panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'main' into release

Browse Source
This commit is contained in:
Faisal Memon
2025-04-25 21:35:24 -07:00
parent 7c7f791e33 27ac69503b
commit 815e207f8f
31 changed files with 242 additions and 126 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/tests/charts.json
+1 -1
View File
@@ -2,7 +2,7 @@
{ {
"name": "kube-prometheus-stack", "name": "kube-prometheus-stack",
"repo": "https://prometheus-community.github.io/helm-charts", "repo": "https://prometheus-community.github.io/helm-charts",
"version": "70.4.1" "version": "70.7.0"
}, },
{ {
"name": "cert-manager", "name": "cert-manager",
.github/tests/oci-charts.json
+2 -2
View File
@@ -2,12 +2,12 @@
{ {
"name": "mysql", "name": "mysql",
"registry": "docker.io/bitnamicharts/mysql", "registry": "docker.io/bitnamicharts/mysql",
"version": "12.3.2" "version": "12.3.4"
}, },
{ {
"name": "postgresql", "name": "postgresql",
"registry": "docker.io/bitnamicharts/postgresql", "registry": "docker.io/bitnamicharts/postgresql",
"version": "16.6.1" "version": "16.6.3"
}, },
{ {
"name": "envoy-gateway", "name": "envoy-gateway",
charts/spire-nested/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spire-nested
description: > description: >
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
type: application type: application
version: 0.24.4 version: 0.24.5
appVersion: "1.12.0" appVersion: "1.12.0"
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
charts/spire-nested/README.md
+1 -1
View File
@@ -1,6 +1,6 @@
# spire # spire
![Version: 0.24.4](https://img.shields.io/badge/Version-0.24.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.12.0](https://img.shields.io/badge/AppVersion-1.12.0-informational?style=flat-square) ![Version: 0.24.5](https://img.shields.io/badge/Version-0.24.5-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.12.0](https://img.shields.io/badge/AppVersion-1.12.0-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
charts/spire/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spire
description: > description: >
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
type: application type: application
version: 0.24.4 version: 0.24.5
appVersion: "1.12.0" appVersion: "1.12.0"
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
charts/spire/README.md
+1 -1
View File
@@ -1,6 +1,6 @@
# spire # spire
![Version: 0.24.4](https://img.shields.io/badge/Version-0.24.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.12.0](https://img.shields.io/badge/AppVersion-1.12.0-informational?style=flat-square) ![Version: 0.24.5](https://img.shields.io/badge/Version-0.24.5-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.12.0](https://img.shields.io/badge/AppVersion-1.12.0-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+1 -1
View File
@@ -120,7 +120,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73` |
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+1 -1
View File
@@ -340,7 +340,7 @@ tests:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514 tag: latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73
toolkit: toolkit:
## @param tests.toolkit.image.registry The OCI registry to pull the image from ## @param tests.toolkit.image.registry The OCI registry to pull the image from
charts/spire/charts/spire-agent/README.md
+9 -9
View File
@@ -70,7 +70,7 @@ A Helm chart to install the SPIRE agent.
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514` | | `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73` |
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` |
@@ -79,17 +79,17 @@ A Helm chart to install the SPIRE agent.
| `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` | | `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` |
| `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` | | `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` |
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` | | `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `docker.io` | | `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-agent` | | `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-agent` |
| `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.8.7` | | `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.9.0` |
| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `1d7c73ccac948ee86cbd78ddde2d30128a1838b403f7bb2100d38d916a252244` | | `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `22f67063f1699330e70cdedc9b923e517688f5ae71085a26bd9b83b3060ee86e` |
| `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` | | `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` |
| `nodeAttestor.tpmDirect.pubHash.enabled` | Display pubhash in logs | `true` | | `nodeAttestor.tpmDirect.pubHash.enabled` | Display pubhash in logs | `true` |
| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `docker.io` | | `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-get-tpm-pubhash` | | `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-get-tpm-pubhash` |
| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.8.7` | | `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.9.0` |
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
| `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` | | `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` |
@@ -114,7 +114,7 @@ A Helm chart to install the SPIRE agent.
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` | | `socketAlternate.image.pullPolicy` | The image pull policy | `Always` |
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514` | | `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73` |
| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
charts/spire/charts/spire-agent/values.yaml
+9 -9
View File
@@ -153,7 +153,7 @@ fsGroupFix:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: Always pullPolicy: Always
tag: latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514 tag: latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {} resources: {}
@@ -186,12 +186,12 @@ nodeAttestor:
## @param nodeAttestor.tpmDirect.plugin.image.tag Overrides the image tag ## @param nodeAttestor.tpmDirect.plugin.image.tag Overrides the image tag
## ##
image: image:
registry: docker.io registry: ghcr.io
repository: boxboat/spire-tpm-plugin-tpm-attestor-agent repository: spiffe/spire-tpm-plugin-tpm-attestor-agent
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: "v1.8.7" tag: "v1.9.0"
## @param nodeAttestor.tpmDirect.plugin.checksum The sha256 checksum of the plugin binary ## @param nodeAttestor.tpmDirect.plugin.checksum The sha256 checksum of the plugin binary
checksum: 1d7c73ccac948ee86cbd78ddde2d30128a1838b403f7bb2100d38d916a252244 checksum: 22f67063f1699330e70cdedc9b923e517688f5ae71085a26bd9b83b3060ee86e
## @param nodeAttestor.tpmDirect.plugin.path The filename in the container of the plugin ## @param nodeAttestor.tpmDirect.plugin.path The filename in the container of the plugin
path: /app/tpm_attestor_agent path: /app/tpm_attestor_agent
pubHash: pubHash:
@@ -203,10 +203,10 @@ nodeAttestor:
## @param nodeAttestor.tpmDirect.pubHash.image.tag Overrides the image tag ## @param nodeAttestor.tpmDirect.pubHash.image.tag Overrides the image tag
## ##
image: image:
registry: docker.io registry: ghcr.io
repository: boxboat/spire-tpm-plugin-get-tpm-pubhash repository: spiffe/spire-tpm-plugin-get-tpm-pubhash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: "v1.8.7" tag: "v1.9.0"
# workloadAttestors determine a workload's properties and then generate a set of selectors associated with it. # workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
workloadAttestors: workloadAttestors:
@@ -280,7 +280,7 @@ socketAlternate:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: Always pullPolicy: Always
tag: latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514 tag: latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73
## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {} resources: {}
charts/spire/charts/spire-lib/templates/_helpers.tpl
+1 -1
View File
@@ -53,7 +53,7 @@
{{- $repo := .image.repository }} {{- $repo := .image.repository }}
{{- $tag := .image.tag | toString }} {{- $tag := .image.tag | toString }}
{{- if eq (substr 0 7 $tag) "sha256:" }} {{- if eq (substr 0 7 $tag) "sha256:" }}
{{- printf "%s/%s@%s" $registry $repo $tag | quote }} {{- printf "%s%s@%s" $registry $repo $tag | quote }}
{{- else if .appVersion }} {{- else if .appVersion }}
{{- $appVersion := .appVersion }} {{- $appVersion := .appVersion }}
{{- if and (hasKey . "ubi") (dig "openshift" false .global) }} {{- if and (hasKey . "ubi") (dig "openshift" false .global) }}
charts/spire/charts/spire-server/README.md
+8 -7
View File
@@ -257,6 +257,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `notifier.externalK8sBundle.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `bundle.crt` | | `notifier.externalK8sBundle.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `bundle.crt` |
| `notifier.externalK8sBundle.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` | | `notifier.externalK8sBundle.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
| `controllerManager.enabled` | Flag to enable controller manager | `false` | | `controllerManager.enabled` | Flag to enable controller manager | `false` |
| `controllerManager.staticManifestMode` | Flag to configure static mode. Valid options off, internal, and external. If internal, the identities config options will be rendered to an included configmap | `off` |
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` | | `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` | | `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
| `controllerManager.entryIDPrefixCleanup` | Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` | | `controllerManager.entryIDPrefixCleanup` | Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` |
@@ -268,7 +269,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.0` | | `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.2` |
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
| `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.securityContext` | Security context | `{}` |
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
@@ -365,11 +366,11 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `nodeAttestor.httpChallenge.allowNonRootPorts` | Allow using ports >= 1024 from clients for attestation | `true` | | `nodeAttestor.httpChallenge.allowNonRootPorts` | Allow using ports >= 1024 from clients for attestation | `true` |
| `nodeAttestor.httpChallenge.tofu` | Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024 | `true` | | `nodeAttestor.httpChallenge.tofu` | Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024 | `true` |
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` | | `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
| `nodeAttestor.tpmDirect.image.registry` | The OCI registry to pull the image from | `docker.io` | | `nodeAttestor.tpmDirect.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `nodeAttestor.tpmDirect.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-server` | | `nodeAttestor.tpmDirect.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-server` |
| `nodeAttestor.tpmDirect.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `nodeAttestor.tpmDirect.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `nodeAttestor.tpmDirect.image.tag` | Overrides the image tag | `v1.8.7` | | `nodeAttestor.tpmDirect.image.tag` | Overrides the image tag | `v1.9.0` |
| `nodeAttestor.tpmDirect.checksum` | The sha256 checksum of the plugin binary | `f39ef9cdd2b3dd74112bfe827b79d6721c59215d0d5f4c2e34fa09bbc60d36d2` | | `nodeAttestor.tpmDirect.checksum` | The sha256 checksum of the plugin binary | `46d0caad8c25a027dd11c93e18b58a8bc6fbd9f1fe2e36fa2a0dd440986de4dc` |
| `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` | | `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` |
| `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` | | `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` |
| `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` | | `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` |
@@ -437,7 +438,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `chown.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `chown.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `chown.image.repository` | The repository within the registry | `chainguard/bash` | | `chown.image.repository` | The repository within the registry | `chainguard/bash` |
| `chown.image.pullPolicy` | The image pull policy | `Always` | | `chown.image.pullPolicy` | The image pull policy | `Always` |
| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514` | | `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73` |
| `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `experimental.enabled` | Allow configuration of experimental features | `false` | | `experimental.enabled` | Allow configuration of experimental features | `false` |
| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | | `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` |
@@ -450,5 +451,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73` |
| `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` |
charts/spire/charts/spire-server/templates/_controller-manager-container.tpl
+10
View File
@@ -75,7 +75,11 @@
{{- end }} {{- end }}
env: env:
- name: ENABLE_WEBHOOKS - name: ENABLE_WEBHOOKS
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
value: {{ .webhooksEnabled | toString | quote }} value: {{ .webhooksEnabled | toString | quote }}
{{- else }}
value: "false"
{{- end }}
{{- if gt (len $extraEnv) 0 }} {{- if gt (len $extraEnv) 0 }}
{{- $extraEnv | toYaml | nindent 4 }} {{- $extraEnv | toYaml | nindent 4 }}
{{- end }} {{- end }}
@@ -91,6 +95,7 @@
- containerPort: {{ $promPort }} - containerPort: {{ $promPort }}
name: prom-cm{{ .suffix }} name: prom-cm{{ .suffix }}
{{- end }} {{- end }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
livenessProbe: livenessProbe:
httpGet: httpGet:
path: /healthz path: /healthz
@@ -99,12 +104,17 @@
httpGet: httpGet:
path: /readyz path: /readyz
port: healthz port: healthz
{{- end }}
resources: resources:
{{- toYaml .Values.controllerManager.resources | nindent 4 }} {{- toYaml .Values.controllerManager.resources | nindent 4 }}
volumeMounts: volumeMounts:
- name: spire-server-socket - name: spire-server-socket
mountPath: /tmp/spire-server/private mountPath: /tmp/spire-server/private
readOnly: true readOnly: true
{{- if ne .Values.controllerManager.staticManifestMode "off" }}
- name: controller-manager-static-config
mountPath: /manifests
{{- end }}
- name: controller-manager-config - name: controller-manager-config
mountPath: /controller-manager-config{{ .suffix }}.yaml mountPath: /controller-manager-config{{ .suffix }}.yaml
subPath: controller-manager-config{{ .suffix }}.yaml subPath: controller-manager-config{{ .suffix }}.yaml
charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml
+2
View File
@@ -26,6 +26,7 @@ matchLabels:
{} {}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
{{- $root := . }} {{- $root := . }}
{{ $namespaces := list .Release.Namespace .Values.namespaceOverride (dig "spire" "namespaces" "server" "name" "" .Values.global) (dig "spire" "namespaces" "system" "name" "" .Values.global) | compact | uniq }} {{ $namespaces := list .Release.Namespace .Values.namespaceOverride (dig "spire" "namespaces" "server" "name" "" .Values.global) (dig "spire" "namespaces" "system" "name" "" .Values.global) | compact | uniq }}
{{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }} {{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }}
@@ -116,3 +117,4 @@ spec:
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
+7
View File
@@ -47,10 +47,12 @@ metrics:
bindAddress: 0.0.0.0:{{ $promPort }} bindAddress: 0.0.0.0:{{ $promPort }}
health: health:
healthProbeBindAddress: 0.0.0.0:{{ $healthPort }} healthProbeBindAddress: 0.0.0.0:{{ $healthPort }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
leaderElection: leaderElection:
leaderElect: true leaderElect: true
resourceName: {{ printf "%s-%s%s" .Release.Namespace (default .Release.Name .Values.crNameOverride) .suffix | sha256sum | trunc 8 }}.spiffe.io resourceName: {{ printf "%s-%s%s" .Release.Namespace (default .Release.Name .Values.crNameOverride) .suffix | sha256sum | trunc 8 }}.spiffe.io
resourceNamespace: {{ include "spire-server.namespace" . }} resourceNamespace: {{ include "spire-server.namespace" . }}
{{- end }}
{{- with .settings.cacheNamespaces }} {{- with .settings.cacheNamespaces }}
cacheNamespaces: cacheNamespaces:
{{- toYaml . | nindent 2 }} {{- toYaml . | nindent 2 }}
@@ -85,7 +87,12 @@ parentIDTemplate: {{ if hasKey .settings "parentIDTemplate" }}{{ .settings.paren
{{- $reconcile = .settings.reconcile }} {{- $reconcile = .settings.reconcile }}
{{- end }} {{- end }}
reconcile: reconcile:
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
clusterSPIFFEIDs: {{ if hasKey $reconcile "clusterSPIFFEIDs" }}{{ toYaml $reconcile.clusterSPIFFEIDs }}{{ else }}{{ toYaml .defaults.reconcile.clusterSPIFFEIDs }}{{ end }} clusterSPIFFEIDs: {{ if hasKey $reconcile "clusterSPIFFEIDs" }}{{ toYaml $reconcile.clusterSPIFFEIDs }}{{ else }}{{ toYaml .defaults.reconcile.clusterSPIFFEIDs }}{{ end }}
{{- end }}
clusterStaticEntries: {{ if hasKey $reconcile "clusterStaticEntries" }}{{ toYaml $reconcile.clusterStaticEntries }}{{ else }}{{ toYaml .defaults.reconcile.clusterStaticEntries }}{{ end }} clusterStaticEntries: {{ if hasKey $reconcile "clusterStaticEntries" }}{{ toYaml $reconcile.clusterStaticEntries }}{{ else }}{{ toYaml .defaults.reconcile.clusterStaticEntries }}{{ end }}
clusterFederatedTrustDomains: {{ if hasKey $reconcile "clusterFederatedTrustDomains" }}{{ toYaml $reconcile.clusterFederatedTrustDomains }}{{ else }}{{ toYaml .defaults.reconcile.clusterFederatedTrustDomains }}{{ end }} clusterFederatedTrustDomains: {{ if hasKey $reconcile "clusterFederatedTrustDomains" }}{{ toYaml $reconcile.clusterFederatedTrustDomains }}{{ else }}{{ toYaml .defaults.reconcile.clusterFederatedTrustDomains }}{{ end }}
{{- if ne .Values.controllerManager.staticManifestMode "off" }}
staticManifestPath: /manifests
{{- end }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/templates/controller-manager-ftd.yaml
+43 -30
View File
@@ -1,5 +1,7 @@
{{- $root := . }} {{- define "spire-server.cluster-federated-trust-domains" -}}
{{- range $key, $value := .Values.controllerManager.identities.clusterFederatedTrustDomains }} {{- $root := .root }}
{{- $useShortName := .useShortName }}
{{- range $key, $value := $root.Values.controllerManager.identities.clusterFederatedTrustDomains }}
{{- range $skey, $svalue := $value }} {{- range $skey, $svalue := $value }}
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "bundleEndpointProfile" "bundleEndpointURL" "trustDomain" "trustDomainBundle")) }} {{- if not (has $skey (list "name" "annotations" "labels" "enabled" "bundleEndpointProfile" "bundleEndpointURL" "trustDomain" "trustDomainBundle")) }}
{{- fail (printf "Unsupported property specified: %s" $skey) }} {{- fail (printf "Unsupported property specified: %s" $skey) }}
@@ -12,34 +14,45 @@
{{- end }} {{- end }}
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }} {{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }} {{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
--- - apiVersion: spire.spiffe.io/v1alpha1
apiVersion: spire.spiffe.io/v1alpha1 kind: ClusterFederatedTrustDomain
kind: ClusterFederatedTrustDomain metadata:
metadata: {{- if $useShortName }}
name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }} name: {{ $key }}
{{- with $value.annotations }} {{- else }}
annotations: name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }}
{{- toYaml . | nindent 4 }} {{- end }}
{{- end }} {{- with $value.annotations }}
{{- with $value.labels }} annotations:
labels: {{- toYaml . | nindent 6 }}
{{- toYaml . | nindent 4 }} {{- end }}
{{- end }} {{- with $value.labels }}
spec: labels:
className: {{ include "spire-server.controller-manager-class-name" $root | quote }} {{- toYaml . | nindent 6 }}
{{- with $value.bundleEndpointProfile }} {{- end }}
bundleEndpointProfile: spec:
{{- toYaml . | nindent 4 }} className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
{{- end }} {{- with $value.bundleEndpointProfile }}
{{- with $value.bundleEndpointURL }} bundleEndpointProfile:
bundleEndpointURL: {{ . | quote }} {{- toYaml . | nindent 6 }}
{{- end }} {{- end }}
{{- with $value.trustDomain }} {{- with $value.bundleEndpointURL }}
trustDomain: {{ . | quote }} bundleEndpointURL: {{ . | quote }}
{{- end }} {{- end }}
{{- with $value.trustDomainBundle }} {{- with $value.trustDomain }}
trustDomainBundle: {{ . | quote }} trustDomain: {{ . | quote }}
{{- end }} {{- end }}
{{- with $value.trustDomainBundle }}
trustDomainBundle: {{ . | quote }}
{{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
{{- $t := include "spire-server.cluster-federated-trust-domains" (dict "root" . "useShortName" false) | fromYamlArray }}
{{- range $_, $v := $t }}
---
{{- $v | toYaml }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/controller-manager-roles.yaml
+1 -1
View File
@@ -1,4 +1,4 @@
{{- if eq (.Values.controllerManager.enabled | toString) "true" }} {{- if and (eq (.Values.controllerManager.enabled | toString) "true") (eq .Values.controllerManager.staticManifestMode "off") }}
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: Role kind: Role
metadata: metadata:
charts/spire/charts/spire-server/templates/controller-manager-service.yaml
+2
View File
@@ -1,4 +1,5 @@
{{- if not .Values.externalServer }} {{- if not .Values.externalServer }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
{{- if eq (.Values.controllerManager.enabled | toString) "true" }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
apiVersion: v1 apiVersion: v1
kind: Service kind: Service
@@ -22,3 +23,4 @@ spec:
{{- include "spire-server.selectorLabels" . | nindent 4 }} {{- include "spire-server.selectorLabels" . | nindent 4 }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/controller-manager-static-configmap.yaml
+21
View File
@@ -0,0 +1,21 @@
{{- if not (has .Values.controllerManager.staticManifestMode (list "off" "internal" "external" )) }}
{{- fail "Unsupported option specified for controllerManager.staticManifestMode" }}
{{- end }}
{{- if eq .Values.controllerManager.staticManifestMode "internal" }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "spire-controller-manager.fullname" . }}-static
namespace: {{ include "spire-server.namespace" . }}
data:
{{- $t := include "spire-server.cluster-static-entries" (dict "root" . "useShortName" true) | fromYamlArray }}
{{- range $_, $v := $t }}
"e-{{ $v.metadata.name }}.yaml": |
{{- $v | toYaml | nindent 4 }}
{{- end }}
{{- $t := include "spire-server.cluster-federated-trust-domains" (dict "root" . "useShortName" true) | fromYamlArray }}
{{- range $_, $v := $t }}
"f-{{ $v.metadata.name }}.yaml": |
{{- $v | toYaml | nindent 4 }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/controller-manager-static-entries.yaml
+61 -48
View File
@@ -1,5 +1,7 @@
{{- $root := . }} {{- define "spire-server.cluster-static-entries" -}}
{{- range $key, $value := .Values.controllerManager.identities.clusterStaticEntries }} {{- $root := .root }}
{{- $useShortName := .useShortName }}
{{- range $key, $value := $root.Values.controllerManager.identities.clusterStaticEntries }}
{{- range $skey, $svalue := $value }} {{- range $skey, $svalue := $value }}
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "admin" "dnsNames" "downstream" "federatesWith" "hint" "jwtSVIDTTL" "parentID" "selectors" "spiffeID" "x509SVIDTTL")) }} {{- if not (has $skey (list "name" "annotations" "labels" "enabled" "admin" "dnsNames" "downstream" "federatesWith" "hint" "jwtSVIDTTL" "parentID" "selectors" "spiffeID" "x509SVIDTTL")) }}
{{- fail (printf "Unsupported property specified: %s" $skey) }} {{- fail (printf "Unsupported property specified: %s" $skey) }}
@@ -12,52 +14,63 @@
{{- end }} {{- end }}
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }} {{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }} {{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
--- - apiVersion: spire.spiffe.io/v1alpha1
apiVersion: spire.spiffe.io/v1alpha1 kind: ClusterStaticEntry
kind: ClusterStaticEntry metadata:
metadata: {{- if $useShortName }}
name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }} name: {{ $key }}
{{- with $value.annotations }} {{- else }}
annotations: name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }}
{{- toYaml . | nindent 4 }} {{- end }}
{{- end }} {{- with $value.annotations }}
{{- with $value.labels }} annotations:
labels: {{- toYaml . | nindent 6 }}
{{- toYaml . | nindent 4 }} {{- end }}
{{- end }} {{- with $value.labels }}
spec: labels:
className: {{ include "spire-server.controller-manager-class-name" $root | quote }} {{- toYaml . | nindent 6 }}
spiffeID: {{ $value.spiffeID | quote }} {{- end }}
{{- with $value.federatesWith }} spec:
federatesWith: className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
{{- toYaml . | nindent 4 }} spiffeID: {{ $value.spiffeID | quote }}
{{- end }} {{- with $value.federatesWith }}
{{- with $value.selectors }} federatesWith:
selectors: {{- toYaml . | nindent 6 }}
{{- toYaml . | nindent 4 }} {{- end }}
{{- end }} {{- with $value.selectors }}
{{- with $value.parentID }} selectors:
parentID: {{ . | quote }} {{- toYaml . | nindent 6 }}
{{- end }} {{- end }}
{{- with $value.dnsNames }} {{- with $value.parentID }}
dnsNames: parentID: {{ . | quote }}
{{- toYaml . | nindent 4 }} {{- end }}
{{- end }} {{- with $value.dnsNames }}
{{- with $value.hint }} dnsNames:
hint: {{ . | quote }} {{- toYaml . | nindent 6 }}
{{- end }} {{- end }}
{{- with $value.x509SVIDTTL }} {{- with $value.hint }}
x509SVIDTTL: {{ . | quote }} hint: {{ . | quote }}
{{- end }} {{- end }}
{{- with $value.jwtSVIDTTL }} {{- with $value.x509SVIDTTL }}
jwtSVIDTTL: {{ . | quote }} x509SVIDTTL: {{ . | quote }}
{{- end }} {{- end }}
{{- with $value.admin }} {{- with $value.jwtSVIDTTL }}
admin: {{ . }} jwtSVIDTTL: {{ . | quote }}
{{- end }} {{- end }}
{{- with $value.downstream }} {{- with $value.admin }}
downstream: {{ . }} admin: {{ . }}
{{- end }} {{- end }}
{{- with $value.downstream }}
downstream: {{ . }}
{{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
{{- $t := include "spire-server.cluster-static-entries" (dict "root" . "useShortName" false) | fromYamlArray }}
{{- range $_, $v := $t }}
---
{{- $v | toYaml }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml
+2
View File
@@ -1,4 +1,5 @@
{{- if not .Values.externalServer }} {{- if not .Values.externalServer }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }} {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
apiVersion: admissionregistration.k8s.io/v1 apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration kind: ValidatingWebhookConfiguration
@@ -39,3 +40,4 @@ webhooks:
sideEffects: None sideEffects: None
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/post-install-hook.yaml
+2
View File
@@ -1,5 +1,6 @@
{{- if not .Values.externalServer }} {{- if not .Values.externalServer }}
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }} {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
apiVersion: v1 apiVersion: v1
@@ -93,3 +94,4 @@ spec:
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+2
View File
@@ -1,5 +1,6 @@
{{- if not .Values.externalServer }} {{- if not .Values.externalServer }}
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }} {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
apiVersion: v1 apiVersion: v1
@@ -93,3 +94,4 @@ spec:
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+2
View File
@@ -1,5 +1,6 @@
{{- if not .Values.externalServer }} {{- if not .Values.externalServer }}
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }} {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
apiVersion: v1 apiVersion: v1
@@ -93,3 +94,4 @@ spec:
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/server-resource.yaml
+5
View File
@@ -505,6 +505,11 @@ spec:
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- if eq (.Values.controllerManager.enabled | toString) "true" }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
{{- if ne .Values.controllerManager.staticManifestMode "off" }}
- name: controller-manager-static-config
configMap:
name: {{ include "spire-controller-manager.fullname" . }}-static
{{- end }}
- name: controller-manager-config - name: controller-manager-config
configMap: configMap:
name: {{ include "spire-controller-manager.fullname" . }} name: {{ include "spire-controller-manager.fullname" . }}
charts/spire/charts/spire-server/values.yaml
+10 -7
View File
@@ -511,6 +511,9 @@ controllerManager:
## @param controllerManager.enabled Flag to enable controller manager ## @param controllerManager.enabled Flag to enable controller manager
enabled: false enabled: false
## @param controllerManager.staticManifestMode Flag to configure static mode. Valid options off, internal, and external. If internal, the identities config options will be rendered to an included configmap
staticManifestMode: "off"
## @param controllerManager.className specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. ## @param controllerManager.className specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs.
className: "" className: ""
## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. ## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.
@@ -544,7 +547,7 @@ controllerManager:
registry: ghcr.io registry: ghcr.io
repository: spiffe/spire-controller-manager repository: spiffe/spire-controller-manager
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: "0.6.0" tag: "0.6.2"
## @param controllerManager.resources [object] Resource requests and limits for controller manager ## @param controllerManager.resources [object] Resource requests and limits for controller manager
resources: {} resources: {}
@@ -897,12 +900,12 @@ nodeAttestor:
## @param nodeAttestor.tpmDirect.image.tag Overrides the image tag ## @param nodeAttestor.tpmDirect.image.tag Overrides the image tag
## ##
image: image:
registry: docker.io registry: ghcr.io
repository: boxboat/spire-tpm-plugin-tpm-attestor-server repository: spiffe/spire-tpm-plugin-tpm-attestor-server
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: "v1.8.7" tag: "v1.9.0"
## @param nodeAttestor.tpmDirect.checksum The sha256 checksum of the plugin binary ## @param nodeAttestor.tpmDirect.checksum The sha256 checksum of the plugin binary
checksum: f39ef9cdd2b3dd74112bfe827b79d6721c59215d0d5f4c2e34fa09bbc60d36d2 checksum: 46d0caad8c25a027dd11c93e18b58a8bc6fbd9f1fe2e36fa2a0dd440986de4dc
## @param nodeAttestor.tpmDirect.pluginPath The filename in the container of the plugin ## @param nodeAttestor.tpmDirect.pluginPath The filename in the container of the plugin
pluginPath: /app/tpm_attestor_server pluginPath: /app/tpm_attestor_server
## @param nodeAttestor.tpmDirect.cas A dictionary of TPM CA PEM or DER files that are allowed to connect. ## @param nodeAttestor.tpmDirect.cas A dictionary of TPM CA PEM or DER files that are allowed to connect.
@@ -1104,7 +1107,7 @@ chown:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: Always pullPolicy: Always
tag: latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514 tag: latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73
## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ ## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {} resources: {}
@@ -1139,7 +1142,7 @@ tests:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514 tag: latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73
## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters
kubeConfigs: {} kubeConfigs: {}
charts/spire/charts/tornjak-frontend/README.md
+1 -1
View File
@@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details.
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73` |
charts/spire/charts/tornjak-frontend/values.yaml
+1 -1
View File
@@ -162,4 +162,4 @@ tests:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:ce272ee5a3739a3c45784c317b2fb1e93a4cc4ea1f4d3feabb702b278e5bf514 tag: latest@sha256:0cc351822c8e066b93d28344713d1a6cbad83e3ee4906d137d7a4e85d9a06f73
examples/static-manifest-server/values.yaml
+31
View File
@@ -0,0 +1,31 @@
spire-server:
nodeAttestor:
k8sPSAT:
enabled: false
joinToken:
enabled: true
tpmDirect:
enabled: true
controllerManager:
enabled: true
staticManifestMode: internal
identities:
clusterStaticEntries:
foo-node:
parentID: spiffe://example.org/spire/server
spiffeID: spiffe://example.org/hosts/foo
selectors:
- tpm:pub_hash:12345
foo-kubelet:
parentID: spiffe://example.org/foo
spiffeID: spiffe://example.org/k8s/one/node/foo
selectors:
- systemd:id:kubelet.service
ingress:
enabled: true
spire-agent:
enabled: false
spiffe-csi-driver:
enabled: false
spiffe-oidc-discovery-provider:
enabled: false
tests/go.mod
+1 -1
View File
@@ -50,7 +50,7 @@ require (
github.com/xeipuuv/gojsonschema v1.2.0 // indirect github.com/xeipuuv/gojsonschema v1.2.0 // indirect
go.uber.org/automaxprocs v1.6.0 // indirect go.uber.org/automaxprocs v1.6.0 // indirect
golang.org/x/crypto v0.36.0 // indirect golang.org/x/crypto v0.36.0 // indirect
golang.org/x/net v0.37.0 // indirect golang.org/x/net v0.38.0 // indirect
golang.org/x/oauth2 v0.23.0 // indirect golang.org/x/oauth2 v0.23.0 // indirect
golang.org/x/sys v0.32.0 // indirect golang.org/x/sys v0.32.0 // indirect
golang.org/x/term v0.30.0 // indirect golang.org/x/term v0.30.0 // indirect
tests/go.sum
+2 -2
View File
@@ -133,8 +133,8 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c= golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8= golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
golang.org/x/oauth2 v0.23.0 h1:PbgcYx2W7i4LvjJWEbf0ngHV6qJYr86PkAV3bXdLEbs= golang.org/x/oauth2 v0.23.0 h1:PbgcYx2W7i4LvjJWEbf0ngHV6qJYr86PkAV3bXdLEbs=
golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI= golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=