From 5e430f49fa23ae19e015f045ce67e07beeb164c7 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Sun, 10 Mar 2024 23:07:20 -0700 Subject: [PATCH 01/13] Fix issue with tests not running on automated PRs (#266) * Use github app for version checker Signed-off-by: Faisal Memon * Use full version Signed-off-by: Faisal Memon --------- Signed-off-by: Faisal Memon --- .github/workflows/check-versions.yaml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/check-versions.yaml b/.github/workflows/check-versions.yaml index 47338ae..9509f8c 100644 --- a/.github/workflows/check-versions.yaml +++ b/.github/workflows/check-versions.yaml @@ -59,11 +59,18 @@ jobs: ./.github/scripts/update-tags.sh git diff + - name: Generate Token + uses: tibdex/github-app-token@v2.1.0 + id: generate-token + with: + app_id: ${{ vars.APP_ID }} + private_key: ${{ secrets.APP_PRIVATE_KEY }} + - name: Create Pull Request id: cpr uses: peter-evans/create-pull-request@v6.0.1 with: - token: ${{ secrets.GITHUB_TOKEN }} + token: ${{ steps.generate-token.outputs.token }} title: Bump test chart dependencies branch: bump-test-chart-deps commit-message: Bump test chart dependencies From d96271c4a22009c03f9ba71eb843fe545222df90 Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Mon, 11 Mar 2024 11:22:45 +0100 Subject: [PATCH 02/13] Bump test chart dependencies (#282) Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> --- .github/tests/charts.json | 8 ++++---- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 9 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 0aa00f7..430f343 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,12 +2,12 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "56.20.0" + "version": "57.0.1" }, { "name": "cert-manager", "repo": "https://charts.jetstack.io", - "version": "v1.14.3" + "version": "v1.14.4" }, { "name": "ingress-nginx", @@ -17,11 +17,11 @@ { "name": "mysql", "repo": "https://charts.bitnami.com/bitnami", - "version": "9.22.0" + "version": "9.23.0" }, { "name": "postgresql", "repo": "https://charts.bitnami.com/bitnami", - "version": "14.2.3" + "version": "14.3.1" } ] diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 0dc9cd0..701303d 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -115,11 +115,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:81f0b434b297453ff101de0b5f4f5cd8d4af1c015a1d34162e9ae9a4a9f38669` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:606810cf1076a226dfb85fa4102ee0ed2d8e2b7c7a8a2a53f9788c65501ecca8` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f1d55af8b49c9d6aa90cc0d7a4fc9643f14b4aecd1c89aa86205ce42b9a96ad1` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index a7dfd10..0513fb2 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -328,7 +328,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:81f0b434b297453ff101de0b5f4f5cd8d4af1c015a1d34162e9ae9a4a9f38669 + tag: latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -340,7 +340,7 @@ tests: registry: cgr.dev repository: chainguard/slim-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:606810cf1076a226dfb85fa4102ee0ed2d8e2b7c7a8a2a53f9788c65501ecca8 + tag: latest@sha256:f1d55af8b49c9d6aa90cc0d7a4fc9643f14b4aecd1c89aa86205ce42b9a96ad1 step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index c4b10d2..460210b 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -69,12 +69,12 @@ A Helm chart to install the SPIRE agent. | `waitForIt.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` | | `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:caead414307e81dbdd86d30662fdfe1b999dd4ce8a10fa667dab3438d0eed193` | +| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a6df2874eca1862fe00e09c0fa8481b95b432a8e18455954d48a034e006ed3e1` | | `waitForIt.resources` | Resource requests and limits | `{}` | | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:81f0b434b297453ff101de0b5f4f5cd8d4af1c015a1d34162e9ae9a4a9f38669` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` | @@ -110,7 +110,7 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `Always` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:81f0b434b297453ff101de0b5f4f5cd8d4af1c015a1d34162e9ae9a4a9f38669` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e` | | `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index b0ddd5b..512e701 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -150,7 +150,7 @@ waitForIt: registry: cgr.dev repository: chainguard/wait-for-it pullPolicy: IfNotPresent - tag: latest@sha256:caead414307e81dbdd86d30662fdfe1b999dd4ce8a10fa667dab3438d0eed193 + tag: latest@sha256:a6df2874eca1862fe00e09c0fa8481b95b432a8e18455954d48a034e006ed3e1 ## @param waitForIt.resources [object] Resource requests and limits resources: {} @@ -167,7 +167,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:81f0b434b297453ff101de0b5f4f5cd8d4af1c015a1d34162e9ae9a4a9f38669 + tag: latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -275,7 +275,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:81f0b434b297453ff101de0b5f4f5cd8d4af1c015a1d34162e9ae9a4a9f38669 + tag: latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 64b0e02..b233852 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -357,4 +357,4 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:81f0b434b297453ff101de0b5f4f5cd8d4af1c015a1d34162e9ae9a4a9f38669` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 2029082..78ffd33 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -886,4 +886,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:81f0b434b297453ff101de0b5f4f5cd8d4af1c015a1d34162e9ae9a4a9f38669 + tag: latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 94e61ea..e52a4e3 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -98,4 +98,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:81f0b434b297453ff101de0b5f4f5cd8d4af1c015a1d34162e9ae9a4a9f38669` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 7e16f95..00757d5 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -154,4 +154,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:81f0b434b297453ff101de0b5f4f5cd8d4af1c015a1d34162e9ae9a4a9f38669 + tag: latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e From 16d4f7c23c90672c5e5cead86301afd3bd25012c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 13 Mar 2024 01:37:20 -0700 Subject: [PATCH 03/13] Bump peter-evans/create-pull-request from 6.0.1 to 6.0.2 (#283) Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 6.0.1 to 6.0.2. - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](https://github.com/peter-evans/create-pull-request/compare/v6.0.1...v6.0.2) --- updated-dependencies: - dependency-name: peter-evans/create-pull-request dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/check-versions.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check-versions.yaml b/.github/workflows/check-versions.yaml index 9509f8c..4905cb6 100644 --- a/.github/workflows/check-versions.yaml +++ b/.github/workflows/check-versions.yaml @@ -68,7 +68,7 @@ jobs: - name: Create Pull Request id: cpr - uses: peter-evans/create-pull-request@v6.0.1 + uses: peter-evans/create-pull-request@v6.0.2 with: token: ${{ steps.generate-token.outputs.token }} title: Bump test chart dependencies From ef610df51f1813922994096b8cfe3c9dfb58df4e Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Wed, 13 Mar 2024 13:36:19 -0700 Subject: [PATCH 04/13] Complete Server K8S PSAT support (#242) * Complete Server K8S PSAT support Add all the SPIRE Server supported options for the K8S PSAT attestor. This retains the ease of use for configuring local cluster support while adding the ability to configure multiple/external clusters as well. Kubeconfig support is added in its own config block as it will be used/shared with spire-controller-manager support in the future. Signed-off-by: Kevin Fox * Fix merge conflict Signed-off-by: Kevin Fox * Add support for integration tests in the tests/integration dir Signed-off-by: Kevin Fox * Fix split issue and typo Signed-off-by: Kevin Fox * Add basic psat test Signed-off-by: Kevin Fox * Fix linter Signed-off-by: Kevin Fox * Fix up test Signed-off-by: Kevin Fox * Add missing file Signed-off-by: Kevin Fox * Better encode config Signed-off-by: Kevin Fox * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Update docs Signed-off-by: Kevin Fox * Apply suggestions from code review Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix docs Signed-off-by: Kevin Fox * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix docs Signed-off-by: Kevin Fox * Update default Signed-off-by: Kevin Fox * Fix config file layout. Incorperate feedback. Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Fix up kind Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon --- charts/spire/charts/spire-server/README.md | 10 +++ .../spire-server/templates/configmap.yaml | 40 +++++++++-- .../templates/kubeconfig-secret.yaml | 19 ++++++ .../spire-server/templates/statefulset.yaml | 10 +++ charts/spire/charts/spire-server/values.yaml | 33 ++++++++++ tests/integration/psat/kind-config.yaml | 7 ++ tests/integration/psat/run-tests.sh | 66 +++++++++++++++++++ tests/integration/psat/values.yaml | 12 ++++ 8 files changed, 192 insertions(+), 5 deletions(-) create mode 100644 charts/spire/charts/spire-server/templates/kubeconfig-secret.yaml create mode 100644 tests/integration/psat/kind-config.yaml create mode 100755 tests/integration/psat/run-tests.sh create mode 100644 tests/integration/psat/values.yaml diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index b233852..c04ec19 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -296,6 +296,15 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` | | `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` | | `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` | +| `nodeAttestor.k8sPsat.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` | +| `nodeAttestor.k8sPsat.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` | +| `nodeAttestor.k8sPsat.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` | +| `nodeAttestor.externalK8sPsat.enabled` | Enable PSAT k8s nodeattestor for external Kubernetes clusters | `true` | +| `nodeAttestor.externalK8sPsat.defaults.serviceAccountAllowList` | Allowed service accounts for PSAT node attestor | `[]` | +| `nodeAttestor.externalK8sPsat.defaults.audience` | Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used | `[]` | +| `nodeAttestor.externalK8sPsat.defaults.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` | +| `nodeAttestor.externalK8sPsat.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` | +| `nodeAttestor.externalK8sPsat.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` | | `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` | | `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` | | `nodeAttestor.tpmDirect.image.registry` | The OCI registry to pull the image from | `docker.io` | @@ -358,3 +367,4 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e` | +| `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index f211981..743657d 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -95,16 +95,46 @@ plugins: plugin_data: {{ include "spire-server.datastore-config" . | nindent 10 }} - {{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.tpmDirect.enabled }} + {{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.externalK8sPsat.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.tpmDirect.enabled }} NodeAttestor: - {{- with .Values.nodeAttestor.k8sPsat }} - {{- if eq (.enabled | toString) "true" }} + {{- if or (eq (.Values.nodeAttestor.k8sPsat.enabled | toString) "true") (eq (.Values.nodeAttestor.externalK8sPsat.enabled | toString) "true") }} k8s_psat: plugin_data: clusters: - {{ include "spire-lib.cluster-name" $root }}: + {{- with .Values.nodeAttestor.k8sPsat }} + {{- if eq (.enabled | toString) "true" }} + - {{ include "spire-lib.cluster-name" $root }}: service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }} - {{- end }} + audience: {{ .audience }} + allowed_node_label_keys: + {{ toYaml .allowedNodeLabelKeys | nindent 14 }} + allowed_pod_label_keys: + {{ toYaml .allowedPodLabelKeys | nindent 14 }} + {{- end }} + {{- end }} + {{- if eq (.Values.nodeAttestor.externalK8sPsat.enabled | toString) "true" }} + {{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPsat.clusters }} + {{- $clusterDefaults := .Values.nodeAttestor.externalK8sPsat.defaults }} + {{- range $name, $_ := $clusters }} + {{- $clusterSettings := dict }} + {{- if hasKey $root.Values.nodeAttestor.externalK8sPsat.clusters $name }} + {{- $clusterSettings = index $root.Values.nodeAttestor.externalK8sPsat.clusters $name }} + {{- end }} + - {{ $name }}: + {{- if hasKey $clusterSettings "kubeConfigName" }} + kube_config_file: /kubeconfigs/{{ $clusterSettings.kubeConfigName }} + {{- else }} + kube_config_file: /kubeconfigs/{{ $name }} + {{- end }} + service_account_allow_list: + {{ if hasKey $clusterSettings "serviceAccountAllowList" }}{{ toYaml $clusterSettings.serviceAccountAllowList | nindent 14 }}{{ else }}{{ toYaml $clusterDefaults.serviceAccountAllowList | nindent 14 }}{{ end }} + audience: {{ if hasKey $clusterSettings "audience" }}{{ $clusterSettings.audience }}{{ else }}{{ $clusterDefaults.audience }}{{ end }} + allowed_node_label_keys: + {{ if hasKey $clusterSettings "allowedNodeLabelKeys" }}{{ toYaml $clusterSettings.allowedNodeLabelKeys | nindent 14 }}{{ else }}{{ toYaml $clusterDefaults.allowedNodeLabelKeys | nindent 14 }}{{ end }} + allowed_pod_label_keys: + {{ if hasKey $clusterSettings "allowedPodLabelKeys" }}{{ toYaml $clusterSettings.allowedPodLabelKeys | nindent 14 }}{{ else }}{{ toYaml $clusterDefaults.allowedPodLabelKeys | nindent 14 }}{{ end }} + {{- end }} + {{- end }} {{- end }} {{- with .Values.nodeAttestor.joinToken }} {{- if eq (.enabled | toString) "true" }} diff --git a/charts/spire/charts/spire-server/templates/kubeconfig-secret.yaml b/charts/spire/charts/spire-server/templates/kubeconfig-secret.yaml new file mode 100644 index 0000000..1a553d7 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/kubeconfig-secret.yaml @@ -0,0 +1,19 @@ +{{- $root := . }} +{{- with .Values.kubeConfigs }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "spire-server.fullname" $root }}-kubeconfigs + namespace: {{ include "spire-server.namespace" $root }} +data: + {{- range $name, $value := . }} + {{- if and (hasKey . "kubeConfig") (hasKey . "kubeConfigBase64") }} + {{- fail "You can not use both kubeConfig and kubeConfigBase64" }} + {{- end }} + {{- if (hasKey . "kubeConfig") }} + {{ $name }}: {{ .kubeConfig | b64enc }} + {{- else }} + {{ $name }}: {{ .kubeConfigBase64 | nospace }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 47f073a..2d3f48a 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -181,6 +181,11 @@ spec: - name: spire-data mountPath: /run/spire/data readOnly: false + {{- with .Values.kubeConfigs }} + - name: kubeconfigs + mountPath: /kubeconfigs + readOnly: true + {{- end }} {{- if .Values.nodeAttestor.tpmDirect.enabled }} - name: tpm-direct mountPath: /tpm @@ -362,6 +367,11 @@ spec: emptyDir: {} - name: spire-controller-manager-tmp emptyDir: {} + {{- if gt (len .Values.kubeConfigs) 0 }} + - name: kubeconfigs + secret: + secretName: {{ include "spire-server.fullname" . }}-kubeconfigs + {{- end }} {{- if .Values.nodeAttestor.tpmDirect.enabled }} - name: tpm-direct emptyDir: {} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 78ffd33..c3fffe8 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -700,6 +700,30 @@ nodeAttestor: enabled: true ## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor serviceAccountAllowList: [] + ## @param nodeAttestor.k8sPsat.audience [array] Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used + audience: ["spire-server"] + ## @param nodeAttestor.k8sPsat.allowedNodeLabelKeys [array] Node label keys considered for selectors + allowedNodeLabelKeys: [] + ## @param nodeAttestor.k8sPsat.allowedPodLabelKeys [array] Pod label keys considered for selectors + allowedPodLabelKeys: [] + externalK8sPsat: + ## @param nodeAttestor.externalK8sPsat.enabled Enable PSAT k8s nodeattestor for external Kubernetes clusters + enabled: true + defaults: + ## @param nodeAttestor.externalK8sPsat.defaults.serviceAccountAllowList [array] Allowed service accounts for PSAT node attestor + serviceAccountAllowList: ["spire-system:spire-agent-upstream"] + ## @param nodeAttestor.externalK8sPsat.defaults.audience [array] Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used + audience: ["spire-server"] + ## @param nodeAttestor.externalK8sPsat.defaults.allowedNodeLabelKeys [array] Node label keys considered for selectors + allowedNodeLabelKeys: [] + ## @param nodeAttestor.externalK8sPsat.defaults.allowedPodLabelKeys [array] Pod label keys considered for selectors + allowedPodLabelKeys: [] + ## @param nodeAttestor.externalK8sPsat.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. + clusters: {} + # clustera: + # kubeConfigName: foo + # serviceAccountAllowList: ["other-ns:other-agent"] + # clusterb: {} joinToken: ## @param nodeAttestor.joinToken.enabled Enable the join_token nodeattestor enabled: false @@ -887,3 +911,12 @@ tests: repository: chainguard/bash pullPolicy: IfNotPresent tag: latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e + +## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters +kubeConfigs: {} +# clustera: +# kubeConfig: | +# xxxxx +# xxxxx +# clusterb: +# kubeConfigBase64: eXl5Cnl5eQo= diff --git a/tests/integration/psat/kind-config.yaml b/tests/integration/psat/kind-config.yaml new file mode 100644 index 0000000..d85992a --- /dev/null +++ b/tests/integration/psat/kind-config.yaml @@ -0,0 +1,7 @@ +kind: Cluster +apiVersion: kind.x-k8s.io/v1alpha4 +networking: + apiServerAddress: "172.17.0.1" + apiServerPort: 7443 + podSubnet: "10.245.0.0/16" + serviceSubnet: "10.97.0.0/12" diff --git a/tests/integration/psat/run-tests.sh b/tests/integration/psat/run-tests.sh new file mode 100755 index 0000000..bbcc22d --- /dev/null +++ b/tests/integration/psat/run-tests.sh @@ -0,0 +1,66 @@ +#!/usr/bin/env bash + +set -xe + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +TESTDIR="${SCRIPTPATH}/../../../.github/tests" +DEPS="${TESTDIR}/dependencies" + +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../../../.github/scripts/parse-versions.sh" +# shellcheck source=/dev/null +source "${TESTDIR}/common.sh" + +CLEANUP=1 + +for i in "$@"; do + case $i in + -c) + CLEANUP=0 + shift # past argument=value + ;; + esac +done + +teardown() { + print_helm_releases + print_spire_workload_status spire-root-server + print_spire_workload_status spire-server spire-system + + if [[ "$1" -ne 0 ]]; then + get_namespace_details spire-root-server + get_namespace_details spire-server spire-system + fi + + if [ "${CLEANUP}" -eq 1 ]; then + helm uninstall --namespace spire-server spire 2>/dev/null || true + kubectl delete ns spire-server 2>/dev/null || true + kubectl delete ns spire-system 2>/dev/null || true + + helm uninstall --namespace mysql spire-root-server 2>/dev/null || true + kubectl delete ns spire-root-server 2>/dev/null || true + fi +} + +trap 'EC=$? && trap - SIGTERM && teardown $EC' SIGINT SIGTERM EXIT + +kubectl create namespace spire-system --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true +kubectl create namespace spire-server --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted || true + +helm upgrade --install --create-namespace spire charts/spire \ + --namespace spire-root-server \ + --values "${DEPS}/spire-root-server-values.yaml" \ + --wait + +kind create cluster --name other --kubeconfig "${SCRIPTPATH}/kubeconfig" --config "${SCRIPTPATH}/kind-config.yaml" +md5sum "${SCRIPTPATH}/kubeconfig" +wc -l "${SCRIPTPATH}/kubeconfig" +KCB64="$(base64 < "${SCRIPTPATH}/kubeconfig" | tr '\n' ' ' | sed 's/ //g')" + +helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml" \ + --wait spire charts/spire --set "spire-server.kubeConfigs.other.kubeConfigBase64=$KCB64" +helm test --namespace spire-server spire + diff --git a/tests/integration/psat/values.yaml b/tests/integration/psat/values.yaml new file mode 100644 index 0000000..fbb7b55 --- /dev/null +++ b/tests/integration/psat/values.yaml @@ -0,0 +1,12 @@ +global: + spire: + recommendations: + enabled: true + clusterName: production + trustDomain: production.other + +spire-server: + ca_subject: + country: US + organization: Production + common_name: production.other From 36e931572ed7cb0b6817ebe8f9478d33124bd32f Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Wed, 13 Mar 2024 14:07:53 -0700 Subject: [PATCH 05/13] Add external k8s bundler (#270) * Complete Server K8S PSAT support Add all the SPIRE Server supported options for the K8S PSAT attestor. This retains the ease of use for configuring local cluster support while adding the ability to configure multiple/external clusters as well. Kubeconfig support is added in its own config block as it will be used/shared with spire-controller-manager support in the future. Signed-off-by: Kevin Fox * Fix merge conflict Signed-off-by: Kevin Fox * Add support for integration tests in the tests/integration dir Signed-off-by: Kevin Fox * Fix split issue and typo Signed-off-by: Kevin Fox * Add basic psat test Signed-off-by: Kevin Fox * Fix linter Signed-off-by: Kevin Fox * Fix up test Signed-off-by: Kevin Fox * Add missing file Signed-off-by: Kevin Fox * Better encode config Signed-off-by: Kevin Fox * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Update docs Signed-off-by: Kevin Fox * Apply suggestions from code review Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix docs Signed-off-by: Kevin Fox * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix docs Signed-off-by: Kevin Fox * Add external k8s bundler Adds support to sync the CA bundle to configmaps in external Kubernetes clusters Signed-off-by: Kevin Fox * Update default Signed-off-by: Kevin Fox * Fix config file layout. Incorperate feedback. Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Update based on parent pr feedback Signed-off-by: Kevin Fox * Reformat config file Signed-off-by: Kevin Fox * Fix some things Signed-off-by: Kevin Fox * Reconfigure kind Signed-off-by: Kevin Fox * More debugging Signed-off-by: Kevin Fox * Fix up kind Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon --- charts/spire/charts/spire-server/README.md | 6 +++++ .../spire-server/templates/configmap.yaml | 24 +++++++++++++++++++ charts/spire/charts/spire-server/values.yaml | 17 +++++++++++++ tests/integration/psat/run-tests.sh | 4 +++- 4 files changed, 50 insertions(+), 1 deletion(-) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index c04ec19..28105ea 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -223,7 +223,13 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `upstreamAuthority.vault.k8sAuth.k8sAuthRoleName` | Required - Name of the Vault role. The plugin authenticates against the named role | `""` | | `upstreamAuthority.vault.k8sAuth.token.audience` | Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info. | `vault` | | `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` | +| `notifier.k8sbundle.enabled` | Enable local k8s bundle uploader | `true` | | `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` | +| `notifier.externalK8sBundle.enabled` | Enable exernal k8s bundle uploader | `true` | +| `notifier.externalK8sBundle.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` | +| `notifier.externalK8sBundle.defaults.configMap` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` | +| `notifier.externalK8sBundle.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `bundle.crt` | +| `notifier.externalK8sBundle.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` | | `controllerManager.enabled` | Flag to enable controller manager | `false` | | `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` | | `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 743657d..8ee8d5e 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -205,11 +205,35 @@ plugins: {{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }} {{- end }} + {{- if or .Values.notifier.k8sbundle.enabled .Values.notifier.externalK8sBundle.enabled }} Notifier: k8sbundle: plugin_data: + {{- if eq (.Values.notifier.k8sbundle.enabled | toString) "true" }} namespace: {{ include "spire-server.bundle-namespace" . | quote }} config_map: {{ include "spire-lib.bundle-configmap" . | quote }} + {{- end }} + {{- $clusters := default .Values.kubeConfigs .Values.notifier.externalK8sBundle.clusters }} + {{- if and (eq (.Values.notifier.externalK8sBundle.enabled | toString) "true") (ne (len $clusters) 0) }} + clusters: + - "": + {{- $clusterDefaults := .Values.notifier.externalK8sBundle.defaults }} + {{- range $name, $_ := $clusters }} + {{- $clusterSettings := dict }} + {{- if hasKey $root.Values.notifier.externalK8sBundle.clusters $name }} + {{- $clusterSettings = index $root.Values.notifier.externalK8sBundle.clusters $name }} + {{- end }} + {{- if hasKey $clusterSettings "kubeConfigName" }} + - kube_config_file_path: /kubeconfigs/{{ $clusterSettings.kubeConfigName }} + {{- else }} + - kube_config_file_path: /kubeconfigs/{{ $name }} + {{- end }} + namespace: {{ if hasKey $clusterSettings "namespace" }}{{ $clusterSettings.namespace }}{{ else }}{{ $clusterDefaults.namespace }}{{ end }} + config_map: {{ if hasKey $clusterSettings "configMap" }}{{ $clusterSettings.configMap }}{{ else }}{{ $clusterDefaults.configMap }}{{ end }} + config_map_key: {{ if hasKey $clusterSettings "configMapKey" }}{{ $clusterSettings.configMapKey }}{{ else }}{{ $clusterDefaults.configMapKey }}{{ end }} + {{- end }} + {{- end }} + {{- end }} {{- with .Values.upstreamAuthority.disk }} {{- if eq (.enabled | toString) "true" }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index c3fffe8..12ca6ed 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -423,8 +423,25 @@ upstreamAuthority: notifier: k8sbundle: + ## @param notifier.k8sbundle.enabled Enable local k8s bundle uploader + enabled: true ## @param notifier.k8sbundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace namespace: "" + externalK8sBundle: + ## @param notifier.externalK8sBundle.enabled Enable exernal k8s bundle uploader + enabled: true + defaults: + ## @param notifier.externalK8sBundle.defaults.namespace Namespace to push the bundle into on clusters + namespace: "spire-system" + ## @param notifier.externalK8sBundle.defaults.configMap ConfigMap name to push the bundle into on external clusters + configMap: "spire-bundle-upstream" + ## @param notifier.externalK8sBundle.defaults.configMapKey ConfigMap key to push the bundle into on external clusters + configMapKey: "bundle.crt" + ## @param notifier.externalK8sBundle.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. + clusters: {} + # clustera: + # namespace: foo + # clusterb: {} controllerManager: ## @param controllerManager.enabled Flag to enable controller manager diff --git a/tests/integration/psat/run-tests.sh b/tests/integration/psat/run-tests.sh index bbcc22d..6b7785a 100755 --- a/tests/integration/psat/run-tests.sh +++ b/tests/integration/psat/run-tests.sh @@ -59,8 +59,10 @@ kind create cluster --name other --kubeconfig "${SCRIPTPATH}/kubeconfig" --confi md5sum "${SCRIPTPATH}/kubeconfig" wc -l "${SCRIPTPATH}/kubeconfig" KCB64="$(base64 < "${SCRIPTPATH}/kubeconfig" | tr '\n' ' ' | sed 's/ //g')" +kubectl --kubeconfig "${SCRIPTPATH}/kubeconfig" create namespace spire-system +kubectl --kubeconfig "${SCRIPTPATH}/kubeconfig" create configmap -n spire-system spire-bundle-upstream helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml" \ --wait spire charts/spire --set "spire-server.kubeConfigs.other.kubeConfigBase64=$KCB64" helm test --namespace spire-server spire - +kubectl --kubeconfig "${SCRIPTPATH}/kubeconfig" get configmap -n spire-system spire-bundle-upstream From e1d4fe1360fc625ae798568611b956d4f7291f51 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 14 Mar 2024 02:34:25 -0700 Subject: [PATCH 06/13] Bump helm.sh/helm/v3 from 3.14.2 to 3.14.3 in /tests (#285) Bumps [helm.sh/helm/v3](https://github.com/helm/helm) from 3.14.2 to 3.14.3. - [Release notes](https://github.com/helm/helm/releases) - [Commits](https://github.com/helm/helm/compare/v3.14.2...v3.14.3) --- updated-dependencies: - dependency-name: helm.sh/helm/v3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- tests/go.mod | 2 +- tests/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/go.mod b/tests/go.mod index 5ce11f2..c233f3b 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -7,7 +7,7 @@ toolchain go1.21.5 require ( github.com/onsi/ginkgo/v2 v2.16.0 github.com/onsi/gomega v1.31.1 - helm.sh/helm/v3 v3.14.2 + helm.sh/helm/v3 v3.14.3 ) require ( diff --git a/tests/go.sum b/tests/go.sum index e034fa8..79ec414 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -212,8 +212,8 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -helm.sh/helm/v3 v3.14.2 h1:V71fv+NGZv0icBlr+in1MJXuUIHCiPG1hW9gEBISTIA= -helm.sh/helm/v3 v3.14.2/go.mod h1:2itvvDv2WSZXTllknfQo6j7u3VVgMAvm8POCDgYH424= +helm.sh/helm/v3 v3.14.3 h1:HmvRJlwyyt9HjgmAuxHbHv3PhMz9ir/XNWHyXfmnOP4= +helm.sh/helm/v3 v3.14.3/go.mod h1:v6myVbyseSBJTzhmeE39UcPLNv6cQK6qss3dvgAySaE= k8s.io/api v0.29.0 h1:NiCdQMY1QOp1H8lfRyeEf8eOwV6+0xA6XEE44ohDX2A= k8s.io/api v0.29.0/go.mod h1:sdVmXoz2Bo/cb77Pxi71IPTSErEW32xa4aXwKH7gfBA= k8s.io/apiextensions-apiserver v0.29.0 h1:0VuspFG7Hj+SxyF/Z/2T0uFbI5gb5LRgEyUVE3Q4lV0= From e423bee85fa4a309051c44e32dd3a0804aa31a75 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 14 Mar 2024 02:39:20 -0700 Subject: [PATCH 07/13] Bump docker/login-action from 3.0.0 to 3.1.0 (#286) Bumps [docker/login-action](https://github.com/docker/login-action) from 3.0.0 to 3.1.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/v3...v3.1.0) --- updated-dependencies: - dependency-name: docker/login-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/helm-release.yaml | 2 +- .github/workflows/update-devcontainer-image.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml index b56c6bc..7308609 100644 --- a/.github/workflows/helm-release.yaml +++ b/.github/workflows/helm-release.yaml @@ -44,7 +44,7 @@ jobs: CR_TOKEN: '${{ secrets.GITHUB_TOKEN }}' - name: Login to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@v3.1.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/update-devcontainer-image.yaml b/.github/workflows/update-devcontainer-image.yaml index 596f41d..15f81d2 100644 --- a/.github/workflows/update-devcontainer-image.yaml +++ b/.github/workflows/update-devcontainer-image.yaml @@ -31,7 +31,7 @@ jobs: - name: Install regctl uses: regclient/actions/regctl-installer@b6614f5f56245066b533343a85f4109bdc38c8cc # main - name: Log in to GHCR - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0 with: registry: ghcr.io username: ${{ github.actor }} From 5299642afa7ba81294a20bff8425decc7ecc8eac Mon Sep 17 00:00:00 2001 From: marcofranssen <694733+marcofranssen@users.noreply.github.com> Date: Mon, 18 Mar 2024 08:03:39 +0000 Subject: [PATCH 08/13] Bump test chart dependencies Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- .github/tests/charts.json | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 9 files changed, 16 insertions(+), 16 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 430f343..221f97e 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "57.0.1" + "version": "57.0.3" }, { "name": "cert-manager", @@ -22,6 +22,6 @@ { "name": "postgresql", "repo": "https://charts.bitnami.com/bitnami", - "version": "14.3.1" + "version": "14.3.3" } ] diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 701303d..e5eb881 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -115,11 +115,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d69268f206bc7914c25f7377309a73406517678458ebccec0e6bfab7b9b7e9d2` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f1d55af8b49c9d6aa90cc0d7a4fc9643f14b4aecd1c89aa86205ce42b9a96ad1` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:faaccf708167925bbbf1dbfcbaf6ab733a170074bce7901542a0c38b87838842` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 0513fb2..728a837 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -328,7 +328,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e + tag: latest@sha256:d69268f206bc7914c25f7377309a73406517678458ebccec0e6bfab7b9b7e9d2 toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -340,7 +340,7 @@ tests: registry: cgr.dev repository: chainguard/slim-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:f1d55af8b49c9d6aa90cc0d7a4fc9643f14b4aecd1c89aa86205ce42b9a96ad1 + tag: latest@sha256:faaccf708167925bbbf1dbfcbaf6ab733a170074bce7901542a0c38b87838842 step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 460210b..3fdc58f 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -69,12 +69,12 @@ A Helm chart to install the SPIRE agent. | `waitForIt.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` | | `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a6df2874eca1862fe00e09c0fa8481b95b432a8e18455954d48a034e006ed3e1` | +| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:1f449e8972f7ffc876cafae20f58e2ff9015141b02cfc637a71ce9a5dddd73ba` | | `waitForIt.resources` | Resource requests and limits | `{}` | | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d69268f206bc7914c25f7377309a73406517678458ebccec0e6bfab7b9b7e9d2` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` | @@ -110,7 +110,7 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `Always` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d69268f206bc7914c25f7377309a73406517678458ebccec0e6bfab7b9b7e9d2` | | `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 512e701..030292a 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -150,7 +150,7 @@ waitForIt: registry: cgr.dev repository: chainguard/wait-for-it pullPolicy: IfNotPresent - tag: latest@sha256:a6df2874eca1862fe00e09c0fa8481b95b432a8e18455954d48a034e006ed3e1 + tag: latest@sha256:1f449e8972f7ffc876cafae20f58e2ff9015141b02cfc637a71ce9a5dddd73ba ## @param waitForIt.resources [object] Resource requests and limits resources: {} @@ -167,7 +167,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e + tag: latest@sha256:d69268f206bc7914c25f7377309a73406517678458ebccec0e6bfab7b9b7e9d2 ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -275,7 +275,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e + tag: latest@sha256:d69268f206bc7914c25f7377309a73406517678458ebccec0e6bfab7b9b7e9d2 ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 28105ea..1c6d8fa 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -372,5 +372,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d69268f206bc7914c25f7377309a73406517678458ebccec0e6bfab7b9b7e9d2` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 12ca6ed..e32e11a 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -927,7 +927,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e + tag: latest@sha256:d69268f206bc7914c25f7377309a73406517678458ebccec0e6bfab7b9b7e9d2 ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index e52a4e3..493a69d 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -98,4 +98,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d69268f206bc7914c25f7377309a73406517678458ebccec0e6bfab7b9b7e9d2` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 00757d5..67acd5d 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -154,4 +154,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:e4e1f63802396154706a44017f23bd3bfba4f8684374c4c981ba7567636a948e + tag: latest@sha256:d69268f206bc7914c25f7377309a73406517678458ebccec0e6bfab7b9b7e9d2 From a8f7d897ca4c29ead09ffc1781f2de2da2f926e2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 19 Mar 2024 03:24:52 -0700 Subject: [PATCH 09/13] Bump github.com/onsi/gomega from 1.31.1 to 1.32.0 in /tests (#291) Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.31.1 to 1.32.0. - [Release notes](https://github.com/onsi/gomega/releases) - [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md) - [Commits](https://github.com/onsi/gomega/compare/v1.31.1...v1.32.0) --- updated-dependencies: - dependency-name: github.com/onsi/gomega dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- tests/go.mod | 4 ++-- tests/go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/tests/go.mod b/tests/go.mod index c233f3b..3537baa 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -6,7 +6,7 @@ toolchain go1.21.5 require ( github.com/onsi/ginkgo/v2 v2.16.0 - github.com/onsi/gomega v1.31.1 + github.com/onsi/gomega v1.32.0 helm.sh/helm/v3 v3.14.3 ) @@ -56,7 +56,7 @@ require ( golang.org/x/time v0.3.0 // indirect golang.org/x/tools v0.17.0 // indirect google.golang.org/appengine v1.6.7 // indirect - google.golang.org/protobuf v1.31.0 // indirect + google.golang.org/protobuf v1.33.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/tests/go.sum b/tests/go.sum index 79ec414..fb36ab3 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -92,8 +92,8 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/onsi/ginkgo/v2 v2.16.0 h1:7q1w9frJDzninhXxjZd+Y/x54XNjG/UlRLIYPZafsPM= github.com/onsi/ginkgo/v2 v2.16.0/go.mod h1:llBI3WDLL9Z6taip6f33H76YcWtJv+7R3HigUjbIBOs= -github.com/onsi/gomega v1.31.1 h1:KYppCUK+bUgAZwHOu7EXVBKyQA6ILvOESHkn/tgoqvo= -github.com/onsi/gomega v1.31.1/go.mod h1:y40C95dwAD1Nz36SsEnxvfFe8FFfNxzI5eJ0EYGyAy0= +github.com/onsi/gomega v1.32.0 h1:JRYU78fJ1LPxlckP6Txi/EYqJvjtMrDC04/MM5XRHPk= +github.com/onsi/gomega v1.32.0/go.mod h1:a4x4gW6Pz2yK1MAmvluYme5lvYTn61afQ2ETw/8n4Lg= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= @@ -196,8 +196,8 @@ google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= -google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8= -google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= +google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI= +google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= From 31fabd64691edbc2ec5c1428e1a37c9fa71ae37a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 19 Mar 2024 03:43:11 -0700 Subject: [PATCH 10/13] Bump github.com/onsi/ginkgo/v2 from 2.16.0 to 2.17.0 in /tests (#292) Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.16.0 to 2.17.0. - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](https://github.com/onsi/ginkgo/compare/v2.16.0...v2.17.0) --- updated-dependencies: - dependency-name: github.com/onsi/ginkgo/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- tests/go.mod | 2 +- tests/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/go.mod b/tests/go.mod index 3537baa..9cb21c3 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -5,7 +5,7 @@ go 1.21 toolchain go1.21.5 require ( - github.com/onsi/ginkgo/v2 v2.16.0 + github.com/onsi/ginkgo/v2 v2.17.0 github.com/onsi/gomega v1.32.0 helm.sh/helm/v3 v3.14.3 ) diff --git a/tests/go.sum b/tests/go.sum index fb36ab3..245df19 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -90,8 +90,8 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= -github.com/onsi/ginkgo/v2 v2.16.0 h1:7q1w9frJDzninhXxjZd+Y/x54XNjG/UlRLIYPZafsPM= -github.com/onsi/ginkgo/v2 v2.16.0/go.mod h1:llBI3WDLL9Z6taip6f33H76YcWtJv+7R3HigUjbIBOs= +github.com/onsi/ginkgo/v2 v2.17.0 h1:kdnunFXpBjbzN56hcJHrXZ8M+LOkenKA7NnBzTNigTI= +github.com/onsi/ginkgo/v2 v2.17.0/go.mod h1:llBI3WDLL9Z6taip6f33H76YcWtJv+7R3HigUjbIBOs= github.com/onsi/gomega v1.32.0 h1:JRYU78fJ1LPxlckP6Txi/EYqJvjtMrDC04/MM5XRHPk= github.com/onsi/gomega v1.32.0/go.mod h1:a4x4gW6Pz2yK1MAmvluYme5lvYTn61afQ2ETw/8n4Lg= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= From 72768ecdbc62df4b445b53d3e41597f0f780c5fa Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Wed, 20 Mar 2024 13:58:43 -0700 Subject: [PATCH 11/13] Support hybrid nodes with different attestors or config (#218) * Add direct tpm support for spire-agent Signed-off-by: Kevin Fox * Add fingerprinting support Signed-off-by: Kevin Fox * Add example Signed-off-by: Kevin Fox * Update charts/spire/charts/spire-agent/templates/configmap.yaml Signed-off-by: kfox1111 * Support hybrid nodes with different attestors In some clusters, you may have a mix of nodes with differing attestor needs. For example, some nodes have hardware TPMs and some without. This patch enables configuring multiple daemonsets for the agent that you can target to pools of nodes. Signed-off-by: Kevin Fox * Remove extra slash Signed-off-by: Kevin Fox * Update docs Signed-off-by: Kevin Fox * Update charts/spire/charts/spire-agent/templates/configmap.yaml Signed-off-by: kfox1111 * Fix broken tests Signed-off-by: Kevin Fox * Add daemonset labels Signed-off-by: Kevin Fox * Add temporary upgrade hook Signed-off-by: Kevin Fox * Fix docs Signed-off-by: Kevin Fox * Fix include Signed-off-by: Kevin Fox * Add missing values Signed-off-by: Kevin Fox * Fix perms, add upgrade note Signed-off-by: Kevin Fox * Fix hardcoded nodeAttestor and keyManager in spire-agent Fixes: https://github.com/spiffe/helm-charts-hardened/issues/220 Signed-off-by: Kevin Fox * Fix merge issues Signed-off-by: Kevin Fox * Fix unit tests Signed-off-by: Kevin Fox * Pass the agent's securityContext on to Kubernetes Currently its ignored. Signed-off-by: Kevin Fox * Update example to be usable Signed-off-by: Kevin Fox * Apply suggestions from code review Signed-off-by: kfox1111 * Update example Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Fix merge conflict issue Signed-off-by: Kevin Fox * Update to the newest release Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Apply suggestions from code review Signed-off-by: kfox1111 * Apply suggestions from code review Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix version numbers in docs Signed-off-by: Kevin Fox * Remove merge conflicted extra code Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon --- charts/spire/README.md | 6 +- charts/spire/charts/spire-agent/README.md | 6 ++ .../spire-agent/templates/configmap.yaml | 18 ++++- .../spire-agent/templates/daemonset.yaml | 20 ++++- .../templates/pre-upgrade-hook.yaml | 77 +++++++++++++++++++ charts/spire/charts/spire-agent/values.yaml | 31 ++++++++ examples/tpm-direct/different-nodes.yaml | 22 ++++++ examples/tpm-direct/same-nodes.yaml | 15 ++++ 8 files changed, 191 insertions(+), 4 deletions(-) create mode 100644 charts/spire/charts/spire-agent/templates/pre-upgrade-hook.yaml create mode 100644 examples/tpm-direct/different-nodes.yaml create mode 100644 examples/tpm-direct/same-nodes.yaml diff --git a/charts/spire/README.md b/charts/spire/README.md index 0135835..14a29d5 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -75,7 +75,11 @@ kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeid We only support upgrading one major version at a time. Version skipping isn't supported. -### 0.18.x +### 0.19.X + +- The spire-agent daemonset gained a new label. For those disabling the upgrade hooks, you need to delete the spire-agent daemonset before issuing the helm upgrade. + +### 0.18.X - SPIRE no longer emits x509UniqueIdentifiers in x509-SVIDS by default. The old behavior can be reenabled with spire-server.credentialComposer.uniqueID.enabled=true. See https://github.com/spiffe/spire/pull/4862 for details. - SPIRE agents will now automatically reattest when they can. The old behavior can be reenabled with spire-agent.disableReattestToRenew=true. See https://github.com/spiffe/spire/pull/4791 for details. diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 3fdc58f..f3af4ff 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -126,6 +126,12 @@ A Helm chart to install the SPIRE agent. | `experimental.enabled` | Allow configuration of experimental features | `false` | | `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` | | `experimental.featureFlags` | List of developer feature flags | `[]` | +| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` | +| `installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | +| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | +| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | +| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` | | `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` | | `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 1fb312b..4de965b 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -1,3 +1,4 @@ +{{- define "spire-agent.check-config-values" -}} {{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}} {{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}} {{- range $type, $tvals := .Values.customPlugins }} @@ -21,6 +22,7 @@ {{- if hasPrefix (.Values.socketPath | dir | clean) (.Values.sockets.hostBasePath | clean) }} {{- fail "The sockets.hostBasePath can not be located under the socketPath direcotry" }} {{- end }} +{{- end }} {{- define "spire-agent.yaml-config" -}} agent: {{- if .Values.disableReattestToRenew }} @@ -132,10 +134,22 @@ telemetry: port: {{ .Values.telemetry.prometheus.port }} {{- end }} {{- end }} +{{- $root := . }} +{{- range $name := (concat (list "default") (keys .Values.agents)) | uniq }} +{{- with (dict "Release" $root.Release "Chart" $root.Chart "Values" (deepCopy $root.Values)) }} +{{- $nameSuffix := "" }} +{{- if ne $name "default" }} +{{- $nameSuffix = printf "-%s" $name }} +{{- end }} +{{- if hasKey $root.Values.agents $name }} +{{- $_ := set . "Values" (mergeOverwrite .Values (index $root.Values.agents $name)) }} +{{- end }} +{{- include "spire-agent.check-config-values" . }} +--- apiVersion: v1 kind: ConfigMap metadata: - name: {{ include "spire-agent.fullname" . }} + name: {{ include "spire-agent.fullname" . }}{{ $nameSuffix }} namespace: {{ include "spire-agent.namespace" . }} {{- with .Values.configMap.annotations }} annotations: @@ -144,3 +158,5 @@ metadata: data: agent.conf: | {{- include "spire-lib.reformat-and-yaml2json" (dict "config" (include "spire-agent.yaml-config" .) "root" .) | nindent 4 }} +{{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index d94cd96..db8fe9d 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -1,4 +1,14 @@ {{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }} +{{- $root := . }} +{{- range $name := (concat (list "default") (keys .Values.agents)) | uniq }} +{{- with (dict "Release" $root.Release "Chart" $root.Chart "Values" (deepCopy $root.Values)) }} +{{- $nameSuffix := "" }} +{{- if ne $name "default" }} +{{- $nameSuffix = printf "-%s" $name }} +{{- end }} +{{- if hasKey $root.Values.agents $name }} +{{- $_ := set . "Values" (mergeOverwrite .Values (index $root.Values.agents $name)) }} +{{- end }} {{- $podSecurityContext := fromYaml (include "spire-lib.podsecuritycontext" .) }} {{- $mainSecurityContext := deepCopy .Values.securityContext }} {{- if .Values.nodeAttestor.tpmDirect.enabled }} @@ -8,17 +18,20 @@ {{- $cbh := eq (include "spire-agent.connect-by-hostname" .) "true" }} {{- $socketAlternateNames := index (include "spire-agent.socket-alternate-names" . | fromYaml) "names" }} {{- $socketPath := include "spire-agent.socket-path" . }} +--- apiVersion: apps/v1 kind: DaemonSet metadata: - name: {{ include "spire-agent.fullname" . }} + name: {{ include "spire-agent.fullname" . }}{{ $nameSuffix }} namespace: {{ include "spire-agent.namespace" . }} labels: {{- include "spire-agent.labels" . | nindent 4 }} + app.kubernetes.io/component: {{ $name }} spec: selector: matchLabels: {{- include "spire-agent.selectorLabels" . | nindent 6 }} + app.kubernetes.io/component: {{ $name }} {{- with .Values.updateStrategy }} updateStrategy: {{- if not (has .type (list "RollingUpdate" "OnDelete")) }} @@ -40,6 +53,7 @@ spec: {{- end }} labels: {{- include "spire-agent.selectorLabels" . | nindent 8 }} + app.kubernetes.io/component: {{ $name }} {{- with .Values.podLabels }} {{- toYaml . | nindent 8 }} {{- end }} @@ -257,7 +271,7 @@ spec: {{- if eq (len .Values.trustBundleURL) 0 }} - name: spire-bundle configMap: - name: {{ include "spire-lib.bundle-configmap" . }} + name: {{ include "spire-lib.bundle-configmap" . }}{{ $nameSuffix }} {{- end }} {{- if .Values.nodeAttestor.tpmDirect.enabled }} - name: tpm-direct @@ -287,3 +301,5 @@ spec: {{- if gt (len .Values.extraVolumes) 0 }} {{- toYaml .Values.extraVolumes | nindent 8 }} {{- end }} +{{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-agent/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-agent/templates/pre-upgrade-hook.yaml new file mode 100644 index 0000000..e28c2bc --- /dev/null +++ b/charts/spire/charts/spire-agent/templates/pre-upgrade-hook.yaml @@ -0,0 +1,77 @@ +{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} +{{- $ds := lookup "apps/v1" "DaemonSet" (include "spire-agent.namespace" .) (include "spire-agent.fullname" .) }} +{{- if and $ds (not (hasKey $ds.metadata.labels "app.kubernetes.io/component")) }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "spire-agent.serviceAccountName" . }}-pre-upgrade + namespace: {{ include "spire-agent.namespace" . }} + labels: + {{- include "spire-agent.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": pre-upgrade + "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "spire-agent.fullname" . }}-pre-upgrade + namespace: {{ include "spire-agent.namespace" . }} + annotations: + "helm.sh/hook": pre-upgrade + "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed +rules: + - apiGroups: ["apps"] + resources: ["daemonsets"] + resourceNames: [{{ include "spire-agent.fullname" . | quote }}] + verbs: ["get", "delete"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire-agent.fullname" . }}-pre-upgrade + namespace: {{ include "spire-agent.namespace" . }} + annotations: + "helm.sh/hook": pre-upgrade + "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed +subjects: + - kind: ServiceAccount + name: {{ include "spire-agent.serviceAccountName" . }}-pre-upgrade + namespace: {{ include "spire-agent.namespace" . }} +roleRef: + kind: Role + name: {{ include "spire-agent.fullname" . }}-pre-upgrade + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "spire-agent.fullname" . }}-pre-upgrade + namespace: {{ include "spire-agent.namespace" . }} + labels: + {{- include "spire-agent.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": pre-upgrade + "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed +spec: + template: + metadata: + name: {{ include "spire-agent.fullname" . }}-pre-upgrade + spec: + restartPolicy: Never + serviceAccountName: {{ include "spire-agent.serviceAccountName" . }}-pre-upgrade + securityContext: + {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} + containers: + - name: pre-upgrade + securityContext: + {{- include "spire-lib.securitycontext" . | nindent 10 }} + image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} + args: + - delete + - daemonset + - {{ include "spire-agent.fullname" . }} + - -n + - {{ include "spire-agent.namespace" . }} +{{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 030292a..ea10d12 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -328,6 +328,37 @@ experimental: ## @param experimental.featureFlags [array] List of developer feature flags featureFlags: [] +## @param agents Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors +agents: {} +# default: +# nodeSelector: +# tpm: without +# tpm: +# nodeSelector: +# tpm: with +# nodeAttestor: +# k8sPsat: +# enabled: false +# tpmDirect: +# enabled: true + +installAndUpgradeHook: + ## @param installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) + enabled: true + +tools: + kubectl: + ## @param tools.kubectl.image.registry The OCI registry to pull the image from + ## @param tools.kubectl.image.repository The repository within the registry + ## @param tools.kubectl.image.pullPolicy The image pull policy + ## @param tools.kubectl.image.tag Overrides the image tag whose default is the chart appVersion + ## + image: + registry: docker.io + repository: rancher/kubectl + pullPolicy: IfNotPresent + tag: "" + sockets: ## @param sockets.hostBasePath Path on which the agent socket is made available when admin.mountOnHost is true hostBasePath: /run/spire/agent/sockets diff --git a/examples/tpm-direct/different-nodes.yaml b/examples/tpm-direct/different-nodes.yaml new file mode 100644 index 0000000..86d913e --- /dev/null +++ b/examples/tpm-direct/different-nodes.yaml @@ -0,0 +1,22 @@ +spire-agent: + agents: + default: + nodeSelector: + tpm: without + tpm: + nodeSelector: + tpm: with + nodeAttestor: + k8sPsat: + enabled: false + tpmDirect: + enabled: true + +spire-server: + controllerManager: + # K8s labels have a 63 character limit. TPM hashes are 64 chars. So you need to label the node with two labels with half of the tpm's hash each. The 'node-restriction.kubernetes.io/' prefix is so that the + # nodes can't update the hash themselves, an important security constraint. + parentIDTemplate: 'spiffe://{{ .TrustDomain }}/spire/agent/{{if index .NodeMeta.Labels "node-restriction.kubernetes.io/tpm-pubhash"}}tpm/{{ index .NodeMeta.Labels "node-restriction.kubernetes.io/tpm-pubhash" }}{{ index .NodeMeta.Labels "node-restriction.kubernetes.io/tpm-pubhash2" }}{{ else }}spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}{{ end }}' + nodeAttestor: + tpmDirect: + enabled: true diff --git a/examples/tpm-direct/same-nodes.yaml b/examples/tpm-direct/same-nodes.yaml new file mode 100644 index 0000000..ab53a82 --- /dev/null +++ b/examples/tpm-direct/same-nodes.yaml @@ -0,0 +1,15 @@ +spire-agent: + nodeAttestor: + k8sPsat: + enabled: false + tpmDirect: + enabled: true + +spire-server: + controllerManager: + # K8s labels have a 63 character limit. TPM hashes are 64 chars. So you need to label the node with two labels with half of the tpm's hash each. The 'node-restriction.kubernetes.io/' prefix is so that the + # nodes can't update the hash themselves, an important security constraint. + parentIDTemplate: 'spiffe://{{ .TrustDomain }}/spire/agent/tpm/{{ index .NodeMeta.Labels "node-restriction.kubernetes.io/tpm-pubhash" }}{{ index .NodeMeta.Labels "node-restriction.kubernetes.io/tpm-pubhash2" }}' + nodeAttestor: + tpmDirect: + enabled: true From 993ee8582b563145ff979811cc47f4bdb8939794 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Wed, 20 Mar 2024 14:12:48 -0700 Subject: [PATCH 12/13] Change production example to be an integration test (#237) * Change production example to be an integration test The documentation is a better example then the test now. Separate the two. Signed-off-by: Kevin Fox * Fix job name reference Signed-off-by: Kevin Fox * Fix job name reference Signed-off-by: Kevin Fox * Update postgresql example Signed-off-by: Kevin Fox * Update mysql example Signed-off-by: Kevin Fox * Update nested and mysql Signed-off-by: Kevin Fox * Fix typo Signed-off-by: Kevin Fox * Add support for integration tests in the tests/integration dir Signed-off-by: Kevin Fox * Fix split issue and typo Signed-off-by: Kevin Fox * Fix split issue Signed-off-by: Kevin Fox * Try folding example your values into bash so that its not laying around in an fs for a user to accidently use. Signed-off-by: Kevin Fox * Fix test Signed-off-by: Kevin Fox * Fix test Signed-off-by: Kevin Fox * Fix test Signed-off-by: Kevin Fox * Fix test Signed-off-by: Kevin Fox * Fix test Signed-off-by: Kevin Fox * Fix test Signed-off-by: Kevin Fox * Cleanup Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon --- .github/tests/common.sh | 20 ++++++ .github/workflows/helm-chart-ci.yaml | 2 +- examples/external-mysql/README.md | 10 ++- examples/external-mysql/run-tests.sh | 2 +- examples/external-postgresql/README.md | 10 ++- examples/external-postgresql/run-tests.sh | 4 +- .../values-node-pod-antiaffinity.yaml | 0 examples/nested/run-tests.sh | 2 +- examples/production/README.md | 66 ------------------- examples/production/example-your-values.yaml | 22 ------- examples/production/values.yaml | 4 -- .../integration}/production/run-tests.sh | 8 +-- ...federation-https-spiffe-ingress-nginx.yaml | 0 ...se-federation-https-web-ingress-nginx.yaml | 0 ...oidc-discovery-provider-ingress-nginx.yaml | 0 ...ues-expose-spire-server-ingress-nginx.yaml | 0 16 files changed, 36 insertions(+), 114 deletions(-) rename examples/{production => misc}/values-node-pod-antiaffinity.yaml (100%) delete mode 100644 examples/production/README.md delete mode 100644 examples/production/example-your-values.yaml delete mode 100644 examples/production/values.yaml rename {examples => tests/integration}/production/run-tests.sh (95%) rename {examples => tests/integration}/production/values-expose-federation-https-spiffe-ingress-nginx.yaml (100%) rename {examples => tests/integration}/production/values-expose-federation-https-web-ingress-nginx.yaml (100%) rename {examples => tests/integration}/production/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml (100%) rename {examples => tests/integration}/production/values-expose-spire-server-ingress-nginx.yaml (100%) diff --git a/.github/tests/common.sh b/.github/tests/common.sh index 6cb4f6e..3211e38 100755 --- a/.github/tests/common.sh +++ b/.github/tests/common.sh @@ -70,3 +70,23 @@ $(helm ls -A | sed 's/\t/ | /g' | sed 's/^/| /' | sed 's/$/ |/' | sed '/^| NAME. EOF } + +# Used just for testing. You should provide your own values as described in the install instructions. +common_test_your_values () { +cat > /tmp/$$.example-your-values.yaml < Date: Fri, 22 Mar 2024 10:29:25 -0700 Subject: [PATCH 13/13] Bump spire Helm Chart version from 0.18.2 to 0.19.0 * 72768ec Support hybrid nodes with different attestors or config (#218) * 5299642 Bump test chart dependencies * 36e9315 Add external k8s bundler (#270) * ef610df Complete Server K8S PSAT support (#242) * d96271c Bump test chart dependencies (#282) Signed-off-by: Faisal Memon --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 0394d9c..f1bb437 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -3,7 +3,7 @@ name: spire description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.18.2 +version: 0.19.0 appVersion: "1.9.1" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire diff --git a/charts/spire/README.md b/charts/spire/README.md index 14a29d5..570d01a 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.18.2](https://img.shields.io/badge/Version-0.18.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.9.1](https://img.shields.io/badge/AppVersion-1.9.1-informational?style=flat-square) +![Version: 0.19.0](https://img.shields.io/badge/Version-0.19.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.9.1](https://img.shields.io/badge/AppVersion-1.9.1-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.