Merge branch 'main' into release
This commit is contained in:
Faisal Memon
@@ -2,7 +2,7 @@
|
||||
{
|
||||
"name": "kube-prometheus-stack",
|
||||
"repo": "https://prometheus-community.github.io/helm-charts",
|
||||
"version": "57.1.1"
|
||||
"version": "57.2.0"
|
||||
},
|
||||
{
|
||||
"name": "cert-manager",
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire
|
||||
description: >
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
type: application
|
||||
version: 0.19.1
|
||||
version: 0.19.2
|
||||
appVersion: "1.9.2"
|
||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# spire
|
||||
|
||||
  
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
@@ -40,10 +40,10 @@ global:
|
||||
commonName: example.org
|
||||
```
|
||||
|
||||
2. If you need a non default storageClass, append the following to the spire-server section and update:
|
||||
2. If you need a non default storageClass, append the following to the global.spire section and update:
|
||||
```
|
||||
persistence:
|
||||
storageClass: your-storage-class
|
||||
persistence:
|
||||
storageClass: your-storage-class
|
||||
```
|
||||
|
||||
3. If your Kubernetes cluster is OpenShift based, use the output of the following command to update the trustDomain setting:
|
||||
@@ -219,6 +219,7 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| `global.spire.caSubject.country` | Country for Spire server CA | `""` |
|
||||
| `global.spire.caSubject.organization` | Organization for Spire server CA | `""` |
|
||||
| `global.spire.caSubject.commonName` | Common Name for Spire server CA | `""` |
|
||||
| `global.spire.persistence.storageClass` | What storage class to use for persistence | `nil` |
|
||||
| `global.spire.recommendations.enabled` | Use recommended settings for production deployments. Default is off. | `false` |
|
||||
| `global.spire.recommendations.namespaceLayout` | Set to true to use recommended values for installing across namespaces | `true` |
|
||||
| `global.spire.recommendations.namespacePSS` | When chart namespace creation is enabled, label them with preffered Pod Security Standard labels | `true` |
|
||||
|
||||
@@ -115,7 +115,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3b5e8046bc76624f645b97684845c3aef3c27d001db0f3f71d1ffbdf885edea7` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5921884408efe50b77796675dc109ad2126f54476fe7403c37d8898a5ceb2e76` |
|
||||
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` |
|
||||
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
@@ -123,7 +123,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` |
|
||||
| `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.step.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.25.2` |
|
||||
| `tests.step.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.26.0` |
|
||||
| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` |
|
||||
| `tests.busybox.image.repository` | The repository within the registry | `busybox` |
|
||||
| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
|
||||
@@ -328,7 +328,7 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:3b5e8046bc76624f645b97684845c3aef3c27d001db0f3f71d1ffbdf885edea7
|
||||
tag: latest@sha256:5921884408efe50b77796675dc109ad2126f54476fe7403c37d8898a5ceb2e76
|
||||
|
||||
toolkit:
|
||||
## @param tests.toolkit.image.registry The OCI registry to pull the image from
|
||||
@@ -352,7 +352,7 @@ tests:
|
||||
registry: "docker.io"
|
||||
repository: smallstep/step-cli
|
||||
pullPolicy: IfNotPresent
|
||||
tag: 0.25.2
|
||||
tag: 0.26.0
|
||||
|
||||
busybox:
|
||||
## @param tests.busybox.image.registry The OCI registry to pull the image from
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire-agent
|
||||
description: A Helm chart to install the SPIRE agent.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.9.2"
|
||||
appVersion: "1.9.3"
|
||||
keywords: ["spiffe", "spire-agent"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -59,6 +59,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `server.address` | Address for Spire server | `""` |
|
||||
| `server.port` | Port number for Spire server | `8081` |
|
||||
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
||||
| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
||||
| `healthChecks.port` | override the host port used for health checking | `9982` |
|
||||
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
|
||||
| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` |
|
||||
@@ -69,7 +70,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3b5e8046bc76624f645b97684845c3aef3c27d001db0f3f71d1ffbdf885edea7` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5921884408efe50b77796675dc109ad2126f54476fe7403c37d8898a5ceb2e76` |
|
||||
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
|
||||
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` |
|
||||
@@ -105,7 +106,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3b5e8046bc76624f645b97684845c3aef3c27d001db0f3f71d1ffbdf885edea7` |
|
||||
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5921884408efe50b77796675dc109ad2126f54476fe7403c37d8898a5ceb2e76` |
|
||||
| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
|
||||
|
||||
@@ -103,6 +103,8 @@ Create the name of the service account to use
|
||||
{{- print .Values.global.spire.upstreamSpireAddress }}
|
||||
{{- else if .Values.server.address }}
|
||||
{{- .Values.server.address }}
|
||||
{{- else if .Values.server.nameOverride }}
|
||||
{{ .Release.Name }}-{{ .Values.server.nameOverride }}.{{ include "spire-agent.server.namespace" . }}
|
||||
{{- else }}
|
||||
{{ .Release.Name }}-server.{{ include "spire-agent.server.namespace" . }}
|
||||
{{- end }}
|
||||
|
||||
@@ -109,11 +109,13 @@ upstream: false
|
||||
## @param server.address Address for Spire server
|
||||
## @param server.port Port number for Spire server
|
||||
## @param server.namespaceOverride Override the namespace for Spire server
|
||||
## @param server.nameOverride Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align.
|
||||
##
|
||||
server:
|
||||
address: ""
|
||||
port: 8081
|
||||
namespaceOverride: ""
|
||||
nameOverride: ""
|
||||
|
||||
healthChecks:
|
||||
## @param healthChecks.port override the host port used for health checking
|
||||
@@ -152,7 +154,7 @@ fsGroupFix:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
tag: latest@sha256:3b5e8046bc76624f645b97684845c3aef3c27d001db0f3f71d1ffbdf885edea7
|
||||
tag: latest@sha256:5921884408efe50b77796675dc109ad2126f54476fe7403c37d8898a5ceb2e76
|
||||
|
||||
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
@@ -260,7 +262,7 @@ socketAlternate:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
tag: latest@sha256:3b5e8046bc76624f645b97684845c3aef3c27d001db0f3f71d1ffbdf885edea7
|
||||
tag: latest@sha256:5921884408efe50b77796675dc109ad2126f54476fe7403c37d8898a5ceb2e76
|
||||
|
||||
## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire-server
|
||||
description: A Helm chart to install the SPIRE server.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.9.2"
|
||||
appVersion: "1.9.3"
|
||||
keywords: ["spiffe", "spire-server", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -210,6 +210,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `upstreamAuthority.spire.enabled` | Flag to use another Spire install as upstream CA | `false` |
|
||||
| `upstreamAuthority.spire.upstreamDriver` | Driver for Spire as upstream CA | `""` |
|
||||
| `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | |
|
||||
| `upstreamAuthority.spire.server.nameOverride` | Override the name for upstream Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
||||
| `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` |
|
||||
| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `8081` |
|
||||
| `upstreamAuthority.vault.enabled` | Enable Hashicorp Vault as upstream CA | `false` |
|
||||
@@ -242,7 +243,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
||||
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.3` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.4` |
|
||||
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
||||
| `controllerManager.securityContext` | Security context | `{}` |
|
||||
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
||||
@@ -366,6 +367,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` |
|
||||
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
||||
| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` |
|
||||
| `experimental.eventsBasedCache` | Use events to update the cache with what's changed since the last update. | `false` |
|
||||
| `experimental.pruneEventsOlderThan` | How old an event can be before being deleted. Used with events based cache. | `12h` |
|
||||
| `experimental.featureFlags` | List of developer feature flags | `[]` |
|
||||
| `tests.hostAliases` | List of host aliases for testing | `[]` |
|
||||
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
|
||||
|
||||
@@ -212,6 +212,8 @@ Create the name of the service account to use
|
||||
{{- define "spire-server.upstream-spire-address" }}
|
||||
{{- if ne (len (dig "spire" "upstreamSpireAddress" "" .Values.global)) 0 }}
|
||||
{{- print .Values.global.spire.upstreamSpireAddress }}
|
||||
{{- else if .Values.upstreamAuthority.spire.server.nameOverride }}
|
||||
{{- printf "%s-%s" .Release.Name .Values.upstreamAuthority.spire.server.nameOverride }}
|
||||
{{- else }}
|
||||
{{- print .Values.upstreamAuthority.spire.server.address }}
|
||||
{{- end }}
|
||||
|
||||
@@ -75,6 +75,8 @@ server:
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
experimental:
|
||||
cache_reload_interval: {{ .cacheReloadInterval | quote }}
|
||||
events_based_cache: {{ .eventsBasedCache }}
|
||||
prune_events_older_than: {{ .pruneEventsOlderThan | quote }}
|
||||
{{- if gt (len .featureFlags) 0 }}
|
||||
feature_flags:
|
||||
{{- range .featureFlags }}
|
||||
|
||||
@@ -509,7 +509,8 @@ spec:
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size }}
|
||||
{{- if .Values.persistence.storageClass }}
|
||||
storageClassName: {{ .Values.persistence.storageClass }}
|
||||
{{- $storageClass := (dig "spire" "persistence" "storageClass" nil .Values.global) | default .Values.persistence.storageClass }}
|
||||
{{- if $storageClass }}
|
||||
storageClassName: {{ $storageClass }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -390,6 +390,8 @@ upstreamAuthority:
|
||||
upstreamDriver: ""
|
||||
## @extra upstreamAuthority.spire.server Server details for the Spire instance use as upstream CA
|
||||
server:
|
||||
## @param upstreamAuthority.spire.server.nameOverride Override the name for upstream Spire server. Should only be changed when building your own nested chart to ensure names align.
|
||||
nameOverride: ""
|
||||
## @param upstreamAuthority.spire.server.address Address for upstream Spire server
|
||||
address: ""
|
||||
## @param upstreamAuthority.spire.server.port Port for upstream Spire server
|
||||
@@ -480,7 +482,7 @@ controllerManager:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-controller-manager
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "0.4.3"
|
||||
tag: "0.4.4"
|
||||
|
||||
## @param controllerManager.resources [object] Resource requests and limits for controller manager
|
||||
resources: {}
|
||||
@@ -909,6 +911,10 @@ experimental:
|
||||
enabled: false
|
||||
## @param experimental.cacheReloadInterval The amount of time between two reloads of the in-memory entry cache.
|
||||
cacheReloadInterval: 5s
|
||||
## @param experimental.eventsBasedCache Use events to update the cache with what's changed since the last update.
|
||||
eventsBasedCache: false
|
||||
## @param experimental.pruneEventsOlderThan How old an event can be before being deleted. Used with events based cache.
|
||||
pruneEventsOlderThan: 12h
|
||||
## @param experimental.featureFlags [array] List of developer feature flags
|
||||
featureFlags: []
|
||||
|
||||
|
||||
@@ -98,4 +98,4 @@ port forwarding. See the chart NOTES output for more details.
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3b5e8046bc76624f645b97684845c3aef3c27d001db0f3f71d1ffbdf885edea7` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5921884408efe50b77796675dc109ad2126f54476fe7403c37d8898a5ceb2e76` |
|
||||
|
||||
@@ -154,4 +154,4 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:3b5e8046bc76624f645b97684845c3aef3c27d001db0f3f71d1ffbdf885edea7
|
||||
tag: latest@sha256:5921884408efe50b77796675dc109ad2126f54476fe7403c37d8898a5ceb2e76
|
||||
|
||||
@@ -29,6 +29,10 @@ global:
|
||||
organization: ""
|
||||
commonName: ""
|
||||
|
||||
persistence:
|
||||
## @param global.spire.persistence.storageClass What storage class to use for persistence
|
||||
storageClass: null
|
||||
|
||||
## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off.
|
||||
## @param global.spire.recommendations.namespaceLayout Set to true to use recommended values for installing across namespaces
|
||||
## @param global.spire.recommendations.namespacePSS When chart namespace creation is enabled, label them with preffered Pod Security Standard labels
|
||||
|
||||
Reference in New Issue
Block a user