panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add recommendation for namespaceLayout (#127)

Browse Source 
Co-authored-by: Marco Franssen <[email protected]>
This commit is contained in:
kfox1111
2023-12-19 15:02:57 +00:00
committed by GitHub
co-authored by Marco Franssen
parent 2496c71164
commit 49beb64584
11 changed files with 77 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+1
View File
@@ -159,6 +159,7 @@ Now you can interact with the Spire agent socket from your own application. The
| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` |
| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` |
| `global.spire.recommendations.enabled` | Use recommended settings for production deployments. Default is off. | `false` |
| `global.spire.recommendations.namespaceLayout` | Set to true to use recommended values for installing across namespaces | `true` |
| `global.spire.recommendations.priorityClassName` | Set to true to use recommended values for Pod Priority Class Names | `true` |
| `global.spire.recommendations.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `true` |
| `global.spire.recommendations.securityContexts` | Set to true to use recommended values for Pod and Container Security Contexts | `true` |
charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl
+6
View File
@@ -29,6 +29,12 @@ Allow the release namespace to be overridden for multi-namespace deployments in
{{- define "spiffe-csi-driver.namespace" -}}
{{- if .Values.namespaceOverride -}}
{{- .Values.namespaceOverride -}}
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
{{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }}
{{- .Values.global.spire.namespaces.system.name }}
{{- else }}
{{- printf "spire-system" }}
{{- end }}
{{- else -}}
{{- .Release.Namespace -}}
{{- end -}}
charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
+6
View File
@@ -29,6 +29,12 @@ Allow the release namespace to be overridden for multi-namespace deployments in
{{- define "spiffe-oidc-discovery-provider.namespace" -}}
{{- if .Values.namespaceOverride -}}
{{- .Values.namespaceOverride -}}
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
{{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }}
{{- .Values.global.spire.namespaces.server.name }}
{{- else }}
{{- printf "spire-server" }}
{{- end }}
{{- else -}}
{{- .Release.Namespace -}}
{{- end -}}
charts/spire/charts/spire-agent/templates/_helpers.tpl
+13 -5
View File
@@ -29,6 +29,12 @@ Allow the release namespace to be overridden for multi-namespace deployments in
{{- define "spire-agent.namespace" -}}
{{- if .Values.namespaceOverride -}}
{{- .Values.namespaceOverride -}}
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
{{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }}
{{- .Values.global.spire.namespaces.system.name }}
{{- else }}
{{- printf "spire-system" }}
{{- end }}
{{- else -}}
{{- .Release.Namespace -}}
{{- end -}}
@@ -37,6 +43,12 @@ Allow the release namespace to be overridden for multi-namespace deployments in
{{- define "spire-agent.server.namespace" -}}
{{- if .Values.server.namespaceOverride -}}
{{- .Values.server.namespaceOverride -}}
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
{{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }}
{{- .Values.global.spire.namespaces.server.name }}
{{- else }}
{{- printf "spire-server" }}
{{- end }}
{{- else -}}
{{- .Release.Namespace -}}
{{- end -}}
@@ -83,11 +95,7 @@ app.kubernetes.io/instance: {{ .Release.Name }}
Create the name of the service account to use
*/}}
{{- define "spire-agent.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "spire-agent.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- default (printf "%s-agent" .Release.Name) .Values.serviceAccount.name }}
{{- end }}
{{- define "spire-agent.server-address" }}
charts/spire/charts/spire-server/templates/_helpers.tpl
+37 -1
View File
@@ -29,6 +29,42 @@ Allow the release namespace to be overridden for multi-namespace deployments in
{{- define "spire-server.namespace" -}}
{{- if .Values.namespaceOverride -}}
{{- .Values.namespaceOverride -}}
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
{{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }}
{{- .Values.global.spire.namespaces.server.name }}
{{- else }}
{{- printf "spire-server" }}
{{- end }}
{{- else -}}
{{- .Release.Namespace -}}
{{- end -}}
{{- end -}}
{{- define "spire-server.agent-namespace" -}}
{{- if .Values.namespaceOverride -}}
{{- .Values.namespaceOverride -}}
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
{{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }}
{{- .Values.global.spire.namespaces.system.name }}
{{- else }}
{{- printf "spire-system" }}
{{- end }}
{{- else -}}
{{- .Release.Namespace -}}
{{- end -}}
{{- end -}}
{{- define "spire-server.bundle-namespace" -}}
{{- if .Values.notifier.k8sbundle.namespace }}
{{- .Values.notifier.k8sbundle.namespace }}
{{- else if .Values.namespaceOverride -}}
{{- .Values.namespaceOverride -}}
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
{{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }}
{{- .Values.global.spire.namespaces.system.name }}
{{- else }}
{{- printf "spire-system" }}
{{- end }}
{{- else -}}
{{- .Release.Namespace -}}
{{- end -}}
@@ -101,7 +137,7 @@ Create the name of the service account to use
{{- if ne (len .Values.nodeAttestor.k8sPsat.serviceAccountAllowList) 0 }}
{{- .Values.nodeAttestor.k8sPsat.serviceAccountAllowList | toJson }}
{{- else }}
[{{ printf "%s:%s-agent" .Release.Namespace .Release.Name | quote }}]
[{{ printf "%s:%s-agent" (include "spire-server.agent-namespace" .) .Release.Name | quote }}]
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/bundle-configmap.yaml
+2 -2
View File
@@ -1,9 +1,9 @@
{{- $namespace := include "spire-server.namespace" . }}
{{- $namespace := include "spire-server.bundle-namespace" . }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "spire-lib.bundle-configmap" . }}
namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
namespace: {{ $namespace }}
{{- with .Values.configMap.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
charts/spire/charts/spire-server/templates/configmap.yaml
+1 -1
View File
@@ -131,7 +131,7 @@ plugins:
Notifier:
k8sbundle:
plugin_data:
namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }}
namespace: {{ include "spire-server.bundle-namespace" . | quote }}
config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
{{- with .Values.upstreamAuthority.disk }}
charts/spire/charts/spire-server/templates/roles.yaml
+3 -2
View File
@@ -1,10 +1,11 @@
{{- $namespace := include "spire-server.namespace" . }}
{{- $bundleNamespace := include "spire-server.bundle-namespace" . }}
# Role to be able to push certificate bundles to a configmap
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "spire-lib.bundle-configmap" . }}
namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
namespace: {{ $bundleNamespace }}
rules:
- apiGroups: [""]
resources: [configmaps]
@@ -52,7 +53,7 @@ kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "spire-lib.bundle-configmap" . }}
namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
namespace: {{ $bundleNamespace }}
subjects:
- kind: ServiceAccount
name: {{ include "spire-server.serviceAccountName" . }}
charts/spire/charts/tornjak-frontend/templates/_helpers.tpl
+6
View File
@@ -29,6 +29,12 @@ Allow the release namespace to be overridden for multi-namespace deployments in
{{- define "tornjak-frontend.namespace" -}}
{{- if .Values.namespaceOverride -}}
{{- .Values.namespaceOverride -}}
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
{{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }}
{{- .Values.global.spire.namespaces.server.name }}
{{- else }}
{{- printf "spire-server" }}
{{- end }}
{{- else -}}
{{- .Release.Namespace -}}
{{- end -}}
charts/spire/values.yaml
+2
View File
@@ -22,12 +22,14 @@ global:
upstreamServerAddress: ""
## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off.
## @param global.spire.recommendations.namespaceLayout Set to true to use recommended values for installing across namespaces
## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names
## @param global.spire.recommendations.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
## @param global.spire.recommendations.securityContexts Set to true to use recommended values for Pod and Container Security Contexts
## @param global.spire.recommendations.prometheus Enable prometheus exporters for monitoring
recommendations:
enabled: false
namespaceLayout: true
priorityClassName: true
strictMode: true
securityContexts: true