Deny production runs of example.org trust domains (#229)

examples/external-mysql/run-tests.sh

@@ -32,7 +32,7 @@ helm upgrade --install mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO
   --wait
 
 helm upgrade --install --namespace "spire-server" \
-  --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml" \
+  --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \
   --set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire
 helm test --namespace "spire-server" spire
 

examples/external-postgresql/run-tests.sh

@@ -32,7 +32,7 @@ helm upgrade --install postgresql postgresql --version "$VERSION_POSTGRESQL" --r
   --wait
 
 helm upgrade --install --namespace "spire-server" \
-  --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml" \
+  --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \
   --set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire
 helm test --namespace "spire-server" spire
 

examples/nested/run-tests.sh

@@ -34,10 +34,10 @@ helm upgrade --install --create-namespace spire charts/spire \
   --wait
 
 kubectl get nodes -o go-template='{{range .items}}{{printf "%s\n" .metadata.uid}}{{end}}' | while read -r line; do
-  kubectl exec -t spire-server-0 -n "spire-root-server" -- spire-server entry create -spiffeID spiffe://example.org/example-cluster/nested-spire -parentID "spiffe://example.org/spire/agent/k8s_psat/example-cluster/$line" -selector k8s:pod-label:app.kubernetes.io/name:server -downstream
+  kubectl exec -t spire-server-0 -n "spire-root-server" -- spire-server entry create -spiffeID spiffe://production.other/production/nested-spire -parentID "spiffe://production.other/spire/agent/k8s_psat/production/$line" -selector k8s:pod-label:app.kubernetes.io/name:server -downstream
 done
 
-helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml" \
+helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \
   --wait spire charts/spire
 helm test --namespace spire-server spire
 

examples/production/example-your-values.yaml

@@ -0,0 +1,45 @@
+global:
+  spire:
+    clusterName: production
+    trustDomain: production.other
+    jwtIssuer: oidc-discovery.production.other
+
+spire-server:
+  ca_subject:
+    country: US
+    organization: Production
+    common_name: production.other
+
+  ingress:
+    hosts:
+      - host: spire-server.production.other
+        paths:
+          - path: /
+            pathType: Prefix
+    tls:
+      - hosts:
+          - spire-server.production.other
+  federation:
+    ingress:
+      hosts:
+        - host: spire-server-federation.production.other
+          paths:
+            - path: /
+              pathType: Prefix
+      tls:
+        - hosts:
+            - spire-server-federation.production.other
+          secretName: tls-cert
+
+spiffe-oidc-discovery-provider:
+  ingress:
+    hosts:
+      - host: oidc-discovery.production.other
+        paths:
+          - path: /
+            pathType: Prefix
+    tls:
+      - secretName: tls-cert
+        hosts:
+          - oidc-discovery.production.other
+

examples/production/run-tests.sh

@@ -48,7 +48,7 @@ kubectl apply -f "${DEPS}/testcert.yaml" -n spire-server
  --wait
 
 ip=$(kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ .spec.clusterIP }}')
-echo "$ip" oidc-discovery.example.org
+echo "$ip" oidc-discovery.production.other
 
 cat > /tmp/dummydns <<EOF
 spiffe-oidc-discovery-provider:
@@ -56,24 +56,18 @@ spiffe-oidc-discovery-provider:
     hostAliases:
       - ip: "$ip"
         hostnames:
-          - "oidc-discovery.example.org"
+          - "oidc-discovery.production.other"
 spire-agent:
   hostAliases:
     - ip: "$ip"
       hostnames:
-        - "spire-server.example.org"
+        - "spire-server.production.other"
 spire-server:
   tests:
     hostAliases:
       - ip: "$ip"
         hostnames:
-          - "spire-server-federation.example.org"
-  federation:
-    ingress:
-      tls:
-        - hosts:
-            - spire-server-federation.example.org
-          secretName: tls-cert
+          - "spire-server-federation.production.other"
 EOF
 
 "${helm_install[@]}" spire charts/spire \
@@ -84,11 +78,17 @@ EOF
   --values "${SCRIPTPATH}/values-export-federation-https-web-ingress-nginx.yaml" \
   --values /tmp/dummydns \
   --set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \
-  --set spire-agent.server.address=spire-server.example.org,spire-agent.server.port=443 \
+  --set spire-agent.server.address=spire-server.production.other,spire-agent.server.port=443 \
+  --values "${SCRIPTPATH}/example-your-values.yaml" \
   --wait
 
 helm test --namespace "${ns}" spire
 
+if helm get manifest -n spire-server spire | grep -i example; then
+  echo Global settings did not work. Please fix.
+  exit 1
+fi
+
 print_helm_releases
 print_spire_workload_status "${ns}"
 

examples/production/values.yaml

@@ -2,6 +2,8 @@ global:
   telemetry:
     prometheus:
       enabled: true
+  spire:
+    strictMode: true
 
 spire-server:
   nodeAttestor: