Spire controller manager upgrade (#8)
Co-authored-by: Faisal Memon <[email protected]> Co-authored-by: Marco Franssen <[email protected]>
This commit is contained in:
kfox1111
co-authored by
Faisal Memon
Marco Franssen
Faisal Memon
Marco Franssen
parent
663551297a
commit
56445c4f94
@@ -170,7 +170,8 @@ jobs:
|
||||
|
||||
- name: Run chart-testing (install)
|
||||
run: |
|
||||
ct install --config ct.yaml \
|
||||
helm install -n spire-server spire-crds charts/spire-crds
|
||||
ct install --config ct.yaml --excluded-charts spire-crds \
|
||||
--target-branch ${{ github.base_ref }}
|
||||
|
||||
- name: Test summary
|
||||
@@ -238,7 +239,10 @@ jobs:
|
||||
verbosity: 1
|
||||
|
||||
- name: Install and test example
|
||||
run: ${{ matrix.example }}/run-tests.sh
|
||||
run: |
|
||||
kubectl create namespace spire-server
|
||||
helm install -n spire-server spire-crds charts/spire-crds
|
||||
${{ matrix.example }}/run-tests.sh
|
||||
|
||||
upgrade-test:
|
||||
runs-on: ubuntu-22.04
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: v2
|
||||
name: spire-crds
|
||||
description: >
|
||||
A Helm chart for deploying the Spire CRDS
|
||||
type: application
|
||||
version: 0.0.1
|
||||
appVersion: "0.0.1"
|
||||
keywords: ["spire-crds"]
|
||||
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
||||
sources:
|
||||
- https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
||||
icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
|
||||
maintainers:
|
||||
- name: marcofranssen
|
||||
email: [email protected]
|
||||
url: https://marcofranssen.nl
|
||||
- name: kfox1111
|
||||
email: [email protected]
|
||||
- name: faisal-memon
|
||||
email: [email protected]
|
||||
- name: edwbuck
|
||||
email: [email protected]
|
||||
@@ -0,0 +1,23 @@
|
||||
# spire-crds
|
||||
|
||||
  
|
||||
|
||||
A Helm chart to install the SPIRE CRDS.
|
||||
|
||||
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
## Maintainers
|
||||
| Name | Email | Url |
|
||||
| ---- | ------ | --- |
|
||||
| marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
|
||||
| kfox1111 | <Kevin.Fox@pnnl.gov> | |
|
||||
| faisal-memon | <fymemon@yahoo.com> | |
|
||||
| edwbuck | <edwbuck@gmail.com> | |
|
||||
|
||||
## Source Code
|
||||
|
||||
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
<!-- The Parameters section is generated using helm-docs.sh -->
|
||||
|
||||
## Parameters
|
||||
+2
-7
@@ -3,7 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.8.0
|
||||
controller-gen.kubebuilder.io/version: v0.11.1
|
||||
{{- .Values.annotations | toYaml | nindent 4 }}
|
||||
creationTimestamp: null
|
||||
name: clusterfederatedtrustdomains.spire.spiffe.io
|
||||
spec:
|
||||
@@ -88,9 +89,3 @@ spec:
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
+16
-11
@@ -3,7 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.8.0
|
||||
controller-gen.kubebuilder.io/version: v0.11.1
|
||||
{{- .Values.annotations | toYaml | nindent 4 }}
|
||||
creationTimestamp: null
|
||||
name: clusterspiffeids.spire.spiffe.io
|
||||
spec:
|
||||
@@ -48,14 +49,22 @@ spec:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
downstream:
|
||||
description: Downstream indicates that the entry describes a downstream
|
||||
SPIRE server.
|
||||
type: boolean
|
||||
federatesWith:
|
||||
description: FederatesWith is a list of trust domain names that workloads
|
||||
that obtain this SPIFFE ID will federate with.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
jwtTtl:
|
||||
description: JWTTTL indicates an upper-bound time-to-live for JWT
|
||||
SVIDs minted for this ClusterSPIFFEID.
|
||||
type: string
|
||||
namespaceSelector:
|
||||
description: NamespaceSelector selects the namespaces that are targetted
|
||||
description: NamespaceSelector selects the namespaces that are targeted
|
||||
by this CRD.
|
||||
properties:
|
||||
matchExpressions:
|
||||
@@ -99,8 +108,9 @@ spec:
|
||||
are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
podSelector:
|
||||
description: PodSelector selects the pods that are targetted by this
|
||||
description: PodSelector selects the pods that are targeted by this
|
||||
CRD.
|
||||
properties:
|
||||
matchExpressions:
|
||||
@@ -144,14 +154,15 @@ spec:
|
||||
are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
spiffeIDTemplate:
|
||||
description: SPIFFEID is the SPIFFE ID template. The node and pod
|
||||
spec are made available to the template under .NodeSpec, .PodSpec
|
||||
respectively.
|
||||
type: string
|
||||
ttl:
|
||||
description: TTL indicates an upper-bound time-to-live for SVIDs minted
|
||||
for this ClusterSPIFFEID. If unset, a default will be chosen.
|
||||
description: TTL indicates an upper-bound time-to-live for X509 SVIDs
|
||||
minted for this ClusterSPIFFEID. If unset, a default will be chosen.
|
||||
type: string
|
||||
workloadSelectorTemplates:
|
||||
description: WorkloadSelectorTemplates are templates to produce arbitrary
|
||||
@@ -213,9 +224,3 @@ spec:
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
@@ -0,0 +1,92 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.11.1
|
||||
{{- .Values.annotations | toYaml | nindent 4 }}
|
||||
creationTimestamp: null
|
||||
name: clusterstaticentries.spire.spiffe.io
|
||||
spec:
|
||||
group: spire.spiffe.io
|
||||
names:
|
||||
kind: ClusterStaticEntry
|
||||
listKind: ClusterStaticEntryList
|
||||
plural: clusterstaticentries
|
||||
singular: clusterstaticentry
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ClusterStaticEntry is the Schema for the clusterstaticentries
|
||||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ClusterStaticEntrySpec defines the desired state of ClusterStaticEntry
|
||||
properties:
|
||||
admin:
|
||||
type: boolean
|
||||
dnsNames:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
downstream:
|
||||
type: boolean
|
||||
federatesWith:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
hint:
|
||||
type: string
|
||||
jwtSVIDTTL:
|
||||
type: string
|
||||
parentID:
|
||||
type: string
|
||||
selectors:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
spiffeID:
|
||||
type: string
|
||||
x509SVIDTTL:
|
||||
type: string
|
||||
required:
|
||||
- parentID
|
||||
- selectors
|
||||
- spiffeID
|
||||
type: object
|
||||
status:
|
||||
description: ClusterStaticEntryStatus defines the observed state of ClusterStaticEntry
|
||||
properties:
|
||||
masked:
|
||||
description: If the static entry was masked by another entry.
|
||||
type: boolean
|
||||
rendered:
|
||||
description: If the static entry rendered properly.
|
||||
type: boolean
|
||||
set:
|
||||
description: If the static entry was successfully created/updated.
|
||||
type: boolean
|
||||
required:
|
||||
- masked
|
||||
- rendered
|
||||
- set
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
+1
@@ -4,6 +4,7 @@ kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.8.0
|
||||
{{- .Values.annotations | toYaml | nindent 4 }}
|
||||
creationTimestamp: null
|
||||
name: controllermanagerconfigs.spire.spiffe.io
|
||||
spec:
|
||||
@@ -0,0 +1,3 @@
|
||||
annotations:
|
||||
## @param annotations.helm.sh/resource-policy keep the crds after chart deletion
|
||||
helm.sh/resource-policy: keep
|
||||
@@ -83,6 +83,39 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| file://./charts/spire-server | spire-server | 0.1.0 |
|
||||
| file://./charts/tornjak-frontend | tornjak-frontend | 0.1.0 |
|
||||
|
||||
## Install notes
|
||||
|
||||
To do a quick non production install:
|
||||
|
||||
```shell
|
||||
kubectl create namespace spire-system
|
||||
helm install -n spire-system spire-crds charts/spire-crds
|
||||
helm install -n spire-system spire charts/spire
|
||||
|
||||
For production installs, please see [the production example](examples/production/).
|
||||
|
||||
## Upgrade notes
|
||||
|
||||
0.14.X:
|
||||
|
||||
If coming from a chart version before 0.14.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart
|
||||
run the following:
|
||||
|
||||
```shell
|
||||
# Replace the spire-server namespace in the commands below with the namespace you want to install the spire-crds chart in.
|
||||
|
||||
kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
helm install -n spire-server spire-crds charts/spire-crds
|
||||
```
|
||||
|
||||
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||
|
||||
## Parameters
|
||||
|
||||
@@ -218,7 +218,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
||||
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.2.3` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.3.0` |
|
||||
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
||||
| `controllerManager.securityContext` | Security context | `{}` |
|
||||
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
||||
|
||||
@@ -64,6 +64,15 @@ rules:
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterspiffeids/status"]
|
||||
verbs: ["get", "patch", "update"]
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterstaticentries"]
|
||||
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterstaticentries/finalizers"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterstaticentries/status"]
|
||||
verbs: ["get", "patch", "update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
|
||||
@@ -386,7 +386,7 @@ controllerManager:
|
||||
repository: spiffe/spire-controller-manager
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: "0.2.3"
|
||||
tag: "0.3.0"
|
||||
|
||||
## @param controllerManager.resources [object] Resource requests and limits for controller manager
|
||||
resources: {}
|
||||
|
||||
@@ -105,7 +105,19 @@ install_and_test() {
|
||||
|
||||
if [[ -n "$UPGRADE_ARGS" ]]; then
|
||||
install_and_test spire "$UPGRADE_ARGS"
|
||||
|
||||
# Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.)
|
||||
kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
|
||||
helm upgrade --install -n spire-server spire-crds charts/spire-crds
|
||||
fi
|
||||
|
||||
install_and_test charts/spire ""
|
||||
|
||||
Reference in New Issue
Block a user