panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'main' into release

Browse Source
This commit is contained in:
Kevin Fox
2023-12-01 07:17:40 -08:00
parent b469b62f1a 78bb95ba35
commit 69511f5a6c
47 changed files with 792 additions and 455 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/tests/charts.json
+3 -3
View File
@@ -2,7 +2,7 @@
{ {
"name": "kube-prometheus-stack", "name": "kube-prometheus-stack",
"repo": "https://prometheus-community.github.io/helm-charts", "repo": "https://prometheus-community.github.io/helm-charts",
"version": "52.1.0" "version": "54.2.2"
}, },
{ {
"name": "cert-manager", "name": "cert-manager",
@@ -17,11 +17,11 @@
{ {
"name": "mysql", "name": "mysql",
"repo": "https://charts.bitnami.com/bitnami", "repo": "https://charts.bitnami.com/bitnami",
"version": "9.14.1" "version": "9.14.4"
}, },
{ {
"name": "postgresql", "name": "postgresql",
"repo": "https://charts.bitnami.com/bitnami", "repo": "https://charts.bitnami.com/bitnami",
"version": "13.2.1" "version": "13.2.18"
} }
] ]
.github/tests/dependencies/spire-root-server-values.yaml
+2
View File
@@ -6,6 +6,8 @@ global:
spire-server: spire-server:
controllerManager: controllerManager:
identities: identities:
clusterSPIFFEIDs:
default:
namespaceSelector: namespaceSelector:
kubernetes.io/metadata.name: spire-server kubernetes.io/metadata.name: spire-server
podSelector: podSelector:
Makefile
+5
View File
@@ -63,3 +63,8 @@ test-example-%:
.PHONY: test-examples .PHONY: test-examples
test-examples: $(patsubst examples/%/values.yaml,test-example-%,$(wildcard examples/*/values.yaml)) ## Run `helm install` and `helm test` for all the examples containing `run-tests.sh` test-examples: $(patsubst examples/%/values.yaml,test-example-%,$(wildcard examples/*/values.yaml)) ## Run `helm install` and `helm test` for all the examples containing `run-tests.sh`
.PHONY: diagrams
diagrams: ## Builds diagrams
@dot -Tpng examples/nested/singlehardened.dot > examples/nested/singlehardened.png
@dot -Tpng examples/nested/multicluster.dot > examples/nested/multicluster.png
README.md
+2 -2
View File
@@ -1,4 +1,4 @@
> [!Note] > **Note**
> Things to consider: > Things to consider:
> 1. We do not support running out of the git main branch. This is where development happens. Please use released versions via the published repo or git tags. > 1. We do not support running out of the git main branch. This is where development happens. Please use released versions via the published repo or git tags.
> 2. All the helm charts in this repo are beta. We encourage you to try them out and contribute. The API may change as we move towards a production ready release. > 2. All the helm charts in this repo are beta. We encourage you to try them out and contribute. The API may change as we move towards a production ready release.
@@ -14,7 +14,7 @@ A suite of [Helm Charts](https://helm.sh/docs) for standardized installations of
## How to install or upgrade ## How to install or upgrade
You most likely want to do an integrated setup based on the spire chart. You most likely want to do an integrated setup based on the spire chart.
See the [Instructions](https://artifacthub.io/packages/helm/spiffe/spire). See the [Instructions](https://artifacthub.io/packages/helm/spiffe/spire#install-notes).
## Contributing ## Contributing
charts/spire/Chart.yaml
+2 -2
View File
@@ -3,8 +3,8 @@ name: spire
description: > description: >
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
type: application type: application
version: 0.15.1 version: 0.16.0
appVersion: "1.8.4" appVersion: "1.8.5"
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
sources: sources:
charts/spire/README.md
+10 -4
View File
@@ -1,6 +1,6 @@
# spire # spire
![Version: 0.15.1](https://img.shields.io/badge/Version-0.13.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) ![Version: 0.16.0](https://img.shields.io/badge/Version-0.16.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.8.5](https://img.shields.io/badge/AppVersion-1.8.5-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
@@ -12,8 +12,8 @@ A Helm chart for deploying the complete Spire stack including: spire-server, spi
To do a quick non production install suitable for quick testing in something like minikube: To do a quick non production install suitable for quick testing in something like minikube:
```shell ```shell
helm install -n spire-server spire-crds --repo https://spiffe.github.io/helm-charts-hardened/ --create-namespace helm install -n spire-server spire-crds spire-crds --repo https://spiffe.github.io/helm-charts-hardened/ --create-namespace
helm install -n spire-server spire --repo https://spiffe.github.io/helm-charts-hardened/ helm install -n spire-server spire spire --repo https://spiffe.github.io/helm-charts-hardened/
``` ```
To customize, start with a base values file and edit as needed: To customize, start with a base values file and edit as needed:
@@ -28,10 +28,16 @@ Then:
helm install -n spire-server spire --repo https://spiffe.github.io/helm-charts-hardened/ -f your-values.yaml helm install -n spire-server spire --repo https://spiffe.github.io/helm-charts-hardened/ -f your-values.yaml
``` ```
For production installs, please see [the production example](https://github.com/spiffe/helm-charts-hardened/tree/main/examples/production). For production installs, please see [the production example](https://github.com/spiffe/helm-charts-hardened/tree/spire-0.16.0/examples/production).
## Upgrade notes ## Upgrade notes
We only support upgrading one major version at a time. Version skipping isn't supported.
### 0.16.X
The settings under "spire-server.controllerManager.identities" have all been moved under "spire-server.controllerManager.identities.clusterSPIFFEIDs.default". If you have changed any from the defaults, please update them to the new location during upgrade.
### 0.15.X ### 0.15.X
The spire-crds chart has been updated. Please ensure you have upgraded spire-crds before upgrading the spire chart. The spire-crds chart has been updated. Please ensure you have upgraded spire-crds before upgrading the spire chart.
charts/spire/charts/spiffe-csi-driver/Chart.yaml
+2 -2
View File
@@ -5,9 +5,9 @@ type: application
version: 0.1.0 version: 0.1.0
appVersion: "0.2.3" appVersion: "0.2.3"
keywords: ["spiffe", "csi-driver"] keywords: ["spiffe", "csi-driver"]
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
- https://github.com/spiffe/helm-charts/tree/main/charts/spire - https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
maintainers: maintainers:
- name: marcofranssen - name: marcofranssen
charts/spire/charts/spiffe-csi-driver/README.md
+3 -7
View File
@@ -4,11 +4,7 @@
A Helm chart to install the SPIFFE CSI driver. A Helm chart to install the SPIFFE CSI driver.
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire> **Homepage:** <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
> [!Note]
> The recommended version is `0.2.3` to support arm64 nodes. If running with any
> prior version to `0.2.3` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
## Maintainers ## Maintainers
@@ -21,7 +17,7 @@ A Helm chart to install the SPIFFE CSI driver.
## Source Code ## Source Code
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire> * <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. --> <!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
@@ -60,7 +56,7 @@ A Helm chart to install the SPIFFE CSI driver.
| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` | | `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` |
| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `nodeDriverRegistrar.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `nodeDriverRegistrar.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.0` | | `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.1` |
| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` | | `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` |
| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | | `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` | | `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` |
charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml
+6 -1
View File
@@ -1,8 +1,13 @@
{{- $labels := dict }}
{{- if (dig "openshift" false .Values.global) }}
{{- $_ := set $labels "security.openshift.io/csi-ephemeral-volume-profile" "restricted" }}
{{- end }}
{{- $labels = mergeOverwrite $labels .Values.csiDriverLabels }}
apiVersion: storage.k8s.io/v1 apiVersion: storage.k8s.io/v1
kind: CSIDriver kind: CSIDriver
metadata: metadata:
name: {{ .Values.pluginName | quote }} name: {{ .Values.pluginName | quote }}
{{- with .Values.csiDriverLabels }} {{- with $labels }}
labels: labels:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
charts/spire/charts/spiffe-csi-driver/values.yaml
+1 -1
View File
@@ -110,7 +110,7 @@ nodeDriverRegistrar:
repository: sig-storage/csi-node-driver-registrar repository: sig-storage/csi-node-driver-registrar
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
version: "" version: ""
tag: v2.9.0 tag: v2.9.1
## @param nodeDriverRegistrar.resources Resource requests and limits for CSI driver pods ## @param nodeDriverRegistrar.resources Resource requests and limits for CSI driver pods
resources: {} resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious # We usually recommend not to specify default resources and to leave this as a conscious
charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml
+3 -3
View File
@@ -3,11 +3,11 @@ name: spiffe-oidc-discovery-provider
description: A Helm chart to install the SPIFFE OIDC discovery provider. description: A Helm chart to install the SPIFFE OIDC discovery provider.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.8.4" appVersion: "1.8.5"
keywords: ["spiffe", "oidc"] keywords: ["spiffe", "oidc"]
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
- https://github.com/spiffe/helm-charts/tree/main/charts/spire - https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
maintainers: maintainers:
- name: marcofranssen - name: marcofranssen
charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+5 -10
View File
@@ -4,12 +4,7 @@
A Helm chart to install the SPIFFE OIDC discovery provider. A Helm chart to install the SPIFFE OIDC discovery provider.
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire> **Homepage:** <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
> [!Note]
> Minimum Spire version is `1.5.3`.
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
## Maintainers ## Maintainers
@@ -22,7 +17,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
## Source Code ## Source Code
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire> * <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. --> <!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
@@ -58,7 +53,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` | | `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` |
| `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.2-alpine` | | `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.3-alpine` |
| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | | `insecureScheme.nginx.resources` | Resource requests and limits | `{}` |
| `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` | | `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` |
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | | `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
@@ -110,12 +105,12 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d8e08cda119684ca08dcfcebdd63cbf3d3ff7c4f8a8effca80b962dddd42438e` |
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` |
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d1fc4d296994f28d7e0264c933a12ba75c9a80478ff1eb4b6f692bb91a073a4c` | | `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:99cafee4f14fe07a3298fcb7b90d4f0c396cba150b65d937856788b42ad83f79` |
| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` | | `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` |
| `tests.busybox.image.repository` | The repository within the registry | `busybox` | | `tests.busybox.image.repository` | The repository within the registry | `busybox` |
| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
charts/spire/charts/spiffe-oidc-discovery-provider/templates/scc-spire-oidc-discovery-provider.yaml
+4 -4
View File
@@ -15,13 +15,13 @@ users:
- system:serviceaccount:{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete - system:serviceaccount:{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete
volumes: volumes:
- configMap - configMap
- csi
- downwardAPI
- emptyDir
- ephemeral
- hostPath - hostPath
- projected - projected
- secret - secret
- ephemeral
- downwardAPI
- csi
- emptyDir
allowHostDirVolumePlugin: true allowHostDirVolumePlugin: true
allowHostIPC: true allowHostIPC: true
allowHostNetwork: true allowHostNetwork: true
charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+3 -3
View File
@@ -111,7 +111,7 @@ insecureScheme:
repository: nginxinc/nginx-unprivileged repository: nginxinc/nginx-unprivileged
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
version: "" version: ""
tag: 1.25.2-alpine tag: 1.25.3-alpine
## @param insecureScheme.nginx.resources Resource requests and limits ## @param insecureScheme.nginx.resources Resource requests and limits
resources: {} resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious # We usually recommend not to specify default resources and to leave this as a conscious
@@ -289,7 +289,7 @@ tests:
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
version: "" version: ""
tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214 tag: latest@sha256:d8e08cda119684ca08dcfcebdd63cbf3d3ff7c4f8a8effca80b962dddd42438e
toolkit: toolkit:
## @param tests.toolkit.image.registry The OCI registry to pull the image from ## @param tests.toolkit.image.registry The OCI registry to pull the image from
@@ -303,7 +303,7 @@ tests:
repository: chainguard/slim-toolkit-debug repository: chainguard/slim-toolkit-debug
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
version: "" version: ""
tag: latest@sha256:d1fc4d296994f28d7e0264c933a12ba75c9a80478ff1eb4b6f692bb91a073a4c tag: latest@sha256:99cafee4f14fe07a3298fcb7b90d4f0c396cba150b65d937856788b42ad83f79
busybox: busybox:
## @param tests.busybox.image.registry The OCI registry to pull the image from ## @param tests.busybox.image.registry The OCI registry to pull the image from
charts/spire/charts/spire-agent/Chart.yaml
+3 -3
View File
@@ -3,11 +3,11 @@ name: spire-agent
description: A Helm chart to install the SPIRE agent. description: A Helm chart to install the SPIRE agent.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.8.4" appVersion: "1.8.5"
keywords: ["spiffe", "spire-agent"] keywords: ["spiffe", "spire-agent"]
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
- https://github.com/spiffe/helm-charts/tree/main/charts/spire - https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
maintainers: maintainers:
- name: marcofranssen - name: marcofranssen
charts/spire/charts/spire-agent/README.md
+6 -10
View File
@@ -4,12 +4,7 @@
A Helm chart to install the SPIRE agent. A Helm chart to install the SPIRE agent.
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire> **Homepage:** <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
> [!Note]
> Minimum Spire version is `1.5.3`.
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
## Maintainers ## Maintainers
@@ -22,7 +17,7 @@ A Helm chart to install the SPIRE agent.
## Source Code ## Source Code
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire> * <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. --> <!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
@@ -31,7 +26,7 @@ A Helm chart to install the SPIRE agent.
### Chart parameters ### Chart parameters
| Name | Description | Value | | Name | Description | Value |
| ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | | ------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `image.repository` | The repository within the registry | `spiffe/spire-agent` | | `image.repository` | The repository within the registry | `spiffe/spire-agent` |
| `image.pullPolicy` | The image pull policy | `IfNotPresent` | | `image.pullPolicy` | The image pull policy | `IfNotPresent` |
@@ -69,13 +64,13 @@ A Helm chart to install the SPIRE agent.
| `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` | | `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` |
| `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `waitForIt.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `waitForIt.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c58a76f9241187615ab081ec73db6aeea6939369fba995206343bd9fb1975378` | | `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ffab5a8d7b7da2d04f433d0321cc5c34d8aa53bd15dd54eb2e4cd9c0d3d3cf5e` |
| `waitForIt.resources` | Resource requests and limits | `{}` | | `waitForIt.resources` | Resource requests and limits | `{}` |
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
| `fsGroupFix.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `fsGroupFix.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` | | `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d8e08cda119684ca08dcfcebdd63cbf3d3ff7c4f8a8effca80b962dddd42438e` |
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
@@ -91,6 +86,7 @@ A Helm chart to install the SPIRE agent.
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | | `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` | | `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | | `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
| `kubeletConnectByHostname` | If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | | `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
| `priorityClassName` | Priority class assigned to daemonset pods | `""` | | `priorityClassName` | Priority class assigned to daemonset pods | `""` |
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
charts/spire/charts/spire-agent/templates/_helpers.tpl
+13
View File
@@ -104,3 +104,16 @@ Create the name of the service account to use
{{- print .Values.socketPath }} {{- print .Values.socketPath }}
{{- end }} {{- end }}
{{- define "spire-agent.connect-by-hostname" -}}
{{- if ne .Values.kubeletConnectByHostname "" }}
{{- if eq (.Values.kubeletConnectByHostname | toString) "true" }}
{{- printf "true" }}
{{- else }}
{{- printf "false" }}
{{- end }}
{{- else if (dig "openshift" false .Values.global) }}
{{- printf "true" }}
{{- else }}
{{- printf "false" }}
{{- end }}
{{- end }}
charts/spire/charts/spire-agent/templates/daemonset.yaml
+11 -2
View File
@@ -1,4 +1,5 @@
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }} {{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
{{- $cbh := eq (include "spire-agent.connect-by-hostname" .) "true" }}
apiVersion: apps/v1 apiVersion: apps/v1
kind: DaemonSet kind: DaemonSet
metadata: metadata:
@@ -71,9 +72,17 @@ spec:
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.image.pullPolicy }} imagePullPolicy: {{ .Values.image.pullPolicy }}
args: ["-config", "/run/spire/config/agent.conf"] args: ["-config", "/run/spire/config/agent.conf"]
{{- if gt (len .Values.extraEnvVars) 0 }} {{- if or (gt (len .Values.extraEnvVars) 0) $cbh }}
env: env:
{{- toYaml .Values.extraEnvVars | nindent 12 }} {{- if $cbh }}
- name: MY_NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
{{- end }}
{{- with .Values.extraEnvVars }}
{{- toYaml . | nindent 12 }}
{{- end }}
{{- end }} {{- end }}
ports: ports:
- containerPort: {{ .Values.healthChecks.port }} - containerPort: {{ .Values.healthChecks.port }}
charts/spire/charts/spire-agent/values.yaml
+5 -2
View File
@@ -134,7 +134,7 @@ waitForIt:
repository: chainguard/wait-for-it repository: chainguard/wait-for-it
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
version: "" version: ""
tag: latest@sha256:c58a76f9241187615ab081ec73db6aeea6939369fba995206343bd9fb1975378 tag: latest@sha256:ffab5a8d7b7da2d04f433d0321cc5c34d8aa53bd15dd54eb2e4cd9c0d3d3cf5e
## @param waitForIt.resources [object] Resource requests and limits ## @param waitForIt.resources [object] Resource requests and limits
resources: {} resources: {}
@@ -153,7 +153,7 @@ fsGroupFix:
repository: chainguard/bash repository: chainguard/bash
pullPolicy: Always pullPolicy: Always
version: "" version: ""
tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214 tag: latest@sha256:d8e08cda119684ca08dcfcebdd63cbf3d3ff7c4f8a8effca80b962dddd42438e
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {} resources: {}
@@ -198,6 +198,9 @@ telemetry:
## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring ## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring
labels: {} labels: {}
## @param kubeletConnectByHostname If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise.
kubeletConnectByHostname: ""
## @param socketPath The unix socket path to the spire-agent ## @param socketPath The unix socket path to the spire-agent
socketPath: /run/spire/agent-sockets/spire-agent.sock socketPath: /run/spire/agent-sockets/spire-agent.sock
charts/spire/charts/spire-server/Chart.yaml
+3 -3
View File
@@ -3,11 +3,11 @@ name: spire-server
description: A Helm chart to install the SPIRE server. description: A Helm chart to install the SPIRE server.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.8.4" appVersion: "1.8.5"
keywords: ["spiffe", "spire-server", "spire-controller-manager"] keywords: ["spiffe", "spire-server", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
- https://github.com/spiffe/helm-charts/tree/main/charts/spire - https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
maintainers: maintainers:
- name: marcofranssen - name: marcofranssen
charts/spire/charts/spire-server/README.md
+18 -24
View File
@@ -4,15 +4,7 @@
A Helm chart to install the SPIRE server. A Helm chart to install the SPIRE server.
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire> **Homepage:** <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
> [!Note]
> Minimum Spire version is `1.5.3`.
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
>
> The recommended spire-controller-manager version is `0.2.2` to support arm64 nodes. If running with any
> prior version to `0.2.2` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
## Maintainers ## Maintainers
@@ -25,7 +17,7 @@ A Helm chart to install the SPIRE server.
## Source Code ## Source Code
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire> * <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
## Tornjak ## Tornjak
@@ -88,7 +80,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
### Chart parameters ### Chart parameters
| Name | Description | Value | | Name | Description | Value |
| ---------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | | --------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` | | `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `image.repository` | The repository within the registry | `spiffe/spire-server` | | `image.repository` | The repository within the registry | `spiffe/spire-server` |
@@ -233,18 +225,20 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.service.annotations` | Annotations for service resource | `{}` | | `controllerManager.service.annotations` | Annotations for service resource | `{}` |
| `controllerManager.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` | | `controllerManager.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` |
| `controllerManager.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` | | `controllerManager.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` |
| `controllerManager.identities.enabled` | Flag to enable default identities for controller manager | `true` | | `controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable this identity for controller manager | `true` |
| `controllerManager.identities.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` | | `controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` |
| `controllerManager.identities.podSelector` | Selector for pods to issue identity | `{}` | | `controllerManager.identities.clusterSPIFFEIDs.default.podSelector` | Selector for pods to issue identity | `{}` |
| `controllerManager.identities.namespaceSelector` | Selector for namespacs to issue identity | `{}` | | `controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector` | Selector for namespacs to issue identity | `{}` |
| `controllerManager.identities.dnsNameTemplates` | DNS name template for issued identities | `[]` | | `controllerManager.identities.clusterSPIFFEIDs.default.dnsNameTemplates` | DNS name template for issued identities | `[]` |
| `controllerManager.identities.federatesWith` | Other Spire server URLs for identity federation | `[]` | | `controllerManager.identities.clusterSPIFFEIDs.default.federatesWith` | Other Spire server URLs for identity federation | `[]` |
| `controllerManager.identities.workloadSelectorTemplates` | Templates to produce selectors that apply to a given workload before it will receive an ID | `[]` | | `controllerManager.identities.clusterSPIFFEIDs.default.workloadSelectorTemplates` | Templates to produce selectors that apply to a given workload before it will receive an ID | `[]` |
| `controllerManager.identities.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` | | `controllerManager.identities.clusterSPIFFEIDs.default.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` |
| `controllerManager.identities.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` | | `controllerManager.identities.clusterSPIFFEIDs.default.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` |
| `controllerManager.identities.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` | | `controllerManager.identities.clusterSPIFFEIDs.default.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
| `controllerManager.identities.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` | | `controllerManager.identities.clusterSPIFFEIDs.default.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` |
| `controllerManager.identities.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` | | `controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` |
| `controllerManager.identities.clusterStaticEntries` | Specify ClusterStaticEntry objects. | `{}` |
| `controllerManager.identities.clusterFederatedTrustDomains` | Specify ClusterFederatedTrustDomain objects. | `{}` |
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` | | `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | | `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
@@ -322,4 +316,4 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d8e08cda119684ca08dcfcebdd63cbf3d3ff7c4f8a8effca80b962dddd42438e` |
charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml
+43 -17
View File
@@ -1,42 +1,68 @@
{{- $root := . }} {{- $root := . }}
{{- with .Values.controllerManager }} {{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }}
{{- if and (eq (.enabled | toString) "true") (eq (.identities.enabled | toString) "true") }} {{- range $skey, $svalue := $value }}
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "admin" "dnsNameTemplates" "downstream" "federatesWith" "jwtTTL" "namespaceSelector" "podSelector" "spiffeIDTemplate" "ttl" "workloadSelectorTemplates" "autoPopulateDNSNames")) }}
{{- fail (printf "Unsupported property specified: %s" $skey) }}
{{- end }}
{{- end }}
{{- range $rprop := list "spiffeIDTemplate" }}
{{- if not (hasKey $value $rprop) }}
{{- fail (printf "Required property %s was not specified" $rprop) }}
{{- end }}
{{- end }}
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
---
apiVersion: spire.spiffe.io/v1alpha1 apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterSPIFFEID kind: ClusterSPIFFEID
metadata: metadata:
name: {{ $root.Release.Namespace }}-{{ include "spire-controller-manager.fullname" $root }}-service-account-based name: {{ $root.Release.Namespace }}-{{ $root.Release.Name }}-{{ $key }}
namespace: {{ include "spire-server.namespace" $root }} {{- with $value.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with $value.labels }}
labels:
{{- toYaml . | nindent 4 }}
{{- end }}
spec: spec:
spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }} className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
{{- with .identities.federatesWith }} spiffeIDTemplate: {{ $value.spiffeIDTemplate | quote }}
{{- with $value.federatesWith }}
federatesWith: federatesWith:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
{{- with .identities.podSelector }} {{- with $value.podSelector }}
podSelector: podSelector:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
{{- with .identities.namespaceSelector }} {{- with $value.namespaceSelector }}
namespaceSelector: namespaceSelector:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
{{- with .identities.dnsNameTemplates }} {{- with $value.dnsNameTemplates }}
dnsNameTemplates: dnsNameTemplates:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
{{- with .identities.workloadSelectorTemplates }} {{- with $value.workloadSelectorTemplates }}
workloadTSelectoremplates: workloadSelectorTemplates:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
{{- with .identities.ttl }} {{- with $value.ttl }}
ttl: {{ . | quote }} ttl: {{ . | quote }}
{{- end }} {{- end }}
{{- with .identities.jwtTTL }} {{- with $value.jwtTTL }}
jwtTtl: {{ . | quote }} jwtTtl: {{ . | quote }}
{{- end }} {{- end }}
admin: {{ .identities.admin }} {{- with $value.admin }}
downstream: {{ .identities.downstream }} admin: {{ . }}
autoPopulateDNSNames: {{ .identities.autoPopulateDNSNames }} {{- end }}
className: {{ include "spire-server.controller-manager-class-name" $root | quote}} {{- with $value.downstream }}
downstream: {{ . }}
{{- end }}
{{- with $value.autoPopulateDNSNames }}
autoPopulateDNSNames: {{ . }}
{{- end }}
{{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/templates/controller-manager-ftd.yaml
+45
View File
@@ -0,0 +1,45 @@
{{- $root := . }}
{{- range $key, $value := .Values.controllerManager.identities.clusterFederatedTrustDomains }}
{{- range $skey, $svalue := $value }}
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "bundleEndpointProfile" "bundleEndpointURL" "trustDomain" "trustDomainBundle")) }}
{{- fail (printf "Unsupported property specified: %s" $skey) }}
{{- end }}
{{- end }}
{{- range $rprop := list "bundleEndpointProfile" "bundleEndpointURL" "trustDomain" }}
{{- if not (hasKey $value $rprop) }}
{{- fail (printf "Required property %s was not specified" $rprop) }}
{{- end }}
{{- end }}
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
---
apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterFederatedTrustDomain
metadata:
name: {{ $root.Release.Namespace }}-{{ $root.Release.Name }}-{{ $key }}
{{- with $value.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with $value.labels }}
labels:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
{{- with $value.bundleEndpointProfile }}
bundleEndpointProfile:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with $value.bundleEndpointURL }}
bundleEndpointURL: {{ . | quote }}
{{- end }}
{{- with $value.trustDomain }}
trustDomain: {{ . | quote }}
{{- end }}
{{- with $value.trustDomainBundle }}
trustDomainBundle: {{ . | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/controller-manager-static-entries.yaml
+63
View File
@@ -0,0 +1,63 @@
{{- $root := . }}
{{- range $key, $value := .Values.controllerManager.identities.clusterStaticEntries }}
{{- range $skey, $svalue := $value }}
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "admin" "dnsNames" "downstream" "federatesWith" "hint" "jwtSVIDTTL" "parentID" "selectors" "spiffeID" "x509SVIDTTL")) }}
{{- fail (printf "Unsupported property specified: %s" $skey) }}
{{- end }}
{{- end }}
{{- range $rprop := list "spiffeID" "selectors" "parentID" }}
{{- if not (hasKey $value $rprop) }}
{{- fail (printf "Required property %s was not specified" $rprop) }}
{{- end }}
{{- end }}
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
---
apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterStaticEntry
metadata:
name: {{ $root.Release.Namespace }}-{{ $root.Release.Name }}-{{ $key }}
{{- with $value.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with $value.labels }}
labels:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
spiffeID: {{ $value.spiffeID | quote }}
{{- with $value.federatesWith }}
federatesWith:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with $value.selectors }}
selectors:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with $value.parentID }}
parentID: {{ . | quote }}
{{- end }}
{{- with $value.dnsNames }}
dnsNames:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with $value.hint }}
hint: {{ . | quote }}
{{- end }}
{{- with $value.x509SVIDTTL }}
x509SVIDTTL: {{ . | quote }}
{{- end }}
{{- with $value.jwtSVIDTTL }}
jwtSVIDTTL: {{ . | quote }}
{{- end }}
{{- with $value.admin }}
admin: {{ . }}
{{- end }}
{{- with $value.downstream }}
downstream: {{ . }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/values.yaml
+46 -14
View File
@@ -445,39 +445,71 @@ controllerManager:
- local-path-storage - local-path-storage
identities: identities:
## @param controllerManager.identities.enabled Flag to enable default identities for controller manager clusterSPIFFEIDs:
# NOTE you can add multiple uniquely named entries to create multiple ClusterSPIFFEID objects. See example below.
default:
## @param controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable this identity for controller manager
enabled: true enabled: true
## @param controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate Spiffe ID template for identities
## @param controllerManager.identities.spiffeIDTemplate Spiffe ID template for identities
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }} spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
## @param controllerManager.identities.podSelector [object] Selector for pods to issue identity ## @param controllerManager.identities.clusterSPIFFEIDs.default.podSelector [object] Selector for pods to issue identity
podSelector: {} podSelector: {}
# matchLabels: # matchLabels:
# spiffe.io/spiffe-id: "true" # spiffe.io/spiffe-id: "true"
## @param controllerManager.identities.namespaceSelector [object] Selector for namespacs to issue identity ## @param controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector [object] Selector for namespacs to issue identity
namespaceSelector: {} namespaceSelector: {}
# matchLabels: # matchLabels:
# spiffe.io/spiffe-id: "true" # spiffe.io/spiffe-id: "true"
## @param controllerManager.identities.dnsNameTemplates [array] DNS name template for issued identities ## @param controllerManager.identities.clusterSPIFFEIDs.default.dnsNameTemplates [array] DNS name template for issued identities
dnsNameTemplates: [] dnsNameTemplates: []
# - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local' # - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local'
## @param controllerManager.identities.federatesWith [array] Other Spire server URLs for identity federation ## @param controllerManager.identities.clusterSPIFFEIDs.default.federatesWith [array] Other Spire server URLs for identity federation
federatesWith: [] federatesWith: []
# - example.io # - example.io
# - example.ai # - example.ai
## @param controllerManager.identities.workloadSelectorTemplates [array] Templates to produce selectors that apply to a given workload before it will receive an ID ## @param controllerManager.identities.clusterSPIFFEIDs.default.workloadSelectorTemplates [array] Templates to produce selectors that apply to a given workload before it will receive an ID
workloadSelectorTemplates: [] workloadSelectorTemplates: []
## @param controllerManager.identities.ttl Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. ## @param controllerManager.identities.clusterSPIFFEIDs.default.ttl Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen.
ttl: "" ttl: ""
## @param controllerManager.identities.jwtTTL Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. ## @param controllerManager.identities.clusterSPIFFEIDs.default.jwtTTL Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen.
jwtTTL: "" jwtTTL: ""
## @param controllerManager.identities.admin Indicates any pod matched by this identity will be an admin. Use this with extreme care. ## @param controllerManager.identities.clusterSPIFFEIDs.default.admin Indicates any pod matched by this identity will be an admin. Use this with extreme care.
admin: false admin: false
## @param controllerManager.identities.downstream Set if this spire instance is a root server and the workloads are downstream servers. ## @param controllerManager.identities.clusterSPIFFEIDs.default.downstream Set if this spire instance is a root server and the workloads are downstream servers.
downstream: false downstream: false
## @param controllerManager.identities.autoPopulateDNSNames Auto populate DNS names from services attached to pods ## @param controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames Auto populate DNS names from services attached to pods
autoPopulateDNSNames: false autoPopulateDNSNames: false
# You can specify additional ClusterSPIFFEIDs following this example:
# foo:
# labels:
# foo: bar
# spiffeIDTemplate: spiffe://{{ .TrustDomain }}/foo
# namespaceSelector:
# matchLabels:
# foo: bar
## @param controllerManager.identities.clusterStaticEntries Specify ClusterStaticEntry objects.
clusterStaticEntries: {}
# foo:
# labels:
# foo: bar
# parentID: spiffe://example.com/bar
# spiffeID: spiffe://example.com/foo
# selectors:
# - k8s:pod-label:app.kubernetes.io/name:server
## @param controllerManager.identities.clusterFederatedTrustDomains Specify ClusterFederatedTrustDomain objects.
clusterFederatedTrustDomains: {}
# foo:
# labels:
# foo: bar
# bundleEndpointProfile:
# endpointSPIFFEID: spiffe://example.com/foo
# type: https_spiffe
# bundleEndpointURL: https://rootserver.example.com:1234
# trustDomain: example.com
validatingWebhookConfiguration: validatingWebhookConfiguration:
## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued ## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued
failurePolicy: Fail failurePolicy: Fail
@@ -724,4 +756,4 @@ tests:
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
version: "" version: ""
tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214 tag: latest@sha256:d8e08cda119684ca08dcfcebdd63cbf3d3ff7c4f8a8effca80b962dddd42438e
charts/spire/charts/tornjak-frontend/Chart.yaml
+1 -1
View File
@@ -4,7 +4,7 @@ description: A Helm chart to deploy Tornjak frontend
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "v1.4.0" appVersion: "v1.4.0"
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
- https://github.com/spiffe/tornjak - https://github.com/spiffe/tornjak
icon: https://raw.githubusercontent.com/spiffe/tornjak/main/logos/logo%2Btornjak.2132x1291.png icon: https://raw.githubusercontent.com/spiffe/tornjak/main/logos/logo%2Btornjak.2132x1291.png
charts/spire/charts/tornjak-frontend/README.md
+2 -4
View File
@@ -5,7 +5,7 @@
A Helm chart to deploy Tornjak frontend A Helm chart to deploy Tornjak frontend
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire> **Homepage:** <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
## Version support ## Version support
@@ -16,8 +16,6 @@ A Helm chart to deploy Tornjak frontend
| Dependency | Supported Versions | | Dependency | Supported Versions |
|:-----------|:-------------------| |:-----------|:-------------------|
| SPIRE | `1.5.3+`, `1.6.x` |
| Tornjak | `1.0.x` |
| Helm | `3.x` | | Helm | `3.x` |
## Tornjak ## Tornjak
@@ -102,4 +100,4 @@ port forwarding. See the chart NOTES output for more details.
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d8e08cda119684ca08dcfcebdd63cbf3d3ff7c4f8a8effca80b962dddd42438e` |
charts/spire/charts/tornjak-frontend/templates/deployment.yaml
+4
View File
@@ -56,6 +56,8 @@ spec:
mountPath: {{ .Values.workingDir }}/node_modules/.cache mountPath: {{ .Values.workingDir }}/node_modules/.cache
- name: env - name: env
mountPath: {{ .Values.workingDir }}/build/tmp mountPath: {{ .Values.workingDir }}/build/tmp
- name: logs
mountPath: /opt/app-root/src/.npm/
{{- with .Values.nodeSelector }} {{- with .Values.nodeSelector }}
nodeSelector: nodeSelector:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
@@ -77,3 +79,5 @@ spec:
emptyDir: {} emptyDir: {}
- name: env - name: env
emptyDir: {} emptyDir: {}
- name: logs
emptyDir: {}
charts/spire/charts/tornjak-frontend/values.yaml
+1 -1
View File
@@ -158,4 +158,4 @@ tests:
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
version: "" version: ""
tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214 tag: latest@sha256:d8e08cda119684ca08dcfcebdd63cbf3d3ff7c4f8a8effca80b962dddd42438e
charts/spire/templates/_spire-lib.tpl
+1 -1
View File
@@ -20,7 +20,7 @@
{{- else if ne (len .Values.jwtIssuer) 0 }} {{- else if ne (len .Values.jwtIssuer) 0 }}
{{- .Values.jwtIssuer }} {{- .Values.jwtIssuer }}
{{- else }} {{- else }}
{{- printf "oidc-discovery.%s" (include "spire-lib.trust-domain" .) }} {{- printf "https://oidc-discovery.%s" (include "spire-lib.trust-domain" .) }}
{{- end }} {{- end }}
{{- end }} {{- end }}
examples/external-mysql/README.md
+1 -1
View File
@@ -15,7 +15,7 @@ Next, edit values.yaml with your settings. Check it into your git repo if using
Then, deploy the chart pointing at your mysql instance like so: Then, deploy the chart pointing at your mysql instance like so:
```shell ```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml --set "spire-server.dataStore.sql.password=${DBPW}" helm upgrade --install --namespace spire-server spire charts/spire -f examples/external-mysql/values.yaml --set "spire-server.dataStore.sql.password=${DBPW}"
``` ```
See the [production example](../production) for production recommendations. See the [production example](../production) for production recommendations.
examples/external-postgresql/README.md
+1 -1
View File
@@ -15,7 +15,7 @@ Next, edit values.yaml with your settings. Check it into your git repo if using
Then, deploy the chart pointing at your postgresql instance like so: Then, deploy the chart pointing at your postgresql instance like so:
```shell ```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml --set "spire-server.dataStore.sql.password=${DBPW}" helm upgrade --install --namespace spire-server spire charts/spire -f examples/external-postgresql/values.yaml --set "spire-server.dataStore.sql.password=${DBPW}"
``` ```
examples/nested/README.md
+10
View File
@@ -0,0 +1,10 @@
# Possible Nesting Configurations
There are multiple ways of configuring the chart depending on what you want to use nesting for.
## Nesting across Kubernetes clusters:
![Multiple Kubernetes Cluster](./multicluster.png)
## Nesting within a Kubernetes cluster:
![Single Hardened](./singlehardened.png)
examples/nested/multicluster.dot
+61
View File
@@ -0,0 +1,61 @@
digraph G {
subgraph cluster_root {
label="Cluster: Root K8S";
subgraph cluster_root_release {
label="Helm Release: Namespace=spire-root Name=spire"
spireRoot [label="Root Spire Server"];
}
}
subgraph cluster_nested1 {
label="Cluster: K8S Workload 1";
subgraph cluster_nested1_release {
label="Helm Release: Namespace=spire-server Name=spire"
subgraph cluster_nested1_ns1 {
label="Namespace: spire-system"
spireUpstreamAgent1 [label="Upstream Spire Agent/CSI"];
}
subgraph cluster_nested1_ns2 {
label="Namespace: spire-server"
spireServerNested1 [label="Nested Spire Server"];
}
subgraph cluster_nested1_ns3 {
label="Namespace: spire-system"
spireDownstreamAgent1 [label="Downstream Spire Agent/CSI"];
}
}
subgraph cluster_nested1_user {
label="Namespace: user"
userWorkload1 [label="User Workload"];
}
}
subgraph cluster_nested2 {
label="Cluster: K8S Workload 2";
subgraph cluster_nested2_release {
label="Helm Release: Namespace=spire-server Name=spire"
subgraph cluster_nested2_ns1 {
label="Namespace: spire-system"
spireUpstreamAgent2 [label="Upstream Spire Agent/CSI"];
}
subgraph cluster_nested2_ns2 {
label="Namespace: spire-server"
spireServerNested2 [label="Nested Spire Server"];
}
subgraph cluster_nested2_ns3 {
label="Namespace: spire-system"
spireDownstreamAgent2 [label="Downstream Spire Agent/CSI"];
}
}
subgraph cluster_nested2_user {
label="Namespace: user"
userWorkload2 [label="Other User Workload"];
}
}
spireRoot -> spireUpstreamAgent1;
spireRoot -> spireUpstreamAgent2;
spireUpstreamAgent1 -> spireServerNested1;
spireServerNested1 -> spireDownstreamAgent1;
spireDownstreamAgent1 -> userWorkload1;
spireUpstreamAgent2 -> spireServerNested2;
spireServerNested2 -> spireDownstreamAgent2;
spireDownstreamAgent2 -> userWorkload2;
}
examples/nested/multicluster.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 127 KiB

examples/nested/singlehardened.dot
+55
View File
@@ -0,0 +1,55 @@
digraph G {
subgraph cluster_baremetal {
label="(Bare Metal|Virtual) Node"
spireDownstreamAgent3 [label="Downstream Spire Agent"];
userWorkload3 [label="External User Workload"];
}
subgraph cluster_k8s {
label="Cluster: K8S";
subgraph cluster_root_release {
label="Helm Release: Namespace=spire-root Name=spire";
subgraph cluster_ns_root {
label="Namespace: spire-root"
spireRoot [label="Root Spire Server"];
}
subgraph cluster_ns_1_system {
label="Namespace: spire-system"
spireUpstreamAgent1 [label="Upstream Spire Agent/CSI"];
}
}
subgraph cluster_nested1_release {
label="Helm Release: Namespace=spire-server Name=spire"
subgraph cluster_ns_nested_server {
label="Namespace: spire-server";
spireServerNested1 [label="Internal Nested Spire Server"];
}
subgraph cluster_ns_nested_system {
label="Namespace: spire-system";
spireDownstreamAgent1 [label="Downstream Spire Agent/CSI"];
}
}
subgraph cluster_ns_nested_system {
label="Namespace: user";
userWorkload1 [label="User Workload"];
}
subgraph cluster_ns_nested2_system {
label="Namespace: user-other";
userWorkload2 [label="Other User Workload"];
}
subgraph cluster_nested3_release {
label="Helm Release: Namespace=spire-external Name=spire"
subgraph cluster_ns_nested2_system {
label="Namespace: spire-external";
spireServerNested2 [label="External Nested Spire Server"];
}
}
spireRoot -> spireUpstreamAgent1;
spireUpstreamAgent1 -> spireServerNested1;
spireServerNested1 -> spireDownstreamAgent1;
spireDownstreamAgent1 -> userWorkload1;
spireDownstreamAgent1 -> userWorkload2;
spireUpstreamAgent1 -> spireServerNested2;
spireServerNested2 -> spireDownstreamAgent3;
spireDownstreamAgent3 -> userWorkload3;
}
}
examples/nested/singlehardened.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 108 KiB

examples/nested/values.yaml
+2
View File
@@ -11,6 +11,8 @@ spire-server:
controllerManager: controllerManager:
enabled: true enabled: true
identities: identities:
clusterSPIFFEIDs:
default:
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/k8s/{{ .ClusterName }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }} spiffeIDTemplate: spiffe://{{ .TrustDomain }}/k8s/{{ .ClusterName }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
spiffe-oidc-discovery-provider: spiffe-oidc-discovery-provider:
examples/openshift/openshift-values.yaml
-8
View File
@@ -27,12 +27,6 @@ spire-agent:
runAsUser: null runAsUser: null
runAsGroup: null runAsGroup: null
fsGroup: null fsGroup: null
# Talk from the agent to kubelet based on hostname instead of localhost
extraEnvVars:
- name: MY_NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
upstream-spire-agent: upstream-spire-agent:
podSecurityContext: podSecurityContext:
@@ -58,8 +52,6 @@ tornjak-frontend:
fsGroup: null fsGroup: null
spiffe-csi-driver: spiffe-csi-driver:
csiDriverLabels:
security.openshift.io/csi-ephemeral-volume-profile: restricted
initContainers: initContainers:
- terminationMessagePath: /dev/termination-log - terminationMessagePath: /dev/termination-log
name: set-context name: set-context
examples/production/README.md
+9 -9
View File
@@ -12,27 +12,27 @@ kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restri
Update the `example-your-values.yaml` file with your values, then: Update the `example-your-values.yaml` file with your values, then:
```shell ```shell
helm upgrade --install --namespace spire-server spire ../../charts/spire \ helm upgrade --install --namespace spire-server spire charts/spire \
-f values.yaml -f example-your-values.yaml --render-subchart-notes -f examples/production/values.yaml -f examples/production/example-your-values.yaml --render-subchart-notes
``` ```
If your using ingress-nginx and want to expose the spiffe oidc discovery provider outside the If your using ingress-nginx and want to expose the spiffe oidc discovery provider outside the
cluster, add the following to the end of the helm upgrade example: cluster, add the following to the end of the helm upgrade example:
```shell ```shell
-f values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml -f examples/production/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml
``` ```
If you want to expose your spire-server outside of Kubernetes and are using ingress-nginx, add following values file when running `helm template/install/upgrade`. If you want to expose your spire-server outside of Kubernetes and are using ingress-nginx, add following values file when running `helm template/install/upgrade`.
```shell ```shell
-f values-expose-spire-server-ingress-nginx.yaml -f examples/production/values-expose-spire-server-ingress-nginx.yaml
``` ```
For example: For example:
```shell ```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-spire-server-ingress-nginx.yaml helm upgrade --install --namespace spire-server spire charts/spire -f examples/production/values.yaml -f examples/production/values-expose-spire-server-ingress-nginx.yaml
``` ```
If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx
@@ -42,25 +42,25 @@ you have two options as described here:
If you chose profile https_web, use: If you chose profile https_web, use:
```shell ```shell
-f values-expose-federation-https-web-ingress-nginx.yaml -f examples/production/values-expose-federation-https-web-ingress-nginx.yaml
``` ```
For example: For example:
```shell ```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-web-ingress-nginx.yaml helm upgrade --install --namespace spire-server spire charts/spire -f examples/production/values.yaml -f examples/production/values-expose-federation-https-web-ingress-nginx.yaml
``` ```
If you chose profile https_spiffe, use: If you chose profile https_spiffe, use:
```shell ```shell
-f values-expose-federation-https-spiffe-ingress-nginx.yaml -f examples/production/values-expose-federation-https-spiffe-ingress-nginx.yaml
``` ```
For example: For example:
```shell ```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-spiffe-ingress-nginx.yaml helm upgrade --install --namespace spire-server spire charts/spire -f examples/production/values.yaml -f examples/production/values-expose-federation-https-spiffe-ingress-nginx.yaml
``` ```
See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup. See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
examples/production/run-tests.sh
+1 -1
View File
@@ -2,7 +2,7 @@
set -xe set -xe
UPGRADE_VERSION=v0.14.0 UPGRADE_VERSION=v0.15.1
UPGRADE_REPO=https://spiffe.github.io/helm-charts-hardened UPGRADE_REPO=https://spiffe.github.io/helm-charts-hardened
SCRIPT="$(readlink -f "$0")" SCRIPT="$(readlink -f "$0")"
examples/production/values.yaml
+1 -1
View File
@@ -124,7 +124,7 @@ tornjak-frontend:
securityContext: securityContext:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
runAsNonRoot: true runAsNonRoot: true
readOnlyRootFilesystem: false readOnlyRootFilesystem: true
capabilities: capabilities:
drop: [ALL] drop: [ALL]
seccompProfile: seccompProfile:
examples/tornjak/README.md
+5 -5
View File
@@ -12,11 +12,11 @@ kubectl create namespace "spire-server"
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
# deploy SPIRE with Tornjak enabled # deploy SPIRE with Tornjak enabled
helm upgrade --install --namespace spire-server \ helm upgrade --install --namespace spire-server spire charts/spire \
--values ../production/values.yaml \ --values examples/production/values.yaml \
--values ./values.yaml \ --values examples/tornjak/values.yaml \
--render-subchart-notes \ --render-subchart-notes
spire ../../charts/spire
# test the Tornjak deployment # test the Tornjak deployment
helm test spire -n spire-server helm test spire -n spire-server
release-chart.sh
+37 -12
View File
@@ -6,12 +6,12 @@
## ##
## Usage example(s): ## Usage example(s):
## ##
## ./__PROG__ --chart spire --current-version 0.15.1 --new-version 0.16.0 ## ./__PROG__ --chart spire --new-version 0.16.0
## ./__PROG__ --chart spire-crds --new-version 0.3.0
## ##
## Options: ## Options:
## --help Show this help message ## --help Show this help message
## --chart The chart to release ## --chart The chart to release
## --current-version The current version number
## --new-version The new version number ## --new-version The new version number
## --dry-run Will not actually submit the PR ## --dry-run Will not actually submit the PR
## ##
@@ -39,6 +39,24 @@ function print_error_and_exit {
exit 1 exit 1
} }
function unreleased_changes_other_charts {
for chart in "$@" ; do
latest_tag="$(git --no-pager tag --list "${chart}-[0-9]*.[0-9]*.[0-9]*" | sort -V | tail -n 1)"
changes="$(git --no-pager log "${latest_tag}..HEAD" --pretty=format:'* %h %s' "charts/${chart}")"
if [ -n "${changes}" ] ; then
echo "### Unreleased changes ${chart}"
echo
echo "${changes}"
echo
echo Please ensure you bump above charts as well before merging main into the release branch.
echo
echo '```shell'
echo ./release-chart.sh --chart "${chart}" --new-version ………
echo '```'
fi
done
}
while (("$#")); do while (("$#")); do
case "$1" in case "$1" in
--help) --help)
@@ -49,10 +67,6 @@ while (("$#")); do
chart=$2 chart=$2
shift 2 shift 2
;; ;;
--current-version)
current_version=$2
shift 2
;;
--new-version) --new-version)
new_version=$2 new_version=$2
shift 2 shift 2
@@ -86,11 +100,6 @@ if [ -z "$chart" ]; then
print_error_and_exit 'chart option is missing' print_error_and_exit 'chart option is missing'
fi fi
if [ -z "$current_version" ]; then
usage
print_error_and_exit 'current-version option is missing'
fi
if [ -z "$new_version" ]; then if [ -z "$new_version" ]; then
usage usage
print_error_and_exit 'new-version option is missing' print_error_and_exit 'new-version option is missing'
@@ -102,21 +111,37 @@ fi
branch_name="bump-${chart}-version" branch_name="bump-${chart}-version"
git fetch --tags
git checkout main git checkout main
git pull git pull
git checkout --track -B "${branch_name}" main git checkout --track -B "${branch_name}" main
current_version="$(grep '^version:' "charts/${chart}/Chart.yaml" | awk '{print $2}')"
commits_since_previous_release="$(git log "${chart}-${current_version}..HEAD" --pretty=format:'* %h %s' "charts/${chart}")" commits_since_previous_release="$(git log "${chart}-${current_version}..HEAD" --pretty=format:'* %h %s' "charts/${chart}")"
"${SED}" -i "s/version: ${current_version}/version: ${new_version}/" "charts/${chart}/Chart.yaml" "${SED}" -i "s/version: ${current_version}/version: ${new_version}/" "charts/${chart}/Chart.yaml"
"${SED}" -i "s/${current_version}/${new_version}/" "charts/${chart}/README.md" "${SED}" -i "s/${current_version}/${new_version}/g" "charts/${chart}/README.md"
git add "charts/${chart}/"{Chart.yaml,README.md} git add "charts/${chart}/"{Chart.yaml,README.md}
git commit -m "Bump ${chart} Helm Chart version from ${current_version} to ${new_version}" \ git commit -m "Bump ${chart} Helm Chart version from ${current_version} to ${new_version}" \
-m "${commits_since_previous_release}" \ -m "${commits_since_previous_release}" \
-s -s
git push -u origin --force-with-lease git push -u origin --force-with-lease
other_charts=()
for chart_dir in charts/*/; do
chart_name=$(basename "$chart_dir")
if [[ "$chart_name" != "$chart" ]]; then
other_charts+=("$chart_name")
fi
done
cat <<EOF | gh pr create --base main --body-file - "${dry_run}" cat <<EOF | gh pr create --base main --body-file - "${dry_run}"
Please review the below changelog to ensure this matches up with the semantic version being applied. Please review the below changelog to ensure this matches up with the semantic version being applied.
> [!Important]
> Before merging to the release branch, ensure all other changed charts also have their version number bumped.
$(unreleased_changes_other_charts "${other_charts[@]}")
> [!Note] > [!Note]
> **Maintainers** ensure to run following after merging this PR to trigger the release workflow: > **Maintainers** ensure to run following after merging this PR to trigger the release workflow:
> >
tests/go.mod
+4 -4
View File
@@ -3,7 +3,7 @@ module github.com/spiffe/helm-charts/tests
go 1.20 go 1.20
require ( require (
github.com/onsi/ginkgo/v2 v2.13.0 github.com/onsi/ginkgo/v2 v2.13.2
github.com/onsi/gomega v1.30.0 github.com/onsi/gomega v1.30.0
helm.sh/helm/v3 v3.13.2 helm.sh/helm/v3 v3.13.2
) )
@@ -16,7 +16,7 @@ require (
github.com/cyphar/filepath-securejoin v0.2.4 // indirect github.com/cyphar/filepath-securejoin v0.2.4 // indirect
github.com/davecgh/go-spew v1.1.1 // indirect github.com/davecgh/go-spew v1.1.1 // indirect
github.com/emicklei/go-restful/v3 v3.10.1 // indirect github.com/emicklei/go-restful/v3 v3.10.1 // indirect
github.com/go-logr/logr v1.2.4 // indirect github.com/go-logr/logr v1.3.0 // indirect
github.com/go-openapi/jsonpointer v0.19.6 // indirect github.com/go-openapi/jsonpointer v0.19.6 // indirect
github.com/go-openapi/jsonreference v0.20.2 // indirect github.com/go-openapi/jsonreference v0.20.2 // indirect
github.com/go-openapi/swag v0.22.3 // indirect github.com/go-openapi/swag v0.22.3 // indirect
@@ -48,11 +48,11 @@ require (
golang.org/x/crypto v0.14.0 // indirect golang.org/x/crypto v0.14.0 // indirect
golang.org/x/net v0.17.0 // indirect golang.org/x/net v0.17.0 // indirect
golang.org/x/oauth2 v0.8.0 // indirect golang.org/x/oauth2 v0.8.0 // indirect
golang.org/x/sys v0.13.0 // indirect golang.org/x/sys v0.14.0 // indirect
golang.org/x/term v0.13.0 // indirect golang.org/x/term v0.13.0 // indirect
golang.org/x/text v0.13.0 // indirect golang.org/x/text v0.13.0 // indirect
golang.org/x/time v0.3.0 // indirect golang.org/x/time v0.3.0 // indirect
golang.org/x/tools v0.12.0 // indirect golang.org/x/tools v0.14.0 // indirect
google.golang.org/appengine v1.6.7 // indirect google.golang.org/appengine v1.6.7 // indirect
google.golang.org/protobuf v1.30.0 // indirect google.golang.org/protobuf v1.30.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/inf.v0 v0.9.1 // indirect
tests/go.sum
+9 -9
View File
@@ -20,8 +20,8 @@ github.com/emicklei/go-restful/v3 v3.10.1 h1:rc42Y5YTp7Am7CS630D7JmhRjq4UlEUuEKf
github.com/emicklei/go-restful/v3 v3.10.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= github.com/emicklei/go-restful/v3 v3.10.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE= github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE=
github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ= github.com/go-logr/logr v1.3.0 h1:2y3SDp0ZXuc6/cjLSZ+Q3ir+QB9T/iG5yYRXqsagWSY=
github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE= github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs= github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE= github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
@@ -85,8 +85,8 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4= github.com/onsi/ginkgo/v2 v2.13.2 h1:Bi2gGVkfn6gQcjNjZJVO8Gf0FHzMPf2phUei9tejVMs=
github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o= github.com/onsi/ginkgo/v2 v2.13.2/go.mod h1:XStQ8QcGwLyF4HdfcZB8SFOS/MWCgDuXMSBe6zrvLgM=
github.com/onsi/gomega v1.30.0 h1:hvMK7xYz4D3HapigLTeGdId/NcfQx1VHMJc60ew99+8= github.com/onsi/gomega v1.30.0 h1:hvMK7xYz4D3HapigLTeGdId/NcfQx1VHMJc60ew99+8=
github.com/onsi/gomega v1.30.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ= github.com/onsi/gomega v1.30.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -132,7 +132,7 @@ golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc= golang.org/x/mod v0.13.0 h1:I/DsJXRlw/8l/0c24sM9yb0T4z9liZTduXvdAWYiysY=
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks= golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -158,8 +158,8 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE= golang.org/x/sys v0.14.0 h1:Vz7Qs629MkJkGyHxUlRHizWJRG2j8fbQKjELVSNhy7Q=
golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc= golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
@@ -179,8 +179,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
golang.org/x/tools v0.12.0 h1:YW6HUoUmYBpwSgyaGaZq1fHjrBjX1rlpZ54T6mu2kss= golang.org/x/tools v0.14.0 h1:jvNa2pY0M4r62jkRQ6RwEZZyPcymeL9XZMLBbV7U2nc=
golang.org/x/tools v0.12.0/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM= golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=