From 6631349bbbac1df6eb701f053d4a642ae05b1f7d Mon Sep 17 00:00:00 2001 From: Shubham Hibare <20609766+hibare@users.noreply.github.com> Date: Thu, 5 Mar 2026 23:27:44 +0530 Subject: [PATCH 01/24] feat(spire-server): add logEncoding parameter for controller-manager (#766) Signed-off-by: Shubham Hibare --- charts/spire/charts/spire-server/README.md | 1 + .../spire-server/templates/controller-manager-configmap.yaml | 3 +++ charts/spire/charts/spire-server/values.yaml | 3 +++ 3 files changed, 7 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index fa4e9b3..de95a95 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -277,6 +277,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.addEntryIDPrefix` | If true, prepends the clusterName to the entryID of each entry the controller manager registers. | `true` | | `controllerManager.gcInterval` | How often the SPIRE state is reconciled when the controller is otherwise idle. This impacts how quickly SPIRE state will converge after CRDs are removed or SPIRE state is mutated underneath the controller. Values are in nanoseconds. | `10000000000` | | `controllerManager.logLevel` | The log level for the controller manager. Supported values are info, error, warn and debug. | `info` | +| `controllerManager.logEncoding` | The log encoding for the controller manager. Supported values are console and json. | `console` | | `controllerManager.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` | | `controllerManager.leaderElection.renewDeadline` | Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. | `10s` | | `controllerManager.leaderElection.retryPeriod` | Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. | `2s` | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml index 23906c7..ea85007 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -49,6 +49,9 @@ health: healthProbeBindAddress: 0.0.0.0:{{ $healthPort }} gcInterval: {{ .Values.controllerManager.gcInterval }} logLevel: {{ .Values.controllerManager.logLevel }} +{{- with .Values.controllerManager.logEncoding }} +logEncoding: {{ . }} +{{- end }} {{- if eq .Values.controllerManager.staticManifestMode "off" }} leaderElection: leaderElect: true diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 19f3299..1130011 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -572,6 +572,9 @@ controllerManager: ## @param controllerManager.logLevel The log level for the controller manager. Supported values are info, error, warn and debug. logLevel: info + ## @param controllerManager.logEncoding The log encoding for the controller manager. Supported values are console and json. + logEncoding: "console" + ## @param controllerManager.leaderElection.leaseDuration Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. ## @param controllerManager.leaderElection.renewDeadline Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. ## @param controllerManager.leaderElection.retryPeriod Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. From 2de363a4a6d3a88e2b9adfcae36c3bb288936959 Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Mon, 9 Mar 2026 09:01:33 -0700 Subject: [PATCH 02/24] Bump test chart dependencies (#767) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> --- .github/tests/charts.json | 2 +- .github/tests/oci-charts.json | 2 +- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 10 files changed, 16 insertions(+), 16 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 6a780ca..2049233 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "82.4.3" + "version": "82.10.1" }, { "name": "cert-manager", diff --git a/.github/tests/oci-charts.json b/.github/tests/oci-charts.json index 3b39d39..425b25a 100644 --- a/.github/tests/oci-charts.json +++ b/.github/tests/oci-charts.json @@ -7,7 +7,7 @@ { "name": "postgresql", "registry": "docker.io/bitnamicharts/postgresql", - "version": "18.5.1" + "version": "18.5.5" }, { "name": "envoy-gateway", diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 6dfe1d3..b30af42 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -127,11 +127,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:bdb534b9f73175bb1cfb2b12f69b11d890a35e3514f74abfc60d95557cb1b1c1` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index c9a3cbd..3e5e99e 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -361,7 +361,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a + tag: latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2 toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -373,7 +373,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275 + tag: latest@sha256:bdb534b9f73175bb1cfb2b12f69b11d890a35e3514f74abfc60d95557cb1b1c1 step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 9e7d4d2..89ee834 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -73,7 +73,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | @@ -125,11 +125,11 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:bdb534b9f73175bb1cfb2b12f69b11d890a35e3514f74abfc60d95557cb1b1c1` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 75a93a2..e97777b 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -159,7 +159,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a + tag: latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2 keyManager: memory: @@ -317,7 +317,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a + tag: latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2 hostCert: ## @param hostCert.image.registry The OCI registry to pull the image from @@ -329,7 +329,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275 + tag: latest@sha256:bdb534b9f73175bb1cfb2b12f69b11d890a35e3514f74abfc60d95557cb1b1c1 ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. priorityClassName: "" diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index de95a95..8acf5cb 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -511,5 +511,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 1130011..bf4e6a0 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1304,7 +1304,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a + tag: latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2 ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 373f94e..51a2fb3 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 3ede662..854b7a3 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a + tag: latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2 From 60899fc9d269cbd831d63ce14e22007e5c438378 Mon Sep 17 00:00:00 2001 From: anhpatel <162738027+anhpatel@users.noreply.github.com> Date: Tue, 10 Mar 2026 14:09:31 -0700 Subject: [PATCH 03/24] Add configurable hostNetwork support to spiffe-csi-driver (#769) Signed-off-by: aniket patel --- charts/spire/charts/spiffe-csi-driver/README.md | 1 + .../spire/charts/spiffe-csi-driver/templates/daemonset.yaml | 3 +++ .../spiffe-csi-driver/templates/scc-restricted-csi.yaml | 4 ++-- .../spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml | 4 ++-- charts/spire/charts/spiffe-csi-driver/values.yaml | 3 +++ 5 files changed, 11 insertions(+), 4 deletions(-) diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index d09ccf6..32b4248 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -54,6 +54,7 @@ A Helm chart to install the SPIFFE CSI driver. | `podLabels` | Labels to add to pods | `{}` | | `podSecurityContext` | Security context for CSI driver pods | `{}` | | `securityContext` | Security context for CSI driver containers | `{}` | +| `hostNetwork` | Enable hostNetwork for the DaemonSet | `false` | | `nodeSelector` | Node selector for CSI driver pods | `{}` | | `tolerations` | Tolerations for CSI driver pods | `[]` | | `affinity` | Node affinity | `{}` | diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml index 54ceb44..e2827e3 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -52,6 +52,9 @@ spec: tolerations: {{- toYaml . | nindent 8 }} {{- end }} + {{- if .Values.hostNetwork }} + hostNetwork: true + {{- end }} {{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }} {{- if or (gt (len .Values.initContainers) 0) (dig "openshift" false .Values.global) (dig "selinux" false .Values.global) .Values.selinux.enabled }} securityContext: diff --git a/charts/spire/charts/spiffe-csi-driver/templates/scc-restricted-csi.yaml b/charts/spire/charts/spiffe-csi-driver/templates/scc-restricted-csi.yaml index 5e94562..f3993c9 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/scc-restricted-csi.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/scc-restricted-csi.yaml @@ -3,7 +3,7 @@ {{- $v2Description := "This is the most restrictive SCC and it is used by default for authenticated users. On top of the legacy 'restricted' SCC, it also requires to drop ALL capabilities and does not allow privilege escalation binaries. It will also default the seccomp profile to runtime/default if unset, otherwise this seccomp profile is required." -}} apiVersion: security.openshift.io/v1 kind: SecurityContextConstraints -allowHostPorts: false +allowHostPorts: {{ .Values.hostNetwork }} priority: null requiredDropCapabilities: {{- if eq (.Values.restrictedScc.version | toString) "2" }} @@ -50,7 +50,7 @@ volumes: - projected - secret allowHostPID: false -allowHostNetwork: false +allowHostNetwork: {{ .Values.hostNetwork }} allowPrivilegeEscalation: {{ eq (.Values.restrictedScc.version | toString) "2" | ternary false true }} {{- if eq (.Values.restrictedScc.version | toString) "2" }} allowedCapabilities: diff --git a/charts/spire/charts/spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml b/charts/spire/charts/spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml index 5966697..5349451 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml @@ -19,9 +19,9 @@ volumes: allowedCapabilities: null allowHostDirVolumePlugin: true allowHostIPC: false -allowHostNetwork: false +allowHostNetwork: {{ .Values.hostNetwork }} allowHostPID: false -allowHostPorts: false +allowHostPorts: {{ .Values.hostNetwork }} allowPrivilegeEscalation: true allowPrivilegedContainer: true defaultAddCapabilities: null diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index b199b0a..3a7d381 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -112,6 +112,9 @@ securityContext: # drop: # - ALL +## @param hostNetwork Enable hostNetwork for the DaemonSet +hostNetwork: false + ## @param nodeSelector [object] Node selector for CSI driver pods nodeSelector: {} From 0370d3170a2be1288f2884f2575a272275391325 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 12 Mar 2026 03:53:19 +0000 Subject: [PATCH 04/24] Bump helm.sh/helm/v3 from 3.20.0 to 3.20.1 in /tests Bumps [helm.sh/helm/v3](https://github.com/helm/helm) from 3.20.0 to 3.20.1. - [Release notes](https://github.com/helm/helm/releases) - [Commits](https://github.com/helm/helm/compare/v3.20.0...v3.20.1) --- updated-dependencies: - dependency-name: helm.sh/helm/v3 dependency-version: 3.20.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- tests/go.mod | 10 +++++----- tests/go.sum | 20 ++++++++++---------- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/tests/go.mod b/tests/go.mod index 1bf1f93..66a91d6 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -5,7 +5,7 @@ go 1.25.0 require ( github.com/onsi/ginkgo/v2 v2.28.1 github.com/onsi/gomega v1.39.1 - helm.sh/helm/v3 v3.20.0 + helm.sh/helm/v3 v3.20.1 ) require ( @@ -57,10 +57,10 @@ require ( google.golang.org/protobuf v1.36.8 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect - k8s.io/api v0.35.0 // indirect - k8s.io/apiextensions-apiserver v0.35.0 // indirect - k8s.io/apimachinery v0.35.0 // indirect - k8s.io/client-go v0.35.0 // indirect + k8s.io/api v0.35.1 // indirect + k8s.io/apiextensions-apiserver v0.35.1 // indirect + k8s.io/apimachinery v0.35.1 // indirect + k8s.io/client-go v0.35.1 // indirect k8s.io/klog/v2 v2.130.1 // indirect k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect diff --git a/tests/go.sum b/tests/go.sum index 52bff9a..772552f 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -165,16 +165,16 @@ gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -helm.sh/helm/v3 v3.20.0 h1:2M+0qQwnbI1a2CxN7dbmfsWHg/MloeaFMnZCY56as50= -helm.sh/helm/v3 v3.20.0/go.mod h1:rTavWa0lagZOxGfdhu4vgk1OjH2UYCnrDKE2PVC4N0o= -k8s.io/api v0.35.0 h1:iBAU5LTyBI9vw3L5glmat1njFK34srdLmktWwLTprlY= -k8s.io/api v0.35.0/go.mod h1:AQ0SNTzm4ZAczM03QH42c7l3bih1TbAXYo0DkF8ktnA= -k8s.io/apiextensions-apiserver v0.35.0 h1:3xHk2rTOdWXXJM+RDQZJvdx0yEOgC0FgQ1PlJatA5T4= -k8s.io/apiextensions-apiserver v0.35.0/go.mod h1:E1Ahk9SADaLQ4qtzYFkwUqusXTcaV2uw3l14aqpL2LU= -k8s.io/apimachinery v0.35.0 h1:Z2L3IHvPVv/MJ7xRxHEtk6GoJElaAqDCCU0S6ncYok8= -k8s.io/apimachinery v0.35.0/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns= -k8s.io/client-go v0.35.0 h1:IAW0ifFbfQQwQmga0UdoH0yvdqrbwMdq9vIFEhRpxBE= -k8s.io/client-go v0.35.0/go.mod h1:q2E5AAyqcbeLGPdoRB+Nxe3KYTfPce1Dnu1myQdqz9o= +helm.sh/helm/v3 v3.20.1 h1:T8PodUaH1UwNvE+imUA2mIKjJItY8g7CVvLVP5g4NzI= +helm.sh/helm/v3 v3.20.1/go.mod h1:Fl1kBaWCpkUrM6IYXPjQ3bdZQfFrogKArqptvueZ6Ww= +k8s.io/api v0.35.1 h1:0PO/1FhlK/EQNVK5+txc4FuhQibV25VLSdLMmGpDE/Q= +k8s.io/api v0.35.1/go.mod h1:28uR9xlXWml9eT0uaGo6y71xK86JBELShLy4wR1XtxM= +k8s.io/apiextensions-apiserver v0.35.1 h1:p5vvALkknlOcAqARwjS20kJffgzHqwyQRM8vHLwgU7w= +k8s.io/apiextensions-apiserver v0.35.1/go.mod h1:2CN4fe1GZ3HMe4wBr25qXyJnJyZaquy4nNlNmb3R7AQ= +k8s.io/apimachinery v0.35.1 h1:yxO6gV555P1YV0SANtnTjXYfiivaTPvCTKX6w6qdDsU= +k8s.io/apimachinery v0.35.1/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns= +k8s.io/client-go v0.35.1 h1:+eSfZHwuo/I19PaSxqumjqZ9l5XiTEKbIaJ+j1wLcLM= +k8s.io/client-go v0.35.1/go.mod h1:1p1KxDt3a0ruRfc/pG4qT/3oHmUj1AhSHEcxNSGg+OA= k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk= k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE= k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE= From 7afffd75ca5172110f5473ee73b175021c46cdfc Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Mon, 16 Mar 2026 11:36:52 +0100 Subject: [PATCH 05/24] Bump test chart dependencies (#771) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> --- .github/tests/charts.json | 6 +++--- .github/tests/oci-charts.json | 4 ++-- charts/spire/charts/spiffe-csi-driver/README.md | 2 +- charts/spire/charts/spiffe-csi-driver/values.yaml | 2 +- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 12 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 2049233..17aef6d 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,16 +2,16 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "82.10.1" + "version": "82.10.4" }, { "name": "cert-manager", "repo": "https://charts.jetstack.io", - "version": "v1.19.4" + "version": "v1.20.0" }, { "name": "ingress-nginx", "repo": "https://kubernetes.github.io/ingress-nginx", - "version": "4.14.3" + "version": "4.15.0" } ] diff --git a/.github/tests/oci-charts.json b/.github/tests/oci-charts.json index 425b25a..c838e58 100644 --- a/.github/tests/oci-charts.json +++ b/.github/tests/oci-charts.json @@ -7,11 +7,11 @@ { "name": "postgresql", "registry": "docker.io/bitnamicharts/postgresql", - "version": "18.5.5" + "version": "18.5.6" }, { "name": "envoy-gateway", "registry": "docker.io/envoyproxy/gateway-helm", - "version": "v1.7.0" + "version": "v1.7.1" } ] diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index 32b4248..633f5e9 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -74,5 +74,5 @@ A Helm chart to install the SPIFFE CSI driver. | `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` | | `selinux.image.repository` | The repository within the registry | `ubi9` | | `selinux.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1771346757` | +| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1773204657` | diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index 3a7d381..f8766e8 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -169,4 +169,4 @@ selinux: registry: registry.access.redhat.com repository: ubi9 pullPolicy: IfNotPresent - tag: 9.7-1771346757 + tag: 9.7-1773204657 diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index b30af42..9f5ee54 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -127,11 +127,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:bdb534b9f73175bb1cfb2b12f69b11d890a35e3514f74abfc60d95557cb1b1c1` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3e58108c91894bffdeb2dd55ec6cc3f635efb0c79ac803d6d4cd42a1885aabfa` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 3e5e99e..06b89ed 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -361,7 +361,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2 + tag: latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755 toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -373,7 +373,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:bdb534b9f73175bb1cfb2b12f69b11d890a35e3514f74abfc60d95557cb1b1c1 + tag: latest@sha256:3e58108c91894bffdeb2dd55ec6cc3f635efb0c79ac803d6d4cd42a1885aabfa step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 89ee834..8a43abe 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -73,7 +73,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | @@ -125,11 +125,11 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:bdb534b9f73175bb1cfb2b12f69b11d890a35e3514f74abfc60d95557cb1b1c1` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3e58108c91894bffdeb2dd55ec6cc3f635efb0c79ac803d6d4cd42a1885aabfa` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index e97777b..458be60 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -159,7 +159,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2 + tag: latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755 keyManager: memory: @@ -317,7 +317,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2 + tag: latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755 hostCert: ## @param hostCert.image.registry The OCI registry to pull the image from @@ -329,7 +329,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:bdb534b9f73175bb1cfb2b12f69b11d890a35e3514f74abfc60d95557cb1b1c1 + tag: latest@sha256:3e58108c91894bffdeb2dd55ec6cc3f635efb0c79ac803d6d4cd42a1885aabfa ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. priorityClassName: "" diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 8acf5cb..c70a0e2 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -511,5 +511,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index bf4e6a0..548f1be 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1304,7 +1304,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2 + tag: latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755 ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 51a2fb3..32fbc7b 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 854b7a3..3800100 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:d65cf89ca7ee0781c8f5c165332aa9e71127e7d8b2d240746720c2c44c4d9ea2 + tag: latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755 From f78c1d424609ce485533f4cab982e99a8fca3bfa Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Mon, 23 Mar 2026 06:59:16 -0700 Subject: [PATCH 06/24] Bump test chart dependencies (#773) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> --- .github/tests/charts.json | 4 ++-- .github/tests/oci-charts.json | 4 ++-- charts/spire/charts/spiffe-csi-driver/README.md | 2 +- charts/spire/charts/spiffe-csi-driver/values.yaml | 2 +- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 6 +++--- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 6 +++--- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 12 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 17aef6d..de0e443 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "82.10.4" + "version": "82.13.2" }, { "name": "cert-manager", @@ -12,6 +12,6 @@ { "name": "ingress-nginx", "repo": "https://kubernetes.github.io/ingress-nginx", - "version": "4.15.0" + "version": "4.15.1" } ] diff --git a/.github/tests/oci-charts.json b/.github/tests/oci-charts.json index c838e58..5fb2f1f 100644 --- a/.github/tests/oci-charts.json +++ b/.github/tests/oci-charts.json @@ -2,12 +2,12 @@ { "name": "mariadb", "registry": "docker.io/bitnamicharts/mariadb", - "version": "25.0.1" + "version": "25.0.5" }, { "name": "postgresql", "registry": "docker.io/bitnamicharts/postgresql", - "version": "18.5.6" + "version": "18.5.9" }, { "name": "envoy-gateway", diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index 633f5e9..f3404bd 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -74,5 +74,5 @@ A Helm chart to install the SPIFFE CSI driver. | `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` | | `selinux.image.repository` | The repository within the registry | `ubi9` | | `selinux.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1773204657` | +| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1774227732` | diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index f8766e8..b9970da 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -169,4 +169,4 @@ selinux: registry: registry.access.redhat.com repository: ubi9 pullPolicy: IfNotPresent - tag: 9.7-1773204657 + tag: 9.7-1774227732 diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 9f5ee54..06b8e7c 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -127,15 +127,15 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3e58108c91894bffdeb2dd55ec6cc3f635efb0c79ac803d6d4cd42a1885aabfa` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:85bba9f6475c744413aae9b0e8abb34d88049e559de1cda1681bd5dabc345e82` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.step.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.29.0` | +| `tests.step.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.30.2` | | `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` | | `tests.busybox.image.repository` | The repository within the registry | `busybox` | | `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 06b89ed..80c1921 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -361,7 +361,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755 + tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1 toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -373,7 +373,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:3e58108c91894bffdeb2dd55ec6cc3f635efb0c79ac803d6d4cd42a1885aabfa + tag: latest@sha256:85bba9f6475c744413aae9b0e8abb34d88049e559de1cda1681bd5dabc345e82 step: ## @param tests.step.image.registry The OCI registry to pull the image from @@ -385,7 +385,7 @@ tests: registry: "docker.io" repository: smallstep/step-cli pullPolicy: IfNotPresent - tag: 0.29.0 + tag: 0.30.2 busybox: ## @param tests.busybox.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 8a43abe..53039d6 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -73,7 +73,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | @@ -125,11 +125,11 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3e58108c91894bffdeb2dd55ec6cc3f635efb0c79ac803d6d4cd42a1885aabfa` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:85bba9f6475c744413aae9b0e8abb34d88049e559de1cda1681bd5dabc345e82` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 458be60..716a443 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -159,7 +159,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755 + tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1 keyManager: memory: @@ -317,7 +317,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755 + tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1 hostCert: ## @param hostCert.image.registry The OCI registry to pull the image from @@ -329,7 +329,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:3e58108c91894bffdeb2dd55ec6cc3f635efb0c79ac803d6d4cd42a1885aabfa + tag: latest@sha256:85bba9f6475c744413aae9b0e8abb34d88049e559de1cda1681bd5dabc345e82 ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. priorityClassName: "" diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index c70a0e2..f750aa1 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -511,5 +511,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 548f1be..8387d5e 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1304,7 +1304,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755 + tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1 ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 32fbc7b..c4c6254 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 3800100..cde5703 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:d5e3a73173196ac5c1ed28266959f270fdc1c434c4ac231850a742ec94533755 + tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1 From bf4bd8199e922454401dbbdcbf5a7eb129881768 Mon Sep 17 00:00:00 2001 From: Gabriel Abdalla Cavalcante Date: Thu, 26 Mar 2026 15:43:19 -0300 Subject: [PATCH 07/24] feature: add awsSecretsManager upstreamAuthority (#772) * feature: add awsSecretsManager upstreamAuthority Signed-off-by: gcavalcante8808 * Bump test chart dependencies (#773) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> Signed-off-by: gcavalcante8808 * Fix docs (#1) Signed-off-by: Kevin Fox Signed-off-by: gcavalcante8808 --------- Signed-off-by: gcavalcante8808 Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: Kevin Fox Co-authored-by: spire-helm-version-checker[bot] <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> Co-authored-by: kfox1111 --- charts/spire/charts/spire-server/README.md | 6 ++++++ .../spire-server/templates/configmap.yaml | 17 +++++++++++++++++ charts/spire/charts/spire-server/values.yaml | 13 +++++++++++++ 3 files changed, 36 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index f750aa1..1267a43 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -229,6 +229,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `upstreamAuthority.awsPCA.signingAlgorithm` | (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | `""` | | `upstreamAuthority.awsPCA.endpoint` | (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | `""` | | `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` | +| `upstreamAuthority.awsSecret.enabled` | Flag to enable upstream authority plugin with AWS Secrets Manager | `false` | +| `upstreamAuthority.awsSecret.region` | AWS Region to use | `""` | +| `upstreamAuthority.awsSecret.certFileArn` | ARN or name of the secret containing the intermediate CA certificate | `""` | +| `upstreamAuthority.awsSecret.keyFileArn` | ARN or name of the secret containing the intermediate CA private key | `""` | +| `upstreamAuthority.awsSecret.bundleFileArn` | (Optional) ARN or name of the secret containing the root CA bundle | `""` | +| `upstreamAuthority.awsSecret.assumeRoleArn` | (Optional) ARN of an IAM role to assume | `""` | | `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` | | `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` | | `upstreamAuthority.certManager.issuerName` | Defaults to the release name, override if CA is provided outside of the chart | `""` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 701187c..2fa417b 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -507,6 +507,23 @@ plugins: {{- end }} {{- end }} {{- end }} + {{- with .Values.upstreamAuthority.awsSecret }} + {{- if eq (.enabled | toString) "true" }} + {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }} + UpstreamAuthority: + awssecret: + plugin_data: + region: {{ .region | quote }} + cert_file_arn: {{ .certFileArn | quote }} + key_file_arn: {{ .keyFileArn | quote }} + {{- if ne .bundleFileArn "" }} + bundle_file_arn: {{ .bundleFileArn | quote }} + {{- end }} + {{- if ne .assumeRoleArn "" }} + assume_role_arn: {{ .assumeRoleArn | quote }} + {{- end }} + {{- end }} + {{- end }} {{- if gt $upstreamAuthorityUsed 1 }} {{- fail "You can only enable a single Upstream Authority." }} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 8387d5e..be57d98 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -448,6 +448,19 @@ upstreamAuthority: endpoint: "" ## @param upstreamAuthority.awsPCA.supplementalBundlePath (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. supplementalBundlePath: "" + awsSecret: + ## @param upstreamAuthority.awsSecret.enabled Flag to enable upstream authority plugin with AWS Secrets Manager + enabled: false + ## @param upstreamAuthority.awsSecret.region AWS Region to use + region: "" + ## @param upstreamAuthority.awsSecret.certFileArn ARN or name of the secret containing the intermediate CA certificate + certFileArn: "" + ## @param upstreamAuthority.awsSecret.keyFileArn ARN or name of the secret containing the intermediate CA private key + keyFileArn: "" + ## @param upstreamAuthority.awsSecret.bundleFileArn (Optional) ARN or name of the secret containing the root CA bundle + bundleFileArn: "" + ## @param upstreamAuthority.awsSecret.assumeRoleArn (Optional) ARN of an IAM role to assume + assumeRoleArn: "" certManager: ## @param upstreamAuthority.certManager.enabled Flag to enable upstream authority plugin with cert manager enabled: false From 9960e106eb8aaec66c0969bfec8063326b665e25 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Sun, 29 Mar 2026 08:09:50 -0700 Subject: [PATCH 08/24] spire-ha-agent chart (#519) * Initial swag at a spire-ha-agent chart Signed-off-by: Kevin Fox * Fix default Signed-off-by: Kevin Fox * Fix docs Signed-off-by: Kevin Fox * Use released cid2pid Signed-off-by: Kevin Fox * Fix test and pdate chart Signed-off-by: Kevin Fox * Bump version Signed-off-by: Kevin Fox * Fix docs Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox --- .github/workflows/helm-chart-ci.yaml | 2 +- charts/spire-ha-agent/Chart.lock | 6 + charts/spire-ha-agent/Chart.yaml | 23 ++ charts/spire-ha-agent/README.md | 83 +++++++ charts/spire-ha-agent/templates/NOTES.txt | 1 + charts/spire-ha-agent/templates/_helpers.tpl | 137 ++++++++++++ .../spire-ha-agent/templates/daemonset.yaml | 207 ++++++++++++++++++ .../templates/serviceaccount.yaml | 13 ++ charts/spire-ha-agent/values.yaml | 198 +++++++++++++++++ 9 files changed, 669 insertions(+), 1 deletion(-) create mode 100644 charts/spire-ha-agent/Chart.lock create mode 100644 charts/spire-ha-agent/Chart.yaml create mode 100644 charts/spire-ha-agent/README.md create mode 100644 charts/spire-ha-agent/templates/NOTES.txt create mode 100644 charts/spire-ha-agent/templates/_helpers.tpl create mode 100644 charts/spire-ha-agent/templates/daemonset.yaml create mode 100644 charts/spire-ha-agent/templates/serviceaccount.yaml create mode 100644 charts/spire-ha-agent/values.yaml diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index f531d50..94c1fbf 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -176,7 +176,7 @@ jobs: - name: Run chart-testing (install) run: | helm install -n spire-server spire-crds charts/spire-crds - ct install --config ct.yaml --excluded-charts spire-crds,spiffe-step-ssh \ + ct install --config ct.yaml --excluded-charts spire-crds,spiffe-step-ssh,spire-ha-agent \ --target-branch ${{ github.base_ref || inputs.target_branch }} - name: Test summary diff --git a/charts/spire-ha-agent/Chart.lock b/charts/spire-ha-agent/Chart.lock new file mode 100644 index 0000000..69455cc --- /dev/null +++ b/charts/spire-ha-agent/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: spire-lib + repository: file://../spire/charts/spire-lib + version: 0.1.0 +digest: sha256:e397a79d7d3b94b353f8458cb435f2cae9fd9495b367b9216958bff2771b801c +generated: "2024-11-08T00:50:47.925287061Z" diff --git a/charts/spire-ha-agent/Chart.yaml b/charts/spire-ha-agent/Chart.yaml new file mode 100644 index 0000000..26e5c9c --- /dev/null +++ b/charts/spire-ha-agent/Chart.yaml @@ -0,0 +1,23 @@ +apiVersion: v2 +name: spire-ha-agent +description: A Helm chart to install the SPIRE HA agent. +type: application +version: 0.1.0 +appVersion: "0.0.13" +keywords: ["spiffe", "spire-ha-agent"] +home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-ha-agent +sources: + - https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire +icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png +maintainers: + - name: marcofranssen + email: marco.franssen@gmail.com + url: https://marcofranssen.nl + - name: kfox1111 + email: Kevin.Fox@pnnl.gov + - name: faisal-memon + email: fymemon@yahoo.com +dependencies: + - name: spire-lib + repository: file://../spire/charts/spire-lib + version: 0.1.0 diff --git a/charts/spire-ha-agent/README.md b/charts/spire-ha-agent/README.md new file mode 100644 index 0000000..d261ab5 --- /dev/null +++ b/charts/spire-ha-agent/README.md @@ -0,0 +1,83 @@ +# spire-ha-agent + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) + +A Helm chart to install the SPIRE HA agent. + +**Homepage:** + +## Maintainers + +| Name | Email | Url | +| ---- | ------ | --- | +| marcofranssen | | | +| kfox1111 | | | +| faisal-memon | | | + +## Source Code + +* + + + +## Parameters + +### Chart parameters + +| Name | Description | Value | +| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/spire-ha-agent` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `singleSocket` | If in singleSocket mode, only one driver is used | `false` | +| `sockets.single.admin.hostPath` | Where the sockets are on disk when in single socket mode | `/var/run/spire/agent/sockets/main/csi.spiffe.io/admin` | +| `sockets.a.admin.hostPath` | Where the sockets are on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/admin` | +| `sockets.b.admin.hostPath` | Where the sockets are on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/admin` | +| `vsock` | Use a vsockets to expose the service rather then a unix socket | `false` | +| `port` | Port number to listen on | `999` | +| `imagePullSecrets` | Pull secrets for images | `[]` | +| `nameOverride` | Name override | `""` | +| `namespaceOverride` | Namespace override | `""` | +| `fullnameOverride` | Fullname override | `""` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. | `""` | +| `podAnnotations` | Annotations to add to pods | `{}` | +| `podLabels` | Labels to add to pods | `{}` | +| `podSecurityContext` | Pod security context | `{}` | +| `securityContext` | Security context | `{}` | +| `resources` | Resource requests and limits | `{}` | +| `nodeSelector` | Node selector | `{}` | +| `tolerations` | List of tolerations | `[]` | +| `affinity` | Node affinity | `{}` | +| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` | +| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` | +| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | +| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` | +| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | +| `cid2PID.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `cid2PID.image.repository` | The repository within the registry | `kfox1111/cid2pid` | +| `cid2PID.image.pullPolicy` | The image pull policy | `Always` | +| `cid2PID.image.tag` | Overrides the image tag whose default is the chart appVersion | `v0.0.3` | +| `cid2PID.busybox.image.registry` | The OCI registry to pull the image from | `docker.io` | +| `cid2PID.busybox.image.repository` | The repository within the registry | `library/busybox` | +| `cid2PID.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `cid2PID.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` | +| `cid2PID.busybox.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | +| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | +| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` | +| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | +| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` | +| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | +| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | +| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | +| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | +| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` | +| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` | +| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` | +| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` | diff --git a/charts/spire-ha-agent/templates/NOTES.txt b/charts/spire-ha-agent/templates/NOTES.txt new file mode 100644 index 0000000..dfe3e24 --- /dev/null +++ b/charts/spire-ha-agent/templates/NOTES.txt @@ -0,0 +1 @@ +Installed {{ .Chart.Name }}… diff --git a/charts/spire-ha-agent/templates/_helpers.tpl b/charts/spire-ha-agent/templates/_helpers.tpl new file mode 100644 index 0000000..bbe212a --- /dev/null +++ b/charts/spire-ha-agent/templates/_helpers.tpl @@ -0,0 +1,137 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "spire-ha-agent.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "spire-ha-agent.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Allow the release namespace to be overridden for multi-namespace deployments in combined charts +*/}} +{{- define "spire-ha-agent.namespace" -}} + {{- if .Values.namespaceOverride -}} + {{- .Values.namespaceOverride -}} + {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }} + {{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }} + {{- .Values.global.spire.namespaces.system.name }} + {{- else }} + {{- printf "spire-system" }} + {{- end }} + {{- else -}} + {{- .Release.Namespace -}} + {{- end -}} +{{- end -}} + +{{- define "spire-ha-agent.server.namespace" -}} + {{- if .Values.server.namespaceOverride -}} + {{- .Values.server.namespaceOverride -}} + {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }} + {{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }} + {{- .Values.global.spire.namespaces.server.name }} + {{- else }} + {{- printf "spire-server" }} + {{- end }} + {{- else -}} + {{- .Release.Namespace -}} + {{- end -}} +{{- end -}} + +{{- define "spire-ha-agent.podMonitor.namespace" -}} + {{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }} + {{- .Values.telemetry.prometheus.podMonitor.namespace }} + {{- else if ne (len (dig "telemetry" "prometheus" "podMonitor" "namespace" "" .Values.global)) 0 }} + {{- .Values.global.telemetry.prometheus.podMonitor.namespace }} + {{- else }} + {{- include "spire-ha-agent.namespace" . }} + {{- end }} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "spire-ha-agent.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "spire-ha-agent.labels" -}} +helm.sh/chart: {{ include "spire-ha-agent.chart" . | quote }} +{{ include "spire-ha-agent.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service | quote }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "spire-ha-agent.selectorLabels" -}} +app.kubernetes.io/name: {{ include "spire-ha-agent.name" . | quote }} +app.kubernetes.io/instance: {{ .Release.Name | quote }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "spire-ha-agent.serviceAccountName" -}} +{{- default (printf "%s-agent" .Release.Name) .Values.serviceAccount.name }} +{{- end }} + +{{- define "spire-ha-agent.server-address" }} +{{- if and (ne (len (dig "spire" "upstreamSpireAddress" "" .Values.global)) 0) .Values.upstream }} +{{- print .Values.global.spire.upstreamSpireAddress }} +{{- else if .Values.server.address }} +{{- .Values.server.address }} +{{- else if .Values.server.nameOverride }} +{{ .Release.Name }}-{{ .Values.server.nameOverride }}.{{ include "spire-ha-agent.server.namespace" . }} +{{- else }} +{{ .Release.Name }}-server.{{ include "spire-ha-agent.server.namespace" . }} +{{- end }} +{{- end }} + +{{- define "spire-ha-agent.socket-path" -}} +{{- print .Values.socketPath }} +{{- end }} + +{{- define "spire-ha-agent.connect-by-hostname" -}} +{{- if ne .Values.kubeletConnectByHostname "" }} +{{- if eq (.Values.kubeletConnectByHostname | toString) "true" }} +{{- printf "true" }} +{{- else }} +{{- printf "false" }} +{{- end }} +{{- else if (dig "openshift" false .Values.global) }} +{{- printf "true" }} +{{- else }} +{{- printf "false" }} +{{- end }} +{{- end }} + +{{- define "spire-ha-agent.socket-alternate-names" -}} +{{- $sockName := .Values.socketPath | base }} +{{- $l := deepCopy .Values.socketAlternate.names }} +{{- $l = without $l $sockName }} +names: +{{ $l | toYaml }} +{{- end }} diff --git a/charts/spire-ha-agent/templates/daemonset.yaml b/charts/spire-ha-agent/templates/daemonset.yaml new file mode 100644 index 0000000..23a5d2e --- /dev/null +++ b/charts/spire-ha-agent/templates/daemonset.yaml @@ -0,0 +1,207 @@ +{{- $podSecurityContext := fromYaml (include "spire-lib.podsecuritycontext" .) }} +{{- $mainSecurityContext := deepCopy .Values.securityContext }} +{{- $socketAlternateNames := index (include "spire-ha-agent.socket-alternate-names" . | fromYaml) "names" }} +{{- $socketPath := include "spire-ha-agent.socket-path" . }} +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: {{ include "spire-ha-agent.fullname" . | quote }} + namespace: {{ include "spire-ha-agent.namespace" . | quote}} + labels: + {{- include "spire-ha-agent.labels" . | nindent 4 }} + app.kubernetes.io/component: spire-ha-agent +spec: + selector: + matchLabels: + {{- include "spire-ha-agent.selectorLabels" . | nindent 6 }} + app.kubernetes.io/component: spire-ha-agent + {{- with .Values.updateStrategy }} + updateStrategy: + {{- if not (has .type (list "RollingUpdate" "OnDelete")) }} + {{- fail "updateStrategy.type can only be RollingUpdate or OnDelete"}} + {{- end }} + type: {{ .type }} + {{- if eq .type "RollingUpdate" }} + rollingUpdate: + maxUnavailable: {{ .rollingUpdate.maxUnavailable }} + {{- end }} + {{- end }} + template: + metadata: + annotations: + kubectl.kubernetes.io/default-container: spire-ha-agent + labels: + {{- include "spire-ha-agent.selectorLabels" . | nindent 8 }} + app.kubernetes.io/component: spire-ha-agent + {{- with .Values.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + hostPID: true + hostNetwork: true + dnsPolicy: ClusterFirstWithHostNet + serviceAccountName: {{ include "spire-ha-agent.serviceAccountName" . | quote }} + securityContext: + {{- toYaml $podSecurityContext | nindent 8 }} + {{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }} + {{- if ne (len .Values.hostAliases) 0 }} + hostAliases: + {{- toYaml .Values.hostAliases | nindent 8 }} + {{- end }} + initContainers: + {{- if not .Values.vsock }} + {{- if gt (len $socketAlternateNames) 0 }} + - name: ensure-alternate-names + image: {{ template "spire-lib.image" (dict "image" .Values.socketAlternate.image "global" .Values.global) }} + imagePullPolicy: {{ .Values.socketAlternate.image.pullPolicy | quote }} + command: ["bash", "-xc"] + {{- /* 1. Look for symlinks pointing at the wrong place and remove them. 2. Make symlinks that don't exist. 3. If new socket is pointing at an existing symlink, remove old symlink. */}} + args: + - | + cd {{ $socketPath | dir }} + {{- range $socketAlternateNames }} + L=`readlink {{ . }}` + [ "x$L" != "x{{ $socketPath | base }}" ] && rm -f {{ . }} + [ ! -L {{ . }} ] && ln -s {{ $socketPath | base }} {{ . }} + {{- end }} + [ -L {{ $socketPath | base }} ] && rm -f {{ $socketPath | base }} + exit 0 + resources: + {{- toYaml .Values.socketAlternate.resources | nindent 12 }} + volumeMounts: + - name: spire-ha-agent-socket-dir + mountPath: {{ $socketPath | dir }} + securityContext: + runAsUser: 0 + runAsGroup: 0 + {{- end }} + {{- else }} + - name: setup-shell + image: {{ template "spire-lib.image" (dict "image" .Values.cid2PID.busybox.image "global" .Values.global) }} + imagePullPolicy: {{ .Values.cid2PID.busybox.image.pullPolicy | quote }} + command: ["sh", "-xc"] + args: + - | + cp -a /bin/busybox /data + resources: + {{- toYaml .Values.cid2PID.busybox.resources | nindent 12 }} + volumeMounts: + - name: cid2pid + mountPath: /data + securityContext: + runAsUser: 0 + runAsGroup: 0 + - name: setup-cid2pid + image: {{ template "spire-lib.image" (dict "image" .Values.cid2PID.image "global" .Values.global) }} + imagePullPolicy: {{ .Values.cid2PID.image.pullPolicy | quote }} + command: ["/data/busybox", "sh", "-xc"] + args: + - | + /data/busybox cp -a /usr/bin/cid2pid /data + /data/busybox rm -f /data/busybox + resources: + {{- toYaml .Values.cid2PID.resources | nindent 12 }} + volumeMounts: + - name: cid2pid + mountPath: /data + securityContext: + runAsUser: 0 + runAsGroup: 0 + {{- end }} + {{- if gt (len .Values.initContainers) 0 }} + {{- toYaml .Values.initContainers | nindent 8 }} + {{- end }} + containers: + - name: {{ .Chart.Name | quote }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + securityContext: + privileged: true +#FIXME read permission to api socket + runAsUser: 0 + runAsGroup: 0 + #{- $mainSecurityContext | toYaml | nindent 12 }} + env: + {{- if .Values.singleSocket }} + - name: SPIRE_HA_AGENT_SINGLE + value: enabled + {{- end }} + {{- if .Values.vsock }} + - name: SPIRE_HA_AGENT_VSOCK + value: enabled + - name: SPIRE_HA_AGENT_PORT + value: {{ .Values.port | quote }} + {{- end }} + {{- with .Values.extraEnvVars }} + {{- toYaml . | nindent 12 }} + {{- end }} + volumeMounts: +# - name: spire-ha-agent-persistence +# mountPath: /var/lib/spire + {{- if .Values.vsock }} + - name: cid2pid + mountPath: /usr/bin/cid2pid + subPath: cid2pid + readOnly: true + {{- else }} + - name: spire-ha-agent-socket-dir + mountPath: /tmp/spire-ha-agent/public + readOnly: false + {{- end }} + - name: spire-ha-admin-socket-dir-upstream-a + mountPath: /var/run/spire/agent/sockets/a/private + {{- if not .Values.singleSocket }} + - name: spire-ha-admin-socket-dir-upstream-b + mountPath: /var/run/spire/agent/sockets/b/private + {{- end }} + - name: dev + mountPath: /dev + {{- if gt (len .Values.extraVolumeMounts) 0 }} + {{- toYaml .Values.extraVolumeMounts | nindent 12 }} + {{- end }} + resources: + {{- toYaml .Values.resources | nindent 12 }} + {{- if gt (len .Values.extraContainers) 0 }} + {{- toYaml .Values.extraContainers | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + volumes: + {{- if not .Values.vsock }} + - name: spire-ha-agent-socket-dir + hostPath: + path: {{ $socketPath | dir }} + type: DirectoryOrCreate + {{- end }} + - name: spire-ha-admin-socket-dir-upstream-a + hostPath: + path: {{ if .Values.singleSocket }}{{ .Values.sockets.single.admin.hostPath }}{{ else }}{{ .Values.sockets.a.admin.hostPath }}{{ end }} + type: DirectoryOrCreate + {{- if not .Values.singleSocket }} + - name: spire-ha-admin-socket-dir-upstream-b + hostPath: + path: {{ .Values.sockets.b.admin.hostPath }} + type: DirectoryOrCreate + {{- end }} + - name: dev + hostPath: + path: /dev + - name: cid2pid + emtpyDir: {} + {{- if gt (len .Values.extraVolumes) 0 }} + {{- toYaml .Values.extraVolumes | nindent 8 }} + {{- end }} diff --git a/charts/spire-ha-agent/templates/serviceaccount.yaml b/charts/spire-ha-agent/templates/serviceaccount.yaml new file mode 100644 index 0000000..4944bdb --- /dev/null +++ b/charts/spire-ha-agent/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "spire-ha-agent.serviceAccountName" . | quote }} + namespace: {{ include "spire-ha-agent.namespace" . | quote }} + labels: + {{- include "spire-ha-agent.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/spire-ha-agent/values.yaml b/charts/spire-ha-agent/values.yaml new file mode 100644 index 0000000..d6d44b3 --- /dev/null +++ b/charts/spire-ha-agent/values.yaml @@ -0,0 +1,198 @@ +# Default configuration for Spire Agent +# SPDX-License-Identifier: APACHE-2.0 + +## @skip global +global: {} + +## @section Chart parameters +## +## @param image.registry The OCI registry to pull the image from +## @param image.repository The repository within the registry +## @param image.pullPolicy The image pull policy +## @param image.tag Overrides the image tag whose default is the chart appVersion +## +image: + registry: ghcr.io + repository: spiffe/spire-ha-agent + pullPolicy: IfNotPresent + tag: "" + +## @param singleSocket If in singleSocket mode, only one driver is used +singleSocket: false + +## @param sockets.single.admin.hostPath Where the sockets are on disk when in single socket mode +## @param sockets.a.admin.hostPath Where the sockets are on disk +## @param sockets.b.admin.hostPath Where the sockets are on disk +sockets: + single: + admin: + hostPath: /var/run/spire/agent/sockets/main/csi.spiffe.io/admin + a: + admin: + hostPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/admin + b: + admin: + hostPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/admin + +## @param vsock Use a vsockets to expose the service rather then a unix socket +vsock: false + +## @param port Port number to listen on +port: 999 + +## @param imagePullSecrets [array] Pull secrets for images +imagePullSecrets: [] + +## @param nameOverride Name override +nameOverride: "" + +## @param namespaceOverride Namespace override +namespaceOverride: "" + +## @param fullnameOverride Fullname override +fullnameOverride: "" + +serviceAccount: + ## @param serviceAccount.create Specifies whether a service account should be created + create: true + ## @param serviceAccount.annotations [object] Annotations to add to the service account + annotations: {} + ## @param serviceAccount.name The name of the service account to use. + ## If not set and create is true, a name is generated using the fullname template + name: "" + +## @param podAnnotations [object] Annotations to add to pods +podAnnotations: {} + +## @param podLabels [object] Labels to add to pods +podLabels: {} + +## @param podSecurityContext [object] Pod security context +podSecurityContext: {} + # fsGroup: 2000 + +## @param securityContext [object] Security context +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +## @param resources [object] Resource requests and limits +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 64Mi + # limits: + # cpu: 100m + # memory: 128Mi + +## @param nodeSelector [object] Node selector +nodeSelector: {} + +## @param tolerations [array] List of tolerations +tolerations: [] + +## @param affinity [object] Node affinity +affinity: {} + +## @param updateStrategy.type The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. +## @param updateStrategy.rollingUpdate.maxUnavailable Max unavailable pods during update. Can be a number or a percentage. +updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 + +# When running as non root, needed to ensure the socket path has the correct permissions. +# Set runAsUser to a non-zero value in podSecurityContext to run as non-root user. +fsGroupFix: + ## @param fsGroupFix.image.registry The OCI registry to pull the image from + ## @param fsGroupFix.image.repository The repository within the registry + ## @param fsGroupFix.image.pullPolicy The image pull policy + ## @param fsGroupFix.image.tag Overrides the image tag whose default is the chart appVersion + ## + image: + registry: cgr.dev + repository: chainguard/bash + pullPolicy: Always + tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1 + + ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + resources: {} + +cid2PID: + ## @param cid2PID.image.registry The OCI registry to pull the image from + ## @param cid2PID.image.repository The repository within the registry + ## @param cid2PID.image.pullPolicy The image pull policy + ## @param cid2PID.image.tag Overrides the image tag whose default is the chart appVersion + ## + image: + registry: ghcr.io + repository: kfox1111/cid2pid + pullPolicy: Always + tag: v0.0.3 + + ## @param cid2PID.busybox.image.registry The OCI registry to pull the image from + ## @param cid2PID.busybox.image.repository The repository within the registry + ## @param cid2PID.busybox.image.pullPolicy The image pull policy + ## @param cid2PID.busybox.image.tag Overrides the image tag whose default is the chart appVersion + ## + busybox: + image: + registry: docker.io + repository: library/busybox + pullPolicy: IfNotPresent + tag: 1.36.1-uclibc + + ## @param cid2PID.busybox.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + resources: {} + +## @param socketPath The unix socket path to the spire-agent +socketPath: /run/spire/agent-sockets/spire-agent.sock + +socketAlternate: + ## @param socketAlternate.names List of alternate names for the socket that workloads might expect to be able to access in the driver mount. + names: + - socket + - spire-agent.sock + - api.sock + + ## @param socketAlternate.image.registry The OCI registry to pull the image from + ## @param socketAlternate.image.repository The repository within the registry + ## @param socketAlternate.image.pullPolicy The image pull policy + ## @param socketAlternate.image.tag Overrides the image tag whose default is the chart appVersion + ## + image: + registry: cgr.dev + repository: chainguard/bash + pullPolicy: Always + tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1 + + ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + resources: {} + +## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. +priorityClassName: "" + +## @param extraEnvVars [array] Extra environment variables to be added to the Spire Agent container +extraEnvVars: [] + +## @param extraVolumes [array] Extra volumes to be mounted on Spire Agent pods +extraVolumes: [] + +## @param extraVolumeMounts [array] Extra volume mounts for Spire Agent pods +extraVolumeMounts: [] + +## @param extraContainers [array] Additional containers to create with Spire Agent pods +extraContainers: [] + +## @param initContainers [array] Additional init containers to create with Spire Agent pods +initContainers: [] +## @param hostAliases [array] Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ +hostAliases: [] From de59147fc5f84d5fd1146e56278b8d42cd84335a Mon Sep 17 00:00:00 2001 From: Daniel Schlatter Date: Sun, 29 Mar 2026 09:13:20 -0700 Subject: [PATCH 09/24] fix gather hostcert edge case issues (#775) * Check each conditional of gather host cert in case a command to create the host cert fails Signed-off-by: Daniel Schlatter * Change curl command to use --cacert in gather-host-cert init container --capath is for directories. --cacert is the correct option for a single cert. Signed-off-by: Daniel Schlatter --------- Signed-off-by: Daniel Schlatter --- charts/spire/charts/spire-agent/templates/daemonset.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 83a194b..b1455d8 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -114,9 +114,11 @@ spec: {{- else }} if [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet-server-current.pem" ]; then openssl x509 -in {{ printf "%s/kubelet-server-current.pem" .Values.workloadAttestors.k8s.verification.hostCert.basePath | quote }} -out /hostCert/kubelet.crt - elif [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" ]; then + fi + if [ ! -f /hostCert/kubelet.crt ] && [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" ]; then openssl x509 -in {{ printf "%s/kubelet.crt" .Values.workloadAttestors.k8s.verification.hostCert.basePath | quote }} -out /hostCert/kubelet.crt - else + fi + if [ ! -f /hostCert/kubelet.crt ]; then {{- if eq .Values.workloadAttestors.k8s.verification.type "auto" }} {{- if $cbh }} URL="https://$KUBELET_ADDR:10250/spec/" @@ -129,7 +131,7 @@ spec: {{- else }} URL="https://localhost:10250/spec/" {{- end }} - curl --capath /var/run/secrets/kubernetes.io/serviceaccount/ca.crt "$URL" + curl --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt "$URL" if [ $? -eq 0 ]; then echo Mode detected as apiServerCA. ln -s /var/run/secrets/kubernetes.io/serviceaccount/ca.crt /hostCert/kubelet.crt From aad7527c0c7c3c453dcd9cf9a44f251701b6b95c Mon Sep 17 00:00:00 2001 From: Alan Cha Date: Sun, 29 Mar 2026 12:34:30 -0400 Subject: [PATCH 10/24] Add set_key_use configuration option (#774) * Add set_key_use configuration option Add a setKeyUse boolean configuration option to control the set_key_use field in the SPIFFE OIDC Discovery Provider configuration. When enabled, this adds the 'use': 'sig' field to JWKS keys, which is required for compatibility with Keycloak's SPIFFE identity provider. Defaults to false to maintain backward compatibility. Signed-off-by: Alan Cha * Fix docs Signed-off-by: Kevin Fox --------- Signed-off-by: Alan Cha Signed-off-by: Kevin Fox Co-authored-by: Kevin Fox --- charts/spire/charts/spiffe-oidc-discovery-provider/README.md | 1 + .../spiffe-oidc-discovery-provider/templates/configmap.yaml | 4 ++++ .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 2 ++ 3 files changed, 7 insertions(+) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 06b8e7c..3904f9c 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -86,6 +86,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `config.jwksUri` | The JWKS URI | `""` | | `config.serverPathPrefix` | If specified, all endpoints listened to will be prefixed by this value | `""` | | `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` | +| `config.setKeyUse` | Add "use":"sig" field to JWKs (required for Keycloak SPIFFE provider) | `false` | | `imagePullSecrets` | Image pull secret names | `[]` | | `nameOverride` | Name override | `""` | | `fullnameOverride` | Full name override | `""` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml index a423778..c4f9c1a 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml @@ -52,6 +52,10 @@ jwks_uri: {{ .Values.config.jwksUri | quote }} server_path_prefix: {{ .Values.config.serverPathPrefix | quote }} {{- end }} +{{- if .Values.config.setKeyUse }} +set_key_use: true +{{- end }} + {{- if eq .Values.bundleSource "ConfigMap" }} file: path: /bundle/bundle.spiffe diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 80c1921..81c9de6 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -220,6 +220,8 @@ config: ## @param config.additionalDomains [array] Add additional domains that can be used for oidc discovery additionalDomains: [] # - localhost + ## @param config.setKeyUse Add "use":"sig" field to JWKs (required for Keycloak SPIFFE provider) + setKeyUse: false ## @param imagePullSecrets [array] Image pull secret names imagePullSecrets: [] From 96773a310f688eea75091fd393b83d68f9eb683b Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Sun, 29 Mar 2026 12:13:59 -0700 Subject: [PATCH 11/24] Bump versions (#777) * Bump versions Signed-off-by: Kevin Fox * Try this Signed-off-by: Kevin Fox * Fix test for newer spire Signed-off-by: Kevin Fox * Bump controller manager version Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox --- charts/spire-nested/Chart.yaml | 2 +- charts/spire-nested/README.md | 2 +- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- .../charts/spiffe-oidc-discovery-provider/Chart.yaml | 2 +- charts/spire/charts/spire-agent/Chart.yaml | 2 +- charts/spire/charts/spire-server/Chart.yaml | 2 +- charts/spire/charts/spire-server/README.md | 2 +- .../spire-server/templates/tests/test-connection.yaml | 8 +++++--- charts/spire/charts/spire-server/values.yaml | 2 +- 10 files changed, 14 insertions(+), 12 deletions(-) diff --git a/charts/spire-nested/Chart.yaml b/charts/spire-nested/Chart.yaml index ad4036b..bf43c6f 100644 --- a/charts/spire-nested/Chart.yaml +++ b/charts/spire-nested/Chart.yaml @@ -4,7 +4,7 @@ description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application version: 0.28.3 -appVersion: "1.14.2" +appVersion: "1.14.4" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire-nested/README.md b/charts/spire-nested/README.md index b026e81..4332bf4 100644 --- a/charts/spire-nested/README.md +++ b/charts/spire-nested/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.28.3](https://img.shields.io/badge/Version-0.28.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.2](https://img.shields.io/badge/AppVersion-1.14.2-informational?style=flat-square) +![Version: 0.28.3](https://img.shields.io/badge/Version-0.28.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.4](https://img.shields.io/badge/AppVersion-1.14.4-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index d4df90d..abe6a96 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -4,7 +4,7 @@ description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application version: 0.28.3 -appVersion: "1.14.2" +appVersion: "1.14.4" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index 15e0f0d..2861b20 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.28.3](https://img.shields.io/badge/Version-0.28.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.2](https://img.shields.io/badge/AppVersion-1.14.2-informational?style=flat-square) +![Version: 0.28.3](https://img.shields.io/badge/Version-0.28.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.4](https://img.shields.io/badge/AppVersion-1.14.4-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml index eeecec7..734bda3 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml @@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider description: A Helm chart to install the SPIFFE OIDC discovery provider. type: application version: 0.1.0 -appVersion: "1.14.2" +appVersion: "1.14.4" keywords: ["spiffe", "oidc"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml index d382d21..51eb0cc 100644 --- a/charts/spire/charts/spire-agent/Chart.yaml +++ b/charts/spire/charts/spire-agent/Chart.yaml @@ -3,7 +3,7 @@ name: spire-agent description: A Helm chart to install the SPIRE agent. type: application version: 0.1.0 -appVersion: "1.14.2" +appVersion: "1.14.4" keywords: ["spiffe", "spire-agent"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml index 658d86c..e9180e7 100644 --- a/charts/spire/charts/spire-server/Chart.yaml +++ b/charts/spire/charts/spire-server/Chart.yaml @@ -3,7 +3,7 @@ name: spire-server description: A Helm chart to install the SPIRE server. type: application version: 0.1.0 -appVersion: "1.14.2" +appVersion: "1.14.4" keywords: ["spiffe", "spire-server", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 1267a43..1dbfafc 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -295,7 +295,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.3` | +| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.4` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | diff --git a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml index 57b4434..07341ce 100644 --- a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml @@ -25,9 +25,11 @@ spec: curl -k -f -s 'https://{{ include "spire-server.fullname" . }}:{{ .Values.service.port }}' IGNORECA=$? echo $NOCA $IGNORECA - if [ $NOCA -eq 60 -a $IGNORECA -eq 22 ]; then - # We were able to connect to the server but didn't recognize the ca (60) and the page not found (22) because we're not using grpc - exit 0 + if [ $NOCA -eq 60 ]; then + if [ $IGNORECA -eq 22 -o $IGNORECA -eq 55 -o $IGNORECA -eq 56 ]; then + # We were able to connect to the server but didn't recognize the ca (60) and the page not found (22) because we're not using grpc + exit 0 + fi fi exit 1 securityContext: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index be57d98..5dd73ba 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -621,7 +621,7 @@ controllerManager: registry: ghcr.io repository: spiffe/spire-controller-manager pullPolicy: IfNotPresent - tag: "0.6.3" + tag: "0.6.4" ## @param controllerManager.resources [object] Resource requests and limits for controller manager resources: {} From 59de7aa314622564451bb8699e34456d731e08ff Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Mon, 30 Mar 2026 12:03:11 +0200 Subject: [PATCH 12/24] Bump test chart dependencies (#779) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> --- .github/tests/charts.json | 4 ++-- .github/tests/oci-charts.json | 2 +- charts/spire/charts/spiffe-csi-driver/README.md | 2 +- charts/spire/charts/spiffe-csi-driver/values.yaml | 2 +- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 12 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index de0e443..e1fdb1a 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,12 +2,12 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "82.13.2" + "version": "82.15.1" }, { "name": "cert-manager", "repo": "https://charts.jetstack.io", - "version": "v1.20.0" + "version": "v1.20.1" }, { "name": "ingress-nginx", diff --git a/.github/tests/oci-charts.json b/.github/tests/oci-charts.json index 5fb2f1f..2152508 100644 --- a/.github/tests/oci-charts.json +++ b/.github/tests/oci-charts.json @@ -2,7 +2,7 @@ { "name": "mariadb", "registry": "docker.io/bitnamicharts/mariadb", - "version": "25.0.5" + "version": "25.0.6" }, { "name": "postgresql", diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index f3404bd..11a7511 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -74,5 +74,5 @@ A Helm chart to install the SPIFFE CSI driver. | `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` | | `selinux.image.repository` | The repository within the registry | `ubi9` | | `selinux.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1774227732` | +| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1774415752` | diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index b9970da..e87b4c3 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -169,4 +169,4 @@ selinux: registry: registry.access.redhat.com repository: ubi9 pullPolicy: IfNotPresent - tag: 9.7-1774227732 + tag: 9.7-1774415752 diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 3904f9c..0f4157f 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -128,11 +128,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:85bba9f6475c744413aae9b0e8abb34d88049e559de1cda1681bd5dabc345e82` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9d00f403f02ff137b98727111a036b9b46523ac2c0573143a976e5052004b285` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 81c9de6..4012f67 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -363,7 +363,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1 + tag: latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2 toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -375,7 +375,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:85bba9f6475c744413aae9b0e8abb34d88049e559de1cda1681bd5dabc345e82 + tag: latest@sha256:9d00f403f02ff137b98727111a036b9b46523ac2c0573143a976e5052004b285 step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 53039d6..7590bb4 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -73,7 +73,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | @@ -125,11 +125,11 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:85bba9f6475c744413aae9b0e8abb34d88049e559de1cda1681bd5dabc345e82` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9d00f403f02ff137b98727111a036b9b46523ac2c0573143a976e5052004b285` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 716a443..5419009 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -159,7 +159,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1 + tag: latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2 keyManager: memory: @@ -317,7 +317,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1 + tag: latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2 hostCert: ## @param hostCert.image.registry The OCI registry to pull the image from @@ -329,7 +329,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:85bba9f6475c744413aae9b0e8abb34d88049e559de1cda1681bd5dabc345e82 + tag: latest@sha256:9d00f403f02ff137b98727111a036b9b46523ac2c0573143a976e5052004b285 ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. priorityClassName: "" diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 1dbfafc..2621806 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -517,5 +517,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 5dd73ba..15ff870 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1317,7 +1317,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1 + tag: latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2 ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index c4c6254..b2e6cc1 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index cde5703..cbd6f0c 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1 + tag: latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2 From 419af5c901da2abb45cf9a050e224ade12a1f50b Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Mon, 30 Mar 2026 04:09:20 -0700 Subject: [PATCH 13/24] Update package version for spire-ha-agent (#778) Signed-off-by: Kevin Fox --- charts/spire-ha-agent/Chart.yaml | 2 +- charts/spire-ha-agent/templates/daemonset.yaml | 13 +++++++++++-- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/charts/spire-ha-agent/Chart.yaml b/charts/spire-ha-agent/Chart.yaml index 26e5c9c..fa3efca 100644 --- a/charts/spire-ha-agent/Chart.yaml +++ b/charts/spire-ha-agent/Chart.yaml @@ -3,7 +3,7 @@ name: spire-ha-agent description: A Helm chart to install the SPIRE HA agent. type: application version: 0.1.0 -appVersion: "0.0.13" +appVersion: "0.0.17" keywords: ["spiffe", "spire-ha-agent"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-ha-agent sources: diff --git a/charts/spire-ha-agent/templates/daemonset.yaml b/charts/spire-ha-agent/templates/daemonset.yaml index 23a5d2e..b693d78 100644 --- a/charts/spire-ha-agent/templates/daemonset.yaml +++ b/charts/spire-ha-agent/templates/daemonset.yaml @@ -126,9 +126,18 @@ spec: runAsGroup: 0 #{- $mainSecurityContext | toYaml | nindent 12 }} env: + - name: SPIRE_HA_AGENT_SOCK + value: /tmp/spire-ha-agent/public/spire-agent.sock {{- if .Values.singleSocket }} - name: SPIRE_HA_AGENT_SINGLE value: enabled + - name: SPIRE_HA_AGENT_SOCKET + value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/admin/admin.sock + {{- else }} + - name: SPIRE_HA_AGENT_SOCKET_A + value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/admin/admin.sock + - name: SPIRE_HA_AGENT_SOCKET_B + value: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/admin/admin.sock {{- end }} {{- if .Values.vsock }} - name: SPIRE_HA_AGENT_VSOCK @@ -153,10 +162,10 @@ spec: readOnly: false {{- end }} - name: spire-ha-admin-socket-dir-upstream-a - mountPath: /var/run/spire/agent/sockets/a/private + mountPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/admin {{- if not .Values.singleSocket }} - name: spire-ha-admin-socket-dir-upstream-b - mountPath: /var/run/spire/agent/sockets/b/private + mountPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/admin {{- end }} - name: dev mountPath: /dev From 838a353567a6a197c9aacfb0084c091a7d040c28 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Sun, 5 Apr 2026 08:47:27 -0700 Subject: [PATCH 14/24] Label chart (#783) Signed-off-by: Kevin Fox --- charts/spire/Chart.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index abe6a96..4028375 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -68,5 +68,6 @@ dependencies: repository: file://./charts/spike-pilot version: 0.1.0 annotations: + org.opencontainers.image.source: https://github.com/spiffe/helm-charts-hardened artifacthub.io/category: security artifacthub.io/license: Apache-2.0 From a27acbcbca9f8828fa6fb712af1ca81965aaf764 Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Mon, 6 Apr 2026 07:12:47 -0700 Subject: [PATCH 15/24] Bump test chart dependencies (#786) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> --- .github/tests/charts.json | 2 +- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 9 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index e1fdb1a..5be1408 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "82.15.1" + "version": "82.18.0" }, { "name": "cert-manager", diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 0f4157f..54b56e1 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -128,11 +128,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9d00f403f02ff137b98727111a036b9b46523ac2c0573143a976e5052004b285` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:6ba4fb1b19bb35fa0b7e6bf08b308379a5b865727e50b7b3068efb824b39ebba` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 4012f67..2a84e56 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -363,7 +363,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2 + tag: latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -375,7 +375,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:9d00f403f02ff137b98727111a036b9b46523ac2c0573143a976e5052004b285 + tag: latest@sha256:6ba4fb1b19bb35fa0b7e6bf08b308379a5b865727e50b7b3068efb824b39ebba step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 7590bb4..d70df1f 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -73,7 +73,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | @@ -125,11 +125,11 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9d00f403f02ff137b98727111a036b9b46523ac2c0573143a976e5052004b285` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:6ba4fb1b19bb35fa0b7e6bf08b308379a5b865727e50b7b3068efb824b39ebba` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 5419009..bcbab33 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -159,7 +159,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2 + tag: latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e keyManager: memory: @@ -317,7 +317,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2 + tag: latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e hostCert: ## @param hostCert.image.registry The OCI registry to pull the image from @@ -329,7 +329,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:9d00f403f02ff137b98727111a036b9b46523ac2c0573143a976e5052004b285 + tag: latest@sha256:6ba4fb1b19bb35fa0b7e6bf08b308379a5b865727e50b7b3068efb824b39ebba ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. priorityClassName: "" diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 2621806..5bd0724 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -517,5 +517,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 15ff870..9ff42f1 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1317,7 +1317,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2 + tag: latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index b2e6cc1..5116da9 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index cbd6f0c..a97af65 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:58ece14caf33a2c4c9fcf2f62e5851b3fbdbea944994410f6980f04e6991a9c2 + tag: latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e From 145f3a36b5a9b61c75dd96c1742a3b88089d75c3 Mon Sep 17 00:00:00 2001 From: Shubham Hibare <20609766+hibare@users.noreply.github.com> Date: Tue, 7 Apr 2026 00:00:43 +0530 Subject: [PATCH 16/24] chore: Add configurable probes for controller-manager (#784) Signed-off-by: Shubham Hibare Co-authored-by: kfox1111 --- charts/spire/charts/spire-server/README.md | 8 ++++++++ .../_controller-manager-container.tpl | 2 ++ charts/spire/charts/spire-server/values.yaml | 20 +++++++++++++++++++ 3 files changed, 30 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 5bd0724..dee4c3c 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -287,6 +287,14 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` | | `controllerManager.leaderElection.renewDeadline` | Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. | `10s` | | `controllerManager.leaderElection.retryPeriod` | Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. | `2s` | +| `controllerManager.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | +| `controllerManager.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `controllerManager.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `controllerManager.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` | +| `controllerManager.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `controllerManager.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `controllerManager.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `controllerManager.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | | `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` | | `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` | | `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` | diff --git a/charts/spire/charts/spire-server/templates/_controller-manager-container.tpl b/charts/spire/charts/spire-server/templates/_controller-manager-container.tpl index 2b56b78..177c593 100644 --- a/charts/spire/charts/spire-server/templates/_controller-manager-container.tpl +++ b/charts/spire/charts/spire-server/templates/_controller-manager-container.tpl @@ -146,10 +146,12 @@ Auto-generation preserves trailing numbers from cluster names or uses hash for u httpGet: path: /healthz port: {{ $hpName }} + {{- toYaml .Values.controllerManager.livenessProbe | nindent 4 }} readinessProbe: httpGet: path: /readyz port: {{ $hpName }} + {{- toYaml .Values.controllerManager.readinessProbe | nindent 4 }} {{- end }} resources: {{- toYaml .Values.controllerManager.resources | nindent 4 }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 9ff42f1..d1fa7d5 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -596,6 +596,26 @@ controllerManager: renewDeadline: "10s" retryPeriod: "2s" + ## @param controllerManager.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param controllerManager.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param controllerManager.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param controllerManager.livenessProbe.failureThreshold Failure threshold for livenessProbe + livenessProbe: + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + + ## @param controllerManager.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param controllerManager.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param controllerManager.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param controllerManager.readinessProbe.failureThreshold Failure threshold for readinessProbe + readinessProbe: + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + ## @param controllerManager.parentIDTemplate The template that is used to register workloads. parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}" From 9273f11f0a77f8b8a05f8dff88e2b06f33e6c130 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Thu, 9 Apr 2026 05:14:05 -0700 Subject: [PATCH 17/24] Support root-level spire-lib chart reuse (#785) * Add root-level spire-lib chart Signed-off-by: Faisal Memon * Make spire consume root-level spire-lib Signed-off-by: Faisal Memon * Prepare chart dependencies in CI Signed-off-by: Faisal Memon * Document DCO requirement in CODEX Signed-off-by: Faisal Memon * Centralize local chart dependency prep Signed-off-by: Faisal Memon * Exclude spire-lib from chart-testing install Signed-off-by: Faisal Memon * Rename CODEX guide to AGENTS Signed-off-by: Faisal Memon * Add make target for chart dependencies Signed-off-by: Faisal Memon --------- Signed-off-by: Faisal Memon --- .github/scripts/prepare-local-chart-deps.sh | 20 +++++++ .github/workflows/helm-chart-ci.yaml | 22 +++++++- AGENTS.md | 54 +++++++++++++++++++ Makefile | 7 ++- charts/spiffe-step-ssh/Chart.yaml | 2 +- charts/spire-ha-agent/Chart.lock | 6 +-- charts/spire-ha-agent/Chart.yaml | 2 +- .../{spire/charts => }/spire-lib/.helmignore | 0 charts/spire-lib/Chart.yaml | 25 +++++++++ charts/{spire/charts => }/spire-lib/README.md | 0 .../spire-lib/templates/_helpers.tpl | 0 .../spire-lib/templates/_namespaces.yaml | 0 .../templates/_spire-server-namespace.yaml | 0 .../templates/_spire-system-namespace.yaml | 0 .../{spire/charts => }/spire-lib/values.yaml | 0 charts/spire-nested/Chart.yaml | 2 +- charts/spire/Chart.lock | 36 +++++++++++++ charts/spire/Chart.yaml | 2 +- charts/spire/charts/spire-lib/Chart.yaml | 24 --------- examples/external-mysql/run-tests.sh | 2 + examples/external-postgresql/run-tests.sh | 2 + examples/federation/run-tests.sh | 2 + examples/nested-full/run-tests.sh | 4 +- examples/nested-security/run-tests.sh | 4 +- examples/stateless-server/run-tests.sh | 2 + examples/tornjak/run-tests.sh | 2 + tests/integration/production/run-tests.sh | 2 + .../integration/spiffe-step-ssh/run-tests.sh | 3 +- 28 files changed, 184 insertions(+), 41 deletions(-) create mode 100755 .github/scripts/prepare-local-chart-deps.sh create mode 100644 AGENTS.md rename charts/{spire/charts => }/spire-lib/.helmignore (100%) create mode 100644 charts/spire-lib/Chart.yaml rename charts/{spire/charts => }/spire-lib/README.md (100%) rename charts/{spire/charts => }/spire-lib/templates/_helpers.tpl (100%) rename charts/{spire/charts => }/spire-lib/templates/_namespaces.yaml (100%) rename charts/{spire/charts => }/spire-lib/templates/_spire-server-namespace.yaml (100%) rename charts/{spire/charts => }/spire-lib/templates/_spire-system-namespace.yaml (100%) rename charts/{spire/charts => }/spire-lib/values.yaml (100%) create mode 100644 charts/spire/Chart.lock delete mode 100644 charts/spire/charts/spire-lib/Chart.yaml diff --git a/.github/scripts/prepare-local-chart-deps.sh b/.github/scripts/prepare-local-chart-deps.sh new file mode 100755 index 0000000..51808c9 --- /dev/null +++ b/.github/scripts/prepare-local-chart-deps.sh @@ -0,0 +1,20 @@ +#!/usr/bin/env bash + +set -euo pipefail + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +REPO_ROOT="$(dirname "${SCRIPTPATH}")/.." + +charts=( + "charts/spire" + "charts/spire-ha-agent" + "charts/spire-nested" +) + +for chart in "${charts[@]}"; do + chart_path="${REPO_ROOT}/${chart}" + if grep -q 'file://../spire-lib' "${chart_path}/Chart.yaml"; then + helm dependency update --skip-refresh "${chart_path}" + fi +done diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index 94c1fbf..11901ba 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -84,12 +84,20 @@ jobs: cache-dependency-path: tests/go.sum check-latest: true + - name: Set up Helm + uses: azure/setup-helm@v3.5 + with: + version: ${{ env.HELM_VERSION }} + - name: Install do dependencies run: | go mod download go install github.com/onsi/ginkgo/v2/ginkgo@latest working-directory: ./tests/unit + - name: Prepare local chart dependencies + run: ./.github/scripts/prepare-local-chart-deps.sh + - name: Run Unit Tests run: ginkgo working-directory: ./tests/unit @@ -173,10 +181,13 @@ jobs: run: ./pre-install.sh working-directory: .github/tests + - name: Prepare local chart dependencies + run: ./.github/scripts/prepare-local-chart-deps.sh + - name: Run chart-testing (install) run: | helm install -n spire-server spire-crds charts/spire-crds - ct install --config ct.yaml --excluded-charts spire-crds,spiffe-step-ssh,spire-ha-agent \ + ct install --config ct.yaml --excluded-charts spire-crds,spiffe-step-ssh,spire-ha-agent,spire-lib \ --target-branch ${{ github.base_ref || inputs.target_branch }} - name: Test summary @@ -252,6 +263,9 @@ jobs: config: .github/kind/conf/kind-config.yaml verbosity: 1 + - name: Prepare local chart dependencies + run: ./.github/scripts/prepare-local-chart-deps.sh + - name: Install and test example run: | if [ "${{ matrix.example }}" = "examples/federation" -o "${{ matrix.example }}" = "examples/nested-full" -o "${{ matrix.example }}" = "examples/nested-security" ]; then @@ -304,6 +318,9 @@ jobs: config: .github/kind/conf/kind-config.yaml verbosity: 1 + - name: Prepare local chart dependencies + run: ./.github/scripts/prepare-local-chart-deps.sh + - name: Install and test integration run: | helm install --create-namespace -n spire-mgmt spire-crds charts/spire-crds @@ -347,5 +364,8 @@ jobs: config: .github/kind/conf/kind-config.yaml verbosity: 1 + - name: Prepare local chart dependencies + run: ./.github/scripts/prepare-local-chart-deps.sh + - name: Install and test example run: tests/integration/production/run-tests.sh -u diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..fe6dc03 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,54 @@ +# AGENTS + +This file is a lightweight working guide for Codex and human contributors in this repository. + +## Repo Overview + +- Main charts live in `charts/` +- The integrated SPIRE chart is `charts/spire` +- Supporting charts include `charts/spire-crds`, `charts/spire-ha-agent`, `charts/spiffe-step-ssh`, and subcharts under `charts/spire/charts/` +- Example installs and scenario configs live in `examples/` +- Go-based unit tests live in `tests/unit` +- Cluster-backed integration tests live in `tests/integration` + +## Common Commands + +- `make lint` + - Runs chart-testing lint using `ct.yaml` +- `cd tests/unit && ginkgo` + - Runs Go unit/render tests for Helm templates +- `make test` + - Runs chart tests and example tests against a dedicated Kubernetes cluster +- `./helm-docs.sh` + - Regenerates chart README files after `Chart.yaml` or `values.yaml` changes + +## Working Agreements + +- Do not bump chart versions as part of normal contributions; maintainers handle release versioning +- If you change `Chart.yaml` or `values.yaml`, regenerate docs with `./helm-docs.sh` +- Prefer focused changes to a single chart or feature area per branch +- Preserve existing Helm templating patterns and values structure unless the task requires a broader refactor +- When possible, validate template changes with `cd tests/unit && ginkgo` before broader cluster tests +- PR commits should include a `Signed-off-by:` trailer to satisfy the repository's DCO check +- If DCO fails after commits are already pushed, fix it by rewriting the affected commits with signoff and force-pushing the branch + +## Testing Notes + +- `make test` assumes access to a dedicated Kubernetes cluster +- CI also runs Kind-based install tests and example matrices from `.github/workflows/helm-chart-ci.yaml` +- Unit tests render the `charts/spire` chart directly and assert against generated template output + +## Useful Paths + +- `README.md` +- `CONTRIBUTING.md` +- `.github/workflows/helm-chart-ci.yaml` +- `ct.yaml` +- `charts/spire/` +- `tests/unit/spire_test.go` + +## Editing Guidance + +- Keep generated README sections in sync by rerunning `./helm-docs.sh` +- Avoid hardcoded image references in templates; CI checks for overridable image templating +- Be careful with changes that affect nested charts, examples, or appVersion alignment across subcharts diff --git a/Makefile b/Makefile index aff0da0..e3d7506 100644 --- a/Makefile +++ b/Makefile @@ -37,10 +37,15 @@ install-test-deps: ## Install test dependency resources @echo Installing test dependencies… @.github/tests/pre-install.sh +.PHONY: chart-deps +chart-deps: ## Prepare local Helm chart dependencies + @echo Preparing local chart dependencies… + @.github/scripts/prepare-local-chart-deps.sh + .PHONY: test-charts test-charts: ## Run tests on charts using Helm chart-testing @echo Running tests… - @ct install --config ct.yaml + @ct install --config ct.yaml --excluded-charts spire-crds,spiffe-step-ssh,spire-ha-agent,spire-lib .PHONY: cleanup-test-deps cleanup-test-deps: ## Cleans up all test dependencies resources diff --git a/charts/spiffe-step-ssh/Chart.yaml b/charts/spiffe-step-ssh/Chart.yaml index 29140a9..df8d220 100644 --- a/charts/spiffe-step-ssh/Chart.yaml +++ b/charts/spiffe-step-ssh/Chart.yaml @@ -34,7 +34,7 @@ maintainers: dependencies: - name: spire-lib - repository: file://../spire/charts/spire-lib + repository: file://../spire-lib version: 0.1.0 - name: step-certificates alias: step diff --git a/charts/spire-ha-agent/Chart.lock b/charts/spire-ha-agent/Chart.lock index 69455cc..23659e9 100644 --- a/charts/spire-ha-agent/Chart.lock +++ b/charts/spire-ha-agent/Chart.lock @@ -1,6 +1,6 @@ dependencies: - name: spire-lib - repository: file://../spire/charts/spire-lib + repository: file://../spire-lib version: 0.1.0 -digest: sha256:e397a79d7d3b94b353f8458cb435f2cae9fd9495b367b9216958bff2771b801c -generated: "2024-11-08T00:50:47.925287061Z" +digest: sha256:0c6454c06ba554747a20ec39b7fee1fe4632eb49ceedb8aafacbc9f0bbc84b78 +generated: "2026-04-05T16:27:01.136911-07:00" diff --git a/charts/spire-ha-agent/Chart.yaml b/charts/spire-ha-agent/Chart.yaml index fa3efca..fe65224 100644 --- a/charts/spire-ha-agent/Chart.yaml +++ b/charts/spire-ha-agent/Chart.yaml @@ -19,5 +19,5 @@ maintainers: email: fymemon@yahoo.com dependencies: - name: spire-lib - repository: file://../spire/charts/spire-lib + repository: file://../spire-lib version: 0.1.0 diff --git a/charts/spire/charts/spire-lib/.helmignore b/charts/spire-lib/.helmignore similarity index 100% rename from charts/spire/charts/spire-lib/.helmignore rename to charts/spire-lib/.helmignore diff --git a/charts/spire-lib/Chart.yaml b/charts/spire-lib/Chart.yaml new file mode 100644 index 0000000..3d4e561 --- /dev/null +++ b/charts/spire-lib/Chart.yaml @@ -0,0 +1,25 @@ +apiVersion: v2 +name: spire-lib +description: A library of helper templates for SPIRE charts. +type: library +version: 0.1.0 +appVersion: "0.1.0" +keywords: ["spiffe", "spire", "library"] +home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-lib +sources: + - https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-lib +icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png +maintainers: + - name: marcofranssen + email: marco.franssen@gmail.com + url: https://marcofranssen.nl + - name: kfox1111 + email: Kevin.Fox@pnnl.gov + - name: faisal-memon + email: fymemon@yahoo.com + - name: edwbuck + email: edwbuck@gmail.com +annotations: + org.opencontainers.image.source: https://github.com/spiffe/helm-charts-hardened + artifacthub.io/category: security + artifacthub.io/license: Apache-2.0 diff --git a/charts/spire/charts/spire-lib/README.md b/charts/spire-lib/README.md similarity index 100% rename from charts/spire/charts/spire-lib/README.md rename to charts/spire-lib/README.md diff --git a/charts/spire/charts/spire-lib/templates/_helpers.tpl b/charts/spire-lib/templates/_helpers.tpl similarity index 100% rename from charts/spire/charts/spire-lib/templates/_helpers.tpl rename to charts/spire-lib/templates/_helpers.tpl diff --git a/charts/spire/charts/spire-lib/templates/_namespaces.yaml b/charts/spire-lib/templates/_namespaces.yaml similarity index 100% rename from charts/spire/charts/spire-lib/templates/_namespaces.yaml rename to charts/spire-lib/templates/_namespaces.yaml diff --git a/charts/spire/charts/spire-lib/templates/_spire-server-namespace.yaml b/charts/spire-lib/templates/_spire-server-namespace.yaml similarity index 100% rename from charts/spire/charts/spire-lib/templates/_spire-server-namespace.yaml rename to charts/spire-lib/templates/_spire-server-namespace.yaml diff --git a/charts/spire/charts/spire-lib/templates/_spire-system-namespace.yaml b/charts/spire-lib/templates/_spire-system-namespace.yaml similarity index 100% rename from charts/spire/charts/spire-lib/templates/_spire-system-namespace.yaml rename to charts/spire-lib/templates/_spire-system-namespace.yaml diff --git a/charts/spire/charts/spire-lib/values.yaml b/charts/spire-lib/values.yaml similarity index 100% rename from charts/spire/charts/spire-lib/values.yaml rename to charts/spire-lib/values.yaml diff --git a/charts/spire-nested/Chart.yaml b/charts/spire-nested/Chart.yaml index bf43c6f..eef7684 100644 --- a/charts/spire-nested/Chart.yaml +++ b/charts/spire-nested/Chart.yaml @@ -21,7 +21,7 @@ maintainers: kubeVersion: ">=1.21.0-0" dependencies: - name: spire-lib - repository: file://../spire/charts/spire-lib + repository: file://../spire-lib version: 0.1.0 - name: spire-server alias: root-spire-server diff --git a/charts/spire/Chart.lock b/charts/spire/Chart.lock new file mode 100644 index 0000000..e80fbb5 --- /dev/null +++ b/charts/spire/Chart.lock @@ -0,0 +1,36 @@ +dependencies: +- name: spire-lib + repository: file://../spire-lib + version: 0.1.0 +- name: spire-server + repository: file://./charts/spire-server + version: 0.1.0 +- name: spire-agent + repository: file://./charts/spire-agent + version: 0.1.0 +- name: spire-agent + repository: file://./charts/spire-agent + version: 0.1.0 +- name: spiffe-csi-driver + repository: file://./charts/spiffe-csi-driver + version: 0.1.0 +- name: spiffe-csi-driver + repository: file://./charts/spiffe-csi-driver + version: 0.1.0 +- name: spiffe-oidc-discovery-provider + repository: file://./charts/spiffe-oidc-discovery-provider + version: 0.1.0 +- name: tornjak-frontend + repository: file://./charts/tornjak-frontend + version: 0.1.0 +- name: spike-keeper + repository: file://./charts/spike-keeper + version: 0.1.0 +- name: spike-nexus + repository: file://./charts/spike-nexus + version: 0.1.0 +- name: spike-pilot + repository: file://./charts/spike-pilot + version: 0.1.0 +digest: sha256:59ed273c48633e8a1ae07be0e1628c9f21849b865dae10195ce46d68c093b4b2 +generated: "2026-04-05T16:48:18.584331-07:00" diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 4028375..b33d489 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -23,7 +23,7 @@ maintainers: kubeVersion: ">=1.21.0-0" dependencies: - name: spire-lib - repository: file://./charts/spire-lib + repository: file://../spire-lib version: 0.1.0 - name: spire-server condition: spire-server.enabled diff --git a/charts/spire/charts/spire-lib/Chart.yaml b/charts/spire/charts/spire-lib/Chart.yaml deleted file mode 100644 index 4f7bda2..0000000 --- a/charts/spire/charts/spire-lib/Chart.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: v2 -name: spire-lib -description: A Helm chart for Kubernetes - -# A chart can be either an 'application' or a 'library' chart. -# -# Application charts are a collection of templates that can be packaged into versioned archives -# to be deployed. -# -# Library charts provide useful utilities or functions for the chart developer. They're included as -# a dependency of application charts to inject those utilities and functions into the rendering -# pipeline. Library charts do not define any templates and therefore cannot be deployed. -type: library - -# This is the chart version. This version number should be incremented each time you make changes -# to the chart and its templates, including the app version. -# Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.1.0 - -# This is the version number of the application being deployed. This version number should be -# incremented each time you make changes to the application. Versions are not expected to -# follow Semantic Versioning. They should reflect the version the application is using. -# It is recommended to use it with quotes. -appVersion: "" diff --git a/examples/external-mysql/run-tests.sh b/examples/external-mysql/run-tests.sh index f3dd9be..9a95901 100755 --- a/examples/external-mysql/run-tests.sh +++ b/examples/external-mysql/run-tests.sh @@ -12,6 +12,8 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh" # shellcheck source=/dev/null source "${TESTDIR}/common.sh" +"${SCRIPTPATH}/../../.github/scripts/prepare-local-chart-deps.sh" + CLEANUP=1 for i in "$@"; do diff --git a/examples/external-postgresql/run-tests.sh b/examples/external-postgresql/run-tests.sh index 363cdff..94eb460 100755 --- a/examples/external-postgresql/run-tests.sh +++ b/examples/external-postgresql/run-tests.sh @@ -12,6 +12,8 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh" # shellcheck source=/dev/null source "${TESTDIR}/common.sh" +"${SCRIPTPATH}/../../.github/scripts/prepare-local-chart-deps.sh" + CLEANUP=1 for i in "$@"; do diff --git a/examples/federation/run-tests.sh b/examples/federation/run-tests.sh index f320e4c..2e273d9 100755 --- a/examples/federation/run-tests.sh +++ b/examples/federation/run-tests.sh @@ -11,6 +11,8 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh" # shellcheck source=/dev/null source "${TESTDIR}/common.sh" +"${SCRIPTPATH}/../../.github/scripts/prepare-local-chart-deps.sh" + CLEANUP=1 for i in "$@"; do diff --git a/examples/nested-full/run-tests.sh b/examples/nested-full/run-tests.sh index d5fd9cd..9c2e888 100755 --- a/examples/nested-full/run-tests.sh +++ b/examples/nested-full/run-tests.sh @@ -45,8 +45,7 @@ teardown() { trap 'EC=$? && trap - SIGTERM && teardown $EC' SIGINT SIGTERM EXIT -# Update deps -helm dep up charts/spire-nested +"${SCRIPTPATH}/../../.github/scripts/prepare-local-chart-deps.sh" # List nodes kubectl get nodes @@ -136,4 +135,3 @@ helm test --namespace spire-mgmt spire helm test --kubeconfig "${SCRIPTPATH}/kubeconfig-child" --namespace spire-mgmt spire helm test --kubeconfig "${SCRIPTPATH}/kubeconfig-other" --namespace spire-mgmt spire - diff --git a/examples/nested-security/run-tests.sh b/examples/nested-security/run-tests.sh index 0bb9ab9..1b89427 100755 --- a/examples/nested-security/run-tests.sh +++ b/examples/nested-security/run-tests.sh @@ -45,8 +45,7 @@ teardown() { trap 'EC=$? && trap - SIGTERM && teardown $EC' SIGINT SIGTERM EXIT -# Update deps -helm dep up charts/spire-nested +"${SCRIPTPATH}/../../.github/scripts/prepare-local-chart-deps.sh" # List nodes kubectl get nodes @@ -124,4 +123,3 @@ fi helm test --namespace spire-mgmt spire helm test --kubeconfig "${SCRIPTPATH}/kubeconfig-child" --namespace spire-mgmt spire - diff --git a/examples/stateless-server/run-tests.sh b/examples/stateless-server/run-tests.sh index f3dd9be..9a95901 100755 --- a/examples/stateless-server/run-tests.sh +++ b/examples/stateless-server/run-tests.sh @@ -12,6 +12,8 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh" # shellcheck source=/dev/null source "${TESTDIR}/common.sh" +"${SCRIPTPATH}/../../.github/scripts/prepare-local-chart-deps.sh" + CLEANUP=1 for i in "$@"; do diff --git a/examples/tornjak/run-tests.sh b/examples/tornjak/run-tests.sh index f91ed82..ecf29ca 100755 --- a/examples/tornjak/run-tests.sh +++ b/examples/tornjak/run-tests.sh @@ -9,6 +9,8 @@ TESTDIR="${SCRIPTPATH}/../../.github/tests" # shellcheck source=/dev/null source "${TESTDIR}/common.sh" +"${SCRIPTPATH}/../../.github/scripts/prepare-local-chart-deps.sh" + helm_install=(helm upgrade --install --create-namespace) ns=spire-system diff --git a/tests/integration/production/run-tests.sh b/tests/integration/production/run-tests.sh index a61cbac..92013ef 100755 --- a/tests/integration/production/run-tests.sh +++ b/tests/integration/production/run-tests.sh @@ -15,6 +15,8 @@ source "${SCRIPTPATH}/../../../.github/scripts/parse-versions.sh" # shellcheck source=/dev/null source "${TESTDIR}/common.sh" +"${SCRIPTPATH}/../../../.github/scripts/prepare-local-chart-deps.sh" + helm_install=(helm upgrade --install --create-namespace) ns=spire-server diff --git a/tests/integration/spiffe-step-ssh/run-tests.sh b/tests/integration/spiffe-step-ssh/run-tests.sh index 772b241..ae012bd 100755 --- a/tests/integration/spiffe-step-ssh/run-tests.sh +++ b/tests/integration/spiffe-step-ssh/run-tests.sh @@ -80,8 +80,7 @@ sudo -u spiffe-test chmod 600 /home/spiffe-test/.ssh/id_ed25519 sudo -u spiffe-test cp /home/spiffe-test/.ssh/id_ed25519.pub /home/spiffe-test/.ssh/authorized_keys sudo -u spiffe-test ssh -T -n -i /home/spiffe-test/.ssh/id_ed25519 spiffe-test@test.production.other hostname || echo Expected fail here -# Update deps -helm dep up charts/spire-nested +"${SCRIPTPATH}/../../../.github/scripts/prepare-local-chart-deps.sh" # List nodes kubectl get nodes From 040ccf905bb963fe54362b00a226e8098dfda8ba Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 9 Apr 2026 10:07:37 -0700 Subject: [PATCH 18/24] Bump versions to 1.14.5 (#789) Signed-off-by: Kevin Fox --- charts/spire-nested/Chart.yaml | 2 +- charts/spire-nested/README.md | 2 +- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml | 2 +- charts/spire/charts/spire-agent/Chart.yaml | 2 +- charts/spire/charts/spire-server/Chart.yaml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/charts/spire-nested/Chart.yaml b/charts/spire-nested/Chart.yaml index eef7684..18b89f6 100644 --- a/charts/spire-nested/Chart.yaml +++ b/charts/spire-nested/Chart.yaml @@ -4,7 +4,7 @@ description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application version: 0.28.3 -appVersion: "1.14.4" +appVersion: "1.14.5" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire-nested/README.md b/charts/spire-nested/README.md index 4332bf4..3e854e8 100644 --- a/charts/spire-nested/README.md +++ b/charts/spire-nested/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.28.3](https://img.shields.io/badge/Version-0.28.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.4](https://img.shields.io/badge/AppVersion-1.14.4-informational?style=flat-square) +![Version: 0.28.3](https://img.shields.io/badge/Version-0.28.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.5](https://img.shields.io/badge/AppVersion-1.14.5-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index b33d489..7a94ec4 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -4,7 +4,7 @@ description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application version: 0.28.3 -appVersion: "1.14.4" +appVersion: "1.14.5" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index 2861b20..5dae52c 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.28.3](https://img.shields.io/badge/Version-0.28.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.4](https://img.shields.io/badge/AppVersion-1.14.4-informational?style=flat-square) +![Version: 0.28.3](https://img.shields.io/badge/Version-0.28.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.5](https://img.shields.io/badge/AppVersion-1.14.5-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml index 734bda3..a246ae5 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml @@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider description: A Helm chart to install the SPIFFE OIDC discovery provider. type: application version: 0.1.0 -appVersion: "1.14.4" +appVersion: "1.14.5" keywords: ["spiffe", "oidc"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml index 51eb0cc..32255f5 100644 --- a/charts/spire/charts/spire-agent/Chart.yaml +++ b/charts/spire/charts/spire-agent/Chart.yaml @@ -3,7 +3,7 @@ name: spire-agent description: A Helm chart to install the SPIRE agent. type: application version: 0.1.0 -appVersion: "1.14.4" +appVersion: "1.14.5" keywords: ["spiffe", "spire-agent"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml index e9180e7..788986d 100644 --- a/charts/spire/charts/spire-server/Chart.yaml +++ b/charts/spire/charts/spire-server/Chart.yaml @@ -3,7 +3,7 @@ name: spire-server description: A Helm chart to install the SPIRE server. type: application version: 0.1.0 -appVersion: "1.14.4" +appVersion: "1.14.5" keywords: ["spiffe", "spire-server", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: From c71ffc3c4edaba3931ce49813319ac44783a720e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 10 Apr 2026 01:28:51 -0700 Subject: [PATCH 19/24] Bump helm.sh/helm/v3 from 3.20.1 to 3.20.2 in /tests (#791) Bumps [helm.sh/helm/v3](https://github.com/helm/helm) from 3.20.1 to 3.20.2. - [Release notes](https://github.com/helm/helm/releases) - [Commits](https://github.com/helm/helm/compare/v3.20.1...v3.20.2) --- updated-dependencies: - dependency-name: helm.sh/helm/v3 dependency-version: 3.20.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- tests/go.mod | 2 +- tests/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/go.mod b/tests/go.mod index 66a91d6..a49e26d 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -5,7 +5,7 @@ go 1.25.0 require ( github.com/onsi/ginkgo/v2 v2.28.1 github.com/onsi/gomega v1.39.1 - helm.sh/helm/v3 v3.20.1 + helm.sh/helm/v3 v3.20.2 ) require ( diff --git a/tests/go.sum b/tests/go.sum index 772552f..b4ddb29 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -165,8 +165,8 @@ gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -helm.sh/helm/v3 v3.20.1 h1:T8PodUaH1UwNvE+imUA2mIKjJItY8g7CVvLVP5g4NzI= -helm.sh/helm/v3 v3.20.1/go.mod h1:Fl1kBaWCpkUrM6IYXPjQ3bdZQfFrogKArqptvueZ6Ww= +helm.sh/helm/v3 v3.20.2 h1:binM4rvPx5DcNsa1sIt7UZi55lRbu3pZUFmQkSoRh48= +helm.sh/helm/v3 v3.20.2/go.mod h1:Fl1kBaWCpkUrM6IYXPjQ3bdZQfFrogKArqptvueZ6Ww= k8s.io/api v0.35.1 h1:0PO/1FhlK/EQNVK5+txc4FuhQibV25VLSdLMmGpDE/Q= k8s.io/api v0.35.1/go.mod h1:28uR9xlXWml9eT0uaGo6y71xK86JBELShLy4wR1XtxM= k8s.io/apiextensions-apiserver v0.35.1 h1:p5vvALkknlOcAqARwjS20kJffgzHqwyQRM8vHLwgU7w= From 86787b5912663403cef6ff7ccea35bcefb16cc16 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Fri, 10 Apr 2026 01:46:28 -0700 Subject: [PATCH 20/24] Add initial spire-ha-agent support to the spire-nested chart (#790) * Add initial spire-ha-agent support to the spire-nested chart Signed-off-by: Kevin Fox * Fix docs Signed-off-by: Kevin Fox * Fix lint issue Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox --- charts/spire-nested/Chart.yaml | 13 ++++++++ charts/spire-nested/README.md | 54 ++++++++++++++++++--------------- charts/spire-nested/values.yaml | 18 ++++++++++- 3 files changed, 59 insertions(+), 26 deletions(-) diff --git a/charts/spire-nested/Chart.yaml b/charts/spire-nested/Chart.yaml index 18b89f6..6c092ae 100644 --- a/charts/spire-nested/Chart.yaml +++ b/charts/spire-nested/Chart.yaml @@ -105,12 +105,25 @@ dependencies: - nestedRoot - nestedChildFull - nestedChildSecurity + - haAgentCommon repository: file://../spire/charts/spiffe-oidc-discovery-provider version: 0.1.0 - name: tornjak-frontend condition: tornjak-frontend.enabled repository: file://../spire/charts/tornjak-frontend version: 0.1.0 + - name: spiffe-csi-driver + repository: file://../spire/charts/spiffe-csi-driver + version: 0.1.0 + condition: spiffe-csi-driver.enabled + tags: + - haAgentCommon + - name: spire-ha-agent + repository: file://../spire-ha-agent + version: 0.1.0 + condition: spire-ha-agent.enabled + tags: + - haAgentCommon annotations: artifacthub.io/category: security artifacthub.io/license: Apache-2.0 diff --git a/charts/spire-nested/README.md b/charts/spire-nested/README.md index 3e854e8..2475b1e 100644 --- a/charts/spire-nested/README.md +++ b/charts/spire-nested/README.md @@ -233,6 +233,7 @@ Now you can interact with the Spire agent socket from your own application. The | `tags.nestedRoot` | Set the chart architecture to root nested | `false` | | `tags.nestedChildFull` | Set the chart mode to a child cluster with its own nested server | `false` | | `tags.nestedChildSecurity` | Set the chart mode to a child cluster for use with a security cluster | `false` | +| `tags.haAgentCommon` | Set the chart mode to deploy the common portion of a spire-ha-agent setup | `false` | ### Spire agent parameters @@ -328,28 +329,31 @@ Now you can interact with the Spire agent socket from your own application. The ### Spire server parameters -| Name | Description | Value | -| ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- | ---------------------------- | -| `internal-spire-server.nameOverride` | Overrides the name of Spire server pods | `internal-server` | -| `internal-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` | -| `internal-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` | -| `internal-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` | -| `internal-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` | -| `internal-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` | -| `internal-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` | -| `internal-spire-server.bundleConfigMap` | The name of the configmap to store the downstream bundle | `spire-bundle-downstream` | -| `external-spire-server.nameOverride` | Overrides the name of Spire server pods | `external-server` | -| `external-spire-server.crNameOverride` | Custom Resource name override | `external` | -| `external-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` | -| `external-spire-server.controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another instance on the k8s cluster with webhooks enabled. | `false` | -| `external-spire-server.controllerManager.className` | specify to use an explicit class name. | `spire-mgmt-external-server` | -| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable the default identity | `false` | -| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the oidc-discovery-provider identity | `false` | -| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` | -| `external-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` | -| `external-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` | -| `external-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` | -| `external-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` | -| `external-spire-server.bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `false` | -| `external-spire-server.nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `false` | -| `external-spire-server.nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `true` | +| Name | Description | Value | +| ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- | ----------------------------------------------- | +| `internal-spire-server.nameOverride` | Overrides the name of Spire server pods | `internal-server` | +| `internal-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` | +| `internal-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` | +| `internal-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` | +| `internal-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` | +| `internal-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` | +| `internal-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` | +| `internal-spire-server.bundleConfigMap` | The name of the configmap to store the downstream bundle | `spire-bundle-downstream` | +| `external-spire-server.nameOverride` | Overrides the name of Spire server pods | `external-server` | +| `external-spire-server.crNameOverride` | Custom Resource name override | `external` | +| `external-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` | +| `external-spire-server.controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another instance on the k8s cluster with webhooks enabled. | `false` | +| `external-spire-server.controllerManager.className` | specify to use an explicit class name. | `spire-mgmt-external-server` | +| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable the default identity | `false` | +| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the oidc-discovery-provider identity | `false` | +| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` | +| `external-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` | +| `external-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` | +| `external-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` | +| `external-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` | +| `external-spire-server.bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `false` | +| `external-spire-server.nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `false` | +| `external-spire-server.nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `true` | +| `spiffe-csi-driver.agentSocketPath` | The socket path where Spiffe CSI driver mounts agent socket | `/var/run/spire/agent-sockets/spire-agent.sock` | +| `spiffe-csi-driver.healthChecks.port` | Health check port number for upstream Spire agent | `9814` | +| `spire-ha-agent` | The configuration overrides for a spire-ha-agent | `{}` | diff --git a/charts/spire-nested/values.yaml b/charts/spire-nested/values.yaml index 3ef0315..4644702 100644 --- a/charts/spire-nested/values.yaml +++ b/charts/spire-nested/values.yaml @@ -101,6 +101,8 @@ tags: nestedChildFull: false ## @param tags.nestedChildSecurity Set the chart mode to a child cluster for use with a security cluster nestedChildSecurity: false + ## @param tags.haAgentCommon Set the chart mode to deploy the common portion of a spire-ha-agent setup + haAgentCommon: false ## subcharts @@ -197,7 +199,7 @@ upstream-spiffe-csi-driver: ## @section SPIFFE oidc discovery provider parameters ## Parameter values for spiffe-oidc-discovery-provider ## -# Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity] +# Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity, haAgentCommon] spiffe-oidc-discovery-provider: # enabled: true ## @param spiffe-oidc-discovery-provider.fullnameOverride Fullname override @@ -395,3 +397,17 @@ external-spire-server: joinToken: ## @param external-spire-server.nodeAttestor.joinToken.enabled Enable the join_token nodeattestor enabled: true + +# Used with tags [haAgentCommon] +spiffe-csi-driver: + # enabled: true + ## @param spiffe-csi-driver.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket + agentSocketPath: /var/run/spire/agent-sockets/spire-agent.sock + healthChecks: + ## @param spiffe-csi-driver.healthChecks.port Health check port number for upstream Spire agent + port: 9814 + +## @param spire-ha-agent The configuration overrides for a spire-ha-agent +# Used with tags [haAgentCommon] +spire-ha-agent: {} + # enabled: true From 013421724ffe8fe217b0e30dca5bba869aa1da62 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?D=C3=A1vid=20Szak=C3=A1llas?= <5807322+dszakallas@users.noreply.github.com> Date: Fri, 10 Apr 2026 18:56:50 +0200 Subject: [PATCH 21/24] Fix typos in error messages (#788) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * nit: fix typos Signed-off-by: Dávid Szakállas <5807322+dszakallas@users.noreply.github.com> * Apply suggestion from @kfox1111 Signed-off-by: kfox1111 --------- Signed-off-by: Dávid Szakállas <5807322+dszakallas@users.noreply.github.com> Signed-off-by: kfox1111 Co-authored-by: Faisal Memon Co-authored-by: kfox1111 Co-authored-by: kfox1111 --- charts/spire/charts/spire-server/templates/configmap.yaml | 2 +- .../spire/charts/spire-server/templates/server-resource.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 2fa417b..5750db9 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -3,7 +3,7 @@ {{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}} {{- include "spire-lib.check-strict-mode" (list . "caSubject.country must be set" (eq (include "spire-server.ca-subject-country" .) "ARPA"))}} {{- include "spire-lib.check-strict-mode" (list . "caSubject.organization must be set" (eq (include "spire-server.ca-subject-organization" .) "Example"))}} -{{- include "spire-lib.check-strict-mode" (list . "caSubject.commonNname must be set" (eq (include "spire-server.ca-subject-common-name" .) "example.org"))}} +{{- include "spire-lib.check-strict-mode" (list . "caSubject.commonName must be set" (eq (include "spire-server.ca-subject-common-name" .) "example.org"))}} {{- range $type, $tvals := .Values.customPlugins }} {{- if not (has $type (list "bundlePublisher" "credentialComposer" "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }} {{- fail (printf "Unknown plugin type specified: %s" $type) }} diff --git a/charts/spire/charts/spire-server/templates/server-resource.yaml b/charts/spire/charts/spire-server/templates/server-resource.yaml index b8e7422..c1ec81e 100644 --- a/charts/spire/charts/spire-server/templates/server-resource.yaml +++ b/charts/spire/charts/spire-server/templates/server-resource.yaml @@ -27,11 +27,11 @@ {{- if hasKey .Values.nodeAttestor "k8sPsat" }} {{- fail "k8sPsat was renamed to k8sPSAT. Please update your config." }} {{- end }} -{{- if hasKey .Values.nodeAttestor "externalK8sPSA" }} +{{- if hasKey .Values.nodeAttestor "externalK8sPsat" }} {{- fail "externalK8sPsat was renamed to externalK8sPSAT. Please update your config." }} {{- end }} {{- if hasKey .Values.notifier "k8sbundle" }} -{{- fail "k8sbundle was renmaed to k8sBundle. Please update your config." }} +{{- fail "k8sbundle was renamed to k8sBundle. Please update your config." }} {{- end }} {{- if eq .Values.kind "statefulset" }} {{- if not (has .Values.persistence.type (list "pvc" "hostPath" "emptyDir")) }} From a062e49c91bd5c9b9eddfc0441c624d2fb9b6e83 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Fri, 10 Apr 2026 13:40:16 -0700 Subject: [PATCH 22/24] Bump spire Helm Chart version from 0.28.3 to 0.28.4 * 01342172 Fix typos in error messages (#788) * 040ccf90 Bump versions to 1.14.5 (#789) * 9273f11f Support root-level spire-lib chart reuse (#785) * 145f3a36 chore: Add configurable probes for controller-manager (#784) * a27acbcb Bump test chart dependencies (#786) * 838a3535 Label chart (#783) * 59de7aa3 Bump test chart dependencies (#779) * 96773a31 Bump versions (#777) * aad7527c Add set_key_use configuration option (#774) * de59147f fix gather hostcert edge case issues (#775) * bf4bd819 feature: add awsSecretsManager upstreamAuthority (#772) * f78c1d42 Bump test chart dependencies (#773) * 7afffd75 Bump test chart dependencies (#771) * 60899fc9 Add configurable hostNetwork support to spiffe-csi-driver (#769) * 2de363a4 Bump test chart dependencies (#767) * 6631349b feat(spire-server): add logEncoding parameter for controller-manager (#766) Signed-off-by: Faisal Memon --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 7a94ec4..9b8e7ce 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -3,7 +3,7 @@ name: spire description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.28.3 +version: 0.28.4 appVersion: "1.14.5" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire diff --git a/charts/spire/README.md b/charts/spire/README.md index 5dae52c..09ebcaf 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.28.3](https://img.shields.io/badge/Version-0.28.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.5](https://img.shields.io/badge/AppVersion-1.14.5-informational?style=flat-square) +![Version: 0.28.4](https://img.shields.io/badge/Version-0.28.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.5](https://img.shields.io/badge/AppVersion-1.14.5-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. From d65890e4097b20bc41e6f216dd1c87c80dd03ce3 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Fri, 10 Apr 2026 23:32:47 -0700 Subject: [PATCH 23/24] Bump spire-nested Helm Chart version from 0.28.3 to 0.28.4 (#792) * 86787b59 Add initial spire-ha-agent support to the spire-nested chart (#790) * 040ccf90 Bump versions to 1.14.5 (#789) * 9273f11f Support root-level spire-lib chart reuse (#785) * 96773a31 Bump versions (#777) Signed-off-by: Faisal Memon Co-authored-by: kfox1111 --- charts/spire-nested/Chart.yaml | 2 +- charts/spire-nested/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire-nested/Chart.yaml b/charts/spire-nested/Chart.yaml index 6c092ae..44db001 100644 --- a/charts/spire-nested/Chart.yaml +++ b/charts/spire-nested/Chart.yaml @@ -3,7 +3,7 @@ name: spire-nested description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.28.3 +version: 0.28.4 appVersion: "1.14.5" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire diff --git a/charts/spire-nested/README.md b/charts/spire-nested/README.md index 2475b1e..f81c130 100644 --- a/charts/spire-nested/README.md +++ b/charts/spire-nested/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.28.3](https://img.shields.io/badge/Version-0.28.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.5](https://img.shields.io/badge/AppVersion-1.14.5-informational?style=flat-square) +![Version: 0.28.4](https://img.shields.io/badge/Version-0.28.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.5](https://img.shields.io/badge/AppVersion-1.14.5-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. From d334bfde50ddc674d564204f311f9615d00ea6dc Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Sat, 11 Apr 2026 08:52:09 -0700 Subject: [PATCH 24/24] Bump spiffe-step-ssh Helm Chart version from 0.1.1 to 0.1.2 (#794) * 9273f11f Support root-level spire-lib chart reuse (#785) Signed-off-by: Faisal Memon --- charts/spiffe-step-ssh/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/spiffe-step-ssh/Chart.yaml b/charts/spiffe-step-ssh/Chart.yaml index df8d220..811fe1b 100644 --- a/charts/spiffe-step-ssh/Chart.yaml +++ b/charts/spiffe-step-ssh/Chart.yaml @@ -15,7 +15,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.1.1 +version: 0.1.2 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to