panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'main' into release

Browse Source
This commit is contained in:
Faisal Memon
2024-04-11 15:57:17 -07:00
parent 26ff986c63 a5613b8cd7
commit 8e6704e588
17 changed files with 59 additions and 101 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire-crds/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spire-crds
description: > description: >
A Helm chart for deploying the Spire CRDS A Helm chart for deploying the Spire CRDS
type: application type: application
version: 0.3.0 version: 0.4.0
appVersion: "0.0.1" appVersion: "0.0.1"
keywords: ["spire-crds"] keywords: ["spire-crds"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml
+2
View File
@@ -64,6 +64,8 @@ spec:
type: array type: array
spiffeID: spiffeID:
type: string type: string
storeSVID:
type: boolean
x509SVIDTTL: x509SVIDTTL:
type: string type: string
required: required:
charts/spire/Chart.yaml
+1 -1
View File
@@ -4,7 +4,7 @@ description: >
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
type: application type: application
version: 0.19.2 version: 0.19.2
appVersion: "1.9.2" appVersion: "1.9.4"
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
charts/spire/README.md
+11 -1
View File
@@ -1,6 +1,6 @@
# spire # spire
![Version: 0.19.2](https://img.shields.io/badge/Version-0.19.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.9.3](https://img.shields.io/badge/AppVersion-1.9.3-informational?style=flat-square) ![Version: 0.19.2](https://img.shields.io/badge/Version-0.19.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.9.4](https://img.shields.io/badge/AppVersion-1.9.4-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
@@ -75,6 +75,16 @@ kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeid
We only support upgrading one major version at a time. Version skipping isn't supported. We only support upgrading one major version at a time. Version skipping isn't supported.
### 0.20.X
- The default service port for the spire-server was changed to be port 443 to allow easier switching between internal access and external access through an ingress controller. For most users, this will be a transparent
change.
- This release configures the entries managed by the spire-controller-manager to move into their own managed space within SPIRE. This should be transparent. In a future release, we will
disable cleanup by default of the old space. This release lays the groundwork for future support for manually created entries in the SPIRE database without the spire-controller-manager
destroying them. It is supported in this release by manually setting spire-server.controllerManager.entryIDPrefixCleanup=false after successfully upgrading to the chart without the
setting and waiting for a spire-controller-manager sync.
### 0.19.X ### 0.19.X
- The spire-agent daemonset gained a new label. For those disabling the upgrade hooks, you need to delete the spire-agent daemonset before issuing the helm upgrade. - The spire-agent daemonset gained a new label. For those disabling the upgrade hooks, you need to delete the spire-agent daemonset before issuing the helm upgrade.
charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider
description: A Helm chart to install the SPIFFE OIDC discovery provider. description: A Helm chart to install the SPIFFE OIDC discovery provider.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.9.1" appVersion: "1.9.4"
keywords: ["spiffe", "oidc"] keywords: ["spiffe", "oidc"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+2 -2
View File
@@ -117,9 +117,9 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5921884408efe50b77796675dc109ad2126f54476fe7403c37d8898a5ceb2e76` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5921884408efe50b77796675dc109ad2126f54476fe7403c37d8898a5ceb2e76` |
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:803995505bc612174a9594a85493916a5234b6a8e0fa619763eceaf2d189cd75` | | `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f0369215d5a2c15e469a2a8d993e4db7e83fcda5142c8682f37c197d76f82faa` |
| `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` |
| `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` |
charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+2 -2
View File
@@ -338,9 +338,9 @@ tests:
## ##
image: image:
registry: cgr.dev registry: cgr.dev
repository: chainguard/slim-toolkit-debug repository: chainguard/min-toolkit-debug
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:803995505bc612174a9594a85493916a5234b6a8e0fa619763eceaf2d189cd75 tag: latest@sha256:f0369215d5a2c15e469a2a8d993e4db7e83fcda5142c8682f37c197d76f82faa
step: step:
## @param tests.step.image.registry The OCI registry to pull the image from ## @param tests.step.image.registry The OCI registry to pull the image from
charts/spire/charts/spire-agent/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spire-agent
description: A Helm chart to install the SPIRE agent. description: A Helm chart to install the SPIRE agent.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.9.3" appVersion: "1.9.4"
keywords: ["spiffe", "spire-agent"] keywords: ["spiffe", "spire-agent"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
charts/spire/charts/spire-agent/README.md
+1 -2
View File
@@ -57,7 +57,7 @@ A Helm chart to install the SPIRE agent.
| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` | | `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` |
| `disableReattestToRenew` | Deprecated: Allow agent to renew certificate when it expires rather than reattest | `false` | | `disableReattestToRenew` | Deprecated: Allow agent to renew certificate when it expires rather than reattest | `false` |
| `server.address` | Address for Spire server | `""` | | `server.address` | Address for Spire server | `""` |
| `server.port` | Port number for Spire server | `8081` | | `server.port` | Port number for Spire server | `443` |
| `server.namespaceOverride` | Override the namespace for Spire server | `""` | | `server.namespaceOverride` | Override the namespace for Spire server | `""` |
| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` | | `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
| `healthChecks.port` | override the host port used for health checking | `9982` | | `healthChecks.port` | override the host port used for health checking | `9982` |
@@ -123,7 +123,6 @@ A Helm chart to install the SPIRE agent.
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` | | `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
| `experimental.featureFlags` | List of developer feature flags | `[]` | | `experimental.featureFlags` | List of developer feature flags | `[]` |
| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` | | `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` |
| `installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | | `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
charts/spire/charts/spire-agent/templates/pre-upgrade-hook.yaml
-77
View File
@@ -1,77 +0,0 @@
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
{{- $ds := lookup "apps/v1" "DaemonSet" (include "spire-agent.namespace" .) (include "spire-agent.fullname" .) }}
{{- if and $ds (not (hasKey $ds.metadata.labels "app.kubernetes.io/component")) }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "spire-agent.serviceAccountName" . }}-pre-upgrade
namespace: {{ include "spire-agent.namespace" . }}
labels:
{{- include "spire-agent.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": pre-upgrade
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ include "spire-agent.fullname" . }}-pre-upgrade
namespace: {{ include "spire-agent.namespace" . }}
annotations:
"helm.sh/hook": pre-upgrade
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
rules:
- apiGroups: ["apps"]
resources: ["daemonsets"]
resourceNames: [{{ include "spire-agent.fullname" . | quote }}]
verbs: ["get", "delete"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "spire-agent.fullname" . }}-pre-upgrade
namespace: {{ include "spire-agent.namespace" . }}
annotations:
"helm.sh/hook": pre-upgrade
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
subjects:
- kind: ServiceAccount
name: {{ include "spire-agent.serviceAccountName" . }}-pre-upgrade
namespace: {{ include "spire-agent.namespace" . }}
roleRef:
kind: Role
name: {{ include "spire-agent.fullname" . }}-pre-upgrade
apiGroup: rbac.authorization.k8s.io
---
apiVersion: batch/v1
kind: Job
metadata:
name: {{ include "spire-agent.fullname" . }}-pre-upgrade
namespace: {{ include "spire-agent.namespace" . }}
labels:
{{- include "spire-agent.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": pre-upgrade
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
spec:
template:
metadata:
name: {{ include "spire-agent.fullname" . }}-pre-upgrade
spec:
restartPolicy: Never
serviceAccountName: {{ include "spire-agent.serviceAccountName" . }}-pre-upgrade
securityContext:
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
containers:
- name: pre-upgrade
securityContext:
{{- include "spire-lib.securitycontext" . | nindent 10 }}
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args:
- delete
- daemonset
- {{ include "spire-agent.fullname" . }}
- -n
- {{ include "spire-agent.namespace" . }}
{{- end }}
{{- end }}
charts/spire/charts/spire-agent/values.yaml
+1 -5
View File
@@ -113,7 +113,7 @@ upstream: false
## ##
server: server:
address: "" address: ""
port: 8081 port: 443
namespaceOverride: "" namespaceOverride: ""
nameOverride: "" nameOverride: ""
@@ -329,10 +329,6 @@ agents: {}
# tpmDirect: # tpmDirect:
# enabled: true # enabled: true
installAndUpgradeHook:
## @param installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`)
enabled: true
tools: tools:
kubectl: kubectl:
## @param tools.kubectl.image.registry The OCI registry to pull the image from ## @param tools.kubectl.image.registry The OCI registry to pull the image from
charts/spire/charts/spire-server/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spire-server
description: A Helm chart to install the SPIRE server. description: A Helm chart to install the SPIRE server.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.9.3" appVersion: "1.9.4"
keywords: ["spiffe", "spire-server", "spire-controller-manager"] keywords: ["spiffe", "spire-server", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
charts/spire/charts/spire-server/README.md
+7 -3
View File
@@ -101,7 +101,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `securityContext` | Security context | `{}` | | `securityContext` | Security context | `{}` |
| `priorityClassName` | Priority class assigned to statefulset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `priorityClassName` | Priority class assigned to statefulset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
| `service.type` | Type of the Spire server service created | `ClusterIP` | | `service.type` | Type of the Spire server service created | `ClusterIP` |
| `service.port` | Port for the created service | `8081` | | `service.port` | Port for the created service | `443` |
| `service.annotations` | Annotations to add to the service object | `{}` | | `service.annotations` | Annotations to add to the service object | `{}` |
| `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` | | `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` |
| `resources` | Resource requests and limits | `{}` | | `resources` | Resource requests and limits | `{}` |
@@ -174,6 +174,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` | | `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
| `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` | | `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` |
| `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` | | `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` |
| `keyManager.awsKMS.keyIdentifierFile.enabled` | Enable key identifier data to be stored in a file in persistent storage. | `false` |
| `keyManager.awsKMS.keyIdentifierValue.enabled` | Enable specifying a key identifier value for AWS KMS | `false` |
| `keyManager.awsKMS.keyIdentifierValue.identifier` | Static identifier for the SPIRE server instance | `""` |
| `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | | | `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | |
| `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` | | `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` |
| `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` | | `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` |
@@ -212,7 +215,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | | | `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | |
| `upstreamAuthority.spire.server.nameOverride` | Override the name for upstream Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` | | `upstreamAuthority.spire.server.nameOverride` | Override the name for upstream Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
| `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` | | `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` |
| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `8081` | | `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `443` |
| `upstreamAuthority.vault.enabled` | Enable Hashicorp Vault as upstream CA | `false` | | `upstreamAuthority.vault.enabled` | Enable Hashicorp Vault as upstream CA | `false` |
| `upstreamAuthority.vault.vaultAddr` | The URL of the Vault server. (e.g., https://vault.example.com:8443/) | `""` | | `upstreamAuthority.vault.vaultAddr` | The URL of the Vault server. (e.g., https://vault.example.com:8443/) | `""` |
| `upstreamAuthority.vault.namespace` | Name of the Vault namespace. This is only available in the Vault Enterprise. | `""` | | `upstreamAuthority.vault.namespace` | Name of the Vault namespace. This is only available in the Vault Enterprise. | `""` |
@@ -235,6 +238,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.enabled` | Flag to enable controller manager | `false` | | `controllerManager.enabled` | Flag to enable controller manager | `false` |
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` | | `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` | | `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
| `controllerManager.entryIDPrefixCleanup` | Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `""` |
| `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` | | `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
| `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` | | `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` |
| `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` | | `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` |
@@ -243,7 +247,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.4` | | `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.5.0` |
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
| `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.securityContext` | Security context | `{}` |
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
charts/spire/charts/spire-server/templates/configmap.yaml
+9
View File
@@ -35,6 +35,9 @@
{{- if ne $tlsFederationCount 1 }} {{- if ne $tlsFederationCount 1 }}
{{- fail "You must enable one and only one federation TLS configuration" }} {{- fail "You must enable one and only one federation TLS configuration" }}
{{- end }} {{- end }}
{{- if and (eq (.Values.keyManager.awsKMS.keyIdentifierFile.enabled | toString) "true") (eq (.Values.keyManager.awsKMS.keyIdentifierValue.enabled | toString ) "true") }}
{{- fail "You can only enable one of keyIdentifierFile or keyIdentifierValue at a time" }}
{{- end }}
{{- define "spire-server.yaml-config" -}} {{- define "spire-server.yaml-config" -}}
{{- $upstreamAuthorityUsed := 0 }} {{- $upstreamAuthorityUsed := 0 }}
{{- $keyManagerUsed := 0 }} {{- $keyManagerUsed := 0 }}
@@ -190,7 +193,13 @@ plugins:
aws_kms: aws_kms:
plugin_data: plugin_data:
region: {{ .region | quote }} region: {{ .region | quote }}
{{- if eq (.keyIdentifierFile.enabled | toString) "true" }}
key_identifier_file: "/run/spire/data/aws-kms-key-identifier"
{{- else if eq (.keyIdentifierValue.enabled | toString) "true" }}
key_identifier_value: {{ .keyIdentifierValue.identifier | quote }}
{{- else }}
key_metadata_file: "/run/spire/data/aws-kms-key-metadata" key_metadata_file: "/run/spire/data/aws-kms-key-metadata"
{{- end }}
{{- if ne .accessKeyID "" }} {{- if ne .accessKeyID "" }}
access_key_id: "${AWS_KMS_ACCESS_KEY_ID}" access_key_id: "${AWS_KMS_ACCESS_KEY_ID}"
{{- end }} {{- end }}
charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
+4
View File
@@ -32,6 +32,10 @@ data:
{{- if .Values.controllerManager.validatingWebhookConfiguration.enabled }} {{- if .Values.controllerManager.validatingWebhookConfiguration.enabled }}
validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
{{- end }} {{- end }}
{{- if typeIs "string" .Values.controllerManager.entryIDPrefixCleanup }}
entryIDPrefixCleanup: {{ .Values.controllerManager.entryIDPrefixCleanup | quote }}
{{- end }}
entryIDPrefix: {{ include "spire-lib.cluster-name" . }}
clusterName: {{ include "spire-lib.cluster-name" . }} clusterName: {{ include "spire-lib.cluster-name" . }}
trustDomain: {{ include "spire-lib.trust-domain" . }} trustDomain: {{ include "spire-lib.trust-domain" . }}
ignoreNamespaces: ignoreNamespaces:
charts/spire/charts/spire-server/values.yaml
+14 -3
View File
@@ -75,7 +75,7 @@ priorityClassName: ""
## ##
service: service:
type: ClusterIP type: ClusterIP
port: 8081 port: 443
annotations: {} annotations: {}
configMap: configMap:
@@ -307,6 +307,14 @@ keyManager:
enabled: false enabled: false
## @param keyManager.awsKMS.region Specify the region for AWS KMS ## @param keyManager.awsKMS.region Specify the region for AWS KMS
region: "" region: ""
keyIdentifierFile:
## @param keyManager.awsKMS.keyIdentifierFile.enabled Enable key identifier data to be stored in a file in persistent storage.
enabled: false
keyIdentifierValue:
## @param keyManager.awsKMS.keyIdentifierValue.enabled Enable specifying a key identifier value for AWS KMS
enabled: false
## @param keyManager.awsKMS.keyIdentifierValue.identifier Static identifier for the SPIRE server instance
identifier: ""
## @extra keyManager.awsKMS.keyPolicy Policy to use when creating keys. If no policy is specified, a default policy will be used. ## @extra keyManager.awsKMS.keyPolicy Policy to use when creating keys. If no policy is specified, a default policy will be used.
keyPolicy: keyPolicy:
## @param keyManager.awsKMS.keyPolicy.policy [nullable] Key policy in JSON format. ## @param keyManager.awsKMS.keyPolicy.policy [nullable] Key policy in JSON format.
@@ -395,7 +403,7 @@ upstreamAuthority:
## @param upstreamAuthority.spire.server.address Address for upstream Spire server ## @param upstreamAuthority.spire.server.address Address for upstream Spire server
address: "" address: ""
## @param upstreamAuthority.spire.server.port Port for upstream Spire server ## @param upstreamAuthority.spire.server.port Port for upstream Spire server
port: 8081 port: 443
vault: vault:
## @param upstreamAuthority.vault.enabled Enable Hashicorp Vault as upstream CA ## @param upstreamAuthority.vault.enabled Enable Hashicorp Vault as upstream CA
enabled: false enabled: false
@@ -457,6 +465,9 @@ controllerManager:
## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. ## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.
watchClassless: false watchClassless: false
## @param controllerManager.entryIDPrefixCleanup Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it.
entryIDPrefixCleanup: ""
## @param controllerManager.parentIDTemplate The template that is used to register workloads. ## @param controllerManager.parentIDTemplate The template that is used to register workloads.
parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}" parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"
@@ -482,7 +493,7 @@ controllerManager:
registry: ghcr.io registry: ghcr.io
repository: spiffe/spire-controller-manager repository: spiffe/spire-controller-manager
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: "0.4.4" tag: "0.5.0"
## @param controllerManager.resources [object] Resource requests and limits for controller manager ## @param controllerManager.resources [object] Resource requests and limits for controller manager
resources: {} resources: {}
charts/spire/templates/_spire-lib.tpl
+1 -1
View File
@@ -94,7 +94,7 @@
*/}} */}}
{{ define "spire-lib.ingress-calculated-name" }} {{ define "spire-lib.ingress-calculated-name" }}
{{- $host := .ingress.host }} {{- $host := .ingress.host }}
{{- if not (contains $host ".") }} {{- if not (contains "." $host) }}
{{- $host = printf "%s.%s" $host (include "spire-lib.trust-domain" .) }} {{- $host = printf "%s.%s" $host (include "spire-lib.trust-domain" .) }}
{{- end }} {{- end }}
{{- $host }} {{- $host }}