Update SPIRE to 1.8.7 (#194)
Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
@@ -4,7 +4,7 @@ description: >
|
|||||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||||
type: application
|
type: application
|
||||||
version: 0.16.0
|
version: 0.16.0
|
||||||
appVersion: "1.8.5"
|
appVersion: "1.8.7"
|
||||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||||
sources:
|
sources:
|
||||||
|
|||||||
@@ -1,6 +1,6 @@
|
|||||||
# spire
|
# spire
|
||||||
|
|
||||||
  
|
  
|
||||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||||
|
|
||||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider
|
|||||||
description: A Helm chart to install the SPIFFE OIDC discovery provider.
|
description: A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||||
type: application
|
type: application
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
appVersion: "1.8.5"
|
appVersion: "1.8.7"
|
||||||
keywords: ["spiffe", "oidc"]
|
keywords: ["spiffe", "oidc"]
|
||||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||||
sources:
|
sources:
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ name: spire-agent
|
|||||||
description: A Helm chart to install the SPIRE agent.
|
description: A Helm chart to install the SPIRE agent.
|
||||||
type: application
|
type: application
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
appVersion: "1.8.5"
|
appVersion: "1.8.7"
|
||||||
keywords: ["spiffe", "spire-agent"]
|
keywords: ["spiffe", "spire-agent"]
|
||||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||||
sources:
|
sources:
|
||||||
|
|||||||
@@ -25,77 +25,78 @@ A Helm chart to install the SPIRE agent.
|
|||||||
|
|
||||||
### Chart parameters
|
### Chart parameters
|
||||||
|
|
||||||
| Name | Description | Value |
|
| Name | Description | Value |
|
||||||
| ------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
| ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
| `image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
||||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||||
| `nameOverride` | Name override | `""` |
|
| `nameOverride` | Name override | `""` |
|
||||||
| `namespaceOverride` | Namespace override | `""` |
|
| `namespaceOverride` | Namespace override | `""` |
|
||||||
| `fullnameOverride` | Fullname override | `""` |
|
| `fullnameOverride` | Fullname override | `""` |
|
||||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||||
| `serviceAccount.name` | The name of the service account to use. | `""` |
|
| `serviceAccount.name` | The name of the service account to use. | `""` |
|
||||||
| `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` |
|
| `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` |
|
||||||
| `podAnnotations` | Annotations to add to pods | `{}` |
|
| `podAnnotations` | Annotations to add to pods | `{}` |
|
||||||
| `podSecurityContext` | Pod security context | `{}` |
|
| `podSecurityContext` | Pod security context | `{}` |
|
||||||
| `securityContext` | Security context | `{}` |
|
| `securityContext` | Security context | `{}` |
|
||||||
| `resources` | Resource requests and limits | `{}` |
|
| `resources` | Resource requests and limits | `{}` |
|
||||||
| `nodeSelector` | Node selector | `{}` |
|
| `nodeSelector` | Node selector | `{}` |
|
||||||
| `tolerations` | List of tolerations | `[]` |
|
| `tolerations` | List of tolerations | `[]` |
|
||||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||||
| `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` |
|
| `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` |
|
||||||
| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` |
|
| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||||
| `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` |
|
| `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` |
|
||||||
| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `pem` |
|
| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `pem` |
|
||||||
| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` |
|
| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` |
|
||||||
| `server.address` | Address for Spire server | `""` |
|
| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` |
|
||||||
| `server.port` | Port number for Spire server | `8081` |
|
| `server.address` | Address for Spire server | `""` |
|
||||||
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
| `server.port` | Port number for Spire server | `8081` |
|
||||||
| `healthChecks.port` | override the host port used for health checking | `9982` |
|
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
||||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
|
| `healthChecks.port` | override the host port used for health checking | `9982` |
|
||||||
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
|
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
|
||||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
|
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
|
||||||
| `readinessProbe.periodSeconds` | Period seconds for probe | `60` |
|
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
|
||||||
| `waitForIt.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
| `readinessProbe.periodSeconds` | Period seconds for probe | `60` |
|
||||||
| `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` |
|
| `waitForIt.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||||
| `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` |
|
||||||
| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9500241a8a6a5912ded07445991b9d3a0834beef810b10c302af593aee1b33dc` |
|
| `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `waitForIt.resources` | Resource requests and limits | `{}` |
|
| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9500241a8a6a5912ded07445991b9d3a0834beef810b10c302af593aee1b33dc` |
|
||||||
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
| `waitForIt.resources` | Resource requests and limits | `{}` |
|
||||||
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||||
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
|
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:099e4b9adb13a94e6f25d6bb9bfe69fd5ba734a615e62bb0e1efba6650c6b23d` |
|
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
|
||||||
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:099e4b9adb13a94e6f25d6bb9bfe69fd5ba734a615e62bb0e1efba6650c6b23d` |
|
||||||
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
|
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||||
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
|
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
|
||||||
| `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` |
|
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
|
||||||
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
|
| `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` |
|
||||||
| `sds.enabled` | Enables Envoy SDS configuration | `false` |
|
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
|
||||||
| `sds.defaultSvidName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` |
|
| `sds.enabled` | Enables Envoy SDS configuration | `false` |
|
||||||
| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` |
|
| `sds.defaultSvidName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` |
|
||||||
| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` |
|
| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` |
|
||||||
| `sds.disableSpiffeCertValidation` | Disable Envoy SDS custom validation | `false` |
|
| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` |
|
||||||
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
| `sds.disableSpiffeCertValidation` | Disable Envoy SDS custom validation | `false` |
|
||||||
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
|
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
||||||
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
|
||||||
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
|
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
||||||
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
|
||||||
| `kubeletConnectByHostname` | If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
|
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||||
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
| `kubeletConnectByHostname` | If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
|
||||||
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||||
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
|
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||||
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
|
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
|
||||||
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` |
|
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
|
||||||
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
|
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` |
|
||||||
| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` |
|
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
|
||||||
| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` |
|
| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` |
|
||||||
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
|
| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` |
|
||||||
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
|
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
|
||||||
| `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` |
|
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
|
||||||
| `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` |
|
| `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` |
|
||||||
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
| `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` |
|
||||||
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
|
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
||||||
| `experimental.featureFlags` | List of developer feature flags | `[]` |
|
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
|
||||||
|
| `experimental.featureFlags` | List of developer feature flags | `[]` |
|
||||||
|
|||||||
@@ -32,6 +32,9 @@ agent:
|
|||||||
trust_bundle_path: "/run/spire/bundle/bundle.crt"
|
trust_bundle_path: "/run/spire/bundle/bundle.crt"
|
||||||
{{- end }}
|
{{- end }}
|
||||||
trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
|
trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
|
||||||
|
{{- with .Values.availabilityTarget }}
|
||||||
|
availability_target: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
{{- if .Values.sds.enabled }}
|
{{- if .Values.sds.enabled }}
|
||||||
sds:
|
sds:
|
||||||
default_svid_name: {{ .Values.sds.defaultSvidName | quote }}
|
default_svid_name: {{ .Values.sds.defaultSvidName | quote }}
|
||||||
|
|||||||
@@ -89,6 +89,8 @@ trustBundleURL: ""
|
|||||||
trustBundleFormat: pem
|
trustBundleFormat: pem
|
||||||
## @param bundleConfigMap Configmap name for Spire bundle
|
## @param bundleConfigMap Configmap name for Spire bundle
|
||||||
bundleConfigMap: spire-bundle
|
bundleConfigMap: spire-bundle
|
||||||
|
## @param availabilityTarget The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h.
|
||||||
|
availabilityTarget: ""
|
||||||
|
|
||||||
## @skip upstream
|
## @skip upstream
|
||||||
upstream: false
|
upstream: false
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ name: spire-server
|
|||||||
description: A Helm chart to install the SPIRE server.
|
description: A Helm chart to install the SPIRE server.
|
||||||
type: application
|
type: application
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
appVersion: "1.8.5"
|
appVersion: "1.8.7"
|
||||||
keywords: ["spiffe", "spire-server", "spire-controller-manager"]
|
keywords: ["spiffe", "spire-server", "spire-controller-manager"]
|
||||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||||
sources:
|
sources:
|
||||||
|
|||||||
Reference in New Issue
Block a user