From 8a28a1b94fa93c4d7729eedff20e5497604b088f Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Fri, 21 Aug 2026 12:23:46 -0700 Subject: [PATCH] Update spire to 1.15.3 (#926) --- charts/spire-identity-exchange/README.md | 349 +++++++++--------- .../templates/configmap.yaml | 3 +- .../templates/deployment.yaml | 37 -- charts/spire-identity-exchange/values.yaml | 26 +- charts/spire-nested/Chart.yaml | 2 +- charts/spire-nested/README.md | 2 +- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- .../spiffe-oidc-discovery-provider/Chart.yaml | 2 +- charts/spire/charts/spire-agent/Chart.yaml | 2 +- charts/spire/charts/spire-server/Chart.yaml | 2 +- 11 files changed, 181 insertions(+), 248 deletions(-) diff --git a/charts/spire-identity-exchange/README.md b/charts/spire-identity-exchange/README.md index ff8db16..79468c4 100644 --- a/charts/spire-identity-exchange/README.md +++ b/charts/spire-identity-exchange/README.md @@ -72,180 +72,175 @@ controllerManager: ### Chart parameters -| Name | Description | Value | -| ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- | -| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | -| `csiDriverName` | The csi driver to use | `csi.spiffe.io` | -| `replicaCount` | Replica count | `1` | -| `namespaceOverride` | Namespace override | `""` | -| `annotations` | Annotations for the deployment | `{}` | -| `labels` | Labels for the deployment | `{}` | -| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `image.repository` | The repository within the registry | `spiffe/spire-identity-exchange-server` | -| `image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `spireServerAttestorSPIFFEWorkloadAPI.resources` | Resource requests and limits | `{}` | -| `spireServerAttestorSPIFFEWorkloadAPI.image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `spireServerAttestorSPIFFEWorkloadAPI.image.repository` | The repository within the registry | `spiffe/spire-server-attestor-spiffe-workload-api` | -| `spireServerAttestorSPIFFEWorkloadAPI.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `spireServerAttestorSPIFFEWorkloadAPI.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `spireAgent.resources` | Resource requests and limits | `{}` | -| `spireAgent.image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `spireAgent.image.repository` | The repository within the registry | `spiffe/spire-agent` | -| `spireAgent.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `spireAgent.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.15.2` | -| `extraEnv` | Extra environment variables to add to the spire identity exchange | `[]` | -| `resources` | Resource requests and limits | `{}` | -| `configMap.annotations` | Annotations to add to the SPIRE Identity Exchange ConfigMap | `{}` | -| `podSecurityContext` | Pod security context for SPIRE Identity Exchange pods | `{}` | -| `securityContext` | Security context for SPIRE Identity Exchange deployment | `{}` | -| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | -| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | -| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | -| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | -| `podAnnotations` | Pod annotations for SPIRE Identity Exchange | `{}` | -| `podLabels` | Labels to add to pods | `{}` | -| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | -| `config.logFormat` | The log format, valid values are "text" and "json" | `text` | -| `telemetry.prometheus.port` | Port for prometheus metrics | `4950` | -| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | -| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the helm release | `""` | -| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | -| `imagePullSecrets` | Image pull secret names | `[]` | -| `nameOverride` | Name override | `""` | -| `fullnameOverride` | Full name override | `""` | -| `serviceAccount.create` | Specifies whether a service account should be created | `true` | -| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | -| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | -| `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | -| `autoscaling.enabled` | Flag to enable autoscaling | `false` | -| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` | -| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` | -| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` | -| `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` | -| `nodeSelector` | Node selector | `{}` | -| `tolerations` | list of tolerations | `[]` | -| `affinity` | Node affinity | `{}` | -| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | -| `clusterName` | The name of this Kubernetes cluster, as it appears in SPIFFE ID paths | `example-cluster` | -| `jwtIssuer` | The issuer URL for JWT-SVIDs. Defaults to https://oidc-discovery.$trustDomain | `""` | -| `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` | -| `auth.plugins.k8s_psat.enabled` | Enable the k8s psat plugin | `true` | -| `auth.plugins.k8s_psat.config.audiences` | The audiences to allow | `[]` | -| `auth.plugins.k8s_psat.config.allowedServiceAccounts` | The service accounts that are allowed | `[]` | -| `auth.plugins.spiffe.enabled` | Enable the spiffe plugin | `true` | -| `auth.plugins.spiffe.keySource` | What source to use to fetch the keys. Can be oidc or oidcLocal. oidcLocal forces discoveryURL to be the internal discovery address. | `oidcLocal` | -| `auth.plugins.spiffe.csiDriverName` | The CSI driver providing the SPIRE Agent workload socket this plugin attests against. Defaults to the chart level csiDriverName. Requires config.connectWithTrustBundle. | | -| `auth.plugins.spiffe.config.issuerURL` | The url to connect to for JWKS discovery | `${SPIFFE_JWT_ISSUER}` | -| `auth.plugins.spiffe.config.trustDomain` | The trust domain to use | `${SPIFFE_TRUST_DOMAIN}` | -| `auth.plugins.spiffe.config.pathPatterns` | The service accounts that are allowed | `[]` | -| `auth.plugins.spiffe.config.audiences` | The audiences to allow | `[]` | -| `auth.plugins.spiffe.config.connectWithTrustBundle` | Use the trust bundle to validate the issuerURL | `true` | -| `auth.stacks.image_pull.enabled` | Enable the image_pull stack | `true` | -| `auth.stacks.image_pull.plugins` | List of plugins that are required by this stack | `[]` | -| `auth.unsupportedBuiltInPlugins` | Unsupported mechanism to use plugins not yet supported by the chart. | `{}` | -| `auth.passthroughPlugins` | Address each plugin as a stack of its own, in addition to any stacks defined | `false` | -| `tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` | -| `tls.externalSecret.secretName` | Specify which Secret to use | `""` | -| `tls.certManager.enabled` | Use certificateManager to create the certificate | `false` | -| `tls.certManager.issuer.create` | Create an issuer to use to issue the certificate | `true` | -| `tls.certManager.issuer.acme.email` | Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service | `""` | -| `tls.certManager.issuer.acme.server` | Server to use to get certificate. Defaults to LetsEncrypt | `https://acme-v02.api.letsencrypt.org/directory` | -| `tls.certManager.issuer.acme.solvers` | Configure the issuer solvers. Defaults to http01 via ingress. | `{}` | -| `tls.certManager.certificate.dnsNames` | Override the dnsNames on the certificate request. Defaults to the same settings as Ingress | `[]` | -| `tls.certManager.certificate.issuerRef.group` | If you are using an external plugin, specify the group for it here | `""` | -| `tls.certManager.certificate.issuerRef.kind` | Kind of the issuer reference. Override if you want to use a ClusterIssuer | `Issuer` | -| `tls.certManager.certificate.issuerRef.name` | Name of the issuer to use. If unset, it will use the name of the built in issuer | `""` | -| `tls.rest.enabled` | Enable the REST listener served with the certificate from disk | `false` | -| `tls.rest.port` | Container port for the REST listener served with the certificate from disk | `8444` | -| `tls.rest.service.type` | Service type | `ClusterIP` | -| `tls.rest.service.port` | port for the service | `443` | -| `tls.rest.service.annotations` | Annotations for service resource | `{}` | -| `tls.rest.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` | -| `tls.rest.ingress.enabled` | Flag to enable ingress | `false` | -| `tls.rest.ingress.className` | Ingress class name | `""` | -| `tls.rest.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | -| `tls.rest.ingress.annotations` | Annotations for ingress object | `{}` | -| `tls.rest.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-identity-exchange-rest` | -| `tls.rest.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | -| `tls.rest.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | -| `tls.rest.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | -| `tls.rest.gatewayAPI.enabled` | Flag to expose the endpoint via Gateway API | `false` | -| `tls.rest.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-identity-exchange-rest` | -| `tls.rest.gatewayAPI.tlsSecret` | Secret with the TLS cert for edge termination. Blank keeps passthrough. | `""` | -| `tls.rest.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` | -| `tls.rest.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` | -| `tls.rest.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` | -| `tls.rest.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` | -| `tls.rest.gatewayAPI.backendTLS.caCertificateRefs` | ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap. | `[]` | -| `tls.grpc.enabled` | Enable the gRPC listener served with the certificate from disk | `false` | -| `tls.grpc.port` | Container port for the gRPC listener served with the certificate from disk | `8443` | -| `tls.grpc.service.type` | Service type | `ClusterIP` | -| `tls.grpc.service.port` | port for the service | `443` | -| `tls.grpc.service.annotations` | Annotations for service resource | `{}` | -| `tls.grpc.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` | -| `tls.grpc.ingress.enabled` | Flag to enable ingress | `false` | -| `tls.grpc.ingress.className` | Ingress class name | `""` | -| `tls.grpc.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | -| `tls.grpc.ingress.annotations` | Annotations for ingress object | `{}` | -| `tls.grpc.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The grpc of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-identity-exchange-grpc` | -| `tls.grpc.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | -| `tls.grpc.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | -| `tls.grpc.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | -| `tls.grpc.gatewayAPI.enabled` | Flag to expose the endpoint via Gateway API | `false` | -| `tls.grpc.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-identity-exchange-grpc` | -| `tls.grpc.gatewayAPI.tlsSecret` | Secret with the TLS cert for edge termination. Blank keeps passthrough. | `""` | -| `tls.grpc.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` | -| `tls.grpc.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` | -| `tls.grpc.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` | -| `tls.grpc.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` | -| `tls.grpc.gatewayAPI.backendTLS.caCertificateRefs` | ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap. | `[]` | -| `spiffe.rest.enabled` | Enable the REST listener served with this deployment's own X509-SVID | `true` | -| `spiffe.rest.port` | Container port for the REST listener served with this deployment's own X509-SVID | `8544` | -| `spiffe.rest.service.type` | Service type | `ClusterIP` | -| `spiffe.rest.service.port` | port for the service | `443` | -| `spiffe.rest.service.annotations` | Annotations for service resource | `{}` | -| `spiffe.rest.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` | -| `spiffe.rest.ingress.enabled` | Flag to enable ingress | `false` | -| `spiffe.rest.ingress.className` | Ingress class name | `""` | -| `spiffe.rest.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | -| `spiffe.rest.ingress.annotations` | Annotations for ingress object | `{}` | -| `spiffe.rest.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-identity-exchange-rest-spiffe` | -| `spiffe.rest.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | -| `spiffe.rest.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | -| `spiffe.rest.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | -| `spiffe.rest.gatewayAPI.enabled` | Flag to expose the endpoint via Gateway API | `false` | -| `spiffe.rest.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-identity-exchange-rest-spiffe` | -| `spiffe.rest.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` | -| `spiffe.rest.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` | -| `spiffe.rest.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` | -| `spiffe.rest.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` | -| `spiffe.grpc.enabled` | Enable the gRPC listener served with this deployment's own X509-SVID | `false` | -| `spiffe.grpc.port` | Container port for the gRPC listener served with this deployment's own X509-SVID | `8543` | -| `spiffe.grpc.service.type` | Service type | `ClusterIP` | -| `spiffe.grpc.service.port` | port for the service | `443` | -| `spiffe.grpc.service.annotations` | Annotations for service resource | `{}` | -| `spiffe.grpc.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` | -| `spiffe.grpc.ingress.enabled` | Flag to enable ingress | `false` | -| `spiffe.grpc.ingress.className` | Ingress class name | `""` | -| `spiffe.grpc.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | -| `spiffe.grpc.ingress.annotations` | Annotations for ingress object | `{}` | -| `spiffe.grpc.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The grpc of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-identity-exchange-grpc-spiffe` | -| `spiffe.grpc.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | -| `spiffe.grpc.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | -| `spiffe.grpc.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | -| `spiffe.grpc.gatewayAPI.enabled` | Flag to expose the endpoint via Gateway API | `false` | -| `spiffe.grpc.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-identity-exchange-grpc-spiffe` | -| `spiffe.grpc.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` | -| `spiffe.grpc.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` | -| `spiffe.grpc.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` | -| `spiffe.grpc.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` | -| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | -| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` | -| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `clusterRole.create` | create a k8s cluster role to allow access to token reviews and oidc discovery | `true` | -| `server.address` | Address for Spire server | `""` | -| `server.port` | Port number for Spire server | `443` | -| `server.namespaceOverride` | Override the namespace for Spire server | `""` | -| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` | +| Name | Description | Value | +| ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ | +| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | +| `csiDriverName` | The csi driver to use | `csi.spiffe.io` | +| `replicaCount` | Replica count | `1` | +| `namespaceOverride` | Namespace override | `""` | +| `annotations` | Annotations for the deployment | `{}` | +| `labels` | Labels for the deployment | `{}` | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/spire-identity-exchange-server` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `spireAgent.resources` | Resource requests and limits | `{}` | +| `spireAgent.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `spireAgent.image.repository` | The repository within the registry | `spiffe/spire-agent` | +| `spireAgent.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `spireAgent.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.15.3` | +| `extraEnv` | Extra environment variables to add to the spire identity exchange | `[]` | +| `resources` | Resource requests and limits | `{}` | +| `configMap.annotations` | Annotations to add to the SPIRE Identity Exchange ConfigMap | `{}` | +| `podSecurityContext` | Pod security context for SPIRE Identity Exchange pods | `{}` | +| `securityContext` | Security context for SPIRE Identity Exchange deployment | `{}` | +| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | +| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | +| `podAnnotations` | Pod annotations for SPIRE Identity Exchange | `{}` | +| `podLabels` | Labels to add to pods | `{}` | +| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | +| `config.logFormat` | The log format, valid values are "text" and "json" | `text` | +| `telemetry.prometheus.port` | Port for prometheus metrics | `4950` | +| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | +| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the helm release | `""` | +| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | +| `imagePullSecrets` | Image pull secret names | `[]` | +| `nameOverride` | Name override | `""` | +| `fullnameOverride` | Full name override | `""` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | +| `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | +| `autoscaling.enabled` | Flag to enable autoscaling | `false` | +| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` | +| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` | +| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` | +| `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` | +| `nodeSelector` | Node selector | `{}` | +| `tolerations` | list of tolerations | `[]` | +| `affinity` | Node affinity | `{}` | +| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | +| `clusterName` | The name of this Kubernetes cluster, as it appears in SPIFFE ID paths | `example-cluster` | +| `jwtIssuer` | The issuer URL for JWT-SVIDs. Defaults to https://oidc-discovery.$trustDomain | `""` | +| `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` | +| `auth.plugins.k8s_psat.enabled` | Enable the k8s psat plugin | `true` | +| `auth.plugins.k8s_psat.config.audiences` | The audiences to allow | `[]` | +| `auth.plugins.k8s_psat.config.allowedServiceAccounts` | The service accounts that are allowed | `[]` | +| `auth.plugins.spiffe.enabled` | Enable the spiffe plugin | `true` | +| `auth.plugins.spiffe.keySource` | What source to use to fetch the keys. Can be oidc or oidcLocal. oidcLocal forces discoveryURL to be the internal discovery address. | `oidcLocal` | +| `auth.plugins.spiffe.csiDriverName` | The CSI driver providing the SPIRE Agent workload socket this plugin attests against. Defaults to the chart level csiDriverName. Requires config.connectWithTrustBundle. | | +| `auth.plugins.spiffe.config.issuerURL` | The url to connect to for JWKS discovery | `${SPIFFE_JWT_ISSUER}` | +| `auth.plugins.spiffe.config.trustDomain` | The trust domain to use | `${SPIFFE_TRUST_DOMAIN}` | +| `auth.plugins.spiffe.config.pathPatterns` | The service accounts that are allowed | `[]` | +| `auth.plugins.spiffe.config.audiences` | The audiences to allow | `[]` | +| `auth.plugins.spiffe.config.connectWithTrustBundle` | Use the trust bundle to validate the issuerURL | `true` | +| `auth.stacks.image_pull.enabled` | Enable the image_pull stack | `true` | +| `auth.stacks.image_pull.plugins` | List of plugins that are required by this stack | `[]` | +| `auth.unsupportedBuiltInPlugins` | Unsupported mechanism to use plugins not yet supported by the chart. | `{}` | +| `auth.passthroughPlugins` | Address each plugin as a stack of its own, in addition to any stacks defined | `false` | +| `tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` | +| `tls.externalSecret.secretName` | Specify which Secret to use | `""` | +| `tls.certManager.enabled` | Use certificateManager to create the certificate | `false` | +| `tls.certManager.issuer.create` | Create an issuer to use to issue the certificate | `true` | +| `tls.certManager.issuer.acme.email` | Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service | `""` | +| `tls.certManager.issuer.acme.server` | Server to use to get certificate. Defaults to LetsEncrypt | `https://acme-v02.api.letsencrypt.org/directory` | +| `tls.certManager.issuer.acme.solvers` | Configure the issuer solvers. Defaults to http01 via ingress. | `{}` | +| `tls.certManager.certificate.dnsNames` | Override the dnsNames on the certificate request. Defaults to the same settings as Ingress | `[]` | +| `tls.certManager.certificate.issuerRef.group` | If you are using an external plugin, specify the group for it here | `""` | +| `tls.certManager.certificate.issuerRef.kind` | Kind of the issuer reference. Override if you want to use a ClusterIssuer | `Issuer` | +| `tls.certManager.certificate.issuerRef.name` | Name of the issuer to use. If unset, it will use the name of the built in issuer | `""` | +| `tls.rest.enabled` | Enable the REST listener served with the certificate from disk | `false` | +| `tls.rest.port` | Container port for the REST listener served with the certificate from disk | `8444` | +| `tls.rest.service.type` | Service type | `ClusterIP` | +| `tls.rest.service.port` | port for the service | `443` | +| `tls.rest.service.annotations` | Annotations for service resource | `{}` | +| `tls.rest.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` | +| `tls.rest.ingress.enabled` | Flag to enable ingress | `false` | +| `tls.rest.ingress.className` | Ingress class name | `""` | +| `tls.rest.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | +| `tls.rest.ingress.annotations` | Annotations for ingress object | `{}` | +| `tls.rest.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-identity-exchange-rest` | +| `tls.rest.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `tls.rest.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `tls.rest.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | +| `tls.rest.gatewayAPI.enabled` | Flag to expose the endpoint via Gateway API | `false` | +| `tls.rest.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-identity-exchange-rest` | +| `tls.rest.gatewayAPI.tlsSecret` | Secret with the TLS cert for edge termination. Blank keeps passthrough. | `""` | +| `tls.rest.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` | +| `tls.rest.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` | +| `tls.rest.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` | +| `tls.rest.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` | +| `tls.rest.gatewayAPI.backendTLS.caCertificateRefs` | ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap. | `[]` | +| `tls.grpc.enabled` | Enable the gRPC listener served with the certificate from disk | `false` | +| `tls.grpc.port` | Container port for the gRPC listener served with the certificate from disk | `8443` | +| `tls.grpc.service.type` | Service type | `ClusterIP` | +| `tls.grpc.service.port` | port for the service | `443` | +| `tls.grpc.service.annotations` | Annotations for service resource | `{}` | +| `tls.grpc.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` | +| `tls.grpc.ingress.enabled` | Flag to enable ingress | `false` | +| `tls.grpc.ingress.className` | Ingress class name | `""` | +| `tls.grpc.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | +| `tls.grpc.ingress.annotations` | Annotations for ingress object | `{}` | +| `tls.grpc.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The grpc of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-identity-exchange-grpc` | +| `tls.grpc.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `tls.grpc.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `tls.grpc.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | +| `tls.grpc.gatewayAPI.enabled` | Flag to expose the endpoint via Gateway API | `false` | +| `tls.grpc.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-identity-exchange-grpc` | +| `tls.grpc.gatewayAPI.tlsSecret` | Secret with the TLS cert for edge termination. Blank keeps passthrough. | `""` | +| `tls.grpc.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` | +| `tls.grpc.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` | +| `tls.grpc.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` | +| `tls.grpc.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` | +| `tls.grpc.gatewayAPI.backendTLS.caCertificateRefs` | ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap. | `[]` | +| `spiffe.rest.enabled` | Enable the REST listener served with this deployment's own X509-SVID | `true` | +| `spiffe.rest.port` | Container port for the REST listener served with this deployment's own X509-SVID | `8544` | +| `spiffe.rest.service.type` | Service type | `ClusterIP` | +| `spiffe.rest.service.port` | port for the service | `443` | +| `spiffe.rest.service.annotations` | Annotations for service resource | `{}` | +| `spiffe.rest.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` | +| `spiffe.rest.ingress.enabled` | Flag to enable ingress | `false` | +| `spiffe.rest.ingress.className` | Ingress class name | `""` | +| `spiffe.rest.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | +| `spiffe.rest.ingress.annotations` | Annotations for ingress object | `{}` | +| `spiffe.rest.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-identity-exchange-rest-spiffe` | +| `spiffe.rest.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `spiffe.rest.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `spiffe.rest.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | +| `spiffe.rest.gatewayAPI.enabled` | Flag to expose the endpoint via Gateway API | `false` | +| `spiffe.rest.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-identity-exchange-rest-spiffe` | +| `spiffe.rest.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` | +| `spiffe.rest.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` | +| `spiffe.rest.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` | +| `spiffe.rest.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` | +| `spiffe.grpc.enabled` | Enable the gRPC listener served with this deployment's own X509-SVID | `false` | +| `spiffe.grpc.port` | Container port for the gRPC listener served with this deployment's own X509-SVID | `8543` | +| `spiffe.grpc.service.type` | Service type | `ClusterIP` | +| `spiffe.grpc.service.port` | port for the service | `443` | +| `spiffe.grpc.service.annotations` | Annotations for service resource | `{}` | +| `spiffe.grpc.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` | +| `spiffe.grpc.ingress.enabled` | Flag to enable ingress | `false` | +| `spiffe.grpc.ingress.className` | Ingress class name | `""` | +| `spiffe.grpc.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | +| `spiffe.grpc.ingress.annotations` | Annotations for ingress object | `{}` | +| `spiffe.grpc.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The grpc of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-identity-exchange-grpc-spiffe` | +| `spiffe.grpc.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `spiffe.grpc.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `spiffe.grpc.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | +| `spiffe.grpc.gatewayAPI.enabled` | Flag to expose the endpoint via Gateway API | `false` | +| `spiffe.grpc.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-identity-exchange-grpc-spiffe` | +| `spiffe.grpc.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` | +| `spiffe.grpc.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` | +| `spiffe.grpc.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` | +| `spiffe.grpc.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` | +| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | +| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` | +| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `clusterRole.create` | create a k8s cluster role to allow access to token reviews and oidc discovery | `true` | +| `server.address` | Address for Spire server | `""` | +| `server.port` | Port number for Spire server | `443` | +| `server.namespaceOverride` | Override the namespace for Spire server | `""` | +| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` | diff --git a/charts/spire-identity-exchange/templates/configmap.yaml b/charts/spire-identity-exchange/templates/configmap.yaml index 87a97e2..d495189 100644 --- a/charts/spire-identity-exchange/templates/configmap.yaml +++ b/charts/spire-identity-exchange/templates/configmap.yaml @@ -206,8 +206,7 @@ data: trust_domain = {{ $trustDomain | quote }} server_address = {{ include "spire-identity-exchange.server-address" . | trim | quote }} server_port = {{ .Values.server.port }} - trust_bundle_url = "http://localhost/trustbundle" - trust_bundle_unix_socket = "/trustbundle/socket" + trust_bundle_spiffe_workload_api = "unix://{{ include "spire-identity-exchange.workload-api-socket-path" . }}" rebootstrap_mode = "always" rebootstrap_delay = "5m" diff --git a/charts/spire-identity-exchange/templates/deployment.yaml b/charts/spire-identity-exchange/templates/deployment.yaml index 0d90193..0efe5ca 100644 --- a/charts/spire-identity-exchange/templates/deployment.yaml +++ b/charts/spire-identity-exchange/templates/deployment.yaml @@ -45,38 +45,6 @@ spec: securityContext: {{- include "spire-identity-exchange.podSecurityContext" . | nindent 8 }} initContainers: - - name: spire-server-attestor - securityContext: - {{- include "spire-lib.securitycontext" . | nindent 12 }} - resources: - {{- toYaml .Values.spireServerAttestorSPIFFEWorkloadAPI.resources | nindent 12 }} - image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.spireServerAttestorSPIFFEWorkloadAPI.image "global" .Values.global) }} - imagePullPolicy: {{ .Values.spireServerAttestorSPIFFEWorkloadAPI.image.pullPolicy }} - restartPolicy: Always - args: - - /trustbundle/socket - env: - - name: SPIFFE_ENDPOINT_SOCKET - value: "unix://{{ include "spire-identity-exchange.workload-api-socket-path" . }}" - - name: SPIFFE_TRUST_DOMAIN - value: {{ $trustDomain }} - readinessProbe: - exec: - command: - - /ko-app/spire-server-attestor-spiffe-workload-api - - --healthcheck - - /trustbundle/socket - initialDelaySeconds: 5 - periodSeconds: 30 - timeoutSeconds: 10 - successThreshold: 1 - failureThreshold: 3 - volumeMounts: - - name: spiffe-workload-api - mountPath: /spiffe-workload-api - readOnly: true - - name: trustbundle - mountPath: /trustbundle - name: spire-agent securityContext: {{- include "spire-lib.securitycontext" . | nindent 12 }} @@ -111,9 +79,6 @@ spec: readOnly: true - name: spire-agent-socket mountPath: /agent - - name: trustbundle - mountPath: /trustbundle - readOnly: true - name: spire-agent-data mountPath: /agent-data containers: @@ -213,8 +178,6 @@ spec: emptyDir: {} - name: spire-agent-data emptyDir: {} - - name: trustbundle - emptyDir: {} - name: spire-identity-exchange-config configMap: name: {{ include "spire-identity-exchange.fullname" . }} diff --git a/charts/spire-identity-exchange/values.yaml b/charts/spire-identity-exchange/values.yaml index 16084bf..ee2994d 100644 --- a/charts/spire-identity-exchange/values.yaml +++ b/charts/spire-identity-exchange/values.yaml @@ -37,30 +37,6 @@ image: pullPolicy: IfNotPresent tag: "" -spireServerAttestorSPIFFEWorkloadAPI: - ## @param spireServerAttestorSPIFFEWorkloadAPI.resources [object] Resource requests and limits - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # requests: - # cpu: 50m - # memory: 32Mi - # limits: - # cpu: 100m - # memory: 64Mi - image: - ## @param spireServerAttestorSPIFFEWorkloadAPI.image.registry The OCI registry to pull the image from - ## @param spireServerAttestorSPIFFEWorkloadAPI.image.repository The repository within the registry - ## @param spireServerAttestorSPIFFEWorkloadAPI.image.pullPolicy The image pull policy - ## @param spireServerAttestorSPIFFEWorkloadAPI.image.tag Overrides the image tag whose default is the chart appVersion - ## - registry: ghcr.io - repository: spiffe/spire-server-attestor-spiffe-workload-api - pullPolicy: IfNotPresent - tag: "" - spireAgent: ## @param spireAgent.resources [object] Resource requests and limits resources: {} @@ -83,7 +59,7 @@ spireAgent: registry: ghcr.io repository: spiffe/spire-agent pullPolicy: IfNotPresent - tag: "1.15.2" + tag: "1.15.3" ## @param extraEnv [array] Extra environment variables to add to the spire identity exchange extraEnv: [] diff --git a/charts/spire-nested/Chart.yaml b/charts/spire-nested/Chart.yaml index 3e49b90..bf6e887 100644 --- a/charts/spire-nested/Chart.yaml +++ b/charts/spire-nested/Chart.yaml @@ -5,7 +5,7 @@ description: > type: application version: 0.30.0 -appVersion: "1.15.2" +appVersion: "1.15.3" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire-nested/README.md b/charts/spire-nested/README.md index b0d1a3d..524dc80 100644 --- a/charts/spire-nested/README.md +++ b/charts/spire-nested/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.30.0](https://img.shields.io/badge/Version-0.30.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.15.2](https://img.shields.io/badge/AppVersion-1.15.2-informational?style=flat-square) +![Version: 0.30.0](https://img.shields.io/badge/Version-0.30.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.15.3](https://img.shields.io/badge/AppVersion-1.15.3-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 5040e65..2f205a3 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -5,7 +5,7 @@ description: > type: application version: 0.30.0 -appVersion: "1.15.2" +appVersion: "1.15.3" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index 72a7646..3436687 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.30.0](https://img.shields.io/badge/Version-0.30.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.15.2](https://img.shields.io/badge/AppVersion-1.15.2-informational?style=flat-square) +![Version: 0.30.0](https://img.shields.io/badge/Version-0.30.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.15.3](https://img.shields.io/badge/AppVersion-1.15.3-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml index fd6d93b..e6312cc 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml @@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider description: A Helm chart to install the SPIFFE OIDC discovery provider. type: application version: 0.1.0 -appVersion: "1.15.2" +appVersion: "1.15.3" keywords: ["spiffe", "oidc"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml index 17b4048..207c29e 100644 --- a/charts/spire/charts/spire-agent/Chart.yaml +++ b/charts/spire/charts/spire-agent/Chart.yaml @@ -3,7 +3,7 @@ name: spire-agent description: A Helm chart to install the SPIRE agent. type: application version: 0.1.0 -appVersion: "1.15.2" +appVersion: "1.15.3" keywords: ["spiffe", "spire-agent"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml index 8a5b7c4..0892a65 100644 --- a/charts/spire/charts/spire-server/Chart.yaml +++ b/charts/spire/charts/spire-server/Chart.yaml @@ -3,7 +3,7 @@ name: spire-server description: A Helm chart to install the SPIRE server. type: application version: 0.1.0 -appVersion: "1.15.2" +appVersion: "1.15.3" keywords: ["spiffe", "spire-server", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: