panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Deny production runs of example.org trust domains (#229)

Browse Source
This commit is contained in:
kfox1111
2023-09-25 12:06:48 -07:00
committed by GitHub
parent 712a0f6fbe
commit 50825d9fc9
16 changed files with 101 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/templates/configmap.yaml
+6
View File
@@ -1,3 +1,9 @@
{{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}}
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.county must be set" (eq .Values.ca_subject.country "ARPA"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.organization must be set" (eq .Values.ca_subject.organization "Example"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.common_name must be set" (eq .Values.ca_subject.common_name "example.org"))}}
{{- range $type, $tvals := .Values.customPlugins }}
{{- if not (has $type (list "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }}
{{- fail (printf "Unknown plugin type specified: %s" $type) }}