panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'main' into release

Browse Source
This commit is contained in:
Kevin Fox
2023-12-01 07:17:40 -08:00
parent b469b62f1a 78bb95ba35
commit 69511f5a6c
47 changed files with 792 additions and 455 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/tests/charts.json
+3 -3
View File
@@ -2,7 +2,7 @@
{
"name": "kube-prometheus-stack",
"repo": "https://prometheus-community.github.io/helm-charts",
"version": "52.1.0"
"version": "54.2.2"
},
{
"name": "cert-manager",
@@ -17,11 +17,11 @@
{
"name": "mysql",
"repo": "https://charts.bitnami.com/bitnami",
"version": "9.14.1"
"version": "9.14.4"
},
{
"name": "postgresql",
"repo": "https://charts.bitnami.com/bitnami",
"version": "13.2.1"
"version": "13.2.18"
}
]
.github/tests/dependencies/spire-root-server-values.yaml
+2
View File
@@ -6,6 +6,8 @@ global:
spire-server:
controllerManager:
identities:
clusterSPIFFEIDs:
default:
namespaceSelector:
kubernetes.io/metadata.name: spire-server
podSelector:
Makefile
+5
View File
@@ -63,3 +63,8 @@ test-example-%:
.PHONY: test-examples
test-examples: $(patsubst examples/%/values.yaml,test-example-%,$(wildcard examples/*/values.yaml)) ## Run `helm install` and `helm test` for all the examples containing `run-tests.sh`
.PHONY: diagrams
diagrams: ## Builds diagrams
@dot -Tpng examples/nested/singlehardened.dot > examples/nested/singlehardened.png
@dot -Tpng examples/nested/multicluster.dot > examples/nested/multicluster.png
README.md
+2 -2
View File
@@ -1,4 +1,4 @@
> [!Note]
> **Note**
> Things to consider:
> 1. We do not support running out of the git main branch. This is where development happens. Please use released versions via the published repo or git tags.
> 2. All the helm charts in this repo are beta. We encourage you to try them out and contribute. The API may change as we move towards a production ready release.
@@ -14,7 +14,7 @@ A suite of [Helm Charts](https://helm.sh/docs) for standardized installations of
## How to install or upgrade
You most likely want to do an integrated setup based on the spire chart.
See the [Instructions](https://artifacthub.io/packages/helm/spiffe/spire).
See the [Instructions](https://artifacthub.io/packages/helm/spiffe/spire#install-notes).
## Contributing
charts/spire/Chart.yaml
+2 -2
View File
@@ -3,8 +3,8 @@ name: spire
description: >
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
type: application
version: 0.15.1
appVersion: "1.8.4"
version: 0.16.0
appVersion: "1.8.5"
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
sources:
charts/spire/README.md
+10 -4
View File
@@ -1,6 +1,6 @@
# spire
![Version: 0.15.1](https://img.shields.io/badge/Version-0.13.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square)
![Version: 0.16.0](https://img.shields.io/badge/Version-0.16.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.8.5](https://img.shields.io/badge/AppVersion-1.8.5-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
@@ -12,8 +12,8 @@ A Helm chart for deploying the complete Spire stack including: spire-server, spi
To do a quick non production install suitable for quick testing in something like minikube:
```shell
helm install -n spire-server spire-crds --repo https://spiffe.github.io/helm-charts-hardened/ --create-namespace
helm install -n spire-server spire --repo https://spiffe.github.io/helm-charts-hardened/
helm install -n spire-server spire-crds spire-crds --repo https://spiffe.github.io/helm-charts-hardened/ --create-namespace
helm install -n spire-server spire spire --repo https://spiffe.github.io/helm-charts-hardened/
```
To customize, start with a base values file and edit as needed:
@@ -28,10 +28,16 @@ Then:
helm install -n spire-server spire --repo https://spiffe.github.io/helm-charts-hardened/ -f your-values.yaml
```
For production installs, please see [the production example](https://github.com/spiffe/helm-charts-hardened/tree/main/examples/production).
For production installs, please see [the production example](https://github.com/spiffe/helm-charts-hardened/tree/spire-0.16.0/examples/production).
## Upgrade notes
We only support upgrading one major version at a time. Version skipping isn't supported.
### 0.16.X
The settings under "spire-server.controllerManager.identities" have all been moved under "spire-server.controllerManager.identities.clusterSPIFFEIDs.default". If you have changed any from the defaults, please update them to the new location during upgrade.
### 0.15.X
The spire-crds chart has been updated. Please ensure you have upgraded spire-crds before upgrading the spire chart.
charts/spire/charts/spiffe-csi-driver/Chart.yaml
+2 -2
View File
@@ -5,9 +5,9 @@ type: application
version: 0.1.0
appVersion: "0.2.3"
keywords: ["spiffe", "csi-driver"]
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources:
- https://github.com/spiffe/helm-charts/tree/main/charts/spire
- https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
maintainers:
- name: marcofranssen
charts/spire/charts/spiffe-csi-driver/README.md
+3 -7
View File
@@ -4,11 +4,7 @@
A Helm chart to install the SPIFFE CSI driver.
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
> [!Note]
> The recommended version is `0.2.3` to support arm64 nodes. If running with any
> prior version to `0.2.3` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
**Homepage:** <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
## Maintainers
@@ -21,7 +17,7 @@ A Helm chart to install the SPIFFE CSI driver.
## Source Code
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
* <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
@@ -60,7 +56,7 @@ A Helm chart to install the SPIFFE CSI driver.
| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` |
| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `nodeDriverRegistrar.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.0` |
| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.1` |
| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` |
| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` |
charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml
+6 -1
View File
@@ -1,8 +1,13 @@
{{- $labels := dict }}
{{- if (dig "openshift" false .Values.global) }}
{{- $_ := set $labels "security.openshift.io/csi-ephemeral-volume-profile" "restricted" }}
{{- end }}
{{- $labels = mergeOverwrite $labels .Values.csiDriverLabels }}
apiVersion: storage.k8s.io/v1
kind: CSIDriver
metadata:
name: {{ .Values.pluginName | quote }}
{{- with .Values.csiDriverLabels }}
{{- with $labels }}
labels:
{{- toYaml . | nindent 4 }}
{{- end }}
charts/spire/charts/spiffe-csi-driver/values.yaml
+1 -1
View File
@@ -110,7 +110,7 @@ nodeDriverRegistrar:
repository: sig-storage/csi-node-driver-registrar
pullPolicy: IfNotPresent
version: ""
tag: v2.9.0
tag: v2.9.1
## @param nodeDriverRegistrar.resources Resource requests and limits for CSI driver pods
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml
+3 -3
View File
@@ -3,11 +3,11 @@ name: spiffe-oidc-discovery-provider
description: A Helm chart to install the SPIFFE OIDC discovery provider.
type: application
version: 0.1.0
appVersion: "1.8.4"
appVersion: "1.8.5"
keywords: ["spiffe", "oidc"]
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources:
- https://github.com/spiffe/helm-charts/tree/main/charts/spire
- https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
maintainers:
- name: marcofranssen
charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+5 -10
View File
@@ -4,12 +4,7 @@
A Helm chart to install the SPIFFE OIDC discovery provider.
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
> [!Note]
> Minimum Spire version is `1.5.3`.
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
**Homepage:** <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
## Maintainers
@@ -22,7 +17,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
## Source Code
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
* <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
@@ -58,7 +53,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` |
| `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.2-alpine` |
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.3-alpine` |
| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` |
| `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` |
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
@@ -110,12 +105,12 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d8e08cda119684ca08dcfcebdd63cbf3d3ff7c4f8a8effca80b962dddd42438e` |
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` |
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d1fc4d296994f28d7e0264c933a12ba75c9a80478ff1eb4b6f692bb91a073a4c` |
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:99cafee4f14fe07a3298fcb7b90d4f0c396cba150b65d937856788b42ad83f79` |
| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` |
| `tests.busybox.image.repository` | The repository within the registry | `busybox` |
| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
charts/spire/charts/spiffe-oidc-discovery-provider/templates/scc-spire-oidc-discovery-provider.yaml
+4 -4
View File
@@ -15,13 +15,13 @@ users:
- system:serviceaccount:{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete
volumes:
- configMap
- csi
- downwardAPI
- emptyDir
- ephemeral
- hostPath
- projected
- secret
- ephemeral
- downwardAPI
- csi
- emptyDir
allowHostDirVolumePlugin: true
allowHostIPC: true
allowHostNetwork: true
charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+3 -3
View File
@@ -111,7 +111,7 @@ insecureScheme:
repository: nginxinc/nginx-unprivileged
pullPolicy: IfNotPresent
version: ""
tag: 1.25.2-alpine
tag: 1.25.3-alpine
## @param insecureScheme.nginx.resources Resource requests and limits
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
@@ -289,7 +289,7 @@ tests:
repository: chainguard/bash
pullPolicy: IfNotPresent
version: ""
tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214
tag: latest@sha256:d8e08cda119684ca08dcfcebdd63cbf3d3ff7c4f8a8effca80b962dddd42438e
toolkit:
## @param tests.toolkit.image.registry The OCI registry to pull the image from
@@ -303,7 +303,7 @@ tests:
repository: chainguard/slim-toolkit-debug
pullPolicy: IfNotPresent
version: ""
tag: latest@sha256:d1fc4d296994f28d7e0264c933a12ba75c9a80478ff1eb4b6f692bb91a073a4c
tag: latest@sha256:99cafee4f14fe07a3298fcb7b90d4f0c396cba150b65d937856788b42ad83f79
busybox:
## @param tests.busybox.image.registry The OCI registry to pull the image from
charts/spire/charts/spire-agent/Chart.yaml
+3 -3
View File
@@ -3,11 +3,11 @@ name: spire-agent
description: A Helm chart to install the SPIRE agent.
type: application
version: 0.1.0
appVersion: "1.8.4"
appVersion: "1.8.5"
keywords: ["spiffe", "spire-agent"]
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources:
- https://github.com/spiffe/helm-charts/tree/main/charts/spire
- https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
maintainers:
- name: marcofranssen
charts/spire/charts/spire-agent/README.md
+6 -10
View File
@@ -4,12 +4,7 @@
A Helm chart to install the SPIRE agent.
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
> [!Note]
> Minimum Spire version is `1.5.3`.
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
**Homepage:** <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
## Maintainers
@@ -22,7 +17,7 @@ A Helm chart to install the SPIRE agent.
## Source Code
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
* <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
@@ -31,7 +26,7 @@ A Helm chart to install the SPIRE agent.
### Chart parameters
| Name | Description | Value |
| ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| ------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `image.repository` | The repository within the registry | `spiffe/spire-agent` |
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
@@ -69,13 +64,13 @@ A Helm chart to install the SPIRE agent.
| `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` |
| `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `waitForIt.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c58a76f9241187615ab081ec73db6aeea6939369fba995206343bd9fb1975378` |
| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ffab5a8d7b7da2d04f433d0321cc5c34d8aa53bd15dd54eb2e4cd9c0d3d3cf5e` |
| `waitForIt.resources` | Resource requests and limits | `{}` |
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
| `fsGroupFix.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` |
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d8e08cda119684ca08dcfcebdd63cbf3d3ff7c4f8a8effca80b962dddd42438e` |
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
@@ -91,6 +86,7 @@ A Helm chart to install the SPIRE agent.
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
| `kubeletConnectByHostname` | If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
| `priorityClassName` | Priority class assigned to daemonset pods | `""` |
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
charts/spire/charts/spire-agent/templates/_helpers.tpl
+13
View File
@@ -104,3 +104,16 @@ Create the name of the service account to use
{{- print .Values.socketPath }}
{{- end }}
{{- define "spire-agent.connect-by-hostname" -}}
{{- if ne .Values.kubeletConnectByHostname "" }}
{{- if eq (.Values.kubeletConnectByHostname | toString) "true" }}
{{- printf "true" }}
{{- else }}
{{- printf "false" }}
{{- end }}
{{- else if (dig "openshift" false .Values.global) }}
{{- printf "true" }}
{{- else }}
{{- printf "false" }}
{{- end }}
{{- end }}
charts/spire/charts/spire-agent/templates/daemonset.yaml
+11 -2
View File
@@ -1,4 +1,5 @@
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
{{- $cbh := eq (include "spire-agent.connect-by-hostname" .) "true" }}
apiVersion: apps/v1
kind: DaemonSet
metadata:
@@ -71,9 +72,17 @@ spec:
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
args: ["-config", "/run/spire/config/agent.conf"]
{{- if gt (len .Values.extraEnvVars) 0 }}
{{- if or (gt (len .Values.extraEnvVars) 0) $cbh }}
env:
{{- toYaml .Values.extraEnvVars | nindent 12 }}
{{- if $cbh }}
- name: MY_NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
{{- end }}
{{- with .Values.extraEnvVars }}
{{- toYaml . | nindent 12 }}
{{- end }}
{{- end }}
ports:
- containerPort: {{ .Values.healthChecks.port }}
charts/spire/charts/spire-agent/values.yaml
+5 -2
View File
@@ -134,7 +134,7 @@ waitForIt:
repository: chainguard/wait-for-it
pullPolicy: IfNotPresent
version: ""
tag: latest@sha256:c58a76f9241187615ab081ec73db6aeea6939369fba995206343bd9fb1975378
tag: latest@sha256:ffab5a8d7b7da2d04f433d0321cc5c34d8aa53bd15dd54eb2e4cd9c0d3d3cf5e
## @param waitForIt.resources [object] Resource requests and limits
resources: {}
@@ -153,7 +153,7 @@ fsGroupFix:
repository: chainguard/bash
pullPolicy: Always
version: ""
tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214
tag: latest@sha256:d8e08cda119684ca08dcfcebdd63cbf3d3ff7c4f8a8effca80b962dddd42438e
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {}
@@ -198,6 +198,9 @@ telemetry:
## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring
labels: {}
## @param kubeletConnectByHostname If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise.
kubeletConnectByHostname: ""
## @param socketPath The unix socket path to the spire-agent
socketPath: /run/spire/agent-sockets/spire-agent.sock
charts/spire/charts/spire-server/Chart.yaml
+3 -3
View File
@@ -3,11 +3,11 @@ name: spire-server
description: A Helm chart to install the SPIRE server.
type: application
version: 0.1.0
appVersion: "1.8.4"
appVersion: "1.8.5"
keywords: ["spiffe", "spire-server", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources:
- https://github.com/spiffe/helm-charts/tree/main/charts/spire
- https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
maintainers:
- name: marcofranssen
charts/spire/charts/spire-server/README.md
+18 -24
View File
@@ -4,15 +4,7 @@
A Helm chart to install the SPIRE server.
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
> [!Note]
> Minimum Spire version is `1.5.3`.
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
>
> The recommended spire-controller-manager version is `0.2.2` to support arm64 nodes. If running with any
> prior version to `0.2.2` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
**Homepage:** <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
## Maintainers
@@ -25,7 +17,7 @@ A Helm chart to install the SPIRE server.
## Source Code
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
* <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
## Tornjak
@@ -88,7 +80,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
### Chart parameters
| Name | Description | Value |
| ---------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| --------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `image.repository` | The repository within the registry | `spiffe/spire-server` |
@@ -233,18 +225,20 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.service.annotations` | Annotations for service resource | `{}` |
| `controllerManager.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` |
| `controllerManager.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` |
| `controllerManager.identities.enabled` | Flag to enable default identities for controller manager | `true` |
| `controllerManager.identities.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` |
| `controllerManager.identities.podSelector` | Selector for pods to issue identity | `{}` |
| `controllerManager.identities.namespaceSelector` | Selector for namespacs to issue identity | `{}` |
| `controllerManager.identities.dnsNameTemplates` | DNS name template for issued identities | `[]` |
| `controllerManager.identities.federatesWith` | Other Spire server URLs for identity federation | `[]` |
| `controllerManager.identities.workloadSelectorTemplates` | Templates to produce selectors that apply to a given workload before it will receive an ID | `[]` |
| `controllerManager.identities.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` |
| `controllerManager.identities.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` |
| `controllerManager.identities.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
| `controllerManager.identities.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` |
| `controllerManager.identities.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` |
| `controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable this identity for controller manager | `true` |
| `controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` |
| `controllerManager.identities.clusterSPIFFEIDs.default.podSelector` | Selector for pods to issue identity | `{}` |
| `controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector` | Selector for namespacs to issue identity | `{}` |
| `controllerManager.identities.clusterSPIFFEIDs.default.dnsNameTemplates` | DNS name template for issued identities | `[]` |
| `controllerManager.identities.clusterSPIFFEIDs.default.federatesWith` | Other Spire server URLs for identity federation | `[]` |
| `controllerManager.identities.clusterSPIFFEIDs.default.workloadSelectorTemplates` | Templates to produce selectors that apply to a given workload before it will receive an ID | `[]` |
| `controllerManager.identities.clusterSPIFFEIDs.default.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` |
| `controllerManager.identities.clusterSPIFFEIDs.default.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` |
| `controllerManager.identities.clusterSPIFFEIDs.default.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
| `controllerManager.identities.clusterSPIFFEIDs.default.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` |
| `controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` |
| `controllerManager.identities.clusterStaticEntries` | Specify ClusterStaticEntry objects. | `{}` |
| `controllerManager.identities.clusterFederatedTrustDomains` | Specify ClusterFederatedTrustDomain objects. | `{}` |
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
@@ -322,4 +316,4 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d8e08cda119684ca08dcfcebdd63cbf3d3ff7c4f8a8effca80b962dddd42438e` |
charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml
+43 -17
View File
@@ -1,42 +1,68 @@
{{- $root := . }}
{{- with .Values.controllerManager }}
{{- if and (eq (.enabled | toString) "true") (eq (.identities.enabled | toString) "true") }}
{{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }}
{{- range $skey, $svalue := $value }}
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "admin" "dnsNameTemplates" "downstream" "federatesWith" "jwtTTL" "namespaceSelector" "podSelector" "spiffeIDTemplate" "ttl" "workloadSelectorTemplates" "autoPopulateDNSNames")) }}
{{- fail (printf "Unsupported property specified: %s" $skey) }}
{{- end }}
{{- end }}
{{- range $rprop := list "spiffeIDTemplate" }}
{{- if not (hasKey $value $rprop) }}
{{- fail (printf "Required property %s was not specified" $rprop) }}
{{- end }}
{{- end }}
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
---
apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterSPIFFEID
metadata:
name: {{ $root.Release.Namespace }}-{{ include "spire-controller-manager.fullname" $root }}-service-account-based
namespace: {{ include "spire-server.namespace" $root }}
name: {{ $root.Release.Namespace }}-{{ $root.Release.Name }}-{{ $key }}
{{- with $value.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with $value.labels }}
labels:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }}
{{- with .identities.federatesWith }}
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
spiffeIDTemplate: {{ $value.spiffeIDTemplate | quote }}
{{- with $value.federatesWith }}
federatesWith:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .identities.podSelector }}
{{- with $value.podSelector }}
podSelector:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .identities.namespaceSelector }}
{{- with $value.namespaceSelector }}
namespaceSelector:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .identities.dnsNameTemplates }}
{{- with $value.dnsNameTemplates }}
dnsNameTemplates:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .identities.workloadSelectorTemplates }}
workloadTSelectoremplates:
{{- with $value.workloadSelectorTemplates }}
workloadSelectorTemplates:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .identities.ttl }}
{{- with $value.ttl }}
ttl: {{ . | quote }}
{{- end }}
{{- with .identities.jwtTTL }}
{{- with $value.jwtTTL }}
jwtTtl: {{ . | quote }}
{{- end }}
admin: {{ .identities.admin }}
downstream: {{ .identities.downstream }}
autoPopulateDNSNames: {{ .identities.autoPopulateDNSNames }}
className: {{ include "spire-server.controller-manager-class-name" $root | quote}}
{{- with $value.admin }}
admin: {{ . }}
{{- end }}
{{- with $value.downstream }}
downstream: {{ . }}
{{- end }}
{{- with $value.autoPopulateDNSNames }}
autoPopulateDNSNames: {{ . }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/controller-manager-ftd.yaml
+45
View File
@@ -0,0 +1,45 @@
{{- $root := . }}
{{- range $key, $value := .Values.controllerManager.identities.clusterFederatedTrustDomains }}
{{- range $skey, $svalue := $value }}
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "bundleEndpointProfile" "bundleEndpointURL" "trustDomain" "trustDomainBundle")) }}
{{- fail (printf "Unsupported property specified: %s" $skey) }}
{{- end }}
{{- end }}
{{- range $rprop := list "bundleEndpointProfile" "bundleEndpointURL" "trustDomain" }}
{{- if not (hasKey $value $rprop) }}
{{- fail (printf "Required property %s was not specified" $rprop) }}
{{- end }}
{{- end }}
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
---
apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterFederatedTrustDomain
metadata:
name: {{ $root.Release.Namespace }}-{{ $root.Release.Name }}-{{ $key }}
{{- with $value.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with $value.labels }}
labels:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
{{- with $value.bundleEndpointProfile }}
bundleEndpointProfile:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with $value.bundleEndpointURL }}
bundleEndpointURL: {{ . | quote }}
{{- end }}
{{- with $value.trustDomain }}
trustDomain: {{ . | quote }}
{{- end }}
{{- with $value.trustDomainBundle }}
trustDomainBundle: {{ . | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/controller-manager-static-entries.yaml
+63
View File
@@ -0,0 +1,63 @@
{{- $root := . }}
{{- range $key, $value := .Values.controllerManager.identities.clusterStaticEntries }}
{{- range $skey, $svalue := $value }}
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "admin" "dnsNames" "downstream" "federatesWith" "hint" "jwtSVIDTTL" "parentID" "selectors" "spiffeID" "x509SVIDTTL")) }}
{{- fail (printf "Unsupported property specified: %s" $skey) }}
{{- end }}
{{- end }}
{{- range $rprop := list "spiffeID" "selectors" "parentID" }}
{{- if not (hasKey $value $rprop) }}
{{- fail (printf "Required property %s was not specified" $rprop) }}
{{- end }}
{{- end }}
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
---
apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterStaticEntry
metadata:
name: {{ $root.Release.Namespace }}-{{ $root.Release.Name }}-{{ $key }}
{{- with $value.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with $value.labels }}
labels:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
spiffeID: {{ $value.spiffeID | quote }}
{{- with $value.federatesWith }}
federatesWith:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with $value.selectors }}
selectors:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with $value.parentID }}
parentID: {{ . | quote }}
{{- end }}
{{- with $value.dnsNames }}
dnsNames:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with $value.hint }}
hint: {{ . | quote }}
{{- end }}
{{- with $value.x509SVIDTTL }}
x509SVIDTTL: {{ . | quote }}
{{- end }}
{{- with $value.jwtSVIDTTL }}
jwtSVIDTTL: {{ . | quote }}
{{- end }}
{{- with $value.admin }}
admin: {{ . }}
{{- end }}
{{- with $value.downstream }}
downstream: {{ . }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/values.yaml
+46 -14
View File
@@ -445,39 +445,71 @@ controllerManager:
- local-path-storage
identities:
## @param controllerManager.identities.enabled Flag to enable default identities for controller manager
clusterSPIFFEIDs:
# NOTE you can add multiple uniquely named entries to create multiple ClusterSPIFFEID objects. See example below.
default:
## @param controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable this identity for controller manager
enabled: true
## @param controllerManager.identities.spiffeIDTemplate Spiffe ID template for identities
## @param controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate Spiffe ID template for identities
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
## @param controllerManager.identities.podSelector [object] Selector for pods to issue identity
## @param controllerManager.identities.clusterSPIFFEIDs.default.podSelector [object] Selector for pods to issue identity
podSelector: {}
# matchLabels:
# spiffe.io/spiffe-id: "true"
## @param controllerManager.identities.namespaceSelector [object] Selector for namespacs to issue identity
## @param controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector [object] Selector for namespacs to issue identity
namespaceSelector: {}
# matchLabels:
# spiffe.io/spiffe-id: "true"
## @param controllerManager.identities.dnsNameTemplates [array] DNS name template for issued identities
## @param controllerManager.identities.clusterSPIFFEIDs.default.dnsNameTemplates [array] DNS name template for issued identities
dnsNameTemplates: []
# - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local'
## @param controllerManager.identities.federatesWith [array] Other Spire server URLs for identity federation
## @param controllerManager.identities.clusterSPIFFEIDs.default.federatesWith [array] Other Spire server URLs for identity federation
federatesWith: []
# - example.io
# - example.ai
## @param controllerManager.identities.workloadSelectorTemplates [array] Templates to produce selectors that apply to a given workload before it will receive an ID
## @param controllerManager.identities.clusterSPIFFEIDs.default.workloadSelectorTemplates [array] Templates to produce selectors that apply to a given workload before it will receive an ID
workloadSelectorTemplates: []
## @param controllerManager.identities.ttl Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen.
## @param controllerManager.identities.clusterSPIFFEIDs.default.ttl Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen.
ttl: ""
## @param controllerManager.identities.jwtTTL Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen.
## @param controllerManager.identities.clusterSPIFFEIDs.default.jwtTTL Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen.
jwtTTL: ""
## @param controllerManager.identities.admin Indicates any pod matched by this identity will be an admin. Use this with extreme care.
## @param controllerManager.identities.clusterSPIFFEIDs.default.admin Indicates any pod matched by this identity will be an admin. Use this with extreme care.
admin: false
## @param controllerManager.identities.downstream Set if this spire instance is a root server and the workloads are downstream servers.
## @param controllerManager.identities.clusterSPIFFEIDs.default.downstream Set if this spire instance is a root server and the workloads are downstream servers.
downstream: false
## @param controllerManager.identities.autoPopulateDNSNames Auto populate DNS names from services attached to pods
## @param controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames Auto populate DNS names from services attached to pods
autoPopulateDNSNames: false
# You can specify additional ClusterSPIFFEIDs following this example:
# foo:
# labels:
# foo: bar
# spiffeIDTemplate: spiffe://{{ .TrustDomain }}/foo
# namespaceSelector:
# matchLabels:
# foo: bar
## @param controllerManager.identities.clusterStaticEntries Specify ClusterStaticEntry objects.
clusterStaticEntries: {}
# foo:
# labels:
# foo: bar
# parentID: spiffe://example.com/bar
# spiffeID: spiffe://example.com/foo
# selectors:
# - k8s:pod-label:app.kubernetes.io/name:server
## @param controllerManager.identities.clusterFederatedTrustDomains Specify ClusterFederatedTrustDomain objects.
clusterFederatedTrustDomains: {}
# foo:
# labels:
# foo: bar
# bundleEndpointProfile:
# endpointSPIFFEID: spiffe://example.com/foo
# type: https_spiffe
# bundleEndpointURL: https://rootserver.example.com:1234
# trustDomain: example.com
validatingWebhookConfiguration:
## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued
failurePolicy: Fail
@@ -724,4 +756,4 @@ tests:
repository: chainguard/bash
pullPolicy: IfNotPresent
version: ""
tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214
tag: latest@sha256:d8e08cda119684ca08dcfcebdd63cbf3d3ff7c4f8a8effca80b962dddd42438e
charts/spire/charts/tornjak-frontend/Chart.yaml
+1 -1
View File
@@ -4,7 +4,7 @@ description: A Helm chart to deploy Tornjak frontend
type: application
version: 0.1.0
appVersion: "v1.4.0"
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources:
- https://github.com/spiffe/tornjak
icon: https://raw.githubusercontent.com/spiffe/tornjak/main/logos/logo%2Btornjak.2132x1291.png
charts/spire/charts/tornjak-frontend/README.md
+2 -4
View File
@@ -5,7 +5,7 @@
A Helm chart to deploy Tornjak frontend
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
**Homepage:** <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
## Version support
@@ -16,8 +16,6 @@ A Helm chart to deploy Tornjak frontend
| Dependency | Supported Versions |
|:-----------|:-------------------|
| SPIRE | `1.5.3+`, `1.6.x` |
| Tornjak | `1.0.x` |
| Helm | `3.x` |
## Tornjak
@@ -102,4 +100,4 @@ port forwarding. See the chart NOTES output for more details.
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d8e08cda119684ca08dcfcebdd63cbf3d3ff7c4f8a8effca80b962dddd42438e` |
charts/spire/charts/tornjak-frontend/templates/deployment.yaml
+4
View File
@@ -56,6 +56,8 @@ spec:
mountPath: {{ .Values.workingDir }}/node_modules/.cache
- name: env
mountPath: {{ .Values.workingDir }}/build/tmp
- name: logs
mountPath: /opt/app-root/src/.npm/
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
@@ -77,3 +79,5 @@ spec:
emptyDir: {}
- name: env
emptyDir: {}
- name: logs
emptyDir: {}
charts/spire/charts/tornjak-frontend/values.yaml
+1 -1
View File
@@ -158,4 +158,4 @@ tests:
repository: chainguard/bash
pullPolicy: IfNotPresent
version: ""
tag: latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214
tag: latest@sha256:d8e08cda119684ca08dcfcebdd63cbf3d3ff7c4f8a8effca80b962dddd42438e
charts/spire/templates/_spire-lib.tpl
+1 -1
View File
@@ -20,7 +20,7 @@
{{- else if ne (len .Values.jwtIssuer) 0 }}
{{- .Values.jwtIssuer }}
{{- else }}
{{- printf "oidc-discovery.%s" (include "spire-lib.trust-domain" .) }}
{{- printf "https://oidc-discovery.%s" (include "spire-lib.trust-domain" .) }}
{{- end }}
{{- end }}
examples/external-mysql/README.md
+1 -1
View File
@@ -15,7 +15,7 @@ Next, edit values.yaml with your settings. Check it into your git repo if using
Then, deploy the chart pointing at your mysql instance like so:
```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml --set "spire-server.dataStore.sql.password=${DBPW}"
helm upgrade --install --namespace spire-server spire charts/spire -f examples/external-mysql/values.yaml --set "spire-server.dataStore.sql.password=${DBPW}"
```
See the [production example](../production) for production recommendations.
examples/external-postgresql/README.md
+1 -1
View File
@@ -15,7 +15,7 @@ Next, edit values.yaml with your settings. Check it into your git repo if using
Then, deploy the chart pointing at your postgresql instance like so:
```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml --set "spire-server.dataStore.sql.password=${DBPW}"
helm upgrade --install --namespace spire-server spire charts/spire -f examples/external-postgresql/values.yaml --set "spire-server.dataStore.sql.password=${DBPW}"
```
examples/nested/README.md
+10
View File
@@ -0,0 +1,10 @@
# Possible Nesting Configurations
There are multiple ways of configuring the chart depending on what you want to use nesting for.
## Nesting across Kubernetes clusters:
![Multiple Kubernetes Cluster](./multicluster.png)
## Nesting within a Kubernetes cluster:
![Single Hardened](./singlehardened.png)
examples/nested/multicluster.dot
+61
View File
@@ -0,0 +1,61 @@
digraph G {
subgraph cluster_root {
label="Cluster: Root K8S";
subgraph cluster_root_release {
label="Helm Release: Namespace=spire-root Name=spire"
spireRoot [label="Root Spire Server"];
}
}
subgraph cluster_nested1 {
label="Cluster: K8S Workload 1";
subgraph cluster_nested1_release {
label="Helm Release: Namespace=spire-server Name=spire"
subgraph cluster_nested1_ns1 {
label="Namespace: spire-system"
spireUpstreamAgent1 [label="Upstream Spire Agent/CSI"];
}
subgraph cluster_nested1_ns2 {
label="Namespace: spire-server"
spireServerNested1 [label="Nested Spire Server"];
}
subgraph cluster_nested1_ns3 {
label="Namespace: spire-system"
spireDownstreamAgent1 [label="Downstream Spire Agent/CSI"];
}
}
subgraph cluster_nested1_user {
label="Namespace: user"
userWorkload1 [label="User Workload"];
}
}
subgraph cluster_nested2 {
label="Cluster: K8S Workload 2";
subgraph cluster_nested2_release {
label="Helm Release: Namespace=spire-server Name=spire"
subgraph cluster_nested2_ns1 {
label="Namespace: spire-system"
spireUpstreamAgent2 [label="Upstream Spire Agent/CSI"];
}
subgraph cluster_nested2_ns2 {
label="Namespace: spire-server"
spireServerNested2 [label="Nested Spire Server"];
}
subgraph cluster_nested2_ns3 {
label="Namespace: spire-system"
spireDownstreamAgent2 [label="Downstream Spire Agent/CSI"];
}
}
subgraph cluster_nested2_user {
label="Namespace: user"
userWorkload2 [label="Other User Workload"];
}
}
spireRoot -> spireUpstreamAgent1;
spireRoot -> spireUpstreamAgent2;
spireUpstreamAgent1 -> spireServerNested1;
spireServerNested1 -> spireDownstreamAgent1;
spireDownstreamAgent1 -> userWorkload1;
spireUpstreamAgent2 -> spireServerNested2;
spireServerNested2 -> spireDownstreamAgent2;
spireDownstreamAgent2 -> userWorkload2;
}
examples/nested/multicluster.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 127 KiB

examples/nested/singlehardened.dot
+55
View File
@@ -0,0 +1,55 @@
digraph G {
subgraph cluster_baremetal {
label="(Bare Metal|Virtual) Node"
spireDownstreamAgent3 [label="Downstream Spire Agent"];
userWorkload3 [label="External User Workload"];
}
subgraph cluster_k8s {
label="Cluster: K8S";
subgraph cluster_root_release {
label="Helm Release: Namespace=spire-root Name=spire";
subgraph cluster_ns_root {
label="Namespace: spire-root"
spireRoot [label="Root Spire Server"];
}
subgraph cluster_ns_1_system {
label="Namespace: spire-system"
spireUpstreamAgent1 [label="Upstream Spire Agent/CSI"];
}
}
subgraph cluster_nested1_release {
label="Helm Release: Namespace=spire-server Name=spire"
subgraph cluster_ns_nested_server {
label="Namespace: spire-server";
spireServerNested1 [label="Internal Nested Spire Server"];
}
subgraph cluster_ns_nested_system {
label="Namespace: spire-system";
spireDownstreamAgent1 [label="Downstream Spire Agent/CSI"];
}
}
subgraph cluster_ns_nested_system {
label="Namespace: user";
userWorkload1 [label="User Workload"];
}
subgraph cluster_ns_nested2_system {
label="Namespace: user-other";
userWorkload2 [label="Other User Workload"];
}
subgraph cluster_nested3_release {
label="Helm Release: Namespace=spire-external Name=spire"
subgraph cluster_ns_nested2_system {
label="Namespace: spire-external";
spireServerNested2 [label="External Nested Spire Server"];
}
}
spireRoot -> spireUpstreamAgent1;
spireUpstreamAgent1 -> spireServerNested1;
spireServerNested1 -> spireDownstreamAgent1;
spireDownstreamAgent1 -> userWorkload1;
spireDownstreamAgent1 -> userWorkload2;
spireUpstreamAgent1 -> spireServerNested2;
spireServerNested2 -> spireDownstreamAgent3;
spireDownstreamAgent3 -> userWorkload3;
}
}
examples/nested/singlehardened.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 108 KiB

examples/nested/values.yaml
+2
View File
@@ -11,6 +11,8 @@ spire-server:
controllerManager:
enabled: true
identities:
clusterSPIFFEIDs:
default:
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/k8s/{{ .ClusterName }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
spiffe-oidc-discovery-provider:
examples/openshift/openshift-values.yaml
-8
View File
@@ -27,12 +27,6 @@ spire-agent:
runAsUser: null
runAsGroup: null
fsGroup: null
# Talk from the agent to kubelet based on hostname instead of localhost
extraEnvVars:
- name: MY_NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
upstream-spire-agent:
podSecurityContext:
@@ -58,8 +52,6 @@ tornjak-frontend:
fsGroup: null
spiffe-csi-driver:
csiDriverLabels:
security.openshift.io/csi-ephemeral-volume-profile: restricted
initContainers:
- terminationMessagePath: /dev/termination-log
name: set-context
examples/production/README.md
+9 -9
View File
@@ -12,27 +12,27 @@ kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restri
Update the `example-your-values.yaml` file with your values, then:
```shell
helm upgrade --install --namespace spire-server spire ../../charts/spire \
-f values.yaml -f example-your-values.yaml --render-subchart-notes
helm upgrade --install --namespace spire-server spire charts/spire \
-f examples/production/values.yaml -f examples/production/example-your-values.yaml --render-subchart-notes
```
If your using ingress-nginx and want to expose the spiffe oidc discovery provider outside the
cluster, add the following to the end of the helm upgrade example:
```shell
-f values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml
-f examples/production/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml
```
If you want to expose your spire-server outside of Kubernetes and are using ingress-nginx, add following values file when running `helm template/install/upgrade`.
```shell
-f values-expose-spire-server-ingress-nginx.yaml
-f examples/production/values-expose-spire-server-ingress-nginx.yaml
```
For example:
```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-spire-server-ingress-nginx.yaml
helm upgrade --install --namespace spire-server spire charts/spire -f examples/production/values.yaml -f examples/production/values-expose-spire-server-ingress-nginx.yaml
```
If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx
@@ -42,25 +42,25 @@ you have two options as described here:
If you chose profile https_web, use:
```shell
-f values-expose-federation-https-web-ingress-nginx.yaml
-f examples/production/values-expose-federation-https-web-ingress-nginx.yaml
```
For example:
```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-web-ingress-nginx.yaml
helm upgrade --install --namespace spire-server spire charts/spire -f examples/production/values.yaml -f examples/production/values-expose-federation-https-web-ingress-nginx.yaml
```
If you chose profile https_spiffe, use:
```shell
-f values-expose-federation-https-spiffe-ingress-nginx.yaml
-f examples/production/values-expose-federation-https-spiffe-ingress-nginx.yaml
```
For example:
```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-spiffe-ingress-nginx.yaml
helm upgrade --install --namespace spire-server spire charts/spire -f examples/production/values.yaml -f examples/production/values-expose-federation-https-spiffe-ingress-nginx.yaml
```
See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
examples/production/run-tests.sh
+1 -1
View File
@@ -2,7 +2,7 @@
set -xe
UPGRADE_VERSION=v0.14.0
UPGRADE_VERSION=v0.15.1
UPGRADE_REPO=https://spiffe.github.io/helm-charts-hardened
SCRIPT="$(readlink -f "$0")"
examples/production/values.yaml
+1 -1
View File
@@ -124,7 +124,7 @@ tornjak-frontend:
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
readOnlyRootFilesystem: false
readOnlyRootFilesystem: true
capabilities:
drop: [ALL]
seccompProfile:
examples/tornjak/README.md
+5 -5
View File
@@ -12,11 +12,11 @@ kubectl create namespace "spire-server"
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
# deploy SPIRE with Tornjak enabled
helm upgrade --install --namespace spire-server \
--values ../production/values.yaml \
--values ./values.yaml \
--render-subchart-notes \
spire ../../charts/spire
helm upgrade --install --namespace spire-server spire charts/spire \
--values examples/production/values.yaml \
--values examples/tornjak/values.yaml \
--render-subchart-notes
# test the Tornjak deployment
helm test spire -n spire-server
release-chart.sh
+37 -12
View File
@@ -6,12 +6,12 @@
##
## Usage example(s):
##
## ./__PROG__ --chart spire --current-version 0.15.1 --new-version 0.16.0
## ./__PROG__ --chart spire --new-version 0.16.0
## ./__PROG__ --chart spire-crds --new-version 0.3.0
##
## Options:
## --help Show this help message
## --chart The chart to release
## --current-version The current version number
## --new-version The new version number
## --dry-run Will not actually submit the PR
##
@@ -39,6 +39,24 @@ function print_error_and_exit {
exit 1
}
function unreleased_changes_other_charts {
for chart in "$@" ; do
latest_tag="$(git --no-pager tag --list "${chart}-[0-9]*.[0-9]*.[0-9]*" | sort -V | tail -n 1)"
changes="$(git --no-pager log "${latest_tag}..HEAD" --pretty=format:'* %h %s' "charts/${chart}")"
if [ -n "${changes}" ] ; then
echo "### Unreleased changes ${chart}"
echo
echo "${changes}"
echo
echo Please ensure you bump above charts as well before merging main into the release branch.
echo
echo '```shell'
echo ./release-chart.sh --chart "${chart}" --new-version ………
echo '```'
fi
done
}
while (("$#")); do
case "$1" in
--help)
@@ -49,10 +67,6 @@ while (("$#")); do
chart=$2
shift 2
;;
--current-version)
current_version=$2
shift 2
;;
--new-version)
new_version=$2
shift 2
@@ -86,11 +100,6 @@ if [ -z "$chart" ]; then
print_error_and_exit 'chart option is missing'
fi
if [ -z "$current_version" ]; then
usage
print_error_and_exit 'current-version option is missing'
fi
if [ -z "$new_version" ]; then
usage
print_error_and_exit 'new-version option is missing'
@@ -102,21 +111,37 @@ fi
branch_name="bump-${chart}-version"
git fetch --tags
git checkout main
git pull
git checkout --track -B "${branch_name}" main
current_version="$(grep '^version:' "charts/${chart}/Chart.yaml" | awk '{print $2}')"
commits_since_previous_release="$(git log "${chart}-${current_version}..HEAD" --pretty=format:'* %h %s' "charts/${chart}")"
"${SED}" -i "s/version: ${current_version}/version: ${new_version}/" "charts/${chart}/Chart.yaml"
"${SED}" -i "s/${current_version}/${new_version}/" "charts/${chart}/README.md"
"${SED}" -i "s/${current_version}/${new_version}/g" "charts/${chart}/README.md"
git add "charts/${chart}/"{Chart.yaml,README.md}
git commit -m "Bump ${chart} Helm Chart version from ${current_version} to ${new_version}" \
-m "${commits_since_previous_release}" \
-s
git push -u origin --force-with-lease
other_charts=()
for chart_dir in charts/*/; do
chart_name=$(basename "$chart_dir")
if [[ "$chart_name" != "$chart" ]]; then
other_charts+=("$chart_name")
fi
done
cat <<EOF | gh pr create --base main --body-file - "${dry_run}"
Please review the below changelog to ensure this matches up with the semantic version being applied.
> [!Important]
> Before merging to the release branch, ensure all other changed charts also have their version number bumped.
$(unreleased_changes_other_charts "${other_charts[@]}")
> [!Note]
> **Maintainers** ensure to run following after merging this PR to trigger the release workflow:
>
tests/go.mod
+4 -4
View File
@@ -3,7 +3,7 @@ module github.com/spiffe/helm-charts/tests
go 1.20
require (
github.com/onsi/ginkgo/v2 v2.13.0
github.com/onsi/ginkgo/v2 v2.13.2
github.com/onsi/gomega v1.30.0
helm.sh/helm/v3 v3.13.2
)
@@ -16,7 +16,7 @@ require (
github.com/cyphar/filepath-securejoin v0.2.4 // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/emicklei/go-restful/v3 v3.10.1 // indirect
github.com/go-logr/logr v1.2.4 // indirect
github.com/go-logr/logr v1.3.0 // indirect
github.com/go-openapi/jsonpointer v0.19.6 // indirect
github.com/go-openapi/jsonreference v0.20.2 // indirect
github.com/go-openapi/swag v0.22.3 // indirect
@@ -48,11 +48,11 @@ require (
golang.org/x/crypto v0.14.0 // indirect
golang.org/x/net v0.17.0 // indirect
golang.org/x/oauth2 v0.8.0 // indirect
golang.org/x/sys v0.13.0 // indirect
golang.org/x/sys v0.14.0 // indirect
golang.org/x/term v0.13.0 // indirect
golang.org/x/text v0.13.0 // indirect
golang.org/x/time v0.3.0 // indirect
golang.org/x/tools v0.12.0 // indirect
golang.org/x/tools v0.14.0 // indirect
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/protobuf v1.30.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
tests/go.sum
+9 -9
View File
@@ -20,8 +20,8 @@ github.com/emicklei/go-restful/v3 v3.10.1 h1:rc42Y5YTp7Am7CS630D7JmhRjq4UlEUuEKf
github.com/emicklei/go-restful/v3 v3.10.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE=
github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
github.com/go-logr/logr v1.3.0 h1:2y3SDp0ZXuc6/cjLSZ+Q3ir+QB9T/iG5yYRXqsagWSY=
github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
@@ -85,8 +85,8 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4=
github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o=
github.com/onsi/ginkgo/v2 v2.13.2 h1:Bi2gGVkfn6gQcjNjZJVO8Gf0FHzMPf2phUei9tejVMs=
github.com/onsi/ginkgo/v2 v2.13.2/go.mod h1:XStQ8QcGwLyF4HdfcZB8SFOS/MWCgDuXMSBe6zrvLgM=
github.com/onsi/gomega v1.30.0 h1:hvMK7xYz4D3HapigLTeGdId/NcfQx1VHMJc60ew99+8=
github.com/onsi/gomega v1.30.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -132,7 +132,7 @@ golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
golang.org/x/mod v0.13.0 h1:I/DsJXRlw/8l/0c24sM9yb0T4z9liZTduXvdAWYiysY=
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -158,8 +158,8 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.14.0 h1:Vz7Qs629MkJkGyHxUlRHizWJRG2j8fbQKjELVSNhy7Q=
golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
@@ -179,8 +179,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
golang.org/x/tools v0.12.0 h1:YW6HUoUmYBpwSgyaGaZq1fHjrBjX1rlpZ54T6mu2kss=
golang.org/x/tools v0.12.0/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM=
golang.org/x/tools v0.14.0 h1:jvNa2pY0M4r62jkRQ6RwEZZyPcymeL9XZMLBbV7U2nc=
golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=