From ac3be716dd4e7f5ff209a6513d533cd82538cebc Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 20 Jun 2023 08:41:41 +0200 Subject: [PATCH 01/11] Bump test chart dependencies (#358) Co-authored-by: marcofranssen Co-authored-by: Faisal Memon --- .github/tests/charts.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 09ee237..62015fc 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,12 +2,12 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "46.6.0" + "version": "46.8.0" }, { "name": "cert-manager", "repo": "https://charts.jetstack.io", - "version": "v1.12.1" + "version": "v1.12.2" }, { "name": "ingress-nginx", @@ -17,11 +17,11 @@ { "name": "mysql", "repo": "https://charts.bitnami.com/bitnami", - "version": "9.10.1" + "version": "9.10.4" }, { "name": "postgresql", "repo": "https://charts.bitnami.com/bitnami", - "version": "12.5.6" + "version": "12.5.7" } ] From 1333b6ab347467247536978a3585810c3f9724ec Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Tue, 20 Jun 2023 12:14:42 -0700 Subject: [PATCH 02/11] Always add parseTime=true for mysql query string (#352) --- .github/tests/production-external-mysql/install.sh | 2 -- charts/spire/charts/spire-server/templates/_helpers.tpl | 5 ++--- examples/external-mysql/values.yaml | 2 -- 3 files changed, 2 insertions(+), 7 deletions(-) diff --git a/.github/tests/production-external-mysql/install.sh b/.github/tests/production-external-mysql/install.sh index fc979cd..7bb5d63 100755 --- a/.github/tests/production-external-mysql/install.sh +++ b/.github/tests/production-external-mysql/install.sh @@ -29,8 +29,6 @@ spire-server: password: ${DBPW} host: mysql port: 3306 - options: - - parseTime: true EOF helm install mysql mysql --namespace "spire-server" --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \ diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index 7df3626..15874a7 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -114,9 +114,8 @@ Create the name of the service account to use {{- $lst = append $lst $entry }} {{- end }} {{- end }} -{{- if gt (len $lst) 0 }} -{{- printf "?%s" (join "&" $lst) }} -{{- end }} +{{- $lst = append $lst "parseTime=true" }} +{{- printf "?%s" (join "&" (uniq $lst)) }} {{- end }} {{- define "spire-server.config-postgresql-options" }} diff --git a/examples/external-mysql/values.yaml b/examples/external-mysql/values.yaml index b332156..c0a8fff 100644 --- a/examples/external-mysql/values.yaml +++ b/examples/external-mysql/values.yaml @@ -6,5 +6,3 @@ spire-server: host: mysql port: 3306 username: spire - options: - - parseTime: true From 0533d92594b37307768d502e9581ff434301626c Mon Sep 17 00:00:00 2001 From: Drew Wells Date: Thu, 22 Jun 2023 08:40:08 -0500 Subject: [PATCH 03/11] fixes missing template (#362) --- charts/spire/charts/spire-server/templates/statefulset.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 1540dd0..ad6a843 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -47,7 +47,7 @@ spec: - name: wait securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: {{ template "spire-server.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} + image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} args: - wait - --namespace @@ -56,7 +56,7 @@ spec: - --for=condition=ready - issuer - {{ include "spire-server.fullname" $ }} - imagePullPolicy: {{ .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy }} + imagePullPolicy: {{ .Values.tools.kubectl.image.pullPolicy }} {{- end }} {{- if gt (len .Values.initContainers) 0 }} {{- toYaml .Values.initContainers | nindent 8 }} From 3b6666016c63d1bfc73a505d27f7c745cc5b05d6 Mon Sep 17 00:00:00 2001 From: Drew Wells Date: Thu, 22 Jun 2023 10:45:37 -0500 Subject: [PATCH 04/11] add missing federatesWith option (#361) DEMO ``` spire-server-0 -- spire-server entry show -spiffeID spiffe://box-4.example.com/ns/dwells/sa/dwells-rc-realm-client Defaulted container "spire-server" out of: spire-server, spire-controller-manager, wait (init) Found 1 entry Entry ID : 09301666-010e-4ba9-9dcb-44370d4e49e4 SPIFFE ID : spiffe://box-4.example.com/ns/dwells/sa/dwells-rc-realm-client Parent ID : spiffe://box-4.example.com/spire/agent/k8s_psat/example-cluster/ff93872d-791f-4bf3-a532-475775d03d3e Revision : 0 X509-SVID TTL : default JWT-SVID TTL : default Selector : k8s:pod-uid:40e0bcad-6ec8-460b-a839-659654549d7a FederatesWith : box-3.example.com ``` Signed-off-by: Drew Wells --- charts/spire/README.md | 1 + charts/spire/charts/spire-server/README.md | 1 + .../templates/controller-manager-cluster-ids.yaml | 4 ++++ charts/spire/charts/spire-server/values.yaml | 3 +++ 4 files changed, 9 insertions(+) diff --git a/charts/spire/README.md b/charts/spire/README.md index 1dc8d53..ce6c591 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -300,6 +300,7 @@ Now you can interact with the Spire agent socket from your own application. The | spire-server.controllerManager.enabled | bool | `false` | | | spire-server.controllerManager.identities.dnsNameTemplates | list | `[]` | | | spire-server.controllerManager.identities.enabled | bool | `true` | | +| spire-server.controllerManager.identities.federatesWith | list | `[]` | | | spire-server.controllerManager.identities.namespaceSelector | object | `{}` | | | spire-server.controllerManager.identities.podSelector | object | `{}` | | | spire-server.controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | | diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 36bcbe4..810aea8 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -50,6 +50,7 @@ A Helm chart to install the SPIRE server. | controllerManager.enabled | bool | `false` | | | controllerManager.identities.dnsNameTemplates | list | `[]` | | | controllerManager.identities.enabled | bool | `true` | | +| controllerManager.identities.federatesWith | list | `[]` | | | controllerManager.identities.namespaceSelector | object | `{}` | | | controllerManager.identities.podSelector | object | `{}` | | | controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml index 5967d31..69c7c6f 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml @@ -8,6 +8,10 @@ metadata: namespace: {{ include "spire-server.namespace" $root }} spec: spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }} + {{- with .identities.federatesWith }} + federatesWith: + {{- toYaml . | nindent 4 }} + {{- end }} {{- with .identities.podSelector }} podSelector: {{- toYaml . | nindent 4 }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 17095b0..789824e 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -279,6 +279,9 @@ controllerManager: # spiffe.io/spiffe-id: "true" dnsNameTemplates: [] # - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local' + federatesWith: [] + # - example.io + # - example.ai validatingWebhookConfiguration: failurePolicy: Fail From 8409674a3e21127e5f79563786b3e39327f19c58 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 22 Jun 2023 09:57:07 -0700 Subject: [PATCH 05/11] Fix the init container flags of the statefulset (#366) --- charts/spire/charts/spire-server/templates/statefulset.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index ad6a843..842b927 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -43,7 +43,7 @@ spec: securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} initContainers: - {{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.createCA }} + {{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }} - name: wait securityContext: {{- toYaml .Values.securityContext | nindent 12 }} From 4dccb0d3b62fa792b5d2223336428b3f8024a1ee Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 22 Jun 2023 18:57:33 +0200 Subject: [PATCH 06/11] Bump spire Helm Chart version from 0.9.0 to 0.9.1 (#365) --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 44a5a8c..900b8ec 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -3,7 +3,7 @@ name: spire description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.9.0 +version: 0.9.1 appVersion: "1.7.0" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire diff --git a/charts/spire/README.md b/charts/spire/README.md index ce6c591..0fe8a68 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -2,7 +2,7 @@ -![Version: 0.9.0](https://img.shields.io/badge/Version-0.9.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) +![Version: 0.9.1](https://img.shields.io/badge/Version-0.9.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. From 99e01c6722e88f3f848b96f0619fef681fafe606 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 23 Jun 2023 01:16:43 +0200 Subject: [PATCH 07/11] Bump spire-controller-manager from 0.2.2 to 0.2.3 (#367) resolves a bunch of vulnerabilities in the Image Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 2 +- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 0fe8a68..26510b1 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -310,7 +310,7 @@ Now you can interact with the Spire agent socket from your own application. The | spire-server.controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | | spire-server.controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | | spire-server.controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry | -| spire-server.controllerManager.image.tag | string | `"0.2.2"` | Overrides the image tag | +| spire-server.controllerManager.image.tag | string | `"0.2.3"` | Overrides the image tag | | spire-server.controllerManager.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | spire-server.controllerManager.resources | object | `{}` | | | spire-server.controllerManager.securityContext | object | `{}` | | diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 810aea8..0f581a1 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -60,7 +60,7 @@ A Helm chart to install the SPIRE server. | controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | | controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | | controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry | -| controllerManager.image.tag | string | `"0.2.2"` | Overrides the image tag | +| controllerManager.image.tag | string | `"0.2.3"` | Overrides the image tag | | controllerManager.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | controllerManager.resources | object | `{}` | | | controllerManager.securityContext | object | `{}` | | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 789824e..c859ddc 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -231,7 +231,7 @@ controllerManager: # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" # -- Overrides the image tag - tag: "0.2.2" + tag: "0.2.3" resources: {} # We usually recommend not to specify default resources and to leave this as a conscious From 386e736e78cc0f92292da291b10b926cc10816e3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 26 Jun 2023 08:54:42 -0700 Subject: [PATCH 08/11] Bump sigstore/cosign-installer from 3.0.5 to 3.1.0 (#368) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Marco Franssen --- .github/workflows/helm-release.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml index bcaa57d..2526a8a 100644 --- a/.github/workflows/helm-release.yaml +++ b/.github/workflows/helm-release.yaml @@ -29,9 +29,9 @@ jobs: git config user.email "$GITHUB_ACTOR@users.noreply.github.com" - name: Setup cosign - uses: sigstore/cosign-installer@v3.0.5 + uses: sigstore/cosign-installer@v3.1.0 with: - cosign-release: v2.0.2 + cosign-release: v2.1.0 - name: Set up Helm uses: azure/setup-helm@v3.5 From f4c421afa009a76fe72f38727b6e836abd542ecd Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 26 Jun 2023 08:56:18 +0200 Subject: [PATCH 09/11] Ensure the released OCI artifact is also captured in rekor Signed-off-by: Marco Franssen --- .github/workflows/helm-release.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml index 2526a8a..f5b31c0 100644 --- a/.github/workflows/helm-release.yaml +++ b/.github/workflows/helm-release.yaml @@ -66,3 +66,5 @@ jobs: digest="$(awk -F "[, ]+" '/Digest/{print $NF}' < .digest)" cosign sign ghcr.io/"${GITHUB_REPOSITORY_OWNER}"/helm-charts/"${name}"@"${digest}" done + env: + COSIGN_YES: true From 731c8b45b5a98776b5c57c8dc43d384e58a8e1ac Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 28 Jun 2023 08:40:55 -0700 Subject: [PATCH 10/11] Bump sigstore/cosign-installer from 3.1.0 to 3.1.1 (#373) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Marco Franssen --- .github/workflows/helm-release.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml index f5b31c0..a245624 100644 --- a/.github/workflows/helm-release.yaml +++ b/.github/workflows/helm-release.yaml @@ -29,9 +29,9 @@ jobs: git config user.email "$GITHUB_ACTOR@users.noreply.github.com" - name: Setup cosign - uses: sigstore/cosign-installer@v3.1.0 + uses: sigstore/cosign-installer@v3.1.1 with: - cosign-release: v2.1.0 + cosign-release: v2.1.1 - name: Set up Helm uses: azure/setup-helm@v3.5 From 5500d36b1ad39becf1296a7a2f2860d6c69836d6 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 27 Jun 2023 12:52:36 +0200 Subject: [PATCH 11/11] Bump spire Helm Chart version from 0.9.1 to 0.10.0 * f4c421af Ensure the released OCI artifact is also captured in rekor * 386e736e Bump sigstore/cosign-installer from 3.0.5 to 3.1.0 (#368) * 99e01c67 Bump spire-controller-manager from 0.2.2 to 0.2.3 (#367) * 4dccb0d3 Bump spire Helm Chart version from 0.9.0 to 0.9.1 (#365) * 8409674a Fix the init container flags of the statefulset (#366) * 3b666601 add missing federatesWith option (#361) * 0533d925 fixes missing template (#362) * 1333b6ab Always add parseTime=true for mysql query string (#352) * ac3be716 Bump test chart dependencies (#358) Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 900b8ec..4faa515 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -3,7 +3,7 @@ name: spire description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.9.1 +version: 0.10.0 appVersion: "1.7.0" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire diff --git a/charts/spire/README.md b/charts/spire/README.md index 26510b1..92accbf 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -2,7 +2,7 @@ -![Version: 0.9.1](https://img.shields.io/badge/Version-0.9.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) +![Version: 0.10.0](https://img.shields.io/badge/Version-0.10.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.