panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #420 from spiffe/release-patch-0-11-1

Browse Source 
Cut patch release 0.11.1
This commit is contained in:
Faisal Memon
2023-08-03 09:56:54 -07:00
committed by GitHub
parent ca418613a2 431d77f40b
commit 7af7e1d6de
16 changed files with 29 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/Chart.lock
-18
View File
@@ -1,18 +0,0 @@
dependencies:
- name: spire-server
repository: file://./charts/spire-server
version: 0.1.0
- name: spire-agent
repository: file://./charts/spire-agent
version: 0.1.0
- name: spiffe-csi-driver
repository: file://./charts/spiffe-csi-driver
version: 0.1.0
- name: spiffe-oidc-discovery-provider
repository: file://./charts/spiffe-oidc-discovery-provider
version: 0.1.0
- name: tornjak-frontend
repository: file://./charts/tornjak-frontend
version: 0.1.0
digest: sha256:0119361a3dd54d1cf088f299ce9adbee55a96c832cb675f57e5e115acf7b17c7
generated: "2023-07-19T19:13:59.722106+02:00"
charts/spire/Chart.yaml
+2 -2
View File
@@ -3,8 +3,8 @@ name: spire
description: > description: >
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
type: application type: application
version: 0.11.0 version: 0.11.1
appVersion: "1.7.0" appVersion: "1.7.1"
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
sources: sources:
charts/spire/README.md
+3 -1
View File
@@ -2,7 +2,7 @@
<!-- This README.md is generated. Please edit README.md.gotmpl --> <!-- This README.md is generated. Please edit README.md.gotmpl -->
![Version: 0.11.0](https://img.shields.io/badge/Version-0.11.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) ![Version: 0.11.1](https://img.shields.io/badge/Version-0.11.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
@@ -156,6 +156,7 @@ Now you can interact with the Spire agent socket from your own application. The
| spiffe-csi-driver.tolerations | list | `[]` | | | spiffe-csi-driver.tolerations | list | `[]` | |
| spiffe-oidc-discovery-provider.affinity | object | `{}` | | | spiffe-oidc-discovery-provider.affinity | object | `{}` | |
| spiffe-oidc-discovery-provider.agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket | | spiffe-oidc-discovery-provider.agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket |
| spiffe-oidc-discovery-provider.annotations | object | `{}` | Annotations for the deployment |
| spiffe-oidc-discovery-provider.autoscaling.enabled | bool | `false` | | | spiffe-oidc-discovery-provider.autoscaling.enabled | bool | `false` | |
| spiffe-oidc-discovery-provider.autoscaling.maxReplicas | int | `5` | | | spiffe-oidc-discovery-provider.autoscaling.maxReplicas | int | `5` | |
| spiffe-oidc-discovery-provider.autoscaling.minReplicas | int | `1` | | | spiffe-oidc-discovery-provider.autoscaling.minReplicas | int | `1` | |
@@ -283,6 +284,7 @@ Now you can interact with the Spire agent socket from your own application. The
| spire-agent.waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag | | spire-agent.waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag |
| spire-agent.waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | spire-agent.waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
| spire-agent.waitForIt.resources | object | `{}` | | | spire-agent.waitForIt.resources | object | `{}` | |
| spire-agent.workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio |
| spire-agent.workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped | | spire-agent.workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped |
| spire-agent.workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor | | spire-agent.workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor |
| spire-server.affinity | object | `{}` | | | spire-server.affinity | object | `{}` | |
charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider
description: A Helm chart to install the SPIFFE OIDC discovery provider. description: A Helm chart to install the SPIFFE OIDC discovery provider.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.7.0" appVersion: "1.7.1"
keywords: ["spiffe", "oidc"] keywords: ["spiffe", "oidc"]
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
sources: sources:
charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+2 -1
View File
@@ -2,7 +2,7 @@
<!-- This README.md is generated. Please edit README.md.gotmpl --> <!-- This README.md is generated. Please edit README.md.gotmpl -->
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square)
A Helm chart to install the SPIFFE OIDC discovery provider. A Helm chart to install the SPIFFE OIDC discovery provider.
@@ -31,6 +31,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|-----|------|---------|-------------| |-----|------|---------|-------------|
| affinity | object | `{}` | | | affinity | object | `{}` | |
| agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket | | agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket |
| annotations | object | `{}` | Annotations for the deployment |
| autoscaling.enabled | bool | `false` | | | autoscaling.enabled | bool | `false` | |
| autoscaling.maxReplicas | int | `5` | | | autoscaling.maxReplicas | int | `5` | |
| autoscaling.minReplicas | int | `1` | | | autoscaling.minReplicas | int | `1` | |
charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml
+4
View File
@@ -6,6 +6,10 @@ metadata:
namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }} namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
labels: labels:
{{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
annotations:
{{- with .Values.annotations }}
{{- toYaml . | nindent 4 }}
{{- end }}
spec: spec:
{{- if not .Values.autoscaling.enabled }} {{- if not .Values.autoscaling.enabled }}
replicas: {{ .Values.replicaCount }} replicas: {{ .Values.replicaCount }}
charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+3
View File
@@ -12,6 +12,9 @@ replicaCount: 1
namespaceOverride: "" namespaceOverride: ""
# -- Annotations for the deployment
annotations: {}
image: image:
# -- The OCI registry to pull the image from # -- The OCI registry to pull the image from
registry: ghcr.io registry: ghcr.io
charts/spire/charts/spire-agent/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spire-agent
description: A Helm chart to install the SPIRE agent. description: A Helm chart to install the SPIRE agent.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.7.0" appVersion: "1.7.1"
keywords: ["spiffe", "spire-agent"] keywords: ["spiffe", "spire-agent"]
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
sources: sources:
charts/spire/charts/spire-agent/README.md
+2 -1
View File
@@ -2,7 +2,7 @@
<!-- This README.md is generated. Please edit README.md.gotmpl --> <!-- This README.md is generated. Please edit README.md.gotmpl -->
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square)
A Helm chart to install the SPIRE agent. A Helm chart to install the SPIRE agent.
@@ -85,6 +85,7 @@ A Helm chart to install the SPIRE agent.
| waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag | | waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag |
| waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
| waitForIt.resources | object | `{}` | | | waitForIt.resources | object | `{}` | |
| workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio |
| workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped | | workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped |
| workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor | | workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor |
charts/spire/charts/spire-agent/templates/configmap.yaml
+1
View File
@@ -30,6 +30,7 @@ plugins:
# Minikube does not have a cert in the cluster CA bundle that # Minikube does not have a cert in the cluster CA bundle that
# can authenticate the kubelet cert, so skip validation. # can authenticate the kubelet cert, so skip validation.
skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }} skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }}
disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }}
{{- if .Values.workloadAttestors.unix.enabled }} {{- if .Values.workloadAttestors.unix.enabled }}
- unix: - unix:
charts/spire/charts/spire-agent/values.yaml
+2
View File
@@ -137,6 +137,8 @@ workloadAttestors:
k8s: k8s:
# -- If true, kubelet certificate verification is skipped # -- If true, kubelet certificate verification is skipped
skipKubeletVerification: true skipKubeletVerification: true
# -- Set to true if using holdApplicationUntilProxyStarts in Istio
disableContainerSelectors: false
telemetry: telemetry:
prometheus: prometheus:
charts/spire/charts/spire-server/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spire-server
description: A Helm chart to install the SPIRE server. description: A Helm chart to install the SPIRE server.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.7.0" appVersion: "1.7.1"
keywords: ["spiffe", "spire-server", "spire-controller-manager"] keywords: ["spiffe", "spire-server", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
sources: sources:
charts/spire/charts/spire-server/README.md
+1 -1
View File
@@ -2,7 +2,7 @@
<!-- This README.md is generated. Please edit README.md.gotmpl --> <!-- This README.md is generated. Please edit README.md.gotmpl -->
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square)
A Helm chart to install the SPIRE server. A Helm chart to install the SPIRE server.
charts/spire/charts/spire-server/templates/configmap.yaml
+1 -1
View File
@@ -78,7 +78,7 @@ plugins:
UpstreamAuthority: UpstreamAuthority:
- cert-manager: - cert-manager:
plugin_data: plugin_data:
issuer_name: {{ default (include "spire-server.fullname" $root) .issuer_name }} issuer_name: {{ default (include "spire-server.fullname" $root) .issuer_name }}-ca
issuer_kind: {{ .issuer_kind | quote }} issuer_kind: {{ .issuer_kind | quote }}
issuer_group: {{ .issuer_group | quote }} issuer_group: {{ .issuer_group | quote }}
namespace: {{ default $root.Release.Namespace .namespace | quote }} namespace: {{ default $root.Release.Namespace .namespace | quote }}
charts/spire/charts/spire-server/templates/issuer.yaml
+4 -3
View File
@@ -1,12 +1,13 @@
{{- with .Values.upstreamAuthority.certManager }} {{- with .Values.upstreamAuthority.certManager }}
{{ if and .enabled .ca.create }} {{ if and .enabled .ca.create }}
{{ $issuerName := printf "%s-selfsigned" (default (include "spire-server.fullname" $) .issuer_name) }}
{{/* {{/*
Configuring CA Issuer: https://cert-manager.io/docs/configuration/ca/ Configuring CA Issuer: https://cert-manager.io/docs/configuration/ca/
*/}} */}}
apiVersion: cert-manager.io/v1 apiVersion: cert-manager.io/v1
kind: Issuer kind: Issuer
metadata: metadata:
name: {{ include "spire-server.fullname" $ }}-selfsigned name: {{ $issuerName }}
namespace: {{ include "spire-server.namespace" $ }} namespace: {{ include "spire-server.namespace" $ }}
labels: labels:
{{- include "spire-server.labels" $ | nindent 4}} {{- include "spire-server.labels" $ | nindent 4}}
@@ -38,14 +39,14 @@ spec:
renewBefore: {{ . }} renewBefore: {{ . }}
{{- end }} {{- end }}
issuerRef: issuerRef:
name: {{ include "spire-server.fullname" $ }}-selfsigned name: {{ $issuerName }}
kind: Issuer kind: Issuer
group: cert-manager.io group: cert-manager.io
--- ---
apiVersion: cert-manager.io/v1 apiVersion: cert-manager.io/v1
kind: Issuer kind: Issuer
metadata: metadata:
name: {{ include "spire-server.fullname" $ }} name: {{ include "spire-server.fullname" $ }}-ca
namespace: {{ include "spire-server.namespace" $ }} namespace: {{ include "spire-server.namespace" $ }}
spec: spec:
ca: ca:
charts/spire/charts/spire-server/templates/statefulset.yaml
+1 -1
View File
@@ -55,7 +55,7 @@ spec:
- --timeout=3m - --timeout=3m
- --for=condition=ready - --for=condition=ready
- issuer - issuer
- {{ include "spire-server.fullname" $ }} - {{ include "spire-server.fullname" $ }}-ca
imagePullPolicy: {{ .Values.tools.kubectl.image.pullPolicy }} imagePullPolicy: {{ .Values.tools.kubectl.image.pullPolicy }}
{{- end }} {{- end }}
{{- if gt (len .Values.initContainers) 0 }} {{- if gt (len .Values.initContainers) 0 }}