panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Upgrade SPIRE to 1.10.3 (#412)

Browse Source 
* Update SPIRE to 1.10.3

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-agent/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
2024-09-04 13:16:50 -07:00
committed by GitHub
co-authored by Faisal Memon
parent de5ec47613
commit 7df063f8db
15 changed files with 116 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/values.yaml
+12 -1
View File
@@ -144,7 +144,7 @@ readinessProbe:
## @param persistence.size What size volume to use for persistence
## @param persistence.accessMode What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended)
## @param persistence.storageClass What storage class to use for persistence
## @param persistence.hostPath Which path to use on the host when type = hostPath
## @param persistence.hostPath Which path to use on the host when persistence.type = hostPath
##
persistence:
type: pvc
@@ -827,6 +827,17 @@ nodeAttestor:
joinToken:
## @param nodeAttestor.joinToken.enabled Enable the join_token nodeattestor
enabled: false
httpChallenge:
## @param nodeAttestor.httpChallenge.enabled Enable the http_challenge nodeattesto
enabled: false
## @param nodeAttestor.httpChallenge.allowedDNSPatterns A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed.
allowedDNSPatterns: []
## @param nodeAttestor.httpChallenge.requiredPort Set to a port number to require clients to listen only on that port. If 0, all port numbers are allowed
requiredPort: 0
## @param nodeAttestor.httpChallenge.allowNonRootPorts Allow using ports >= 1024 from clients for attestation
allowNonRootPorts: true
## @param nodeAttestor.httpChallenge.tofu Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024
tofu: true
tpmDirect:
## @param nodeAttestor.tpmDirect.enabled Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental.
enabled: false