diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 99ab1c8..5535af2 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -79,17 +79,17 @@ A Helm chart to install the SPIRE agent. | `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` | | `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` | | `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` | -| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `docker.io` | -| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-agent` | +| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-agent` | | `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.8.7` | -| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `1d7c73ccac948ee86cbd78ddde2d30128a1838b403f7bb2100d38d916a252244` | +| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.9.0` | +| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `22f67063f1699330e70cdedc9b923e517688f5ae71085a26bd9b83b3060ee86e` | | `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` | | `nodeAttestor.tpmDirect.pubHash.enabled` | Display pubhash in logs | `true` | -| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `docker.io` | -| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-get-tpm-pubhash` | +| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-get-tpm-pubhash` | | `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.8.7` | +| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.9.0` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | | `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index a357d79..cdbeb2a 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -186,12 +186,12 @@ nodeAttestor: ## @param nodeAttestor.tpmDirect.plugin.image.tag Overrides the image tag ## image: - registry: docker.io - repository: boxboat/spire-tpm-plugin-tpm-attestor-agent + registry: ghcr.io + repository: spiffe/spire-tpm-plugin-tpm-attestor-agent pullPolicy: IfNotPresent - tag: "v1.8.7" + tag: "v1.9.0" ## @param nodeAttestor.tpmDirect.plugin.checksum The sha256 checksum of the plugin binary - checksum: 1d7c73ccac948ee86cbd78ddde2d30128a1838b403f7bb2100d38d916a252244 + checksum: 22f67063f1699330e70cdedc9b923e517688f5ae71085a26bd9b83b3060ee86e ## @param nodeAttestor.tpmDirect.plugin.path The filename in the container of the plugin path: /app/tpm_attestor_agent pubHash: @@ -203,10 +203,10 @@ nodeAttestor: ## @param nodeAttestor.tpmDirect.pubHash.image.tag Overrides the image tag ## image: - registry: docker.io - repository: boxboat/spire-tpm-plugin-get-tpm-pubhash + registry: ghcr.io + repository: spiffe/spire-tpm-plugin-get-tpm-pubhash pullPolicy: IfNotPresent - tag: "v1.8.7" + tag: "v1.9.0" # workloadAttestors determine a workload's properties and then generate a set of selectors associated with it. workloadAttestors: diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 101fc0e..cd24ab1 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -365,11 +365,11 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `nodeAttestor.httpChallenge.allowNonRootPorts` | Allow using ports >= 1024 from clients for attestation | `true` | | `nodeAttestor.httpChallenge.tofu` | Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024 | `true` | | `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` | -| `nodeAttestor.tpmDirect.image.registry` | The OCI registry to pull the image from | `docker.io` | -| `nodeAttestor.tpmDirect.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-server` | +| `nodeAttestor.tpmDirect.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `nodeAttestor.tpmDirect.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-server` | | `nodeAttestor.tpmDirect.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `nodeAttestor.tpmDirect.image.tag` | Overrides the image tag | `v1.8.7` | -| `nodeAttestor.tpmDirect.checksum` | The sha256 checksum of the plugin binary | `f39ef9cdd2b3dd74112bfe827b79d6721c59215d0d5f4c2e34fa09bbc60d36d2` | +| `nodeAttestor.tpmDirect.image.tag` | Overrides the image tag | `v1.9.0` | +| `nodeAttestor.tpmDirect.checksum` | The sha256 checksum of the plugin binary | `46d0caad8c25a027dd11c93e18b58a8bc6fbd9f1fe2e36fa2a0dd440986de4dc` | | `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` | | `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` | | `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 7a6a10b..fef4d24 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -897,12 +897,12 @@ nodeAttestor: ## @param nodeAttestor.tpmDirect.image.tag Overrides the image tag ## image: - registry: docker.io - repository: boxboat/spire-tpm-plugin-tpm-attestor-server + registry: ghcr.io + repository: spiffe/spire-tpm-plugin-tpm-attestor-server pullPolicy: IfNotPresent - tag: "v1.8.7" + tag: "v1.9.0" ## @param nodeAttestor.tpmDirect.checksum The sha256 checksum of the plugin binary - checksum: f39ef9cdd2b3dd74112bfe827b79d6721c59215d0d5f4c2e34fa09bbc60d36d2 + checksum: 46d0caad8c25a027dd11c93e18b58a8bc6fbd9f1fe2e36fa2a0dd440986de4dc ## @param nodeAttestor.tpmDirect.pluginPath The filename in the container of the plugin pluginPath: /app/tpm_attestor_server ## @param nodeAttestor.tpmDirect.cas A dictionary of TPM CA PEM or DER files that are allowed to connect.