From 811a2f6b013077405965e8ad685c428b31026e24 Mon Sep 17 00:00:00 2001
From: Pete Cable <petercable@gmail.com>
Date: Thu, 16 Mar 2023 12:36:13 -0700
Subject: [PATCH 01/33] Add option to enable federation on spire-server (#97)

---
 .github/tests/federation-bundle-endpoint/values.yaml  |  3 +++
 charts/spire/charts/spire-server/README.md            |  3 +++
 .../charts/spire-server/templates/configmap.yaml      | 11 +++++++++++
 .../spire/charts/spire-server/templates/service.yaml  |  8 ++++++++
 .../charts/spire-server/templates/statefulset.yaml    |  7 +++++++
 .../spire-server/templates/tests/test-connection.yaml |  8 ++++++++
 charts/spire/charts/spire-server/values.yaml          |  6 ++++++
 7 files changed, 46 insertions(+)
 create mode 100644 .github/tests/federation-bundle-endpoint/values.yaml

diff --git a/.github/tests/federation-bundle-endpoint/values.yaml b/.github/tests/federation-bundle-endpoint/values.yaml
new file mode 100644
index 0000000..6b7d104
--- /dev/null
+++ b/.github/tests/federation-bundle-endpoint/values.yaml
@@ -0,0 +1,3 @@
+spire-server:
+  federation:
+    enabled: true
diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index 38d021a..ac897b7 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -57,6 +57,9 @@ A Helm chart to install the SPIRE server.
 | extraContainers | list | `[]` |  |
 | extraVolumeMounts | list | `[]` |  |
 | extraVolumes | list | `[]` |  |
+| federation.bundleEndpoint.address | string | `"0.0.0.0"` |  |
+| federation.bundleEndpoint.port | int | `8443` |  |
+| federation.enabled | bool | `false` |  |
 | fullnameOverride | string | `""` |  |
 | image.pullPolicy | string | `"IfNotPresent"` |  |
 | image.registry | string | `"ghcr.io"` |  |
diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml
index 03f148a..31063da 100644
--- a/charts/spire/charts/spire-server/templates/configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/configmap.yaml
@@ -29,6 +29,17 @@ data:
         common_name = {{ .common_name | quote }},
         {{- end }}
       }
+
+      {{- with .Values.federation }}
+      {{- if eq (.enabled | toString) "true" }}
+      federation {
+        bundle_endpoint {
+          address = "{{ .bundleEndpoint.address }}"
+          port = {{ .bundleEndpoint.port }}
+        }
+      }
+      {{- end }}
+      {{- end }}
     }
 
     plugins {
diff --git a/charts/spire/charts/spire-server/templates/service.yaml b/charts/spire/charts/spire-server/templates/service.yaml
index a0cb1c2..5cdaf50 100644
--- a/charts/spire/charts/spire-server/templates/service.yaml
+++ b/charts/spire/charts/spire-server/templates/service.yaml
@@ -16,5 +16,13 @@ spec:
       port: {{ .Values.service.port }}
       targetPort: grpc
       protocol: TCP
+    {{- with .Values.federation }}
+    {{- if eq (.enabled | toString) "true" }}
+    - name: federation
+      port: {{ .bundleEndpoint.port }}
+      targetPort: federation
+      protocol: TCP
+    {{- end }}
+    {{- end }}
   selector:
     {{- include "spire-server.selectorLabels" . | nindent 4 }}
diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml
index cd18025..2773bf6 100644
--- a/charts/spire/charts/spire-server/templates/statefulset.yaml
+++ b/charts/spire/charts/spire-server/templates/statefulset.yaml
@@ -57,6 +57,13 @@ spec:
               protocol: TCP
             - containerPort: 8080
               name: healthz
+            {{- with .Values.federation }}
+            {{- if eq (.enabled | toString) "true" }}
+            - name: federation
+              containerPort: {{ .bundleEndpoint.port }}
+              protocol: TCP
+            {{- end }}
+            {{- end }}
             {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
             - containerPort: 9988
               name: prom
diff --git a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
index 432a583..4daa47d 100644
--- a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
+++ b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
@@ -17,4 +17,12 @@ spec:
       args: ['-zvw3', '{{ include "spire-server.fullname" . }}', '{{ .Values.service.port }}']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
+    {{- if eq (.Values.federation.enabled | toString) "true" }}
+    - name: wget-federation-bundle-endpoint
+      image: busybox
+      command: ['wget']
+      args: ['--no-check-certificate', '-O', '/dev/null', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.cluster.local:{{ .Values.federation.bundleEndpoint.port }}']
+      securityContext:
+        {{- toYaml .Values.securityContext | nindent 8 }}
+    {{- end }}
   restartPolicy: Never
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 5768c0b..5324b55 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -87,6 +87,12 @@ trustDomain: example.org
 
 bundleConfigMap: spire-server
 
+federation:
+  enabled: false
+  bundleEndpoint:
+    port: 8443
+    address: "0.0.0.0"
+
 ca_subject:
   country: NL
   organization: Example

From a516caa8a665b3b0d0dbb5bd7b8a2261d836b5ea Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@gmail.com>
Date: Fri, 17 Mar 2023 22:37:31 +0100
Subject: [PATCH 02/33] Remove k8s 1.21 from test matrix + small syntax error
 fix (#133)

- Remove k8s 1.21 from test matrix
- Fix syntax
- Improve readability test step

Officialy according to readme we support last three k8s versions.
Testing last 5 versions should be sufficient.

---------

Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 .github/workflows/helm-chart-ci.yaml | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml
index 7cee295..f4aa84f 100644
--- a/.github/workflows/helm-chart-ci.yaml
+++ b/.github/workflows/helm-chart-ci.yaml
@@ -116,7 +116,6 @@ jobs:
           - v1.24.7
           - v1.23.13
           - v1.22.15
-          - v1.21.14
         values:
           - ${{ fromJson(needs.build-matrix.outputs.tests) }}
 
@@ -152,18 +151,22 @@ jobs:
 
       - name: Run chart-testing (install)
         run: |
-          export scenario="$(basename "${TEST_DIR}")"
-          export EXTRA_HELM_ARGS=""
-          [ "${scenario}" != "default" ] && kubectl create namespace "${scenario}"
           post-install() {
             [ -x "${TEST_DIR}/post-install.sh" ] && "${TEST_DIR}/post-install.sh" $1
             exit $1
           }
+
           trap 'post-install $? $LINENO' EXIT
+
+          export scenario="$(basename "${TEST_DIR}")"
+          export EXTRA_HELM_ARGS=""
+
+          [ "${scenario}" != "default" ] && kubectl create namespace "${scenario}"
           [ -x "${TEST_DIR}/pre-install.sh" ] && "${TEST_DIR}/pre-install.sh"
           [ -f "${TEST_DIR}/.env" ] && source "${TEST_DIR}/.env"
-          if [ -x {${TEST_DIR}/install.sh ]; then
-            ./${TEST_DIR}/install.sh
+
+          if [ -x "${TEST_DIR}/install.sh" ]; then
+            "${TEST_DIR}/install.sh"
           else
             ct install --debug \
               --namespace "${scenario}" \

From 5b6708bb578f1871e5acff01001ca8c323f4add8 Mon Sep 17 00:00:00 2001
From: Dennis Gove <dpgove@gmail.com>
Date: Sat, 18 Mar 2023 18:12:44 -0400
Subject: [PATCH 03/33] Remove @dennisgove from CODEOWNERS (#140)

---
 CODEOWNERS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CODEOWNERS b/CODEOWNERS
index 0a45229..97468c2 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -2,6 +2,6 @@
 # the repo. Unless a later match takes precedence,
 # they will be requested for review when someone opens a 
 # pull request.
-*       @marcofranssen @Kfox1111 @developer-guy @dennisgove @dfeldman @faisal-memon @mrsabath
+*       @marcofranssen @Kfox1111 @developer-guy @dfeldman @faisal-memon @mrsabath
 
 # See CODEOWNERS syntax here: https://help.github.com/articles/about-codeowners/#codeowners-syntax

From 64d010757c44a28d7127181c3b0de3da533cb1f1 Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@gmail.com>
Date: Tue, 21 Mar 2023 12:39:59 +0100
Subject: [PATCH 04/33] Resolve issue in prod example on volume mount (#143)

---
 examples/production/README.md   | 8 +++++++-
 examples/production/values.yaml | 4 ++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/examples/production/README.md b/examples/production/README.md
index 77f3b78..4cf892c 100644
--- a/examples/production/README.md
+++ b/examples/production/README.md
@@ -1,8 +1,14 @@
-Install with something similar to:
+# Recommended production setup
 
+Too install Spire with the least privileges possible we deploy spire accross 2 namespaces.
+
+```shell
 kubectl create namespace "spire-system"
 kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
 kubectl create namespace "spire-server"
 kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
 
 helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml
+```
+
+See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
diff --git a/examples/production/values.yaml b/examples/production/values.yaml
index 7658760..b18767e 100644
--- a/examples/production/values.yaml
+++ b/examples/production/values.yaml
@@ -10,6 +10,8 @@ spiffe-oidc-discovery-provider:
   podSecurityContext:
     runAsUser: 1000
     runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
   securityContext:
     allowPrivilegeEscalation: false
     runAsNonRoot: true
@@ -29,6 +31,8 @@ spire-server:
   podSecurityContext:
     runAsUser: 1000
     runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
   securityContext:
     allowPrivilegeEscalation: false
     runAsNonRoot: true

From 04a1305556656f996755e9bc1fb2545f36bead25 Mon Sep 17 00:00:00 2001
From: kfox1111 <Kevin.Fox@pnnl.gov>
Date: Tue, 21 Mar 2023 10:14:38 -0700
Subject: [PATCH 05/33] Fork the lockdown test to two tests as it is doing the
 work of 2 (#134)

This patch makes a second copy of the existing lockdown test
because it is doing double duty. In follow on patches we will
make each test do one thing only.

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>
---
 .github/tests/lockdown2/.env            |  1 +
 .github/tests/lockdown2/post-install.sh | 48 +++++++++++++++++++++++++
 .github/tests/lockdown2/pre-install.sh  |  5 +++
 .github/tests/lockdown2/values.yaml     |  5 +++
 4 files changed, 59 insertions(+)
 create mode 100644 .github/tests/lockdown2/.env
 create mode 100755 .github/tests/lockdown2/post-install.sh
 create mode 100755 .github/tests/lockdown2/pre-install.sh
 create mode 100644 .github/tests/lockdown2/values.yaml

diff --git a/.github/tests/lockdown2/.env b/.github/tests/lockdown2/.env
new file mode 100644
index 0000000..7b6e741
--- /dev/null
+++ b/.github/tests/lockdown2/.env
@@ -0,0 +1 @@
+export EXTRA_HELM_ARGS="--values=examples/production/values.yaml"
diff --git a/.github/tests/lockdown2/post-install.sh b/.github/tests/lockdown2/post-install.sh
new file mode 100755
index 0000000..d93ebd9
--- /dev/null
+++ b/.github/tests/lockdown2/post-install.sh
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT=$(readlink -f "$0")
+SCRIPTPATH=$(dirname "$SCRIPT")
+
+k_wait=(kubectl wait --for condition=available --timeout 30s --namespace)
+k_rollout_status=(kubectl rollout status --watch --timeout 30s --namespace)
+
+cat <<EOF >>"$GITHUB_STEP_SUMMARY"
+### spire
+| workload | Status |
+| -------- | ------ |
+| spire-server | $("${k_rollout_status[@]}" spire-server statefulset spire-server) |
+| spire-spiffe-csi-driver | $("${k_rollout_status[@]}" spire-system daemonset spire-spiffe-csi-driver) |
+| spire-agent | $("${k_rollout_status[@]}" spire-system daemonset spire-agent) |
+| spire-spiffe-oidc-discovery-provider | $("${k_wait[@]}" spire-server deployments.apps spire-spiffe-oidc-discovery-provider) |
+EOF
+
+if [ $1 -ne 0 ]; then
+  echo
+  echo '```'
+  echo '==> Events of namespace spire-server'
+  echo '........................................................................................................................'
+  echo '>>> kubectl --request-timeout=30s get events --output wide --namespace spire-server'
+  kubectl --request-timeout=30s get events --output wide --namespace spire-server
+  echo '........................................................................................................................'
+  echo '<== Events of namespace spire-server'
+  echo '........................................................................................................................'
+  echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-server'
+  kubectl --request-timeout=30s describe pods --namespace spire-server
+  echo '========================================================================================================================'
+  echo '==> Events of namespace spire-system'
+  echo '........................................................................................................................'
+  echo '>>> kubectl --request-timeout=30s get events --output wide --namespace spire-system'
+  kubectl --request-timeout=30s get events --output wide --namespace spire-system
+  echo '........................................................................................................................'
+  echo '<== Events of namespace spire-system'
+  echo '........................................................................................................................'
+  echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-system'
+  kubectl --request-timeout=30s describe pods --namespace spire-system
+  echo '========================================================================================================================'
+  kubectl get pods -o name -n spire-server | while read line; do echo logs for $line; kubectl logs -n spire-server $line --all-containers=true --ignore-errors=true; done
+  kubectl get pods -o name -n spire-system | while read line; do echo logs for $line; kubectl logs -n spire-system $line --all-containers=true --ignore-errors=true; done
+  echo '========================================================================================================================'
+  echo '```'
+fi | cat >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/tests/lockdown2/pre-install.sh b/.github/tests/lockdown2/pre-install.sh
new file mode 100755
index 0000000..8336be0
--- /dev/null
+++ b/.github/tests/lockdown2/pre-install.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+kubectl create namespace "spire-system"
+kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
+kubectl create namespace "spire-server"
+kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
diff --git a/.github/tests/lockdown2/values.yaml b/.github/tests/lockdown2/values.yaml
new file mode 100644
index 0000000..3260fb5
--- /dev/null
+++ b/.github/tests/lockdown2/values.yaml
@@ -0,0 +1,5 @@
+spiffe-oidc-discovery-provider:
+  namespaceOverride: spire-server
+
+spire-server:
+  namespaceOverride: spire-server

From 4f85802ae0a53a2eb8edd3a42842e0847592c152 Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@gmail.com>
Date: Tue, 21 Mar 2023 09:11:00 +0100
Subject: [PATCH 06/33] Update lockdown test to test the production example

Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 .github/tests/lockdown/.env                   |  1 -
 .github/tests/lockdown/post-install.sh        | 48 -----------------
 .github/tests/lockdown/pre-install.sh         |  5 --
 .github/tests/lockdown/values.yaml            |  5 --
 .github/tests/production-example/install.sh   | 11 ++++
 .../tests/production-example/post-install.sh  | 51 +++++++++++++++++++
 .../tests/production-example/pre-install.sh   |  6 +++
 .github/workflows/helm-chart-ci.yaml          |  1 +
 8 files changed, 69 insertions(+), 59 deletions(-)
 delete mode 100644 .github/tests/lockdown/.env
 delete mode 100755 .github/tests/lockdown/post-install.sh
 delete mode 100755 .github/tests/lockdown/pre-install.sh
 delete mode 100644 .github/tests/lockdown/values.yaml
 create mode 100755 .github/tests/production-example/install.sh
 create mode 100755 .github/tests/production-example/post-install.sh
 create mode 100755 .github/tests/production-example/pre-install.sh

diff --git a/.github/tests/lockdown/.env b/.github/tests/lockdown/.env
deleted file mode 100644
index 7b6e741..0000000
--- a/.github/tests/lockdown/.env
+++ /dev/null
@@ -1 +0,0 @@
-export EXTRA_HELM_ARGS="--values=examples/production/values.yaml"
diff --git a/.github/tests/lockdown/post-install.sh b/.github/tests/lockdown/post-install.sh
deleted file mode 100755
index d93ebd9..0000000
--- a/.github/tests/lockdown/post-install.sh
+++ /dev/null
@@ -1,48 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT=$(readlink -f "$0")
-SCRIPTPATH=$(dirname "$SCRIPT")
-
-k_wait=(kubectl wait --for condition=available --timeout 30s --namespace)
-k_rollout_status=(kubectl rollout status --watch --timeout 30s --namespace)
-
-cat <<EOF >>"$GITHUB_STEP_SUMMARY"
-### spire
-| workload | Status |
-| -------- | ------ |
-| spire-server | $("${k_rollout_status[@]}" spire-server statefulset spire-server) |
-| spire-spiffe-csi-driver | $("${k_rollout_status[@]}" spire-system daemonset spire-spiffe-csi-driver) |
-| spire-agent | $("${k_rollout_status[@]}" spire-system daemonset spire-agent) |
-| spire-spiffe-oidc-discovery-provider | $("${k_wait[@]}" spire-server deployments.apps spire-spiffe-oidc-discovery-provider) |
-EOF
-
-if [ $1 -ne 0 ]; then
-  echo
-  echo '```'
-  echo '==> Events of namespace spire-server'
-  echo '........................................................................................................................'
-  echo '>>> kubectl --request-timeout=30s get events --output wide --namespace spire-server'
-  kubectl --request-timeout=30s get events --output wide --namespace spire-server
-  echo '........................................................................................................................'
-  echo '<== Events of namespace spire-server'
-  echo '........................................................................................................................'
-  echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-server'
-  kubectl --request-timeout=30s describe pods --namespace spire-server
-  echo '========================================================================================================================'
-  echo '==> Events of namespace spire-system'
-  echo '........................................................................................................................'
-  echo '>>> kubectl --request-timeout=30s get events --output wide --namespace spire-system'
-  kubectl --request-timeout=30s get events --output wide --namespace spire-system
-  echo '........................................................................................................................'
-  echo '<== Events of namespace spire-system'
-  echo '........................................................................................................................'
-  echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-system'
-  kubectl --request-timeout=30s describe pods --namespace spire-system
-  echo '========================================================================================================================'
-  kubectl get pods -o name -n spire-server | while read line; do echo logs for $line; kubectl logs -n spire-server $line --all-containers=true --ignore-errors=true; done
-  kubectl get pods -o name -n spire-system | while read line; do echo logs for $line; kubectl logs -n spire-system $line --all-containers=true --ignore-errors=true; done
-  echo '========================================================================================================================'
-  echo '```'
-fi | cat >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/tests/lockdown/pre-install.sh b/.github/tests/lockdown/pre-install.sh
deleted file mode 100755
index 8336be0..0000000
--- a/.github/tests/lockdown/pre-install.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/bin/bash
-kubectl create namespace "spire-system"
-kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
-kubectl create namespace "spire-server"
-kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
diff --git a/.github/tests/lockdown/values.yaml b/.github/tests/lockdown/values.yaml
deleted file mode 100644
index 3260fb5..0000000
--- a/.github/tests/lockdown/values.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-spiffe-oidc-discovery-provider:
-  namespaceOverride: spire-server
-
-spire-server:
-  namespaceOverride: spire-server
diff --git a/.github/tests/production-example/install.sh b/.github/tests/production-example/install.sh
new file mode 100755
index 0000000..c44be6f
--- /dev/null
+++ b/.github/tests/production-example/install.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT=$(readlink -f "$0")
+SCRIPTPATH=$(dirname "$SCRIPT")
+
+ct install --debug \
+  --namespace spire-server \
+  --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
+  spire charts/spire
diff --git a/.github/tests/production-example/post-install.sh b/.github/tests/production-example/post-install.sh
new file mode 100755
index 0000000..ee0963e
--- /dev/null
+++ b/.github/tests/production-example/post-install.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT=$(readlink -f "$0")
+SCRIPTPATH=$(dirname "$SCRIPT")
+
+k_wait=(kubectl wait --for condition=available --timeout 30s --namespace)
+k_rollout_status=(kubectl rollout status --watch --timeout 30s --namespace)
+
+function get_namespace_details {
+cat <<EOF >>"$GITHUB_STEP_SUMMARY"
+### Namespace $1
+
+#### Events
+
+\`\`\`shell
+$(kubectl --request-timeout=30s get events --output wide --namespace "$1")
+\`\`\`
+
+#### Pods
+
+\`\`\`shell
+$(kubectl --request-timeout=30s describe pods --namespace "$1")
+\`\`\`
+
+#### Logs
+
+\`\`\`shell
+$(kubectl get pods -o name -n "$1" | while read -r line; do echo logs for "${line}"; kubectl logs -n "$1" "${line}" --all-containers=true --ignore-errors=true; done)
+\`\`\`
+
+EOF
+}
+
+cat <<EOF >>"$GITHUB_STEP_SUMMARY"
+### spire
+
+| workload                             | Status |
+| ------------------------------------ | ------ |
+| spire-server                         | "$("${k_rollout_status[@]}" spire-server statefulset spire-server)" |
+| spire-controller-manager             | "$("${k_rollout_status[@]}" spire-server statefulset spire-controller-manager)" |
+| spire-spiffe-oidc-discovery-provider | "$("${k_wait[@]}" spire-server deployments.apps spire-spiffe-oidc-discovery-provider)" |
+| spire-spiffe-csi-driver              | "$("${k_rollout_status[@]}" spire-system daemonset spire-spiffe-csi-driver)" |
+| spire-agent                          | "$("${k_rollout_status[@]}" spire-system daemonset spire-agent)" |
+EOF
+
+if [ $1 -ne 0 ]; then
+  get_namespace_details spire-server
+  get_namespace_details spire-systen
+fi
diff --git a/.github/tests/production-example/pre-install.sh b/.github/tests/production-example/pre-install.sh
new file mode 100755
index 0000000..b33d1ed
--- /dev/null
+++ b/.github/tests/production-example/pre-install.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+kubectl create namespace spire-system
+kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
+kubectl create namespace spire-server
+kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted
diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml
index f4aa84f..55c5846 100644
--- a/.github/workflows/helm-chart-ci.yaml
+++ b/.github/workflows/helm-chart-ci.yaml
@@ -10,6 +10,7 @@ on:
       - '.github/kind/conf/kind-config.yaml'
       - '.github/tests/**/*.yaml'
       - '.github/tests/**/*.sh'
+      - 'examples/**/*.yaml'
       - 'helm-docs.sh'
 
 concurrency:

From d4fd2ced3951d138743ee6f30046693bd12e0f40 Mon Sep 17 00:00:00 2001
From: kfox1111 <Kevin.Fox@pnnl.gov>
Date: Tue, 21 Mar 2023 14:13:26 -0700
Subject: [PATCH 07/33] Extract the namespace override test out of the old
 lockdown test. (#145)

This patch removes the production bits of the old lockdown test
and establishes the namespace override test as its own test.

---------

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>
---
 .github/tests/lockdown2/.env                  |  1 -
 .github/tests/lockdown2/values.yaml           |  5 ----
 .../post-install.sh                           |  0
 .../pre-install.sh                            |  0
 .github/tests/namespace-override/values.yaml  | 24 +++++++++++++++++++
 5 files changed, 24 insertions(+), 6 deletions(-)
 delete mode 100644 .github/tests/lockdown2/.env
 delete mode 100644 .github/tests/lockdown2/values.yaml
 rename .github/tests/{lockdown2 => namespace-override}/post-install.sh (100%)
 rename .github/tests/{lockdown2 => namespace-override}/pre-install.sh (100%)
 create mode 100644 .github/tests/namespace-override/values.yaml

diff --git a/.github/tests/lockdown2/.env b/.github/tests/lockdown2/.env
deleted file mode 100644
index 7b6e741..0000000
--- a/.github/tests/lockdown2/.env
+++ /dev/null
@@ -1 +0,0 @@
-export EXTRA_HELM_ARGS="--values=examples/production/values.yaml"
diff --git a/.github/tests/lockdown2/values.yaml b/.github/tests/lockdown2/values.yaml
deleted file mode 100644
index 3260fb5..0000000
--- a/.github/tests/lockdown2/values.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-spiffe-oidc-discovery-provider:
-  namespaceOverride: spire-server
-
-spire-server:
-  namespaceOverride: spire-server
diff --git a/.github/tests/lockdown2/post-install.sh b/.github/tests/namespace-override/post-install.sh
similarity index 100%
rename from .github/tests/lockdown2/post-install.sh
rename to .github/tests/namespace-override/post-install.sh
diff --git a/.github/tests/lockdown2/pre-install.sh b/.github/tests/namespace-override/pre-install.sh
similarity index 100%
rename from .github/tests/lockdown2/pre-install.sh
rename to .github/tests/namespace-override/pre-install.sh
diff --git a/.github/tests/namespace-override/values.yaml b/.github/tests/namespace-override/values.yaml
new file mode 100644
index 0000000..64acaf3
--- /dev/null
+++ b/.github/tests/namespace-override/values.yaml
@@ -0,0 +1,24 @@
+spiffe-oidc-discovery-provider:
+  enabled: true
+  namespaceOverride: spire-server
+
+spire-server:
+  namespaceOverride: spire-server
+  nodeAttestor:
+    k8sPsat:
+      serviceAccountAllowList: ["spire-system:spire-agent"]
+  notifier:
+    k8sbundle:
+      namespace: spire-system
+
+spiffe-csi-driver:
+  enabled: true
+  namespaceOverride: spire-system
+
+spire-agent:
+  enabled: true
+  namespaceOverride: spire-system
+  serviceAccount:
+    name: spire-agent
+  server:
+    namespaceOverride: spire-server

From b4be9edfeb6e83ee4594f318cc25d0ed35848a94 Mon Sep 17 00:00:00 2001
From: Faisal Memon <fymemon@yahoo.com>
Date: Wed, 22 Mar 2023 01:28:31 -0700
Subject: [PATCH 08/33] Add maturity tag (#138)

---
 README.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index f41a5db..4a180a2 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,8 @@
 
 # SPIFFE Helm Charts
 
-[![Apache 2.0 License](https://img.shields.io/github/license/spiffe/helm-charts?style=for-the-badge)](https://opensource.org/licenses/Apache-2.0)
+[![Apache 2.0 License](https://img.shields.io/github/license/spiffe/helm-charts)](https://opensource.org/licenses/Apache-2.0)
+[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
 
 A suite of [Helm Charts](https://helm.sh/docs) for standardized installations of SPIRE components in Kubernetes environments.
 

From b25dc773bc70b2dd4604595450db34962ce4e12b Mon Sep 17 00:00:00 2001
From: kfox1111 <Kevin.Fox@pnnl.gov>
Date: Wed, 22 Mar 2023 01:49:33 -0700
Subject: [PATCH 09/33] Test fixing the tests (#148)

Co-authored-by: Marco Franssen <marco.franssen@gmail.com>
---
 .github/tests/namespace-override/pre-install.sh | 2 --
 .github/tests/namespace-override/values.yaml    | 2 ++
 .github/tests/production-example/install.sh     | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/tests/namespace-override/pre-install.sh b/.github/tests/namespace-override/pre-install.sh
index 8336be0..91bd6f0 100755
--- a/.github/tests/namespace-override/pre-install.sh
+++ b/.github/tests/namespace-override/pre-install.sh
@@ -1,5 +1,3 @@
 #!/bin/bash
 kubectl create namespace "spire-system"
-kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
 kubectl create namespace "spire-server"
-kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
diff --git a/.github/tests/namespace-override/values.yaml b/.github/tests/namespace-override/values.yaml
index 64acaf3..36a4336 100644
--- a/.github/tests/namespace-override/values.yaml
+++ b/.github/tests/namespace-override/values.yaml
@@ -1,6 +1,8 @@
 spiffe-oidc-discovery-provider:
   enabled: true
   namespaceOverride: spire-server
+  insecureScheme:
+    enabled: true
 
 spire-server:
   namespaceOverride: spire-server
diff --git a/.github/tests/production-example/install.sh b/.github/tests/production-example/install.sh
index c44be6f..19b8806 100755
--- a/.github/tests/production-example/install.sh
+++ b/.github/tests/production-example/install.sh
@@ -5,7 +5,7 @@ set -x
 SCRIPT=$(readlink -f "$0")
 SCRIPTPATH=$(dirname "$SCRIPT")
 
-ct install --debug \
+helm install \
   --namespace spire-server \
   --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
   spire charts/spire

From 05d0f4778d0be7eed7223eb76b32d9d33cbadef9 Mon Sep 17 00:00:00 2001
From: Mariusz Sabath <mrsabath@gmail.com>
Date: Wed, 22 Mar 2023 13:09:09 -0400
Subject: [PATCH 10/33] Introduction of Tornjak to SPIRE Server helm charts
 (#144)

This PR introduces a simplified version of
[Tornjak](https://github.com/spiffe/tornjak) to support UI and SPIRE
control plane.

It extends the `/charts/spire-server` sub-chart by injecting *tornjak*
container to the *spire-server* pod. Tornjak image consists of Tornjak
API (Tornjak Backend), Tornjak UI (Frontend), and database for storing
Tornjak specific information.

Tornjak Backend communicates with SPIRE API via SPIRE Server socket.

Since Tornjak UI (Frontend) is a React code that renders in a browser,
it needs to communicate with Tornjak APIs, and that requires
communication ports to be open, either via Ingress (in Cloud deployment)
or via port forwarding in local deployments (e.g. kind, minikube etc).
Typically port 10000 is used for HTTP connection to Backend, and port
3000 for the HTTP connection to Frontend.

End user management, TLS, and mTLS connections will be addressed by
future PRs.

This PR resolves issue #31

---------

Signed-off-by: Mariusz Sabath <mrsabath@gmail.com>
Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
Co-authored-by: Kevin Fox <Kevin.Fox@pnnl.gov>
Co-authored-by: Marco Franssen <marco.franssen@gmail.com>
Co-authored-by: Pete Cable <petercable@gmail.com>
Co-authored-by: Dennis Gove <dpgove@gmail.com>
---
 charts/spire/charts/spire-server/README.md    |  8 +++
 .../charts/spire-server/templates/NOTES.txt   | 18 ++++++
 .../spire-server/templates/_helpers.tpl       | 33 ++++++++++-
 .../spire-server/templates/service.yaml       | 33 +++++++++++
 .../spire-server/templates/statefulset.yaml   | 55 +++++++++++++++++++
 .../tests/test-tornjak-connection.yaml        | 27 +++++++++
 .../templates/tornjak-config.yaml             | 23 ++++++++
 charts/spire/charts/spire-server/values.yaml  | 23 ++++++++
 8 files changed, 219 insertions(+), 1 deletion(-)
 create mode 100644 charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
 create mode 100644 charts/spire/charts/spire-server/templates/tornjak-config.yaml

diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index ac897b7..09e781f 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -89,6 +89,14 @@ A Helm chart to install the SPIRE server.
 | telemetry.prometheus.enabled | bool | `false` |  |
 | tolerations | list | `[]` |  |
 | topologySpreadConstraints | list | `[]` |  |
+| tornjak.config.backend.dataStore.driver | string | `"sqlite3"` |  |
+| tornjak.config.backend.dataStore.file | string | `"/run/spire/data/tornjak.sqlite3"` |  |
+| tornjak.config.frontend.apiServerURL | string | `"http://localhost:10000"` |  |
+| tornjak.enabled | bool | `true` |  |
+| tornjak.image.pullPolicy | string | `"IfNotPresent"` |  |
+| tornjak.image.registry | string | `"ghcr.io"` |  |
+| tornjak.image.repository | string | `"spiffe/tornjak"` |  |
+| tornjak.image.version | string | `"latest"` |  |
 | trustDomain | string | `"example.org"` |  |
 | upstreamAuthority.certManager.enabled | bool | `false` |  |
 | upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` |  |
diff --git a/charts/spire/charts/spire-server/templates/NOTES.txt b/charts/spire/charts/spire-server/templates/NOTES.txt
index b013798..27b3c78 100644
--- a/charts/spire/charts/spire-server/templates/NOTES.txt
+++ b/charts/spire/charts/spire-server/templates/NOTES.txt
@@ -4,3 +4,21 @@ Installed {{ .Chart.Name }}…
 
   kubectl exec -n {{ .Release.Namespace }} {{ include "spire-server.fullname" . }}-0 -c spire-server -- \
     spire-server entry show
+
+{{- if eq (.Values.tornjak.enabled | toString) "true" }}
+
+### WARNING ### 
+This Tornjak is configured without authentication and it is intended for
+testing only. Please do not use this version in production.
+
+Tornjak APIs (Backend):
+      kubectl -n {{ include "spire-server.namespace" . }} port-forward {{ include "spire-server.fullname" . }}-0 10000:10000
+
+Tornjak UI (Frontend):
+      kubectl -n {{ include "spire-server.namespace" . }} port-forward {{ include "spire-server.fullname" . }}-0 3000:3000
+
+Tornjak API access:  {{ include "tornjak.apiURL" . }}
+Tornjak UI access:   {{ include "tornjak.FrontendURL" . }}
+
+Installed {{ include "spire-tornjak.fullname" . }}…
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl
index 7e7c45c..0060b36 100644
--- a/charts/spire/charts/spire-server/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-server/templates/_helpers.tpl
@@ -84,7 +84,6 @@ Create the name of the service account to use
 {{- end -}}
 {{- end }}
 
-
 {{- define "spire-server.upstream-ca-secret" -}}
 {{- $root := . }}
 {{- with .Values.upstreamAuthority.disk -}}
@@ -111,3 +110,35 @@ Create the name of the service account to use
 [{{ printf "%s:%s-agent" .Release.Namespace .Release.Name | quote }}]
 {{- end }}
 {{- end }}
+
+{{/*
+Tornjak specific section
+*/}}
+
+{{- define "spire-tornjak.fullname" -}}
+{{ include "spire-server.fullname" . | trimSuffix "-server" }}-tornjak
+{{- end }}
+{{- define "spire-tornjak.config" -}}
+{{ include "spire-tornjak.fullname" . }}-config
+{{- end }}
+{{- define "spire-tornjak.frontend" -}}
+{{ include "spire-tornjak.fullname" . }}-fe
+{{- end }}
+{{- define "spire-tornjak.backend" -}}
+{{ include "spire-tornjak.fullname" . }}-be
+{{- end }}
+
+{{/*
+Create URL for accessing Tornjak Backend
+*/}}
+{{- define "tornjak.apiURL" -}}
+{{- default .Values.tornjak.config.frontend.apiServerURL }}
+{{- end }}
+
+{{/*
+Create URL for accessing Tornjak Frontend
+*/}}
+{{- define "tornjak.FrontendURL" -}}
+{{- $feurl := print "http://localhost:3000" }}
+{{- $feurl }}
+{{- end }}
\ No newline at end of file
diff --git a/charts/spire/charts/spire-server/templates/service.yaml b/charts/spire/charts/spire-server/templates/service.yaml
index 5cdaf50..673fae1 100644
--- a/charts/spire/charts/spire-server/templates/service.yaml
+++ b/charts/spire/charts/spire-server/templates/service.yaml
@@ -26,3 +26,36 @@ spec:
     {{- end }}
   selector:
     {{- include "spire-server.selectorLabels" . | nindent 4 }}
+
+{{- if eq (.Values.tornjak.enabled | toString) "true" }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: {{ include "spire-server.namespace" . }}
+  name: {{ include "spire-tornjak.frontend" . }}
+spec:
+  type: {{ .Values.service.type }} # ClusterIP
+  selector:
+    {{- include "spire-server.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: {{ include "spire-tornjak.frontend" . }}
+      port: 3000
+      targetPort: 3000
+      protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: {{ include "spire-server.namespace" . }}
+  name: {{ include "spire-tornjak.backend" . }}
+spec:
+  type: {{ .Values.service.type }} # ClusterIP
+  selector:
+   {{- include "spire-server.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: {{ include "spire-tornjak.backend" . }}
+      port: 10000
+      targetPort: 10000
+      protocol: TCP
+{{- end }}      
\ No newline at end of file
diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml
index 2773bf6..e7b4f36 100644
--- a/charts/spire/charts/spire-server/templates/statefulset.yaml
+++ b/charts/spire/charts/spire-server/templates/statefulset.yaml
@@ -1,5 +1,6 @@
 {{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
 {{- $configSum2 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }}
+{{- $configSumTornjak := (include (print $.Template.BasePath "/tornjak-config.yaml") . | sha256sum) }}
 {{- $fullname := include "spire-server.fullname" . }}
 apiVersion: apps/v1
 kind: StatefulSet
@@ -21,6 +22,7 @@ spec:
       annotations:
         checksum/config: {{ $configSum }}
         checksum/config2: {{ $configSum2 }}
+        checksum/configTornjak: {{ $configSumTornjak }}
         {{- with .Values.podAnnotations }}
           {{- toYaml . | nindent 8 }}
         {{- end }}
@@ -144,6 +146,51 @@ spec:
               mountPath: /tmp
               readOnly: false
         {{- end }}
+
+        {{- if eq (.Values.tornjak.enabled | toString) "true" }}
+        - name: tornjak
+          securityContext:
+            {{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
+          image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tornjak.image) }}
+          imagePullPolicy: {{ .Values.tornjak.image.pullPolicy }}
+          startupProbe:
+            httpGet:
+              scheme: HTTP
+              port: 3000  
+            failureThreshold: 6
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 10
+          env:
+          {{- if .Values.tornjak.config.frontend }}
+          - name: REACT_APP_API_SERVER_URI
+            value: {{ include "tornjak.apiURL" . | required "Either .Values.tornjak.config.backend.ingress or .Values.tornjak.config.frontend.apiServerURL is required." }}          
+          {{- end }}
+          args:
+          - -c
+          - /run/spire/config/server.conf
+          - -t
+          - /run/spire/tornjak-config/server.conf
+          ports:
+          - containerPort: 3000
+            protocol: TCP
+          volumeMounts:
+          - name: {{ include "spire-tornjak.config" . }}
+            mountPath: /run/spire/tornjak-config
+          - name: spire-server-socket
+            mountPath: /tmp/spire-server/private
+            readOnly: true
+          - name: spire-config
+            mountPath: /run/spire/config
+            readOnly: true
+          {{- if eq (.Values.dataStorage.enabled | toString) "true" }}
+          - name: spire-data
+            mountPath: /run/spire/data
+            readOnly: false
+          {{- end }}
+        {{- end }}
+
         {{- if gt (len .Values.extraContainers) 0 }}
         {{- toYaml .Values.extraContainers | nindent 8 }}
         {{- end }}
@@ -181,6 +228,14 @@ spec:
           configMap:
             name: {{ include "spire-controller-manager.fullname" . }}
         {{- end }}
+        {{- if eq (.Values.tornjak.enabled | toString) "true" }}
+        {{- if .Values.tornjak.config }}
+        - name: {{ include "spire-tornjak.config" . }}
+          configMap:
+            defaultMode: 420
+            name: {{ include "spire-tornjak.config" . }}
+        {{- end }}
+        {{- end }}
         {{- if gt (len .Values.extraVolumes) 0 }}
         {{- toYaml .Values.extraVolumes | nindent 8 }}
         {{- end }}
diff --git a/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
new file mode 100644
index 0000000..9dd5ca7
--- /dev/null
+++ b/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
@@ -0,0 +1,27 @@
+{{- if eq (.Values.tornjak.enabled | toString) "true" }}
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "spire-tornjak.fullname" . }}-test-connection"
+  namespace: {{ include "spire-server.namespace" . }}
+  labels:  
+  annotations:
+    "helm.sh/hook": test
+spec:
+  securityContext:
+    {{- toYaml .Values.podSecurityContext | nindent 4 }}
+  containers:
+    - name: wget-tornjak-backend
+      image: busybox
+      command: ['wget']
+      args: ['--no-check-certificate', '-O', '/dev/null', 'http://{{ include "spire-tornjak.backend" . }}:10000/api/tornjak/serverinfo']
+      securityContext:
+        {{- toYaml .Values.securityContext | nindent 8 }}
+    - name: wget-tornjak-frontend
+      image: busybox
+      command: ['wget']
+      args: ['--no-check-certificate', '-O', '/dev/null', 'http://{{ include "spire-tornjak.frontend" . }}:3000']
+      securityContext:
+        {{- toYaml .Values.securityContext | nindent 8 }}
+  restartPolicy: Never
+{{- end }}
\ No newline at end of file
diff --git a/charts/spire/charts/spire-server/templates/tornjak-config.yaml b/charts/spire/charts/spire-server/templates/tornjak-config.yaml
new file mode 100644
index 0000000..407c23e
--- /dev/null
+++ b/charts/spire/charts/spire-server/templates/tornjak-config.yaml
@@ -0,0 +1,23 @@
+{{- if eq (.Values.tornjak.enabled | toString) "true" }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "spire-tornjak.config" . }}
+  namespace: {{ include "spire-server.namespace" . }}
+data:
+  server.conf: |
+    server {
+      metadata = "insert metadata"
+    }
+
+    plugins {
+    {{- if .Values.tornjak.config.backend.dataStore }}
+      DataStore "sql" {
+        plugin_data {
+          drivername = "{{ .Values.tornjak.config.backend.dataStore.driver }}"
+          filename = "{{ .Values.tornjak.config.backend.dataStore.file }}"
+        }
+      }
+    {{- end }}
+    }
+    {{- end }}
\ No newline at end of file
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 5324b55..c3a9c35 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -203,3 +203,26 @@ nodeAttestor:
   k8sPsat:
     enabled: true
     serviceAccountAllowList: []
+
+# tornjak - Tornjak specific configuration
+tornjak:
+  enabled: true
+  # image - Tornjak image (frontend + backend) if not separated above
+  image: # ghcr.io/spiffe/tornjak
+    registry: ghcr.io
+    repository: spiffe/tornjak
+    pullPolicy: IfNotPresent
+    # Overrides the image tag whose default is the chart appVersion.
+    # TODO we should use a specific Tornjak version instead of 'latest'
+    version: "latest"
+  config:
+    # Front-end specific configuration:
+    frontend:
+      # apiServerURL - URL of the Tornjak back-end
+      apiServerURL: "http://localhost:10000"  # 👈 Use it for minikube or kind
+     # Back-end specific configuration
+    backend:
+      # dataStore - persistent DB for storing Tornjak specific information
+      dataStore:
+        driver: "sqlite3"
+        file: "/run/spire/data/tornjak.sqlite3"
\ No newline at end of file

From 901e670d49ee9c2ef3b129ce3a514214a22014ee Mon Sep 17 00:00:00 2001
From: Mariusz Sabath <mrsabath@gmail.com>
Date: Wed, 22 Mar 2023 15:16:38 -0400
Subject: [PATCH 11/33] Disable default Tornjak deployment (#153)

---
 charts/spire/charts/spire-server/README.md   | 2 +-
 charts/spire/charts/spire-server/values.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index 09e781f..f0e477a 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -92,7 +92,7 @@ A Helm chart to install the SPIRE server.
 | tornjak.config.backend.dataStore.driver | string | `"sqlite3"` |  |
 | tornjak.config.backend.dataStore.file | string | `"/run/spire/data/tornjak.sqlite3"` |  |
 | tornjak.config.frontend.apiServerURL | string | `"http://localhost:10000"` |  |
-| tornjak.enabled | bool | `true` |  |
+| tornjak.enabled | bool | `false` |  |
 | tornjak.image.pullPolicy | string | `"IfNotPresent"` |  |
 | tornjak.image.registry | string | `"ghcr.io"` |  |
 | tornjak.image.repository | string | `"spiffe/tornjak"` |  |
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index c3a9c35..16e2150 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -206,7 +206,7 @@ nodeAttestor:
 
 # tornjak - Tornjak specific configuration
 tornjak:
-  enabled: true
+  enabled: false
   # image - Tornjak image (frontend + backend) if not separated above
   image: # ghcr.io/spiffe/tornjak
     registry: ghcr.io

From 02fda80cf34d8ea098834f6149ef6b8b5919dc15 Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@gmail.com>
Date: Sat, 25 Mar 2023 00:23:05 +0100
Subject: [PATCH 12/33] Add Artifact Hub badge to README.md

Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 4a180a2..ed62ef9 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,7 @@
 
 [![Apache 2.0 License](https://img.shields.io/github/license/spiffe/helm-charts)](https://opensource.org/licenses/Apache-2.0)
 [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
+[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/spiffe)](https://artifacthub.io/packages/search?repo=spiffe)
 
 A suite of [Helm Charts](https://helm.sh/docs) for standardized installations of SPIRE components in Kubernetes environments.
 

From ae62dd1af7f6e40d93cee67837b0fd4a7f252888 Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@gmail.com>
Date: Sat, 25 Mar 2023 00:29:24 +0100
Subject: [PATCH 13/33] Bump spire version to 1.6.1

Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 charts/spire/Chart.yaml                                       | 2 +-
 charts/spire/README.md                                        | 2 +-
 charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml | 2 +-
 charts/spire/charts/spiffe-oidc-discovery-provider/README.md  | 2 +-
 charts/spire/charts/spire-agent/Chart.yaml                    | 2 +-
 charts/spire/charts/spire-agent/README.md                     | 2 +-
 charts/spire/charts/spire-server/Chart.yaml                   | 2 +-
 charts/spire/charts/spire-server/README.md                    | 2 +-
 8 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml
index 8d7031b..7a1f40e 100644
--- a/charts/spire/Chart.yaml
+++ b/charts/spire/Chart.yaml
@@ -4,7 +4,7 @@ description: >
   A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
 type: application
 version: 0.5.0
-appVersion: "1.5.5"
+appVersion: "1.6.1"
 keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
 home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
 sources:
diff --git a/charts/spire/README.md b/charts/spire/README.md
index 9782438..4ca34ba 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -2,7 +2,7 @@
 
 <!-- This README.md is generated. Please edit README.md.gotmpl -->
 
-![Version: 0.5.0](https://img.shields.io/badge/Version-0.5.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.5](https://img.shields.io/badge/AppVersion-1.5.5-informational?style=flat-square)
+![Version: 0.5.0](https://img.shields.io/badge/Version-0.5.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.1](https://img.shields.io/badge/AppVersion-1.6.1-informational?style=flat-square)
 
 A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
 
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml
index 0165f4d..10a446a 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml
@@ -3,4 +3,4 @@ name: spiffe-oidc-discovery-provider
 description: A Helm chart to install the SPIFFE OIDC discovery provider.
 type: application
 version: 0.1.0
-appVersion: "1.6.0"
+appVersion: "1.6.1"
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md
index 5d5cc3b..b5dd649 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md
@@ -2,7 +2,7 @@
 
 <!-- This README.md is generated. Please edit README.md.gotmpl -->
 
-![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.0](https://img.shields.io/badge/AppVersion-1.6.0-informational?style=flat-square)
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.1](https://img.shields.io/badge/AppVersion-1.6.1-informational?style=flat-square)
 
 A Helm chart to install the SPIFFE OIDC discovery provider.
 
diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml
index 9fe0970..97f4859 100644
--- a/charts/spire/charts/spire-agent/Chart.yaml
+++ b/charts/spire/charts/spire-agent/Chart.yaml
@@ -3,4 +3,4 @@ name: spire-agent
 description: A Helm chart to install the SPIRE agent.
 type: application
 version: 0.1.0
-appVersion: "1.6.0"
+appVersion: "1.6.1"
diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md
index e012e29..e8a9665 100644
--- a/charts/spire/charts/spire-agent/README.md
+++ b/charts/spire/charts/spire-agent/README.md
@@ -2,7 +2,7 @@
 
 <!-- This README.md is generated. Please edit README.md.gotmpl -->
 
-![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.0](https://img.shields.io/badge/AppVersion-1.6.0-informational?style=flat-square)
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.1](https://img.shields.io/badge/AppVersion-1.6.1-informational?style=flat-square)
 
 A Helm chart to install the SPIRE agent.
 
diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml
index b1714db..87c737a 100644
--- a/charts/spire/charts/spire-server/Chart.yaml
+++ b/charts/spire/charts/spire-server/Chart.yaml
@@ -3,4 +3,4 @@ name: spire-server
 description: A Helm chart to install the SPIRE server.
 type: application
 version: 0.1.0
-appVersion: "1.6.0"
+appVersion: "1.6.1"
diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index f0e477a..7fce3fe 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -2,7 +2,7 @@
 
 <!-- This README.md is generated. Please edit README.md.gotmpl -->
 
-![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.0](https://img.shields.io/badge/AppVersion-1.6.0-informational?style=flat-square)
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.1](https://img.shields.io/badge/AppVersion-1.6.1-informational?style=flat-square)
 
 A Helm chart to install the SPIRE server.
 

From faef4391a6dba135bc8e224996253de67c414472 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Mar 2023 01:45:26 +0000
Subject: [PATCH 14/33] Bump helm/chart-testing-action from 2.3.1 to 2.4.0

Bumps [helm/chart-testing-action](https://github.com/helm/chart-testing-action) from 2.3.1 to 2.4.0.
- [Release notes](https://github.com/helm/chart-testing-action/releases)
- [Commits](https://github.com/helm/chart-testing-action/compare/v2.3.1...v2.4.0)

---
updated-dependencies:
- dependency-name: helm/chart-testing-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/helm-chart-ci.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml
index 55c5846..6b132e4 100644
--- a/.github/workflows/helm-chart-ci.yaml
+++ b/.github/workflows/helm-chart-ci.yaml
@@ -53,7 +53,7 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Setup chart-testing
-        uses: helm/chart-testing-action@v2.3.1
+        uses: helm/chart-testing-action@v2.4.0
         with:
           version: ${{ env.CHART_TESTING_VERSION }}
 
@@ -137,7 +137,7 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Setup chart-testing
-        uses: helm/chart-testing-action@v2.3.1
+        uses: helm/chart-testing-action@v2.4.0
         with:
           version: ${{ env.CHART_TESTING_VERSION }}
 

From f709ed970518e8b52cb8f50a2b791ef15ed7e9cd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Mar 2023 01:45:20 +0000
Subject: [PATCH 15/33] Bump actions/checkout from 3.4.0 to 3.5.0

Bumps [actions/checkout](https://github.com/actions/checkout) from 3.4.0 to 3.5.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3.4.0...v3.5.0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/helm-chart-ci.yaml | 8 ++++----
 .github/workflows/helm-release.yaml  | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml
index 6b132e4..638229c 100644
--- a/.github/workflows/helm-chart-ci.yaml
+++ b/.github/workflows/helm-chart-ci.yaml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.4.0
+        uses: actions/checkout@v3.5.0
 
       - name: Verify Docs updated
         run: ./helm-docs.sh
@@ -38,7 +38,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.4.0
+        uses: actions/checkout@v3.5.0
         with:
           fetch-depth: 0
 
@@ -83,7 +83,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.4.0
+        uses: actions/checkout@v3.5.0
 
       - id: set-matrix
         name: Collect all tests
@@ -122,7 +122,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.4.0
+        uses: actions/checkout@v3.5.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml
index f85d48d..ec04daf 100644
--- a/.github/workflows/helm-release.yaml
+++ b/.github/workflows/helm-release.yaml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.4.0
+        uses: actions/checkout@v3.5.0
         with:
           fetch-depth: 0
 

From 0dac0dbd95d6fdc47c3352fc550ee431e6ed449e Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@gmail.com>
Date: Sat, 25 Mar 2023 00:37:34 +0100
Subject: [PATCH 16/33] Improve Spire Chart documentation

Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 README.md                     |  2 +-
 charts/spire/README.md        | 16 ++++++++++++++--
 charts/spire/README.md.gotmpl | 16 ++++++++++++++--
 3 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index ed62ef9..e46dd58 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,7 @@ Unless otherwise noted in an application chart README, the following dependencie
 
 | Dependency | Supported Versions |
 |:-----------|:-------------------|
-| SPIRE      | `1.5.x`, `1.6.x`   |
+| SPIRE      | `1.5.3`+, `1.6.x`  |
 | Helm       | `3.x`              |
 
 For Kubernetes we will officially try to support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions).
diff --git a/charts/spire/README.md b/charts/spire/README.md
index 4ca34ba..81cb23b 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -3,14 +3,26 @@
 <!-- This README.md is generated. Please edit README.md.gotmpl -->
 
 ![Version: 0.5.0](https://img.shields.io/badge/Version-0.5.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.1](https://img.shields.io/badge/AppVersion-1.6.1-informational?style=flat-square)
+[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
 
 A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
 
 **Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
 
-> **Warning**: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server.
+## Version support
 
-> **Note**: Minimum Spire version is `v1.5.3`.
+> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
+> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
+> we do aim for as much stability as possible.
+
+| Dependency | Supported Versions |
+|:-----------|:-------------------|
+| SPIRE      | `1.5.3+`, `1.6.x`  |
+| Helm       | `3.x`              |
+
+## Prerequisites
+
+Please note this chart requires `Projected Service Account Tokens` which has to be enabled on your k8s api server.
 
 To enable Projected Service Account Tokens on Docker for Mac/Windows run the following
 command to SSH into the Docker Desktop K8s VM.
diff --git a/charts/spire/README.md.gotmpl b/charts/spire/README.md.gotmpl
index 9c640b7..a5fdd06 100644
--- a/charts/spire/README.md.gotmpl
+++ b/charts/spire/README.md.gotmpl
@@ -5,14 +5,26 @@
 {{ template "chart.deprecationWarning" . }}
 
 {{ template "chart.badgesSection" . }}
+[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
 
 {{ template "chart.description" . }}
 
 {{ template "chart.homepageLine" . }}
 
-> **Warning**: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server.
+## Version support
 
-> **Note**: Minimum Spire version is `v1.5.3`.
+> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
+> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
+> we do aim for as much stability as possible.
+
+| Dependency | Supported Versions |
+|:-----------|:-------------------|
+| SPIRE      | `1.5.3+`, `1.6.x`  |
+| Helm       | `3.x`              |
+
+## Prerequisites
+
+Please note this chart requires `Projected Service Account Tokens` which has to be enabled on your k8s api server.
 
 To enable Projected Service Account Tokens on Docker for Mac/Windows run the following
 command to SSH into the Docker Desktop K8s VM.

From 64585ba2b5682a2574acfaa0ad40a871d4ec0f2b Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@gmail.com>
Date: Mon, 27 Mar 2023 10:59:38 +0200
Subject: [PATCH 17/33] Fix formatting issues introduced with #152

Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 charts/spire/charts/spire-server/templates/NOTES.txt          | 2 +-
 charts/spire/charts/spire-server/templates/_helpers.tpl       | 2 +-
 charts/spire/charts/spire-server/templates/service.yaml       | 2 +-
 charts/spire/charts/spire-server/templates/statefulset.yaml   | 4 ++--
 .../spire/charts/spire-server/templates/tornjak-config.yaml   | 2 +-
 charts/spire/charts/spire-server/values.yaml                  | 2 +-
 6 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/charts/spire/charts/spire-server/templates/NOTES.txt b/charts/spire/charts/spire-server/templates/NOTES.txt
index 27b3c78..37cef28 100644
--- a/charts/spire/charts/spire-server/templates/NOTES.txt
+++ b/charts/spire/charts/spire-server/templates/NOTES.txt
@@ -7,7 +7,7 @@ Installed {{ .Chart.Name }}…
 
 {{- if eq (.Values.tornjak.enabled | toString) "true" }}
 
-### WARNING ### 
+### WARNING ###
 This Tornjak is configured without authentication and it is intended for
 testing only. Please do not use this version in production.
 
diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl
index 0060b36..48d3339 100644
--- a/charts/spire/charts/spire-server/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-server/templates/_helpers.tpl
@@ -141,4 +141,4 @@ Create URL for accessing Tornjak Frontend
 {{- define "tornjak.FrontendURL" -}}
 {{- $feurl := print "http://localhost:3000" }}
 {{- $feurl }}
-{{- end }}
\ No newline at end of file
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/service.yaml b/charts/spire/charts/spire-server/templates/service.yaml
index 673fae1..f843e53 100644
--- a/charts/spire/charts/spire-server/templates/service.yaml
+++ b/charts/spire/charts/spire-server/templates/service.yaml
@@ -58,4 +58,4 @@ spec:
       port: 10000
       targetPort: 10000
       protocol: TCP
-{{- end }}      
\ No newline at end of file
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml
index e7b4f36..0330d31 100644
--- a/charts/spire/charts/spire-server/templates/statefulset.yaml
+++ b/charts/spire/charts/spire-server/templates/statefulset.yaml
@@ -156,7 +156,7 @@ spec:
           startupProbe:
             httpGet:
               scheme: HTTP
-              port: 3000  
+              port: 3000
             failureThreshold: 6
             initialDelaySeconds: 60
             periodSeconds: 30
@@ -165,7 +165,7 @@ spec:
           env:
           {{- if .Values.tornjak.config.frontend }}
           - name: REACT_APP_API_SERVER_URI
-            value: {{ include "tornjak.apiURL" . | required "Either .Values.tornjak.config.backend.ingress or .Values.tornjak.config.frontend.apiServerURL is required." }}          
+            value: {{ include "tornjak.apiURL" . | required "Either .Values.tornjak.config.backend.ingress or .Values.tornjak.config.frontend.apiServerURL is required." }}
           {{- end }}
           args:
           - -c
diff --git a/charts/spire/charts/spire-server/templates/tornjak-config.yaml b/charts/spire/charts/spire-server/templates/tornjak-config.yaml
index 407c23e..f1bd3ce 100644
--- a/charts/spire/charts/spire-server/templates/tornjak-config.yaml
+++ b/charts/spire/charts/spire-server/templates/tornjak-config.yaml
@@ -20,4 +20,4 @@ data:
       }
     {{- end }}
     }
-    {{- end }}
\ No newline at end of file
+    {{- end }}
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 16e2150..268af20 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -225,4 +225,4 @@ tornjak:
       # dataStore - persistent DB for storing Tornjak specific information
       dataStore:
         driver: "sqlite3"
-        file: "/run/spire/data/tornjak.sqlite3"
\ No newline at end of file
+        file: "/run/spire/data/tornjak.sqlite3"

From e2ec6ac47d0e91c3c01db3da40707e10150553fb Mon Sep 17 00:00:00 2001
From: kfox1111 <Kevin.Fox@pnnl.gov>
Date: Tue, 28 Mar 2023 01:21:24 -0700
Subject: [PATCH 18/33] Add a test to ensure the chart versions match (#163)

Co-authored-by: Marco Franssen <marco.franssen@gmail.com>
---
 .github/workflows/helm-chart-ci.yaml | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml
index 638229c..64d0a0b 100644
--- a/.github/workflows/helm-chart-ci.yaml
+++ b/.github/workflows/helm-chart-ci.yaml
@@ -23,7 +23,7 @@ env:
   CHART_TESTING_VERSION: v3.7.1
 
 jobs:
-  check-docs:
+  checks:
     runs-on: ubuntu-22.04
 
     steps:
@@ -33,6 +33,22 @@ jobs:
       - name: Verify Docs updated
         run: ./helm-docs.sh
 
+      - name: Verify Spire appVersion
+        run: |
+          set +e
+          BASEVER=$(yq e .appVersion Chart.yaml)
+          for FILE in spiffe-oidc-discovery-provider spire-agent spire-server; do
+            VER=$(yq .appVersion charts/$FILE/Chart.yaml)
+            if [ "$VER" != "$BASEVER" ]; then
+              {
+                echo "## Version mismatch"
+                echo
+                echo "There is a mismatch between the chart version ($BASEVER) and subchart version ($VER). The issue may be in file $FILE. Please fix."
+              } >> "$GITHUB_STEP_SUMMARY"
+              exit 1
+            fi
+          done
+
   lint-chart:
     runs-on: ubuntu-22.04
 

From 059d5fb89fd07d5509cfb5e04117f885c21468b9 Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@gmail.com>
Date: Tue, 28 Mar 2023 09:53:12 +0200
Subject: [PATCH 19/33] Bump spire Helm Chart version from 0.5.0 to 0.5.1

* 64585ba Fix formatting issues introduced with #152
* 0dac0db Improve Spire Chart documentation
* f709ed9 Bump actions/checkout from 3.4.0 to 3.5.0
* faef439 Bump helm/chart-testing-action from 2.3.1 to 2.4.0
* ae62dd1 Bump spire version to 1.6.1
* 02fda80 Add Artifact Hub badge to README.md
* 901e670 Disable default Tornjak deployment (#153)
* 05d0f47 Introduction of Tornjak to SPIRE Server helm charts (#144)
* b25dc77 Test fixing the tests (#148)
* b4be9ed Add maturity tag (#138)
* d4fd2ce Extract the namespace override test out of the old lockdown test. (#145)
* 4f85802 Update lockdown test to test the production example
* 04a1305 Fork the lockdown test to two tests as it is doing the work of 2 (#134)
* 64d0107 Resolve issue in prod example on volume mount (#143)
* 5b6708b Remove @dennisgove from CODEOWNERS (#140)
* a516caa Remove k8s 1.21 from test matrix + small syntax error fix (#133)
* 811a2f6 Add option to enable federation on spire-server (#97)

Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 charts/spire/Chart.yaml | 2 +-
 charts/spire/README.md  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml
index 7a1f40e..33585ad 100644
--- a/charts/spire/Chart.yaml
+++ b/charts/spire/Chart.yaml
@@ -3,7 +3,7 @@ name: spire
 description: >
   A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
 type: application
-version: 0.5.0
+version: 0.5.1
 appVersion: "1.6.1"
 keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
 home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
diff --git a/charts/spire/README.md b/charts/spire/README.md
index 81cb23b..20b945f 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -2,7 +2,7 @@
 
 <!-- This README.md is generated. Please edit README.md.gotmpl -->
 
-![Version: 0.5.0](https://img.shields.io/badge/Version-0.5.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.1](https://img.shields.io/badge/AppVersion-1.6.1-informational?style=flat-square)
+![Version: 0.5.1](https://img.shields.io/badge/Version-0.5.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.1](https://img.shields.io/badge/AppVersion-1.6.1-informational?style=flat-square)
 [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
 
 A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.

From dfb32dc28f572b5a4c466803a61cbf983d00f985 Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@gmail.com>
Date: Fri, 31 Mar 2023 10:11:54 +0200
Subject: [PATCH 20/33] Revert adding tornjak to be releasable (#180)

---
 charts/spire/charts/spire-server/README.md    |  8 ---
 .../charts/spire-server/templates/NOTES.txt   | 18 ------
 .../spire-server/templates/_helpers.tpl       | 32 -----------
 .../spire-server/templates/service.yaml       | 33 -----------
 .../spire-server/templates/statefulset.yaml   | 55 -------------------
 .../tests/test-tornjak-connection.yaml        | 27 ---------
 .../templates/tornjak-config.yaml             | 23 --------
 charts/spire/charts/spire-server/values.yaml  | 23 --------
 8 files changed, 219 deletions(-)
 delete mode 100644 charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
 delete mode 100644 charts/spire/charts/spire-server/templates/tornjak-config.yaml

diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index 7fce3fe..ce5cbb8 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -89,14 +89,6 @@ A Helm chart to install the SPIRE server.
 | telemetry.prometheus.enabled | bool | `false` |  |
 | tolerations | list | `[]` |  |
 | topologySpreadConstraints | list | `[]` |  |
-| tornjak.config.backend.dataStore.driver | string | `"sqlite3"` |  |
-| tornjak.config.backend.dataStore.file | string | `"/run/spire/data/tornjak.sqlite3"` |  |
-| tornjak.config.frontend.apiServerURL | string | `"http://localhost:10000"` |  |
-| tornjak.enabled | bool | `false` |  |
-| tornjak.image.pullPolicy | string | `"IfNotPresent"` |  |
-| tornjak.image.registry | string | `"ghcr.io"` |  |
-| tornjak.image.repository | string | `"spiffe/tornjak"` |  |
-| tornjak.image.version | string | `"latest"` |  |
 | trustDomain | string | `"example.org"` |  |
 | upstreamAuthority.certManager.enabled | bool | `false` |  |
 | upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` |  |
diff --git a/charts/spire/charts/spire-server/templates/NOTES.txt b/charts/spire/charts/spire-server/templates/NOTES.txt
index 37cef28..b013798 100644
--- a/charts/spire/charts/spire-server/templates/NOTES.txt
+++ b/charts/spire/charts/spire-server/templates/NOTES.txt
@@ -4,21 +4,3 @@ Installed {{ .Chart.Name }}…
 
   kubectl exec -n {{ .Release.Namespace }} {{ include "spire-server.fullname" . }}-0 -c spire-server -- \
     spire-server entry show
-
-{{- if eq (.Values.tornjak.enabled | toString) "true" }}
-
-### WARNING ###
-This Tornjak is configured without authentication and it is intended for
-testing only. Please do not use this version in production.
-
-Tornjak APIs (Backend):
-      kubectl -n {{ include "spire-server.namespace" . }} port-forward {{ include "spire-server.fullname" . }}-0 10000:10000
-
-Tornjak UI (Frontend):
-      kubectl -n {{ include "spire-server.namespace" . }} port-forward {{ include "spire-server.fullname" . }}-0 3000:3000
-
-Tornjak API access:  {{ include "tornjak.apiURL" . }}
-Tornjak UI access:   {{ include "tornjak.FrontendURL" . }}
-
-Installed {{ include "spire-tornjak.fullname" . }}…
-{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl
index 48d3339..6a8355f 100644
--- a/charts/spire/charts/spire-server/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-server/templates/_helpers.tpl
@@ -110,35 +110,3 @@ Create the name of the service account to use
 [{{ printf "%s:%s-agent" .Release.Namespace .Release.Name | quote }}]
 {{- end }}
 {{- end }}
-
-{{/*
-Tornjak specific section
-*/}}
-
-{{- define "spire-tornjak.fullname" -}}
-{{ include "spire-server.fullname" . | trimSuffix "-server" }}-tornjak
-{{- end }}
-{{- define "spire-tornjak.config" -}}
-{{ include "spire-tornjak.fullname" . }}-config
-{{- end }}
-{{- define "spire-tornjak.frontend" -}}
-{{ include "spire-tornjak.fullname" . }}-fe
-{{- end }}
-{{- define "spire-tornjak.backend" -}}
-{{ include "spire-tornjak.fullname" . }}-be
-{{- end }}
-
-{{/*
-Create URL for accessing Tornjak Backend
-*/}}
-{{- define "tornjak.apiURL" -}}
-{{- default .Values.tornjak.config.frontend.apiServerURL }}
-{{- end }}
-
-{{/*
-Create URL for accessing Tornjak Frontend
-*/}}
-{{- define "tornjak.FrontendURL" -}}
-{{- $feurl := print "http://localhost:3000" }}
-{{- $feurl }}
-{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/service.yaml b/charts/spire/charts/spire-server/templates/service.yaml
index f843e53..5cdaf50 100644
--- a/charts/spire/charts/spire-server/templates/service.yaml
+++ b/charts/spire/charts/spire-server/templates/service.yaml
@@ -26,36 +26,3 @@ spec:
     {{- end }}
   selector:
     {{- include "spire-server.selectorLabels" . | nindent 4 }}
-
-{{- if eq (.Values.tornjak.enabled | toString) "true" }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  namespace: {{ include "spire-server.namespace" . }}
-  name: {{ include "spire-tornjak.frontend" . }}
-spec:
-  type: {{ .Values.service.type }} # ClusterIP
-  selector:
-    {{- include "spire-server.selectorLabels" . | nindent 4 }}
-  ports:
-    - name: {{ include "spire-tornjak.frontend" . }}
-      port: 3000
-      targetPort: 3000
-      protocol: TCP
----
-apiVersion: v1
-kind: Service
-metadata:
-  namespace: {{ include "spire-server.namespace" . }}
-  name: {{ include "spire-tornjak.backend" . }}
-spec:
-  type: {{ .Values.service.type }} # ClusterIP
-  selector:
-   {{- include "spire-server.selectorLabels" . | nindent 4 }}
-  ports:
-    - name: {{ include "spire-tornjak.backend" . }}
-      port: 10000
-      targetPort: 10000
-      protocol: TCP
-{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml
index 0330d31..2773bf6 100644
--- a/charts/spire/charts/spire-server/templates/statefulset.yaml
+++ b/charts/spire/charts/spire-server/templates/statefulset.yaml
@@ -1,6 +1,5 @@
 {{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
 {{- $configSum2 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }}
-{{- $configSumTornjak := (include (print $.Template.BasePath "/tornjak-config.yaml") . | sha256sum) }}
 {{- $fullname := include "spire-server.fullname" . }}
 apiVersion: apps/v1
 kind: StatefulSet
@@ -22,7 +21,6 @@ spec:
       annotations:
         checksum/config: {{ $configSum }}
         checksum/config2: {{ $configSum2 }}
-        checksum/configTornjak: {{ $configSumTornjak }}
         {{- with .Values.podAnnotations }}
           {{- toYaml . | nindent 8 }}
         {{- end }}
@@ -146,51 +144,6 @@ spec:
               mountPath: /tmp
               readOnly: false
         {{- end }}
-
-        {{- if eq (.Values.tornjak.enabled | toString) "true" }}
-        - name: tornjak
-          securityContext:
-            {{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
-          image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tornjak.image) }}
-          imagePullPolicy: {{ .Values.tornjak.image.pullPolicy }}
-          startupProbe:
-            httpGet:
-              scheme: HTTP
-              port: 3000
-            failureThreshold: 6
-            initialDelaySeconds: 60
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 10
-          env:
-          {{- if .Values.tornjak.config.frontend }}
-          - name: REACT_APP_API_SERVER_URI
-            value: {{ include "tornjak.apiURL" . | required "Either .Values.tornjak.config.backend.ingress or .Values.tornjak.config.frontend.apiServerURL is required." }}
-          {{- end }}
-          args:
-          - -c
-          - /run/spire/config/server.conf
-          - -t
-          - /run/spire/tornjak-config/server.conf
-          ports:
-          - containerPort: 3000
-            protocol: TCP
-          volumeMounts:
-          - name: {{ include "spire-tornjak.config" . }}
-            mountPath: /run/spire/tornjak-config
-          - name: spire-server-socket
-            mountPath: /tmp/spire-server/private
-            readOnly: true
-          - name: spire-config
-            mountPath: /run/spire/config
-            readOnly: true
-          {{- if eq (.Values.dataStorage.enabled | toString) "true" }}
-          - name: spire-data
-            mountPath: /run/spire/data
-            readOnly: false
-          {{- end }}
-        {{- end }}
-
         {{- if gt (len .Values.extraContainers) 0 }}
         {{- toYaml .Values.extraContainers | nindent 8 }}
         {{- end }}
@@ -228,14 +181,6 @@ spec:
           configMap:
             name: {{ include "spire-controller-manager.fullname" . }}
         {{- end }}
-        {{- if eq (.Values.tornjak.enabled | toString) "true" }}
-        {{- if .Values.tornjak.config }}
-        - name: {{ include "spire-tornjak.config" . }}
-          configMap:
-            defaultMode: 420
-            name: {{ include "spire-tornjak.config" . }}
-        {{- end }}
-        {{- end }}
         {{- if gt (len .Values.extraVolumes) 0 }}
         {{- toYaml .Values.extraVolumes | nindent 8 }}
         {{- end }}
diff --git a/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
deleted file mode 100644
index 9dd5ca7..0000000
--- a/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
+++ /dev/null
@@ -1,27 +0,0 @@
-{{- if eq (.Values.tornjak.enabled | toString) "true" }}
-apiVersion: v1
-kind: Pod
-metadata:
-  name: "{{ include "spire-tornjak.fullname" . }}-test-connection"
-  namespace: {{ include "spire-server.namespace" . }}
-  labels:  
-  annotations:
-    "helm.sh/hook": test
-spec:
-  securityContext:
-    {{- toYaml .Values.podSecurityContext | nindent 4 }}
-  containers:
-    - name: wget-tornjak-backend
-      image: busybox
-      command: ['wget']
-      args: ['--no-check-certificate', '-O', '/dev/null', 'http://{{ include "spire-tornjak.backend" . }}:10000/api/tornjak/serverinfo']
-      securityContext:
-        {{- toYaml .Values.securityContext | nindent 8 }}
-    - name: wget-tornjak-frontend
-      image: busybox
-      command: ['wget']
-      args: ['--no-check-certificate', '-O', '/dev/null', 'http://{{ include "spire-tornjak.frontend" . }}:3000']
-      securityContext:
-        {{- toYaml .Values.securityContext | nindent 8 }}
-  restartPolicy: Never
-{{- end }}
\ No newline at end of file
diff --git a/charts/spire/charts/spire-server/templates/tornjak-config.yaml b/charts/spire/charts/spire-server/templates/tornjak-config.yaml
deleted file mode 100644
index f1bd3ce..0000000
--- a/charts/spire/charts/spire-server/templates/tornjak-config.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-{{- if eq (.Values.tornjak.enabled | toString) "true" }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "spire-tornjak.config" . }}
-  namespace: {{ include "spire-server.namespace" . }}
-data:
-  server.conf: |
-    server {
-      metadata = "insert metadata"
-    }
-
-    plugins {
-    {{- if .Values.tornjak.config.backend.dataStore }}
-      DataStore "sql" {
-        plugin_data {
-          drivername = "{{ .Values.tornjak.config.backend.dataStore.driver }}"
-          filename = "{{ .Values.tornjak.config.backend.dataStore.file }}"
-        }
-      }
-    {{- end }}
-    }
-    {{- end }}
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 268af20..5324b55 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -203,26 +203,3 @@ nodeAttestor:
   k8sPsat:
     enabled: true
     serviceAccountAllowList: []
-
-# tornjak - Tornjak specific configuration
-tornjak:
-  enabled: false
-  # image - Tornjak image (frontend + backend) if not separated above
-  image: # ghcr.io/spiffe/tornjak
-    registry: ghcr.io
-    repository: spiffe/tornjak
-    pullPolicy: IfNotPresent
-    # Overrides the image tag whose default is the chart appVersion.
-    # TODO we should use a specific Tornjak version instead of 'latest'
-    version: "latest"
-  config:
-    # Front-end specific configuration:
-    frontend:
-      # apiServerURL - URL of the Tornjak back-end
-      apiServerURL: "http://localhost:10000"  # 👈 Use it for minikube or kind
-     # Back-end specific configuration
-    backend:
-      # dataStore - persistent DB for storing Tornjak specific information
-      dataStore:
-        driver: "sqlite3"
-        file: "/run/spire/data/tornjak.sqlite3"

From b54c41aee05056ae09d1a1c7a122119b3e3af4e6 Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@gmail.com>
Date: Thu, 16 Mar 2023 17:19:55 +0100
Subject: [PATCH 21/33] Enhance the production example

Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 examples/production/values.yaml | 49 +++++++++++++++++++++------------
 1 file changed, 31 insertions(+), 18 deletions(-)

diff --git a/examples/production/values.yaml b/examples/production/values.yaml
index b18767e..d81d285 100644
--- a/examples/production/values.yaml
+++ b/examples/production/values.yaml
@@ -3,24 +3,6 @@ global:
     prometheus:
       enabled: true
 
-spiffe-oidc-discovery-provider:
-  enabled: true
-  insecureScheme:
-    enabled: true
-  podSecurityContext:
-    runAsUser: 1000
-    runAsGroup: 1000
-    fsGroup: 1000
-    fsGroupChangePolicy: OnRootMismatch
-  securityContext:
-    allowPrivilegeEscalation: false
-    runAsNonRoot: true
-    readOnlyRootFilesystem: true
-    capabilities:
-      drop: [ALL]
-    seccompProfile:
-      type: RuntimeDefault
-
 spire-server:
   nodeAttestor:
     k8sPsat:
@@ -41,6 +23,12 @@ spire-server:
       drop: [ALL]
     seccompProfile:
       type: RuntimeDefault
+
+  dataStorage:
+    enabled: true
+
+  logLevel: info
+
   controllerManager:
     securityContext:
       allowPrivilegeEscalation: false
@@ -51,6 +39,11 @@ spire-server:
       seccompProfile:
         type: RuntimeDefault
 
+    ignoreNamespaces:
+      - kube-system
+      - kube-public
+      - local-path-storage
+
 spiffe-csi-driver:
   enabled: true
   namespaceOverride: spire-system
@@ -64,3 +57,23 @@ spire-agent:
   server:
     namespaceOverride: spire-server
   priorityClassName: system-node-critical
+
+  logLevel: info
+
+spiffe-oidc-discovery-provider:
+  enabled: true
+  insecureScheme:
+    enabled: true
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
+  securityContext:
+    allowPrivilegeEscalation: false
+    runAsNonRoot: true
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop: [ALL]
+    seccompProfile:
+      type: RuntimeDefault

From 87904164ad0c167fd80425310444e7c36620f8a1 Mon Sep 17 00:00:00 2001
From: kfox1111 <Kevin.Fox@pnnl.gov>
Date: Sun, 2 Apr 2023 10:28:49 -0700
Subject: [PATCH 22/33] Enable global config for clusterName, trustDomain, and
 bundleConfigMap (#156)

---
 charts/spire/README.md                        | 10 +++----
 .../templates/_helpers.tpl                    | 16 +++++++++++
 .../charts/spire-agent/templates/_helpers.tpl | 24 +++++++++++++++++
 .../spire-agent/templates/configmap.yaml      |  4 +--
 .../spire-agent/templates/daemonset.yaml      |  2 +-
 charts/spire/charts/spire-server/README.md    |  2 +-
 .../spire-server/templates/_helpers.tpl       | 24 +++++++++++++++++
 .../templates/bundle-configmap.yaml           |  2 +-
 .../spire-server/templates/configmap.yaml     |  6 ++---
 .../controller-manager-configmap.yaml         |  4 +--
 .../charts/spire-server/templates/roles.yaml  |  2 +-
 charts/spire/charts/spire-server/values.yaml  |  2 +-
 charts/spire/values.yaml                      | 27 +++++++++----------
 13 files changed, 92 insertions(+), 33 deletions(-)

diff --git a/charts/spire/README.md b/charts/spire/README.md
index 20b945f..d23e402 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -105,20 +105,16 @@ Kubernetes: `>=1.21.0-0`
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
 | fullnameOverride | string | `""` |  |
+| global.spire.bundleConfigMap | string | `""` | Override all instances of bundleConfigMap |
+| global.spire.clusterName | string | `"example-cluster"` | Set the name of the Kubernetes cluster |
+| global.spire.trustDomain | string | `"example.org"` | Set the trust domain to use for the spiffe identifiers |
 | nameOverride | string | `""` |  |
 | spiffe-csi-driver.enabled | bool | `true` |  |
 | spiffe-oidc-discovery-provider.enabled | bool | `false` |  |
-| spiffe-oidc-discovery-provider.trustDomain | string | `"example.org"` |  |
-| spire-agent.bundleConfigMap | string | `"spire-bundle"` |  |
-| spire-agent.clusterName | string | `"example-cluster"` |  |
 | spire-agent.enabled | bool | `true` |  |
 | spire-agent.nameOverride | string | `"agent"` |  |
-| spire-agent.trustDomain | string | `"example.org"` |  |
-| spire-server.bundleConfigMap | string | `"spire-bundle"` |  |
-| spire-server.clusterName | string | `"example-cluster"` |  |
 | spire-server.controllerManager.enabled | bool | `true` |  |
 | spire-server.enabled | bool | `true` |  |
 | spire-server.nameOverride | string | `"server"` |  |
-| spire-server.trustDomain | string | `"example.org"` |  |
 
 ----------------------------------------------
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
index 6ff4768..bda54f2 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
@@ -87,3 +87,19 @@ Create the name of the service account to use
 {{- define "spiffe-oidc-discovery-provider.workload-api-socket-path" -}}
 {{- printf "/spiffe-workload-api/%s" .Values.agentSocketName }}
 {{- end }}
+
+{{- define "spiffe-oidc-discovery-provider.cluster-name" }}
+{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
+{{- .Values.global.spire.clusterName }}
+{{- else }}
+{{- .Values.clusterName }}
+{{- end }}
+{{- end }}
+
+{{- define "spiffe-oidc-discovery-provider.trust-domain" }}
+{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
+{{- .Values.global.spire.trustDomain }}
+{{- else }}
+{{- .Values.trustDomain }}
+{{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-agent/templates/_helpers.tpl b/charts/spire/charts/spire-agent/templates/_helpers.tpl
index f3704fc..065f6ed 100644
--- a/charts/spire/charts/spire-agent/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-agent/templates/_helpers.tpl
@@ -103,3 +103,27 @@ Create the name of the service account to use
 {{- define "spire-agent.socket-path" -}}
 {{- print .Values.socketPath }}
 {{- end }}
+
+{{- define "spire-agent.cluster-name" }}
+{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
+{{- .Values.global.spire.clusterName }}
+{{- else }}
+{{- .Values.clusterName }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-agent.trust-domain" }}
+{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
+{{- .Values.global.spire.trustDomain }}
+{{- else }}
+{{- .Values.trustDomain }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-agent.bundle-configmap" }}
+{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
+{{- .Values.global.spire.bundleConfigMap }}
+{{- else }}
+{{- .Values.bundleConfigMap }}
+{{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml
index 9d368e8..900f526 100644
--- a/charts/spire/charts/spire-agent/templates/configmap.yaml
+++ b/charts/spire/charts/spire-agent/templates/configmap.yaml
@@ -12,13 +12,13 @@ data:
       server_port = {{ .Values.server.port | quote }}
       socket_path = {{ include "spire-agent.socket-path" . | quote }}
       trust_bundle_path = "/run/spire/bundle/bundle.crt"
-      trust_domain = {{ .Values.trustDomain | quote }}
+      trust_domain = {{ include "spire-agent.trust-domain" . | quote }}
     }
 
     plugins {
       NodeAttestor "k8s_psat" {
         plugin_data {
-          cluster = {{ .Values.clusterName | quote }}
+          cluster = {{ include "spire-agent.cluster-name" . | quote }}
         }
       }
 
diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml
index 503c171..10c2603 100644
--- a/charts/spire/charts/spire-agent/templates/daemonset.yaml
+++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml
@@ -100,7 +100,7 @@ spec:
             name: {{ include "spire-agent.fullname" . }}
         - name: spire-bundle
           configMap:
-            name: {{ .Values.bundleConfigMap }}
+            name: {{ include "spire-agent.bundle-configmap" . }}
         - name: spire-token
           projected:
             sources:
diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index ce5cbb8..347c653 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -22,7 +22,7 @@ A Helm chart to install the SPIRE server.
 | autoscaling.maxReplicas | int | `100` |  |
 | autoscaling.minReplicas | int | `1` |  |
 | autoscaling.targetCPUUtilizationPercentage | int | `80` |  |
-| bundleConfigMap | string | `"spire-server"` |  |
+| bundleConfigMap | string | `"spire-bundle"` |  |
 | caKeyType | string | `"rsa-2048"` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA.  EC cryptography is not supported) |
 | caTTL | string | `"24h"` |  |
 | ca_subject.common_name | string | `"example.org"` |  |
diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl
index 6a8355f..6d53181 100644
--- a/charts/spire/charts/spire-server/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-server/templates/_helpers.tpl
@@ -110,3 +110,27 @@ Create the name of the service account to use
 [{{ printf "%s:%s-agent" .Release.Namespace .Release.Name | quote }}]
 {{- end }}
 {{- end }}
+
+{{- define "spire-server.cluster-name" }}
+{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
+{{- .Values.global.spire.clusterName }}
+{{- else }}
+{{- .Values.clusterName }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-server.trust-domain" }}
+{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
+{{- .Values.global.spire.trustDomain }}
+{{- else }}
+{{- .Values.trustDomain }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-server.bundle-configmap" }}
+{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
+{{- .Values.global.spire.bundleConfigMap }}
+{{- else }}
+{{- .Values.bundleConfigMap }}
+{{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/bundle-configmap.yaml b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml
index 948c120..bbc2fb5 100644
--- a/charts/spire/charts/spire-server/templates/bundle-configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml
@@ -2,5 +2,5 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ .Values.bundleConfigMap }}
+  name: {{ include "spire-server.bundle-configmap" . }}
   namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml
index 31063da..d1143f5 100644
--- a/charts/spire/charts/spire-server/templates/configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/configmap.yaml
@@ -10,7 +10,7 @@ data:
     server {
       bind_address = "0.0.0.0"
       bind_port = "8081"
-      trust_domain = {{ .Values.trustDomain | quote }}
+      trust_domain = {{ include "spire-server.trust-domain" . | quote }}
       data_dir = "/run/spire/data"
       log_level = {{ .Values.logLevel | quote }}
 
@@ -55,7 +55,7 @@ data:
       NodeAttestor "k8s_psat" {
         plugin_data {
           clusters = {
-            {{ $root.Values.clusterName | quote }} = {
+            {{ include "spire-server.cluster-name" $root | quote }} = {
               service_account_allow_list = {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
             }
           }
@@ -73,7 +73,7 @@ data:
       Notifier "k8sbundle" {
         plugin_data {
           namespace = {{ .Values.notifier.k8sbundle.namespace | default $namespace | quote }}
-          config_map = {{ .Values.bundleConfigMap | quote }}
+          config_map = {{ include "spire-server.bundle-configmap" . | quote }}
         }
       }
 
diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
index ebf9ee8..0509a56 100644
--- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
@@ -22,8 +22,8 @@ data:
       resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
       resourceNamespace: {{ include "spire-server.namespace" . }}
     validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook
-    clusterName: {{ .Values.clusterName }}
-    trustDomain: {{ .Values.trustDomain }}
+    clusterName: {{ include "spire-server.cluster-name" . }}
+    trustDomain: {{ include "spire-server.trust-domain" . }}
     ignoreNamespaces:
       {{- with .Values.controllerManager.ignoreNamespaces }}
       {{- toYaml . | nindent 6 }}
diff --git a/charts/spire/charts/spire-server/templates/roles.yaml b/charts/spire/charts/spire-server/templates/roles.yaml
index 3382d67..7bd8b1c 100644
--- a/charts/spire/charts/spire-server/templates/roles.yaml
+++ b/charts/spire/charts/spire-server/templates/roles.yaml
@@ -8,7 +8,7 @@ metadata:
 rules:
   - apiGroups: [""]
     resources: [configmaps]
-    resourceNames: [{{ .Values.bundleConfigMap }}]
+    resourceNames: [{{ include "spire-server.bundle-configmap" . }}]
     verbs:
       - get
       - patch
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 5324b55..07ed1e4 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -85,7 +85,7 @@ jwtIssuer: oidc-discovery.example.org
 clusterName: example-cluster
 trustDomain: example.org
 
-bundleConfigMap: spire-server
+bundleConfigMap: spire-bundle
 
 federation:
   enabled: false
diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml
index 76e0e1b..fb91ef5 100644
--- a/charts/spire/values.yaml
+++ b/charts/spire/values.yaml
@@ -1,8 +1,16 @@
-# You can enable features that affect all services here.
-# global:
-#   telemetry:
-#     prometheus:
-#       enabled: true
+# You can enable config/features that affect all services here.
+global:
+  spire:
+    # -- Set the name of the Kubernetes cluster
+    clusterName: "example-cluster"
+    # -- Set the trust domain to use for the spiffe identifiers
+    trustDomain: "example.org"
+    # -- Override all instances of bundleConfigMap
+    bundleConfigMap: ""
+
+#  telemetry:
+#    prometheus:
+#      enabled: true
 
 nameOverride: ""
 fullnameOverride: ""
@@ -11,10 +19,6 @@ fullnameOverride: ""
 spire-server:
   enabled: true
   nameOverride: server
-  bundleConfigMap: &bundleConfigMap spire-bundle
-
-  clusterName: &clusterName "example-cluster"
-  trustDomain: &trustDomain "example.org"
 
   controllerManager:
     enabled: true
@@ -22,14 +26,9 @@ spire-server:
 spire-agent:
   enabled: true
   nameOverride: agent
-  bundleConfigMap: *bundleConfigMap
-
-  clusterName: *clusterName
-  trustDomain: *trustDomain
 
 spiffe-csi-driver:
   enabled: true
 
 spiffe-oidc-discovery-provider:
   enabled: false
-  trustDomain: *trustDomain

From a7709287bfcf7ca6c46fe202933975fc315890ce Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@gmail.com>
Date: Mon, 3 Apr 2023 14:33:30 +0200
Subject: [PATCH 23/33] Switch busybox image to
 cgr.dev/chainguard/busybox:latest-glibc (#175)

---
 .github/tests/extras/values.yaml                     |  8 ++++----
 .../templates/tests/test-connection.yaml             |  8 ++++----
 .../templates/tests/test-connection.yaml             | 12 ++++++------
 3 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/tests/extras/values.yaml b/.github/tests/extras/values.yaml
index 274bc39..41a416e 100644
--- a/.github/tests/extras/values.yaml
+++ b/.github/tests/extras/values.yaml
@@ -1,7 +1,7 @@
 spire-agent:
   initContainers:
   - name: extra-init
-    image: busybox
+    image: cgr.dev/chainguard/busybox:latest-glibc
     command:
     - sh
     - -xec
@@ -12,7 +12,7 @@ spire-agent:
       mountPath: /extra
   extraContainers:
   - name: extra
-    image: busybox
+    image: cgr.dev/chainguard/busybox:latest-glibc
     command:
     - sh
     - -xec
@@ -32,7 +32,7 @@ spire-agent:
 spire-server:
   initContainers:
   - name: extra-init
-    image: busybox
+    image: cgr.dev/chainguard/busybox:latest-glibc
     command:
     - sh
     - -xec
@@ -43,7 +43,7 @@ spire-server:
       mountPath: /extra
   extraContainers:
   - name: extra
-    image: busybox
+    image: cgr.dev/chainguard/busybox:latest-glibc
     command:
     - sh
     - -xec
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
index 70ab843..ab04d40 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
@@ -12,26 +12,26 @@ spec:
     {{- toYaml .Values.podSecurityContext | nindent 4 }}
   containers:
     - name: wget-service-name
-      image: busybox
+      image: cgr.dev/chainguard/bash:latest
       command: ['wget']
       args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     - name: wget-service-name-namespace
-      image: busybox
+      image: cgr.dev/chainguard/bash:latest
       command: ['wget']
       args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     - name: wget-service-name-namespace-svc-cluster-local
-      image: busybox
+      image: cgr.dev/chainguard/bash:latest
       command: ['wget']
       args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.cluster.local:{{ .Values.service.port }}/.well-known/openid-configuration']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     {{- if .Values.ingress.enabled }}
     - name: wget-ingress
-      image: busybox
+      image: cgr.dev/chainguard/bash:latest
       command: ['wget']
       args: ['-O', '/dev/null', '{{ index .Values.config.domains 0 }}/.well-known/openid-configuration']
       securityContext:
diff --git a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
index 4daa47d..0293420 100644
--- a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
+++ b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
@@ -11,17 +11,17 @@ spec:
   securityContext:
     {{- toYaml .Values.podSecurityContext | nindent 4 }}
   containers:
-    - name: wget
-      image: busybox
+    - name: netcat
+      image: cgr.dev/chainguard/bash:latest
       command: ['nc']
       args: ['-zvw3', '{{ include "spire-server.fullname" . }}', '{{ .Values.service.port }}']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     {{- if eq (.Values.federation.enabled | toString) "true" }}
-    - name: wget-federation-bundle-endpoint
-      image: busybox
-      command: ['wget']
-      args: ['--no-check-certificate', '-O', '/dev/null', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.cluster.local:{{ .Values.federation.bundleEndpoint.port }}']
+    - name: curl-federation-bundle-endpoint
+      image: cgr.dev/chainguard/bash:latest
+      command: ['curl']
+      args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.cluster.local:{{ .Values.federation.bundleEndpoint.port }}']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     {{- end }}

From 1b4bfb779e2441a677f8a0f6097fdf3fda51a287 Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@gmail.com>
Date: Mon, 3 Apr 2023 14:14:12 +0200
Subject: [PATCH 24/33] Cleanup old leftover to k8s-workload-registrar

Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 charts/spire/charts/spire-server/templates/_helpers.tpl | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl
index 6d53181..85fe37e 100644
--- a/charts/spire/charts/spire-server/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-server/templates/_helpers.tpl
@@ -99,10 +99,6 @@ Create the name of the service account to use
 {{ include "spire-server.fullname" . | trimSuffix "-server" }}-controller-manager
 {{- end }}
 
-{{- define "spire-k8s-workload-registrar.fullname" -}}
-{{ include "spire-server.fullname" . | trimSuffix "-server" }}-k8s-workload-registrar
-{{- end }}
-
 {{- define "spire-server.serviceAccountAllowedList" }}
 {{- if ne (len .Values.nodeAttestor.k8sPsat.serviceAccountAllowList) 0 }}
 {{- .Values.nodeAttestor.k8sPsat.serviceAccountAllowList | toJson }}

From 072d952d9ae61a2e708527d809a69192e52f387d Mon Sep 17 00:00:00 2001
From: kfox1111 <Kevin.Fox@pnnl.gov>
Date: Mon, 3 Apr 2023 10:32:18 -0700
Subject: [PATCH 25/33] Switch tests to curl (#178)

Co-authored-by: Marco Franssen <marco.franssen@gmail.com>
Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 .../templates/tests/test-connection.yaml      | 24 +++++++++----------
 .../templates/tests/test-connection.yaml      | 18 +++++++++++---
 2 files changed, 27 insertions(+), 15 deletions(-)

diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
index ab04d40..b6c09bb 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
@@ -11,29 +11,29 @@ spec:
   securityContext:
     {{- toYaml .Values.podSecurityContext | nindent 4 }}
   containers:
-    - name: wget-service-name
+    - name: curl-service-name
       image: cgr.dev/chainguard/bash:latest
-      command: ['wget']
-      args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
+      command: ['curl']
+      args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
-    - name: wget-service-name-namespace
+    - name: curl-service-name-namespace
       image: cgr.dev/chainguard/bash:latest
-      command: ['wget']
-      args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
+      command: ['curl']
+      args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
-    - name: wget-service-name-namespace-svc-cluster-local
+    - name: curl-service-name-namespace-svc-cluster-local
       image: cgr.dev/chainguard/bash:latest
-      command: ['wget']
-      args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.cluster.local:{{ .Values.service.port }}/.well-known/openid-configuration']
+      command: ['curl']
+      args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.cluster.local:{{ .Values.service.port }}/.well-known/openid-configuration']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     {{- if .Values.ingress.enabled }}
-    - name: wget-ingress
+    - name: curl-ingress
       image: cgr.dev/chainguard/bash:latest
-      command: ['wget']
-      args: ['-O', '/dev/null', '{{ index .Values.config.domains 0 }}/.well-known/openid-configuration']
+      command: ['curl']
+      args: ['-s', '-f', 'http://{{ index .Values.config.domains 0 }}/.well-known/openid-configuration']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     {{- end }}
diff --git a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
index 0293420..392bf1d 100644
--- a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
+++ b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
@@ -11,10 +11,22 @@ spec:
   securityContext:
     {{- toYaml .Values.podSecurityContext | nindent 4 }}
   containers:
-    - name: netcat
+    - name: curl
       image: cgr.dev/chainguard/bash:latest
-      command: ['nc']
-      args: ['-zvw3', '{{ include "spire-server.fullname" . }}', '{{ .Values.service.port }}']
+      command: ['bash']
+      args:
+        - -c
+        - |
+          curl -f -s 'https://{{ include "spire-server.fullname" . }}:{{ .Values.service.port }}'
+          NOCA=$?
+          curl -k -f -s 'https://{{ include "spire-server.fullname" . }}:{{ .Values.service.port }}'
+          IGNORECA=$?
+          echo $NOCA $IGNORECA
+          if [ $NOCA -eq 60 -a $IGNORECA -eq 22 ]; then
+            # We were able to connect to the server but didn't recognize the ca (60) and the page not found (22) because we're not using grpc
+            exit 0
+          fi
+          exit 1
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     {{- if eq (.Values.federation.enabled | toString) "true" }}

From 280315ca68f6027fc04dde23eee2eb2b219907c1 Mon Sep 17 00:00:00 2001
From: kfox1111 <Kevin.Fox@pnnl.gov>
Date: Mon, 3 Apr 2023 10:37:19 -0700
Subject: [PATCH 26/33] Fix namespace-override github test summary (#154)

Co-authored-by: Marco Franssen <marco.franssen@gmail.com>
Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 .../tests/namespace-override/post-install.sh  | 24 ++++++++++++++-----
 .github/workflows/helm-chart-ci.yaml          |  3 ++-
 2 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/.github/tests/namespace-override/post-install.sh b/.github/tests/namespace-override/post-install.sh
index d93ebd9..c565da6 100755
--- a/.github/tests/namespace-override/post-install.sh
+++ b/.github/tests/namespace-override/post-install.sh
@@ -5,17 +5,29 @@ set -x
 SCRIPT=$(readlink -f "$0")
 SCRIPTPATH=$(dirname "$SCRIPT")
 
-k_wait=(kubectl wait --for condition=available --timeout 30s --namespace)
-k_rollout_status=(kubectl rollout status --watch --timeout 30s --namespace)
+k_wait () {
+  kubectl wait --for condition=available --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1
+}
+
+k_rollout_status () {
+  kubectl rollout status --watch --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1
+}
+
+RELEASE=$(helm ls --no-headers -n "${scenario}" | awk '{print $1}' | grep 'spire-[^-]*$')
 
 cat <<EOF >>"$GITHUB_STEP_SUMMARY"
+### release
+| release |
+| ------- |
+| $RELEASE |
+
 ### spire
 | workload | Status |
 | -------- | ------ |
-| spire-server | $("${k_rollout_status[@]}" spire-server statefulset spire-server) |
-| spire-spiffe-csi-driver | $("${k_rollout_status[@]}" spire-system daemonset spire-spiffe-csi-driver) |
-| spire-agent | $("${k_rollout_status[@]}" spire-system daemonset spire-agent) |
-| spire-spiffe-oidc-discovery-provider | $("${k_wait[@]}" spire-server deployments.apps spire-spiffe-oidc-discovery-provider) |
+| spire-server | <pre>$(k_rollout_status spire-server statefulset "${RELEASE}-server")</pre> |
+| spire-spiffe-csi-driver | <pre>$(k_rollout_status spire-system daemonset "${RELEASE}-spiffe-csi-driver")</pre> |
+| spire-agent | <pre>$(k_rollout_status spire-system daemonset "${RELEASE}-agent")</pre> |
+| spire-spiffe-oidc-discovery-provider | <pre>$(k_wait spire-server deployments.apps "${RELEASE}-spiffe-oidc-discovery-provider")</pre> |
 EOF
 
 if [ $1 -ne 0 ]; then
diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml
index 64d0a0b..c55fd18 100644
--- a/.github/workflows/helm-chart-ci.yaml
+++ b/.github/workflows/helm-chart-ci.yaml
@@ -20,7 +20,7 @@ concurrency:
 env:
   HELM_VERSION: v3.11.1
   PYTHON_VERSION: 3.11.2
-  CHART_TESTING_VERSION: v3.7.1
+  CHART_TESTING_VERSION: v3.8.0
 
 jobs:
   checks:
@@ -189,6 +189,7 @@ jobs:
               --namespace "${scenario}" \
               --target-branch ${{ github.base_ref }} \
               --exclude-deprecated \
+              --skip-clean-up \
               ${{ (matrix.values != 'default' && '--helm-extra-set-args "--values=${TEST_DIR}/values.yaml ${EXTRA_HELM_ARGS}"') || '' }}
           fi
         env:

From ec236e97626ed00cdde9f19a8366e508256ebfc7 Mon Sep 17 00:00:00 2001
From: kfox1111 <Kevin.Fox@pnnl.gov>
Date: Mon, 3 Apr 2023 10:50:06 -0700
Subject: [PATCH 27/33] Test for configurable images (#182)

Co-authored-by: Marco Franssen <marco.franssen@gmail.com>
Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 .github/workflows/helm-chart-ci.yaml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml
index c55fd18..256506e 100644
--- a/.github/workflows/helm-chart-ci.yaml
+++ b/.github/workflows/helm-chart-ci.yaml
@@ -49,6 +49,25 @@ jobs:
             fi
           done
 
+      - name: Check objects for images without overrides
+        run: |
+          set +e
+          set -o pipefail
+          # Look for image: definitions that are not templated. If we find none, exit is not 0 and we invert the error code to get the
+          # test to pass. Ignore tests for now...
+          grep "image:" charts/spire/charts/*/templates/*.* | grep -v 'image: {{ template "' > /tmp/findings
+          res=$?
+          if [ $res -eq 0 ]; then
+            {
+              echo "## Hardcoded images"
+              echo 
+              echo ":x: These templates were found to be using statically defined images and not overridable ones. Please fix."
+              echo
+              cat /tmp/findings
+            } >> "$GITHUB_STEP_SUMMARY"
+            exit 1
+          fi
+
   lint-chart:
     runs-on: ubuntu-22.04
 

From c661d0bc7ee580682459f483d468148cd3a08970 Mon Sep 17 00:00:00 2001
From: kfox1111 <Kevin.Fox@pnnl.gov>
Date: Mon, 3 Apr 2023 10:52:36 -0700
Subject: [PATCH 28/33] Make service dns domain configurable (#164)

Co-authored-by: Marco Franssen <marco.franssen@gmail.com>
Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 charts/spire/README.md                                    | 1 +
 .../spire/charts/spiffe-oidc-discovery-provider/README.md | 1 +
 .../spiffe-oidc-discovery-provider/templates/_helpers.tpl | 8 ++++++++
 .../templates/configmap.yaml                              | 2 +-
 .../templates/tests/test-connection.yaml                  | 2 +-
 .../charts/spiffe-oidc-discovery-provider/values.yaml     | 2 ++
 charts/spire/charts/spire-server/README.md                | 1 +
 charts/spire/charts/spire-server/templates/_helpers.tpl   | 8 ++++++++
 .../spire-server/templates/tests/test-connection.yaml     | 2 +-
 charts/spire/charts/spire-server/values.yaml              | 3 +++
 charts/spire/values.yaml                                  | 3 +++
 11 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/charts/spire/README.md b/charts/spire/README.md
index d23e402..091fd64 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -105,6 +105,7 @@ Kubernetes: `>=1.21.0-0`
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
 | fullnameOverride | string | `""` |  |
+| global.k8s.clusterDomain | string | `"cluster.local"` |  |
 | global.spire.bundleConfigMap | string | `""` | Override all instances of bundleConfigMap |
 | global.spire.clusterName | string | `"example-cluster"` | Set the name of the Kubernetes cluster |
 | global.spire.trustDomain | string | `"example.org"` | Set the trust domain to use for the spiffe identifiers |
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md
index b5dd649..9ba5d0b 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md
@@ -21,6 +21,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
 | autoscaling.minReplicas | int | `1` |  |
 | autoscaling.targetCPUUtilizationPercentage | int | `80` |  |
 | autoscaling.targetMemoryUtilizationPercentage | int | `80` |  |
+| clusterDomain | string | `"cluster.local"` |  |
 | config.acme.cacheDir | string | `"/run/spire"` |  |
 | config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` |  |
 | config.acme.emailAddress | string | `"letsencrypt@example.org"` |  |
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
index bda54f2..fbe6f33 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
@@ -103,3 +103,11 @@ Create the name of the service account to use
 {{- .Values.trustDomain }}
 {{- end }}
 {{- end }}
+
+{{- define "spiffe-oidc-discovery-provider.cluster-domain" }}
+{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
+{{- .Values.global.k8s.clusterDomain }}
+{{- else }}
+{{- .Values.clusterDomain }}
+{{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml
index 70308ad..a0ec2bf 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml
@@ -11,7 +11,7 @@ data:
     domains = [
       "{{ include "spiffe-oidc-discovery-provider.fullname" . }}",
       "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}",
-      "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.cluster.local",
+      "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}",
     {{- if gt (len .Values.config.domains) 0 }}
       "{{- join "\",\n      \"" .Values.config.domains }}"
     {{- end }}
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
index b6c09bb..e687868 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
@@ -26,7 +26,7 @@ spec:
     - name: curl-service-name-namespace-svc-cluster-local
       image: cgr.dev/chainguard/bash:latest
       command: ['curl']
-      args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.cluster.local:{{ .Values.service.port }}/.well-known/openid-configuration']
+      args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     {{- if .Values.ingress.enabled }}
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
index 88f53b0..e4871fb 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
@@ -113,6 +113,8 @@ tolerations: []
 affinity: {}
 
 trustDomain: example.org
+# -- This is the value of your clusters `kubeadm init --service-dns-domain` flag
+clusterDomain: cluster.local
 
 telemetry:
   prometheus:
diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index 347c653..108db58 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -28,6 +28,7 @@ A Helm chart to install the SPIRE server.
 | ca_subject.common_name | string | `"example.org"` |  |
 | ca_subject.country | string | `"NL"` |  |
 | ca_subject.organization | string | `"Example"` |  |
+| clusterDomain | string | `"cluster.local"` |  |
 | clusterName | string | `"example-cluster"` |  |
 | controllerManager.enabled | bool | `false` |  |
 | controllerManager.identities.dnsNameTemplates | list | `[]` |  |
diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl
index 85fe37e..786ef07 100644
--- a/charts/spire/charts/spire-server/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-server/templates/_helpers.tpl
@@ -130,3 +130,11 @@ Create the name of the service account to use
 {{- .Values.bundleConfigMap }}
 {{- end }}
 {{- end }}
+
+{{- define "spire-server.cluster-domain" -}}
+{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
+{{- .Values.global.k8s.clusterDomain }}
+{{- else }}
+{{- .Values.clusterDomain }}
+{{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
index 392bf1d..ce49605 100644
--- a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
+++ b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
@@ -33,7 +33,7 @@ spec:
     - name: curl-federation-bundle-endpoint
       image: cgr.dev/chainguard/bash:latest
       command: ['curl']
-      args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.cluster.local:{{ .Values.federation.bundleEndpoint.port }}']
+      args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-server.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     {{- end }}
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 07ed1e4..61df91c 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -87,6 +87,9 @@ trustDomain: example.org
 
 bundleConfigMap: spire-bundle
 
+# -- This is the value of your clusters `kubeadm init --service-dns-domain` flag
+clusterDomain: cluster.local
+
 federation:
   enabled: false
   bundleEndpoint:
diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml
index fb91ef5..e34b928 100644
--- a/charts/spire/values.yaml
+++ b/charts/spire/values.yaml
@@ -1,5 +1,8 @@
 # You can enable config/features that affect all services here.
 global:
+  k8s:
+    # -- This is the value of your clusters `kubeadm init --service-dns-domain` flag
+    clusterDomain: "cluster.local"
   spire:
     # -- Set the name of the Kubernetes cluster
     clusterName: "example-cluster"

From daa620bf05c68a20de491fc9cf0be9542d2afe27 Mon Sep 17 00:00:00 2001
From: kfox1111 <Kevin.Fox@pnnl.gov>
Date: Mon, 3 Apr 2023 10:54:53 -0700
Subject: [PATCH 29/33] Fix production example test (#183)

Co-authored-by: Marco Franssen <marco.franssen@gmail.com>
Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 .github/tests/production-example/install.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/tests/production-example/install.sh b/.github/tests/production-example/install.sh
index 19b8806..442a97b 100755
--- a/.github/tests/production-example/install.sh
+++ b/.github/tests/production-example/install.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-set -x
+set -xe
 
 SCRIPT=$(readlink -f "$0")
 SCRIPTPATH=$(dirname "$SCRIPT")
@@ -8,4 +8,6 @@ SCRIPTPATH=$(dirname "$SCRIPT")
 helm install \
   --namespace spire-server \
   --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
-  spire charts/spire
+  spire charts/spire --wait
+
+helm test spire --namespace spire-server

From d5dc706592de9cbafe2ff08438c7d598404677b0 Mon Sep 17 00:00:00 2001
From: Faisal Memon <fymemon@yahoo.com>
Date: Tue, 4 Apr 2023 00:25:19 -0700
Subject: [PATCH 30/33] Add Kubernetes 1.21 back (#188)

Co-authored-by: Marco Franssen <marco.franssen@gmail.com>
Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 .github/workflows/helm-chart-ci.yaml | 1 +
 README.md                            | 3 ++-
 charts/spire/README.md               | 3 +++
 charts/spire/README.md.gotmpl        | 3 +++
 4 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml
index 256506e..c6755c8 100644
--- a/.github/workflows/helm-chart-ci.yaml
+++ b/.github/workflows/helm-chart-ci.yaml
@@ -152,6 +152,7 @@ jobs:
           - v1.24.7
           - v1.23.13
           - v1.22.15
+          - v1.21.14
         values:
           - ${{ fromJson(needs.build-matrix.outputs.tests) }}
 
diff --git a/README.md b/README.md
index e46dd58..d5e947b 100644
--- a/README.md
+++ b/README.md
@@ -23,8 +23,9 @@ Unless otherwise noted in an application chart README, the following dependencie
 |:-----------|:-------------------|
 | SPIRE      | `1.5.3`+, `1.6.x`  |
 | Helm       | `3.x`              |
+| Kubernetes | `1.21+`            |
 
-For Kubernetes we will officially try to support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions).
+> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. *The first version we tested this chart with is `1.21`.*
 
 ## Contributing
 
diff --git a/charts/spire/README.md b/charts/spire/README.md
index 091fd64..737ddf1 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -19,6 +19,9 @@ A Helm chart for deploying the complete Spire stack including: spire-server, spi
 |:-----------|:-------------------|
 | SPIRE      | `1.5.3+`, `1.6.x`  |
 | Helm       | `3.x`              |
+| Kubernetes | `1.21+`            |
+
+> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. *The first version we tested this chart with is `1.21`.*
 
 ## Prerequisites
 
diff --git a/charts/spire/README.md.gotmpl b/charts/spire/README.md.gotmpl
index a5fdd06..70823d0 100644
--- a/charts/spire/README.md.gotmpl
+++ b/charts/spire/README.md.gotmpl
@@ -21,6 +21,9 @@
 |:-----------|:-------------------|
 | SPIRE      | `1.5.3+`, `1.6.x`  |
 | Helm       | `3.x`              |
+| Kubernetes | `1.21+`            |
+
+> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. *The first version we tested this chart with is `1.21`.*
 
 ## Prerequisites
 

From 456075f8431299fff007a68c319790269b6a489c Mon Sep 17 00:00:00 2001
From: Faisal Memon <fymemon@yahoo.com>
Date: Tue, 4 Apr 2023 00:46:49 -0700
Subject: [PATCH 31/33] Add hooks to set failurepolicy to ignore on webhook
 (#128)

Co-authored-by: Marco Franssen <marco.franssen@gmail.com>
Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 charts/spire/charts/spire-server/README.md    |  4 +
 .../templates/controller-manager-webhook.yaml |  4 +-
 .../templates/post-install-hook.yaml          | 85 +++++++++++++++++++
 .../templates/post-upgrade-hook.yaml          | 85 +++++++++++++++++++
 .../templates/pre-upgrade-hook.yaml           | 85 +++++++++++++++++++
 charts/spire/charts/spire-server/values.yaml  |  6 ++
 6 files changed, 267 insertions(+), 2 deletions(-)
 create mode 100644 charts/spire/charts/spire-server/templates/post-install-hook.yaml
 create mode 100644 charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
 create mode 100644 charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml

diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index 108db58..6574da3 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -49,6 +49,10 @@ A Helm chart to install the SPIRE server.
 | controllerManager.service.port | int | `443` |  |
 | controllerManager.service.type | string | `"ClusterIP"` |  |
 | controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` |  |
+| controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` |  |
+| controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"cgr.dev"` |  |
+| controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"chainguard/kubectl"` |  |
+| controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `"latest"` |  |
 | dataStorage.accessMode | string | `"ReadWriteOnce"` |  |
 | dataStorage.enabled | bool | `true` |  |
 | dataStorage.size | string | `"1Gi"` |  |
diff --git a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml
index 1e55403..4216396 100644
--- a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml
+++ b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml
@@ -10,7 +10,7 @@ webhooks:
         name: {{ include "spire-controller-manager.fullname" . }}-webhook
         namespace: {{ include "spire-server.namespace" . }}
         path: /validate-spire-spiffe-io-v1alpha1-clusterfederatedtrustdomain
-    failurePolicy: {{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}
+    failurePolicy: Ignore # Actual value to be set by post install/upgrade hooks
     name: vclusterfederatedtrustdomain.kb.io
     rules:
       - apiGroups: ["spire.spiffe.io"]
@@ -24,7 +24,7 @@ webhooks:
         name: {{ include "spire-controller-manager.fullname" . }}-webhook
         namespace: {{ include "spire-server.namespace" . }}
         path: /validate-spire-spiffe-io-v1alpha1-clusterspiffeid
-    failurePolicy: {{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}
+    failurePolicy: Ignore # Actual value to be set by post install/upgrade hooks
     name: vclusterspiffeid.kb.io
     rules:
       - apiGroups: ["spire.spiffe.io"]
diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml
new file mode 100644
index 0000000..d30893d
--- /dev/null
+++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml
@@ -0,0 +1,85 @@
+{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
+{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "spire-server.serviceAccountName" . }}-post-install
+  namespace: {{ include "spire-server.namespace" . }}
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": post-install
+    "helm.sh/hook-delete-policy": hook-succeeded, hook-failed
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "spire-server.fullname" . }}-post-install
+  annotations:
+    "helm.sh/hook": post-install
+    "helm.sh/hook-delete-policy": hook-succeeded, hook-failed
+rules:
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations"]
+    resourceNames: [{{ printf "%s-webhook"  (include "spire-controller-manager.fullname" .) | quote }}]
+    verbs: ["get", "patch"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire-server.fullname" . }}-post-install
+  annotations:
+    "helm.sh/hook": post-install
+    "helm.sh/hook-delete-policy": hook-succeeded, hook-failed
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "spire-server.serviceAccountName" . }}-post-install
+    namespace: {{ include "spire-server.namespace" . }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "spire-server.fullname" . }}-post-install
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "spire-server.fullname" . }}-post-install
+  namespace: {{ include "spire-server.namespace" . }}
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": post-install
+    "helm.sh/hook-delete-policy": hook-succeeded, hook-failed
+spec:
+  template:
+    metadata:
+      name: {{ include "spire-server.fullname" . }}-post-install
+    spec:
+      restartPolicy: Never
+      serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-install
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+      - name: post-install-job
+        securityContext:
+          {{- toYaml .Values.securityContext | nindent 10 }}
+        image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
+        command:
+        - /bin/sh
+        - -c
+        - |-
+          kubectl patch validatingwebhookconfiguration {{ include "spire-controller-manager.fullname" . }}-webhook --type='strategic' -p '
+          {
+            "webhooks":[
+              {
+                "name":"vclusterspiffeid.kb.io",
+                "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
+              },
+              {
+                "name":"vclusterfederatedtrustdomain.kb.io",
+                "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
+              }
+            ]
+          }'
+{{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
new file mode 100644
index 0000000..a6fd319
--- /dev/null
+++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
@@ -0,0 +1,85 @@
+{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
+{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "spire-server.serviceAccountName" . }}-post-upgrade
+  namespace: {{ include "spire-server.namespace" . }}
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": post-upgrade
+    "helm.sh/hook-delete-policy": hook-succeeded, hook-failed
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "spire-server.fullname" . }}-post-upgrade
+  annotations:
+    "helm.sh/hook": post-upgrade
+    "helm.sh/hook-delete-policy": hook-succeeded, hook-failed
+rules:
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations"]
+    resourceNames: [{{ printf "%s-webhook"  (include "spire-controller-manager.fullname" .) | quote }}]
+    verbs: ["get", "patch"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire-server.fullname" . }}-post-upgrade
+  annotations:
+    "helm.sh/hook": post-upgrade
+    "helm.sh/hook-delete-policy": hook-succeeded, hook-failed
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "spire-server.serviceAccountName" . }}-post-upgrade
+    namespace: {{ include "spire-server.namespace" . }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "spire-server.fullname" . }}-post-upgrade
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "spire-server.fullname" . }}-post-upgrade
+  namespace: {{ include "spire-server.namespace" . }}
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": post-upgrade
+    "helm.sh/hook-delete-policy": hook-succeeded, hook-failed
+spec:
+  template:
+    metadata:
+      name: {{ include "spire-server.fullname" . }}-post-upgrade
+    spec:
+      restartPolicy: Never
+      serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-upgrade 
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+      - name: post-upgrade-job
+        securityContext:
+          {{- toYaml .Values.securityContext | nindent 10 }}
+        image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
+        command:
+        - /bin/sh
+        - -c
+        - |-
+          kubectl patch validatingwebhookconfiguration {{ include "spire-controller-manager.fullname" . }}-webhook --type='strategic' -p '
+          {
+            "webhooks":[
+              {
+                "name":"vclusterspiffeid.kb.io",
+                "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
+              },
+              {
+                "name":"vclusterfederatedtrustdomain.kb.io",
+                "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
+              }
+            ]
+          }'
+{{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
new file mode 100644
index 0000000..bf4fa74
--- /dev/null
+++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
@@ -0,0 +1,85 @@
+{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
+{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "spire-server.serviceAccountName" . }}-pre-upgrade
+  namespace: {{ include "spire-server.namespace" . }}
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-delete-policy": hook-succeeded, hook-failed
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "spire-server.fullname" . }}-pre-upgrade
+  annotations:
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-delete-policy": hook-succeeded, hook-failed
+rules:
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations"]
+    resourceNames: [{{ printf "%s-webhook"  (include "spire-controller-manager.fullname" .) | quote }}]
+    verbs: ["get", "patch"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire-server.fullname" . }}-pre-upgrade
+  annotations:
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-delete-policy": hook-succeeded, hook-failed
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "spire-server.serviceAccountName" . }}-pre-upgrade
+    namespace: {{ include "spire-server.namespace" . }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "spire-server.fullname" . }}-pre-upgrade
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "spire-server.fullname" . }}-pre-upgrade
+  namespace: {{ include "spire-server.namespace" . }}
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-delete-policy": hook-succeeded, hook-failed
+spec:
+  template:
+    metadata:
+      name: {{ include "spire-server.fullname" . }}-pre-upgrade
+    spec:
+      restartPolicy: Never
+      serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-upgrade
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+      - name: post-install-job
+        securityContext:
+          {{- toYaml .Values.securityContext | nindent 10 }}
+        image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
+        command:
+        - /bin/sh
+        - -c
+        - |-
+          kubectl patch validatingwebhookconfiguration {{ include "spire-controller-manager.fullname" . }}-webhook --type='strategic' -p '
+          {
+            "webhooks":[
+              {
+                "name":"vclusterspiffeid.kb.io",
+                "failurePolicy":"Ignore"
+              },
+              {
+                "name":"vclusterfederatedtrustdomain.kb.io",
+                "failurePolicy":"Ignore"
+              }
+            ]
+          }'
+{{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 61df91c..76274fd 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -185,6 +185,12 @@ controllerManager:
 
   validatingWebhookConfiguration:
     failurePolicy: Fail
+    upgradeHook:
+      image:
+        registry: cgr.dev
+        repository: chainguard/kubectl
+        pullPolicy: IfNotPresent
+        version: latest
 
 telemetry:
   prometheus:

From 563e1f79209b0eb3564f744d53ca63ab07a97b2d Mon Sep 17 00:00:00 2001
From: kfox1111 <Kevin.Fox@pnnl.gov>
Date: Tue, 4 Apr 2023 00:55:35 -0700
Subject: [PATCH 32/33] Add podmonitors (#165)

Co-authored-by: Marco Franssen <marco.franssen@gmail.com>
Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 .github/tests/prometheus/pre-install.sh       |  3 ++
 .github/tests/prometheus/values.yaml          |  9 ++++++
 .../spiffe-oidc-discovery-provider/README.md  |  3 ++
 .../templates/_helpers.tpl                    | 10 +++++++
 .../templates/podmonitor.yaml                 | 29 +++++++++++++++++++
 .../values.yaml                               |  5 ++++
 charts/spire/charts/spire-agent/README.md     |  3 ++
 .../charts/spire-agent/templates/_helpers.tpl | 10 +++++++
 .../spire-agent/templates/podmonitor.yaml     | 27 +++++++++++++++++
 charts/spire/charts/spire-agent/values.yaml   |  5 ++++
 charts/spire/charts/spire-server/README.md    |  3 ++
 .../spire-server/templates/_helpers.tpl       | 10 +++++++
 .../spire-server/templates/podmonitor.yaml    | 27 +++++++++++++++++
 charts/spire/charts/spire-server/values.yaml  |  5 ++++
 charts/spire/values.yaml                      |  5 ++++
 15 files changed, 154 insertions(+)
 create mode 100755 .github/tests/prometheus/pre-install.sh
 create mode 100644 charts/spire/charts/spiffe-oidc-discovery-provider/templates/podmonitor.yaml
 create mode 100644 charts/spire/charts/spire-agent/templates/podmonitor.yaml
 create mode 100644 charts/spire/charts/spire-server/templates/podmonitor.yaml

diff --git a/.github/tests/prometheus/pre-install.sh b/.github/tests/prometheus/pre-install.sh
new file mode 100755
index 0000000..5959a16
--- /dev/null
+++ b/.github/tests/prometheus/pre-install.sh
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+helm install kube-prometheus-stack kube-prometheus-stack --version 45.7.1 --repo https://prometheus-community.github.io/helm-charts -n "$scenario" --wait
diff --git a/.github/tests/prometheus/values.yaml b/.github/tests/prometheus/values.yaml
index b66af8d..a0886e4 100644
--- a/.github/tests/prometheus/values.yaml
+++ b/.github/tests/prometheus/values.yaml
@@ -2,3 +2,12 @@ global:
   telemetry:
     prometheus:
       enabled: true
+      podMonitor:
+        enabled: true
+        labels:
+          release: kube-prometheus-stack
+
+spiffe-oidc-discovery-provider:
+  enabled: true
+  insecureScheme:
+    enabled: true
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md
index 9ba5d0b..3504e7f 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md
@@ -68,6 +68,9 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
 | telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` |  |
 | telemetry.prometheus.nginxExporter.image.version | string | `"0.11.0"` |  |
 | telemetry.prometheus.nginxExporter.resources | object | `{}` |  |
+| telemetry.prometheus.podMonitor.enabled | bool | `false` |  |
+| telemetry.prometheus.podMonitor.labels | object | `{}` |  |
+| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider |
 | telemetry.prometheus.port | int | `9988` |  |
 | tolerations | list | `[]` |  |
 | trustDomain | string | `"example.org"` |  |
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
index fbe6f33..139e151 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
@@ -34,6 +34,16 @@ Allow the release namespace to be overridden for multi-namespace deployments in
   {{- end -}}
 {{- end -}}
 
+{{- define "spiffe-oidc-discovery-provider.podMonitor.namespace" -}}
+  {{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }}
+    {{- .Values.telemetry.prometheus.podMonitor.namespace }}
+  {{- else if ne (len (dig "telemetry" "prometheus" "podMonitor" "namespace" "" .Values.global)) 0 }}
+    {{- .Values.global.telemetry.prometheus.podMonitor.namespace }}
+  {{- else }}
+    {{- include "spiffe-oidc-discovery-provider.namespace" . }}
+  {{- end }}
+{{- end -}}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/podmonitor.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/podmonitor.yaml
new file mode 100644
index 0000000..dec060f
--- /dev/null
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/podmonitor.yaml
@@ -0,0 +1,29 @@
+{{- if .Values.insecureScheme.enabled }}
+{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
+{{- $namespace := include "spiffe-oidc-discovery-provider.podMonitor.namespace" . }}
+{{- $podNamespace := ( include "spiffe-oidc-discovery-provider.namespace" . ) }}
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: {{ include "spire-agent.fullname" . }}
+  namespace: {{ $namespace }}
+  labels:
+    {{- include "spire-agent.labels" . | nindent 4 }}
+    {{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }}
+    {{- .Values.global.telemetry.prometheus.podMonitor.labels | toYaml | nindent 4 }}
+    {{- end }}
+    {{- with .Values.telemetry.prometheus.podMonitor.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "spire-agent.selectorLabels" . | nindent 6 }}
+  podMetricsEndpoints:
+    - port: prom
+  {{- if ne $namespace $podNamespace }}
+  namespaceSelector:
+    kubernetes.io/metadata.name: {{ $podNamespace }}
+  {{- end }}  
+{{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
index e4871fb..1424301 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
@@ -120,6 +120,11 @@ telemetry:
   prometheus:
     enabled: false
     port: 9988
+    podMonitor:
+      enabled: false
+      # -- Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider
+      namespace: ""
+      labels: {}
 
     nginxExporter:
       image:
diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md
index e8a9665..035c857 100644
--- a/charts/spire/charts/spire-agent/README.md
+++ b/charts/spire/charts/spire-agent/README.md
@@ -44,6 +44,9 @@ A Helm chart to install the SPIRE agent.
 | serviceAccount.name | string | `""` |  |
 | socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` |  |
 | telemetry.prometheus.enabled | bool | `false` |  |
+| telemetry.prometheus.podMonitor.enabled | bool | `false` |  |
+| telemetry.prometheus.podMonitor.labels | object | `{}` |  |
+| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent |
 | telemetry.prometheus.port | int | `9988` |  |
 | trustDomain | string | `"example.org"` |  |
 | waitForIt.image.pullPolicy | string | `"IfNotPresent"` |  |
diff --git a/charts/spire/charts/spire-agent/templates/_helpers.tpl b/charts/spire/charts/spire-agent/templates/_helpers.tpl
index 065f6ed..ff43724 100644
--- a/charts/spire/charts/spire-agent/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-agent/templates/_helpers.tpl
@@ -42,6 +42,16 @@ Allow the release namespace to be overridden for multi-namespace deployments in
   {{- end -}}
 {{- end -}}
 
+{{- define "spire-agent.podMonitor.namespace" -}}
+  {{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }}
+    {{- .Values.telemetry.prometheus.podMonitor.namespace }}
+  {{- else if ne (len (dig "telemetry" "prometheus" "podMonitor" "namespace" "" .Values.global)) 0 }}
+    {{- .Values.global.telemetry.prometheus.podMonitor.namespace }}
+  {{- else }}
+    {{- include "spire-agent.namespace" . }}
+  {{- end }}
+{{- end -}}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}
diff --git a/charts/spire/charts/spire-agent/templates/podmonitor.yaml b/charts/spire/charts/spire-agent/templates/podmonitor.yaml
new file mode 100644
index 0000000..92fd0e3
--- /dev/null
+++ b/charts/spire/charts/spire-agent/templates/podmonitor.yaml
@@ -0,0 +1,27 @@
+{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
+{{- $namespace := include "spiffe-oidc-discovery-provider.podMonitor.namespace" . }}
+{{- $podNamespace := ( include "spiffe-oidc-discovery-provider.namespace" . ) }}
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
+  namespace: {{ $namespace }}
+  labels:
+    {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
+    {{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }}
+    {{- .Values.global.telemetry.prometheus.podMonitor.labels | toYaml | nindent 4 }}
+    {{- end }}
+    {{- with .Values.telemetry.prometheus.podMonitor.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 6 }}
+  podMetricsEndpoints:
+    - port: prom
+  {{- if ne $namespace $podNamespace }}
+  namespaceSelector:
+    kubernetes.io/metadata.name: {{ $podNamespace }}
+  {{- end }}  
+{{- end }}
diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml
index a2b47db..e5bca41 100644
--- a/charts/spire/charts/spire-agent/values.yaml
+++ b/charts/spire/charts/spire-agent/values.yaml
@@ -86,6 +86,11 @@ telemetry:
   prometheus:
     enabled: false
     port: 9988
+    podMonitor:
+      enabled: false
+      # -- Override where to install the podMonitor, if not set will use the same namespace as the spire-agent
+      namespace: ""
+      labels: {}
 
 socketPath: /run/spire/agent-sockets/spire-agent.sock
 
diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index 6574da3..8a6abd7 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -92,6 +92,9 @@ A Helm chart to install the SPIRE server.
 | serviceAccount.create | bool | `true` |  |
 | serviceAccount.name | string | `""` |  |
 | telemetry.prometheus.enabled | bool | `false` |  |
+| telemetry.prometheus.podMonitor.enabled | bool | `false` |  |
+| telemetry.prometheus.podMonitor.labels | object | `{}` |  |
+| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
 | tolerations | list | `[]` |  |
 | topologySpreadConstraints | list | `[]` |  |
 | trustDomain | string | `"example.org"` |  |
diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl
index 786ef07..809aeb3 100644
--- a/charts/spire/charts/spire-server/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-server/templates/_helpers.tpl
@@ -34,6 +34,16 @@ Allow the release namespace to be overridden for multi-namespace deployments in
   {{- end -}}
 {{- end -}}
 
+{{- define "spire-server.podMonitor.namespace" -}}
+  {{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }}
+    {{- .Values.telemetry.prometheus.podMonitor.namespace }}
+  {{- else if ne (len (dig "telemetry" "prometheus" "podMonitor" "namespace" "" .Values.global)) 0 }}
+    {{- .Values.global.telemetry.prometheus.podMonitor.namespace }}
+  {{- else }}
+    {{- include "spire-server.namespace" . }}
+  {{- end }}
+{{- end -}}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}
diff --git a/charts/spire/charts/spire-server/templates/podmonitor.yaml b/charts/spire/charts/spire-server/templates/podmonitor.yaml
new file mode 100644
index 0000000..878a4ba
--- /dev/null
+++ b/charts/spire/charts/spire-server/templates/podmonitor.yaml
@@ -0,0 +1,27 @@
+{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
+{{- $namespace := include "spire-server.podMonitor.namespace" . }}
+{{- $podNamespace := ( include "spire-server.namespace" . ) }}
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: {{ include "spire-server.fullname" . }}
+  namespace: {{ $namespace }}
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
+    {{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }}
+    {{- .Values.global.telemetry.prometheus.podMonitor.labels | toYaml | nindent 4 }}
+    {{- end }}
+    {{- with .Values.telemetry.prometheus.podMonitor.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "spire-server.selectorLabels" . | nindent 6 }}
+  podMetricsEndpoints:
+    - port: prom
+  {{- if ne $namespace $podNamespace }}
+  namespaceSelector:
+    kubernetes.io/metadata.name: {{ $podNamespace }}
+  {{- end }}  
+{{- end }}
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 76274fd..4206c66 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -195,6 +195,11 @@ controllerManager:
 telemetry:
   prometheus:
     enabled: false
+    podMonitor:
+      enabled: false
+      # -- Override where to install the podMonitor, if not set will use the same namespace as the spire-server
+      namespace: ""
+      labels: {}
 
 extraVolumes: []
 extraVolumeMounts: []
diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml
index e34b928..72e07e1 100644
--- a/charts/spire/values.yaml
+++ b/charts/spire/values.yaml
@@ -14,6 +14,11 @@ global:
 #  telemetry:
 #    prometheus:
 #      enabled: true
+#      podMonitor:
+#        enabled: true
+#        # -- Allows to install the PodMonitor in another namespace then the spire components are installed into.
+#        namespace: "kube-prometheus-system"
+#        labels: {}
 
 nameOverride: ""
 fullnameOverride: ""

From 2a2615b2c6227d9f4ff01a530f64beb929f65eb4 Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@gmail.com>
Date: Tue, 4 Apr 2023 09:56:26 +0200
Subject: [PATCH 33/33] Bump spire Helm Chart version from 0.5.1 to 0.6.0

* 563e1f7 Add podmonitors (#165)
* 456075f Add hooks to set failurepolicy to ignore on webhook (#128)
* d5dc706 Add Kubernetes 1.21 back (#188)
* daa620b Fix production example test (#183)
* c661d0b Make service dns domain configurable (#164)
* ec236e9 Test for configurable images (#182)
* 280315c Fix namespace-override github test summary (#154)
* 072d952 Switch tests to curl (#178)
* 1b4bfb7 Cleanup old leftover to k8s-workload-registrar
* a770928 Switch busybox image to cgr.dev/chainguard/busybox:latest-glibc (#175)
* 8790416 Enable global config for clusterName, trustDomain, and bundleConfigMap (#156)
* b54c41a Enhance the production example
* dfb32dc Revert adding tornjak to be releasable (#180)
* 059d5fb Bump spire Helm Chart version from 0.5.0 to 0.5.1
* e2ec6ac Add a test to ensure the chart versions match (#163)
* 64585ba Fix formatting issues introduced with #152
* 0dac0db Improve Spire Chart documentation
* f709ed9 Bump actions/checkout from 3.4.0 to 3.5.0
* faef439 Bump helm/chart-testing-action from 2.3.1 to 2.4.0
* ae62dd1 Bump spire version to 1.6.1
* 02fda80 Add Artifact Hub badge to README.md
* 901e670 Disable default Tornjak deployment (#153)
* 05d0f47 Introduction of Tornjak to SPIRE Server helm charts (#144)
* b25dc77 Test fixing the tests (#148)
* b4be9ed Add maturity tag (#138)
* d4fd2ce Extract the namespace override test out of the old lockdown test. (#145)
* 4f85802 Update lockdown test to test the production example
* 04a1305 Fork the lockdown test to two tests as it is doing the work of 2 (#134)
* 64d0107 Resolve issue in prod example on volume mount (#143)
* 5b6708b Remove @dennisgove from CODEOWNERS (#140)
* a516caa Remove k8s 1.21 from test matrix + small syntax error fix (#133)
* 811a2f6 Add option to enable federation on spire-server (#97)

Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 charts/spire/Chart.yaml | 2 +-
 charts/spire/README.md  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml
index 33585ad..8519d5c 100644
--- a/charts/spire/Chart.yaml
+++ b/charts/spire/Chart.yaml
@@ -3,7 +3,7 @@ name: spire
 description: >
   A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
 type: application
-version: 0.5.1
+version: 0.6.0
 appVersion: "1.6.1"
 keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
 home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
diff --git a/charts/spire/README.md b/charts/spire/README.md
index 737ddf1..4b083eb 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -2,7 +2,7 @@
 
 <!-- This README.md is generated. Please edit README.md.gotmpl -->
 
-![Version: 0.5.1](https://img.shields.io/badge/Version-0.5.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.1](https://img.shields.io/badge/AppVersion-1.6.1-informational?style=flat-square)
+![Version: 0.6.0](https://img.shields.io/badge/Version-0.6.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.1](https://img.shields.io/badge/AppVersion-1.6.1-informational?style=flat-square)
 [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
 
 A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.