panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

spire-controller-manager 0.4.0 support (#60)

Browse Source 
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
2023-11-08 10:43:19 +00:00
committed by GitHub
co-authored by Marco Franssen Faisal Memon
parent edf2381aad
commit 805d8696d0
19 changed files with 105 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/tests/common.sh
+2
View File
@@ -1,5 +1,7 @@
#!/usr/bin/env bash #!/usr/bin/env bash
GITHUB_STEP_SUMMARY="${GITHUB_STEP_SUMMARY:-/tmp/summary}"
get_namespace_details () { get_namespace_details () {
cat <<EOF >>"$GITHUB_STEP_SUMMARY" cat <<EOF >>"$GITHUB_STEP_SUMMARY"
### Namespace $1 ### Namespace $1
.github/tests/dependencies/spire-root-server-values.yaml
+8 -1
View File
@@ -6,7 +6,14 @@ global:
spire-server: spire-server:
controllerManager: controllerManager:
enabled: false identities:
namespaceSelector:
kubernetes.io/metadata.name: spire-server
podSelector:
app.kubernetes.io/component: server
app.kubernetes.io/instance: spire
app.kubernetes.io/name: server
downstream: true
nodeAttestor: nodeAttestor:
k8sPsat: k8sPsat:
serviceAccountAllowList: serviceAccountAllowList:
charts/spire-crds/templates/spire.spiffe.io_clusterfederatedtrustdomains.yaml
+9
View File
@@ -65,6 +65,9 @@ spec:
description: BundleEndpointURL is the URL of the bundle endpoint. description: BundleEndpointURL is the URL of the bundle endpoint.
It must be an HTTPS URL and cannot contain userinfo (i.e. username/password). It must be an HTTPS URL and cannot contain userinfo (i.e. username/password).
type: string type: string
className:
description: Set the class of controller to handle this object.
type: string
trustDomain: trustDomain:
description: TrustDomain is the name of the trust domain to federate description: TrustDomain is the name of the trust domain to federate
with (e.g. example.org) with (e.g. example.org)
@@ -89,3 +92,9 @@ spec:
storage: true storage: true
subresources: subresources:
status: {} status: {}
status:
acceptedNames:
kind: ""
plural: ""
conditions: []
storedVersions: []
charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml
+13
View File
@@ -41,6 +41,10 @@ spec:
access the SPIRE administrative APIs. Extra care should be taken access the SPIRE administrative APIs. Extra care should be taken
to only apply this SPIFFE ID to admin workloads. to only apply this SPIFFE ID to admin workloads.
type: boolean type: boolean
autoPopulateDNSNames:
description: AutoPopulateDNSNames indicates whether or not to auto
populate service DNS names.
type: boolean
dnsNameTemplates: dnsNameTemplates:
description: DNSNameTemplate represents templates for extra DNS names description: DNSNameTemplate represents templates for extra DNS names
that are applicable to SVIDs minted for this ClusterSPIFFEID. The that are applicable to SVIDs minted for this ClusterSPIFFEID. The
@@ -53,6 +57,9 @@ spec:
description: Downstream indicates that the entry describes a downstream description: Downstream indicates that the entry describes a downstream
SPIRE server. SPIRE server.
type: boolean type: boolean
className:
description: Set the class of controller to handle this object.
type: string
federatesWith: federatesWith:
description: FederatesWith is a list of trust domain names that workloads description: FederatesWith is a list of trust domain names that workloads
that obtain this SPIFFE ID will federate with. that obtain this SPIFFE ID will federate with.
@@ -224,3 +231,9 @@ spec:
storage: true storage: true
subresources: subresources:
status: {} status: {}
status:
acceptedNames:
kind: ""
plural: ""
conditions: []
storedVersions: []
charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml
+9
View File
@@ -39,6 +39,9 @@ spec:
properties: properties:
admin: admin:
type: boolean type: boolean
className:
description: Set the class of controller to handle this object.
type: string
dnsNames: dnsNames:
items: items:
type: string type: string
@@ -90,3 +93,9 @@ spec:
storage: true storage: true
subresources: subresources:
status: {} status: {}
status:
acceptedNames:
kind: ""
plural: ""
conditions: []
storedVersions: []
charts/spire/README.md
+8
View File
@@ -32,6 +32,14 @@ For production installs, please see [the production example](https://github.com/
## Upgrade notes ## Upgrade notes
### 0.15.X
The spire-crds chart has been updated. Please ensure you have upgraded spire-crds before upgrading the spire chart.
The chart now supports multiple parallel installs of spire-controller-manager. Each install will handle all custom resources with a matching `className` field. By default this is set to `Release.Namespace-Release.Name` and the controller manager will only pick up custom resources with this `className`.
If you have not loaded any SPIRE custom resources yourself, the upgrade process will be transparent. If you have loaded your own SPIRE custom resources, set `spire-server.controllerManager.watchClassless=true` until you can update your SPIRE custom resources to have the `className` for the instance specified.
### 0.14.X ### 0.14.X
If coming from a chart version before 0.14.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart If coming from a chart version before 0.14.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart
charts/spire/charts/spire-server/README.md
+4 -1
View File
@@ -215,13 +215,15 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` | | `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` | | `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
| `controllerManager.enabled` | Flag to enable controller manager | `false` | | `controllerManager.enabled` | Flag to enable controller manager | `false` |
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | | `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
| `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` | | `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` |
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.3.0` | | `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.0` |
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
| `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.securityContext` | Security context | `{}` |
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
@@ -240,6 +242,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.identities.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` | | `controllerManager.identities.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` |
| `controllerManager.identities.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` | | `controllerManager.identities.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
| `controllerManager.identities.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` | | `controllerManager.identities.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` |
| `controllerManager.identities.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` |
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` | | `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | | `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
charts/spire/charts/spire-server/templates/_helpers.tpl
+8
View File
@@ -220,3 +220,11 @@ The code below determines what connection type should be used.
{{- end }} {{- end }}
{{ $args | toYaml }} {{ $args | toYaml }}
{{- end -}} {{- end -}}
{{- define "spire-server.controller-manager-class-name" -}}
{{- if .Values.controllerManager.className }}
{{- .Values.controllerManager.className }}
{{- else }}
{{- .Release.Namespace }}-{{ .Release.Name }}
{{- end -}}
{{- end -}}
charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml
+3 -1
View File
@@ -4,7 +4,7 @@
apiVersion: spire.spiffe.io/v1alpha1 apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterSPIFFEID kind: ClusterSPIFFEID
metadata: metadata:
name: {{ include "spire-controller-manager.fullname" $root }}-service-account-based name: {{ $root.Release.Namespace }}-{{ include "spire-controller-manager.fullname" $root }}-service-account-based
namespace: {{ include "spire-server.namespace" $root }} namespace: {{ include "spire-server.namespace" $root }}
spec: spec:
spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }} spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }}
@@ -36,5 +36,7 @@ spec:
{{- end }} {{- end }}
admin: {{ .identities.admin }} admin: {{ .identities.admin }}
downstream: {{ .identities.downstream }} downstream: {{ .identities.downstream }}
autoPopulateDNSNames: {{ .identities.autoPopulateDNSNames }}
className: {{ include "spire-server.controller-manager-class-name" $root | quote}}
{{- end }} {{- end }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
+3 -1
View File
@@ -25,7 +25,7 @@ data:
leaderElect: true leaderElect: true
resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
resourceNamespace: {{ include "spire-server.namespace" . }} resourceNamespace: {{ include "spire-server.namespace" . }}
validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
clusterName: {{ include "spire-lib.cluster-name" . }} clusterName: {{ include "spire-lib.cluster-name" . }}
trustDomain: {{ include "spire-lib.trust-domain" . }} trustDomain: {{ include "spire-lib.trust-domain" . }}
ignoreNamespaces: ignoreNamespaces:
@@ -33,4 +33,6 @@ data:
{{- toYaml . | nindent 6 }} {{- toYaml . | nindent 6 }}
{{- end }} {{- end }}
spireServerSocketPath: "/tmp/spire-server/private/api.sock" spireServerSocketPath: "/tmp/spire-server/private/api.sock"
className: {{ include "spire-server.controller-manager-class-name" . | quote}}
watchClassless: {{ .Values.controllerManager.watchClassless | toYaml }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/templates/controller-manager-roles.yaml
+6 -3
View File
@@ -32,7 +32,7 @@ subjects:
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole kind: ClusterRole
metadata: metadata:
name: {{ include "spire-controller-manager.fullname" . }} name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}
rules: rules:
- apiGroups: [""] - apiGroups: [""]
resources: ["namespaces"] resources: ["namespaces"]
@@ -43,6 +43,9 @@ rules:
- apiGroups: [""] - apiGroups: [""]
resources: ["nodes"] resources: ["nodes"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["endpoints"]
verbs: ["get", "list", "watch"]
- apiGroups: [""] - apiGroups: [""]
resources: ["pods"] resources: ["pods"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]
@@ -77,11 +80,11 @@ rules:
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding kind: ClusterRoleBinding
metadata: metadata:
name: {{ include "spire-controller-manager.fullname" . }} name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}
roleRef: roleRef:
apiGroup: rbac.authorization.k8s.io apiGroup: rbac.authorization.k8s.io
kind: ClusterRole kind: ClusterRole
name: {{ include "spire-controller-manager.fullname" . }} name: {{ .Release.Namespace}}-{{ include "spire-controller-manager.fullname" . }}
subjects: subjects:
- kind: ServiceAccount - kind: ServiceAccount
name: {{ include "spire-server.serviceAccountName" . }} name: {{ include "spire-server.serviceAccountName" . }}
charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml
+1 -1
View File
@@ -2,7 +2,7 @@
apiVersion: admissionregistration.k8s.io/v1 apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration kind: ValidatingWebhookConfiguration
metadata: metadata:
name: {{ include "spire-controller-manager.fullname" . }}-webhook name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
webhooks: webhooks:
- admissionReviewVersions: ["v1"] - admissionReviewVersions: ["v1"]
clientConfig: clientConfig:
charts/spire/charts/spire-server/templates/post-install-hook.yaml
+2 -2
View File
@@ -22,7 +22,7 @@ metadata:
rules: rules:
- apiGroups: ["admissionregistration.k8s.io"] - apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations"] resources: ["validatingwebhookconfigurations"]
resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}] resourceNames: [{{ printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) | quote }}]
verbs: ["get", "patch"] verbs: ["get", "patch"]
--- ---
kind: ClusterRoleBinding kind: ClusterRoleBinding
@@ -68,7 +68,7 @@ spec:
args: args:
- patch - patch
- validatingwebhookconfiguration - validatingwebhookconfiguration
- {{ include "spire-controller-manager.fullname" . }}-webhook - {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
- --type=strategic - --type=strategic
- -p - -p
- | - |
charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+2 -2
View File
@@ -22,7 +22,7 @@ metadata:
rules: rules:
- apiGroups: ["admissionregistration.k8s.io"] - apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations"] resources: ["validatingwebhookconfigurations"]
resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}] resourceNames: [{{ printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) | quote }}]
verbs: ["get", "patch"] verbs: ["get", "patch"]
--- ---
kind: ClusterRoleBinding kind: ClusterRoleBinding
@@ -68,7 +68,7 @@ spec:
args: args:
- patch - patch
- validatingwebhookconfiguration - validatingwebhookconfiguration
- {{ include "spire-controller-manager.fullname" . }}-webhook - {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
- --type=strategic - --type=strategic
- -p - -p
- | - |
charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+7 -2
View File
@@ -1,4 +1,9 @@
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
{{- $webhookname := printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) }}
{{- $oldwebhookname := printf "%s-webhook" (include "spire-controller-manager.fullname" .) }}
{{- if not (lookup "admissionregistration.k8s.io/v1" "ValidatingWebhookConfiguration" "" $webhookname) }}
{{- $webhookname = $oldwebhookname }}
{{- end }}
{{- if eq (.Values.controllerManager.enabled | toString) "true" }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
apiVersion: v1 apiVersion: v1
@@ -22,7 +27,7 @@ metadata:
rules: rules:
- apiGroups: ["admissionregistration.k8s.io"] - apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations"] resources: ["validatingwebhookconfigurations"]
resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}] resourceNames: [{{ $webhookname | quote }}]
verbs: ["get", "patch"] verbs: ["get", "patch"]
--- ---
kind: ClusterRoleBinding kind: ClusterRoleBinding
@@ -68,7 +73,7 @@ spec:
args: args:
- patch - patch
- validatingwebhookconfiguration - validatingwebhookconfiguration
- {{ include "spire-controller-manager.fullname" . }}-webhook - {{ $webhookname }}
- --type=strategic - --type=strategic
- -p - -p
- | - |
charts/spire/charts/spire-server/values.yaml
+9 -1
View File
@@ -377,6 +377,12 @@ notifier:
controllerManager: controllerManager:
## @param controllerManager.enabled Flag to enable controller manager ## @param controllerManager.enabled Flag to enable controller manager
enabled: false enabled: false
## @param controllerManager.className specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs.
className: ""
## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.
watchClassless: false
installAndUpgradeHook: installAndUpgradeHook:
## @param controllerManager.installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) ## @param controllerManager.installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`)
enabled: true enabled: true
@@ -395,7 +401,7 @@ controllerManager:
repository: spiffe/spire-controller-manager repository: spiffe/spire-controller-manager
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
version: "" version: ""
tag: "0.3.0" tag: "0.4.0"
## @param controllerManager.resources [object] Resource requests and limits for controller manager ## @param controllerManager.resources [object] Resource requests and limits for controller manager
resources: {} resources: {}
@@ -469,6 +475,8 @@ controllerManager:
admin: false admin: false
## @param controllerManager.identities.downstream Set if this spire instance is a root server and the workloads are downstream servers. ## @param controllerManager.identities.downstream Set if this spire instance is a root server and the workloads are downstream servers.
downstream: false downstream: false
## @param controllerManager.identities.autoPopulateDNSNames Auto populate DNS names from services attached to pods
autoPopulateDNSNames: false
validatingWebhookConfiguration: validatingWebhookConfiguration:
## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued ## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued
charts/spire/templates/NOTES.txt
+10
View File
@@ -21,3 +21,13 @@ Warning: You're using an unsupported plugin. Functionality of this release and f
Warning: You're using an experimental config. Functionality of this release and future upgrades aren't guaranteed to work smoothly. Warning: You're using an experimental config. Functionality of this release and future upgrades aren't guaranteed to work smoothly.
{{- end }} {{- end }}
{{- $className := include "spire-server.controller-manager-class-name" (dict "Values" (index .Values "spire-server") "Release" .Release) }}
{{- if (index .Values "spire-server").controllerManager.enabled }}
{{- if (index .Values "spire-server").controllerManager.watchClassless }}
Spire CR's will be handled if no className is specified or if className is set to "{{ $className }}"
{{- else }}
Spire CR's will be handled only if className is set to "{{ $className }}"
{{- end }}
{{- end }}
examples/nested/run-tests.sh
-4
View File
@@ -46,10 +46,6 @@ helm upgrade --install --create-namespace spire charts/spire \
--values "${DEPS}/spire-root-server-values.yaml" \ --values "${DEPS}/spire-root-server-values.yaml" \
--wait --wait
kubectl get nodes -o go-template='{{range .items}}{{printf "%s\n" .metadata.uid}}{{end}}' | while read -r line; do
kubectl exec -t spire-server-0 -n "spire-root-server" -- spire-server entry create -spiffeID spiffe://production.other/production/nested-spire -parentID "spiffe://production.other/spire/agent/k8s_psat/production/$line" -selector k8s:pod-label:app.kubernetes.io/name:server -downstream
done
helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \ helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \
--wait spire charts/spire --wait spire charts/spire
helm test --namespace spire-server spire helm test --namespace spire-server spire
examples/production/run-tests.sh
+1
View File
@@ -58,6 +58,7 @@ if [[ -n "$UPGRADE_ARGS" ]]; then
popd popd
popd popd
# Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.) # Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.)
helm upgrade -n spire-system spire-crds charts/spire-crds --wait
else else
kubectl create namespace spire-system 2>/dev/null || true kubectl create namespace spire-system 2>/dev/null || true