panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update spire to 1.15.3 (#926)

Browse Source
This commit is contained in:
kfox1111
2026-08-21 12:23:46 -07:00
committed by GitHub
parent b47ab6c197
commit 8a28a1b94f
11 changed files with 181 additions and 248 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire-identity-exchange/README.md
+2 -7
View File
@@ -73,7 +73,7 @@ controllerManager:
### Chart parameters ### Chart parameters
| Name | Description | Value | | Name | Description | Value |
| ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- | | ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ |
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | | `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` | | `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
| `replicaCount` | Replica count | `1` | | `replicaCount` | Replica count | `1` |
@@ -84,16 +84,11 @@ controllerManager:
| `image.repository` | The repository within the registry | `spiffe/spire-identity-exchange-server` | | `image.repository` | The repository within the registry | `spiffe/spire-identity-exchange-server` |
| `image.pullPolicy` | The image pull policy | `IfNotPresent` | | `image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `spireServerAttestorSPIFFEWorkloadAPI.resources` | Resource requests and limits | `{}` |
| `spireServerAttestorSPIFFEWorkloadAPI.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `spireServerAttestorSPIFFEWorkloadAPI.image.repository` | The repository within the registry | `spiffe/spire-server-attestor-spiffe-workload-api` |
| `spireServerAttestorSPIFFEWorkloadAPI.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `spireServerAttestorSPIFFEWorkloadAPI.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `spireAgent.resources` | Resource requests and limits | `{}` | | `spireAgent.resources` | Resource requests and limits | `{}` |
| `spireAgent.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `spireAgent.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `spireAgent.image.repository` | The repository within the registry | `spiffe/spire-agent` | | `spireAgent.image.repository` | The repository within the registry | `spiffe/spire-agent` |
| `spireAgent.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `spireAgent.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `spireAgent.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.15.2` | | `spireAgent.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.15.3` |
| `extraEnv` | Extra environment variables to add to the spire identity exchange | `[]` | | `extraEnv` | Extra environment variables to add to the spire identity exchange | `[]` |
| `resources` | Resource requests and limits | `{}` | | `resources` | Resource requests and limits | `{}` |
| `configMap.annotations` | Annotations to add to the SPIRE Identity Exchange ConfigMap | `{}` | | `configMap.annotations` | Annotations to add to the SPIRE Identity Exchange ConfigMap | `{}` |
charts/spire-identity-exchange/templates/configmap.yaml
+1 -2
View File
@@ -206,8 +206,7 @@ data:
trust_domain = {{ $trustDomain | quote }} trust_domain = {{ $trustDomain | quote }}
server_address = {{ include "spire-identity-exchange.server-address" . | trim | quote }} server_address = {{ include "spire-identity-exchange.server-address" . | trim | quote }}
server_port = {{ .Values.server.port }} server_port = {{ .Values.server.port }}
trust_bundle_url = "http://localhost/trustbundle" trust_bundle_spiffe_workload_api = "unix://{{ include "spire-identity-exchange.workload-api-socket-path" . }}"
trust_bundle_unix_socket = "/trustbundle/socket"
rebootstrap_mode = "always" rebootstrap_mode = "always"
rebootstrap_delay = "5m" rebootstrap_delay = "5m"
charts/spire-identity-exchange/templates/deployment.yaml
-37
View File
@@ -45,38 +45,6 @@ spec:
securityContext: securityContext:
{{- include "spire-identity-exchange.podSecurityContext" . | nindent 8 }} {{- include "spire-identity-exchange.podSecurityContext" . | nindent 8 }}
initContainers: initContainers:
- name: spire-server-attestor
securityContext:
{{- include "spire-lib.securitycontext" . | nindent 12 }}
resources:
{{- toYaml .Values.spireServerAttestorSPIFFEWorkloadAPI.resources | nindent 12 }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.spireServerAttestorSPIFFEWorkloadAPI.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.spireServerAttestorSPIFFEWorkloadAPI.image.pullPolicy }}
restartPolicy: Always
args:
- /trustbundle/socket
env:
- name: SPIFFE_ENDPOINT_SOCKET
value: "unix://{{ include "spire-identity-exchange.workload-api-socket-path" . }}"
- name: SPIFFE_TRUST_DOMAIN
value: {{ $trustDomain }}
readinessProbe:
exec:
command:
- /ko-app/spire-server-attestor-spiffe-workload-api
- --healthcheck
- /trustbundle/socket
initialDelaySeconds: 5
periodSeconds: 30
timeoutSeconds: 10
successThreshold: 1
failureThreshold: 3
volumeMounts:
- name: spiffe-workload-api
mountPath: /spiffe-workload-api
readOnly: true
- name: trustbundle
mountPath: /trustbundle
- name: spire-agent - name: spire-agent
securityContext: securityContext:
{{- include "spire-lib.securitycontext" . | nindent 12 }} {{- include "spire-lib.securitycontext" . | nindent 12 }}
@@ -111,9 +79,6 @@ spec:
readOnly: true readOnly: true
- name: spire-agent-socket - name: spire-agent-socket
mountPath: /agent mountPath: /agent
- name: trustbundle
mountPath: /trustbundle
readOnly: true
- name: spire-agent-data - name: spire-agent-data
mountPath: /agent-data mountPath: /agent-data
containers: containers:
@@ -213,8 +178,6 @@ spec:
emptyDir: {} emptyDir: {}
- name: spire-agent-data - name: spire-agent-data
emptyDir: {} emptyDir: {}
- name: trustbundle
emptyDir: {}
- name: spire-identity-exchange-config - name: spire-identity-exchange-config
configMap: configMap:
name: {{ include "spire-identity-exchange.fullname" . }} name: {{ include "spire-identity-exchange.fullname" . }}
charts/spire-identity-exchange/values.yaml
+1 -25
View File
@@ -37,30 +37,6 @@ image:
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: "" tag: ""
spireServerAttestorSPIFFEWorkloadAPI:
## @param spireServerAttestorSPIFFEWorkloadAPI.resources [object] Resource requests and limits
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# requests:
# cpu: 50m
# memory: 32Mi
# limits:
# cpu: 100m
# memory: 64Mi
image:
## @param spireServerAttestorSPIFFEWorkloadAPI.image.registry The OCI registry to pull the image from
## @param spireServerAttestorSPIFFEWorkloadAPI.image.repository The repository within the registry
## @param spireServerAttestorSPIFFEWorkloadAPI.image.pullPolicy The image pull policy
## @param spireServerAttestorSPIFFEWorkloadAPI.image.tag Overrides the image tag whose default is the chart appVersion
##
registry: ghcr.io
repository: spiffe/spire-server-attestor-spiffe-workload-api
pullPolicy: IfNotPresent
tag: ""
spireAgent: spireAgent:
## @param spireAgent.resources [object] Resource requests and limits ## @param spireAgent.resources [object] Resource requests and limits
resources: {} resources: {}
@@ -83,7 +59,7 @@ spireAgent:
registry: ghcr.io registry: ghcr.io
repository: spiffe/spire-agent repository: spiffe/spire-agent
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: "1.15.2" tag: "1.15.3"
## @param extraEnv [array] Extra environment variables to add to the spire identity exchange ## @param extraEnv [array] Extra environment variables to add to the spire identity exchange
extraEnv: [] extraEnv: []
charts/spire-nested/Chart.yaml
+1 -1
View File
@@ -5,7 +5,7 @@ description: >
type: application type: application
version: 0.30.0 version: 0.30.0
appVersion: "1.15.2" appVersion: "1.15.3"
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
charts/spire-nested/README.md
+1 -1
View File
@@ -1,6 +1,6 @@
# spire # spire
![Version: 0.30.0](https://img.shields.io/badge/Version-0.30.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.15.2](https://img.shields.io/badge/AppVersion-1.15.2-informational?style=flat-square) ![Version: 0.30.0](https://img.shields.io/badge/Version-0.30.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.15.3](https://img.shields.io/badge/AppVersion-1.15.3-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
charts/spire/Chart.yaml
+1 -1
View File
@@ -5,7 +5,7 @@ description: >
type: application type: application
version: 0.30.0 version: 0.30.0
appVersion: "1.15.2" appVersion: "1.15.3"
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
charts/spire/README.md
+1 -1
View File
@@ -1,6 +1,6 @@
# spire # spire
![Version: 0.30.0](https://img.shields.io/badge/Version-0.30.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.15.2](https://img.shields.io/badge/AppVersion-1.15.2-informational?style=flat-square) ![Version: 0.30.0](https://img.shields.io/badge/Version-0.30.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.15.3](https://img.shields.io/badge/AppVersion-1.15.3-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider
description: A Helm chart to install the SPIFFE OIDC discovery provider. description: A Helm chart to install the SPIFFE OIDC discovery provider.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.15.2" appVersion: "1.15.3"
keywords: ["spiffe", "oidc"] keywords: ["spiffe", "oidc"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
charts/spire/charts/spire-agent/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spire-agent
description: A Helm chart to install the SPIRE agent. description: A Helm chart to install the SPIRE agent.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.15.2" appVersion: "1.15.3"
keywords: ["spiffe", "spire-agent"] keywords: ["spiffe", "spire-agent"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
charts/spire/charts/spire-server/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spire-server
description: A Helm chart to install the SPIRE server. description: A Helm chart to install the SPIRE server.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.15.2" appVersion: "1.15.3"
keywords: ["spiffe", "spire-server", "spire-controller-manager"] keywords: ["spiffe", "spire-server", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources: