Merge branch 'main' into release
This commit is contained in:
Faisal Memon
Executable
+20
@@ -0,0 +1,20 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT="$(readlink -f "$0")"
|
||||
SCRIPTPATH="$(dirname "${SCRIPT}")"
|
||||
REPO_ROOT="$(dirname "${SCRIPTPATH}")/.."
|
||||
|
||||
charts=(
|
||||
"charts/spire"
|
||||
"charts/spire-ha-agent"
|
||||
"charts/spire-nested"
|
||||
)
|
||||
|
||||
for chart in "${charts[@]}"; do
|
||||
chart_path="${REPO_ROOT}/${chart}"
|
||||
if grep -q 'file://../spire-lib' "${chart_path}/Chart.yaml"; then
|
||||
helm dependency update --skip-refresh "${chart_path}"
|
||||
fi
|
||||
done
|
||||
@@ -2,16 +2,16 @@
|
||||
{
|
||||
"name": "kube-prometheus-stack",
|
||||
"repo": "https://prometheus-community.github.io/helm-charts",
|
||||
"version": "82.4.3"
|
||||
"version": "82.18.0"
|
||||
},
|
||||
{
|
||||
"name": "cert-manager",
|
||||
"repo": "https://charts.jetstack.io",
|
||||
"version": "v1.19.4"
|
||||
"version": "v1.20.1"
|
||||
},
|
||||
{
|
||||
"name": "ingress-nginx",
|
||||
"repo": "https://kubernetes.github.io/ingress-nginx",
|
||||
"version": "4.14.3"
|
||||
"version": "4.15.1"
|
||||
}
|
||||
]
|
||||
|
||||
@@ -2,16 +2,16 @@
|
||||
{
|
||||
"name": "mariadb",
|
||||
"registry": "docker.io/bitnamicharts/mariadb",
|
||||
"version": "25.0.1"
|
||||
"version": "25.0.6"
|
||||
},
|
||||
{
|
||||
"name": "postgresql",
|
||||
"registry": "docker.io/bitnamicharts/postgresql",
|
||||
"version": "18.5.1"
|
||||
"version": "18.5.9"
|
||||
},
|
||||
{
|
||||
"name": "envoy-gateway",
|
||||
"registry": "docker.io/envoyproxy/gateway-helm",
|
||||
"version": "v1.7.0"
|
||||
"version": "v1.7.1"
|
||||
}
|
||||
]
|
||||
|
||||
@@ -84,12 +84,20 @@ jobs:
|
||||
cache-dependency-path: tests/go.sum
|
||||
check-latest: true
|
||||
|
||||
- name: Set up Helm
|
||||
uses: azure/[email protected]
|
||||
with:
|
||||
version: ${{ env.HELM_VERSION }}
|
||||
|
||||
- name: Install do dependencies
|
||||
run: |
|
||||
go mod download
|
||||
go install github.com/onsi/ginkgo/v2/ginkgo@latest
|
||||
working-directory: ./tests/unit
|
||||
|
||||
- name: Prepare local chart dependencies
|
||||
run: ./.github/scripts/prepare-local-chart-deps.sh
|
||||
|
||||
- name: Run Unit Tests
|
||||
run: ginkgo
|
||||
working-directory: ./tests/unit
|
||||
@@ -173,10 +181,13 @@ jobs:
|
||||
run: ./pre-install.sh
|
||||
working-directory: .github/tests
|
||||
|
||||
- name: Prepare local chart dependencies
|
||||
run: ./.github/scripts/prepare-local-chart-deps.sh
|
||||
|
||||
- name: Run chart-testing (install)
|
||||
run: |
|
||||
helm install -n spire-server spire-crds charts/spire-crds
|
||||
ct install --config ct.yaml --excluded-charts spire-crds,spiffe-step-ssh \
|
||||
ct install --config ct.yaml --excluded-charts spire-crds,spiffe-step-ssh,spire-ha-agent,spire-lib \
|
||||
--target-branch ${{ github.base_ref || inputs.target_branch }}
|
||||
|
||||
- name: Test summary
|
||||
@@ -252,6 +263,9 @@ jobs:
|
||||
config: .github/kind/conf/kind-config.yaml
|
||||
verbosity: 1
|
||||
|
||||
- name: Prepare local chart dependencies
|
||||
run: ./.github/scripts/prepare-local-chart-deps.sh
|
||||
|
||||
- name: Install and test example
|
||||
run: |
|
||||
if [ "${{ matrix.example }}" = "examples/federation" -o "${{ matrix.example }}" = "examples/nested-full" -o "${{ matrix.example }}" = "examples/nested-security" ]; then
|
||||
@@ -304,6 +318,9 @@ jobs:
|
||||
config: .github/kind/conf/kind-config.yaml
|
||||
verbosity: 1
|
||||
|
||||
- name: Prepare local chart dependencies
|
||||
run: ./.github/scripts/prepare-local-chart-deps.sh
|
||||
|
||||
- name: Install and test integration
|
||||
run: |
|
||||
helm install --create-namespace -n spire-mgmt spire-crds charts/spire-crds
|
||||
@@ -347,5 +364,8 @@ jobs:
|
||||
config: .github/kind/conf/kind-config.yaml
|
||||
verbosity: 1
|
||||
|
||||
- name: Prepare local chart dependencies
|
||||
run: ./.github/scripts/prepare-local-chart-deps.sh
|
||||
|
||||
- name: Install and test example
|
||||
run: tests/integration/production/run-tests.sh -u
|
||||
|
||||
@@ -0,0 +1,54 @@
|
||||
# AGENTS
|
||||
|
||||
This file is a lightweight working guide for Codex and human contributors in this repository.
|
||||
|
||||
## Repo Overview
|
||||
|
||||
- Main charts live in `charts/`
|
||||
- The integrated SPIRE chart is `charts/spire`
|
||||
- Supporting charts include `charts/spire-crds`, `charts/spire-ha-agent`, `charts/spiffe-step-ssh`, and subcharts under `charts/spire/charts/`
|
||||
- Example installs and scenario configs live in `examples/`
|
||||
- Go-based unit tests live in `tests/unit`
|
||||
- Cluster-backed integration tests live in `tests/integration`
|
||||
|
||||
## Common Commands
|
||||
|
||||
- `make lint`
|
||||
- Runs chart-testing lint using `ct.yaml`
|
||||
- `cd tests/unit && ginkgo`
|
||||
- Runs Go unit/render tests for Helm templates
|
||||
- `make test`
|
||||
- Runs chart tests and example tests against a dedicated Kubernetes cluster
|
||||
- `./helm-docs.sh`
|
||||
- Regenerates chart README files after `Chart.yaml` or `values.yaml` changes
|
||||
|
||||
## Working Agreements
|
||||
|
||||
- Do not bump chart versions as part of normal contributions; maintainers handle release versioning
|
||||
- If you change `Chart.yaml` or `values.yaml`, regenerate docs with `./helm-docs.sh`
|
||||
- Prefer focused changes to a single chart or feature area per branch
|
||||
- Preserve existing Helm templating patterns and values structure unless the task requires a broader refactor
|
||||
- When possible, validate template changes with `cd tests/unit && ginkgo` before broader cluster tests
|
||||
- PR commits should include a `Signed-off-by:` trailer to satisfy the repository's DCO check
|
||||
- If DCO fails after commits are already pushed, fix it by rewriting the affected commits with signoff and force-pushing the branch
|
||||
|
||||
## Testing Notes
|
||||
|
||||
- `make test` assumes access to a dedicated Kubernetes cluster
|
||||
- CI also runs Kind-based install tests and example matrices from `.github/workflows/helm-chart-ci.yaml`
|
||||
- Unit tests render the `charts/spire` chart directly and assert against generated template output
|
||||
|
||||
## Useful Paths
|
||||
|
||||
- `README.md`
|
||||
- `CONTRIBUTING.md`
|
||||
- `.github/workflows/helm-chart-ci.yaml`
|
||||
- `ct.yaml`
|
||||
- `charts/spire/`
|
||||
- `tests/unit/spire_test.go`
|
||||
|
||||
## Editing Guidance
|
||||
|
||||
- Keep generated README sections in sync by rerunning `./helm-docs.sh`
|
||||
- Avoid hardcoded image references in templates; CI checks for overridable image templating
|
||||
- Be careful with changes that affect nested charts, examples, or appVersion alignment across subcharts
|
||||
@@ -37,10 +37,15 @@ install-test-deps: ## Install test dependency resources
|
||||
@echo Installing test dependencies…
|
||||
@.github/tests/pre-install.sh
|
||||
|
||||
.PHONY: chart-deps
|
||||
chart-deps: ## Prepare local Helm chart dependencies
|
||||
@echo Preparing local chart dependencies…
|
||||
@.github/scripts/prepare-local-chart-deps.sh
|
||||
|
||||
.PHONY: test-charts
|
||||
test-charts: ## Run tests on charts using Helm chart-testing
|
||||
@echo Running tests…
|
||||
@ct install --config ct.yaml
|
||||
@ct install --config ct.yaml --excluded-charts spire-crds,spiffe-step-ssh,spire-ha-agent,spire-lib
|
||||
|
||||
.PHONY: cleanup-test-deps
|
||||
cleanup-test-deps: ## Cleans up all test dependencies resources
|
||||
|
||||
@@ -15,7 +15,7 @@ type: application
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 0.1.1
|
||||
version: 0.1.2
|
||||
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application. Versions are not expected to
|
||||
@@ -34,7 +34,7 @@ maintainers:
|
||||
|
||||
dependencies:
|
||||
- name: spire-lib
|
||||
repository: file://../spire/charts/spire-lib
|
||||
repository: file://../spire-lib
|
||||
version: 0.1.0
|
||||
- name: step-certificates
|
||||
alias: step
|
||||
|
||||
@@ -0,0 +1,6 @@
|
||||
dependencies:
|
||||
- name: spire-lib
|
||||
repository: file://../spire-lib
|
||||
version: 0.1.0
|
||||
digest: sha256:0c6454c06ba554747a20ec39b7fee1fe4632eb49ceedb8aafacbc9f0bbc84b78
|
||||
generated: "2026-04-05T16:27:01.136911-07:00"
|
||||
@@ -0,0 +1,23 @@
|
||||
apiVersion: v2
|
||||
name: spire-ha-agent
|
||||
description: A Helm chart to install the SPIRE HA agent.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "0.0.17"
|
||||
keywords: ["spiffe", "spire-ha-agent"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-ha-agent
|
||||
sources:
|
||||
- https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
|
||||
maintainers:
|
||||
- name: marcofranssen
|
||||
email: [email protected]
|
||||
url: https://marcofranssen.nl
|
||||
- name: kfox1111
|
||||
email: [email protected]
|
||||
- name: faisal-memon
|
||||
email: [email protected]
|
||||
dependencies:
|
||||
- name: spire-lib
|
||||
repository: file://../spire-lib
|
||||
version: 0.1.0
|
||||
@@ -0,0 +1,83 @@
|
||||
# spire-ha-agent
|
||||
|
||||
  
|
||||
|
||||
A Helm chart to install the SPIRE HA agent.
|
||||
|
||||
**Homepage:** <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
|
||||
|
||||
## Maintainers
|
||||
|
||||
| Name | Email | Url |
|
||||
| ---- | ------ | --- |
|
||||
| marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
|
||||
| kfox1111 | <Kevin.Fox@pnnl.gov> | |
|
||||
| faisal-memon | <fymemon@yahoo.com> | |
|
||||
|
||||
## Source Code
|
||||
|
||||
* <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-ha-agent>
|
||||
|
||||
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||
|
||||
## Parameters
|
||||
|
||||
### Chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/spire-ha-agent` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `singleSocket` | If in singleSocket mode, only one driver is used | `false` |
|
||||
| `sockets.single.admin.hostPath` | Where the sockets are on disk when in single socket mode | `/var/run/spire/agent/sockets/main/csi.spiffe.io/admin` |
|
||||
| `sockets.a.admin.hostPath` | Where the sockets are on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/admin` |
|
||||
| `sockets.b.admin.hostPath` | Where the sockets are on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/admin` |
|
||||
| `vsock` | Use a vsockets to expose the service rather then a unix socket | `false` |
|
||||
| `port` | Port number to listen on | `999` |
|
||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||
| `nameOverride` | Name override | `""` |
|
||||
| `namespaceOverride` | Namespace override | `""` |
|
||||
| `fullnameOverride` | Fullname override | `""` |
|
||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||
| `serviceAccount.name` | The name of the service account to use. | `""` |
|
||||
| `podAnnotations` | Annotations to add to pods | `{}` |
|
||||
| `podLabels` | Labels to add to pods | `{}` |
|
||||
| `podSecurityContext` | Pod security context | `{}` |
|
||||
| `securityContext` | Security context | `{}` |
|
||||
| `resources` | Resource requests and limits | `{}` |
|
||||
| `nodeSelector` | Node selector | `{}` |
|
||||
| `tolerations` | List of tolerations | `[]` |
|
||||
| `affinity` | Node affinity | `{}` |
|
||||
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
|
||||
| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` |
|
||||
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` |
|
||||
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `cid2PID.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `cid2PID.image.repository` | The repository within the registry | `kfox1111/cid2pid` |
|
||||
| `cid2PID.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `cid2PID.image.tag` | Overrides the image tag whose default is the chart appVersion | `v0.0.3` |
|
||||
| `cid2PID.busybox.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `cid2PID.busybox.image.repository` | The repository within the registry | `library/busybox` |
|
||||
| `cid2PID.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `cid2PID.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` |
|
||||
| `cid2PID.busybox.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` |
|
||||
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` |
|
||||
| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
|
||||
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
|
||||
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` |
|
||||
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
|
||||
| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` |
|
||||
| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` |
|
||||
@@ -0,0 +1 @@
|
||||
Installed {{ .Chart.Name }}…
|
||||
@@ -0,0 +1,137 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "spire-ha-agent.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "spire-ha-agent.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Allow the release namespace to be overridden for multi-namespace deployments in combined charts
|
||||
*/}}
|
||||
{{- define "spire-ha-agent.namespace" -}}
|
||||
{{- if .Values.namespaceOverride -}}
|
||||
{{- .Values.namespaceOverride -}}
|
||||
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
|
||||
{{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }}
|
||||
{{- .Values.global.spire.namespaces.system.name }}
|
||||
{{- else }}
|
||||
{{- printf "spire-system" }}
|
||||
{{- end }}
|
||||
{{- else -}}
|
||||
{{- .Release.Namespace -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "spire-ha-agent.server.namespace" -}}
|
||||
{{- if .Values.server.namespaceOverride -}}
|
||||
{{- .Values.server.namespaceOverride -}}
|
||||
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
|
||||
{{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }}
|
||||
{{- .Values.global.spire.namespaces.server.name }}
|
||||
{{- else }}
|
||||
{{- printf "spire-server" }}
|
||||
{{- end }}
|
||||
{{- else -}}
|
||||
{{- .Release.Namespace -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "spire-ha-agent.podMonitor.namespace" -}}
|
||||
{{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }}
|
||||
{{- .Values.telemetry.prometheus.podMonitor.namespace }}
|
||||
{{- else if ne (len (dig "telemetry" "prometheus" "podMonitor" "namespace" "" .Values.global)) 0 }}
|
||||
{{- .Values.global.telemetry.prometheus.podMonitor.namespace }}
|
||||
{{- else }}
|
||||
{{- include "spire-ha-agent.namespace" . }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "spire-ha-agent.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "spire-ha-agent.labels" -}}
|
||||
helm.sh/chart: {{ include "spire-ha-agent.chart" . | quote }}
|
||||
{{ include "spire-ha-agent.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "spire-ha-agent.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "spire-ha-agent.name" . | quote }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "spire-ha-agent.serviceAccountName" -}}
|
||||
{{- default (printf "%s-agent" .Release.Name) .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-ha-agent.server-address" }}
|
||||
{{- if and (ne (len (dig "spire" "upstreamSpireAddress" "" .Values.global)) 0) .Values.upstream }}
|
||||
{{- print .Values.global.spire.upstreamSpireAddress }}
|
||||
{{- else if .Values.server.address }}
|
||||
{{- .Values.server.address }}
|
||||
{{- else if .Values.server.nameOverride }}
|
||||
{{ .Release.Name }}-{{ .Values.server.nameOverride }}.{{ include "spire-ha-agent.server.namespace" . }}
|
||||
{{- else }}
|
||||
{{ .Release.Name }}-server.{{ include "spire-ha-agent.server.namespace" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-ha-agent.socket-path" -}}
|
||||
{{- print .Values.socketPath }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-ha-agent.connect-by-hostname" -}}
|
||||
{{- if ne .Values.kubeletConnectByHostname "" }}
|
||||
{{- if eq (.Values.kubeletConnectByHostname | toString) "true" }}
|
||||
{{- printf "true" }}
|
||||
{{- else }}
|
||||
{{- printf "false" }}
|
||||
{{- end }}
|
||||
{{- else if (dig "openshift" false .Values.global) }}
|
||||
{{- printf "true" }}
|
||||
{{- else }}
|
||||
{{- printf "false" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-ha-agent.socket-alternate-names" -}}
|
||||
{{- $sockName := .Values.socketPath | base }}
|
||||
{{- $l := deepCopy .Values.socketAlternate.names }}
|
||||
{{- $l = without $l $sockName }}
|
||||
names:
|
||||
{{ $l | toYaml }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,216 @@
|
||||
{{- $podSecurityContext := fromYaml (include "spire-lib.podsecuritycontext" .) }}
|
||||
{{- $mainSecurityContext := deepCopy .Values.securityContext }}
|
||||
{{- $socketAlternateNames := index (include "spire-ha-agent.socket-alternate-names" . | fromYaml) "names" }}
|
||||
{{- $socketPath := include "spire-ha-agent.socket-path" . }}
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: {{ include "spire-ha-agent.fullname" . | quote }}
|
||||
namespace: {{ include "spire-ha-agent.namespace" . | quote}}
|
||||
labels:
|
||||
{{- include "spire-ha-agent.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: spire-ha-agent
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spire-ha-agent.selectorLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: spire-ha-agent
|
||||
{{- with .Values.updateStrategy }}
|
||||
updateStrategy:
|
||||
{{- if not (has .type (list "RollingUpdate" "OnDelete")) }}
|
||||
{{- fail "updateStrategy.type can only be RollingUpdate or OnDelete"}}
|
||||
{{- end }}
|
||||
type: {{ .type }}
|
||||
{{- if eq .type "RollingUpdate" }}
|
||||
rollingUpdate:
|
||||
maxUnavailable: {{ .rollingUpdate.maxUnavailable }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
kubectl.kubernetes.io/default-container: spire-ha-agent
|
||||
labels:
|
||||
{{- include "spire-ha-agent.selectorLabels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: spire-ha-agent
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
hostPID: true
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
serviceAccountName: {{ include "spire-ha-agent.serviceAccountName" . | quote }}
|
||||
securityContext:
|
||||
{{- toYaml $podSecurityContext | nindent 8 }}
|
||||
{{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }}
|
||||
{{- if ne (len .Values.hostAliases) 0 }}
|
||||
hostAliases:
|
||||
{{- toYaml .Values.hostAliases | nindent 8 }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- if not .Values.vsock }}
|
||||
{{- if gt (len $socketAlternateNames) 0 }}
|
||||
- name: ensure-alternate-names
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.socketAlternate.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.socketAlternate.image.pullPolicy | quote }}
|
||||
command: ["bash", "-xc"]
|
||||
{{- /* 1. Look for symlinks pointing at the wrong place and remove them. 2. Make symlinks that don't exist. 3. If new socket is pointing at an existing symlink, remove old symlink. */}}
|
||||
args:
|
||||
- |
|
||||
cd {{ $socketPath | dir }}
|
||||
{{- range $socketAlternateNames }}
|
||||
L=`readlink {{ . }}`
|
||||
[ "x$L" != "x{{ $socketPath | base }}" ] && rm -f {{ . }}
|
||||
[ ! -L {{ . }} ] && ln -s {{ $socketPath | base }} {{ . }}
|
||||
{{- end }}
|
||||
[ -L {{ $socketPath | base }} ] && rm -f {{ $socketPath | base }}
|
||||
exit 0
|
||||
resources:
|
||||
{{- toYaml .Values.socketAlternate.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spire-ha-agent-socket-dir
|
||||
mountPath: {{ $socketPath | dir }}
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
- name: setup-shell
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.cid2PID.busybox.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.cid2PID.busybox.image.pullPolicy | quote }}
|
||||
command: ["sh", "-xc"]
|
||||
args:
|
||||
- |
|
||||
cp -a /bin/busybox /data
|
||||
resources:
|
||||
{{- toYaml .Values.cid2PID.busybox.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: cid2pid
|
||||
mountPath: /data
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
- name: setup-cid2pid
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.cid2PID.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.cid2PID.image.pullPolicy | quote }}
|
||||
command: ["/data/busybox", "sh", "-xc"]
|
||||
args:
|
||||
- |
|
||||
/data/busybox cp -a /usr/bin/cid2pid /data
|
||||
/data/busybox rm -f /data/busybox
|
||||
resources:
|
||||
{{- toYaml .Values.cid2PID.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: cid2pid
|
||||
mountPath: /data
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
{{- end }}
|
||||
{{- if gt (len .Values.initContainers) 0 }}
|
||||
{{- toYaml .Values.initContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name | quote }}
|
||||
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
securityContext:
|
||||
privileged: true
|
||||
#FIXME read permission to api socket
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
#{- $mainSecurityContext | toYaml | nindent 12 }}
|
||||
env:
|
||||
- name: SPIRE_HA_AGENT_SOCK
|
||||
value: /tmp/spire-ha-agent/public/spire-agent.sock
|
||||
{{- if .Values.singleSocket }}
|
||||
- name: SPIRE_HA_AGENT_SINGLE
|
||||
value: enabled
|
||||
- name: SPIRE_HA_AGENT_SOCKET
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/admin/admin.sock
|
||||
{{- else }}
|
||||
- name: SPIRE_HA_AGENT_SOCKET_A
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/admin/admin.sock
|
||||
- name: SPIRE_HA_AGENT_SOCKET_B
|
||||
value: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/admin/admin.sock
|
||||
{{- end }}
|
||||
{{- if .Values.vsock }}
|
||||
- name: SPIRE_HA_AGENT_VSOCK
|
||||
value: enabled
|
||||
- name: SPIRE_HA_AGENT_PORT
|
||||
value: {{ .Values.port | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraEnvVars }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
# - name: spire-ha-agent-persistence
|
||||
# mountPath: /var/lib/spire
|
||||
{{- if .Values.vsock }}
|
||||
- name: cid2pid
|
||||
mountPath: /usr/bin/cid2pid
|
||||
subPath: cid2pid
|
||||
readOnly: true
|
||||
{{- else }}
|
||||
- name: spire-ha-agent-socket-dir
|
||||
mountPath: /tmp/spire-ha-agent/public
|
||||
readOnly: false
|
||||
{{- end }}
|
||||
- name: spire-ha-admin-socket-dir-upstream-a
|
||||
mountPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/admin
|
||||
{{- if not .Values.singleSocket }}
|
||||
- name: spire-ha-admin-socket-dir-upstream-b
|
||||
mountPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/admin
|
||||
{{- end }}
|
||||
- name: dev
|
||||
mountPath: /dev
|
||||
{{- if gt (len .Values.extraVolumeMounts) 0 }}
|
||||
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- if gt (len .Values.extraContainers) 0 }}
|
||||
{{- toYaml .Values.extraContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if not .Values.vsock }}
|
||||
- name: spire-ha-agent-socket-dir
|
||||
hostPath:
|
||||
path: {{ $socketPath | dir }}
|
||||
type: DirectoryOrCreate
|
||||
{{- end }}
|
||||
- name: spire-ha-admin-socket-dir-upstream-a
|
||||
hostPath:
|
||||
path: {{ if .Values.singleSocket }}{{ .Values.sockets.single.admin.hostPath }}{{ else }}{{ .Values.sockets.a.admin.hostPath }}{{ end }}
|
||||
type: DirectoryOrCreate
|
||||
{{- if not .Values.singleSocket }}
|
||||
- name: spire-ha-admin-socket-dir-upstream-b
|
||||
hostPath:
|
||||
path: {{ .Values.sockets.b.admin.hostPath }}
|
||||
type: DirectoryOrCreate
|
||||
{{- end }}
|
||||
- name: dev
|
||||
hostPath:
|
||||
path: /dev
|
||||
- name: cid2pid
|
||||
emtpyDir: {}
|
||||
{{- if gt (len .Values.extraVolumes) 0 }}
|
||||
{{- toYaml .Values.extraVolumes | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spire-ha-agent.serviceAccountName" . | quote }}
|
||||
namespace: {{ include "spire-ha-agent.namespace" . | quote }}
|
||||
labels:
|
||||
{{- include "spire-ha-agent.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,198 @@
|
||||
# Default configuration for Spire Agent
|
||||
# SPDX-License-Identifier: APACHE-2.0
|
||||
|
||||
## @skip global
|
||||
global: {}
|
||||
|
||||
## @section Chart parameters
|
||||
##
|
||||
## @param image.registry The OCI registry to pull the image from
|
||||
## @param image.repository The repository within the registry
|
||||
## @param image.pullPolicy The image pull policy
|
||||
## @param image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-ha-agent
|
||||
pullPolicy: IfNotPresent
|
||||
tag: ""
|
||||
|
||||
## @param singleSocket If in singleSocket mode, only one driver is used
|
||||
singleSocket: false
|
||||
|
||||
## @param sockets.single.admin.hostPath Where the sockets are on disk when in single socket mode
|
||||
## @param sockets.a.admin.hostPath Where the sockets are on disk
|
||||
## @param sockets.b.admin.hostPath Where the sockets are on disk
|
||||
sockets:
|
||||
single:
|
||||
admin:
|
||||
hostPath: /var/run/spire/agent/sockets/main/csi.spiffe.io/admin
|
||||
a:
|
||||
admin:
|
||||
hostPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/admin
|
||||
b:
|
||||
admin:
|
||||
hostPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/admin
|
||||
|
||||
## @param vsock Use a vsockets to expose the service rather then a unix socket
|
||||
vsock: false
|
||||
|
||||
## @param port Port number to listen on
|
||||
port: 999
|
||||
|
||||
## @param imagePullSecrets [array] Pull secrets for images
|
||||
imagePullSecrets: []
|
||||
|
||||
## @param nameOverride Name override
|
||||
nameOverride: ""
|
||||
|
||||
## @param namespaceOverride Namespace override
|
||||
namespaceOverride: ""
|
||||
|
||||
## @param fullnameOverride Fullname override
|
||||
fullnameOverride: ""
|
||||
|
||||
serviceAccount:
|
||||
## @param serviceAccount.create Specifies whether a service account should be created
|
||||
create: true
|
||||
## @param serviceAccount.annotations [object] Annotations to add to the service account
|
||||
annotations: {}
|
||||
## @param serviceAccount.name The name of the service account to use.
|
||||
## If not set and create is true, a name is generated using the fullname template
|
||||
name: ""
|
||||
|
||||
## @param podAnnotations [object] Annotations to add to pods
|
||||
podAnnotations: {}
|
||||
|
||||
## @param podLabels [object] Labels to add to pods
|
||||
podLabels: {}
|
||||
|
||||
## @param podSecurityContext [object] Pod security context
|
||||
podSecurityContext: {}
|
||||
# fsGroup: 2000
|
||||
|
||||
## @param securityContext [object] Security context
|
||||
securityContext: {}
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
## @param resources [object] Resource requests and limits
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# requests:
|
||||
# cpu: 50m
|
||||
# memory: 64Mi
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
## @param nodeSelector [object] Node selector
|
||||
nodeSelector: {}
|
||||
|
||||
## @param tolerations [array] List of tolerations
|
||||
tolerations: []
|
||||
|
||||
## @param affinity [object] Node affinity
|
||||
affinity: {}
|
||||
|
||||
## @param updateStrategy.type The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete.
|
||||
## @param updateStrategy.rollingUpdate.maxUnavailable Max unavailable pods during update. Can be a number or a percentage.
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
|
||||
# When running as non root, needed to ensure the socket path has the correct permissions.
|
||||
# Set runAsUser to a non-zero value in podSecurityContext to run as non-root user.
|
||||
fsGroupFix:
|
||||
## @param fsGroupFix.image.registry The OCI registry to pull the image from
|
||||
## @param fsGroupFix.image.repository The repository within the registry
|
||||
## @param fsGroupFix.image.pullPolicy The image pull policy
|
||||
## @param fsGroupFix.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1
|
||||
|
||||
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
||||
cid2PID:
|
||||
## @param cid2PID.image.registry The OCI registry to pull the image from
|
||||
## @param cid2PID.image.repository The repository within the registry
|
||||
## @param cid2PID.image.pullPolicy The image pull policy
|
||||
## @param cid2PID.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: ghcr.io
|
||||
repository: kfox1111/cid2pid
|
||||
pullPolicy: Always
|
||||
tag: v0.0.3
|
||||
|
||||
## @param cid2PID.busybox.image.registry The OCI registry to pull the image from
|
||||
## @param cid2PID.busybox.image.repository The repository within the registry
|
||||
## @param cid2PID.busybox.image.pullPolicy The image pull policy
|
||||
## @param cid2PID.busybox.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
busybox:
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: library/busybox
|
||||
pullPolicy: IfNotPresent
|
||||
tag: 1.36.1-uclibc
|
||||
|
||||
## @param cid2PID.busybox.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
||||
## @param socketPath The unix socket path to the spire-agent
|
||||
socketPath: /run/spire/agent-sockets/spire-agent.sock
|
||||
|
||||
socketAlternate:
|
||||
## @param socketAlternate.names List of alternate names for the socket that workloads might expect to be able to access in the driver mount.
|
||||
names:
|
||||
- socket
|
||||
- spire-agent.sock
|
||||
- api.sock
|
||||
|
||||
## @param socketAlternate.image.registry The OCI registry to pull the image from
|
||||
## @param socketAlternate.image.repository The repository within the registry
|
||||
## @param socketAlternate.image.pullPolicy The image pull policy
|
||||
## @param socketAlternate.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1
|
||||
|
||||
## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
||||
## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.
|
||||
priorityClassName: ""
|
||||
|
||||
## @param extraEnvVars [array] Extra environment variables to be added to the Spire Agent container
|
||||
extraEnvVars: []
|
||||
|
||||
## @param extraVolumes [array] Extra volumes to be mounted on Spire Agent pods
|
||||
extraVolumes: []
|
||||
|
||||
## @param extraVolumeMounts [array] Extra volume mounts for Spire Agent pods
|
||||
extraVolumeMounts: []
|
||||
|
||||
## @param extraContainers [array] Additional containers to create with Spire Agent pods
|
||||
extraContainers: []
|
||||
|
||||
## @param initContainers [array] Additional init containers to create with Spire Agent pods
|
||||
initContainers: []
|
||||
## @param hostAliases [array] Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/
|
||||
hostAliases: []
|
||||
@@ -0,0 +1,25 @@
|
||||
apiVersion: v2
|
||||
name: spire-lib
|
||||
description: A library of helper templates for SPIRE charts.
|
||||
type: library
|
||||
version: 0.1.0
|
||||
appVersion: "0.1.0"
|
||||
keywords: ["spiffe", "spire", "library"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-lib
|
||||
sources:
|
||||
- https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-lib
|
||||
icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
|
||||
maintainers:
|
||||
- name: marcofranssen
|
||||
email: [email protected]
|
||||
url: https://marcofranssen.nl
|
||||
- name: kfox1111
|
||||
email: [email protected]
|
||||
- name: faisal-memon
|
||||
email: [email protected]
|
||||
- name: edwbuck
|
||||
email: [email protected]
|
||||
annotations:
|
||||
org.opencontainers.image.source: https://github.com/spiffe/helm-charts-hardened
|
||||
artifacthub.io/category: security
|
||||
artifacthub.io/license: Apache-2.0
|
||||
@@ -3,8 +3,8 @@ name: spire-nested
|
||||
description: >
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
type: application
|
||||
version: 0.28.3
|
||||
appVersion: "1.14.2"
|
||||
version: 0.28.4
|
||||
appVersion: "1.14.5"
|
||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
@@ -21,7 +21,7 @@ maintainers:
|
||||
kubeVersion: ">=1.21.0-0"
|
||||
dependencies:
|
||||
- name: spire-lib
|
||||
repository: file://../spire/charts/spire-lib
|
||||
repository: file://../spire-lib
|
||||
version: 0.1.0
|
||||
- name: spire-server
|
||||
alias: root-spire-server
|
||||
@@ -105,12 +105,25 @@ dependencies:
|
||||
- nestedRoot
|
||||
- nestedChildFull
|
||||
- nestedChildSecurity
|
||||
- haAgentCommon
|
||||
repository: file://../spire/charts/spiffe-oidc-discovery-provider
|
||||
version: 0.1.0
|
||||
- name: tornjak-frontend
|
||||
condition: tornjak-frontend.enabled
|
||||
repository: file://../spire/charts/tornjak-frontend
|
||||
version: 0.1.0
|
||||
- name: spiffe-csi-driver
|
||||
repository: file://../spire/charts/spiffe-csi-driver
|
||||
version: 0.1.0
|
||||
condition: spiffe-csi-driver.enabled
|
||||
tags:
|
||||
- haAgentCommon
|
||||
- name: spire-ha-agent
|
||||
repository: file://../spire-ha-agent
|
||||
version: 0.1.0
|
||||
condition: spire-ha-agent.enabled
|
||||
tags:
|
||||
- haAgentCommon
|
||||
annotations:
|
||||
artifacthub.io/category: security
|
||||
artifacthub.io/license: Apache-2.0
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# spire
|
||||
|
||||
  
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
@@ -233,6 +233,7 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| `tags.nestedRoot` | Set the chart architecture to root nested | `false` |
|
||||
| `tags.nestedChildFull` | Set the chart mode to a child cluster with its own nested server | `false` |
|
||||
| `tags.nestedChildSecurity` | Set the chart mode to a child cluster for use with a security cluster | `false` |
|
||||
| `tags.haAgentCommon` | Set the chart mode to deploy the common portion of a spire-ha-agent setup | `false` |
|
||||
|
||||
### Spire agent parameters
|
||||
|
||||
@@ -329,7 +330,7 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
### Spire server parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- | ---------------------------- |
|
||||
| ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- | ----------------------------------------------- |
|
||||
| `internal-spire-server.nameOverride` | Overrides the name of Spire server pods | `internal-server` |
|
||||
| `internal-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
|
||||
| `internal-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` |
|
||||
@@ -353,3 +354,6 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| `external-spire-server.bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `false` |
|
||||
| `external-spire-server.nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `false` |
|
||||
| `external-spire-server.nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `true` |
|
||||
| `spiffe-csi-driver.agentSocketPath` | The socket path where Spiffe CSI driver mounts agent socket | `/var/run/spire/agent-sockets/spire-agent.sock` |
|
||||
| `spiffe-csi-driver.healthChecks.port` | Health check port number for upstream Spire agent | `9814` |
|
||||
| `spire-ha-agent` | The configuration overrides for a spire-ha-agent | `{}` |
|
||||
|
||||
@@ -101,6 +101,8 @@ tags:
|
||||
nestedChildFull: false
|
||||
## @param tags.nestedChildSecurity Set the chart mode to a child cluster for use with a security cluster
|
||||
nestedChildSecurity: false
|
||||
## @param tags.haAgentCommon Set the chart mode to deploy the common portion of a spire-ha-agent setup
|
||||
haAgentCommon: false
|
||||
|
||||
## subcharts
|
||||
|
||||
@@ -197,7 +199,7 @@ upstream-spiffe-csi-driver:
|
||||
## @section SPIFFE oidc discovery provider parameters
|
||||
## Parameter values for spiffe-oidc-discovery-provider
|
||||
##
|
||||
# Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity]
|
||||
# Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity, haAgentCommon]
|
||||
spiffe-oidc-discovery-provider:
|
||||
# enabled: true
|
||||
## @param spiffe-oidc-discovery-provider.fullnameOverride Fullname override
|
||||
@@ -395,3 +397,17 @@ external-spire-server:
|
||||
joinToken:
|
||||
## @param external-spire-server.nodeAttestor.joinToken.enabled Enable the join_token nodeattestor
|
||||
enabled: true
|
||||
|
||||
# Used with tags [haAgentCommon]
|
||||
spiffe-csi-driver:
|
||||
# enabled: true
|
||||
## @param spiffe-csi-driver.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
|
||||
agentSocketPath: /var/run/spire/agent-sockets/spire-agent.sock
|
||||
healthChecks:
|
||||
## @param spiffe-csi-driver.healthChecks.port Health check port number for upstream Spire agent
|
||||
port: 9814
|
||||
|
||||
## @param spire-ha-agent The configuration overrides for a spire-ha-agent
|
||||
# Used with tags [haAgentCommon]
|
||||
spire-ha-agent: {}
|
||||
# enabled: true
|
||||
|
||||
@@ -0,0 +1,36 @@
|
||||
dependencies:
|
||||
- name: spire-lib
|
||||
repository: file://../spire-lib
|
||||
version: 0.1.0
|
||||
- name: spire-server
|
||||
repository: file://./charts/spire-server
|
||||
version: 0.1.0
|
||||
- name: spire-agent
|
||||
repository: file://./charts/spire-agent
|
||||
version: 0.1.0
|
||||
- name: spire-agent
|
||||
repository: file://./charts/spire-agent
|
||||
version: 0.1.0
|
||||
- name: spiffe-csi-driver
|
||||
repository: file://./charts/spiffe-csi-driver
|
||||
version: 0.1.0
|
||||
- name: spiffe-csi-driver
|
||||
repository: file://./charts/spiffe-csi-driver
|
||||
version: 0.1.0
|
||||
- name: spiffe-oidc-discovery-provider
|
||||
repository: file://./charts/spiffe-oidc-discovery-provider
|
||||
version: 0.1.0
|
||||
- name: tornjak-frontend
|
||||
repository: file://./charts/tornjak-frontend
|
||||
version: 0.1.0
|
||||
- name: spike-keeper
|
||||
repository: file://./charts/spike-keeper
|
||||
version: 0.1.0
|
||||
- name: spike-nexus
|
||||
repository: file://./charts/spike-nexus
|
||||
version: 0.1.0
|
||||
- name: spike-pilot
|
||||
repository: file://./charts/spike-pilot
|
||||
version: 0.1.0
|
||||
digest: sha256:59ed273c48633e8a1ae07be0e1628c9f21849b865dae10195ce46d68c093b4b2
|
||||
generated: "2026-04-05T16:48:18.584331-07:00"
|
||||
@@ -3,8 +3,8 @@ name: spire
|
||||
description: >
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
type: application
|
||||
version: 0.28.3
|
||||
appVersion: "1.14.2"
|
||||
version: 0.28.4
|
||||
appVersion: "1.14.5"
|
||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
@@ -23,7 +23,7 @@ maintainers:
|
||||
kubeVersion: ">=1.21.0-0"
|
||||
dependencies:
|
||||
- name: spire-lib
|
||||
repository: file://./charts/spire-lib
|
||||
repository: file://../spire-lib
|
||||
version: 0.1.0
|
||||
- name: spire-server
|
||||
condition: spire-server.enabled
|
||||
@@ -68,5 +68,6 @@ dependencies:
|
||||
repository: file://./charts/spike-pilot
|
||||
version: 0.1.0
|
||||
annotations:
|
||||
org.opencontainers.image.source: https://github.com/spiffe/helm-charts-hardened
|
||||
artifacthub.io/category: security
|
||||
artifacthub.io/license: Apache-2.0
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# spire
|
||||
|
||||
  
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
|
||||
@@ -54,6 +54,7 @@ A Helm chart to install the SPIFFE CSI driver.
|
||||
| `podLabels` | Labels to add to pods | `{}` |
|
||||
| `podSecurityContext` | Security context for CSI driver pods | `{}` |
|
||||
| `securityContext` | Security context for CSI driver containers | `{}` |
|
||||
| `hostNetwork` | Enable hostNetwork for the DaemonSet | `false` |
|
||||
| `nodeSelector` | Node selector for CSI driver pods | `{}` |
|
||||
| `tolerations` | Tolerations for CSI driver pods | `[]` |
|
||||
| `affinity` | Node affinity | `{}` |
|
||||
@@ -73,5 +74,5 @@ A Helm chart to install the SPIFFE CSI driver.
|
||||
| `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` |
|
||||
| `selinux.image.repository` | The repository within the registry | `ubi9` |
|
||||
| `selinux.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1771346757` |
|
||||
| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1774415752` |
|
||||
|
||||
|
||||
@@ -52,6 +52,9 @@ spec:
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.hostNetwork }}
|
||||
hostNetwork: true
|
||||
{{- end }}
|
||||
{{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }}
|
||||
{{- if or (gt (len .Values.initContainers) 0) (dig "openshift" false .Values.global) (dig "selinux" false .Values.global) .Values.selinux.enabled }}
|
||||
securityContext:
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
{{- $v2Description := "This is the most restrictive SCC and it is used by default for authenticated users. On top of the legacy 'restricted' SCC, it also requires to drop ALL capabilities and does not allow privilege escalation binaries. It will also default the seccomp profile to runtime/default if unset, otherwise this seccomp profile is required." -}}
|
||||
apiVersion: security.openshift.io/v1
|
||||
kind: SecurityContextConstraints
|
||||
allowHostPorts: false
|
||||
allowHostPorts: {{ .Values.hostNetwork }}
|
||||
priority: null
|
||||
requiredDropCapabilities:
|
||||
{{- if eq (.Values.restrictedScc.version | toString) "2" }}
|
||||
@@ -50,7 +50,7 @@ volumes:
|
||||
- projected
|
||||
- secret
|
||||
allowHostPID: false
|
||||
allowHostNetwork: false
|
||||
allowHostNetwork: {{ .Values.hostNetwork }}
|
||||
allowPrivilegeEscalation: {{ eq (.Values.restrictedScc.version | toString) "2" | ternary false true }}
|
||||
{{- if eq (.Values.restrictedScc.version | toString) "2" }}
|
||||
allowedCapabilities:
|
||||
|
||||
@@ -19,9 +19,9 @@ volumes:
|
||||
allowedCapabilities: null
|
||||
allowHostDirVolumePlugin: true
|
||||
allowHostIPC: false
|
||||
allowHostNetwork: false
|
||||
allowHostNetwork: {{ .Values.hostNetwork }}
|
||||
allowHostPID: false
|
||||
allowHostPorts: false
|
||||
allowHostPorts: {{ .Values.hostNetwork }}
|
||||
allowPrivilegeEscalation: true
|
||||
allowPrivilegedContainer: true
|
||||
defaultAddCapabilities: null
|
||||
|
||||
@@ -112,6 +112,9 @@ securityContext:
|
||||
# drop:
|
||||
# - ALL
|
||||
|
||||
## @param hostNetwork Enable hostNetwork for the DaemonSet
|
||||
hostNetwork: false
|
||||
|
||||
## @param nodeSelector [object] Node selector for CSI driver pods
|
||||
nodeSelector: {}
|
||||
|
||||
@@ -166,4 +169,4 @@ selinux:
|
||||
registry: registry.access.redhat.com
|
||||
repository: ubi9
|
||||
pullPolicy: IfNotPresent
|
||||
tag: 9.7-1771346757
|
||||
tag: 9.7-1774415752
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider
|
||||
description: A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.14.2"
|
||||
appVersion: "1.14.5"
|
||||
keywords: ["spiffe", "oidc"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -86,6 +86,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `config.jwksUri` | The JWKS URI | `""` |
|
||||
| `config.serverPathPrefix` | If specified, all endpoints listened to will be prefixed by this value | `""` |
|
||||
| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` |
|
||||
| `config.setKeyUse` | Add "use":"sig" field to JWKs (required for Keycloak SPIFFE provider) | `false` |
|
||||
| `imagePullSecrets` | Image pull secret names | `[]` |
|
||||
| `nameOverride` | Name override | `""` |
|
||||
| `fullnameOverride` | Full name override | `""` |
|
||||
@@ -127,15 +128,15 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e` |
|
||||
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
|
||||
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275` |
|
||||
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:6ba4fb1b19bb35fa0b7e6bf08b308379a5b865727e50b7b3068efb824b39ebba` |
|
||||
| `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` |
|
||||
| `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.step.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.29.0` |
|
||||
| `tests.step.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.30.2` |
|
||||
| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` |
|
||||
| `tests.busybox.image.repository` | The repository within the registry | `busybox` |
|
||||
| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
|
||||
@@ -52,6 +52,10 @@ jwks_uri: {{ .Values.config.jwksUri | quote }}
|
||||
server_path_prefix: {{ .Values.config.serverPathPrefix | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.config.setKeyUse }}
|
||||
set_key_use: true
|
||||
{{- end }}
|
||||
|
||||
{{- if eq .Values.bundleSource "ConfigMap" }}
|
||||
file:
|
||||
path: /bundle/bundle.spiffe
|
||||
|
||||
@@ -220,6 +220,8 @@ config:
|
||||
## @param config.additionalDomains [array] Add additional domains that can be used for oidc discovery
|
||||
additionalDomains: []
|
||||
# - localhost
|
||||
## @param config.setKeyUse Add "use":"sig" field to JWKs (required for Keycloak SPIFFE provider)
|
||||
setKeyUse: false
|
||||
|
||||
## @param imagePullSecrets [array] Image pull secret names
|
||||
imagePullSecrets: []
|
||||
@@ -361,7 +363,7 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a
|
||||
tag: latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e
|
||||
|
||||
toolkit:
|
||||
## @param tests.toolkit.image.registry The OCI registry to pull the image from
|
||||
@@ -373,7 +375,7 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/min-toolkit-debug
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275
|
||||
tag: latest@sha256:6ba4fb1b19bb35fa0b7e6bf08b308379a5b865727e50b7b3068efb824b39ebba
|
||||
|
||||
step:
|
||||
## @param tests.step.image.registry The OCI registry to pull the image from
|
||||
@@ -385,7 +387,7 @@ tests:
|
||||
registry: "docker.io"
|
||||
repository: smallstep/step-cli
|
||||
pullPolicy: IfNotPresent
|
||||
tag: 0.29.0
|
||||
tag: 0.30.2
|
||||
|
||||
busybox:
|
||||
## @param tests.busybox.image.registry The OCI registry to pull the image from
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire-agent
|
||||
description: A Helm chart to install the SPIRE agent.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.14.2"
|
||||
appVersion: "1.14.5"
|
||||
keywords: ["spiffe", "spire-agent"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -73,7 +73,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e` |
|
||||
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
|
||||
| `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` |
|
||||
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` |
|
||||
@@ -125,11 +125,11 @@ A Helm chart to install the SPIRE agent.
|
||||
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` |
|
||||
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e` |
|
||||
| `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
|
||||
| `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275` |
|
||||
| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:6ba4fb1b19bb35fa0b7e6bf08b308379a5b865727e50b7b3068efb824b39ebba` |
|
||||
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` |
|
||||
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
|
||||
|
||||
@@ -114,9 +114,11 @@ spec:
|
||||
{{- else }}
|
||||
if [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet-server-current.pem" ]; then
|
||||
openssl x509 -in {{ printf "%s/kubelet-server-current.pem" .Values.workloadAttestors.k8s.verification.hostCert.basePath | quote }} -out /hostCert/kubelet.crt
|
||||
elif [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" ]; then
|
||||
fi
|
||||
if [ ! -f /hostCert/kubelet.crt ] && [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" ]; then
|
||||
openssl x509 -in {{ printf "%s/kubelet.crt" .Values.workloadAttestors.k8s.verification.hostCert.basePath | quote }} -out /hostCert/kubelet.crt
|
||||
else
|
||||
fi
|
||||
if [ ! -f /hostCert/kubelet.crt ]; then
|
||||
{{- if eq .Values.workloadAttestors.k8s.verification.type "auto" }}
|
||||
{{- if $cbh }}
|
||||
URL="https://$KUBELET_ADDR:10250/spec/"
|
||||
@@ -129,7 +131,7 @@ spec:
|
||||
{{- else }}
|
||||
URL="https://localhost:10250/spec/"
|
||||
{{- end }}
|
||||
curl --capath /var/run/secrets/kubernetes.io/serviceaccount/ca.crt "$URL"
|
||||
curl --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt "$URL"
|
||||
if [ $? -eq 0 ]; then
|
||||
echo Mode detected as apiServerCA.
|
||||
ln -s /var/run/secrets/kubernetes.io/serviceaccount/ca.crt /hostCert/kubelet.crt
|
||||
|
||||
@@ -159,7 +159,7 @@ fsGroupFix:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a
|
||||
tag: latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e
|
||||
|
||||
keyManager:
|
||||
memory:
|
||||
@@ -317,7 +317,7 @@ socketAlternate:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a
|
||||
tag: latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e
|
||||
|
||||
hostCert:
|
||||
## @param hostCert.image.registry The OCI registry to pull the image from
|
||||
@@ -329,7 +329,7 @@ hostCert:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/min-toolkit-debug
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275
|
||||
tag: latest@sha256:6ba4fb1b19bb35fa0b7e6bf08b308379a5b865727e50b7b3068efb824b39ebba
|
||||
|
||||
## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.
|
||||
priorityClassName: ""
|
||||
|
||||
@@ -1,24 +0,0 @@
|
||||
apiVersion: v2
|
||||
name: spire-lib
|
||||
description: A Helm chart for Kubernetes
|
||||
|
||||
# A chart can be either an 'application' or a 'library' chart.
|
||||
#
|
||||
# Application charts are a collection of templates that can be packaged into versioned archives
|
||||
# to be deployed.
|
||||
#
|
||||
# Library charts provide useful utilities or functions for the chart developer. They're included as
|
||||
# a dependency of application charts to inject those utilities and functions into the rendering
|
||||
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
|
||||
type: library
|
||||
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 0.1.0
|
||||
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application. Versions are not expected to
|
||||
# follow Semantic Versioning. They should reflect the version the application is using.
|
||||
# It is recommended to use it with quotes.
|
||||
appVersion: ""
|
||||
@@ -3,7 +3,7 @@ name: spire-server
|
||||
description: A Helm chart to install the SPIRE server.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.14.2"
|
||||
appVersion: "1.14.5"
|
||||
keywords: ["spiffe", "spire-server", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -229,6 +229,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `upstreamAuthority.awsPCA.signingAlgorithm` | (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | `""` |
|
||||
| `upstreamAuthority.awsPCA.endpoint` | (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | `""` |
|
||||
| `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` |
|
||||
| `upstreamAuthority.awsSecret.enabled` | Flag to enable upstream authority plugin with AWS Secrets Manager | `false` |
|
||||
| `upstreamAuthority.awsSecret.region` | AWS Region to use | `""` |
|
||||
| `upstreamAuthority.awsSecret.certFileArn` | ARN or name of the secret containing the intermediate CA certificate | `""` |
|
||||
| `upstreamAuthority.awsSecret.keyFileArn` | ARN or name of the secret containing the intermediate CA private key | `""` |
|
||||
| `upstreamAuthority.awsSecret.bundleFileArn` | (Optional) ARN or name of the secret containing the root CA bundle | `""` |
|
||||
| `upstreamAuthority.awsSecret.assumeRoleArn` | (Optional) ARN of an IAM role to assume | `""` |
|
||||
| `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` |
|
||||
| `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` |
|
||||
| `upstreamAuthority.certManager.issuerName` | Defaults to the release name, override if CA is provided outside of the chart | `""` |
|
||||
@@ -277,9 +283,18 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.addEntryIDPrefix` | If true, prepends the clusterName to the entryID of each entry the controller manager registers. | `true` |
|
||||
| `controllerManager.gcInterval` | How often the SPIRE state is reconciled when the controller is otherwise idle. This impacts how quickly SPIRE state will converge after CRDs are removed or SPIRE state is mutated underneath the controller. Values are in nanoseconds. | `10000000000` |
|
||||
| `controllerManager.logLevel` | The log level for the controller manager. Supported values are info, error, warn and debug. | `info` |
|
||||
| `controllerManager.logEncoding` | The log encoding for the controller manager. Supported values are console and json. | `console` |
|
||||
| `controllerManager.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` |
|
||||
| `controllerManager.leaderElection.renewDeadline` | Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. | `10s` |
|
||||
| `controllerManager.leaderElection.retryPeriod` | Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. | `2s` |
|
||||
| `controllerManager.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
|
||||
| `controllerManager.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` |
|
||||
| `controllerManager.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` |
|
||||
| `controllerManager.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` |
|
||||
| `controllerManager.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
||||
| `controllerManager.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` |
|
||||
| `controllerManager.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` |
|
||||
| `controllerManager.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
|
||||
| `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
|
||||
| `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` |
|
||||
| `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` |
|
||||
@@ -288,7 +303,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
||||
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.3` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.4` |
|
||||
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
||||
| `controllerManager.securityContext` | Security context | `{}` |
|
||||
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
||||
@@ -510,5 +525,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e` |
|
||||
| `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` |
|
||||
|
||||
@@ -146,10 +146,12 @@ Auto-generation preserves trailing numbers from cluster names or uses hash for u
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: {{ $hpName }}
|
||||
{{- toYaml .Values.controllerManager.livenessProbe | nindent 4 }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: {{ $hpName }}
|
||||
{{- toYaml .Values.controllerManager.readinessProbe | nindent 4 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.controllerManager.resources | nindent 4 }}
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
{{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}}
|
||||
{{- include "spire-lib.check-strict-mode" (list . "caSubject.country must be set" (eq (include "spire-server.ca-subject-country" .) "ARPA"))}}
|
||||
{{- include "spire-lib.check-strict-mode" (list . "caSubject.organization must be set" (eq (include "spire-server.ca-subject-organization" .) "Example"))}}
|
||||
{{- include "spire-lib.check-strict-mode" (list . "caSubject.commonNname must be set" (eq (include "spire-server.ca-subject-common-name" .) "example.org"))}}
|
||||
{{- include "spire-lib.check-strict-mode" (list . "caSubject.commonName must be set" (eq (include "spire-server.ca-subject-common-name" .) "example.org"))}}
|
||||
{{- range $type, $tvals := .Values.customPlugins }}
|
||||
{{- if not (has $type (list "bundlePublisher" "credentialComposer" "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }}
|
||||
{{- fail (printf "Unknown plugin type specified: %s" $type) }}
|
||||
@@ -507,6 +507,23 @@ plugins:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.upstreamAuthority.awsSecret }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
||||
UpstreamAuthority:
|
||||
awssecret:
|
||||
plugin_data:
|
||||
region: {{ .region | quote }}
|
||||
cert_file_arn: {{ .certFileArn | quote }}
|
||||
key_file_arn: {{ .keyFileArn | quote }}
|
||||
{{- if ne .bundleFileArn "" }}
|
||||
bundle_file_arn: {{ .bundleFileArn | quote }}
|
||||
{{- end }}
|
||||
{{- if ne .assumeRoleArn "" }}
|
||||
assume_role_arn: {{ .assumeRoleArn | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if gt $upstreamAuthorityUsed 1 }}
|
||||
{{- fail "You can only enable a single Upstream Authority." }}
|
||||
{{- end }}
|
||||
|
||||
@@ -49,6 +49,9 @@ health:
|
||||
healthProbeBindAddress: 0.0.0.0:{{ $healthPort }}
|
||||
gcInterval: {{ .Values.controllerManager.gcInterval }}
|
||||
logLevel: {{ .Values.controllerManager.logLevel }}
|
||||
{{- with .Values.controllerManager.logEncoding }}
|
||||
logEncoding: {{ . }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
leaderElection:
|
||||
leaderElect: true
|
||||
|
||||
@@ -27,11 +27,11 @@
|
||||
{{- if hasKey .Values.nodeAttestor "k8sPsat" }}
|
||||
{{- fail "k8sPsat was renamed to k8sPSAT. Please update your config." }}
|
||||
{{- end }}
|
||||
{{- if hasKey .Values.nodeAttestor "externalK8sPSA" }}
|
||||
{{- if hasKey .Values.nodeAttestor "externalK8sPsat" }}
|
||||
{{- fail "externalK8sPsat was renamed to externalK8sPSAT. Please update your config." }}
|
||||
{{- end }}
|
||||
{{- if hasKey .Values.notifier "k8sbundle" }}
|
||||
{{- fail "k8sbundle was renmaed to k8sBundle. Please update your config." }}
|
||||
{{- fail "k8sbundle was renamed to k8sBundle. Please update your config." }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.kind "statefulset" }}
|
||||
{{- if not (has .Values.persistence.type (list "pvc" "hostPath" "emptyDir")) }}
|
||||
|
||||
@@ -25,10 +25,12 @@ spec:
|
||||
curl -k -f -s 'https://{{ include "spire-server.fullname" . }}:{{ .Values.service.port }}'
|
||||
IGNORECA=$?
|
||||
echo $NOCA $IGNORECA
|
||||
if [ $NOCA -eq 60 -a $IGNORECA -eq 22 ]; then
|
||||
if [ $NOCA -eq 60 ]; then
|
||||
if [ $IGNORECA -eq 22 -o $IGNORECA -eq 55 -o $IGNORECA -eq 56 ]; then
|
||||
# We were able to connect to the server but didn't recognize the ca (60) and the page not found (22) because we're not using grpc
|
||||
exit 0
|
||||
fi
|
||||
fi
|
||||
exit 1
|
||||
securityContext:
|
||||
{{- include "spire-lib.securitycontext" . | nindent 8 }}
|
||||
|
||||
@@ -448,6 +448,19 @@ upstreamAuthority:
|
||||
endpoint: ""
|
||||
## @param upstreamAuthority.awsPCA.supplementalBundlePath (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle.
|
||||
supplementalBundlePath: ""
|
||||
awsSecret:
|
||||
## @param upstreamAuthority.awsSecret.enabled Flag to enable upstream authority plugin with AWS Secrets Manager
|
||||
enabled: false
|
||||
## @param upstreamAuthority.awsSecret.region AWS Region to use
|
||||
region: ""
|
||||
## @param upstreamAuthority.awsSecret.certFileArn ARN or name of the secret containing the intermediate CA certificate
|
||||
certFileArn: ""
|
||||
## @param upstreamAuthority.awsSecret.keyFileArn ARN or name of the secret containing the intermediate CA private key
|
||||
keyFileArn: ""
|
||||
## @param upstreamAuthority.awsSecret.bundleFileArn (Optional) ARN or name of the secret containing the root CA bundle
|
||||
bundleFileArn: ""
|
||||
## @param upstreamAuthority.awsSecret.assumeRoleArn (Optional) ARN of an IAM role to assume
|
||||
assumeRoleArn: ""
|
||||
certManager:
|
||||
## @param upstreamAuthority.certManager.enabled Flag to enable upstream authority plugin with cert manager
|
||||
enabled: false
|
||||
@@ -572,6 +585,9 @@ controllerManager:
|
||||
## @param controllerManager.logLevel The log level for the controller manager. Supported values are info, error, warn and debug.
|
||||
logLevel: info
|
||||
|
||||
## @param controllerManager.logEncoding The log encoding for the controller manager. Supported values are console and json.
|
||||
logEncoding: "console"
|
||||
|
||||
## @param controllerManager.leaderElection.leaseDuration Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure.
|
||||
## @param controllerManager.leaderElection.renewDeadline Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration.
|
||||
## @param controllerManager.leaderElection.retryPeriod Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline.
|
||||
@@ -580,6 +596,26 @@ controllerManager:
|
||||
renewDeadline: "10s"
|
||||
retryPeriod: "2s"
|
||||
|
||||
## @param controllerManager.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
|
||||
## @param controllerManager.livenessProbe.periodSeconds Period seconds for livenessProbe
|
||||
## @param controllerManager.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe
|
||||
## @param controllerManager.livenessProbe.failureThreshold Failure threshold for livenessProbe
|
||||
livenessProbe:
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
|
||||
## @param controllerManager.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
|
||||
## @param controllerManager.readinessProbe.periodSeconds Period seconds for readinessProbe
|
||||
## @param controllerManager.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
|
||||
## @param controllerManager.readinessProbe.failureThreshold Failure threshold for readinessProbe
|
||||
readinessProbe:
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
|
||||
## @param controllerManager.parentIDTemplate The template that is used to register workloads.
|
||||
parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"
|
||||
|
||||
@@ -605,7 +641,7 @@ controllerManager:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-controller-manager
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "0.6.3"
|
||||
tag: "0.6.4"
|
||||
|
||||
## @param controllerManager.resources [object] Resource requests and limits for controller manager
|
||||
resources: {}
|
||||
@@ -1301,7 +1337,7 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a
|
||||
tag: latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e
|
||||
|
||||
## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters
|
||||
kubeConfigs: {}
|
||||
|
||||
@@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details.
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e` |
|
||||
|
||||
@@ -162,4 +162,4 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a
|
||||
tag: latest@sha256:ef209fd7d231ead12bf24287db24991bdd979669f4df2e037698f94545816d3e
|
||||
|
||||
@@ -12,6 +12,8 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
|
||||
# shellcheck source=/dev/null
|
||||
source "${TESTDIR}/common.sh"
|
||||
|
||||
"${SCRIPTPATH}/../../.github/scripts/prepare-local-chart-deps.sh"
|
||||
|
||||
CLEANUP=1
|
||||
|
||||
for i in "$@"; do
|
||||
|
||||
@@ -12,6 +12,8 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
|
||||
# shellcheck source=/dev/null
|
||||
source "${TESTDIR}/common.sh"
|
||||
|
||||
"${SCRIPTPATH}/../../.github/scripts/prepare-local-chart-deps.sh"
|
||||
|
||||
CLEANUP=1
|
||||
|
||||
for i in "$@"; do
|
||||
|
||||
@@ -11,6 +11,8 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
|
||||
# shellcheck source=/dev/null
|
||||
source "${TESTDIR}/common.sh"
|
||||
|
||||
"${SCRIPTPATH}/../../.github/scripts/prepare-local-chart-deps.sh"
|
||||
|
||||
CLEANUP=1
|
||||
|
||||
for i in "$@"; do
|
||||
|
||||
@@ -45,8 +45,7 @@ teardown() {
|
||||
|
||||
trap 'EC=$? && trap - SIGTERM && teardown $EC' SIGINT SIGTERM EXIT
|
||||
|
||||
# Update deps
|
||||
helm dep up charts/spire-nested
|
||||
"${SCRIPTPATH}/../../.github/scripts/prepare-local-chart-deps.sh"
|
||||
|
||||
# List nodes
|
||||
kubectl get nodes
|
||||
@@ -136,4 +135,3 @@ helm test --namespace spire-mgmt spire
|
||||
|
||||
helm test --kubeconfig "${SCRIPTPATH}/kubeconfig-child" --namespace spire-mgmt spire
|
||||
helm test --kubeconfig "${SCRIPTPATH}/kubeconfig-other" --namespace spire-mgmt spire
|
||||
|
||||
|
||||
@@ -45,8 +45,7 @@ teardown() {
|
||||
|
||||
trap 'EC=$? && trap - SIGTERM && teardown $EC' SIGINT SIGTERM EXIT
|
||||
|
||||
# Update deps
|
||||
helm dep up charts/spire-nested
|
||||
"${SCRIPTPATH}/../../.github/scripts/prepare-local-chart-deps.sh"
|
||||
|
||||
# List nodes
|
||||
kubectl get nodes
|
||||
@@ -124,4 +123,3 @@ fi
|
||||
helm test --namespace spire-mgmt spire
|
||||
|
||||
helm test --kubeconfig "${SCRIPTPATH}/kubeconfig-child" --namespace spire-mgmt spire
|
||||
|
||||
|
||||
@@ -12,6 +12,8 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
|
||||
# shellcheck source=/dev/null
|
||||
source "${TESTDIR}/common.sh"
|
||||
|
||||
"${SCRIPTPATH}/../../.github/scripts/prepare-local-chart-deps.sh"
|
||||
|
||||
CLEANUP=1
|
||||
|
||||
for i in "$@"; do
|
||||
|
||||
@@ -9,6 +9,8 @@ TESTDIR="${SCRIPTPATH}/../../.github/tests"
|
||||
# shellcheck source=/dev/null
|
||||
source "${TESTDIR}/common.sh"
|
||||
|
||||
"${SCRIPTPATH}/../../.github/scripts/prepare-local-chart-deps.sh"
|
||||
|
||||
helm_install=(helm upgrade --install --create-namespace)
|
||||
ns=spire-system
|
||||
|
||||
|
||||
+5
-5
@@ -5,7 +5,7 @@ go 1.25.0
|
||||
require (
|
||||
github.com/onsi/ginkgo/v2 v2.28.1
|
||||
github.com/onsi/gomega v1.39.1
|
||||
helm.sh/helm/v3 v3.20.0
|
||||
helm.sh/helm/v3 v3.20.2
|
||||
)
|
||||
|
||||
require (
|
||||
@@ -57,10 +57,10 @@ require (
|
||||
google.golang.org/protobuf v1.36.8 // indirect
|
||||
gopkg.in/inf.v0 v0.9.1 // indirect
|
||||
gopkg.in/yaml.v3 v3.0.1 // indirect
|
||||
k8s.io/api v0.35.0 // indirect
|
||||
k8s.io/apiextensions-apiserver v0.35.0 // indirect
|
||||
k8s.io/apimachinery v0.35.0 // indirect
|
||||
k8s.io/client-go v0.35.0 // indirect
|
||||
k8s.io/api v0.35.1 // indirect
|
||||
k8s.io/apiextensions-apiserver v0.35.1 // indirect
|
||||
k8s.io/apimachinery v0.35.1 // indirect
|
||||
k8s.io/client-go v0.35.1 // indirect
|
||||
k8s.io/klog/v2 v2.130.1 // indirect
|
||||
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
|
||||
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
|
||||
|
||||
+10
-10
@@ -165,16 +165,16 @@ gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
|
||||
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
helm.sh/helm/v3 v3.20.0 h1:2M+0qQwnbI1a2CxN7dbmfsWHg/MloeaFMnZCY56as50=
|
||||
helm.sh/helm/v3 v3.20.0/go.mod h1:rTavWa0lagZOxGfdhu4vgk1OjH2UYCnrDKE2PVC4N0o=
|
||||
k8s.io/api v0.35.0 h1:iBAU5LTyBI9vw3L5glmat1njFK34srdLmktWwLTprlY=
|
||||
k8s.io/api v0.35.0/go.mod h1:AQ0SNTzm4ZAczM03QH42c7l3bih1TbAXYo0DkF8ktnA=
|
||||
k8s.io/apiextensions-apiserver v0.35.0 h1:3xHk2rTOdWXXJM+RDQZJvdx0yEOgC0FgQ1PlJatA5T4=
|
||||
k8s.io/apiextensions-apiserver v0.35.0/go.mod h1:E1Ahk9SADaLQ4qtzYFkwUqusXTcaV2uw3l14aqpL2LU=
|
||||
k8s.io/apimachinery v0.35.0 h1:Z2L3IHvPVv/MJ7xRxHEtk6GoJElaAqDCCU0S6ncYok8=
|
||||
k8s.io/apimachinery v0.35.0/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
|
||||
k8s.io/client-go v0.35.0 h1:IAW0ifFbfQQwQmga0UdoH0yvdqrbwMdq9vIFEhRpxBE=
|
||||
k8s.io/client-go v0.35.0/go.mod h1:q2E5AAyqcbeLGPdoRB+Nxe3KYTfPce1Dnu1myQdqz9o=
|
||||
helm.sh/helm/v3 v3.20.2 h1:binM4rvPx5DcNsa1sIt7UZi55lRbu3pZUFmQkSoRh48=
|
||||
helm.sh/helm/v3 v3.20.2/go.mod h1:Fl1kBaWCpkUrM6IYXPjQ3bdZQfFrogKArqptvueZ6Ww=
|
||||
k8s.io/api v0.35.1 h1:0PO/1FhlK/EQNVK5+txc4FuhQibV25VLSdLMmGpDE/Q=
|
||||
k8s.io/api v0.35.1/go.mod h1:28uR9xlXWml9eT0uaGo6y71xK86JBELShLy4wR1XtxM=
|
||||
k8s.io/apiextensions-apiserver v0.35.1 h1:p5vvALkknlOcAqARwjS20kJffgzHqwyQRM8vHLwgU7w=
|
||||
k8s.io/apiextensions-apiserver v0.35.1/go.mod h1:2CN4fe1GZ3HMe4wBr25qXyJnJyZaquy4nNlNmb3R7AQ=
|
||||
k8s.io/apimachinery v0.35.1 h1:yxO6gV555P1YV0SANtnTjXYfiivaTPvCTKX6w6qdDsU=
|
||||
k8s.io/apimachinery v0.35.1/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
|
||||
k8s.io/client-go v0.35.1 h1:+eSfZHwuo/I19PaSxqumjqZ9l5XiTEKbIaJ+j1wLcLM=
|
||||
k8s.io/client-go v0.35.1/go.mod h1:1p1KxDt3a0ruRfc/pG4qT/3oHmUj1AhSHEcxNSGg+OA=
|
||||
k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
|
||||
k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
|
||||
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=
|
||||
|
||||
@@ -15,6 +15,8 @@ source "${SCRIPTPATH}/../../../.github/scripts/parse-versions.sh"
|
||||
# shellcheck source=/dev/null
|
||||
source "${TESTDIR}/common.sh"
|
||||
|
||||
"${SCRIPTPATH}/../../../.github/scripts/prepare-local-chart-deps.sh"
|
||||
|
||||
helm_install=(helm upgrade --install --create-namespace)
|
||||
ns=spire-server
|
||||
|
||||
|
||||
@@ -80,8 +80,7 @@ sudo -u spiffe-test chmod 600 /home/spiffe-test/.ssh/id_ed25519
|
||||
sudo -u spiffe-test cp /home/spiffe-test/.ssh/id_ed25519.pub /home/spiffe-test/.ssh/authorized_keys
|
||||
sudo -u spiffe-test ssh -T -n -i /home/spiffe-test/.ssh/id_ed25519 [email protected] hostname || echo Expected fail here
|
||||
|
||||
# Update deps
|
||||
helm dep up charts/spire-nested
|
||||
"${SCRIPTPATH}/../../../.github/scripts/prepare-local-chart-deps.sh"
|
||||
|
||||
# List nodes
|
||||
kubectl get nodes
|
||||
|
||||
Reference in New Issue
Block a user