From b0d9a736fe75b748e5e9eb95ddfa8d553dbdb978 Mon Sep 17 00:00:00 2001 From: Drew Wells Date: Wed, 2 Aug 2023 16:22:59 -0500 Subject: [PATCH 1/6] issuer naming should respect issuer_name override (#378) align the spire-server configmap and issuer CR naming --------- Signed-off-by: Drew Wells Signed-off-by: Faisal Memon Co-authored-by: Faisal Memon --- charts/spire/charts/spire-server/templates/configmap.yaml | 2 +- charts/spire/charts/spire-server/templates/issuer.yaml | 7 ++++--- .../spire/charts/spire-server/templates/statefulset.yaml | 2 +- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 431adb3..9d1dd2c 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -78,7 +78,7 @@ plugins: UpstreamAuthority: - cert-manager: plugin_data: - issuer_name: {{ default (include "spire-server.fullname" $root) .issuer_name }} + issuer_name: {{ default (include "spire-server.fullname" $root) .issuer_name }}-ca issuer_kind: {{ .issuer_kind | quote }} issuer_group: {{ .issuer_group | quote }} namespace: {{ default $root.Release.Namespace .namespace | quote }} diff --git a/charts/spire/charts/spire-server/templates/issuer.yaml b/charts/spire/charts/spire-server/templates/issuer.yaml index 4ce6c25..1a9afbd 100644 --- a/charts/spire/charts/spire-server/templates/issuer.yaml +++ b/charts/spire/charts/spire-server/templates/issuer.yaml @@ -1,12 +1,13 @@ {{- with .Values.upstreamAuthority.certManager }} {{ if and .enabled .ca.create }} +{{ $issuerName := printf "%s-selfsigned" (default (include "spire-server.fullname" $) .issuer_name) }} {{/* Configuring CA Issuer: https://cert-manager.io/docs/configuration/ca/ */}} apiVersion: cert-manager.io/v1 kind: Issuer metadata: - name: {{ include "spire-server.fullname" $ }}-selfsigned + name: {{ $issuerName }} namespace: {{ include "spire-server.namespace" $ }} labels: {{- include "spire-server.labels" $ | nindent 4}} @@ -38,14 +39,14 @@ spec: renewBefore: {{ . }} {{- end }} issuerRef: - name: {{ include "spire-server.fullname" $ }}-selfsigned + name: {{ $issuerName }} kind: Issuer group: cert-manager.io --- apiVersion: cert-manager.io/v1 kind: Issuer metadata: - name: {{ include "spire-server.fullname" $ }} + name: {{ include "spire-server.fullname" $ }}-ca namespace: {{ include "spire-server.namespace" $ }} spec: ca: diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 4a5e148..2039642 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -55,7 +55,7 @@ spec: - --timeout=3m - --for=condition=ready - issuer - - {{ include "spire-server.fullname" $ }} + - {{ include "spire-server.fullname" $ }}-ca imagePullPolicy: {{ .Values.tools.kubectl.image.pullPolicy }} {{- end }} {{- if gt (len .Values.initContainers) 0 }} From 99c0f148ac3685caf72bcd1bd29f4e9ab578504c Mon Sep 17 00:00:00 2001 From: Drew Wells Date: Mon, 31 Jul 2023 12:54:01 -0500 Subject: [PATCH 2/6] support annotations so oidc can be annotated (#391) Signed-off-by: Drew Wells Signed-off-by: Drew Wells Co-authored-by: Faisal Memon --- charts/spire/README.md | 1 + charts/spire/charts/spiffe-oidc-discovery-provider/README.md | 1 + .../spiffe-oidc-discovery-provider/templates/deployment.yaml | 4 ++++ .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 3 +++ 4 files changed, 9 insertions(+) diff --git a/charts/spire/README.md b/charts/spire/README.md index 98ba717..f6f41a6 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -156,6 +156,7 @@ Now you can interact with the Spire agent socket from your own application. The | spiffe-csi-driver.tolerations | list | `[]` | | | spiffe-oidc-discovery-provider.affinity | object | `{}` | | | spiffe-oidc-discovery-provider.agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket | +| spiffe-oidc-discovery-provider.annotations | object | `{}` | Annotations for the deployment | | spiffe-oidc-discovery-provider.autoscaling.enabled | bool | `false` | | | spiffe-oidc-discovery-provider.autoscaling.maxReplicas | int | `5` | | | spiffe-oidc-discovery-provider.autoscaling.minReplicas | int | `1` | | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index a4b0917..4b1c3ae 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -31,6 +31,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. |-----|------|---------|-------------| | affinity | object | `{}` | | | agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket | +| annotations | object | `{}` | Annotations for the deployment | | autoscaling.enabled | bool | `false` | | | autoscaling.maxReplicas | int | `5` | | | autoscaling.minReplicas | int | `1` | | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml index 4110a83..b5aaa90 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -6,6 +6,10 @@ metadata: namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }} labels: {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} + annotations: + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} spec: {{- if not .Values.autoscaling.enabled }} replicas: {{ .Values.replicaCount }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 07d683a..02d5cc6 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -12,6 +12,9 @@ replicaCount: 1 namespaceOverride: "" +# -- Annotations for the deployment +annotations: {} + image: # -- The OCI registry to pull the image from registry: ghcr.io From 604743d0bfa1aecaa0978df811910302983a5694 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Fri, 28 Jul 2023 14:01:26 -0700 Subject: [PATCH 3/6] Update spire to 1.7.1 (#412) Signed-off-by: Kevin Fox --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml | 2 +- charts/spire/charts/spiffe-oidc-discovery-provider/README.md | 2 +- charts/spire/charts/spire-agent/Chart.yaml | 2 +- charts/spire/charts/spire-agent/README.md | 2 +- charts/spire/charts/spire-server/Chart.yaml | 2 +- charts/spire/charts/spire-server/README.md | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 46a2532..2558687 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -4,7 +4,7 @@ description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application version: 0.11.0 -appVersion: "1.7.0" +appVersion: "1.7.1" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index f6f41a6..2e762b7 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -2,7 +2,7 @@ -![Version: 0.11.0](https://img.shields.io/badge/Version-0.11.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) +![Version: 0.11.0](https://img.shields.io/badge/Version-0.11.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml index 5bd5c3e..6b572f6 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml @@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider description: A Helm chart to install the SPIFFE OIDC discovery provider. type: application version: 0.1.0 -appVersion: "1.7.0" +appVersion: "1.7.1" keywords: ["spiffe", "oidc"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 4b1c3ae..e477695 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -2,7 +2,7 @@ -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) A Helm chart to install the SPIFFE OIDC discovery provider. diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml index 5b585f3..71fbc93 100644 --- a/charts/spire/charts/spire-agent/Chart.yaml +++ b/charts/spire/charts/spire-agent/Chart.yaml @@ -3,7 +3,7 @@ name: spire-agent description: A Helm chart to install the SPIRE agent. type: application version: 0.1.0 -appVersion: "1.7.0" +appVersion: "1.7.1" keywords: ["spiffe", "spire-agent"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index fc4e18e..3d68cfd 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -2,7 +2,7 @@ -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) A Helm chart to install the SPIRE agent. diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml index 39460ad..219d6ea 100644 --- a/charts/spire/charts/spire-server/Chart.yaml +++ b/charts/spire/charts/spire-server/Chart.yaml @@ -3,7 +3,7 @@ name: spire-server description: A Helm chart to install the SPIRE server. type: application version: 0.1.0 -appVersion: "1.7.0" +appVersion: "1.7.1" keywords: ["spiffe", "spire-server", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index f0208c3..b63c970 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -2,7 +2,7 @@ -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) A Helm chart to install the SPIRE server. From b3d04ae162f5b5d03a8be0e67e340f87b6ca3a11 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 20 Jul 2023 15:28:32 -0700 Subject: [PATCH 4/6] Remove misadded lockfile (#400) --- charts/spire/Chart.lock | 18 ------------------ 1 file changed, 18 deletions(-) delete mode 100644 charts/spire/Chart.lock diff --git a/charts/spire/Chart.lock b/charts/spire/Chart.lock deleted file mode 100644 index 88436fe..0000000 --- a/charts/spire/Chart.lock +++ /dev/null @@ -1,18 +0,0 @@ -dependencies: -- name: spire-server - repository: file://./charts/spire-server - version: 0.1.0 -- name: spire-agent - repository: file://./charts/spire-agent - version: 0.1.0 -- name: spiffe-csi-driver - repository: file://./charts/spiffe-csi-driver - version: 0.1.0 -- name: spiffe-oidc-discovery-provider - repository: file://./charts/spiffe-oidc-discovery-provider - version: 0.1.0 -- name: tornjak-frontend - repository: file://./charts/tornjak-frontend - version: 0.1.0 -digest: sha256:0119361a3dd54d1cf088f299ce9adbee55a96c832cb675f57e5e115acf7b17c7 -generated: "2023-07-19T19:13:59.722106+02:00" From cfd6aa79855caba4d5fb467aa9e0ef9855a823d5 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Thu, 27 Jul 2023 10:27:57 -0700 Subject: [PATCH 5/6] Add support for disabling container selectors (#399) --- charts/spire/README.md | 1 + charts/spire/charts/spire-agent/README.md | 1 + charts/spire/charts/spire-agent/templates/configmap.yaml | 1 + charts/spire/charts/spire-agent/values.yaml | 2 ++ 4 files changed, 5 insertions(+) diff --git a/charts/spire/README.md b/charts/spire/README.md index 2e762b7..63f87a7 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -284,6 +284,7 @@ Now you can interact with the Spire agent socket from your own application. The | spire-agent.waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag | | spire-agent.waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | spire-agent.waitForIt.resources | object | `{}` | | +| spire-agent.workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio | | spire-agent.workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped | | spire-agent.workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor | | spire-server.affinity | object | `{}` | | diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 3d68cfd..76ffe7f 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -85,6 +85,7 @@ A Helm chart to install the SPIRE agent. | waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag | | waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | waitForIt.resources | object | `{}` | | +| workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio | | workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped | | workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index aa545fc..9adfcc7 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -30,6 +30,7 @@ plugins: # Minikube does not have a cert in the cluster CA bundle that # can authenticate the kubelet cert, so skip validation. skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }} + disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }} {{- if .Values.workloadAttestors.unix.enabled }} - unix: diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 9653d91..06b0bae 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -137,6 +137,8 @@ workloadAttestors: k8s: # -- If true, kubelet certificate verification is skipped skipKubeletVerification: true + # -- Set to true if using holdApplicationUntilProxyStarts in Istio + disableContainerSelectors: false telemetry: prometheus: From 431d77f40bd5a2d3d970cb9d22ce4d56cff1f41e Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Thu, 3 Aug 2023 09:12:03 -0700 Subject: [PATCH 6/6] Bump spire Helm Chart version from 0.11.0 to 0.11.1 (#419) Please review the below changelog to ensure this matches up with the semantic version being applied. **Note**: As this is a patch release we will make a cherry-picked release using a followup PR targetering the release branch. Will cherrypick the following commits into this patch release + the commit bumping this version number. **Changes in this release** * d2e1606 issuer naming should respect issuer_name override (#378) * a09e054 support annotations so oidc can be annotated (#391) * 7d94b10 Update spire to 1.7.1 (#412) * 9a6768b Add support for disabling container selectors (#399) * 624ca9c Remove misadded lockfile (#400) Signed-off-by: Faisal Memon --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 2558687..c21d945 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -3,7 +3,7 @@ name: spire description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.11.0 +version: 0.11.1 appVersion: "1.7.1" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire diff --git a/charts/spire/README.md b/charts/spire/README.md index 63f87a7..549ca0f 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -2,7 +2,7 @@ -![Version: 0.11.0](https://img.shields.io/badge/Version-0.11.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) +![Version: 0.11.1](https://img.shields.io/badge/Version-0.11.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.