port: 10000 {{- toYaml .Values.tornjak.startupProbe | nindent 12 }} {{- end }} args: @@ -193,7 +193,7 @@ spec: - /run/spire/tornjak-config/server.conf ports: - name: tornjak-http - containerPort: 10080 + containerPort: 10000 protocol: TCP - name: tornjak-https containerPort: 10443 diff --git a/charts/spire/charts/spire-server/templates/tornjak-config.yaml b/charts/spire/charts/spire-server/templates/tornjak-config.yaml index 3f86455..f187e47 100644 --- a/charts/spire/charts/spire-server/templates/tornjak-config.yaml +++ b/charts/spire/charts/spire-server/templates/tornjak-config.yaml @@ -11,7 +11,7 @@ data: {{- if eq (include "spire-tornjak.connectionType" .) "http" }} http { enabled = true # if true, opens HTTP server - port = "10080" # if HTTP enabled, opens HTTP listen port at specified container port + port = "10000" # if HTTP enabled, opens HTTP listen port at specified container port } {{- end }} {{- if eq (include "spire-tornjak.connectionType" .) "tls" }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 2c4039b..0db2ea8 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -196,13 +196,13 @@ upstreamAuthority: certificateAuthorityARN: "" # -- (Optional) ARN of an IAM role to assume assumeRoleARN: "" - # -- (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. + # -- (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. # -- See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. caSigningTemplateARN: "" - # -- (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. + # -- (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. # -- See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. signingAlgorithm: "" - # -- (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. + # -- (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. # -- See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. endpoint: "" # -- (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. @@ -387,7 +387,7 @@ tornjak: type: ClusterIP # -- Ports for tornjak ports: - http: 10080 + http: 10000 https: 10443 annotations: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 45aba9a..1105e4c 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -34,7 +34,7 @@ This chart requires access to Tornjak Backend (`tornjakFrontend.apiServerURL`). This URL needs to be reachable from your web browser and can therefore not be a cluster internal URL. Obtain the URL for Tornjak APIs. If deployed in the same cluster, locally, -Tornjak APIs are typically available at `http://localhost:10080`. +Tornjak APIs are typically available at `http://localhost:10000`. Review Tornjak documentation for more details. ## Usage diff --git a/charts/spire/charts/tornjak-frontend/README.md.gotmpl b/charts/spire/charts/tornjak-frontend/README.md.gotmpl index 5e1d258..c980a92 100644 --- a/charts/spire/charts/tornjak-frontend/README.md.gotmpl +++ b/charts/spire/charts/tornjak-frontend/README.md.gotmpl @@ -36,7 +36,7 @@ This chart requires access to Tornjak Backend (`tornjakFrontend.apiServerURL`). This URL needs to be reachable from your web browser and can therefore not be a cluster internal URL. Obtain the URL for Tornjak APIs. If deployed in the same cluster, locally, -Tornjak APIs are typically available at `http://localhost:10080`. +Tornjak APIs are typically available at `http://localhost:10000`. Review Tornjak documentation for more details. ## Usage From bfec27ef6723d3f8a4d46d8a1459f82a772d9274 Mon Sep 17 00:00:00 2001 From: Drew Wells Date: Wed, 9 Aug 2023 09:53:21 -0500 Subject: [PATCH 14/38] Fix jwtIssuer to allow for Uris including scheme (#425) --- charts/spire/README.md | 6 +++--- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 2 +- .../spiffe-oidc-discovery-provider/templates/configmap.yaml | 3 ++- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 2 +- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/values.yaml | 2 +- 7 files changed, 10 insertions(+), 9 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 079062d..555aa9e 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -112,7 +112,7 @@ Now you can interact with the Spire agent socket from your own application. The | global.spire.bundleConfigMap | string | `""` | Override all instances of bundleConfigMap | | global.spire.clusterName | string | `"example-cluster"` | | | global.spire.image.registry | string | `""` | Override all Spire image registries at once | -| global.spire.jwtIssuer | string | `"oidc-discovery.example.org"` | Set the jwt issuer | +| global.spire.jwtIssuer | string | `"https://oidc-discovery.example.org"` | Set the jwt issuer | | global.spire.trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers | | spiffe-csi-driver.enabled | bool | `true` | Enables deployment of CSI driver | | spiffe-oidc-discovery-provider.enabled | bool | `false` | Enables deployment of OIDC discovery provider | @@ -191,7 +191,7 @@ Now you can interact with the Spire agent socket from your own application. The | spiffe-oidc-discovery-provider.insecureScheme.nginx.image.tag | string | `"1.24.0-alpine"` | Overrides the image tag | | spiffe-oidc-discovery-provider.insecureScheme.nginx.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | spiffe-oidc-discovery-provider.insecureScheme.nginx.resources | object | `{}` | | -| spiffe-oidc-discovery-provider.jwtIssuer | string | `"oidc-discovery.example.org"` | | +| spiffe-oidc-discovery-provider.jwtIssuer | string | `"https://oidc-discovery.example.org"` | | | spiffe-oidc-discovery-provider.livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe | | spiffe-oidc-discovery-provider.livenessProbe.periodSeconds | int | `5` | Period seconds for livenessProbe | | spiffe-oidc-discovery-provider.nameOverride | string | `""` | | @@ -361,7 +361,7 @@ Now you can interact with the Spire agent socket from your own application. The | spire-server.ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | | | spire-server.ingress.tls | list | `[]` | | | spire-server.initContainers | list | `[]` | | -| spire-server.jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain | +| spire-server.jwtIssuer | string | `"https://oidc-discovery.example.org"` | The JWT issuer domain | | spire-server.livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe | | spire-server.livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe | | spire-server.livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index e477695..5f1a57c 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -66,7 +66,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | insecureScheme.nginx.image.tag | string | `"1.24.0-alpine"` | Overrides the image tag | | insecureScheme.nginx.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | insecureScheme.nginx.resources | object | `{}` | | -| jwtIssuer | string | `"oidc-discovery.example.org"` | | +| jwtIssuer | string | `"https://oidc-discovery.example.org"` | | | livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe | | livenessProbe.periodSeconds | int | `5` | Period seconds for livenessProbe | | nameOverride | string | `""` | | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml index 4c219e9..5fc7e70 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml @@ -8,7 +8,8 @@ domains: - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}" - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}" - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}" - {{- $jwtIssuer := include "spire-lib.jwt-issuer" . }} + {{- $uri := urlParse (include "spire-lib.jwt-issuer" .) }} + {{- $jwtIssuer := (default $uri.path $uri.host) }} {{- uniq (concat (list $jwtIssuer) .Values.config.additionalDomains) | toYaml | nindent 2 }} {{- if .Values.insecureScheme.enabled }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 02d5cc6..c722bba 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -107,7 +107,7 @@ insecureScheme: # cpu: 100m # memory: 64Mi -jwtIssuer: oidc-discovery.example.org +jwtIssuer: https://oidc-discovery.example.org config: # -- The log level, valid values are "debug", "info", "warn", and "error" diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index a46079b..b86ff5a 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -159,7 +159,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | | | ingress.tls | list | `[]` | | | initContainers | list | `[]` | | -| jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain | +| jwtIssuer | string | `"https://oidc-discovery.example.org"` | The JWT issuer domain | | livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe | | livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe | | livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 0db2ea8..72f1388 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -132,7 +132,7 @@ dataStore: # -- The log level, valid values are "debug", "info", "warn", and "error" logLevel: info # -- The JWT issuer domain -jwtIssuer: oidc-discovery.example.org +jwtIssuer: https://oidc-discovery.example.org # -- Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) clusterName: example-cluster diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 11b7fe0..78f3321 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -9,7 +9,7 @@ global: # -- The trust domain to be used for the SPIFFE identifiers trustDomain: example.org # -- Set the jwt issuer - jwtIssuer: oidc-discovery.example.org + jwtIssuer: https://oidc-discovery.example.org # -- Override all instances of bundleConfigMap bundleConfigMap: "" From e774584c468a94d3c458fbda48daff9266375baf Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 9 Aug 2023 15:11:47 +0000 Subject: [PATCH 15/38] Bump test chart dependencies (#426) Co-authored-by: marcofranssen --- .github/tests/charts.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index f8fe753..049a076 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "48.2.2" + "version": "48.3.1" }, { "name": "cert-manager", @@ -17,11 +17,11 @@ { "name": "mysql", "repo": "https://charts.bitnami.com/bitnami", - "version": "9.10.9" + "version": "9.10.10" }, { "name": "postgresql", "repo": "https://charts.bitnami.com/bitnami", - "version": "12.7.1" + "version": "12.8.0" } ] From a167ce68901a2b08d44367aa3a6da7612a64afc6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 9 Aug 2023 15:06:48 +0000 Subject: [PATCH 16/38] Bump actions/setup-go from 4.0.1 to 4.1.0 Bumps [actions/setup-go](https://github.com/actions/setup-go) from 4.0.1 to 4.1.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/v4.0.1...v4.1.0) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/helm-chart-ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index e60087f..57a1ede 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -73,7 +73,7 @@ jobs: fi - name: Setup Go - uses: actions/setup-go@v4.0.1 + uses: actions/setup-go@v4.1.0 with: go-version-file: tests/go.mod cache-dependency-path: tests/go.sum From e60f5287e04f3def30d1194bb2c741081230ebfc Mon Sep 17 00:00:00 2001 From: grameshtwilio <83727765+grameshtwilio@users.noreply.github.com> Date: Sat, 12 Aug 2023 11:55:40 -0700 Subject: [PATCH 17/38] option to set KeyManager memory in spire server (#444) --- charts/spire/README.md | 2 ++ charts/spire/charts/spire-server/README.md | 2 ++ .../spire-server/templates/configmap.yaml | 19 +++++++++++++++++++ charts/spire/charts/spire-server/values.yaml | 6 ++++++ 4 files changed, 29 insertions(+) diff --git a/charts/spire/README.md b/charts/spire/README.md index 555aa9e..dd2fdce 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -362,6 +362,8 @@ Now you can interact with the Spire agent socket from your own application. The | spire-server.ingress.tls | list | `[]` | | | spire-server.initContainers | list | `[]` | | | spire-server.jwtIssuer | string | `"https://oidc-discovery.example.org"` | The JWT issuer domain | +| spire-server.keyManager.disk.enabled | bool | `true` | | +| spire-server.keyManager.memory.enabled | bool | `false` | | | spire-server.livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe | | spire-server.livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe | | spire-server.livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe | diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index b86ff5a..f3aed43 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -160,6 +160,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | ingress.tls | list | `[]` | | | initContainers | list | `[]` | | | jwtIssuer | string | `"https://oidc-discovery.example.org"` | The JWT issuer domain | +| keyManager.disk.enabled | bool | `true` | | +| keyManager.memory.enabled | bool | `false` | | | livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe | | livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe | | livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index f751e82..59987ec 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -1,5 +1,6 @@ {{- define "spire-server.yaml-config" -}} {{- $upstreamAuthorityUsed := 0 }} +{{- $keyManagerUsed := 0 }} {{- $root := . }} server: bind_address: "0.0.0.0" @@ -47,10 +48,28 @@ plugins: {{- end }} {{- end }} + {{- with .Values.keyManager.disk }} + {{- if eq (.enabled | toString) "true" }} + {{- $keyManagerUsed = add1 $keyManagerUsed }} KeyManager: - disk: plugin_data: keys_path: "/run/spire/data/keys.json" + {{- end }} + {{- end }} + + {{- with .Values.keyManager.memory }} + {{- if eq (.enabled | toString) "true" }} + {{- $keyManagerUsed = add1 $keyManagerUsed }} + KeyManager: + - memory: + plugin_data: + {{- end }} + {{- end }} + +{{- if gt $keyManagerUsed 1 }} +{{- fail "You can only enable a single KeyManager" }} +{{- end }} Notifier: - k8sbundle: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 72f1388..3dacef8 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -175,6 +175,12 @@ ca_subject: organization: Example common_name: example.org +keyManager: + disk: + enabled: true + memory: + enabled: false + upstreamAuthority: disk: enabled: false From a52818a72e4697374e59515b09108eaae73af853 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Tue, 15 Aug 2023 09:42:51 -0700 Subject: [PATCH 18/38] Add a FAQ and switch rare issue from README to it (#437) fixes https://github.com/spiffe/helm-charts/issues/433 closes #385 --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Marco Franssen Co-authored-by: Faisal Memon --- FAQ.md | 50 +++++++++++++++++++++++++++++++++++ charts/spire/README.md | 25 ++---------------- charts/spire/README.md.gotmpl | 25 ++---------------- 3 files changed, 54 insertions(+), 46 deletions(-) create mode 100644 FAQ.md diff --git a/FAQ.md b/FAQ.md new file mode 100644 index 0000000..61d5b56 --- /dev/null +++ b/FAQ.md @@ -0,0 +1,50 @@ +# Frequently Asked Questions + +- [Pods are stuck terminating after uninstall. How do I fix it?](#pods-are-stuck-terminating-after-uninstall-how-do-i-fix-it) +- [Uninstall is stuck. How do I fix it?](#uninstall-is-stuck-how-do-i-fix-it) +- [The PSAT plugin is not working](#the-psat-plugin-is-not-working) + +## Pods are stuck terminating after uninstall. How do I fix it? + +If you uninstall the SPIRE chart before all users of the CSI driver are removed, Pods will get stuck in a terminating state waiting for the driver, that no longer is installed, to unmount the volumes for the Pod. In order to fix this, reinstall the chart and remove all affected workloads that are not part of the SPIRE helm chart itself, before attempting to remove SPIRE again. + +You can discover Pods that use the driver with the following command: +``` +kubectl get pods --all-namespaces -o go-template='{{range .items}}{{$nn := printf "%s %s" .metadata.namespace .metadata.name}}{{range .spec.volumes}}{{if .csi.driver}}{{if eq .csi.driver "csi.spiffe.io"}}{{printf "%s\n" $nn}}{{end}}{{end}}{{end}}{{end}}' +``` + +## Uninstall is stuck. How do I fix it? + +If you uninstall the SPIFFE CSI driver manually before removing the chart, Pods can still be using the driver and are unable to unmount the CSI volume. + +To resolve, reinstall the chart before trying to remove it again. + +## The PSAT plugin is not working + +The chart requires `Projected Service Account Tokens` which has to be enabled on your Kubernetes API server. In most cases this is already done for you. + +> **Note**: This is enabled by default with newer versions as shown by the existence of: +> +> - --service-account-issuer +> - --service-account-key-file +> - --service-account-signing-key-file + +See [Service Account Token Volume Projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) in the Kubernetes docs for more details. + +To enable Projected Service Account Tokens on Docker for Mac/Windows run the following +command to SSH into the Docker Desktop K8s VM. + +```bash +docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh +``` +Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml` +```yaml +spec: + containers: + - command: + - kube-apiserver + - --api-audiences=api,spire-server + - --service-account-issuer=api,spire-agent + - --service-account-key-file=/run/config/pki/sa.pub + - --service-account-signing-key-file=/run/config/pki/sa.key +``` diff --git a/charts/spire/README.md b/charts/spire/README.md index dd2fdce..c7018a7 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -23,29 +23,8 @@ A Helm chart for deploying the complete Spire stack including: spire-server, spi > **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. -## Prerequisites - -Please note this chart requires `Projected Service Account Tokens` which has to be enabled on your k8s api server. - -To enable Projected Service Account Tokens on Docker for Mac/Windows run the following -command to SSH into the Docker Desktop K8s VM. - -```bash -docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh -``` - -Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml` - -```yaml -spec: - containers: - - command: - - kube-apiserver - - --api-audiences=api,spire-server - - --service-account-issuer=api,spire-agent - - --service-account-key-file=/run/config/pki/sa.pub - - --service-account-signing-key-file=/run/config/pki/sa.key -``` +## FAQ +For any issues see our [FAQ](../../FAQ.md)… ## Usage diff --git a/charts/spire/README.md.gotmpl b/charts/spire/README.md.gotmpl index 3e85623..5939f32 100644 --- a/charts/spire/README.md.gotmpl +++ b/charts/spire/README.md.gotmpl @@ -25,29 +25,8 @@ > **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. -## Prerequisites - -Please note this chart requires `Projected Service Account Tokens` which has to be enabled on your k8s api server. - -To enable Projected Service Account Tokens on Docker for Mac/Windows run the following -command to SSH into the Docker Desktop K8s VM. - -```bash -docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh -``` - -Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml` - -```yaml -spec: - containers: - - command: - - kube-apiserver - - --api-audiences=api,spire-server - - --service-account-issuer=api,spire-agent - - --service-account-key-file=/run/config/pki/sa.pub - - --service-account-signing-key-file=/run/config/pki/sa.key -``` +## FAQ +For any issues see our [FAQ](../../FAQ.md)… ## Usage From bd393e9597ebfbad9dfc6c51ba7a502118055f0c Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 15 Aug 2023 17:55:19 +0000 Subject: [PATCH 19/38] Bump test chart dependencies (#445) Bump the Helm charts used in test scenarios to latest available versions. Signed-off-by: GitHub Co-authored-by: marcofranssen --- .github/tests/charts.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 049a076..455c028 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -22,6 +22,6 @@ { "name": "postgresql", "repo": "https://charts.bitnami.com/bitnami", - "version": "12.8.0" + "version": "12.8.2" } ] From 48a2898016cc96b4a91fc98015c622aec8869c32 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Wed, 16 Aug 2023 07:22:09 -0700 Subject: [PATCH 20/38] Fix chainguard image references as per issue 442 (#443) --- charts/spire/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 2 +- charts/spire/charts/spire-agent/README.md | 4 ++-- charts/spire/charts/spire-agent/values.yaml | 4 ++-- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index c7018a7..f03afd2 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -216,7 +216,7 @@ Now you can interact with the Spire agent socket from your own application. The | spire-agent.fsGroupFix.image.pullPolicy | string | `"Always"` | The image pull policy | | spire-agent.fsGroupFix.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from | | spire-agent.fsGroupFix.image.repository | string | `"chainguard/bash"` | The repository within the registry | -| spire-agent.fsGroupFix.image.tag | string | `"5.2.15"` | Overrides the image tag | +| spire-agent.fsGroupFix.image.tag | string | `"latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4"` | Overrides the image tag | | spire-agent.fsGroupFix.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | spire-agent.fsGroupFix.resources | object | `{}` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | | spire-agent.fullnameOverride | string | `""` | | @@ -260,7 +260,7 @@ Now you can interact with the Spire agent socket from your own application. The | spire-agent.waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | | spire-agent.waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from | | spire-agent.waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry | -| spire-agent.waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag | +| spire-agent.waitForIt.image.tag | string | `"latest@sha256:deeaccb164a67a4d7f585c4d416641b1f422c029911a29d72beae28221f823df"` | Overrides the image tag | | spire-agent.waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | spire-agent.waitForIt.resources | object | `{}` | | | spire-agent.workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index c722bba..88f4d11 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -219,7 +219,7 @@ tests: # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" # -- Overrides the image tag - tag: 5.2.15 + tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4 tools: kubectl: diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 76ffe7f..d07f0d0 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -38,7 +38,7 @@ A Helm chart to install the SPIRE agent. | fsGroupFix.image.pullPolicy | string | `"Always"` | The image pull policy | | fsGroupFix.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from | | fsGroupFix.image.repository | string | `"chainguard/bash"` | The repository within the registry | -| fsGroupFix.image.tag | string | `"5.2.15"` | Overrides the image tag | +| fsGroupFix.image.tag | string | `"latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4"` | Overrides the image tag | | fsGroupFix.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | fsGroupFix.resources | object | `{}` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | | fullnameOverride | string | `""` | | @@ -82,7 +82,7 @@ A Helm chart to install the SPIRE agent. | waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | | waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from | | waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry | -| waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag | +| waitForIt.image.tag | string | `"latest@sha256:deeaccb164a67a4d7f585c4d416641b1f422c029911a29d72beae28221f823df"` | Overrides the image tag | | waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | waitForIt.resources | object | `{}` | | | workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 06b0bae..167c73d 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -108,7 +108,7 @@ waitForIt: # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" # -- Overrides the image tag - tag: latest-20230517 + tag: latest@sha256:deeaccb164a67a4d7f585c4d416641b1f422c029911a29d72beae28221f823df resources: {} # When running as non root, needed to ensure the socket path has the correct permissions. @@ -124,7 +124,7 @@ fsGroupFix: # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" # -- Overrides the image tag - tag: 5.2.15 + tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4 # -- Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 3dacef8..695750b 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -453,4 +453,4 @@ tests: # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" # -- Overrides the image tag - tag: 5.2.15 + tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4 diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 7edc633..e947e7b 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -105,4 +105,4 @@ tests: # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" # -- Overrides the image tag - tag: 5.2.15 + tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4 From 0124f633e8678d98310c4f741afb6b33467f190f Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Wed, 16 Aug 2023 07:23:32 -0700 Subject: [PATCH 21/38] Bypass example-test for docs only changes (#449) --- .github/workflows/helm-chart-ci-ignore.yaml | 37 +++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/.github/workflows/helm-chart-ci-ignore.yaml b/.github/workflows/helm-chart-ci-ignore.yaml index 2ae017e..1269466 100644 --- a/.github/workflows/helm-chart-ci-ignore.yaml +++ b/.github/workflows/helm-chart-ci-ignore.yaml @@ -36,3 +36,40 @@ jobs: steps: - run: 'echo "Skipping tests"' + + build-matrix: + name: Build matrix + runs-on: ubuntu-22.04 + + steps: + - name: Checkout + uses: actions/checkout@v3.5.3 + + - id: set-matrix + name: Collect all examples + run: | + examples="$(find examples -maxdepth 2 -type f -name run-tests.sh | xargs -I % dirname %)" + examples_json="$(echo "$examples" | jq -c --slurp --raw-input 'split("\n") | map(select(. != ""))')" + echo "${examples_json}" + echo "examples=$examples_json" >>"$GITHUB_OUTPUT" + + outputs: + examples: ${{ steps.set-matrix.outputs.examples }} + + example-test: + runs-on: ubuntu-22.04 + + needs: + - build-matrix + + strategy: + matrix: + k8s: + - v1.27.2 + - v1.26.4 + - v1.25.9 + example: + - ${{ fromJson(needs.build-matrix.outputs.examples) }} + + steps: + - run: 'echo "Skipping example-test"' From f40743d48408ebc536c9135c09594f0848296caf Mon Sep 17 00:00:00 2001 From: Mariusz Sabath Date: Wed, 16 Aug 2023 10:27:27 -0400 Subject: [PATCH 22/38] Improve Tornjak documentation (#439) --- examples/tornjak/README.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/examples/tornjak/README.md b/examples/tornjak/README.md index 4108c3b..913ccc8 100644 --- a/examples/tornjak/README.md +++ b/examples/tornjak/README.md @@ -15,7 +15,7 @@ helm upgrade --install --namespace spire-server \ --values ../production/values.yaml \ --values ./values.yaml \ --render-subchart-notes \ - spire charts/spire + spire ../../charts/spire # test the Tornjak deployment helm test spire -n spire-server @@ -27,8 +27,13 @@ To access Tornjak you will have to use port-forwarding for the time being *(unti Run following commands from your shell, if you ran with different values your namespace might differ. Consult the install notes printed when running above `helm upgrade` command in that case. +Since `port-forward` is a blocking command, execute them in two different consoles: + ```shell kubectl -n spire-server port-forward service/spire-tornjak-backend 10000:10000 +``` + +```shell kubectl -n spire-server port-forward service/spire-tornjak-frontend 3000:3000 ``` From ae8941c49d7e9d73d64c5ba9a3d914ee133e9572 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Wed, 16 Aug 2023 07:35:41 -0700 Subject: [PATCH 23/38] Support Nested Spire with External Agent (#117) --- .../spire-root-server-values.yaml | 18 +++ charts/spire/Chart.yaml | 10 ++ charts/spire/README.md | 105 ++++++++++++++++++ .../charts/spire-agent/templates/_helpers.tpl | 4 +- charts/spire/charts/spire-agent/values.yaml | 3 + charts/spire/charts/spire-server/README.md | 1 + .../spire-server/templates/_helpers.tpl | 8 ++ .../spire-server/templates/configmap.yaml | 2 +- .../templates/pre-delete-hook.yaml | 90 +++++++++++++++ .../spire-server/templates/statefulset.yaml | 14 +++ .../templates/tests/test-connection.yaml | 1 + .../tests/test-tornjak-connection.yaml | 1 + charts/spire/charts/spire-server/values.yaml | 1 + charts/spire/values.yaml | 28 +++++ examples/nested/run-tests.sh | 53 +++++++++ examples/nested/values.yaml | 22 ++++ examples/production/values.yaml | 23 ++++ project/issues_due_to_nesting.md | 1 + 18 files changed, 383 insertions(+), 2 deletions(-) create mode 100644 .github/tests/dependencies/spire-root-server-values.yaml create mode 100644 charts/spire/charts/spire-server/templates/pre-delete-hook.yaml create mode 100755 examples/nested/run-tests.sh create mode 100644 examples/nested/values.yaml create mode 100644 project/issues_due_to_nesting.md diff --git a/.github/tests/dependencies/spire-root-server-values.yaml b/.github/tests/dependencies/spire-root-server-values.yaml new file mode 100644 index 0000000..02ef8cf --- /dev/null +++ b/.github/tests/dependencies/spire-root-server-values.yaml @@ -0,0 +1,18 @@ +spire-server: + controllerManager: + enabled: false + nodeAttestor: + k8sPsat: + serviceAccountAllowList: + - spire-system:spire-agent-upstream + bundleConfigMap: spire-bundle-upstream + notifier: + k8sbundle: + namespace: spire-system + +spire-agent: + enabled: false + +spiffe-csi-driver: + enabled: false + diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index c21d945..8ab9381 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -30,10 +30,20 @@ dependencies: condition: spire-agent.enabled repository: file://./charts/spire-agent version: 0.1.0 + - name: spire-agent + alias: upstream-spire-agent + condition: upstream.enabled + repository: file://./charts/spire-agent + version: 0.1.0 - name: spiffe-csi-driver condition: spiffe-csi-driver.enabled repository: file://./charts/spiffe-csi-driver version: 0.1.0 + - name: spiffe-csi-driver + alias: upstream-spiffe-csi-driver + condition: upstream.enabled + repository: file://./charts/spiffe-csi-driver + version: 0.1.0 - name: spiffe-oidc-discovery-provider condition: spiffe-oidc-discovery-provider.enabled repository: file://./charts/spiffe-oidc-discovery-provider diff --git a/charts/spire/README.md b/charts/spire/README.md index f03afd2..6d0800b 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -78,8 +78,10 @@ Now you can interact with the Spire agent socket from your own application. The | Repository | Name | Version | |------------|------|---------| | file://./charts/spiffe-csi-driver | spiffe-csi-driver | 0.1.0 | +| file://./charts/spiffe-csi-driver | upstream-spiffe-csi-driver(spiffe-csi-driver) | 0.1.0 | | file://./charts/spiffe-oidc-discovery-provider | spiffe-oidc-discovery-provider | 0.1.0 | | file://./charts/spire-agent | spire-agent | 0.1.0 | +| file://./charts/spire-agent | upstream-spire-agent(spire-agent) | 0.1.0 | | file://./charts/spire-server | spire-server | 0.1.0 | | file://./charts/tornjak-frontend | tornjak-frontend | 0.1.0 | @@ -93,6 +95,7 @@ Now you can interact with the Spire agent socket from your own application. The | global.spire.image.registry | string | `""` | Override all Spire image registries at once | | global.spire.jwtIssuer | string | `"https://oidc-discovery.example.org"` | Set the jwt issuer | | global.spire.trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers | +| global.spire.upstreamServerAddress | string | `""` | Set what address to use for the upstream server when using nested spire | | spiffe-csi-driver.enabled | bool | `true` | Enables deployment of CSI driver | | spiffe-oidc-discovery-provider.enabled | bool | `false` | Enables deployment of OIDC discovery provider | | spire-agent.enabled | bool | `true` | Enables deployment of SPIRE Agent(s) | @@ -101,6 +104,16 @@ Now you can interact with the Spire agent socket from your own application. The | spire-server.enabled | bool | `true` | Enables deployment of SPIRE Server | | spire-server.nameOverride | string | `"server"` | | | tornjak-frontend.enabled | bool | `false` | Enables deployment of Tornjak frontend/UI (Not for production) | +| upstream-spiffe-csi-driver.agentSocketPath | string | `"/run/spire/agent-sockets-upstream/spire-agent.sock"` | | +| upstream-spiffe-csi-driver.healthChecks.port | int | `9810` | | +| upstream-spiffe-csi-driver.pluginName | string | `"upstream.csi.spiffe.io"` | | +| upstream-spire-agent.bundleConfigMap | string | `"spire-bundle-upstream"` | | +| upstream-spire-agent.healthChecks.port | int | `9981` | | +| upstream-spire-agent.nameOverride | string | `"agent-upstream"` | | +| upstream-spire-agent.serviceAccount.name | string | `"spire-agent-upstream"` | | +| upstream-spire-agent.socketPath | string | `"/run/spire/agent-sockets-upstream/spire-agent.sock"` | | +| upstream-spire-agent.telemetry.prometheus.port | int | `9989` | | +| upstream.enabled | bool | `false` | enable upstream agent and driver for use with nested spire. | | spiffe-csi-driver.agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent | | spiffe-csi-driver.fullnameOverride | string | `""` | | | spiffe-csi-driver.healthChecks.port | int | `9809` | | @@ -431,6 +444,7 @@ Now you can interact with the Spire agent socket from your own application. The | spire-server.upstreamAuthority.spire.enabled | bool | `false` | | | spire-server.upstreamAuthority.spire.server.address | string | `""` | | | spire-server.upstreamAuthority.spire.server.port | int | `8081` | | +| spire-server.upstreamAuthority.spire.upstreamDriver | string | `""` | | | tornjak-frontend.affinity | object | `{}` | | | tornjak-frontend.apiServerURL | string | `"http://localhost:10000/"` | URL of the Tornjak APIs (backend) Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. | | tornjak-frontend.fullnameOverride | string | `""` | | @@ -461,5 +475,96 @@ Now you can interact with the Spire agent socket from your own application. The | tornjak-frontend.startupProbe.timeoutSeconds | int | `5` | Timeout seconds for startupProbe | | tornjak-frontend.tolerations | list | `[]` | | | tornjak-frontend.topologySpreadConstraints | list | `[]` | | +| upstream-spiffe-csi-driver.agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent | +| upstream-spiffe-csi-driver.fullnameOverride | string | `""` | | +| upstream-spiffe-csi-driver.healthChecks.port | int | `9809` | | +| upstream-spiffe-csi-driver.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| upstream-spiffe-csi-driver.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | +| upstream-spiffe-csi-driver.image.repository | string | `"spiffe/spiffe-csi-driver"` | The repository within the registry | +| upstream-spiffe-csi-driver.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion | +| upstream-spiffe-csi-driver.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | +| upstream-spiffe-csi-driver.imagePullSecrets | list | `[]` | | +| upstream-spiffe-csi-driver.kubeletPath | string | `"/var/lib/kubelet"` | | +| upstream-spiffe-csi-driver.livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe | +| upstream-spiffe-csi-driver.livenessProbe.timeoutSeconds | int | `5` | Timeout value in seconds for livenessProbe | +| upstream-spiffe-csi-driver.nameOverride | string | `""` | | +| upstream-spiffe-csi-driver.namespaceOverride | string | `""` | | +| upstream-spiffe-csi-driver.nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| upstream-spiffe-csi-driver.nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | The OCI registry to pull the image from | +| upstream-spiffe-csi-driver.nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | The repository within the registry | +| upstream-spiffe-csi-driver.nodeDriverRegistrar.image.tag | string | `"v2.8.0"` | Overrides the image tag | +| upstream-spiffe-csi-driver.nodeDriverRegistrar.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | +| upstream-spiffe-csi-driver.nodeDriverRegistrar.resources | object | `{}` | | +| upstream-spiffe-csi-driver.nodeSelector | object | `{}` | | +| upstream-spiffe-csi-driver.pluginName | string | `"csi.spiffe.io"` | Set the csi driver name deployed to Kubernetes. | +| upstream-spiffe-csi-driver.podAnnotations | object | `{}` | | +| upstream-spiffe-csi-driver.podSecurityContext | object | `{}` | | +| upstream-spiffe-csi-driver.priorityClassName | string | `""` | Priority class assigned to daemonset pods | +| upstream-spiffe-csi-driver.resources | object | `{}` | | +| upstream-spiffe-csi-driver.securityContext.privileged | bool | `true` | | +| upstream-spiffe-csi-driver.securityContext.readOnlyRootFilesystem | bool | `true` | | +| upstream-spiffe-csi-driver.serviceAccount.annotations | object | `{}` | Annotations to add to the service account | +| upstream-spiffe-csi-driver.serviceAccount.create | bool | `true` | Specifies whether a service account should be created | +| upstream-spiffe-csi-driver.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | +| upstream-spiffe-csi-driver.tolerations | list | `[]` | | +| upstream-spire-agent.bundleConfigMap | string | `"spire-bundle"` | | +| upstream-spire-agent.clusterName | string | `"example-cluster"` | | +| upstream-spire-agent.configMap.annotations | object | `{}` | Annotations to add to the SPIRE Agent ConfigMap | +| upstream-spire-agent.extraContainers | list | `[]` | | +| upstream-spire-agent.extraVolumeMounts | list | `[]` | | +| upstream-spire-agent.extraVolumes | list | `[]` | | +| upstream-spire-agent.fsGroupFix.image.pullPolicy | string | `"Always"` | The image pull policy | +| upstream-spire-agent.fsGroupFix.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from | +| upstream-spire-agent.fsGroupFix.image.repository | string | `"chainguard/bash"` | The repository within the registry | +| upstream-spire-agent.fsGroupFix.image.tag | string | `"5.2.15"` | Overrides the image tag | +| upstream-spire-agent.fsGroupFix.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | +| upstream-spire-agent.fsGroupFix.resources | object | `{}` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | +| upstream-spire-agent.fullnameOverride | string | `""` | | +| upstream-spire-agent.healthChecks.port | int | `9980` | override the host port used for health checking | +| upstream-spire-agent.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| upstream-spire-agent.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | +| upstream-spire-agent.image.repository | string | `"spiffe/spire-agent"` | The repository within the registry | +| upstream-spire-agent.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. | +| upstream-spire-agent.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | +| upstream-spire-agent.imagePullSecrets | list | `[]` | | +| upstream-spire-agent.initContainers | list | `[]` | | +| upstream-spire-agent.livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe | +| upstream-spire-agent.livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe | +| upstream-spire-agent.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" | +| upstream-spire-agent.nameOverride | string | `""` | | +| upstream-spire-agent.namespaceOverride | string | `""` | | +| upstream-spire-agent.nodeSelector | object | `{}` | | +| upstream-spire-agent.podAnnotations | object | `{}` | | +| upstream-spire-agent.podSecurityContext | object | `{}` | | +| upstream-spire-agent.priorityClassName | string | `""` | Priority class assigned to daemonset pods | +| upstream-spire-agent.readinessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for readinessProbe | +| upstream-spire-agent.readinessProbe.periodSeconds | int | `60` | Period seconds for readinessProbe | +| upstream-spire-agent.resources | object | `{}` | | +| upstream-spire-agent.securityContext | object | `{}` | | +| upstream-spire-agent.server.address | string | `""` | | +| upstream-spire-agent.server.namespaceOverride | string | `""` | | +| upstream-spire-agent.server.port | int | `8081` | | +| upstream-spire-agent.serviceAccount.annotations | object | `{}` | Annotations to add to the service account | +| upstream-spire-agent.serviceAccount.create | bool | `true` | Specifies whether a service account should be created | +| upstream-spire-agent.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | +| upstream-spire-agent.socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent | +| upstream-spire-agent.telemetry.prometheus.enabled | bool | `false` | | +| upstream-spire-agent.telemetry.prometheus.podMonitor.enabled | bool | `false` | | +| upstream-spire-agent.telemetry.prometheus.podMonitor.labels | object | `{}` | | +| upstream-spire-agent.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | +| upstream-spire-agent.telemetry.prometheus.port | int | `9988` | | +| upstream-spire-agent.tolerations | list | `[]` | | +| upstream-spire-agent.trustBundleFormat | string | `"pem"` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | +| upstream-spire-agent.trustBundleURL | string | `""` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | +| upstream-spire-agent.trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers | +| upstream-spire-agent.waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| upstream-spire-agent.waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from | +| upstream-spire-agent.waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry | +| upstream-spire-agent.waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag | +| upstream-spire-agent.waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | +| upstream-spire-agent.waitForIt.resources | object | `{}` | | +| upstream-spire-agent.workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio | +| upstream-spire-agent.workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped | +| upstream-spire-agent.workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor | ---------------------------------------------- diff --git a/charts/spire/charts/spire-agent/templates/_helpers.tpl b/charts/spire/charts/spire-agent/templates/_helpers.tpl index 4fa7ee7..a28e1db 100644 --- a/charts/spire/charts/spire-agent/templates/_helpers.tpl +++ b/charts/spire/charts/spire-agent/templates/_helpers.tpl @@ -91,7 +91,9 @@ Create the name of the service account to use {{- end }} {{- define "spire-agent.server-address" }} -{{- if .Values.server.address }} +{{- if and (ne (len (dig "spire" "upstreamSpireAddress" "" .Values.global)) 0) .Values.upstream }} +{{- print .Values.global.spire.upstreamSpireAddress }} +{{- else if .Values.server.address }} {{- .Values.server.address }} {{- else }} {{ .Release.Name }}-server.{{ include "spire-agent.server.namespace" . }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 167c73d..a444759 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -76,6 +76,9 @@ trustBundleURL: "" trustBundleFormat: pem bundleConfigMap: spire-bundle +# @ignored +upstream: false + server: address: "" port: 8081 diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index f3aed43..f659994 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -250,5 +250,6 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | upstreamAuthority.spire.enabled | bool | `false` | | | upstreamAuthority.spire.server.address | string | `""` | | | upstreamAuthority.spire.server.port | int | `8081` | | +| upstreamAuthority.spire.upstreamDriver | string | `""` | | ---------------------------------------------- diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index 2e2e7a1..e0076aa 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -153,6 +153,14 @@ Create the name of the service account to use {{- $config | toYaml }} {{- end }} +{{- define "spire-server.upstream-spire-address" }} +{{- if ne (len (dig "spire" "upstreamSpireAddress" "" .Values.global)) 0 }} +{{- print .Values.global.spire.upstreamSpireAddress }} +{{- else }} +{{- print .Values.upstreamAuthority.spire.server.address }} +{{- end }} +{{- end }} + {{/* Tornjak specific section */}} diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 59987ec..a9e21b1 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -113,7 +113,7 @@ plugins: UpstreamAuthority: - spire: plugin_data: - server_address: {{ .server.address | quote }} + server_address: {{ include "spire-server.upstream-spire-address" $root | quote }} server_port: {{ .server.port }} workload_api_socket: "/run/spire/upstream_agent/spire-agent.sock" {{- end }} diff --git a/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml new file mode 100644 index 0000000..a5a060c --- /dev/null +++ b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml @@ -0,0 +1,90 @@ +{{- if .Values.upstreamAuthority.spire.enabled }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "spire-server.serviceAccountName" . }}-pre-delete + namespace: {{ include "spire-server.namespace" . }} + labels: + {{- include "spire-server.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "spire-server.fullname" . }}-pre-delete + namespace: {{ include "spire-server.namespace" . }} + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed +rules: + - apiGroups: ["apps"] + resources: ["statefulsets"] + resourceNames: [{{ include "spire-server.fullname" . | quote }}] + verbs: ["get", "delete"] + - apiGroups: [""] + resources: ["pods"] + verbs: ["get", "list", "watch"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire-server.fullname" . }}-pre-delete + namespace: {{ include "spire-server.namespace" . }} + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed +subjects: + - kind: ServiceAccount + name: {{ include "spire-server.serviceAccountName" . }}-pre-delete + namespace: {{ include "spire-server.namespace" . }} +roleRef: + kind: Role + name: {{ include "spire-server.fullname" . }}-pre-delete + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "spire-server.fullname" . }}-pre-delete + namespace: {{ include "spire-server.namespace" . }} + labels: + {{- include "spire-server.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed +spec: + template: + metadata: + name: {{ include "spire-server.fullname" . }}-pre-delete + spec: + restartPolicy: Never + serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-delete + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: pre-delete-job + securityContext: + {{- toYaml .Values.securityContext | nindent 10 }} + image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} + args: + - delete + - -n + - {{ include "spire-server.namespace" . }} + - statefulset + - {{ include "spire-server.fullname" . }} + - --wait + - name: pre-delete-check + securityContext: + {{- toYaml .Values.securityContext | nindent 10 }} + image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} + args: + - wait + - --for=delete + - pod + - -l + - app.kubernetes.io/instance={{ include "spire-server.name" . }},app.kubernetes.io/name={{ .Release.Name }},app.kubernetes.io/component=server + - -n + - {{ include "spire-server.namespace" . }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index c92c4eb..7a1fcd9 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -13,6 +13,7 @@ metadata: namespace: {{ include "spire-server.namespace" . }} labels: {{- include "spire-server.labels" . | nindent 4 }} + app.kubernetes.io/component: server spec: {{- if not .Values.autoscaling.enabled }} {{- if and (eq .Values.dataStore.sql.databaseType "sqlite3") (gt (int .Values.replicaCount) 1) }} @@ -24,6 +25,7 @@ spec: selector: matchLabels: {{- include "spire-server.selectorLabels" . | nindent 6 }} + app.kubernetes.io/component: server template: metadata: annotations: @@ -36,6 +38,7 @@ spec: {{- end }} labels: {{- include "spire-server.selectorLabels" . | nindent 8 }} + app.kubernetes.io/component: server spec: {{- with .Values.imagePullSecrets }} imagePullSecrets: @@ -128,6 +131,11 @@ spec: mountPath: /run/spire/upstream_ca readOnly: false {{ end }} + {{- if gt (len .Values.upstreamAuthority.spire.upstreamDriver) 0 }} + - name: upstream-agent + mountPath: /run/spire/upstream_agent + readOnly: true + {{ end }} {{- if gt (len .Values.extraVolumeMounts) 0 }} {{- toYaml .Values.extraVolumeMounts | nindent 12 }} {{- end }} @@ -272,6 +280,12 @@ spec: secret: secretName: {{ include "spire-server.upstream-ca-secret" . }} {{- end }} + {{- if gt (len .Values.upstreamAuthority.spire.upstreamDriver) 0 }} + - name: upstream-agent + csi: + driver: {{ .Values.upstreamAuthority.spire.upstreamDriver }} + readOnly: true + {{- end }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }} - name: controller-manager-config configMap: diff --git a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml index 9e17406..ec3a9d2 100644 --- a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml @@ -5,6 +5,7 @@ metadata: namespace: {{ include "spire-server.namespace" . }} labels: {{- include "spire-server.labels" . | nindent 4 }} + app.kubernetes.io/component: test annotations: "helm.sh/hook": test spec: diff --git a/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml index e35ab37..cacc94d 100644 --- a/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml +++ b/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml @@ -7,6 +7,7 @@ metadata: namespace: {{ include "spire-server.namespace" . }} labels: {{- include "spire-server.labels" . | nindent 4 }} + app.kubernetes.io/component: test annotations: "helm.sh/hook": test spec: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 695750b..d43a1e2 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -238,6 +238,7 @@ upstreamAuthority: renewBefore: "" spire: enabled: false + upstreamDriver: "" server: address: "" port: 8081 diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 78f3321..e7876bf 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -13,6 +13,9 @@ global: # -- Override all instances of bundleConfigMap bundleConfigMap: "" + # -- Set what address to use for the upstream server when using nested spire + upstreamServerAddress: "" + image: # -- Override all Spire image registries at once registry: "" @@ -41,10 +44,35 @@ spire-agent: enabled: true nameOverride: agent +upstream: + # -- enable upstream agent and driver for use with nested spire. + enabled: false + +upstream-spire-agent: + # @ignored + upstream: true + nameOverride: agent-upstream + bundleConfigMap: spire-bundle-upstream + + socketPath: /run/spire/agent-sockets-upstream/spire-agent.sock + serviceAccount: + name: spire-agent-upstream + healthChecks: + port: 9981 + telemetry: + prometheus: + port: 9989 + spiffe-csi-driver: # -- Enables deployment of CSI driver enabled: true +upstream-spiffe-csi-driver: + pluginName: upstream.csi.spiffe.io + agentSocketPath: /run/spire/agent-sockets-upstream/spire-agent.sock + healthChecks: + port: 9810 + spiffe-oidc-discovery-provider: # -- Enables deployment of OIDC discovery provider enabled: false diff --git a/examples/nested/run-tests.sh b/examples/nested/run-tests.sh new file mode 100755 index 0000000..a3ae4eb --- /dev/null +++ b/examples/nested/run-tests.sh @@ -0,0 +1,53 @@ +#!/usr/bin/env bash + +set -xe + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +TESTDIR="${SCRIPTPATH}/../../.github/tests" +DEPS="${TESTDIR}/dependencies" + +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh" +# shellcheck source=/dev/null +source "${TESTDIR}/common.sh" + +teardown() { + helm uninstall --namespace spire-server spire 2>/dev/null || true + kubectl delete ns spire-server 2>/dev/null || true + kubectl delete ns spire-system 2>/dev/null || true + + helm uninstall --namespace mysql spire-root-server 2>/dev/null || true + kubectl delete ns spire-root-server 2>/dev/null || true +} + +trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT + +kubectl create namespace spire-system --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true +kubectl create namespace spire-server --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted || true + +helm upgrade --install --create-namespace spire charts/spire \ + --namespace spire-root-server \ + --values "${DEPS}/spire-root-server-values.yaml" \ + --wait + +kubectl get nodes -o go-template='{{range .items}}{{printf "%s\n" .metadata.uid}}{{end}}' | while read -r line; do + kubectl exec -t spire-server-0 -n "spire-root-server" -- spire-server entry create -spiffeID spiffe://example.org/example-cluster/nested-spire -parentID "spiffe://example.org/spire/agent/k8s_psat/example-cluster/$line" -selector k8s:pod-label:app.kubernetes.io/name:server -downstream +done + +helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml" \ + --wait spire charts/spire +helm test --namespace spire-server spire + +print_helm_releases +print_spire_workload_status spire-root-server +print_spire_workload_status spire-server +print_spire_workload_status spire-system + +if [[ "$1" -ne 0 ]]; then + get_namespace_details spire-root-server + get_namespace_details spire-server + get_namespace_details spire-system +fi diff --git a/examples/nested/values.yaml b/examples/nested/values.yaml new file mode 100644 index 0000000..d24df6e --- /dev/null +++ b/examples/nested/values.yaml @@ -0,0 +1,22 @@ +global: + spire: + upstreamSpireAddress: spire-server.spire-root-server + +spire-server: + enabled: true + upstreamAuthority: + spire: + enabled: true + upstreamDriver: upstream.csi.spiffe.io + controllerManager: + enabled: true + identities: + spiffeIDTemplate: spiffe://{{ .TrustDomain }}/k8s/{{ .ClusterName }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }} + +spiffe-oidc-discovery-provider: + enabled: true + insecureScheme: + enabled: true + +upstream: + enabled: true diff --git a/examples/production/values.yaml b/examples/production/values.yaml index 0b10ab1..3ee755d 100644 --- a/examples/production/values.yaml +++ b/examples/production/values.yaml @@ -46,6 +46,11 @@ spiffe-csi-driver: namespaceOverride: spire-system priorityClassName: system-node-critical + +upstream-spiffe-csi-driver: + namespaceOverride: spire-system + priorityClassName: system-node-critical + spire-agent: enabled: true namespaceOverride: spire-system @@ -69,6 +74,24 @@ spire-agent: logLevel: info +upstream-spire-agent: + namespaceOverride: spire-system + priorityClassName: system-node-critical + podSecurityContext: + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + readOnlyRootFilesystem: true + capabilities: + drop: [ALL] + seccompProfile: + type: RuntimeDefault + + logLevel: info + spiffe-oidc-discovery-provider: enabled: true config: diff --git a/project/issues_due_to_nesting.md b/project/issues_due_to_nesting.md new file mode 100644 index 0000000..e883418 --- /dev/null +++ b/project/issues_due_to_nesting.md @@ -0,0 +1 @@ +Nested charts only support enablement by boolean, not by complex tests such as string compares. From 94326d9c6dcfa0a87f7194018a56a78e7542deec Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Wed, 16 Aug 2023 16:48:42 +0200 Subject: [PATCH 24/38] Fixup Helm docs --- charts/spire/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 6d0800b..726bf3b 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -516,7 +516,7 @@ Now you can interact with the Spire agent socket from your own application. The | upstream-spire-agent.fsGroupFix.image.pullPolicy | string | `"Always"` | The image pull policy | | upstream-spire-agent.fsGroupFix.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from | | upstream-spire-agent.fsGroupFix.image.repository | string | `"chainguard/bash"` | The repository within the registry | -| upstream-spire-agent.fsGroupFix.image.tag | string | `"5.2.15"` | Overrides the image tag | +| upstream-spire-agent.fsGroupFix.image.tag | string | `"latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4"` | Overrides the image tag | | upstream-spire-agent.fsGroupFix.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | upstream-spire-agent.fsGroupFix.resources | object | `{}` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | | upstream-spire-agent.fullnameOverride | string | `""` | | @@ -560,7 +560,7 @@ Now you can interact with the Spire agent socket from your own application. The | upstream-spire-agent.waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | | upstream-spire-agent.waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from | | upstream-spire-agent.waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry | -| upstream-spire-agent.waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag | +| upstream-spire-agent.waitForIt.image.tag | string | `"latest@sha256:deeaccb164a67a4d7f585c4d416641b1f422c029911a29d72beae28221f823df"` | Overrides the image tag | | upstream-spire-agent.waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | upstream-spire-agent.waitForIt.resources | object | `{}` | | | upstream-spire-agent.workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio | From dc8a4545cc5289d97c7008845b6f1e6177d3d962 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Wed, 16 Aug 2023 23:42:21 -0700 Subject: [PATCH 25/38] Array spacing in values is incorrect in a file. (#451) --- charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 88f4d11..bc9fcdb 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -114,7 +114,7 @@ config: logLevel: info # -- Add additional domains that can be used for oidc discovery additionalDomains: - - localhost + - localhost acme: tosAccepted: false From 72893515a2934f16e6c23f342f5d4ad48511396a Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 17 Aug 2023 10:10:45 -0700 Subject: [PATCH 26/38] Update spire bits to 1.7.2 (#452) --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml | 2 +- charts/spire/charts/spiffe-oidc-discovery-provider/README.md | 2 +- charts/spire/charts/spire-agent/Chart.yaml | 2 +- charts/spire/charts/spire-agent/README.md | 2 +- charts/spire/charts/spire-server/Chart.yaml | 2 +- charts/spire/charts/spire-server/README.md | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 8ab9381..3aa7355 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -4,7 +4,7 @@ description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application version: 0.11.1 -appVersion: "1.7.1" +appVersion: "1.7.2" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index 726bf3b..8d6bbf6 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -2,7 +2,7 @@ -![Version: 0.11.1](https://img.shields.io/badge/Version-0.11.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) +![Version: 0.11.1](https://img.shields.io/badge/Version-0.11.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml index 6b572f6..01006b6 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml @@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider description: A Helm chart to install the SPIFFE OIDC discovery provider. type: application version: 0.1.0 -appVersion: "1.7.1" +appVersion: "1.7.2" keywords: ["spiffe", "oidc"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 5f1a57c..b780523 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -2,7 +2,7 @@ -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) A Helm chart to install the SPIFFE OIDC discovery provider. diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml index 71fbc93..1763751 100644 --- a/charts/spire/charts/spire-agent/Chart.yaml +++ b/charts/spire/charts/spire-agent/Chart.yaml @@ -3,7 +3,7 @@ name: spire-agent description: A Helm chart to install the SPIRE agent. type: application version: 0.1.0 -appVersion: "1.7.1" +appVersion: "1.7.2" keywords: ["spiffe", "spire-agent"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index d07f0d0..136f09f 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -2,7 +2,7 @@ -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) A Helm chart to install the SPIRE agent. diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml index 219d6ea..ac676b2 100644 --- a/charts/spire/charts/spire-server/Chart.yaml +++ b/charts/spire/charts/spire-server/Chart.yaml @@ -3,7 +3,7 @@ name: spire-server description: A Helm chart to install the SPIRE server. type: application version: 0.1.0 -appVersion: "1.7.1" +appVersion: "1.7.2" keywords: ["spiffe", "spire-server", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index f659994..529b296 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -2,7 +2,7 @@ -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) A Helm chart to install the SPIRE server. From 5e4cf6f529f6d4251031653c819850e504242c36 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 17 Aug 2023 10:11:05 -0700 Subject: [PATCH 27/38] Clarify project issues identified with nesting document (#450) --- project/issues_due_to_nesting.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/project/issues_due_to_nesting.md b/project/issues_due_to_nesting.md index e883418..ba52157 100644 --- a/project/issues_due_to_nesting.md +++ b/project/issues_due_to_nesting.md @@ -1 +1 @@ -Nested charts only support enablement by boolean, not by complex tests such as string compares. +Nested charts only support enabling/disabling with a Values boolean (true/false). Its not possible to do complex tests such as nestingType=="secondary". From b7e15255f3999bfbd7a63422bc4e74df0d193856 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Fri, 18 Aug 2023 00:48:14 -0700 Subject: [PATCH 28/38] Allow job hooks to be disabled (#434) Co-authored-by: Marco Franssen Co-authored-by: Kevin Fox --- charts/spire/README.md | 5 +++++ .../spire/charts/spiffe-oidc-discovery-provider/README.md | 1 + .../templates/pre-delete-hook.yaml | 2 ++ .../charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++++ charts/spire/charts/spire-server/README.md | 2 ++ .../spire-server/templates/controller-manager-webhook.yaml | 4 ++++ .../charts/spire-server/templates/post-install-hook.yaml | 2 ++ .../charts/spire-server/templates/post-upgrade-hook.yaml | 2 ++ .../charts/spire-server/templates/pre-delete-hook.yaml | 2 ++ .../charts/spire-server/templates/pre-upgrade-hook.yaml | 2 ++ charts/spire/charts/spire-server/values.yaml | 6 ++++++ charts/spire/values.yaml | 7 +++++++ 12 files changed, 39 insertions(+) diff --git a/charts/spire/README.md b/charts/spire/README.md index 8d6bbf6..585f3e0 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -89,6 +89,8 @@ Now you can interact with the Spire agent socket from your own application. The | Key | Type | Default | Description | |-----|------|---------|-------------| +| global.deleteHooks.enabled | bool | `true` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | +| global.installAndUpgradeHooks.enabled | bool | `true` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | | global.k8s.clusterDomain | string | `"cluster.local"` | | | global.spire.bundleConfigMap | string | `""` | Override all instances of bundleConfigMap | | global.spire.clusterName | string | `"example-cluster"` | | @@ -162,6 +164,7 @@ Now you can interact with the Spire agent socket from your own application. The | spiffe-oidc-discovery-provider.config.additionalDomains | list | `["localhost"]` | Add additional domains that can be used for oidc discovery | | spiffe-oidc-discovery-provider.config.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" | | spiffe-oidc-discovery-provider.configMap.annotations | object | `{}` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | +| spiffe-oidc-discovery-provider.deleteHook.enabled | bool | `true` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | | spiffe-oidc-discovery-provider.fullnameOverride | string | `""` | | | spiffe-oidc-discovery-provider.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | | spiffe-oidc-discovery-provider.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | @@ -294,6 +297,7 @@ Now you can interact with the Spire agent socket from your own application. The | spire-server.clusterName | string | `"example-cluster"` | | | spire-server.configMap.annotations | object | `{}` | Annotations to add to the SPIRE Server ConfigMap | | spire-server.controllerManager.configMap.annotations | object | `{}` | Annotations to add to the Controller Manager ConfigMap | +| spire-server.controllerManager.deleteHook.enabled | bool | `true` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | | spire-server.controllerManager.enabled | bool | `false` | | | spire-server.controllerManager.identities.dnsNameTemplates | list | `[]` | | | spire-server.controllerManager.identities.enabled | bool | `true` | | @@ -309,6 +313,7 @@ Now you can interact with the Spire agent socket from your own application. The | spire-server.controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry | | spire-server.controllerManager.image.tag | string | `"0.2.3"` | Overrides the image tag | | spire-server.controllerManager.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | +| spire-server.controllerManager.installAndUpgradeHook.enabled | bool | `true` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | | spire-server.controllerManager.resources | object | `{}` | | | spire-server.controllerManager.securityContext | object | `{}` | | | spire-server.controllerManager.service.annotations | object | `{}` | | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index b780523..74ef3aa 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -45,6 +45,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | config.additionalDomains | list | `["localhost"]` | Add additional domains that can be used for oidc discovery | | config.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" | | configMap.annotations | object | `{}` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | +| deleteHook.enabled | bool | `true` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | | fullnameOverride | string | `""` | | | image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | | image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml index 29016f6..452fea0 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml @@ -1,3 +1,4 @@ +{{- if eq ((dig "deleteHooks" "enabled" .Values.deleteHook.enabled .Values.global) | toString) "true" }} apiVersion: v1 kind: ServiceAccount metadata: @@ -71,3 +72,4 @@ spec: - deployment - {{ include "spiffe-oidc-discovery-provider.fullname" . }} - --wait +{{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index bc9fcdb..5430819 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -135,6 +135,10 @@ serviceAccount: # If not set and create is true, a name is generated using the fullname template name: "" +deleteHook: + # -- Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) + enabled: true + autoscaling: enabled: false minReplicas: 1 diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 529b296..84cefce 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -100,6 +100,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | clusterName | string | `"example-cluster"` | | | configMap.annotations | object | `{}` | Annotations to add to the SPIRE Server ConfigMap | | controllerManager.configMap.annotations | object | `{}` | Annotations to add to the Controller Manager ConfigMap | +| controllerManager.deleteHook.enabled | bool | `true` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | | controllerManager.enabled | bool | `false` | | | controllerManager.identities.dnsNameTemplates | list | `[]` | | | controllerManager.identities.enabled | bool | `true` | | @@ -115,6 +116,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry | | controllerManager.image.tag | string | `"0.2.3"` | Overrides the image tag | | controllerManager.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | +| controllerManager.installAndUpgradeHook.enabled | bool | `true` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | | controllerManager.resources | object | `{}` | | | controllerManager.securityContext | object | `{}` | | | controllerManager.service.annotations | object | `{}` | | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml index 4216396..0622736 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml @@ -10,7 +10,11 @@ webhooks: name: {{ include "spire-controller-manager.fullname" . }}-webhook namespace: {{ include "spire-server.namespace" . }} path: /validate-spire-spiffe-io-v1alpha1-clusterfederatedtrustdomain + {{- if eq (.Values.controllerManager.installAndUpgradeHook.enabled | toString) "true" }} failurePolicy: Ignore # Actual value to be set by post install/upgrade hooks + {{- else }} + failurePolicy: {{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }} + {{- end }} name: vclusterfederatedtrustdomain.kb.io rules: - apiGroups: ["spire.spiffe.io"] diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml index 14e5b99..dbbb7bd 100644 --- a/charts/spire/charts/spire-server/templates/post-install-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml @@ -1,3 +1,4 @@ +{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} apiVersion: v1 @@ -85,3 +86,4 @@ spec: } {{- end }} {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml index 628ee8d..ff2883b 100644 --- a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml @@ -1,3 +1,4 @@ +{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} apiVersion: v1 @@ -85,3 +86,4 @@ spec: } {{- end }} {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml index a5a060c..1416a82 100644 --- a/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml @@ -1,3 +1,4 @@ +{{- if eq ((dig "deleteHooks" "enabled" .Values.controllerManager.deleteHook.enabled .Values.global) | toString) "true" }} {{- if .Values.upstreamAuthority.spire.enabled }} apiVersion: v1 kind: ServiceAccount @@ -88,3 +89,4 @@ spec: - -n - {{ include "spire-server.namespace" . }} {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml index f96250e..db53b27 100644 --- a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml @@ -1,3 +1,4 @@ +{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} apiVersion: v1 @@ -85,3 +86,4 @@ spec: } {{- end }} {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index d43a1e2..0fff24d 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -250,6 +250,12 @@ notifier: controllerManager: enabled: false + installAndUpgradeHook: + # -- Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) + enabled: true + deleteHook: + # -- Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) + enabled: true image: # -- The OCI registry to pull the image from diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index e7876bf..8b18fbc 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -20,6 +20,13 @@ global: # -- Override all Spire image registries at once registry: "" + installAndUpgradeHooks: + # -- Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) + enabled: true + deleteHooks: + # -- Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) + enabled: true + # telemetry: # prometheus: # enabled: true From 77fe43f37d19f80399299dcb02c0cb16efcf23ed Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Fri, 18 Aug 2023 00:49:50 -0700 Subject: [PATCH 29/38] Cron job to check for and update images (#249) Co-authored-by: Marco Franssen --- .github/dependabot.yaml | 8 ++++ .github/scripts/edit-yaml.py | 24 ++++++++++ .github/scripts/requirements.txt | 2 + .github/scripts/update-tags.sh | 66 +++++++++++++++++++++++++++ .github/tests/images.json | 51 +++++++++++++++++++++ .github/workflows/check-versions.yaml | 20 ++++++++ 6 files changed, 171 insertions(+) create mode 100755 .github/scripts/edit-yaml.py create mode 100644 .github/scripts/requirements.txt create mode 100755 .github/scripts/update-tags.sh create mode 100644 .github/tests/images.json diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml index c82e211..6a7cb06 100644 --- a/.github/dependabot.yaml +++ b/.github/dependabot.yaml @@ -12,3 +12,11 @@ updates: schedule: interval: "daily" open-pull-requests-limit: 5 +- package-ecosystem: pip + directory: "/.github/scripts" + schedule: + interval: daily + groups: + python-packages: + patterns: + - "*" diff --git a/.github/scripts/edit-yaml.py b/.github/scripts/edit-yaml.py new file mode 100755 index 0000000..2709e77 --- /dev/null +++ b/.github/scripts/edit-yaml.py @@ -0,0 +1,24 @@ +#!/usr/bin/env python3 + +import os +import sys +from dict_deep import deep_set +import ruamel.yaml + +def represent_none(self, data): + return self.represent_scalar(u'tag:yaml.org,2002:null', u'null') + +y = ruamel.yaml.YAML() +y.indent(mapping=2, sequence=4, offset=2) +# Dont wrap long lines +y.width = 4096 +y.preserve_quotes = True +y.representer.add_representer(type(None), represent_none) + +d = y.load(open(os.environ['VALUES'])) + +tagquery = os.environ['QUERY'] + '.tag' + +deep_set(d, tagquery, os.environ['LATEST_VERSION']); + +y.dump(d, sys.stdout) diff --git a/.github/scripts/requirements.txt b/.github/scripts/requirements.txt new file mode 100644 index 0000000..f139ec1 --- /dev/null +++ b/.github/scripts/requirements.txt @@ -0,0 +1,2 @@ +ruamel.yaml +dict_deep diff --git a/.github/scripts/update-tags.sh b/.github/scripts/update-tags.sh new file mode 100755 index 0000000..4ba69e5 --- /dev/null +++ b/.github/scripts/update-tags.sh @@ -0,0 +1,66 @@ +#!/usr/bin/env bash + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" + +IMAGEJSON="${SCRIPTPATH}/../tests/images.json" + +if ! command -v crane &> /dev/null; then + echo Please install crane + exit 1 +fi + +if ! command -v jq &> /dev/null; then + echo Please install jq + exit 1 +fi + +if ! command -v yq &> /dev/null; then + echo Please install yq + exit 1 +fi + +if ! command -v python3 -c 'import ruamel.yaml' &> /dev/null; then + echo Please install python3 with the ruamel.yaml module + exit 1 +fi + +if ! command -v python3 -c 'import dict_deep' &> /dev/null; then + echo Please install python3 with the dict_deep module + exit 1 +fi + +jq -r '. | keys[]' "$IMAGEJSON" | while read -r CHART; do + jq -r ".\"${CHART}\" | keys[]" "$IMAGEJSON" | while read -r IDX; do + QUERY=$(jq -r ".\"${CHART}\"[${IDX}].query" "$IMAGEJSON") + FILTER=$(jq -r ".\"${CHART}\"[${IDX}].filter" "$IMAGEJSON") + + OLD_IFS=${IFS} + SORTFLAGS=() + while IFS='' read -r value; do + SORTFLAGS+=("$value") + done < <(jq -r ".\"${CHART}\"[${IDX}].\"sort-flags\" | .[]" "$IMAGEJSON") + IFS=${OLD_IFS} + + VALUES="${SCRIPTPATH}/../../charts/spire/charts/${CHART}" + REGISTRY=$(yq e ".${QUERY}.registry" "$VALUES") + REPOSITORY=$(yq e ".${QUERY}.repository" "$VALUES") + VERSION=$(yq e ".${QUERY}.tag" "$VALUES") + if [[ "$FILTER" == "LATESTSHA" ]]; then + LATEST_VERSION="latest@"$(crane digest "${REGISTRY}/${REPOSITORY}:latest") + else + LATEST_VERSION=$(crane ls "${REGISTRY}/${REPOSITORY}" | grep "${FILTER}" | sort "${SORTFLAGS[@]}"| tail -n 1) + fi + + export QUERY + export VALUES + export LATEST_VERSION + + if [ "${VERSION}" != "${LATEST_VERSION}" ]; then + echo "New image version found: ${REGISTRY}/${REPOSITORY}:${LATEST_VERSION}" + "${SCRIPTPATH}/edit-yaml.py" > /tmp/$$ + mv /tmp/$$ "${VALUES}" + fi + done +done +"${SCRIPTPATH}/../../helm-docs.sh" diff --git a/.github/tests/images.json b/.github/tests/images.json new file mode 100644 index 0000000..d33d64c --- /dev/null +++ b/.github/tests/images.json @@ -0,0 +1,51 @@ +{ + "spire-server/values.yaml": [ + { + "query": "tests.bash.image", + "filter": "LATESTSHA", + "sort-flags": [] + } + ], + "spire-agent/values.yaml": [ + { + "query": "waitForIt.image", + "filter": "LATESTSHA", + "sort-flags": [] + }, + { + "query": "fsGroupFix.image", + "filter": "LATESTSHA", + "sort-flags": [] + } + ], + "spiffe-csi-driver/values.yaml": [ + { + "query": "nodeDriverRegistrar.image", + "filter": "^v", + "sort-flags": [] + } + ], + "spiffe-oidc-discovery-provider/values.yaml": [ + { + "query": "insecureScheme.nginx.image", + "filter": "^[0-9]\\+\\.[0-9]\\+\\.[0-9]\\+-alpine$", + "sort-flags": [] + }, { + "query": "telemetry.prometheus.nginxExporter.image", + "filter": "^[0-9]\\+\\.[0-9]\\+\\.[0-9]\\+$", + "sort-flags": ["-t", ".", "-k1,1n", "-k2,2n", "-k3,3n"] + }, + { + "query": "tests.bash.image", + "filter": "LATESTSHA", + "sort-flags": [] + } + ], + "tornjak-frontend/values.yaml": [ + { + "query": "tests.bash.image", + "filter": "LATESTSHA", + "sort-flags": [] + } + ] +} diff --git a/.github/workflows/check-versions.yaml b/.github/workflows/check-versions.yaml index 913808c..305c1c3 100644 --- a/.github/workflows/check-versions.yaml +++ b/.github/workflows/check-versions.yaml @@ -32,6 +32,26 @@ jobs: ./.github/scripts/update-versions.sh git diff + - name: Setup go + uses: actions/setup-go@v4.0.0 + + - name: Setup crane + uses: imjasonh/setup-crane@v0.1 + + - uses: actions/setup-python@v4.6.1 + with: + python-version: '3.9' + + - name: Update image tags + run: | + go install github.com/mikefarah/yq/v4@latest + + sudo apt-get install wget apt-transport-https gnupg lsb-release + sudo pip install -r .github/scripts/requirements.txt + + ./.github/scripts/update-tags.sh + git diff + - name: Create Pull Request id: cpr uses: peter-evans/create-pull-request@v5.0.2 From 5e2e8a9188a04a85943ac598abf9627075e8d48b Mon Sep 17 00:00:00 2001 From: Maximiliano Churichi Date: Fri, 18 Aug 2023 08:52:51 +0100 Subject: [PATCH 30/38] Adds AWS KMS KeyManager support (#435) Co-authored-by: Marco Franssen Co-authored-by: kfox1111 --- .gitignore | 1 + charts/spire/README.md | 7 ++++ charts/spire/charts/spire-server/README.md | 7 ++++ .../templates/aws-kms-configmap.yaml | 10 ++++++ .../templates/aws-kms-secret.yaml | 17 ++++++++++ .../spire-server/templates/configmap.yaml | 24 ++++++++++++-- .../spire-server/templates/statefulset.yaml | 33 +++++++++++++++++++ charts/spire/charts/spire-server/values.yaml | 13 ++++++++ 8 files changed, 110 insertions(+), 2 deletions(-) create mode 100644 charts/spire/charts/spire-server/templates/aws-kms-configmap.yaml create mode 100644 charts/spire/charts/spire-server/templates/aws-kms-secret.yaml diff --git a/.gitignore b/.gitignore index 1ad54ad..beb5ec8 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,6 @@ bin/ .idea/ +.vscode/ *.swp charts/**/*.tgz .DS_Store diff --git a/charts/spire/README.md b/charts/spire/README.md index 585f3e0..a1fafe4 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -359,6 +359,13 @@ Now you can interact with the Spire agent socket from your own application. The | spire-server.ingress.tls | list | `[]` | | | spire-server.initContainers | list | `[]` | | | spire-server.jwtIssuer | string | `"https://oidc-discovery.example.org"` | The JWT issuer domain | +| spire-server.keyManager.awsKMS.accessKeyID | Optional | `""` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. | +| spire-server.keyManager.awsKMS.enabled | bool | `false` | | +| spire-server.keyManager.awsKMS.keyPolicy | object | `{"existingConfigMap":"","policy":""}` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | +| spire-server.keyManager.awsKMS.keyPolicy.existingConfigMap | Optional | `""` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | +| spire-server.keyManager.awsKMS.keyPolicy.policy | Optional | `""` | Key policy in JSON format. | +| spire-server.keyManager.awsKMS.region | string | `""` | | +| spire-server.keyManager.awsKMS.secretAccessKey | Optional | `""` | Secret access key for the AWS account. | | spire-server.keyManager.disk.enabled | bool | `true` | | | spire-server.keyManager.memory.enabled | bool | `false` | | | spire-server.livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe | diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 84cefce..84fc6ef 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -162,6 +162,13 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | ingress.tls | list | `[]` | | | initContainers | list | `[]` | | | jwtIssuer | string | `"https://oidc-discovery.example.org"` | The JWT issuer domain | +| keyManager.awsKMS.accessKeyID | Optional | `""` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. | +| keyManager.awsKMS.enabled | bool | `false` | | +| keyManager.awsKMS.keyPolicy | object | `{"existingConfigMap":"","policy":""}` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | +| keyManager.awsKMS.keyPolicy.existingConfigMap | Optional | `""` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | +| keyManager.awsKMS.keyPolicy.policy | Optional | `""` | Key policy in JSON format. | +| keyManager.awsKMS.region | string | `""` | | +| keyManager.awsKMS.secretAccessKey | Optional | `""` | Secret access key for the AWS account. | | keyManager.disk.enabled | bool | `true` | | | keyManager.memory.enabled | bool | `false` | | | livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe | diff --git a/charts/spire/charts/spire-server/templates/aws-kms-configmap.yaml b/charts/spire/charts/spire-server/templates/aws-kms-configmap.yaml new file mode 100644 index 0000000..a7edc7a --- /dev/null +++ b/charts/spire/charts/spire-server/templates/aws-kms-configmap.yaml @@ -0,0 +1,10 @@ +{{- if ne .Values.keyManager.awsKMS.keyPolicy.policy "" }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "spire-server.fullname" . }}-aws-kms + namespace: {{ include "spire-server.namespace" . }} +data: + policy.json: | + {{ .Values.keyManager.awsKMS.keyPolicy.policy | nindent 4 }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/aws-kms-secret.yaml b/charts/spire/charts/spire-server/templates/aws-kms-secret.yaml new file mode 100644 index 0000000..3477dcc --- /dev/null +++ b/charts/spire/charts/spire-server/templates/aws-kms-secret.yaml @@ -0,0 +1,17 @@ +{{- $root := . }} +{{- with .Values.keyManager.awsKMS }} +{{- if or (ne .accessKeyID "") (ne .secretAccessKey "") }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "spire-server.fullname" $root }}-aws-kms + namespace: {{ include "spire-server.namespace" $root }} +data: + {{- if ne .accessKeyID "" }} + AWS_KMS_ACCESS_KEY_ID: {{ .accessKeyID | b64enc }} + {{- end }} + {{- if ne .secretAccessKey "" }} + AWS_KMS_SECRET_ACCESS_KEY: {{ .secretAccessKey | b64enc }} + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index a9e21b1..d72eae9 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -67,8 +67,28 @@ plugins: {{- end }} {{- end }} -{{- if gt $keyManagerUsed 1 }} -{{- fail "You can only enable a single KeyManager" }} + {{- with .Values.keyManager.awsKMS }} + {{- if eq (.enabled | toString) "true" }} + {{- $keyManagerUsed = add1 $keyManagerUsed }} + KeyManager: + - aws_kms: + plugin_data: + region: {{ .region | quote }} + key_metadata_file: "/run/spire/data/aws-kms-key-metadata" + {{- if ne .accessKeyID "" }} + access_key_id: "${AWS_KMS_ACCESS_KEY_ID}" + {{- end }} + {{- if ne .secretAccessKey "" }} + secret_access_key: "${AWS_KMS_SECRET_ACCESS_KEY}" + {{- end }} + {{- if or (ne .keyPolicy.policy "") (ne .keyPolicy.existingConfigMap "") }} + key_policy_file: "/run/spire/data/aws-kms-key-policy.json" + {{- end }} + {{- end }} + {{- end }} + +{{- if ne $keyManagerUsed 1 }} +{{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }} {{- end }} Notifier: diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 7a1fcd9..ef70c9f 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -87,6 +87,20 @@ spec: name: {{ $fullname }}-dbpw key: DBPW {{- end }} + {{- if ne .Values.keyManager.awsKMS.accessKeyID "" }} + - name: AWS_KMS_ACCESS_KEY_ID + valueFrom: + secretKeyRef: + name: {{ $fullname }}-aws-kms + key: AWS_KMS_ACCESS_KEY_ID + {{- end }} + {{- if ne .Values.keyManager.awsKMS.secretAccessKey "" }} + - name: AWS_KMS_SECRET_ACCESS_KEY + valueFrom: + secretKeyRef: + name: {{ $fullname }}-aws-kms + key: AWS_KMS_SECRET_ACCESS_KEY + {{- end }} ports: - name: grpc containerPort: 8081 @@ -136,6 +150,14 @@ spec: mountPath: /run/spire/upstream_agent readOnly: true {{ end }} + {{- with .Values.keyManager.awsKMS }} + {{- if and (eq (.enabled | toString) "true") (or (ne .keyPolicy.policy "") (ne .keyPolicy.existingConfigMap "")) }} + - name: aws-kms-key-policy + mountPath: /run/spire/data/aws-kms-key-policy.json + subPath: policy.json + readOnly: true + {{ end }} + {{ end }} {{- if gt (len .Values.extraVolumeMounts) 0 }} {{- toYaml .Values.extraVolumeMounts | nindent 12 }} {{- end }} @@ -286,6 +308,17 @@ spec: driver: {{ .Values.upstreamAuthority.spire.upstreamDriver }} readOnly: true {{- end }} + {{- with .Values.keyManager.awsKMS }} + {{- if and (eq (.enabled | toString) "true") (or (ne .keyPolicy.policy "") (ne .keyPolicy.existingConfigMap "")) }} + - name: aws-kms-key-policy + configMap: + {{- if ne .keyPolicy.policy "" }} + name: {{ $fullname }}-aws-kms + {{- else if ne .keyPolicy.existingConfigMap "" }} + name: {{ .keyPolicy.existingConfigMap }} + {{- end }} + {{- end }} + {{- end }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }} - name: controller-manager-config configMap: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 0fff24d..3b943ba 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -180,6 +180,19 @@ keyManager: enabled: true memory: enabled: false + awsKMS: + enabled: false + region: "" + # -- Policy to use when creating keys. If no policy is specified, a default policy will be used. + keyPolicy: + # -- (Optional) Key policy in JSON format. + policy: "" + # -- (Optional) Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. + existingConfigMap: "" + # -- (Optional) Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. + accessKeyID: "" + # -- (Optional) Secret access key for the AWS account. + secretAccessKey: "" upstreamAuthority: disk: From 76e3665396812fcc0be177770b45c7a0d7fee453 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 18 Aug 2023 19:06:15 +0200 Subject: [PATCH 31/38] Fix annotation for spire-oidc deployment (#457) --- .../templates/deployment.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml index b5aaa90..c34f3a2 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -6,10 +6,10 @@ metadata: namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }} labels: {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} + {{- with .Values.annotations }} annotations: - {{- with .Values.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} + {{- toYaml . | nindent 4 }} + {{- end }} spec: {{- if not .Values.autoscaling.enabled }} replicas: {{ .Values.replicaCount }} From 80b9a838739ee3f5b62f2103ccd7927643bbcc98 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 18 Aug 2023 10:07:26 +0200 Subject: [PATCH 32/38] Fix indentation issue in dependabot.yaml Signed-off-by: Marco Franssen --- .github/dependabot.yaml | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml index 6a7cb06..b0fbc66 100644 --- a/.github/dependabot.yaml +++ b/.github/dependabot.yaml @@ -12,11 +12,12 @@ updates: schedule: interval: "daily" open-pull-requests-limit: 5 -- package-ecosystem: pip - directory: "/.github/scripts" - schedule: - interval: daily - groups: - python-packages: - patterns: - - "*" + + - package-ecosystem: pip + directory: "/.github/scripts" + schedule: + interval: daily + groups: + python-packages: + patterns: + - "*" From 9cb59dafb8f2f2551a55f8866d895fbf9931a888 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 18 Aug 2023 10:07:42 +0200 Subject: [PATCH 33/38] Include go dependencies in dependabot.yaml Signed-off-by: Marco Franssen --- .github/dependabot.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml index b0fbc66..58d754c 100644 --- a/.github/dependabot.yaml +++ b/.github/dependabot.yaml @@ -13,6 +13,12 @@ updates: interval: "daily" open-pull-requests-limit: 5 + - package-ecosystem: gomod + directory: "/tests" + schedule: + interval: daily + open-pull-requests-limit: 5 + - package-ecosystem: pip directory: "/.github/scripts" schedule: From 3d307a2ebfe69e79ce8b5a1d5036569a189b4e82 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Aug 2023 01:03:40 -0700 Subject: [PATCH 34/38] Bump actions/setup-go from 4.0.0 to 4.1.0 (#459) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/check-versions.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check-versions.yaml b/.github/workflows/check-versions.yaml index 305c1c3..d9504df 100644 --- a/.github/workflows/check-versions.yaml +++ b/.github/workflows/check-versions.yaml @@ -33,7 +33,7 @@ jobs: git diff - name: Setup go - uses: actions/setup-go@v4.0.0 + uses: actions/setup-go@v4.1.0 - name: Setup crane uses: imjasonh/setup-crane@v0.1 From eb1ad75d7fad369c6ee226dc2de187b5733c465d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Aug 2023 01:03:56 -0700 Subject: [PATCH 35/38] Bump imjasonh/setup-crane from 0.1 to 0.3 (#460) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/check-versions.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check-versions.yaml b/.github/workflows/check-versions.yaml index d9504df..f28d1b4 100644 --- a/.github/workflows/check-versions.yaml +++ b/.github/workflows/check-versions.yaml @@ -36,7 +36,7 @@ jobs: uses: actions/setup-go@v4.1.0 - name: Setup crane - uses: imjasonh/setup-crane@v0.1 + uses: imjasonh/setup-crane@v0.3 - uses: actions/setup-python@v4.6.1 with: From ecb83d6dd440f18d8a150c5cf969f915fa6d2464 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Aug 2023 10:10:52 -0700 Subject: [PATCH 36/38] Bump github.com/onsi/gomega from 1.27.6 to 1.27.10 in /tests (#461) Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.27.6 to 1.27.10.
Release notes

Sourced from github.com/onsi/gomega's releases.

v1.27.10

1.27.10

Fixes

  • fix: go 1.21 adding goroutine ID to creator+location (#685) [bdc7803]

v1.27.9

1.27.9

Fixes

  • Prevent nil-dereference in format.Object for boxed nil error (#681) [3b31fc3]

Maintenance

  • Bump golang.org/x/net from 0.11.0 to 0.12.0 (#679) [360849b]
  • chore: use String() instead of fmt.Sprintf (#678) [86f3659]
  • Bump golang.org/x/net from 0.10.0 to 0.11.0 (#674) [642ead0]
  • chore: unnecessary use of fmt.Sprintf (#677) [ceb9ca6]
  • Bump github.com/onsi/ginkgo/v2 from 2.10.0 to 2.11.0 (#675) [a2087d8]
  • docs: fix ContainSubstring references (#673) [fc9a89f]
  • Bump github.com/onsi/ginkgo/v2 from 2.9.7 to 2.10.0 (#671) [9076019]

v1.27.8

1.27.8

Fixes

  • HaveExactElement should not call FailureMessage if a submatcher returned an error [096f392]

Maintenance

  • Bump github.com/onsi/ginkgo/v2 from 2.9.5 to 2.9.7 (#669) [8884bee]

v1.27.7

1.27.7

Fixes

  • fix: gcustom.MakeMatcher accepts nil as actual value (#666) [57054d5]

Maintenance

  • update gitignore [05c1bc6]
  • Bump github.com/onsi/ginkgo/v2 from 2.9.4 to 2.9.5 (#663) [7cadcf6]
  • Bump golang.org/x/net from 0.9.0 to 0.10.0 (#662) [b524839]
  • Bump github.com/onsi/ginkgo/v2 from 2.9.2 to 2.9.4 (#661) [5f44694]
  • Bump commonmarker from 0.23.8 to 0.23.9 in /docs (#657) [05dc99a]
  • Bump nokogiri from 1.14.1 to 1.14.3 in /docs (#658) [3a033d1]
  • Replace deprecated NewGomegaWithT with NewWithT (#659) [a19238f]
  • Bump golang.org/x/net from 0.8.0 to 0.9.0 (#656) [29ed041]
  • Bump actions/setup-go from 3 to 4 (#651) [11b2080]
Changelog

Sourced from github.com/onsi/gomega's changelog.

1.27.10

Fixes

  • fix: go 1.21 adding goroutine ID to creator+location (#685) [bdc7803]

1.27.9

Fixes

  • Prevent nil-dereference in format.Object for boxed nil error (#681) [3b31fc3]

Maintenance

  • Bump golang.org/x/net from 0.11.0 to 0.12.0 (#679) [360849b]
  • chore: use String() instead of fmt.Sprintf (#678) [86f3659]
  • Bump golang.org/x/net from 0.10.0 to 0.11.0 (#674) [642ead0]
  • chore: unnecessary use of fmt.Sprintf (#677) [ceb9ca6]
  • Bump github.com/onsi/ginkgo/v2 from 2.10.0 to 2.11.0 (#675) [a2087d8]
  • docs: fix ContainSubstring references (#673) [fc9a89f]
  • Bump github.com/onsi/ginkgo/v2 from 2.9.7 to 2.10.0 (#671) [9076019]

1.27.8

Fixes

  • HaveExactElement should not call FailureMessage if a submatcher returned an error [096f392]

Maintenance

  • Bump github.com/onsi/ginkgo/v2 from 2.9.5 to 2.9.7 (#669) [8884bee]

1.27.7

Fixes

  • fix: gcustom.MakeMatcher accepts nil as actual value (#666) [57054d5]

Maintenance

  • update gitignore [05c1bc6]
  • Bump github.com/onsi/ginkgo/v2 from 2.9.4 to 2.9.5 (#663) [7cadcf6]
  • Bump golang.org/x/net from 0.9.0 to 0.10.0 (#662) [b524839]
  • Bump github.com/onsi/ginkgo/v2 from 2.9.2 to 2.9.4 (#661) [5f44694]
  • Bump commonmarker from 0.23.8 to 0.23.9 in /docs (#657) [05dc99a]
  • Bump nokogiri from 1.14.1 to 1.14.3 in /docs (#658) [3a033d1]
  • Replace deprecated NewGomegaWithT with NewWithT (#659) [a19238f]
  • Bump golang.org/x/net from 0.8.0 to 0.9.0 (#656) [29ed041]
  • Bump actions/setup-go from 3 to 4 (#651) [11b2080]
Commits
  • 9cbf7b0 v1.27.10
  • bdc7803 fix: go 1.21 adding goroutine ID to creator+location (#685)
  • 66bcd9d v1.27.9
  • 3b31fc3 Prevent nil-dereference in format.Object for boxed nil error (#681)
  • 360849b Bump golang.org/x/net from 0.11.0 to 0.12.0 (#679)
  • 86f3659 chore: use String() instead of fmt.Sprintf (#678)
  • 642ead0 Bump golang.org/x/net from 0.10.0 to 0.11.0 (#674)
  • ceb9ca6 chore: unnecessary use of fmt.Sprintf (#677)
  • a2087d8 Bump github.com/onsi/ginkgo/v2 from 2.10.0 to 2.11.0 (#675)
  • fc9a89f docs: fix ContainSubstring references (#673)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/onsi/gomega&package-manager=go_modules&previous-version=1.27.6&new-version=1.27.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- tests/go.mod | 16 ++++++++-------- tests/go.sum | 33 +++++++++++++++++---------------- 2 files changed, 25 insertions(+), 24 deletions(-) diff --git a/tests/go.mod b/tests/go.mod index c13d8a1..785c3cd 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -3,8 +3,8 @@ module github.com/spiffe/helm-charts/tests go 1.20 require ( - github.com/onsi/ginkgo/v2 v2.9.4 - github.com/onsi/gomega v1.27.6 + github.com/onsi/ginkgo/v2 v2.11.0 + github.com/onsi/gomega v1.27.10 helm.sh/helm/v3 v3.11.3 ) @@ -45,14 +45,14 @@ require ( github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect github.com/xeipuuv/gojsonschema v1.2.0 // indirect - golang.org/x/crypto v0.5.0 // indirect - golang.org/x/net v0.9.0 // indirect + golang.org/x/crypto v0.11.0 // indirect + golang.org/x/net v0.12.0 // indirect golang.org/x/oauth2 v0.4.0 // indirect - golang.org/x/sys v0.7.0 // indirect - golang.org/x/term v0.7.0 // indirect - golang.org/x/text v0.9.0 // indirect + golang.org/x/sys v0.10.0 // indirect + golang.org/x/term v0.10.0 // indirect + golang.org/x/text v0.11.0 // indirect golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect - golang.org/x/tools v0.8.0 // indirect + golang.org/x/tools v0.9.3 // indirect google.golang.org/appengine v1.6.7 // indirect google.golang.org/protobuf v1.28.1 // indirect gopkg.in/inf.v0 v0.9.1 // indirect diff --git a/tests/go.sum b/tests/go.sum index 0078965..950921b 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -113,10 +113,10 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs= github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno= -github.com/onsi/ginkgo/v2 v2.9.4 h1:xR7vG4IXt5RWx6FfIjyAtsoMAtnc3C/rFXBBd2AjZwE= -github.com/onsi/ginkgo/v2 v2.9.4/go.mod h1:gCQYp2Q+kSoIj7ykSVb9nskRSsR6PUj4AiLywzIhbKM= -github.com/onsi/gomega v1.27.6 h1:ENqfyGeS5AX/rlXDd/ETokDz93u0YufY1Pgxuy/PvWE= -github.com/onsi/gomega v1.27.6/go.mod h1:PIQNjfQwkP3aQAH7lf7j87O/5FiNr+ZR8+ipb+qQlhg= +github.com/onsi/ginkgo/v2 v2.11.0 h1:WgqUCUt/lT6yXoQ8Wef0fsNn5cAuMK7+KT9UFRz2tcU= +github.com/onsi/ginkgo/v2 v2.11.0/go.mod h1:ZhrRA5XmEE3x3rhlzamx/JJvujdZoJ2uvgI7kR0iZvM= +github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI= +github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= @@ -152,8 +152,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4= -golang.org/x/crypto v0.5.0 h1:U/0M97KRkSFvyD/3FSmdP5W5swImpNgle/EHFhOsQPE= -golang.org/x/crypto v0.5.0/go.mod h1:NK/OQwhpMQP3MwtdjgLlYHnH9ebylxKWv3e0fK+mkQU= +golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA= +golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE= golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU= @@ -161,6 +161,7 @@ golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHl golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= +golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -173,8 +174,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY= -golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM= -golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns= +golang.org/x/net v0.12.0 h1:cfawfvKITfUsFCeJIHJrbSxpeu/E81khclypR0GVT50= +golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.4.0 h1:NF0gk8LVPg1Ml7SSbGyySuoxdsXitj7TvgvuRxIMc/M= golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec= @@ -194,20 +195,20 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU= -golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA= +golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc= -golang.org/x/term v0.7.0 h1:BEvjmm5fURWqcfbSKTdpkDXYBrUS1c0m8agp14W48vQ= -golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY= +golang.org/x/term v0.10.0 h1:3R7pNqamzBraeqj/Tj8qt1aQ2HpmlC+Cx/qL/7hn4/c= +golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= -golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE= -golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= +golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4= +golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 h1:vVKdlvoWBphwdxWKrFZEuM0kGgGLxUOYcY4U/2Vjg44= golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -219,8 +220,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= -golang.org/x/tools v0.8.0 h1:vSDcovVPld282ceKgDimkRSC8kpaH1dgyc9UMzlt84Y= -golang.org/x/tools v0.8.0/go.mod h1:JxBZ99ISMI5ViVkT1tr6tdNmXeTrcpVSD3vZ1RsRdN4= +golang.org/x/tools v0.9.3 h1:Gn1I8+64MsuTb/HpH+LmQtNas23LhUVr3rYZ0eKuaMM= +golang.org/x/tools v0.9.3/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= From c298510701e84ada523786f5528c0ec9e0e2f453 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 21 Aug 2023 19:38:42 +0200 Subject: [PATCH 37/38] Fix initContainers spire-server statefulset (#458) To allow for inplace upgrades of spire-server statefulset we are not allowed to make changes to all fields of the statefulset spec. When bumping from 0.8.1 to the latest version the `initContainers:` field is added in the spec and therefore does not allow for updating the statefulset. This fix prevents the empty initContainers block when bumping from a previous chart version. Signed-off-by: Marco Franssen Co-authored-by: Faisal Memon --- charts/spire/charts/spire-server/templates/statefulset.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index ef70c9f..d9fc9a6 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -48,6 +48,7 @@ spec: shareProcessNamespace: true securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }} initContainers: {{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }} - name: wait @@ -67,6 +68,7 @@ spec: {{- if gt (len .Values.initContainers) 0 }} {{- toYaml .Values.initContainers | nindent 8 }} {{- end }} + {{- end }} containers: - name: {{ .Chart.Name }} securityContext: From 8e9d42acf7962aeddcd675c0dc18eee3da32bda7 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 21 Aug 2023 19:43:47 +0200 Subject: [PATCH 38/38] Bump spire Helm Chart version from 0.11.1 to 0.12.0 (#455) Please review the below changelog to ensure this matches up with the semantic version being applied. > **Note**: **Maintainers** ensure to run following after merging this PR to trigger the release workflow: > > ```shell > git checkout main > git pull > git checkout release > git pull > git merge main > git push > ``` **Changes in this release** * 5e2e8a91 Adds AWS KMS KeyManager support (#435) * 77fe43f3 Cron job to check for and update images (#249) * b7e15255 Allow job hooks to be disabled (#434) * 5e4cf6f5 Clarify project issues identified with nesting document (#450) * 72893515 Update spire bits to 1.7.2 (#452) * dc8a4545 Array spacing in values is incorrect in a file. (#451) * 94326d9c Fixup Helm docs * ae8941c4 Support Nested Spire with External Agent (#117) * f40743d4 Improve Tornjak documentation (#439) * 0124f633 Bypass example-test for docs only changes (#449) * 48a28980 Fix chainguard image references as per issue 442 (#443) * bd393e95 Bump test chart dependencies (#445) * a52818a7 Add a FAQ and switch rare issue from README to it (#437) * e60f5287 option to set KeyManager memory in spire server (#444) * a167ce68 Bump actions/setup-go from 4.0.1 to 4.1.0 * e774584c Bump test chart dependencies (#426) * bfec27ef Fix jwtIssuer to allow for Uris including scheme (#425) * 7a6e4f8d Change Tornjak backend default port (#436) * 1e3039cc Bump spire Helm Chart version from 0.11.0 to 0.11.1 (#419) * d2e16062 issuer naming should respect issuer_name override (#378) * a2e5c36c Bump test chart dependencies (#416) * a09e054d support annotations so oidc can be annotated (#391) * 7d94b105 Update spire to 1.7.1 (#412) * 9f4d4ace Add aws_pca to the spire-server (#404) * af13f1fc Bump test chart dependencies (#401) * 9a6768bc Add support for disabling container selectors (#399) * 4687e20d Merge pull request #315 from spiffe/persistence-type * e16210c6 Merge branch 'main' into persistence-type * 624ca9cc Remove misadded lockfile (#400) * 7ce67c62 Bump actions/checkout from 3.5.2 to 3.5.3 (#395) * b85ba64d Bump helm/kind-action from 1.7.0 to 1.8.0 (#396) * a6bdb4d1 Add persistence type flag Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 3aa7355..e5619d6 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -3,7 +3,7 @@ name: spire description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.11.1 +version: 0.12.0 appVersion: "1.7.2" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire diff --git a/charts/spire/README.md b/charts/spire/README.md index a1fafe4..b7c72ab 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -2,7 +2,7 @@ -![Version: 0.11.1](https://img.shields.io/badge/Version-0.11.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) +![Version: 0.12.0](https://img.shields.io/badge/Version-0.12.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.