diff --git a/charts/spire/Chart.lock b/charts/spire/Chart.lock deleted file mode 100644 index 88436fe..0000000 --- a/charts/spire/Chart.lock +++ /dev/null @@ -1,18 +0,0 @@ -dependencies: -- name: spire-server - repository: file://./charts/spire-server - version: 0.1.0 -- name: spire-agent - repository: file://./charts/spire-agent - version: 0.1.0 -- name: spiffe-csi-driver - repository: file://./charts/spiffe-csi-driver - version: 0.1.0 -- name: spiffe-oidc-discovery-provider - repository: file://./charts/spiffe-oidc-discovery-provider - version: 0.1.0 -- name: tornjak-frontend - repository: file://./charts/tornjak-frontend - version: 0.1.0 -digest: sha256:0119361a3dd54d1cf088f299ce9adbee55a96c832cb675f57e5e115acf7b17c7 -generated: "2023-07-19T19:13:59.722106+02:00" diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 46a2532..c21d945 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -3,8 +3,8 @@ name: spire description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.11.0 -appVersion: "1.7.0" +version: 0.11.1 +appVersion: "1.7.1" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index 98ba717..549ca0f 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -2,7 +2,7 @@ -![Version: 0.11.0](https://img.shields.io/badge/Version-0.11.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) +![Version: 0.11.1](https://img.shields.io/badge/Version-0.11.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. @@ -156,6 +156,7 @@ Now you can interact with the Spire agent socket from your own application. The | spiffe-csi-driver.tolerations | list | `[]` | | | spiffe-oidc-discovery-provider.affinity | object | `{}` | | | spiffe-oidc-discovery-provider.agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket | +| spiffe-oidc-discovery-provider.annotations | object | `{}` | Annotations for the deployment | | spiffe-oidc-discovery-provider.autoscaling.enabled | bool | `false` | | | spiffe-oidc-discovery-provider.autoscaling.maxReplicas | int | `5` | | | spiffe-oidc-discovery-provider.autoscaling.minReplicas | int | `1` | | @@ -283,6 +284,7 @@ Now you can interact with the Spire agent socket from your own application. The | spire-agent.waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag | | spire-agent.waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | spire-agent.waitForIt.resources | object | `{}` | | +| spire-agent.workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio | | spire-agent.workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped | | spire-agent.workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor | | spire-server.affinity | object | `{}` | | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml index 5bd5c3e..6b572f6 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml @@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider description: A Helm chart to install the SPIFFE OIDC discovery provider. type: application version: 0.1.0 -appVersion: "1.7.0" +appVersion: "1.7.1" keywords: ["spiffe", "oidc"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index a4b0917..e477695 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -2,7 +2,7 @@ -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) A Helm chart to install the SPIFFE OIDC discovery provider. @@ -31,6 +31,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. |-----|------|---------|-------------| | affinity | object | `{}` | | | agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket | +| annotations | object | `{}` | Annotations for the deployment | | autoscaling.enabled | bool | `false` | | | autoscaling.maxReplicas | int | `5` | | | autoscaling.minReplicas | int | `1` | | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml index 4110a83..b5aaa90 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -6,6 +6,10 @@ metadata: namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }} labels: {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} + annotations: + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} spec: {{- if not .Values.autoscaling.enabled }} replicas: {{ .Values.replicaCount }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 07d683a..02d5cc6 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -12,6 +12,9 @@ replicaCount: 1 namespaceOverride: "" +# -- Annotations for the deployment +annotations: {} + image: # -- The OCI registry to pull the image from registry: ghcr.io diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml index 5b585f3..71fbc93 100644 --- a/charts/spire/charts/spire-agent/Chart.yaml +++ b/charts/spire/charts/spire-agent/Chart.yaml @@ -3,7 +3,7 @@ name: spire-agent description: A Helm chart to install the SPIRE agent. type: application version: 0.1.0 -appVersion: "1.7.0" +appVersion: "1.7.1" keywords: ["spiffe", "spire-agent"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index fc4e18e..76ffe7f 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -2,7 +2,7 @@ -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) A Helm chart to install the SPIRE agent. @@ -85,6 +85,7 @@ A Helm chart to install the SPIRE agent. | waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag | | waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | waitForIt.resources | object | `{}` | | +| workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio | | workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped | | workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index aa545fc..9adfcc7 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -30,6 +30,7 @@ plugins: # Minikube does not have a cert in the cluster CA bundle that # can authenticate the kubelet cert, so skip validation. skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }} + disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }} {{- if .Values.workloadAttestors.unix.enabled }} - unix: diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 9653d91..06b0bae 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -137,6 +137,8 @@ workloadAttestors: k8s: # -- If true, kubelet certificate verification is skipped skipKubeletVerification: true + # -- Set to true if using holdApplicationUntilProxyStarts in Istio + disableContainerSelectors: false telemetry: prometheus: diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml index 39460ad..219d6ea 100644 --- a/charts/spire/charts/spire-server/Chart.yaml +++ b/charts/spire/charts/spire-server/Chart.yaml @@ -3,7 +3,7 @@ name: spire-server description: A Helm chart to install the SPIRE server. type: application version: 0.1.0 -appVersion: "1.7.0" +appVersion: "1.7.1" keywords: ["spiffe", "spire-server", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index f0208c3..b63c970 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -2,7 +2,7 @@ -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) A Helm chart to install the SPIRE server. diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 431adb3..9d1dd2c 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -78,7 +78,7 @@ plugins: UpstreamAuthority: - cert-manager: plugin_data: - issuer_name: {{ default (include "spire-server.fullname" $root) .issuer_name }} + issuer_name: {{ default (include "spire-server.fullname" $root) .issuer_name }}-ca issuer_kind: {{ .issuer_kind | quote }} issuer_group: {{ .issuer_group | quote }} namespace: {{ default $root.Release.Namespace .namespace | quote }} diff --git a/charts/spire/charts/spire-server/templates/issuer.yaml b/charts/spire/charts/spire-server/templates/issuer.yaml index 4ce6c25..1a9afbd 100644 --- a/charts/spire/charts/spire-server/templates/issuer.yaml +++ b/charts/spire/charts/spire-server/templates/issuer.yaml @@ -1,12 +1,13 @@ {{- with .Values.upstreamAuthority.certManager }} {{ if and .enabled .ca.create }} +{{ $issuerName := printf "%s-selfsigned" (default (include "spire-server.fullname" $) .issuer_name) }} {{/* Configuring CA Issuer: https://cert-manager.io/docs/configuration/ca/ */}} apiVersion: cert-manager.io/v1 kind: Issuer metadata: - name: {{ include "spire-server.fullname" $ }}-selfsigned + name: {{ $issuerName }} namespace: {{ include "spire-server.namespace" $ }} labels: {{- include "spire-server.labels" $ | nindent 4}} @@ -38,14 +39,14 @@ spec: renewBefore: {{ . }} {{- end }} issuerRef: - name: {{ include "spire-server.fullname" $ }}-selfsigned + name: {{ $issuerName }} kind: Issuer group: cert-manager.io --- apiVersion: cert-manager.io/v1 kind: Issuer metadata: - name: {{ include "spire-server.fullname" $ }} + name: {{ include "spire-server.fullname" $ }}-ca namespace: {{ include "spire-server.namespace" $ }} spec: ca: diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 4a5e148..2039642 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -55,7 +55,7 @@ spec: - --timeout=3m - --for=condition=ready - issuer - - {{ include "spire-server.fullname" $ }} + - {{ include "spire-server.fullname" $ }}-ca imagePullPolicy: {{ .Values.tools.kubectl.image.pullPolicy }} {{- end }} {{- if gt (len .Values.initContainers) 0 }}