Merge branch 'main' into release
This commit is contained in:
Faisal Memon
@@ -3,7 +3,7 @@ name: spire-crds
|
||||
description: >
|
||||
A Helm chart for deploying the Spire CRDS
|
||||
type: application
|
||||
version: 0.3.0
|
||||
version: 0.4.0
|
||||
appVersion: "0.0.1"
|
||||
keywords: ["spire-crds"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
|
||||
@@ -64,6 +64,8 @@ spec:
|
||||
type: array
|
||||
spiffeID:
|
||||
type: string
|
||||
storeSVID:
|
||||
type: boolean
|
||||
x509SVIDTTL:
|
||||
type: string
|
||||
required:
|
||||
|
||||
@@ -4,7 +4,7 @@ description: >
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
type: application
|
||||
version: 0.19.2
|
||||
appVersion: "1.9.2"
|
||||
appVersion: "1.9.4"
|
||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
+11
-1
@@ -1,6 +1,6 @@
|
||||
# spire
|
||||
|
||||
  
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
@@ -75,6 +75,16 @@ kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeid
|
||||
|
||||
We only support upgrading one major version at a time. Version skipping isn't supported.
|
||||
|
||||
### 0.20.X
|
||||
|
||||
- The default service port for the spire-server was changed to be port 443 to allow easier switching between internal access and external access through an ingress controller. For most users, this will be a transparent
|
||||
change.
|
||||
|
||||
- This release configures the entries managed by the spire-controller-manager to move into their own managed space within SPIRE. This should be transparent. In a future release, we will
|
||||
disable cleanup by default of the old space. This release lays the groundwork for future support for manually created entries in the SPIRE database without the spire-controller-manager
|
||||
destroying them. It is supported in this release by manually setting spire-server.controllerManager.entryIDPrefixCleanup=false after successfully upgrading to the chart without the
|
||||
setting and waiting for a spire-controller-manager sync.
|
||||
|
||||
### 0.19.X
|
||||
|
||||
- The spire-agent daemonset gained a new label. For those disabling the upgrade hooks, you need to delete the spire-agent daemonset before issuing the helm upgrade.
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider
|
||||
description: A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.9.1"
|
||||
appVersion: "1.9.4"
|
||||
keywords: ["spiffe", "oidc"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -117,9 +117,9 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5921884408efe50b77796675dc109ad2126f54476fe7403c37d8898a5ceb2e76` |
|
||||
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` |
|
||||
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
|
||||
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:803995505bc612174a9594a85493916a5234b6a8e0fa619763eceaf2d189cd75` |
|
||||
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f0369215d5a2c15e469a2a8d993e4db7e83fcda5142c8682f37c197d76f82faa` |
|
||||
| `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` |
|
||||
| `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
|
||||
@@ -338,9 +338,9 @@ tests:
|
||||
##
|
||||
image:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/slim-toolkit-debug
|
||||
repository: chainguard/min-toolkit-debug
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:803995505bc612174a9594a85493916a5234b6a8e0fa619763eceaf2d189cd75
|
||||
tag: latest@sha256:f0369215d5a2c15e469a2a8d993e4db7e83fcda5142c8682f37c197d76f82faa
|
||||
|
||||
step:
|
||||
## @param tests.step.image.registry The OCI registry to pull the image from
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire-agent
|
||||
description: A Helm chart to install the SPIRE agent.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.9.3"
|
||||
appVersion: "1.9.4"
|
||||
keywords: ["spiffe", "spire-agent"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -57,7 +57,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` |
|
||||
| `disableReattestToRenew` | Deprecated: Allow agent to renew certificate when it expires rather than reattest | `false` |
|
||||
| `server.address` | Address for Spire server | `""` |
|
||||
| `server.port` | Port number for Spire server | `8081` |
|
||||
| `server.port` | Port number for Spire server | `443` |
|
||||
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
||||
| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
||||
| `healthChecks.port` | override the host port used for health checking | `9982` |
|
||||
@@ -123,7 +123,6 @@ A Helm chart to install the SPIRE agent.
|
||||
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
|
||||
| `experimental.featureFlags` | List of developer feature flags | `[]` |
|
||||
| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` |
|
||||
| `installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
|
||||
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
|
||||
@@ -1,77 +0,0 @@
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- $ds := lookup "apps/v1" "DaemonSet" (include "spire-agent.namespace" .) (include "spire-agent.fullname" .) }}
|
||||
{{- if and $ds (not (hasKey $ds.metadata.labels "app.kubernetes.io/component")) }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spire-agent.serviceAccountName" . }}-pre-upgrade
|
||||
namespace: {{ include "spire-agent.namespace" . }}
|
||||
labels:
|
||||
{{- include "spire-agent.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": pre-upgrade
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "spire-agent.fullname" . }}-pre-upgrade
|
||||
namespace: {{ include "spire-agent.namespace" . }}
|
||||
annotations:
|
||||
"helm.sh/hook": pre-upgrade
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||
rules:
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["daemonsets"]
|
||||
resourceNames: [{{ include "spire-agent.fullname" . | quote }}]
|
||||
verbs: ["get", "delete"]
|
||||
---
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "spire-agent.fullname" . }}-pre-upgrade
|
||||
namespace: {{ include "spire-agent.namespace" . }}
|
||||
annotations:
|
||||
"helm.sh/hook": pre-upgrade
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire-agent.serviceAccountName" . }}-pre-upgrade
|
||||
namespace: {{ include "spire-agent.namespace" . }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ include "spire-agent.fullname" . }}-pre-upgrade
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ include "spire-agent.fullname" . }}-pre-upgrade
|
||||
namespace: {{ include "spire-agent.namespace" . }}
|
||||
labels:
|
||||
{{- include "spire-agent.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": pre-upgrade
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
name: {{ include "spire-agent.fullname" . }}-pre-upgrade
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
serviceAccountName: {{ include "spire-agent.serviceAccountName" . }}-pre-upgrade
|
||||
securityContext:
|
||||
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
|
||||
containers:
|
||||
- name: pre-upgrade
|
||||
securityContext:
|
||||
{{- include "spire-lib.securitycontext" . | nindent 10 }}
|
||||
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
|
||||
args:
|
||||
- delete
|
||||
- daemonset
|
||||
- {{ include "spire-agent.fullname" . }}
|
||||
- -n
|
||||
- {{ include "spire-agent.namespace" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -113,7 +113,7 @@ upstream: false
|
||||
##
|
||||
server:
|
||||
address: ""
|
||||
port: 8081
|
||||
port: 443
|
||||
namespaceOverride: ""
|
||||
nameOverride: ""
|
||||
|
||||
@@ -329,10 +329,6 @@ agents: {}
|
||||
# tpmDirect:
|
||||
# enabled: true
|
||||
|
||||
installAndUpgradeHook:
|
||||
## @param installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`)
|
||||
enabled: true
|
||||
|
||||
tools:
|
||||
kubectl:
|
||||
## @param tools.kubectl.image.registry The OCI registry to pull the image from
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire-server
|
||||
description: A Helm chart to install the SPIRE server.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.9.3"
|
||||
appVersion: "1.9.4"
|
||||
keywords: ["spiffe", "spire-server", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -101,7 +101,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `securityContext` | Security context | `{}` |
|
||||
| `priorityClassName` | Priority class assigned to statefulset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||
| `service.type` | Type of the Spire server service created | `ClusterIP` |
|
||||
| `service.port` | Port for the created service | `8081` |
|
||||
| `service.port` | Port for the created service | `443` |
|
||||
| `service.annotations` | Annotations to add to the service object | `{}` |
|
||||
| `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` |
|
||||
| `resources` | Resource requests and limits | `{}` |
|
||||
@@ -174,6 +174,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
|
||||
| `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` |
|
||||
| `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` |
|
||||
| `keyManager.awsKMS.keyIdentifierFile.enabled` | Enable key identifier data to be stored in a file in persistent storage. | `false` |
|
||||
| `keyManager.awsKMS.keyIdentifierValue.enabled` | Enable specifying a key identifier value for AWS KMS | `false` |
|
||||
| `keyManager.awsKMS.keyIdentifierValue.identifier` | Static identifier for the SPIRE server instance | `""` |
|
||||
| `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | |
|
||||
| `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` |
|
||||
| `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` |
|
||||
@@ -212,7 +215,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | |
|
||||
| `upstreamAuthority.spire.server.nameOverride` | Override the name for upstream Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
||||
| `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` |
|
||||
| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `8081` |
|
||||
| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `443` |
|
||||
| `upstreamAuthority.vault.enabled` | Enable Hashicorp Vault as upstream CA | `false` |
|
||||
| `upstreamAuthority.vault.vaultAddr` | The URL of the Vault server. (e.g., https://vault.example.com:8443/) | `""` |
|
||||
| `upstreamAuthority.vault.namespace` | Name of the Vault namespace. This is only available in the Vault Enterprise. | `""` |
|
||||
@@ -235,6 +238,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
||||
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
||||
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
||||
| `controllerManager.entryIDPrefixCleanup` | Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `""` |
|
||||
| `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
|
||||
| `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` |
|
||||
| `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` |
|
||||
@@ -243,7 +247,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
||||
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.4` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.5.0` |
|
||||
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
||||
| `controllerManager.securityContext` | Security context | `{}` |
|
||||
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
||||
|
||||
@@ -35,6 +35,9 @@
|
||||
{{- if ne $tlsFederationCount 1 }}
|
||||
{{- fail "You must enable one and only one federation TLS configuration" }}
|
||||
{{- end }}
|
||||
{{- if and (eq (.Values.keyManager.awsKMS.keyIdentifierFile.enabled | toString) "true") (eq (.Values.keyManager.awsKMS.keyIdentifierValue.enabled | toString ) "true") }}
|
||||
{{- fail "You can only enable one of keyIdentifierFile or keyIdentifierValue at a time" }}
|
||||
{{- end }}
|
||||
{{- define "spire-server.yaml-config" -}}
|
||||
{{- $upstreamAuthorityUsed := 0 }}
|
||||
{{- $keyManagerUsed := 0 }}
|
||||
@@ -190,7 +193,13 @@ plugins:
|
||||
aws_kms:
|
||||
plugin_data:
|
||||
region: {{ .region | quote }}
|
||||
{{- if eq (.keyIdentifierFile.enabled | toString) "true" }}
|
||||
key_identifier_file: "/run/spire/data/aws-kms-key-identifier"
|
||||
{{- else if eq (.keyIdentifierValue.enabled | toString) "true" }}
|
||||
key_identifier_value: {{ .keyIdentifierValue.identifier | quote }}
|
||||
{{- else }}
|
||||
key_metadata_file: "/run/spire/data/aws-kms-key-metadata"
|
||||
{{- end }}
|
||||
{{- if ne .accessKeyID "" }}
|
||||
access_key_id: "${AWS_KMS_ACCESS_KEY_ID}"
|
||||
{{- end }}
|
||||
|
||||
@@ -32,6 +32,10 @@ data:
|
||||
{{- if .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
{{- if typeIs "string" .Values.controllerManager.entryIDPrefixCleanup }}
|
||||
entryIDPrefixCleanup: {{ .Values.controllerManager.entryIDPrefixCleanup | quote }}
|
||||
{{- end }}
|
||||
entryIDPrefix: {{ include "spire-lib.cluster-name" . }}
|
||||
clusterName: {{ include "spire-lib.cluster-name" . }}
|
||||
trustDomain: {{ include "spire-lib.trust-domain" . }}
|
||||
ignoreNamespaces:
|
||||
|
||||
@@ -75,7 +75,7 @@ priorityClassName: ""
|
||||
##
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8081
|
||||
port: 443
|
||||
annotations: {}
|
||||
|
||||
configMap:
|
||||
@@ -307,6 +307,14 @@ keyManager:
|
||||
enabled: false
|
||||
## @param keyManager.awsKMS.region Specify the region for AWS KMS
|
||||
region: ""
|
||||
keyIdentifierFile:
|
||||
## @param keyManager.awsKMS.keyIdentifierFile.enabled Enable key identifier data to be stored in a file in persistent storage.
|
||||
enabled: false
|
||||
keyIdentifierValue:
|
||||
## @param keyManager.awsKMS.keyIdentifierValue.enabled Enable specifying a key identifier value for AWS KMS
|
||||
enabled: false
|
||||
## @param keyManager.awsKMS.keyIdentifierValue.identifier Static identifier for the SPIRE server instance
|
||||
identifier: ""
|
||||
## @extra keyManager.awsKMS.keyPolicy Policy to use when creating keys. If no policy is specified, a default policy will be used.
|
||||
keyPolicy:
|
||||
## @param keyManager.awsKMS.keyPolicy.policy [nullable] Key policy in JSON format.
|
||||
@@ -395,7 +403,7 @@ upstreamAuthority:
|
||||
## @param upstreamAuthority.spire.server.address Address for upstream Spire server
|
||||
address: ""
|
||||
## @param upstreamAuthority.spire.server.port Port for upstream Spire server
|
||||
port: 8081
|
||||
port: 443
|
||||
vault:
|
||||
## @param upstreamAuthority.vault.enabled Enable Hashicorp Vault as upstream CA
|
||||
enabled: false
|
||||
@@ -457,6 +465,9 @@ controllerManager:
|
||||
## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.
|
||||
watchClassless: false
|
||||
|
||||
## @param controllerManager.entryIDPrefixCleanup Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it.
|
||||
entryIDPrefixCleanup: ""
|
||||
|
||||
## @param controllerManager.parentIDTemplate The template that is used to register workloads.
|
||||
parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"
|
||||
|
||||
@@ -482,7 +493,7 @@ controllerManager:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-controller-manager
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "0.4.4"
|
||||
tag: "0.5.0"
|
||||
|
||||
## @param controllerManager.resources [object] Resource requests and limits for controller manager
|
||||
resources: {}
|
||||
|
||||
@@ -94,7 +94,7 @@
|
||||
*/}}
|
||||
{{ define "spire-lib.ingress-calculated-name" }}
|
||||
{{- $host := .ingress.host }}
|
||||
{{- if not (contains $host ".") }}
|
||||
{{- if not (contains "." $host) }}
|
||||
{{- $host = printf "%s.%s" $host (include "spire-lib.trust-domain" .) }}
|
||||
{{- end }}
|
||||
{{- $host }}
|
||||
|
||||
Reference in New Issue
Block a user