From bc79f58ab7b90c524b8021ca57adb57a60cfcf98 Mon Sep 17 00:00:00 2001 From: anhpatel <162738027+anhpatel@users.noreply.github.com> Date: Wed, 10 Apr 2024 06:26:10 -0700 Subject: [PATCH 1/8] AWS KMS key_identifier upgrade (#314) * Allow use of key_identifier_file or key_identifier_value in place of key_metadata_file Signed-off-by: aniket patel * Change key identifier values to have enabled flags Signed-off-by: aniket patel * Update charts/spire/charts/spire-server/templates/configmap.yaml Co-authored-by: kfox1111 Signed-off-by: anhpatel <162738027+anhpatel@users.noreply.github.com> * Update charts/spire/charts/spire-server/templates/configmap.yaml Co-authored-by: kfox1111 Signed-off-by: anhpatel <162738027+anhpatel@users.noreply.github.com> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: kfox1111 Signed-off-by: anhpatel <162738027+anhpatel@users.noreply.github.com> * Update docs Signed-off-by: aniket patel * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: kfox1111 Signed-off-by: anhpatel <162738027+anhpatel@users.noreply.github.com> * Update docs Signed-off-by: aniket patel --------- Signed-off-by: aniket patel Signed-off-by: anhpatel <162738027+anhpatel@users.noreply.github.com> Co-authored-by: kfox1111 --- charts/spire/charts/spire-server/README.md | 3 +++ .../spire/charts/spire-server/templates/configmap.yaml | 9 +++++++++ charts/spire/charts/spire-server/values.yaml | 8 ++++++++ 3 files changed, 20 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 8c4cf4b..ae9f458 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -174,6 +174,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` | | `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` | | `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` | +| `keyManager.awsKMS.keyIdentifierFile.enabled` | Enable key identifier data to be stored in a file in persistent storage. | `false` | +| `keyManager.awsKMS.keyIdentifierValue.enabled` | Enable specifying a key identifier value for AWS KMS | `false` | +| `keyManager.awsKMS.keyIdentifierValue.identifier` | Static identifier for the SPIRE server instance | `""` | | `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | | | `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` | | `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index a2c7803..2c6e34c 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -35,6 +35,9 @@ {{- if ne $tlsFederationCount 1 }} {{- fail "You must enable one and only one federation TLS configuration" }} {{- end }} +{{- if and (eq (.Values.keyManager.awsKMS.keyIdentifierFile.enabled | toString) "true") (eq (.Values.keyManager.awsKMS.keyIdentifierValue.enabled | toString ) "true") }} +{{- fail "You can only enable one of keyIdentifierFile or keyIdentifierValue at a time" }} +{{- end }} {{- define "spire-server.yaml-config" -}} {{- $upstreamAuthorityUsed := 0 }} {{- $keyManagerUsed := 0 }} @@ -190,7 +193,13 @@ plugins: aws_kms: plugin_data: region: {{ .region | quote }} + {{- if eq (.keyIdentifierFile.enabled | toString) "true" }} + key_identifier_file: "/run/spire/data/aws-kms-key-identifier" + {{- else if eq (.keyIdentifierValue.enabled | toString) "true" }} + key_identifier_value: {{ .keyIdentifierValue.identifier | quote }} + {{- else }} key_metadata_file: "/run/spire/data/aws-kms-key-metadata" + {{- end }} {{- if ne .accessKeyID "" }} access_key_id: "${AWS_KMS_ACCESS_KEY_ID}" {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 0cc0565..e75fc65 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -307,6 +307,14 @@ keyManager: enabled: false ## @param keyManager.awsKMS.region Specify the region for AWS KMS region: "" + keyIdentifierFile: + ## @param keyManager.awsKMS.keyIdentifierFile.enabled Enable key identifier data to be stored in a file in persistent storage. + enabled: false + keyIdentifierValue: + ## @param keyManager.awsKMS.keyIdentifierValue.enabled Enable specifying a key identifier value for AWS KMS + enabled: false + ## @param keyManager.awsKMS.keyIdentifierValue.identifier Static identifier for the SPIRE server instance + identifier: "" ## @extra keyManager.awsKMS.keyPolicy Policy to use when creating keys. If no policy is specified, a default policy will be used. keyPolicy: ## @param keyManager.awsKMS.keyPolicy.policy [nullable] Key policy in JSON format. From dcd11e9ff477d11261afc30ecc575c2ec29c9dd3 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 11 Apr 2024 11:14:05 -0700 Subject: [PATCH 2/8] Fix chainguard issue (#326) Chainguard renamed an image we depend on. Update to the new name. Signed-off-by: Kevin Fox --- charts/spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 86e3cbc..372409d 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -117,9 +117,9 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5921884408efe50b77796675dc109ad2126f54476fe7403c37d8898a5ceb2e76` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | +| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:803995505bc612174a9594a85493916a5234b6a8e0fa619763eceaf2d189cd75` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f0369215d5a2c15e469a2a8d993e4db7e83fcda5142c8682f37c197d76f82faa` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 5007c17..1e46d49 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -338,9 +338,9 @@ tests: ## image: registry: cgr.dev - repository: chainguard/slim-toolkit-debug + repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:803995505bc612174a9594a85493916a5234b6a8e0fa619763eceaf2d189cd75 + tag: latest@sha256:f0369215d5a2c15e469a2a8d993e4db7e83fcda5142c8682f37c197d76f82faa step: ## @param tests.step.image.registry The OCI registry to pull the image from From 5b1bf432f4210f56305d08d6c4c2982958784693 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 11 Apr 2024 11:15:05 -0700 Subject: [PATCH 3/8] Update spire to 1.9.4 (#324) Signed-off-by: Kevin Fox --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml | 2 +- charts/spire/charts/spire-agent/Chart.yaml | 2 +- charts/spire/charts/spire-server/Chart.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index bc4e958..1901deb 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -4,7 +4,7 @@ description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application version: 0.19.2 -appVersion: "1.9.2" +appVersion: "1.9.4" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index 785c655..c7fd5c3 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.19.2](https://img.shields.io/badge/Version-0.19.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.9.3](https://img.shields.io/badge/AppVersion-1.9.3-informational?style=flat-square) +![Version: 0.19.2](https://img.shields.io/badge/Version-0.19.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.9.4](https://img.shields.io/badge/AppVersion-1.9.4-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml index 4efda76..4c99b77 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml @@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider description: A Helm chart to install the SPIFFE OIDC discovery provider. type: application version: 0.1.0 -appVersion: "1.9.1" +appVersion: "1.9.4" keywords: ["spiffe", "oidc"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml index 4c158bc..888df65 100644 --- a/charts/spire/charts/spire-agent/Chart.yaml +++ b/charts/spire/charts/spire-agent/Chart.yaml @@ -3,7 +3,7 @@ name: spire-agent description: A Helm chart to install the SPIRE agent. type: application version: 0.1.0 -appVersion: "1.9.3" +appVersion: "1.9.4" keywords: ["spiffe", "spire-agent"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml index 955df24..ec4dfc9 100644 --- a/charts/spire/charts/spire-server/Chart.yaml +++ b/charts/spire/charts/spire-server/Chart.yaml @@ -3,7 +3,7 @@ name: spire-server description: A Helm chart to install the SPIRE server. type: application version: 0.1.0 -appVersion: "1.9.3" +appVersion: "1.9.4" keywords: ["spiffe", "spire-server", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: From c1e4feb34d92923468783ba5618cbe5515e5e154 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 11 Apr 2024 11:16:08 -0700 Subject: [PATCH 4/8] Fix ingress host with a dot (#323) Fixes: https://github.com/spiffe/helm-charts-hardened/issues/312 Signed-off-by: Kevin Fox --- charts/spire/templates/_spire-lib.tpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/templates/_spire-lib.tpl index 239efc1..db33cee 100644 --- a/charts/spire/templates/_spire-lib.tpl +++ b/charts/spire/templates/_spire-lib.tpl @@ -94,7 +94,7 @@ */}} {{ define "spire-lib.ingress-calculated-name" }} {{- $host := .ingress.host }} -{{- if not (contains $host ".") }} +{{- if not (contains "." $host) }} {{- $host = printf "%s.%s" $host (include "spire-lib.trust-domain" .) }} {{- end }} {{- $host }} From aa92791df2ad6bbe4eacea65684f5e9ba90b1e8d Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 11 Apr 2024 11:58:00 -0700 Subject: [PATCH 5/8] Upgrade to spire-controller-manager 0.5.0 (#316) * Upgrade to spire-controller-manager 0.5.0 Signed-off-by: Kevin Fox * Update for released 0.5.0 Signed-off-by: Kevin Fox * Fix up doc formatting Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 --- .../templates/spire.spiffe.io_clusterstaticentries.yaml | 2 ++ charts/spire/README.md | 7 +++++++ charts/spire/charts/spire-server/README.md | 3 ++- .../templates/controller-manager-configmap.yaml | 4 ++++ charts/spire/charts/spire-server/values.yaml | 5 ++++- 5 files changed, 19 insertions(+), 2 deletions(-) diff --git a/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml b/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml index bfdde50..6754b7e 100644 --- a/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml +++ b/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml @@ -64,6 +64,8 @@ spec: type: array spiffeID: type: string + storeSVID: + type: boolean x509SVIDTTL: type: string required: diff --git a/charts/spire/README.md b/charts/spire/README.md index c7fd5c3..e72a79f 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -75,6 +75,13 @@ kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeid We only support upgrading one major version at a time. Version skipping isn't supported. +### 0.20.X + +This release configures the entries managed by the spire-controller-manager to move into their own managed space within SPIRE. This should be transparent. In a future release, we will +disable cleanup by default of the old space. This release lays the groundwork for future support for manually created entries in the SPIRE database without the spire-controller-manager +destroying them. It is supported in this release by manually setting spire-server.controllerManager.entryIDPrefixCleanup=false after successfully upgrading to the chart without the +setting and waiting for a spire-controller-manager sync. + ### 0.19.X - The spire-agent daemonset gained a new label. For those disabling the upgrade hooks, you need to delete the spire-agent daemonset before issuing the helm upgrade. diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index ae9f458..78100c8 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -238,6 +238,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.enabled` | Flag to enable controller manager | `false` | | `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` | | `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` | +| `controllerManager.entryIDPrefixCleanup` | Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `""` | | `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` | | `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` | | `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` | @@ -246,7 +247,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.4` | +| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.5.0` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml index e5abd92..f019f56 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -32,6 +32,10 @@ data: {{- if .Values.controllerManager.validatingWebhookConfiguration.enabled }} validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook {{- end }} + {{- if typeIs "string" .Values.controllerManager.entryIDPrefixCleanup }} + entryIDPrefixCleanup: {{ .Values.controllerManager.entryIDPrefixCleanup | quote }} + {{- end }} + entryIDPrefix: {{ include "spire-lib.cluster-name" . }} clusterName: {{ include "spire-lib.cluster-name" . }} trustDomain: {{ include "spire-lib.trust-domain" . }} ignoreNamespaces: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index e75fc65..4411597 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -465,6 +465,9 @@ controllerManager: ## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. watchClassless: false + ## @param controllerManager.entryIDPrefixCleanup Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. + entryIDPrefixCleanup: "" + ## @param controllerManager.parentIDTemplate The template that is used to register workloads. parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}" @@ -490,7 +493,7 @@ controllerManager: registry: ghcr.io repository: spiffe/spire-controller-manager pullPolicy: IfNotPresent - tag: "0.4.4" + tag: "0.5.0" ## @param controllerManager.resources [object] Resource requests and limits for controller manager resources: {} From 1ef979c4e7e4aaa84b217adedd65fe1c0208959b Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 11 Apr 2024 12:00:34 -0700 Subject: [PATCH 6/8] Remove upgrade hook needed in 0.19.x (#317) Signed-off-by: Kevin Fox Co-authored-by: Faisal Memon --- charts/spire/charts/spire-agent/README.md | 1 - .../templates/pre-upgrade-hook.yaml | 77 ------------------- charts/spire/charts/spire-agent/values.yaml | 4 - 3 files changed, 82 deletions(-) delete mode 100644 charts/spire/charts/spire-agent/templates/pre-upgrade-hook.yaml diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index bc53a8a..9556614 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -123,7 +123,6 @@ A Helm chart to install the SPIRE agent. | `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` | | `experimental.featureFlags` | List of developer feature flags | `[]` | | `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` | -| `installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | | `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spire-agent/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-agent/templates/pre-upgrade-hook.yaml deleted file mode 100644 index e28c2bc..0000000 --- a/charts/spire/charts/spire-agent/templates/pre-upgrade-hook.yaml +++ /dev/null @@ -1,77 +0,0 @@ -{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} -{{- $ds := lookup "apps/v1" "DaemonSet" (include "spire-agent.namespace" .) (include "spire-agent.fullname" .) }} -{{- if and $ds (not (hasKey $ds.metadata.labels "app.kubernetes.io/component")) }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "spire-agent.serviceAccountName" . }}-pre-upgrade - namespace: {{ include "spire-agent.namespace" . }} - labels: - {{- include "spire-agent.labels" . | nindent 4 }} - annotations: - "helm.sh/hook": pre-upgrade - "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ include "spire-agent.fullname" . }}-pre-upgrade - namespace: {{ include "spire-agent.namespace" . }} - annotations: - "helm.sh/hook": pre-upgrade - "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed -rules: - - apiGroups: ["apps"] - resources: ["daemonsets"] - resourceNames: [{{ include "spire-agent.fullname" . | quote }}] - verbs: ["get", "delete"] ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ include "spire-agent.fullname" . }}-pre-upgrade - namespace: {{ include "spire-agent.namespace" . }} - annotations: - "helm.sh/hook": pre-upgrade - "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed -subjects: - - kind: ServiceAccount - name: {{ include "spire-agent.serviceAccountName" . }}-pre-upgrade - namespace: {{ include "spire-agent.namespace" . }} -roleRef: - kind: Role - name: {{ include "spire-agent.fullname" . }}-pre-upgrade - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ include "spire-agent.fullname" . }}-pre-upgrade - namespace: {{ include "spire-agent.namespace" . }} - labels: - {{- include "spire-agent.labels" . | nindent 4 }} - annotations: - "helm.sh/hook": pre-upgrade - "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed -spec: - template: - metadata: - name: {{ include "spire-agent.fullname" . }}-pre-upgrade - spec: - restartPolicy: Never - serviceAccountName: {{ include "spire-agent.serviceAccountName" . }}-pre-upgrade - securityContext: - {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} - containers: - - name: pre-upgrade - securityContext: - {{- include "spire-lib.securitycontext" . | nindent 10 }} - image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} - args: - - delete - - daemonset - - {{ include "spire-agent.fullname" . }} - - -n - - {{ include "spire-agent.namespace" . }} -{{- end }} -{{- end }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 6d7dcf0..f9ab02d 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -329,10 +329,6 @@ agents: {} # tpmDirect: # enabled: true -installAndUpgradeHook: - ## @param installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) - enabled: true - tools: kubectl: ## @param tools.kubectl.image.registry The OCI registry to pull the image from From 1bf3aa77ef3d225c5b3c5a5b7f82f1cb4cdfb97a Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 11 Apr 2024 12:29:28 -0700 Subject: [PATCH 7/8] Default spire-server port 443 (#308) Changes the default service port for the spire-server to 443 to allow easier switching between internal access and external access through an ingress controller. Signed-off-by: Kevin Fox Signed-off-by: Faisal Memon Co-authored-by: Faisal Memon --- charts/spire/README.md | 5 ++++- charts/spire/charts/spire-agent/README.md | 2 +- charts/spire/charts/spire-agent/values.yaml | 2 +- charts/spire/charts/spire-server/README.md | 4 ++-- charts/spire/charts/spire-server/values.yaml | 4 ++-- 5 files changed, 10 insertions(+), 7 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index e72a79f..22d8879 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -77,7 +77,10 @@ We only support upgrading one major version at a time. Version skipping isn't su ### 0.20.X -This release configures the entries managed by the spire-controller-manager to move into their own managed space within SPIRE. This should be transparent. In a future release, we will +- The default service port for the spire-server was changed to be port 443 to allow easier switching between internal access and external access through an ingress controller. For most users, this will be a transparent +change. + +- This release configures the entries managed by the spire-controller-manager to move into their own managed space within SPIRE. This should be transparent. In a future release, we will disable cleanup by default of the old space. This release lays the groundwork for future support for manually created entries in the SPIRE database without the spire-controller-manager destroying them. It is supported in this release by manually setting spire-server.controllerManager.entryIDPrefixCleanup=false after successfully upgrading to the chart without the setting and waiting for a spire-controller-manager sync. diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 9556614..85d87a2 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -57,7 +57,7 @@ A Helm chart to install the SPIRE agent. | `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` | | `disableReattestToRenew` | Deprecated: Allow agent to renew certificate when it expires rather than reattest | `false` | | `server.address` | Address for Spire server | `""` | -| `server.port` | Port number for Spire server | `8081` | +| `server.port` | Port number for Spire server | `443` | | `server.namespaceOverride` | Override the namespace for Spire server | `""` | | `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` | | `healthChecks.port` | override the host port used for health checking | `9982` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index f9ab02d..be1b1d9 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -113,7 +113,7 @@ upstream: false ## server: address: "" - port: 8081 + port: 443 namespaceOverride: "" nameOverride: "" diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 78100c8..5e503cc 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -101,7 +101,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `securityContext` | Security context | `{}` | | `priorityClassName` | Priority class assigned to statefulset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `service.type` | Type of the Spire server service created | `ClusterIP` | -| `service.port` | Port for the created service | `8081` | +| `service.port` | Port for the created service | `443` | | `service.annotations` | Annotations to add to the service object | `{}` | | `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` | | `resources` | Resource requests and limits | `{}` | @@ -215,7 +215,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | | | `upstreamAuthority.spire.server.nameOverride` | Override the name for upstream Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` | | `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` | -| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `8081` | +| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `443` | | `upstreamAuthority.vault.enabled` | Enable Hashicorp Vault as upstream CA | `false` | | `upstreamAuthority.vault.vaultAddr` | The URL of the Vault server. (e.g., https://vault.example.com:8443/) | `""` | | `upstreamAuthority.vault.namespace` | Name of the Vault namespace. This is only available in the Vault Enterprise. | `""` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 4411597..1e38cbd 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -75,7 +75,7 @@ priorityClassName: "" ## service: type: ClusterIP - port: 8081 + port: 443 annotations: {} configMap: @@ -403,7 +403,7 @@ upstreamAuthority: ## @param upstreamAuthority.spire.server.address Address for upstream Spire server address: "" ## @param upstreamAuthority.spire.server.port Port for upstream Spire server - port: 8081 + port: 443 vault: ## @param upstreamAuthority.vault.enabled Enable Hashicorp Vault as upstream CA enabled: false From a5613b8cd702b43144e6458fb779ef3b6c6630fd Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Thu, 11 Apr 2024 15:56:57 -0700 Subject: [PATCH 8/8] Bump spire-crds Helm Chart version from 0.3.0 to 0.4.0 (#328) * aa92791 Upgrade to spire-controller-manager 0.5.0 (#316) Signed-off-by: Faisal Memon --- charts/spire-crds/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/spire-crds/Chart.yaml b/charts/spire-crds/Chart.yaml index 8ac17dc..1dfea97 100644 --- a/charts/spire-crds/Chart.yaml +++ b/charts/spire-crds/Chart.yaml @@ -3,7 +3,7 @@ name: spire-crds description: > A Helm chart for deploying the Spire CRDS type: application -version: 0.3.0 +version: 0.4.0 appVersion: "0.0.1" keywords: ["spire-crds"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire