Merge branch 'main' into release
This commit is contained in:
Faisal Memon
@@ -2,7 +2,7 @@
|
||||
{
|
||||
"name": "kube-prometheus-stack",
|
||||
"repo": "https://prometheus-community.github.io/helm-charts",
|
||||
"version": "70.4.1"
|
||||
"version": "70.7.0"
|
||||
},
|
||||
{
|
||||
"name": "cert-manager",
|
||||
|
||||
@@ -2,12 +2,12 @@
|
||||
{
|
||||
"name": "mysql",
|
||||
"registry": "docker.io/bitnamicharts/mysql",
|
||||
"version": "12.3.2"
|
||||
"version": "12.3.4"
|
||||
},
|
||||
{
|
||||
"name": "postgresql",
|
||||
"registry": "docker.io/bitnamicharts/postgresql",
|
||||
"version": "16.6.1"
|
||||
"version": "16.6.3"
|
||||
},
|
||||
{
|
||||
"name": "envoy-gateway",
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire-nested
|
||||
description: >
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
type: application
|
||||
version: 0.24.4
|
||||
version: 0.24.5
|
||||
appVersion: "1.12.0"
|
||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# spire
|
||||
|
||||
  
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire
|
||||
description: >
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
type: application
|
||||
version: 0.24.4
|
||||
version: 0.24.5
|
||||
appVersion: "1.12.0"
|
||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# spire
|
||||
|
||||
  
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
|
||||
@@ -120,7 +120,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73` |
|
||||
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
|
||||
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
|
||||
@@ -340,7 +340,7 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514
|
||||
tag: latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73
|
||||
|
||||
toolkit:
|
||||
## @param tests.toolkit.image.registry The OCI registry to pull the image from
|
||||
|
||||
@@ -70,7 +70,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73` |
|
||||
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
|
||||
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` |
|
||||
@@ -79,17 +79,17 @@ A Helm chart to install the SPIRE agent.
|
||||
| `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` |
|
||||
| `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` |
|
||||
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-agent` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-agent` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.8.7` |
|
||||
| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `1d7c73ccac948ee86cbd78ddde2d30128a1838b403f7bb2100d38d916a252244` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.9.0` |
|
||||
| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `22f67063f1699330e70cdedc9b923e517688f5ae71085a26bd9b83b3060ee86e` |
|
||||
| `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.enabled` | Display pubhash in logs | `true` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-get-tpm-pubhash` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-get-tpm-pubhash` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.8.7` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.9.0` |
|
||||
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
|
||||
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
|
||||
| `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` |
|
||||
@@ -114,7 +114,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514` |
|
||||
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73` |
|
||||
| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
|
||||
|
||||
@@ -153,7 +153,7 @@ fsGroupFix:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
tag: latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514
|
||||
tag: latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73
|
||||
|
||||
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
@@ -186,12 +186,12 @@ nodeAttestor:
|
||||
## @param nodeAttestor.tpmDirect.plugin.image.tag Overrides the image tag
|
||||
##
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: boxboat/spire-tpm-plugin-tpm-attestor-agent
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-tpm-plugin-tpm-attestor-agent
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.8.7"
|
||||
tag: "v1.9.0"
|
||||
## @param nodeAttestor.tpmDirect.plugin.checksum The sha256 checksum of the plugin binary
|
||||
checksum: 1d7c73ccac948ee86cbd78ddde2d30128a1838b403f7bb2100d38d916a252244
|
||||
checksum: 22f67063f1699330e70cdedc9b923e517688f5ae71085a26bd9b83b3060ee86e
|
||||
## @param nodeAttestor.tpmDirect.plugin.path The filename in the container of the plugin
|
||||
path: /app/tpm_attestor_agent
|
||||
pubHash:
|
||||
@@ -203,10 +203,10 @@ nodeAttestor:
|
||||
## @param nodeAttestor.tpmDirect.pubHash.image.tag Overrides the image tag
|
||||
##
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: boxboat/spire-tpm-plugin-get-tpm-pubhash
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-tpm-plugin-get-tpm-pubhash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.8.7"
|
||||
tag: "v1.9.0"
|
||||
|
||||
# workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
|
||||
workloadAttestors:
|
||||
@@ -280,7 +280,7 @@ socketAlternate:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
tag: latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514
|
||||
tag: latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73
|
||||
|
||||
## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
||||
@@ -53,7 +53,7 @@
|
||||
{{- $repo := .image.repository }}
|
||||
{{- $tag := .image.tag | toString }}
|
||||
{{- if eq (substr 0 7 $tag) "sha256:" }}
|
||||
{{- printf "%s/%s@%s" $registry $repo $tag | quote }}
|
||||
{{- printf "%s%s@%s" $registry $repo $tag | quote }}
|
||||
{{- else if .appVersion }}
|
||||
{{- $appVersion := .appVersion }}
|
||||
{{- if and (hasKey . "ubi") (dig "openshift" false .global) }}
|
||||
|
||||
@@ -257,6 +257,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `notifier.externalK8sBundle.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `bundle.crt` |
|
||||
| `notifier.externalK8sBundle.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
||||
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
||||
| `controllerManager.staticManifestMode` | Flag to configure static mode. Valid options off, internal, and external. If internal, the identities config options will be rendered to an included configmap | `off` |
|
||||
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
||||
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
||||
| `controllerManager.entryIDPrefixCleanup` | Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` |
|
||||
@@ -268,7 +269,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
||||
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.0` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.2` |
|
||||
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
||||
| `controllerManager.securityContext` | Security context | `{}` |
|
||||
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
||||
@@ -365,11 +366,11 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `nodeAttestor.httpChallenge.allowNonRootPorts` | Allow using ports >= 1024 from clients for attestation | `true` |
|
||||
| `nodeAttestor.httpChallenge.tofu` | Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024 | `true` |
|
||||
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
|
||||
| `nodeAttestor.tpmDirect.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `nodeAttestor.tpmDirect.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-server` |
|
||||
| `nodeAttestor.tpmDirect.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `nodeAttestor.tpmDirect.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-server` |
|
||||
| `nodeAttestor.tpmDirect.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeAttestor.tpmDirect.image.tag` | Overrides the image tag | `v1.8.7` |
|
||||
| `nodeAttestor.tpmDirect.checksum` | The sha256 checksum of the plugin binary | `f39ef9cdd2b3dd74112bfe827b79d6721c59215d0d5f4c2e34fa09bbc60d36d2` |
|
||||
| `nodeAttestor.tpmDirect.image.tag` | Overrides the image tag | `v1.9.0` |
|
||||
| `nodeAttestor.tpmDirect.checksum` | The sha256 checksum of the plugin binary | `46d0caad8c25a027dd11c93e18b58a8bc6fbd9f1fe2e36fa2a0dd440986de4dc` |
|
||||
| `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` |
|
||||
| `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` |
|
||||
| `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` |
|
||||
@@ -437,7 +438,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `chown.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `chown.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `chown.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514` |
|
||||
| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73` |
|
||||
| `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
||||
| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` |
|
||||
@@ -450,5 +451,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73` |
|
||||
| `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` |
|
||||
|
||||
@@ -75,7 +75,11 @@
|
||||
{{- end }}
|
||||
env:
|
||||
- name: ENABLE_WEBHOOKS
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
value: {{ .webhooksEnabled | toString | quote }}
|
||||
{{- else }}
|
||||
value: "false"
|
||||
{{- end }}
|
||||
{{- if gt (len $extraEnv) 0 }}
|
||||
{{- $extraEnv | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -91,6 +95,7 @@
|
||||
- containerPort: {{ $promPort }}
|
||||
name: prom-cm{{ .suffix }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
@@ -99,12 +104,17 @@
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: healthz
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.controllerManager.resources | nindent 4 }}
|
||||
volumeMounts:
|
||||
- name: spire-server-socket
|
||||
mountPath: /tmp/spire-server/private
|
||||
readOnly: true
|
||||
{{- if ne .Values.controllerManager.staticManifestMode "off" }}
|
||||
- name: controller-manager-static-config
|
||||
mountPath: /manifests
|
||||
{{- end }}
|
||||
- name: controller-manager-config
|
||||
mountPath: /controller-manager-config{{ .suffix }}.yaml
|
||||
subPath: controller-manager-config{{ .suffix }}.yaml
|
||||
|
||||
@@ -26,6 +26,7 @@ matchLabels:
|
||||
{}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- $root := . }}
|
||||
{{ $namespaces := list .Release.Namespace .Values.namespaceOverride (dig "spire" "namespaces" "server" "name" "" .Values.global) (dig "spire" "namespaces" "system" "name" "" .Values.global) | compact | uniq }}
|
||||
{{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }}
|
||||
@@ -116,3 +117,4 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -47,10 +47,12 @@ metrics:
|
||||
bindAddress: 0.0.0.0:{{ $promPort }}
|
||||
health:
|
||||
healthProbeBindAddress: 0.0.0.0:{{ $healthPort }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
leaderElection:
|
||||
leaderElect: true
|
||||
resourceName: {{ printf "%s-%s%s" .Release.Namespace (default .Release.Name .Values.crNameOverride) .suffix | sha256sum | trunc 8 }}.spiffe.io
|
||||
resourceNamespace: {{ include "spire-server.namespace" . }}
|
||||
{{- end }}
|
||||
{{- with .settings.cacheNamespaces }}
|
||||
cacheNamespaces:
|
||||
{{- toYaml . | nindent 2 }}
|
||||
@@ -85,7 +87,12 @@ parentIDTemplate: {{ if hasKey .settings "parentIDTemplate" }}{{ .settings.paren
|
||||
{{- $reconcile = .settings.reconcile }}
|
||||
{{- end }}
|
||||
reconcile:
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
clusterSPIFFEIDs: {{ if hasKey $reconcile "clusterSPIFFEIDs" }}{{ toYaml $reconcile.clusterSPIFFEIDs }}{{ else }}{{ toYaml .defaults.reconcile.clusterSPIFFEIDs }}{{ end }}
|
||||
{{- end }}
|
||||
clusterStaticEntries: {{ if hasKey $reconcile "clusterStaticEntries" }}{{ toYaml $reconcile.clusterStaticEntries }}{{ else }}{{ toYaml .defaults.reconcile.clusterStaticEntries }}{{ end }}
|
||||
clusterFederatedTrustDomains: {{ if hasKey $reconcile "clusterFederatedTrustDomains" }}{{ toYaml $reconcile.clusterFederatedTrustDomains }}{{ else }}{{ toYaml .defaults.reconcile.clusterFederatedTrustDomains }}{{ end }}
|
||||
{{- if ne .Values.controllerManager.staticManifestMode "off" }}
|
||||
staticManifestPath: /manifests
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
{{- $root := . }}
|
||||
{{- range $key, $value := .Values.controllerManager.identities.clusterFederatedTrustDomains }}
|
||||
{{- define "spire-server.cluster-federated-trust-domains" -}}
|
||||
{{- $root := .root }}
|
||||
{{- $useShortName := .useShortName }}
|
||||
{{- range $key, $value := $root.Values.controllerManager.identities.clusterFederatedTrustDomains }}
|
||||
{{- range $skey, $svalue := $value }}
|
||||
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "bundleEndpointProfile" "bundleEndpointURL" "trustDomain" "trustDomainBundle")) }}
|
||||
{{- fail (printf "Unsupported property specified: %s" $skey) }}
|
||||
@@ -12,34 +14,45 @@
|
||||
{{- end }}
|
||||
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
|
||||
---
|
||||
apiVersion: spire.spiffe.io/v1alpha1
|
||||
kind: ClusterFederatedTrustDomain
|
||||
metadata:
|
||||
name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }}
|
||||
{{- with $value.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $value.labels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
|
||||
{{- with $value.bundleEndpointProfile }}
|
||||
bundleEndpointProfile:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $value.bundleEndpointURL }}
|
||||
bundleEndpointURL: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.trustDomain }}
|
||||
trustDomain: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.trustDomainBundle }}
|
||||
trustDomainBundle: {{ . | quote }}
|
||||
{{- end }}
|
||||
- apiVersion: spire.spiffe.io/v1alpha1
|
||||
kind: ClusterFederatedTrustDomain
|
||||
metadata:
|
||||
{{- if $useShortName }}
|
||||
name: {{ $key }}
|
||||
{{- else }}
|
||||
name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }}
|
||||
{{- end }}
|
||||
{{- with $value.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.labels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
|
||||
{{- with $value.bundleEndpointProfile }}
|
||||
bundleEndpointProfile:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.bundleEndpointURL }}
|
||||
bundleEndpointURL: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.trustDomain }}
|
||||
trustDomain: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.trustDomainBundle }}
|
||||
trustDomainBundle: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- $t := include "spire-server.cluster-federated-trust-domains" (dict "root" . "useShortName" false) | fromYamlArray }}
|
||||
{{- range $_, $v := $t }}
|
||||
---
|
||||
{{- $v | toYaml }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") (eq .Values.controllerManager.staticManifestMode "off") }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -22,3 +23,4 @@ spec:
|
||||
{{- include "spire-server.selectorLabels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
{{- if not (has .Values.controllerManager.staticManifestMode (list "off" "internal" "external" )) }}
|
||||
{{- fail "Unsupported option specified for controllerManager.staticManifestMode" }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "internal" }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-static
|
||||
namespace: {{ include "spire-server.namespace" . }}
|
||||
data:
|
||||
{{- $t := include "spire-server.cluster-static-entries" (dict "root" . "useShortName" true) | fromYamlArray }}
|
||||
{{- range $_, $v := $t }}
|
||||
"e-{{ $v.metadata.name }}.yaml": |
|
||||
{{- $v | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- $t := include "spire-server.cluster-federated-trust-domains" (dict "root" . "useShortName" true) | fromYamlArray }}
|
||||
{{- range $_, $v := $t }}
|
||||
"f-{{ $v.metadata.name }}.yaml": |
|
||||
{{- $v | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -1,5 +1,7 @@
|
||||
{{- $root := . }}
|
||||
{{- range $key, $value := .Values.controllerManager.identities.clusterStaticEntries }}
|
||||
{{- define "spire-server.cluster-static-entries" -}}
|
||||
{{- $root := .root }}
|
||||
{{- $useShortName := .useShortName }}
|
||||
{{- range $key, $value := $root.Values.controllerManager.identities.clusterStaticEntries }}
|
||||
{{- range $skey, $svalue := $value }}
|
||||
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "admin" "dnsNames" "downstream" "federatesWith" "hint" "jwtSVIDTTL" "parentID" "selectors" "spiffeID" "x509SVIDTTL")) }}
|
||||
{{- fail (printf "Unsupported property specified: %s" $skey) }}
|
||||
@@ -12,52 +14,63 @@
|
||||
{{- end }}
|
||||
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
|
||||
---
|
||||
apiVersion: spire.spiffe.io/v1alpha1
|
||||
kind: ClusterStaticEntry
|
||||
metadata:
|
||||
name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }}
|
||||
{{- with $value.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $value.labels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
|
||||
spiffeID: {{ $value.spiffeID | quote }}
|
||||
{{- with $value.federatesWith }}
|
||||
federatesWith:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $value.selectors }}
|
||||
selectors:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $value.parentID }}
|
||||
parentID: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.dnsNames }}
|
||||
dnsNames:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $value.hint }}
|
||||
hint: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.x509SVIDTTL }}
|
||||
x509SVIDTTL: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.jwtSVIDTTL }}
|
||||
jwtSVIDTTL: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.admin }}
|
||||
admin: {{ . }}
|
||||
{{- end }}
|
||||
{{- with $value.downstream }}
|
||||
downstream: {{ . }}
|
||||
{{- end }}
|
||||
- apiVersion: spire.spiffe.io/v1alpha1
|
||||
kind: ClusterStaticEntry
|
||||
metadata:
|
||||
{{- if $useShortName }}
|
||||
name: {{ $key }}
|
||||
{{- else }}
|
||||
name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }}
|
||||
{{- end }}
|
||||
{{- with $value.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.labels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
|
||||
spiffeID: {{ $value.spiffeID | quote }}
|
||||
{{- with $value.federatesWith }}
|
||||
federatesWith:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.selectors }}
|
||||
selectors:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.parentID }}
|
||||
parentID: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.dnsNames }}
|
||||
dnsNames:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.hint }}
|
||||
hint: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.x509SVIDTTL }}
|
||||
x509SVIDTTL: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.jwtSVIDTTL }}
|
||||
jwtSVIDTTL: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.admin }}
|
||||
admin: {{ . }}
|
||||
{{- end }}
|
||||
{{- with $value.downstream }}
|
||||
downstream: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- $t := include "spire-server.cluster-static-entries" (dict "root" . "useShortName" false) | fromYamlArray }}
|
||||
{{- range $_, $v := $t }}
|
||||
---
|
||||
{{- $v | toYaml }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
@@ -39,3 +40,4 @@ webhooks:
|
||||
sideEffects: None
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
|
||||
apiVersion: v1
|
||||
@@ -93,3 +94,4 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
|
||||
apiVersion: v1
|
||||
@@ -93,3 +94,4 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
|
||||
apiVersion: v1
|
||||
@@ -93,3 +94,4 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -505,6 +505,11 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if ne .Values.controllerManager.staticManifestMode "off" }}
|
||||
- name: controller-manager-static-config
|
||||
configMap:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-static
|
||||
{{- end }}
|
||||
- name: controller-manager-config
|
||||
configMap:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
|
||||
@@ -511,6 +511,9 @@ controllerManager:
|
||||
## @param controllerManager.enabled Flag to enable controller manager
|
||||
enabled: false
|
||||
|
||||
## @param controllerManager.staticManifestMode Flag to configure static mode. Valid options off, internal, and external. If internal, the identities config options will be rendered to an included configmap
|
||||
staticManifestMode: "off"
|
||||
|
||||
## @param controllerManager.className specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs.
|
||||
className: ""
|
||||
## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.
|
||||
@@ -544,7 +547,7 @@ controllerManager:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-controller-manager
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "0.6.0"
|
||||
tag: "0.6.2"
|
||||
|
||||
## @param controllerManager.resources [object] Resource requests and limits for controller manager
|
||||
resources: {}
|
||||
@@ -897,12 +900,12 @@ nodeAttestor:
|
||||
## @param nodeAttestor.tpmDirect.image.tag Overrides the image tag
|
||||
##
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: boxboat/spire-tpm-plugin-tpm-attestor-server
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-tpm-plugin-tpm-attestor-server
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.8.7"
|
||||
tag: "v1.9.0"
|
||||
## @param nodeAttestor.tpmDirect.checksum The sha256 checksum of the plugin binary
|
||||
checksum: f39ef9cdd2b3dd74112bfe827b79d6721c59215d0d5f4c2e34fa09bbc60d36d2
|
||||
checksum: 46d0caad8c25a027dd11c93e18b58a8bc6fbd9f1fe2e36fa2a0dd440986de4dc
|
||||
## @param nodeAttestor.tpmDirect.pluginPath The filename in the container of the plugin
|
||||
pluginPath: /app/tpm_attestor_server
|
||||
## @param nodeAttestor.tpmDirect.cas A dictionary of TPM CA PEM or DER files that are allowed to connect.
|
||||
@@ -1104,7 +1107,7 @@ chown:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
tag: latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514
|
||||
tag: latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73
|
||||
|
||||
## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
@@ -1139,7 +1142,7 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514
|
||||
tag: latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73
|
||||
|
||||
## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters
|
||||
kubeConfigs: {}
|
||||
|
||||
@@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details.
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73` |
|
||||
|
||||
@@ -162,4 +162,4 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514
|
||||
tag: latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
spire-server:
|
||||
nodeAttestor:
|
||||
k8sPSAT:
|
||||
enabled: false
|
||||
joinToken:
|
||||
enabled: true
|
||||
tpmDirect:
|
||||
enabled: true
|
||||
controllerManager:
|
||||
enabled: true
|
||||
staticManifestMode: internal
|
||||
identities:
|
||||
clusterStaticEntries:
|
||||
foo-node:
|
||||
parentID: spiffe://example.org/spire/server
|
||||
spiffeID: spiffe://example.org/hosts/foo
|
||||
selectors:
|
||||
- tpm:pub_hash:12345
|
||||
foo-kubelet:
|
||||
parentID: spiffe://example.org/foo
|
||||
spiffeID: spiffe://example.org/k8s/one/node/foo
|
||||
selectors:
|
||||
- systemd:id:kubelet.service
|
||||
ingress:
|
||||
enabled: true
|
||||
spire-agent:
|
||||
enabled: false
|
||||
spiffe-csi-driver:
|
||||
enabled: false
|
||||
spiffe-oidc-discovery-provider:
|
||||
enabled: false
|
||||
+1
-1
@@ -50,7 +50,7 @@ require (
|
||||
github.com/xeipuuv/gojsonschema v1.2.0 // indirect
|
||||
go.uber.org/automaxprocs v1.6.0 // indirect
|
||||
golang.org/x/crypto v0.36.0 // indirect
|
||||
golang.org/x/net v0.37.0 // indirect
|
||||
golang.org/x/net v0.38.0 // indirect
|
||||
golang.org/x/oauth2 v0.23.0 // indirect
|
||||
golang.org/x/sys v0.32.0 // indirect
|
||||
golang.org/x/term v0.30.0 // indirect
|
||||
|
||||
+2
-2
@@ -133,8 +133,8 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
|
||||
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
|
||||
golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
|
||||
golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
|
||||
golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
|
||||
golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
|
||||
golang.org/x/oauth2 v0.23.0 h1:PbgcYx2W7i4LvjJWEbf0ngHV6qJYr86PkAV3bXdLEbs=
|
||||
golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
|
||||
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
|
||||
Reference in New Issue
Block a user