Change production example to be an integration test (#237)
* Change production example to be an integration test The documentation is a better example then the test now. Separate the two. Signed-off-by: Kevin Fox <[email protected]> * Fix job name reference Signed-off-by: Kevin Fox <[email protected]> * Fix job name reference Signed-off-by: Kevin Fox <[email protected]> * Update postgresql example Signed-off-by: Kevin Fox <[email protected]> * Update mysql example Signed-off-by: Kevin Fox <[email protected]> * Update nested and mysql Signed-off-by: Kevin Fox <[email protected]> * Fix typo Signed-off-by: Kevin Fox <[email protected]> * Add support for integration tests in the tests/integration dir Signed-off-by: Kevin Fox <[email protected]> * Fix split issue and typo Signed-off-by: Kevin Fox <[email protected]> * Fix split issue Signed-off-by: Kevin Fox <[email protected]> * Try folding example your values into bash so that its not laying around in an fs for a user to accidently use. Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Cleanup Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -70,3 +70,23 @@ $(helm ls -A | sed 's/\t/ | /g' | sed 's/^/| /' | sed 's/$/ |/' | sed '/^| NAME.
|
||||
|
||||
EOF
|
||||
}
|
||||
|
||||
# Used just for testing. You should provide your own values as described in the install instructions.
|
||||
common_test_your_values () {
|
||||
cat > /tmp/$$.example-your-values.yaml <<EOF
|
||||
global:
|
||||
spire:
|
||||
recommendations:
|
||||
enabled: true
|
||||
clusterName: production
|
||||
trustDomain: production.other
|
||||
caSubject:
|
||||
country: US
|
||||
organization: Production
|
||||
commonName: production.other
|
||||
EOF
|
||||
echo "/tmp/$$.example-your-values.yaml"
|
||||
}
|
||||
|
||||
COMMON_TEST_YOUR_VALUES="$(common_test_your_values)"
|
||||
export COMMON_TEST_YOUR_VALUES
|
||||
|
||||
@@ -343,4 +343,4 @@ jobs:
|
||||
verbosity: 1
|
||||
|
||||
- name: Install and test example
|
||||
run: examples/production/run-tests.sh -u
|
||||
run: tests/integration/production/run-tests.sh -u
|
||||
|
||||
@@ -10,13 +10,11 @@ If manually deploying for testing, you can safely put the password into an envir
|
||||
source ../bin/readpw.sh
|
||||
```
|
||||
|
||||
Next, edit values.yaml with your settings. Check it into your git repo if using one.
|
||||
Follow the instructions as described at https://artifacthub.io/packages/helm/spiffe/spire, and copy in the settings from
|
||||
examples/external-mysql/values.yaml into your values file.
|
||||
|
||||
Then, deploy the chart pointing at your mysql instance like so:
|
||||
You can add the password at install runtime like so:
|
||||
|
||||
```shell
|
||||
helm upgrade --install --namespace spire-server spire charts/spire -f examples/external-mysql/values.yaml --set "spire-server.dataStore.sql.password=${DBPW}"
|
||||
helm upgrade --install --namespace spire-mgmt spire spire -f your-values.yaml --set "spire-server.dataStore.sql.password=${DBPW}" --repo https://spiffe.github.io/helm-charts-hardened/
|
||||
```
|
||||
|
||||
See the [production example](../production) for production recommendations.
|
||||
See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
|
||||
|
||||
@@ -54,6 +54,6 @@ helm upgrade --install mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO
|
||||
--wait
|
||||
|
||||
helm upgrade --install --namespace "spire-server" \
|
||||
--values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \
|
||||
--values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../misc/values-node-pod-antiaffinity.yaml" \
|
||||
--set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire
|
||||
helm test --namespace "spire-server" spire
|
||||
|
||||
@@ -10,14 +10,12 @@ If manually deploying for testing, you can safely put the password into an envir
|
||||
source ../bin/readpw.sh
|
||||
```
|
||||
|
||||
Next, edit values.yaml with your settings. Check it into your git repo if using one.
|
||||
Follow the instructions as described at https://artifacthub.io/packages/helm/spiffe/spire, and copy in the settings from
|
||||
examples/external-postgresql/values.yaml into your values file.
|
||||
|
||||
Then, deploy the chart pointing at your postgresql instance like so:
|
||||
You can add the password at install runtime like so:
|
||||
|
||||
```shell
|
||||
helm upgrade --install --namespace spire-server spire charts/spire -f examples/external-postgresql/values.yaml --set "spire-server.dataStore.sql.password=${DBPW}"
|
||||
helm upgrade --install --namespace spire-mgmt spire spire -f your-values.yaml --set "spire-server.dataStore.sql.password=${DBPW}" --repo https://spiffe.github.io/helm-charts-hardened/
|
||||
|
||||
```
|
||||
|
||||
See the [production example](../production) for production recommendations.
|
||||
See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
|
||||
|
||||
@@ -50,10 +50,10 @@ kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restrict
|
||||
|
||||
helm upgrade --install postgresql postgresql --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \
|
||||
--namespace spire-server \
|
||||
--values "${DEPS}/postgresql.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml" \
|
||||
--values "${DEPS}/postgresql.yaml" \
|
||||
--wait
|
||||
|
||||
helm upgrade --install --namespace "spire-server" \
|
||||
--values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \
|
||||
--values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../misc/values-node-pod-antiaffinity.yaml" \
|
||||
--set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire
|
||||
helm test --namespace "spire-server" spire
|
||||
|
||||
@@ -55,7 +55,7 @@ helm upgrade --install --create-namespace spire charts/spire \
|
||||
--values "${DEPS}/spire-root-server-values.yaml" \
|
||||
--wait
|
||||
|
||||
helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \
|
||||
helm upgrade --install --create-namespace --namespace spire-server --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../misc/values-node-pod-antiaffinity.yaml" \
|
||||
--wait spire charts/spire
|
||||
helm test --namespace spire-server spire
|
||||
|
||||
|
||||
@@ -1,66 +0,0 @@
|
||||
# Recommended production setup
|
||||
|
||||
To install Spire with the least privileges possible we deploy spire across 2 namespaces.
|
||||
|
||||
```shell
|
||||
kubectl create namespace "spire-system"
|
||||
kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
|
||||
kubectl create namespace "spire-server"
|
||||
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
|
||||
```
|
||||
|
||||
Update the `example-your-values.yaml` file with your values, then:
|
||||
|
||||
```shell
|
||||
helm upgrade --install --namespace spire-server spire charts/spire \
|
||||
-f examples/production/values.yaml -f examples/production/example-your-values.yaml --render-subchart-notes
|
||||
```
|
||||
|
||||
If your using ingress-nginx and want to expose the spiffe oidc discovery provider outside the
|
||||
cluster, add the following to the end of the helm upgrade example:
|
||||
|
||||
```shell
|
||||
-f examples/production/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml
|
||||
```
|
||||
|
||||
If you want to expose your spire-server outside of Kubernetes and are using ingress-nginx, add following values file when running `helm template/install/upgrade`.
|
||||
|
||||
```shell
|
||||
-f examples/production/values-expose-spire-server-ingress-nginx.yaml
|
||||
```
|
||||
|
||||
For example:
|
||||
|
||||
```shell
|
||||
helm upgrade --install --namespace spire-server spire charts/spire -f examples/production/values.yaml -f examples/production/values-expose-spire-server-ingress-nginx.yaml
|
||||
```
|
||||
|
||||
If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx
|
||||
you have two options as described here:
|
||||
[github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles](https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles)
|
||||
|
||||
If you chose profile https_web, use:
|
||||
|
||||
```shell
|
||||
-f examples/production/values-expose-federation-https-web-ingress-nginx.yaml
|
||||
```
|
||||
|
||||
For example:
|
||||
|
||||
```shell
|
||||
helm upgrade --install --namespace spire-server spire charts/spire -f examples/production/values.yaml -f examples/production/values-expose-federation-https-web-ingress-nginx.yaml
|
||||
```
|
||||
|
||||
If you chose profile https_spiffe, use:
|
||||
|
||||
```shell
|
||||
-f examples/production/values-expose-federation-https-spiffe-ingress-nginx.yaml
|
||||
```
|
||||
|
||||
For example:
|
||||
|
||||
```shell
|
||||
helm upgrade --install --namespace spire-server spire charts/spire -f examples/production/values.yaml -f examples/production/values-expose-federation-https-spiffe-ingress-nginx.yaml
|
||||
```
|
||||
|
||||
See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
|
||||
@@ -1,22 +0,0 @@
|
||||
global:
|
||||
spire:
|
||||
clusterName: production
|
||||
trustDomain: production.other
|
||||
|
||||
spire-server:
|
||||
ca_subject:
|
||||
country: US
|
||||
organization: Production
|
||||
common_name: production.other
|
||||
|
||||
# ingress:
|
||||
# host: spire-server
|
||||
# federation:
|
||||
# ingress:
|
||||
# host: spire-server-federation
|
||||
# tlsSecret: tls-cert
|
||||
|
||||
# spiffe-oidc-discovery-provider:
|
||||
# ingress:
|
||||
# host: oidc-discovery
|
||||
# tlsSecret: tls-cert
|
||||
@@ -1,4 +0,0 @@
|
||||
global:
|
||||
spire:
|
||||
recommendations:
|
||||
enabled: true
|
||||
@@ -7,11 +7,11 @@ UPGRADE_REPO=https://spiffe.github.io/helm-charts-hardened
|
||||
|
||||
SCRIPT="$(readlink -f "$0")"
|
||||
SCRIPTPATH="$(dirname "${SCRIPT}")"
|
||||
TESTDIR="${SCRIPTPATH}/../../.github/tests"
|
||||
TESTDIR="${SCRIPTPATH}/../../../.github/tests"
|
||||
DEPS="${TESTDIR}/dependencies"
|
||||
|
||||
# shellcheck source=/dev/null
|
||||
source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
|
||||
source "${SCRIPTPATH}/../../../.github/scripts/parse-versions.sh"
|
||||
# shellcheck source=/dev/null
|
||||
source "${TESTDIR}/common.sh"
|
||||
|
||||
@@ -122,7 +122,7 @@ install_and_test() {
|
||||
# shellcheck disable=SC2086
|
||||
"${helm_install[@]}" spire "$1" \
|
||||
--namespace "${ns}" \
|
||||
--values "${SCRIPTPATH}/values.yaml" \
|
||||
--values "${COMMON_TEST_YOUR_VALUES}" \
|
||||
--values "${SCRIPTPATH}/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml" \
|
||||
--values "${SCRIPTPATH}/values-expose-spire-server-ingress-nginx.yaml" \
|
||||
--values "${SCRIPTPATH}/values-expose-federation-https-web-ingress-nginx.yaml" \
|
||||
@@ -130,8 +130,6 @@ install_and_test() {
|
||||
--set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \
|
||||
--set spire-agent.server.address=spire-server.production.other,spire-agent.server.port=443 \
|
||||
--set spire-server.federation.ingress.tlsSecret=tls-cert,spiffe-oidc-discovery-provider.ingress.tlsSecret=tls-cert \
|
||||
--values "${SCRIPTPATH}/example-your-values.yaml" \
|
||||
$2 \
|
||||
--wait
|
||||
|
||||
helm test --namespace "${ns}" spire
|
||||
Reference in New Issue
Block a user