From 86d6fcac2511090d8ec9b5affae9c9bd81addcf0 Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Mon, 9 Sep 2024 06:36:28 -0700 Subject: [PATCH 01/32] Bump test chart dependencies (#449) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> --- .github/tests/charts.json | 6 +++--- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 4 ++-- charts/spire/charts/spire-server/values.yaml | 4 ++-- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 9 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 9094b79..9d3d922 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "62.3.1" + "version": "62.6.0" }, { "name": "cert-manager", @@ -17,11 +17,11 @@ { "name": "mysql", "repo": "https://charts.bitnami.com/bitnami", - "version": "11.1.15" + "version": "11.1.16" }, { "name": "postgresql", "repo": "https://charts.bitnami.com/bitnami", - "version": "15.5.27" + "version": "15.5.28" } ] diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 772d992..0d3ed44 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -116,11 +116,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5420e15d91112458fc573755954c9174dbf4db8d802c4de3aac18145f5a78a17` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:206d0bd57044a6e9058ec82173a5ae92a64164383066e2aa7519736a011f151c` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index f59b18c..e73a745 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -330,7 +330,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a + tag: latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8 toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -342,7 +342,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:5420e15d91112458fc573755954c9174dbf4db8d802c4de3aac18145f5a78a17 + tag: latest@sha256:206d0bd57044a6e9058ec82173a5ae92a64164383066e2aa7519736a011f151c step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index a662ace..32391f0 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -69,7 +69,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` | @@ -113,12 +113,12 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `Always` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8` | | `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5420e15d91112458fc573755954c9174dbf4db8d802c4de3aac18145f5a78a17` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:206d0bd57044a6e9058ec82173a5ae92a64164383066e2aa7519736a011f151c` | | `hostCert.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index ddca079..c7958ec 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -151,7 +151,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a + tag: latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8 ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -278,7 +278,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a + tag: latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8 ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -293,7 +293,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:5420e15d91112458fc573755954c9174dbf4db8d802c4de3aac18145f5a78a17 + tag: latest@sha256:206d0bd57044a6e9058ec82173a5ae92a64164383066e2aa7519736a011f151c ## @param hostCert.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 836c534..ae0f659 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -416,7 +416,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `chown.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `chown.image.repository` | The repository within the registry | `chainguard/bash` | | `chown.image.pullPolicy` | The image pull policy | `Always` | -| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a` | +| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8` | | `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `experimental.enabled` | Allow configuration of experimental features | `false` | | `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | @@ -429,5 +429,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 19e8f4a..32b1c53 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1052,7 +1052,7 @@ chown: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a + tag: latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8 ## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -1087,7 +1087,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a + tag: latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8 ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 33abe48..7bf3761 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 1607b62..34e5852 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a + tag: latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8 From 98b332b63ebc245d125c75b45825e4e15d89a2a3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 12 Sep 2024 06:48:30 -0700 Subject: [PATCH 02/32] Bump helm.sh/helm/v3 from 3.15.4 to 3.16.0 in /tests (#452) Bumps [helm.sh/helm/v3](https://github.com/helm/helm) from 3.15.4 to 3.16.0. - [Release notes](https://github.com/helm/helm/releases) - [Commits](https://github.com/helm/helm/compare/v3.15.4...v3.16.0) --- updated-dependencies: - dependency-name: helm.sh/helm/v3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- tests/go.mod | 41 ++++++++-------- tests/go.sum | 134 ++++++++++++++++++++------------------------------- 2 files changed, 73 insertions(+), 102 deletions(-) diff --git a/tests/go.mod b/tests/go.mod index b209745..b6cf8d8 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -6,21 +6,23 @@ toolchain go1.22.5 require ( github.com/onsi/ginkgo/v2 v2.20.2 github.com/onsi/gomega v1.34.2 - helm.sh/helm/v3 v3.15.4 + helm.sh/helm/v3 v3.16.0 ) require ( + dario.cat/mergo v1.0.1 // indirect github.com/BurntSushi/toml v1.3.2 // indirect github.com/Masterminds/goutils v1.1.1 // indirect - github.com/Masterminds/semver/v3 v3.2.1 // indirect - github.com/Masterminds/sprig/v3 v3.2.3 // indirect - github.com/cyphar/filepath-securejoin v0.2.4 // indirect - github.com/davecgh/go-spew v1.1.1 // indirect + github.com/Masterminds/semver/v3 v3.3.0 // indirect + github.com/Masterminds/sprig/v3 v3.3.0 // indirect + github.com/cyphar/filepath-securejoin v0.3.1 // indirect + github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/emicklei/go-restful/v3 v3.11.0 // indirect + github.com/fxamacker/cbor/v2 v2.7.0 // indirect github.com/go-logr/logr v1.4.2 // indirect github.com/go-openapi/jsonpointer v0.19.6 // indirect github.com/go-openapi/jsonreference v0.20.2 // indirect - github.com/go-openapi/swag v0.22.3 // indirect + github.com/go-openapi/swag v0.22.4 // indirect github.com/go-task/slim-sprig/v3 v3.0.0 // indirect github.com/gobwas/glob v0.2.3 // indirect github.com/gogo/protobuf v1.3.2 // indirect @@ -29,9 +31,8 @@ require ( github.com/google/go-cmp v0.6.0 // indirect github.com/google/gofuzz v1.2.0 // indirect github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5 // indirect - github.com/google/uuid v1.3.0 // indirect - github.com/huandu/xstrings v1.4.0 // indirect - github.com/imdario/mergo v0.3.13 // indirect + github.com/google/uuid v1.6.0 // indirect + github.com/huandu/xstrings v1.5.0 // indirect github.com/josharian/intern v1.0.0 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/mailru/easyjson v0.7.7 // indirect @@ -41,31 +42,31 @@ require ( github.com/modern-go/reflect2 v1.0.2 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/pkg/errors v0.9.1 // indirect - github.com/shopspring/decimal v1.3.1 // indirect - github.com/spf13/cast v1.5.0 // indirect + github.com/shopspring/decimal v1.4.0 // indirect + github.com/spf13/cast v1.7.0 // indirect + github.com/x448/float16 v0.8.4 // indirect github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect github.com/xeipuuv/gojsonschema v1.2.0 // indirect golang.org/x/crypto v0.26.0 // indirect golang.org/x/net v0.28.0 // indirect - golang.org/x/oauth2 v0.10.0 // indirect + golang.org/x/oauth2 v0.21.0 // indirect golang.org/x/sys v0.24.0 // indirect golang.org/x/term v0.23.0 // indirect golang.org/x/text v0.17.0 // indirect golang.org/x/time v0.3.0 // indirect golang.org/x/tools v0.24.0 // indirect - google.golang.org/appengine v1.6.7 // indirect - google.golang.org/protobuf v1.34.1 // indirect + google.golang.org/protobuf v1.34.2 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect - k8s.io/api v0.30.3 // indirect - k8s.io/apiextensions-apiserver v0.30.3 // indirect - k8s.io/apimachinery v0.30.3 // indirect - k8s.io/client-go v0.30.3 // indirect - k8s.io/klog/v2 v2.120.1 // indirect + k8s.io/api v0.31.0 // indirect + k8s.io/apiextensions-apiserver v0.31.0 // indirect + k8s.io/apimachinery v0.31.0 // indirect + k8s.io/client-go v0.31.0 // indirect + k8s.io/klog/v2 v2.130.1 // indirect k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect - k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect + k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect sigs.k8s.io/yaml v1.4.0 // indirect diff --git a/tests/go.sum b/tests/go.sum index eeab87f..f75620c 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -1,39 +1,41 @@ +dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s= +dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk= github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8= github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ= github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI= github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU= -github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ= -github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0= -github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ= -github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA= -github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM= +github.com/Masterminds/semver/v3 v3.3.0 h1:B8LGeaivUe71a5qox1ICM/JLl0NqZSW5CHyL+hmvYS0= +github.com/Masterminds/semver/v3 v3.3.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= +github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs= +github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= -github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg= -github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4= +github.com/cyphar/filepath-securejoin v0.3.1 h1:1V7cHiaW+C+39wEfpH6XlLBQo3j/PciWFrgfCLS8XrE= +github.com/cyphar/filepath-securejoin v0.3.1/go.mod h1:F7i41x/9cBF7lzCrVsYs9fuzwRZm4NQsGTBdpp6mETc= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g= github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= -github.com/evanphx/json-patch v5.7.0+incompatible h1:vgGkfT/9f8zE6tvSCe74nfpAVDQ2tG6yudJd8LBksgI= -github.com/evanphx/json-patch v5.7.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk= -github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE= -github.com/frankban/quicktest v1.14.3/go.mod h1:mgiwOwqx65TmIk1wJ6Q7wvnVMocbUorkibMOrVTHZps= +github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8= +github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0= +github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E= +github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ= github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY= github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE= github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs= github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE= github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k= -github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g= github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14= +github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU= +github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14= github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI= github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8= github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y= github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8= github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= -github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I= @@ -46,15 +48,10 @@ github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0= github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5 h1:5iH8iuqE5apketRbSFBy+X1V0o+l+8NF1avt4HWl7cA= github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144= -github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I= -github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE= -github.com/huandu/xstrings v1.4.0 h1:D17IlohoQq4UcpqD7fDk80P7l+lwAmlFaBHgOipl2FU= -github.com/huandu/xstrings v1.4.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE= -github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA= -github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk= -github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg= +github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= +github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI= +github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE= github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY= github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y= github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= @@ -70,10 +67,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0= github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc= -github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw= github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw= github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s= -github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw= github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ= github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw= github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= @@ -89,29 +84,28 @@ github.com/onsi/gomega v1.34.2 h1:pNCwDkzrsv7MS9kpaQvVb1aVLahQXyJ/Tv5oAZMI3i8= github.com/onsi/gomega v1.34.2/go.mod h1:v1xfxRgk0KIsG+QOdm7p8UosrOzPYRo60fd3B/1Dukc= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= -github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ= -github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog= -github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o= -github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8= -github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o= -github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE= -github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w= -github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8= +github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4= +github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k= +github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME= +github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w= +github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo= github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= -github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= -github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= -github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk= -github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= +github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg= +github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= +github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= +github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU= github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo= github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU= @@ -121,53 +115,33 @@ github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y= github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= -github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= -golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4= golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw= golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= -golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= -golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= -golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= -golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY= golang.org/x/net v0.28.0 h1:a9JDOJc5GMUJ0+UDqmLT86WiEy7iWyIhz8gz8E4e5hE= golang.org/x/net v0.28.0/go.mod h1:yqtgsTWOOnlGLG9GFRrK3++bGOUEkNBoHZc8MEDWPNg= -golang.org/x/oauth2 v0.10.0 h1:zHCpF2Khkwy4mMB4bv0U37YtJdTGW8jI0glAApi0Kh8= -golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI= +golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs= +golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg= golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= -golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc= golang.org/x/term v0.23.0 h1:F6D4vR+EHoL9/sWAWgAR1H2DcHr4PareCbAaCo1RpuU= golang.org/x/term v0.23.0/go.mod h1:DgV24QBUrK6jhZXl+20l6UWznPlwAHm1Q1mGHtydmSk= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= -golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= -golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc= golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY= golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4= @@ -176,47 +150,43 @@ golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGm golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.24.0 h1:J1shsA93PJUEVaUSaay7UXAyE8aimq3GW0pjlolpa24= golang.org/x/tools v0.24.0/go.mod h1:YhNqVBIfWHdzvTLs0d8LCuMhkKUgSUKldakyV7W/WDQ= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c= -google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= -google.golang.org/protobuf v1.34.1 h1:9ddQBjfCyZPOHPUiPxpYESBLc+T8P3E+Vo4IbKZgFWg= -google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos= +google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg= +google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= +gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4= +gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M= gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc= gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw= -gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= -gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -helm.sh/helm/v3 v3.15.4 h1:UFHd6oZ1IN3FsUZ7XNhOQDyQ2QYknBNWRHH57e9cbHY= -helm.sh/helm/v3 v3.15.4/go.mod h1:phOwlxqGSgppCY/ysWBNRhG3MtnpsttOzxaTK+Mt40E= -k8s.io/api v0.30.3 h1:ImHwK9DCsPA9uoU3rVh4QHAHHK5dTSv1nxJUapx8hoQ= -k8s.io/api v0.30.3/go.mod h1:GPc8jlzoe5JG3pb0KJCSLX5oAFIW3/qNJITlDj8BH04= -k8s.io/apiextensions-apiserver v0.30.3 h1:oChu5li2vsZHx2IvnGP3ah8Nj3KyqG3kRSaKmijhB9U= -k8s.io/apiextensions-apiserver v0.30.3/go.mod h1:uhXxYDkMAvl6CJw4lrDN4CPbONkF3+XL9cacCT44kV4= -k8s.io/apimachinery v0.30.3 h1:q1laaWCmrszyQuSQCfNB8cFgCuDAoPszKY4ucAjDwHc= -k8s.io/apimachinery v0.30.3/go.mod h1:iexa2somDaxdnj7bha06bhb43Zpa6eWH8N8dbqVjTUc= -k8s.io/client-go v0.30.3 h1:bHrJu3xQZNXIi8/MoxYtZBBWQQXwy16zqJwloXXfD3k= -k8s.io/client-go v0.30.3/go.mod h1:8d4pf8vYu665/kUbsxWAQ/JDBNWqfFeZnvFiVdmx89U= -k8s.io/klog/v2 v2.120.1 h1:QXU6cPEOIslTGvZaXvFWiP9VKyeet3sawzTOvdXb4Vw= -k8s.io/klog/v2 v2.120.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE= +helm.sh/helm/v3 v3.16.0 h1:Si2uwaRq3nxT/EiR4U1sWJE2dysLKQgsrd0agL3dsH0= +helm.sh/helm/v3 v3.16.0/go.mod h1:r+xBHHP20qJeEqtvBXMf7W35QDJnzY/eiEBzt+TfHps= +k8s.io/api v0.31.0 h1:b9LiSjR2ym/SzTOlfMHm1tr7/21aD7fSkqgD/CVJBCo= +k8s.io/api v0.31.0/go.mod h1:0YiFF+JfFxMM6+1hQei8FY8M7s1Mth+z/q7eF1aJkTE= +k8s.io/apiextensions-apiserver v0.31.0 h1:fZgCVhGwsclj3qCw1buVXCV6khjRzKC5eCFt24kyLSk= +k8s.io/apiextensions-apiserver v0.31.0/go.mod h1:b9aMDEYaEe5sdK+1T0KU78ApR/5ZVp4i56VacZYEHxk= +k8s.io/apimachinery v0.31.0 h1:m9jOiSr3FoSSL5WO9bjm1n6B9KROYYgNZOb4tyZ1lBc= +k8s.io/apimachinery v0.31.0/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo= +k8s.io/client-go v0.31.0 h1:QqEJzNjbN2Yv1H79SsS+SWnXkBgVu4Pj3CJQgbx0gI8= +k8s.io/client-go v0.31.0/go.mod h1:Y9wvC76g4fLjmU0BA+rV+h2cncoadjvjjkkIGoTLcGU= +k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk= +k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE= k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 h1:BZqlfIlq5YbRMFko6/PM7FjZpUb45WallggurYhKGag= k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340/go.mod h1:yD4MZYeKMBwQKVht279WycxKyM84kkAx2DPrTXaeb98= -k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI= -k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= +k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A= +k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo= sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0= sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4= From 3bc70255e7aba204dfb22fe84fce598500b67131 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 12 Sep 2024 09:49:14 -0700 Subject: [PATCH 03/32] Update spiffe-helper (#453) * Update spiffe-helper Signed-off-by: Kevin Fox * Update .github/tests/images.json Signed-off-by: kfox1111 --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 --- .github/tests/images.json | 5 + .../spiffe-oidc-discovery-provider/README.md | 224 +++++++++--------- .../templates/deployment.yaml | 2 +- .../values.yaml | 2 +- examples/mysql-using-spire/mysql-values.yaml | 6 +- .../mysqlclient-statefulset.yaml | 6 +- 6 files changed, 125 insertions(+), 120 deletions(-) diff --git a/.github/tests/images.json b/.github/tests/images.json index bd564c5..9cdb449 100644 --- a/.github/tests/images.json +++ b/.github/tests/images.json @@ -63,6 +63,11 @@ "query": "tests.busybox.image", "filter": "^[0-9]\\+\\.[0-9]\\+\\.[0-9]\\+-uclibc$", "sort-flags": ["-t", ".", "-k1,1n", "-k2,2n", "-k3,3n"] + }, + { + "query": "spiffeHelper.image", + "filter": "LATESTSHA", + "sort-flags": [] } ], "tornjak-frontend/values.yaml": [ diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 0d3ed44..3e25760 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -25,115 +25,115 @@ A Helm chart to install the SPIFFE OIDC discovery provider. ### Chart parameters -| Name | Description | Value | -| ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | -| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | -| `csiDriverName` | The csi driver to use | `csi.spiffe.io` | -| `replicaCount` | Replica count | `1` | -| `namespaceOverride` | Namespace override | `""` | -| `annotations` | Annotations for the deployment | `{}` | -| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `image.repository` | The repository within the registry | `spiffe/oidc-discovery-provider` | -| `image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `spiffeHelper.image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `spiffeHelper.image.repository` | The repository within the registry | `spiffe/spiffe-helper` | -| `spiffeHelper.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `spiffeHelper.image.tag` | Overrides the image tag whose default is the chart appVersion | `nightly@sha256:8cee346ffdcee5c996d394f1c3bb761c2c06834a0e779a78db6dc6a46fd13ae6` | -| `spiffeHelper.resources` | Resource requests and limits | `{}` | -| `resources` | Resource requests and limits | `{}` | -| `service.type` | Service type | `ClusterIP` | -| `service.ports.http` | Insecure port for the service | `80` | -| `service.ports.https` | Secure port for the service | `443` | -| `service.annotations` | Annotations for service resource | `{}` | -| `configMap.annotations` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | `{}` | -| `podSecurityContext` | Pod security context for OIDC discovery provider pods | `{}` | -| `securityContext` | Security context for OIDC discovery provider deployment | `{}` | -| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | -| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | -| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | -| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | -| `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` | -| `tls.spire.enabled` | Use spire to secure the oidc-discovery-provider | `true` | -| `tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` | -| `tls.externalSecret.secretName` | Specify which Secret to use | `""` | -| `tls.certManager.enabled` | Use certificateManager to create the certificate | `false` | -| `tls.certManager.issuer.create` | Create an issuer to use to issue the certificate | `true` | -| `tls.certManager.issuer.acme.email` | Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service | `""` | -| `tls.certManager.issuer.acme.server` | Server to use to get certificate. Defaults to LetsEncrypt | `https://acme-v02.api.letsencrypt.org/directory` | -| `tls.certManager.issuer.acme.solvers` | Configure the issuer solvers. Defaults to http01 via ingress. | `{}` | -| `tls.certManager.certificate.dnsNames` | Override the dnsNames on the certificate request. Defaults to the same settings as Ingress | `[]` | -| `tls.certManager.certificate.issuerRef.group` | If you are using an external plugin, specify the group for it here | `""` | -| `tls.certManager.certificate.issuerRef.kind` | Kind of the issuer reference. Override if you want to use a ClusterIssuer | `Issuer` | -| `tls.certManager.certificate.issuerRef.name` | Name of the issuer to use. If unset, it will use the name of the built in issuer | `""` | -| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from. Only used when TLS is disabled. | `docker.io` | -| `insecureScheme.nginx.image.repository` | The repository within the registry. Only used when TLS is disabled. | `nginxinc/nginx-unprivileged` | -| `insecureScheme.nginx.image.pullPolicy` | The image pull policy. Only used when TLS is disabled. | `IfNotPresent` | -| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.27.1-alpine` | -| `insecureScheme.nginx.ipMode` | IP modes supported by the cluster. Must be one of [ipv4, ipv6, both] | `both` | -| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | -| `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` | -| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | -| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` | -| `imagePullSecrets` | Image pull secret names | `[]` | -| `nameOverride` | Name override | `""` | -| `fullnameOverride` | Full name override | `""` | -| `serviceAccount.create` | Specifies whether a service account should be created | `true` | -| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | -| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | -| `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | -| `autoscaling.enabled` | Flag to enable autoscaling | `false` | -| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` | -| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` | -| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` | -| `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` | -| `nodeSelector` | Node selector | `{}` | -| `tolerations` | iist of tolerations | `[]` | -| `affinity` | Node affinity | `{}` | -| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | -| `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` | -| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | -| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | -| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | -| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the helm release | `""` | -| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | -| `telemetry.prometheus.nginxExporter.image.registry` | The OCI registry to pull the image from | `docker.io` | -| `telemetry.prometheus.nginxExporter.image.repository` | The repository within the registry | `nginx/nginx-prometheus-exporter` | -| `telemetry.prometheus.nginxExporter.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `telemetry.prometheus.nginxExporter.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.3.0` | -| `telemetry.prometheus.nginxExporter.resources` | Resource requests and limits | `{}` | -| `ingress.enabled` | Flag to enable ingress | `false` | -| `ingress.className` | Ingress class name | `""` | -| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | -| `ingress.annotations` | Annotations for ingress object | `{}` | -| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `oidc-discovery` | -| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | -| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | -| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | -| `tests.hostAliases` | List of host aliases for testing | `[]` | -| `tests.tls.enabled` | Flag for enabling tls for tests | `false` | -| `tests.tls.customCA` | Custom CA value for tests | `""` | -| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | -| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8` | -| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | -| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:206d0bd57044a6e9058ec82173a5ae92a64164383066e2aa7519736a011f151c` | -| `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | -| `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | -| `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.step.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.27.2` | -| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` | -| `tests.busybox.image.repository` | The repository within the registry | `busybox` | -| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` | -| `tests.agent.image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `tests.agent.image.repository` | The repository within the registry | `spiffe/spire-agent` | -| `tests.agent.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.agent.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | -| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | -| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| Name | Description | Value | +| ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | +| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | +| `csiDriverName` | The csi driver to use | `csi.spiffe.io` | +| `replicaCount` | Replica count | `1` | +| `namespaceOverride` | Namespace override | `""` | +| `annotations` | Annotations for the deployment | `{}` | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/oidc-discovery-provider` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `spiffeHelper.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `spiffeHelper.image.repository` | The repository within the registry | `spiffe/spiffe-helper` | +| `spiffeHelper.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `spiffeHelper.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.8.0` | +| `spiffeHelper.resources` | Resource requests and limits | `{}` | +| `resources` | Resource requests and limits | `{}` | +| `service.type` | Service type | `ClusterIP` | +| `service.ports.http` | Insecure port for the service | `80` | +| `service.ports.https` | Secure port for the service | `443` | +| `service.annotations` | Annotations for service resource | `{}` | +| `configMap.annotations` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | `{}` | +| `podSecurityContext` | Pod security context for OIDC discovery provider pods | `{}` | +| `securityContext` | Security context for OIDC discovery provider deployment | `{}` | +| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | +| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | +| `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` | +| `tls.spire.enabled` | Use spire to secure the oidc-discovery-provider | `true` | +| `tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` | +| `tls.externalSecret.secretName` | Specify which Secret to use | `""` | +| `tls.certManager.enabled` | Use certificateManager to create the certificate | `false` | +| `tls.certManager.issuer.create` | Create an issuer to use to issue the certificate | `true` | +| `tls.certManager.issuer.acme.email` | Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service | `""` | +| `tls.certManager.issuer.acme.server` | Server to use to get certificate. Defaults to LetsEncrypt | `https://acme-v02.api.letsencrypt.org/directory` | +| `tls.certManager.issuer.acme.solvers` | Configure the issuer solvers. Defaults to http01 via ingress. | `{}` | +| `tls.certManager.certificate.dnsNames` | Override the dnsNames on the certificate request. Defaults to the same settings as Ingress | `[]` | +| `tls.certManager.certificate.issuerRef.group` | If you are using an external plugin, specify the group for it here | `""` | +| `tls.certManager.certificate.issuerRef.kind` | Kind of the issuer reference. Override if you want to use a ClusterIssuer | `Issuer` | +| `tls.certManager.certificate.issuerRef.name` | Name of the issuer to use. If unset, it will use the name of the built in issuer | `""` | +| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from. Only used when TLS is disabled. | `docker.io` | +| `insecureScheme.nginx.image.repository` | The repository within the registry. Only used when TLS is disabled. | `nginxinc/nginx-unprivileged` | +| `insecureScheme.nginx.image.pullPolicy` | The image pull policy. Only used when TLS is disabled. | `IfNotPresent` | +| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.27.1-alpine` | +| `insecureScheme.nginx.ipMode` | IP modes supported by the cluster. Must be one of [ipv4, ipv6, both] | `both` | +| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | +| `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` | +| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | +| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` | +| `imagePullSecrets` | Image pull secret names | `[]` | +| `nameOverride` | Name override | `""` | +| `fullnameOverride` | Full name override | `""` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | +| `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | +| `autoscaling.enabled` | Flag to enable autoscaling | `false` | +| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` | +| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` | +| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` | +| `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` | +| `nodeSelector` | Node selector | `{}` | +| `tolerations` | iist of tolerations | `[]` | +| `affinity` | Node affinity | `{}` | +| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | +| `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` | +| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | +| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | +| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | +| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the helm release | `""` | +| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | +| `telemetry.prometheus.nginxExporter.image.registry` | The OCI registry to pull the image from | `docker.io` | +| `telemetry.prometheus.nginxExporter.image.repository` | The repository within the registry | `nginx/nginx-prometheus-exporter` | +| `telemetry.prometheus.nginxExporter.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `telemetry.prometheus.nginxExporter.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.3.0` | +| `telemetry.prometheus.nginxExporter.resources` | Resource requests and limits | `{}` | +| `ingress.enabled` | Flag to enable ingress | `false` | +| `ingress.className` | Ingress class name | `""` | +| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | +| `ingress.annotations` | Annotations for ingress object | `{}` | +| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `oidc-discovery` | +| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | +| `tests.hostAliases` | List of host aliases for testing | `[]` | +| `tests.tls.enabled` | Flag for enabling tls for tests | `false` | +| `tests.tls.customCA` | Custom CA value for tests | `""` | +| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | +| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8` | +| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | +| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:206d0bd57044a6e9058ec82173a5ae92a64164383066e2aa7519736a011f151c` | +| `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | +| `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | +| `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.step.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.27.2` | +| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` | +| `tests.busybox.image.repository` | The repository within the registry | `busybox` | +| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` | +| `tests.agent.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `tests.agent.image.repository` | The repository within the registry | `spiffe/spire-agent` | +| `tests.agent.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.agent.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | +| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | +| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml index 3e99bb2..0d1a828 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -50,7 +50,7 @@ spec: args: - -config - /etc/spiffe-helper.conf - - -exitWhenReady + - -daemon-mode=false volumeMounts: - name: spiffe-workload-api mountPath: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | dir }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index e73a745..a64ec51 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -41,7 +41,7 @@ spiffeHelper: registry: ghcr.io repository: spiffe/spiffe-helper pullPolicy: IfNotPresent - tag: nightly@sha256:8cee346ffdcee5c996d394f1c3bb761c2c06834a0e779a78db6dc6a46fd13ae6 + tag: 0.8.0 ## @param spiffeHelper.resources [object] Resource requests and limits resources: {} diff --git a/examples/mysql-using-spire/mysql-values.yaml b/examples/mysql-using-spire/mysql-values.yaml index ccf0059..57ecbf9 100644 --- a/examples/mysql-using-spire/mysql-values.yaml +++ b/examples/mysql-using-spire/mysql-values.yaml @@ -19,7 +19,7 @@ primary: - name: spiffe-helper mountPath: /helper - name: setup-helper-volume-p2 - image: ghcr.io/spiffe/spiffe-helper:nightly@sha256:8cee346ffdcee5c996d394f1c3bb761c2c06834a0e779a78db6dc6a46fd13ae6 + image: ghcr.io/spiffe/spiffe-helper:0.8.0 imagePullPolicy: IfNotPresent command: - /helper/busybox @@ -31,13 +31,13 @@ primary: - name: spiffe-helper mountPath: /helper - name: init-tls - image: ghcr.io/spiffe/spiffe-helper:nightly@sha256:8cee346ffdcee5c996d394f1c3bb761c2c06834a0e779a78db6dc6a46fd13ae6 + image: ghcr.io/spiffe/spiffe-helper:0.8.0 imagePullPolicy: Always command: - /spiffe-helper - -config - /etc/spiffe-helper.conf - - -exitWhenReady + - -daemon-mode=false securityContext: {{- omit .Values.primary.containerSecurityContext "enabled" | toYaml | nindent 8 }} volumeMounts: - name: spiffe-workload-api diff --git a/examples/mysql-using-spire/mysqlclient-statefulset.yaml b/examples/mysql-using-spire/mysqlclient-statefulset.yaml index 71d9931..3132580 100644 --- a/examples/mysql-using-spire/mysqlclient-statefulset.yaml +++ b/examples/mysql-using-spire/mysqlclient-statefulset.yaml @@ -16,13 +16,13 @@ spec: terminationGracePeriodSeconds: 0 initContainers: - name: init-tls - image: ghcr.io/spiffe/spiffe-helper:nightly@sha256:8cee346ffdcee5c996d394f1c3bb761c2c06834a0e779a78db6dc6a46fd13ae6 + image: ghcr.io/spiffe/spiffe-helper:0.8.0 imagePullPolicy: Always command: - /spiffe-helper - -config - /etc/spiffe-helper.conf - - -exitWhenReady + - -daemon-mode=false securityContext: runAsUser: 1001 runAsGroup: 1001 @@ -47,7 +47,7 @@ spec: - name: certdir mountPath: /certs - name: refresh-tls - image: ghcr.io/spiffe/spiffe-helper:nightly@sha256:8cee346ffdcee5c996d394f1c3bb761c2c06834a0e779a78db6dc6a46fd13ae6 + image: ghcr.io/spiffe/spiffe-helper:0.8.0 imagePullPolicy: Always command: - /spiffe-helper From ea710023f462836b3ce582991a6b5091d7c2ab5c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 14 Sep 2024 04:38:50 -0700 Subject: [PATCH 04/32] Bump helm.sh/helm/v3 from 3.16.0 to 3.16.1 in /tests (#456) Bumps [helm.sh/helm/v3](https://github.com/helm/helm) from 3.16.0 to 3.16.1. - [Release notes](https://github.com/helm/helm/releases) - [Commits](https://github.com/helm/helm/compare/v3.16.0...v3.16.1) --- updated-dependencies: - dependency-name: helm.sh/helm/v3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- tests/go.mod | 2 +- tests/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/go.mod b/tests/go.mod index b6cf8d8..16e0ac6 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -6,7 +6,7 @@ toolchain go1.22.5 require ( github.com/onsi/ginkgo/v2 v2.20.2 github.com/onsi/gomega v1.34.2 - helm.sh/helm/v3 v3.16.0 + helm.sh/helm/v3 v3.16.1 ) require ( diff --git a/tests/go.sum b/tests/go.sum index f75620c..3d91cb1 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -171,8 +171,8 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -helm.sh/helm/v3 v3.16.0 h1:Si2uwaRq3nxT/EiR4U1sWJE2dysLKQgsrd0agL3dsH0= -helm.sh/helm/v3 v3.16.0/go.mod h1:r+xBHHP20qJeEqtvBXMf7W35QDJnzY/eiEBzt+TfHps= +helm.sh/helm/v3 v3.16.1 h1:cER6tI/8PgUAsaJaQCVBUg3VI9KN4oVaZJgY60RIc0c= +helm.sh/helm/v3 v3.16.1/go.mod h1:r+xBHHP20qJeEqtvBXMf7W35QDJnzY/eiEBzt+TfHps= k8s.io/api v0.31.0 h1:b9LiSjR2ym/SzTOlfMHm1tr7/21aD7fSkqgD/CVJBCo= k8s.io/api v0.31.0/go.mod h1:0YiFF+JfFxMM6+1hQei8FY8M7s1Mth+z/q7eF1aJkTE= k8s.io/apiextensions-apiserver v0.31.0 h1:fZgCVhGwsclj3qCw1buVXCV6khjRzKC5eCFt24kyLSk= From 8832da39b4549c942785255730fe030fad4d81ef Mon Sep 17 00:00:00 2001 From: nweisenauer <137267159+nweisenauer-sap@users.noreply.github.com> Date: Mon, 16 Sep 2024 15:23:01 +0200 Subject: [PATCH 05/32] Protects SPIRE Agent's Chart Against YAML Template Injection (#450) * protects agent's chart against template injection Signed-off-by: Nico Weisenauer <137267159+nweisenauer-sap@users.noreply.github.com> * removes unnecessary braces and whitespace Signed-off-by: Nico Weisenauer <137267159+nweisenauer-sap@users.noreply.github.com> * Removes int type validation via cast Signed-off-by: Nico Weisenauer <137267159+nweisenauer-sap@users.noreply.github.com> --------- Signed-off-by: Nico Weisenauer <137267159+nweisenauer-sap@users.noreply.github.com> --- .../charts/spire-agent/templates/_helpers.tpl | 8 +-- .../spire-agent/templates/configmap.yaml | 14 ++--- .../spire-agent/templates/daemonset.yaml | 58 +++++++++++-------- .../spire-agent/templates/podmonitor.yaml | 4 +- .../charts/spire-agent/templates/roles.yaml | 10 ++-- .../templates/scc-spire-agent.yaml | 4 +- .../spire-agent/templates/serviceaccount.yaml | 4 +- .../charts/spire-lib/templates/_helpers.tpl | 12 ++-- 8 files changed, 61 insertions(+), 53 deletions(-) diff --git a/charts/spire/charts/spire-agent/templates/_helpers.tpl b/charts/spire/charts/spire-agent/templates/_helpers.tpl index fe77147..34e6b08 100644 --- a/charts/spire/charts/spire-agent/templates/_helpers.tpl +++ b/charts/spire/charts/spire-agent/templates/_helpers.tpl @@ -75,20 +75,20 @@ Create chart name and version as used by the chart label. Common labels */}} {{- define "spire-agent.labels" -}} -helm.sh/chart: {{ include "spire-agent.chart" . }} +helm.sh/chart: {{ include "spire-agent.chart" . | quote }} {{ include "spire-agent.selectorLabels" . }} {{- if .Chart.AppVersion }} app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} {{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} +app.kubernetes.io/managed-by: {{ .Release.Service | quote }} {{- end }} {{/* Selector labels */}} {{- define "spire-agent.selectorLabels" -}} -app.kubernetes.io/name: {{ include "spire-agent.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/name: {{ include "spire-agent.name" . | quote }} +app.kubernetes.io/instance: {{ .Release.Name | quote }} {{- end }} {{/* diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index d659ce7..d46c6b7 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -53,7 +53,7 @@ agent: default_svid_name: {{ .Values.sds.defaultSvidName | quote }} default_bundle_name: {{ .Values.sds.defaultBundleName | quote }} default_all_bundles_name: {{ .Values.sds.defaultAllBundlesName | quote }} - disable_spiffe_cert_validation: {{ .Values.sds.disableSpiffeCertValidation }} + disable_spiffe_cert_validation: {{ eq .Values.sds.disableSpiffeCertValidation true }} {{- end }} {{- with .Values.experimental }} @@ -97,7 +97,7 @@ plugins: {{- if eq (.enabled | toString) "true" }} tpm: plugin_cmd: "/tpm/tpm_attestor_agent" - plugin_checksum: {{ .plugin.checksum }} + plugin_checksum: {{ .plugin.checksum | quote }} plugin_data: {} {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} {{- end }} @@ -126,9 +126,9 @@ plugins: kubelet_ca_path: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt {{- end }} skip_kubelet_verification: {{ eq .Values.workloadAttestors.k8s.verification.type "skip" }} - disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }} - use_new_container_locator: {{ .Values.workloadAttestors.k8s.useNewContainerLocator }} - verbose_container_locator_logs: {{ .Values.workloadAttestors.k8s.verboseContainerLocatorLogs }} + disable_container_selectors: {{ eq .Values.workloadAttestors.k8s.disableContainerSelectors true}} + use_new_container_locator: {{ eq .Values.workloadAttestors.k8s.useNewContainerLocator true }} + verbose_container_locator_logs: {{ eq .Values.workloadAttestors.k8s.verboseContainerLocatorLogs true }} {{- if eq (include "spire-agent.connect-by-hostname" .) "true" }} node_name_env: "MY_NODE_NAME" {{- end }} @@ -168,8 +168,8 @@ telemetry: apiVersion: v1 kind: ConfigMap metadata: - name: {{ include "spire-agent.fullname" . }}{{ $nameSuffix }} - namespace: {{ include "spire-agent.namespace" . }} + name: {{ printf "%s%s" (include "spire-agent.fullname" .) $nameSuffix | quote }} + namespace: {{ include "spire-agent.namespace" . | quote }} {{- with .Values.configMap.annotations }} annotations: {{- toYaml . | nindent 4 }} diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 3bec7b0..c242127 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -22,16 +22,16 @@ apiVersion: apps/v1 kind: DaemonSet metadata: - name: {{ include "spire-agent.fullname" . }}{{ $nameSuffix }} - namespace: {{ include "spire-agent.namespace" . }} + name: {{ printf "%s%s" (include "spire-agent.fullname" .) $nameSuffix | quote }} + namespace: {{ include "spire-agent.namespace" . | quote}} labels: {{- include "spire-agent.labels" . | nindent 4 }} - app.kubernetes.io/component: {{ $name }} + app.kubernetes.io/component: {{ $name | quote }} spec: selector: matchLabels: {{- include "spire-agent.selectorLabels" . | nindent 6 }} - app.kubernetes.io/component: {{ $name }} + app.kubernetes.io/component: {{ $name | quote }} {{- with .Values.updateStrategy }} updateStrategy: {{- if not (has .type (list "RollingUpdate" "OnDelete")) }} @@ -47,13 +47,13 @@ spec: metadata: annotations: kubectl.kubernetes.io/default-container: spire-agent - checksum/config: {{ $configSum }} + checksum/config: {{ $configSum | quote }} {{- with .Values.podAnnotations }} {{- toYaml . | nindent 8 }} {{- end }} labels: {{- include "spire-agent.selectorLabels" . | nindent 8 }} - app.kubernetes.io/component: {{ $name }} + app.kubernetes.io/component: {{ $name | quote }} {{- with .Values.podLabels }} {{- toYaml . | nindent 8 }} {{- end }} @@ -65,7 +65,7 @@ spec: hostPID: true hostNetwork: true dnsPolicy: ClusterFirstWithHostNet - serviceAccountName: {{ include "spire-agent.serviceAccountName" . }} + serviceAccountName: {{ include "spire-agent.serviceAccountName" . | quote }} securityContext: {{- toYaml $podSecurityContext | nindent 8 }} {{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }} @@ -79,17 +79,17 @@ spec: securityContext: {{- $mainSecurityContext | toYaml | nindent 12 }} image: {{ template "spire-lib.image" (dict "image" .Values.hostCert.image "global" .Values.global) }} - imagePullPolicy: {{ .Values.hostCert.image.pullPolicy }} + imagePullPolicy: {{ .Values.hostCert.image.pullPolicy | quote }} command: ["bash", "-xc"] args: - | {{- if ne .Values.workloadAttestors.k8s.verification.hostCert.fileName "" }} - openssl x509 -in "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/{{ .Values.workloadAttestors.k8s.verification.hostCert.fileName }}" -out /hostCert/kubelet.crt + openssl x509 -in {{ printf "%s/%s" .Values.workloadAttestors.k8s.verification.hostCert.basePath .Values.workloadAttestors.k8s.verification.hostCert.fileName | quote }} -out /hostCert/kubelet.crt {{- else }} if [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet-server-current.pem" ]; then - openssl x509 -in "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet-server-current.pem" -out /hostCert/kubelet.crt + openssl x509 -in {{ printf "%s/kubelet-server-current.pem" .Values.workloadAttestors.k8s.verification.hostCert.basePath | quote }} -out /hostCert/kubelet.crt elif [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" ]; then - openssl x509 -in "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" -out /hostCert/kubelet.crt + openssl x509 -in {{ printf "%s/kubelet.crt" .Values.workloadAttestors.k8s.verification.hostCert.basePath | quote }} -out /hostCert/kubelet.crt else {{- if eq .Values.workloadAttestors.k8s.verification.type "auto" }} {{- if $cbh }} @@ -150,7 +150,7 @@ spec: readOnly: true - name: kmsg mountPath: /dev/kmsg - imagePullPolicy: {{ .Values.nodeAttestor.tpmDirect.pubHash.image.pullPolicy }} + imagePullPolicy: {{ .Values.nodeAttestor.tpmDirect.pubHash.image.pullPolicy | quote }} {{- end }} - name: init-tpm-direct securityContext: @@ -161,16 +161,16 @@ spec: - -ec - | # SPIRE must be able to fork the plugin directly within its container. Copy the plugin into a volume that can be mounted where SPIRE can execute it. - cp -a {{ .Values.nodeAttestor.tpmDirect.plugin.path }} /tpm/tpm_attestor_agent + cp -a {{ .Values.nodeAttestor.tpmDirect.plugin.path | quote }} /tpm/tpm_attestor_agent volumeMounts: - name: tpm-direct mountPath: /tpm - imagePullPolicy: {{ .Values.nodeAttestor.tpmDirect.plugin.image.pullPolicy }} + imagePullPolicy: {{ .Values.nodeAttestor.tpmDirect.plugin.image.pullPolicy | quote }} {{- end }} {{- if gt (len $socketAlternateNames) 0 }} - name: ensure-alternate-names image: {{ template "spire-lib.image" (dict "image" .Values.socketAlternate.image "global" .Values.global) }} - imagePullPolicy: {{ .Values.socketAlternate.image.pullPolicy }} + imagePullPolicy: {{ .Values.socketAlternate.image.pullPolicy | quote }} command: ["bash", "-xc"] {{- /* 1. Look for symlinks pointing at the wrong place and remove them. 2. Make symlinks that don't exist. 3. If new socket is pointing at an existing symlink, remove old symlink. */}} args: @@ -178,7 +178,7 @@ spec: cd {{ $socketPath | dir }} {{- range $socketAlternateNames }} L=`readlink {{ . }}` - [ "x$L" != "x{{ $socketPath | base}}" ] && rm -f {{ . }} + [ "x$L" != "x{{ $socketPath | base }}" ] && rm -f {{ . }} [ ! -L {{ . }} ] && ln -s {{ $socketPath | base }} {{ . }} {{- end }} [ -L {{ $socketPath | base }} ] && rm -f {{ $socketPath | base }} @@ -195,12 +195,12 @@ spec: {{- if gt (int (dig "fsGroup" 0 $podSecurityContext)) 0 }} - name: fsgroupfix image: {{ template "spire-lib.image" (dict "image" .Values.fsGroupFix.image "global" .Values.global) }} - imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy }} + imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy | quote }} command: ["bash", "-c"] args: - | - chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ $socketPath | dir }} /tmp/spire-agent/private - chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} /var/lib/spire + chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} {{ $socketPath | dir }} /tmp/spire-agent/private + chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} /var/lib/spire resources: {{- toYaml .Values.fsGroupFix.resources | nindent 12 }} volumeMounts: @@ -218,9 +218,9 @@ spec: {{- toYaml .Values.initContainers | nindent 8 }} {{- end }} containers: - - name: {{ .Chart.Name }} + - name: {{ .Chart.Name | quote }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} - imagePullPolicy: {{ .Values.image.pullPolicy }} + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} args: ["-config", "/opt/spire/conf/agent/agent.conf"] securityContext: {{- $mainSecurityContext | toYaml | nindent 12 }} @@ -314,7 +314,11 @@ spec: {{- if .Values.sockets.admin.mountOnHost }} - name: spire-agent-admin-socket-dir hostPath: - path: {{ .Values.sockets.hostBasePath }}/{{ if .Values.upstream }}upstream.csi.spiffe.io{{ else }}csi.spiffe.io{{ end }}/admin + {{- if .Values.upstream }} + path: {{ printf "%s/upstream.csi.spiffe.io/admin" .Values.sockets.hostBasePath | quote }} + {{- else }} + path: {{ printf "%s/csi.spiffe.io/admin" .Values.sockets.hostBasePath | quote }} + {{- end }} type: DirectoryOrCreate {{- else }} - name: spire-agent-admin-socket-dir @@ -323,7 +327,11 @@ spec: {{- if eq .Values.persistence.type "hostPath" }} - name: spire-agent-persistence hostPath: - path: {{ .Values.persistence.hostPath }}/{{ if .Values.upstream }}upstream.csi.spiffe.io{{ else }}csi.spiffe.io{{ end }} + {{- if .Values.upstream }} + path: {{ printf "%s/upstream.csi.spiffe.io" .Values.persistence.hostPath | quote }} + {{- else }} + path: {{ printf "%s/csi.spiffe.io" .Values.persistence.hostPath | quote }} + {{- end }} type: DirectoryOrCreate {{- else }} - name: spire-agent-persistence @@ -332,7 +340,7 @@ spec: {{- if eq (len .Values.trustBundleURL) 0 }} - name: spire-bundle configMap: - name: {{ include "spire-lib.bundle-configmap" . }}{{ $nameSuffix }} + name: {{ printf "%s%s" (include "spire-lib.bundle-configmap" .) $nameSuffix | quote }} {{- end }} {{- if .Values.nodeAttestor.tpmDirect.enabled }} - name: tpm-direct @@ -364,7 +372,7 @@ spec: emptyDir: {} - name: host-cert hostPath: - path: {{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }} + path: {{ .Values.workloadAttestors.k8s.verification.hostCert.basePath | quote }} {{- end }} {{- if gt (len .Values.extraVolumes) 0 }} {{- toYaml .Values.extraVolumes | nindent 8 }} diff --git a/charts/spire/charts/spire-agent/templates/podmonitor.yaml b/charts/spire/charts/spire-agent/templates/podmonitor.yaml index 409bfb3..a800128 100644 --- a/charts/spire/charts/spire-agent/templates/podmonitor.yaml +++ b/charts/spire/charts/spire-agent/templates/podmonitor.yaml @@ -5,7 +5,7 @@ apiVersion: monitoring.coreos.com/v1 kind: PodMonitor metadata: name: {{ include "spire-agent.fullname" . }} - namespace: {{ $namespace }} + namespace: {{ $namespace | quote }} labels: {{- include "spire-agent.labels" . | nindent 4 }} {{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }} @@ -22,6 +22,6 @@ spec: - port: prom {{- if ne $namespace $podNamespace }} namespaceSelector: - kubernetes.io/metadata.name: {{ $podNamespace }} + kubernetes.io/metadata.name: {{ $podNamespace | quote }} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-agent/templates/roles.yaml b/charts/spire/charts/spire-agent/templates/roles.yaml index e6878a2..f4df1ce 100644 --- a/charts/spire/charts/spire-agent/templates/roles.yaml +++ b/charts/spire/charts/spire-agent/templates/roles.yaml @@ -2,7 +2,7 @@ kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ include "spire-agent.fullname" . }} + name: {{ include "spire-agent.fullname" . | quote }} rules: - apiGroups: [""] resources: @@ -15,12 +15,12 @@ rules: kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ include "spire-agent.fullname" . }} + name: {{ include "spire-agent.fullname" . | quote }} subjects: - kind: ServiceAccount - name: {{ include "spire-agent.serviceAccountName" . }} - namespace: {{ include "spire-agent.namespace" . }} + name: {{ include "spire-agent.serviceAccountName" . | quote }} + namespace: {{ include "spire-agent.namespace" . | quote }} roleRef: kind: ClusterRole - name: {{ include "spire-agent.fullname" . }} + name: {{ include "spire-agent.fullname" . | quote }} apiGroup: rbac.authorization.k8s.io diff --git a/charts/spire/charts/spire-agent/templates/scc-spire-agent.yaml b/charts/spire/charts/spire-agent/templates/scc-spire-agent.yaml index 30d84f1..3c81651 100644 --- a/charts/spire/charts/spire-agent/templates/scc-spire-agent.yaml +++ b/charts/spire/charts/spire-agent/templates/scc-spire-agent.yaml @@ -2,7 +2,7 @@ apiVersion: security.openshift.io/v1 kind: SecurityContextConstraints metadata: - name: {{ include "spire-agent.fullname" . }} + name: {{ include "spire-agent.fullname" . | quote }} readOnlyRootFilesystem: true runAsUser: type: RunAsAny @@ -11,7 +11,7 @@ seLinuxContext: supplementalGroups: type: RunAsAny users: - - system:serviceaccount:{{ include "spire-agent.namespace" . }}:{{ include "spire-agent.serviceAccountName" . }} + - {{ printf "system:serviceaccount:%s:%s" (include "spire-agent.namespace" .) (include "spire-agent.serviceAccountName" .) | quote }} volumes: - configMap - hostPath diff --git a/charts/spire/charts/spire-agent/templates/serviceaccount.yaml b/charts/spire/charts/spire-agent/templates/serviceaccount.yaml index 03e447e..c0c3472 100644 --- a/charts/spire/charts/spire-agent/templates/serviceaccount.yaml +++ b/charts/spire/charts/spire-agent/templates/serviceaccount.yaml @@ -2,8 +2,8 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "spire-agent.serviceAccountName" . }} - namespace: {{ include "spire-agent.namespace" . }} + name: {{ include "spire-agent.serviceAccountName" . | quote }} + namespace: {{ include "spire-agent.namespace" . | quote }} labels: {{- include "spire-agent.labels" . | nindent 4 }} {{- with .Values.serviceAccount.annotations }} diff --git a/charts/spire/charts/spire-lib/templates/_helpers.tpl b/charts/spire/charts/spire-lib/templates/_helpers.tpl index db33cee..8e3684a 100644 --- a/charts/spire/charts/spire-lib/templates/_helpers.tpl +++ b/charts/spire/charts/spire-lib/templates/_helpers.tpl @@ -53,17 +53,17 @@ {{- $repo := .image.repository }} {{- $tag := .image.tag | toString }} {{- if eq (substr 0 7 $tag) "sha256:" }} -{{- printf "%s/%s@%s" $registry $repo $tag }} +{{- printf "%s/%s@%s" $registry $repo $tag | quote }} {{- else if .appVersion }} {{- $appVersion := .appVersion }} {{- if and (hasKey . "ubi") (dig "openshift" false .global) }} {{- $appVersion = printf "ubi-%s" $appVersion }} {{- end }} -{{- printf "%s%s:%s" $registry $repo (default $appVersion $tag) }} +{{- printf "%s%s:%s" $registry $repo (default $appVersion $tag) | quote }} {{- else if $tag }} -{{- printf "%s%s:%s" $registry $repo $tag }} +{{- printf "%s%s:%s" $registry $repo $tag | quote }} {{- else }} -{{- printf "%s%s" $registry $repo }} +{{- printf "%s%s" $registry $repo | quote }} {{- end }} {{- end }} @@ -309,7 +309,7 @@ securityContext - the subbranch of values that contains the securityContext to m {{- define "spire-lib.default_node_priority_class_name" }} {{- if .Values.priorityClassName }} -priorityClassName: {{ .Values.priorityClassName }} +priorityClassName: {{ .Values.priorityClassName | quote }} {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "priorityClassName" true .Values.global) }} priorityClassName: system-node-critical {{- end }} @@ -317,7 +317,7 @@ priorityClassName: system-node-critical {{- define "spire-lib.default_cluster_priority_class_name" }} {{- if .Values.priorityClassName }} -priorityClassName: {{ .Values.priorityClassName }} +priorityClassName: {{ .Values.priorityClassName | quote }} {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "priorityClassName" true .Values.global) }} priorityClassName: system-cluster-critical {{- end }} From ee7aacf61bbcfe2201e7279fd8b822719c0f67c4 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Tue, 17 Sep 2024 08:27:01 -0700 Subject: [PATCH 06/32] Fix autoupdate patterns for spiffe-helper (#460) Signed-off-by: Kevin Fox --- .github/tests/images.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/tests/images.json b/.github/tests/images.json index 9cdb449..53f3fe4 100644 --- a/.github/tests/images.json +++ b/.github/tests/images.json @@ -66,8 +66,8 @@ }, { "query": "spiffeHelper.image", - "filter": "LATESTSHA", - "sort-flags": [] + "filter": "^[0-9]\\+\\.[0-9]\\+\\.[0-9]\\+$", + "sort-flags": ["-t", ".", "-k1,1n", "-k2,2n", "-k3,3n"] } ], "tornjak-frontend/values.yaml": [ From b7e9823a65b963405c80575f80901f2c20e6f911 Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Tue, 17 Sep 2024 21:36:52 +0200 Subject: [PATCH 07/32] Add new config.jwtDomain value to oidc-discovery chart (#457) Signed-off-by: Erik Godding Boye Co-authored-by: Faisal Memon --- .../charts/spiffe-oidc-discovery-provider/README.md | 1 + .../templates/configmap.yaml | 9 ++++++--- .../charts/spiffe-oidc-discovery-provider/values.yaml | 2 ++ 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 3e25760..c6daf4f 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -74,6 +74,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | | `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` | | `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | +| `config.jwtDomain` | The JWT domain. Defaults to oidc-discovery.$jwtIssuer URL-parsed host if unset | `""` | | `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` | | `imagePullSecrets` | Image pull secret names | `[]` | | `nameOverride` | Name override | `""` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml index 3fdb93a..6906852 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml @@ -23,9 +23,12 @@ domains: - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}" - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}" - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}" - {{- $uri := urlParse (include "spire-lib.jwt-issuer" .) }} - {{- $jwtIssuer := (default $uri.path $uri.host) }} - {{- uniq (concat (list $jwtIssuer) .Values.config.additionalDomains) | toYaml | nindent 2 }} + {{- $jwtDomain := .Values.config.jwtDomain }} + {{- if not $jwtDomain }} + {{- $uri := urlParse (include "spire-lib.jwt-issuer" .) }} + {{- $jwtDomain = (default $uri.path $uri.host) }} + {{- end }} + {{- uniq (concat (list $jwtDomain) .Values.config.additionalDomains) | toYaml | nindent 2 }} {{- if eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "false" }} allow_insecure_scheme: true diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index a64ec51..b2e92ae 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -186,6 +186,8 @@ jwtIssuer: "" config: ## @param config.logLevel The log level, valid values are "debug", "info", "warn", and "error" logLevel: info + ## @param config.jwtDomain [string] The JWT domain. Defaults to oidc-discovery.$jwtIssuer URL-parsed host if unset + jwtDomain: "" ## @param config.additionalDomains [array] Add additional domains that can be used for oidc discovery additionalDomains: [] # - localhost From 68d21ccade9deeed9f6d55fdc9bb3527b945c5b2 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Tue, 17 Sep 2024 13:39:22 -0700 Subject: [PATCH 08/32] Add an initial json schema file for spire-agent (#458) * Add an initial json schema file for spire-agent Signed-off-by: Kevin Fox * Fix tab Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Co-authored-by: Faisal Memon --- .../charts/spire-agent/values.schema.json | 50 +++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 charts/spire/charts/spire-agent/values.schema.json diff --git a/charts/spire/charts/spire-agent/values.schema.json b/charts/spire/charts/spire-agent/values.schema.json new file mode 100644 index 0000000..de32746 --- /dev/null +++ b/charts/spire/charts/spire-agent/values.schema.json @@ -0,0 +1,50 @@ +{ + "$schema": "http://json-schema.org/schema#", + "type": "object", + "properties": { + "server": { + "type": "object", + "properties": { + "port": { + "type": "integer", + "minimum": 1 + } + } + }, + "healthChecks": { + "type": "object", + "properties": { + "port": { + "type": "integer", + "minimum": 1 + } + } + }, + "livenessProbe": { + "type": "object", + "properties": { + "initialDelaySeconds": { + "type": "integer", + "minimum": 0 + }, + "periodSeconds": { + "type": "integer", + "minimum": 1 + } + } + }, + "readinessProbe": { + "type": "object", + "properties": { + "initialDelaySeconds": { + "type": "integer", + "minimum": 0 + }, + "periodSeconds": { + "type": "integer", + "minimum": 1 + } + } + } + } +} From c3c8514333128791ca61c3f5bc9b8fc21ff4621a Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Tue, 17 Sep 2024 14:02:06 -0700 Subject: [PATCH 09/32] Change curl --caPath to --capath (#462) Signed-off-by: Faisal Memon Co-authored-by: kfox1111 --- charts/spire/charts/spire-agent/templates/daemonset.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index c242127..66649b4 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -97,7 +97,7 @@ spec: {{- else }} URL="https://localhost:10250/spec/" {{- end }} - curl --caPath /var/run/secrets/kubernetes.io/serviceaccount/ca.crt "$URL" + curl --capath /var/run/secrets/kubernetes.io/serviceaccount/ca.crt "$URL" if [ $? -eq 0 ]; then echo Mode detected as apiServerCA. ln -s /var/run/secrets/kubernetes.io/serviceaccount/ca.crt /hostCert/kubelet.crt From 352aee2f0ddbc7debbcf96acd2260919e9efaa6e Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Mon, 23 Sep 2024 06:50:10 -0700 Subject: [PATCH 10/32] Bump test chart dependencies (#468) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> --- .github/tests/charts.json | 6 +++--- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 6 +++--- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 6 +++--- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 4 ++-- charts/spire/charts/spire-server/values.yaml | 4 ++-- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 9 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 9d3d922..b04dc5e 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "62.6.0" + "version": "62.7.0" }, { "name": "cert-manager", @@ -17,11 +17,11 @@ { "name": "mysql", "repo": "https://charts.bitnami.com/bitnami", - "version": "11.1.16" + "version": "11.1.17" }, { "name": "postgresql", "repo": "https://charts.bitnami.com/bitnami", - "version": "15.5.28" + "version": "15.5.32" } ] diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index c6daf4f..fa944b4 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -117,15 +117,15 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:206d0bd57044a6e9058ec82173a5ae92a64164383066e2aa7519736a011f151c` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c144a2e6e4e4a7744b121f5afb0f997aa5dad0568edc81cc017efc46df1ed375` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.step.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.27.2` | +| `tests.step.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.27.4` | | `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` | | `tests.busybox.image.repository` | The repository within the registry | `busybox` | | `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index b2e92ae..3f8b318 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -332,7 +332,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8 + tag: latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395 toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -344,7 +344,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:206d0bd57044a6e9058ec82173a5ae92a64164383066e2aa7519736a011f151c + tag: latest@sha256:c144a2e6e4e4a7744b121f5afb0f997aa5dad0568edc81cc017efc46df1ed375 step: ## @param tests.step.image.registry The OCI registry to pull the image from @@ -356,7 +356,7 @@ tests: registry: "docker.io" repository: smallstep/step-cli pullPolicy: IfNotPresent - tag: 0.27.2 + tag: 0.27.4 busybox: ## @param tests.busybox.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 32391f0..a7ceade 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -69,7 +69,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` | @@ -113,12 +113,12 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `Always` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395` | | `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:206d0bd57044a6e9058ec82173a5ae92a64164383066e2aa7519736a011f151c` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c144a2e6e4e4a7744b121f5afb0f997aa5dad0568edc81cc017efc46df1ed375` | | `hostCert.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index c7958ec..9608c77 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -151,7 +151,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8 + tag: latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395 ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -278,7 +278,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8 + tag: latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395 ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -293,7 +293,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:206d0bd57044a6e9058ec82173a5ae92a64164383066e2aa7519736a011f151c + tag: latest@sha256:c144a2e6e4e4a7744b121f5afb0f997aa5dad0568edc81cc017efc46df1ed375 ## @param hostCert.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index ae0f659..ac029b5 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -416,7 +416,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `chown.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `chown.image.repository` | The repository within the registry | `chainguard/bash` | | `chown.image.pullPolicy` | The image pull policy | `Always` | -| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8` | +| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395` | | `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `experimental.enabled` | Allow configuration of experimental features | `false` | | `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | @@ -429,5 +429,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 32b1c53..889ac58 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1052,7 +1052,7 @@ chown: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8 + tag: latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395 ## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -1087,7 +1087,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8 + tag: latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395 ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 7bf3761..2925753 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 34e5852..7f2a659 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:3ed6a0b7b498b531c631a5f314ba85e91c6fd66d47301f9f67e9422e395c80c8 + tag: latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395 From ea2d67383031d42cdd14556a83acc219d6d56239 Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Mon, 30 Sep 2024 17:06:39 -0700 Subject: [PATCH 11/32] Bump test chart dependencies (#470) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> --- .github/tests/charts.json | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 4 ++-- charts/spire/charts/spire-server/values.yaml | 4 ++-- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 9 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index b04dc5e..ab3729b 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "62.7.0" + "version": "63.1.0" }, { "name": "cert-manager", @@ -22,6 +22,6 @@ { "name": "postgresql", "repo": "https://charts.bitnami.com/bitnami", - "version": "15.5.32" + "version": "15.5.36" } ] diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index fa944b4..2a8281a 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -117,11 +117,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c144a2e6e4e4a7744b121f5afb0f997aa5dad0568edc81cc017efc46df1ed375` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0fb32be5ecb7e6ee127640b4af3d9e22c5240d5b17149c7647b62d539ea403d8` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 3f8b318..697b832 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -332,7 +332,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395 + tag: latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4 toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -344,7 +344,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:c144a2e6e4e4a7744b121f5afb0f997aa5dad0568edc81cc017efc46df1ed375 + tag: latest@sha256:0fb32be5ecb7e6ee127640b4af3d9e22c5240d5b17149c7647b62d539ea403d8 step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index a7ceade..4b3a0ba 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -69,7 +69,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` | @@ -113,12 +113,12 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `Always` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4` | | `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c144a2e6e4e4a7744b121f5afb0f997aa5dad0568edc81cc017efc46df1ed375` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0fb32be5ecb7e6ee127640b4af3d9e22c5240d5b17149c7647b62d539ea403d8` | | `hostCert.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 9608c77..9a3741d 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -151,7 +151,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395 + tag: latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4 ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -278,7 +278,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395 + tag: latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4 ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -293,7 +293,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:c144a2e6e4e4a7744b121f5afb0f997aa5dad0568edc81cc017efc46df1ed375 + tag: latest@sha256:0fb32be5ecb7e6ee127640b4af3d9e22c5240d5b17149c7647b62d539ea403d8 ## @param hostCert.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index ac029b5..9706a8b 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -416,7 +416,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `chown.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `chown.image.repository` | The repository within the registry | `chainguard/bash` | | `chown.image.pullPolicy` | The image pull policy | `Always` | -| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395` | +| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4` | | `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `experimental.enabled` | Allow configuration of experimental features | `false` | | `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | @@ -429,5 +429,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 889ac58..d70492f 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1052,7 +1052,7 @@ chown: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395 + tag: latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4 ## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -1087,7 +1087,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395 + tag: latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4 ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 2925753..76461ec 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 7f2a659..08a855c 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:b812c38f9e411c76215246e1773534e4dc35332cb3a905cc31b7053b443af395 + tag: latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4 From 5d07eaff52b0be467ca3756252b0dc62454e7323 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 3 Oct 2024 12:06:38 -0700 Subject: [PATCH 12/32] Align more settings to convention (#467) * Align more settings to convention Signed-off-by: Kevin Fox * Update docs Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox --- charts/spire-nested/README.md | 10 ++-- charts/spire-nested/values.yaml | 20 +++---- charts/spire/charts/spire-agent/README.md | 8 +-- .../spire-agent/templates/configmap.yaml | 6 +- .../spire-agent/templates/daemonset.yaml | 9 +++ charts/spire/charts/spire-agent/values.yaml | 16 ++--- charts/spire/charts/spire-server/README.md | 40 ++++++------- .../spire-server/templates/_helpers.tpl | 14 ++--- .../spire-server/templates/configmap.yaml | 36 ++++++------ .../charts/spire-server/templates/issuer.yaml | 8 +-- .../charts/spire-server/templates/roles.yaml | 6 +- .../templates/server-resource.yaml | 28 ++++++++- charts/spire/charts/spire-server/values.yaml | 58 +++++++++---------- .../ci/namespace-override-values-skip.yaml | 4 +- examples/federation/a-values.yaml | 8 +-- examples/federation/b-values.yaml | 8 +-- examples/tpm-direct/different-nodes.yaml | 2 +- examples/tpm-direct/same-nodes.yaml | 2 +- examples/tpm-direct/values.yaml | 2 +- tests/unit/spire_test.go | 8 +-- 20 files changed, 164 insertions(+), 129 deletions(-) diff --git a/charts/spire-nested/README.md b/charts/spire-nested/README.md index a4991f4..759a837 100644 --- a/charts/spire-nested/README.md +++ b/charts/spire-nested/README.md @@ -303,7 +303,7 @@ Now you can interact with the Spire agent socket from your own application. The | `root-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the test-keys identity | `false` | | `root-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` | | `root-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` | -| `root-spire-server.nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` | +| `root-spire-server.nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor | `[]` | | `root-spire-server.bundleConfigMap` | The name of the configmap to store the upstream bundle | `spire-bundle-upstream` | | `external-root-spire-server-full.externalServer` | Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers. | `true` | | `external-root-spire-server-full.nameOverride` | Name override | `root-server` | @@ -315,7 +315,7 @@ Now you can interact with the Spire agent socket from your own application. The | `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable the default cluster spiffe id | `false` | | `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the test-keys identity | `false` | | `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` | -| `external-root-spire-server-full.nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` | +| `external-root-spire-server-full.nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor | `[]` | | `external-root-spire-server-full.bundleConfigMap` | The name of the configmap to store the upstream bundle | `spire-bundle-upstream` | | `external-root-spire-server-security.externalServer` | Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers. | `true` | | `external-root-spire-server-security.nameOverride` | Name override | `root-server` | @@ -323,7 +323,7 @@ Now you can interact with the Spire agent socket from your own application. The | `external-root-spire-server-security.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` | | `external-root-spire-server-security.controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another instance on the k8s cluster with webhooks enabled. | `false` | | `external-root-spire-server-security.controllerManager.className` | specify to use an explicit class name. | `spire-mgmt-external-server` | -| `external-root-spire-server-security.nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` | +| `external-root-spire-server-security.nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor | `[]` | | `external-root-spire-server-security.bundleConfigMap` | The name of the configmap to store the upstream bundle | `spire-bundle-upstream` | ### Spire server parameters @@ -350,6 +350,6 @@ Now you can interact with the Spire agent socket from your own application. The | `external-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` | | `external-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` | | `external-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` | -| `external-spire-server.notifier.k8sbundle.enabled` | Enable local k8s bundle uploader | `false` | -| `external-spire-server.nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `false` | +| `external-spire-server.notifier.k8sBundle.enabled` | Enable local k8s bundle uploader | `false` | +| `external-spire-server.nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `false` | | `external-spire-server.nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `true` | diff --git a/charts/spire-nested/values.yaml b/charts/spire-nested/values.yaml index f7c9549..4465ade 100644 --- a/charts/spire-nested/values.yaml +++ b/charts/spire-nested/values.yaml @@ -246,8 +246,8 @@ root-spire-server: ## @param root-spire-server.externalControllerManagers.enabled Flag to enable external controller managers enabled: true nodeAttestor: - k8sPsat: - ## @param root-spire-server.nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor + k8sPSAT: + ## @param root-spire-server.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor serviceAccountAllowList: - spire-agent-upstream ## @param root-spire-server.bundleConfigMap The name of the configmap to store the upstream bundle @@ -284,8 +284,8 @@ external-root-spire-server-full: ## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable the test-keys identity enabled: false nodeAttestor: - k8sPsat: - ## @param external-root-spire-server-full.nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor + k8sPSAT: + ## @param external-root-spire-server-full.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor serviceAccountAllowList: - spire-agent-upstream ## @param external-root-spire-server-full.bundleConfigMap The name of the configmap to store the upstream bundle @@ -308,8 +308,8 @@ external-root-spire-server-security: ## @param external-root-spire-server-security.controllerManager.className specify to use an explicit class name. className: spire-mgmt-external-server nodeAttestor: - k8sPsat: - ## @param external-root-spire-server-security.nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor + k8sPSAT: + ## @param external-root-spire-server-security.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor serviceAccountAllowList: - spire-agent-upstream ## @param external-root-spire-server-security.bundleConfigMap The name of the configmap to store the upstream bundle @@ -385,12 +385,12 @@ external-spire-server: ## @param external-spire-server.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server nameOverride: root-server notifier: - k8sbundle: - ## @param external-spire-server.notifier.k8sbundle.enabled Enable local k8s bundle uploader + k8sBundle: + ## @param external-spire-server.notifier.k8sBundle.enabled Enable local k8s bundle uploader enabled: false nodeAttestor: - k8sPsat: - ## @param external-spire-server.nodeAttestor.k8sPsat.enabled Enable Psat k8s nodeattestor + k8sPSAT: + ## @param external-spire-server.nodeAttestor.k8sPSAT.enabled Enable PSAT k8s nodeattestor enabled: false joinToken: ## @param external-spire-server.nodeAttestor.joinToken.enabled Enable the join_token nodeattestor diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 4b3a0ba..5d83e95 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -72,7 +72,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | -| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` | +| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | | `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` | | `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` | | `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` | @@ -84,7 +84,7 @@ A Helm chart to install the SPIRE agent. | `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.8.7` | | `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `1d7c73ccac948ee86cbd78ddde2d30128a1838b403f7bb2100d38d916a252244` | | `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` | -| `nodeAttestor.tpmDirect.pubHash.enabled` | Enable Psat k8s nodeattestor | `true` | +| `nodeAttestor.tpmDirect.pubHash.enabled` | Display pubhash in logs | `true` | | `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `docker.io` | | `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-get-tpm-pubhash` | | `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` | @@ -98,10 +98,10 @@ A Helm chart to install the SPIRE agent. | `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false | `false` | | `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` | | `sds.enabled` | Enables Envoy SDS configuration | `false` | -| `sds.defaultSvidName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` | +| `sds.defaultSVIDName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` | | `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` | | `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` | -| `sds.disableSpiffeCertValidation` | Disable Envoy SDS custom validation | `false` | +| `sds.disableSPIFFECertValidation` | Disable Envoy SDS custom validation | `false` | | `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | | `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | | `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index d46c6b7..fad0255 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -50,10 +50,10 @@ agent: {{- end }} {{- if .Values.sds.enabled }} sds: - default_svid_name: {{ .Values.sds.defaultSvidName | quote }} + default_svid_name: {{ .Values.sds.defaultSVIDName | quote }} default_bundle_name: {{ .Values.sds.defaultBundleName | quote }} default_all_bundles_name: {{ .Values.sds.defaultAllBundlesName | quote }} - disable_spiffe_cert_validation: {{ eq .Values.sds.disableSpiffeCertValidation true }} + disable_spiffe_cert_validation: {{ eq .Values.sds.disableSPIFFECertValidation true }} {{- end }} {{- with .Values.experimental }} @@ -73,7 +73,7 @@ agent: {{- $keyManagerUsed := add (len .Values.customPlugins.keyManager) (len .Values.unsupportedBuiltInPlugins.keyManager) }} plugins: NodeAttestor: - {{- if .Values.nodeAttestor.k8sPsat.enabled }} + {{- if .Values.nodeAttestor.k8sPSAT.enabled }} k8s_psat: plugin_data: cluster: {{ include "spire-lib.cluster-name" . | quote }} diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 66649b4..fd7a985 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -1,5 +1,14 @@ {{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }} {{- $root := . }} +{{- if hasKey .Values.nodeAttestor "k8sPsat" }} +{{- fail "k8sPsat was renamed to k8sPSAT. Please update your config." }} +{{- end }} +{{- if hasKey .Values.sds "defaultSvidName" }} +{{- fail "defaultSvidName was renamed to defaultSVIDName. Please update your config." }} +{{- end }} +{{- if hasKey .Values.sds "disableSpiffeCertValidation" }} +{{- fail "disableSpiffeCertValidation was renamed to disableSPIFFECertValidation. Please update your config." }} +{{- end }} {{- range $name := (concat (list "default") (keys .Values.agents)) | uniq }} {{- with (dict "Release" $root.Release "Chart" $root.Chart "Values" (deepCopy $root.Values)) }} {{- $nameSuffix := "" }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 9a3741d..7475397 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -162,8 +162,8 @@ keyManager: enabled: true nodeAttestor: - k8sPsat: - ## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s Node Attestor + k8sPSAT: + ## @param nodeAttestor.k8sPSAT.enabled Enable PSAT k8s Node Attestor enabled: true httpChallenge: ## @param nodeAttestor.httpChallenge.enabled Enable the http challenge Node Attestor @@ -193,7 +193,7 @@ nodeAttestor: ## @param nodeAttestor.tpmDirect.plugin.path The filename in the container of the plugin path: /app/tpm_attestor_agent pubHash: - ## @param nodeAttestor.tpmDirect.pubHash.enabled Enable Psat k8s nodeattestor + ## @param nodeAttestor.tpmDirect.pubHash.enabled Display pubhash in logs enabled: true ## @param nodeAttestor.tpmDirect.pubHash.image.registry The OCI registry to pull the image from ## @param nodeAttestor.tpmDirect.pubHash.image.repository The repository within the registry @@ -233,14 +233,14 @@ workloadAttestors: sds: ## @param sds.enabled Enables Envoy SDS configuration enabled: false - ## @param sds.defaultSvidName The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS - defaultSvidName: "default" + ## @param sds.defaultSVIDName The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS + defaultSVIDName: "default" ## @param sds.defaultBundleName The Validation Context resource name to use for the default X.509 bundle with Envoy SDS defaultBundleName: "ROOTCA" ## @param sds.defaultAllBundlesName The Validation Context resource name to use for all bundles (including federated) with Envoy SDS defaultAllBundlesName: "ALL" - ## @param sds.disableSpiffeCertValidation Disable Envoy SDS custom validation - disableSpiffeCertValidation: false + ## @param sds.disableSPIFFECertValidation Disable Envoy SDS custom validation + disableSPIFFECertValidation: false telemetry: prometheus: @@ -355,7 +355,7 @@ agents: {} # nodeSelector: # tpm: with # nodeAttestor: -# k8sPsat: +# k8sPSAT: # enabled: false # tpmDirect: # enabled: true diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 9706a8b..ce2bedc 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -168,9 +168,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | | `federation.ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` | | `federation.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` | -| `ca_subject.country` | Country for Spire server CA | `ARPA` | -| `ca_subject.organization` | Organization for Spire server CA | `Example` | -| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` | +| `caSubject.country` | Country for Spire server CA | `ARPA` | +| `caSubject.organization` | Organization for Spire server CA | `Example` | +| `caSubject.commonName` | Common Name for Spire server CA | `example.org` | | `credentialComposer.uniqueID.enabled` | Add the x509UniqueIdentifier attribute to workload X509-SVIDs | `false` | | `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` | | `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` | @@ -201,11 +201,11 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` | | `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` | | `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` | -| `upstreamAuthority.certManager.issuer_name` | Defaults to the release name, override if CA is provided outside of the chart | `""` | -| `upstreamAuthority.certManager.issuer_kind` | Defaults to "Issuer", override if CA is provided outside of the chart | `Issuer` | -| `upstreamAuthority.certManager.issuer_group` | Defaults to "cert-manager.io", override if CA is provided outside of the chart | `cert-manager.io` | +| `upstreamAuthority.certManager.issuerName` | Defaults to the release name, override if CA is provided outside of the chart | `""` | +| `upstreamAuthority.certManager.issuerKind` | Defaults to "Issuer", override if CA is provided outside of the chart | `Issuer` | +| `upstreamAuthority.certManager.issuerGroup` | Defaults to "cert-manager.io", override if CA is provided outside of the chart | `cert-manager.io` | | `upstreamAuthority.certManager.namespace` | Specify to use a namespace other then the one the chart is installed into | `""` | -| `upstreamAuthority.certManager.kube_config_file` | Path to kube_config_file on node to setup cert manager | `""` | +| `upstreamAuthority.certManager.kubeConfigFile` | Path to kube config file on node to setup cert manager | `""` | | `upstreamAuthority.certManager.ca.create` | Creates a Cert-Manager CA | `false` | | `upstreamAuthority.certManager.ca.duration` | Duration of the CA. Defaults to 10 years | `87600h` | | `upstreamAuthority.certManager.ca.privateKey.algorithm` | Algorithm to generate private key for CA | `ECDSA` | @@ -230,8 +230,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `upstreamAuthority.vault.k8sAuth.k8sAuthRoleName` | Required - Name of the Vault role. The plugin authenticates against the named role | `""` | | `upstreamAuthority.vault.k8sAuth.token.audience` | Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info. | `vault` | | `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` | -| `notifier.k8sbundle.enabled` | Enable local k8s bundle uploader | `true` | -| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` | +| `notifier.k8sBundle.enabled` | Enable local k8s bundle uploader | `true` | +| `notifier.k8sBundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` | | `notifier.externalK8sBundle.enabled` | Enable external k8s bundle uploader | `true` | | `notifier.externalK8sBundle.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` | | `notifier.externalK8sBundle.defaults.configMap` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` | @@ -327,17 +327,17 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `caTTL` | TTL for CA | `24h` | | `defaultX509SvidTTL` | TTL for X509 Svids | `4h` | | `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` | -| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` | -| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor. If namespace isn't specified, release namespace will be used. | `[]` | -| `nodeAttestor.k8sPsat.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` | -| `nodeAttestor.k8sPsat.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` | -| `nodeAttestor.k8sPsat.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` | -| `nodeAttestor.externalK8sPsat.enabled` | Enable PSAT k8s nodeattestor for external Kubernetes clusters | `true` | -| `nodeAttestor.externalK8sPsat.defaults.serviceAccountAllowList` | Allowed service accounts for PSAT node attestor | `[]` | -| `nodeAttestor.externalK8sPsat.defaults.audience` | Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used | `[]` | -| `nodeAttestor.externalK8sPsat.defaults.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` | -| `nodeAttestor.externalK8sPsat.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` | -| `nodeAttestor.externalK8sPsat.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` | +| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `true` | +| `nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor. If namespace isn't specified, release namespace will be used. | `[]` | +| `nodeAttestor.k8sPSAT.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` | +| `nodeAttestor.k8sPSAT.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` | +| `nodeAttestor.k8sPSAT.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` | +| `nodeAttestor.externalK8sPSAT.enabled` | Enable PSAT k8s nodeattestor for external Kubernetes clusters | `true` | +| `nodeAttestor.externalK8sPSAT.defaults.serviceAccountAllowList` | Allowed service accounts for PSAT node attestor | `[]` | +| `nodeAttestor.externalK8sPSAT.defaults.audience` | Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used | `[]` | +| `nodeAttestor.externalK8sPSAT.defaults.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` | +| `nodeAttestor.externalK8sPSAT.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` | +| `nodeAttestor.externalK8sPSAT.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` | | `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` | | `nodeAttestor.httpChallenge.enabled` | Enable the http_challenge nodeattesto | `false` | | `nodeAttestor.httpChallenge.allowedDNSPatterns` | A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed. | `[]` | diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index 5674c5c..ce0fb91 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -66,8 +66,8 @@ Allow the release namespace to be overridden for multi-namespace deployments in {{- end -}} {{- define "spire-server.bundle-namespace" -}} - {{- if .Values.notifier.k8sbundle.namespace }} - {{- .Values.notifier.k8sbundle.namespace }} + {{- if .Values.notifier.k8sBundle.namespace }} + {{- .Values.notifier.k8sBundle.namespace }} {{- else if .Values.namespaceOverride -}} {{- .Values.namespaceOverride -}} {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }} @@ -146,9 +146,9 @@ Create the name of the service account to use {{- define "spire-server.serviceAccountAllowedList" }} {{- $releaseNamespace := include "spire-server.agent-namespace" . }} -{{- if ne (len .Values.nodeAttestor.k8sPsat.serviceAccountAllowList) 0 }} +{{- if ne (len .Values.nodeAttestor.k8sPSAT.serviceAccountAllowList) 0 }} {{- $list := list }} -{{- range .Values.nodeAttestor.k8sPsat.serviceAccountAllowList }} +{{- range .Values.nodeAttestor.k8sPSAT.serviceAccountAllowList }} {{- if contains ":" . }} {{- $list = append $list . }} {{- else }} @@ -293,17 +293,17 @@ The code below determines what connection type should be used. {{- define "spire-server.ca-subject-country" }} {{- $g := dig "spire" "caSubject" "country" "" .Values.global }} -{{- default .Values.ca_subject.country $g }} +{{- default .Values.caSubject.country $g }} {{- end }} {{- define "spire-server.ca-subject-organization" }} {{- $g := dig "spire" "caSubject" "organization" "" .Values.global }} -{{- default .Values.ca_subject.organization $g }} +{{- default .Values.caSubject.organization $g }} {{- end }} {{- define "spire-server.ca-subject-common-name" }} {{- $g := dig "spire" "caSubject" "commonName" "" .Values.global }} -{{- default .Values.ca_subject.common_name $g }} +{{- default .Values.caSubject.commonName $g }} {{- end }} {{- define "spire-server.subject" }} diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index c43f358..d5ca253 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -1,9 +1,9 @@ {{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}} {{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}} {{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}} -{{- include "spire-lib.check-strict-mode" (list . "ca_subject.country must be set" (eq (include "spire-server.ca-subject-country" .) "ARPA"))}} -{{- include "spire-lib.check-strict-mode" (list . "ca_subject.organization must be set" (eq (include "spire-server.ca-subject-organization" .) "Example"))}} -{{- include "spire-lib.check-strict-mode" (list . "ca_subject.common_name must be set" (eq (include "spire-server.ca-subject-common-name" .) "example.org"))}} +{{- include "spire-lib.check-strict-mode" (list . "caSubject.country must be set" (eq (include "spire-server.ca-subject-country" .) "ARPA"))}} +{{- include "spire-lib.check-strict-mode" (list . "caSubject.organization must be set" (eq (include "spire-server.ca-subject-organization" .) "Example"))}} +{{- include "spire-lib.check-strict-mode" (list . "caSubject.commonNname must be set" (eq (include "spire-server.ca-subject-common-name" .) "example.org"))}} {{- range $type, $tvals := .Values.customPlugins }} {{- if not (has $type (list "bundlePublisher" "credentialComposer" "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }} {{- fail (printf "Unknown plugin type specified: %s" $type) }} @@ -103,14 +103,14 @@ plugins: plugin_data: {{ include "spire-server.datastore-config" . | nindent 10 }} - {{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.externalK8sPsat.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }} + {{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }} NodeAttestor: - {{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPsat.clusters }} - {{- if or (eq (.Values.nodeAttestor.k8sPsat.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPsat.enabled | toString) "true") (gt (len $clusters) 0)) }} + {{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPSAT.clusters }} + {{- if or (eq (.Values.nodeAttestor.k8sPSAT.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true") (gt (len $clusters) 0)) }} k8s_psat: plugin_data: clusters: - {{- with .Values.nodeAttestor.k8sPsat }} + {{- with .Values.nodeAttestor.k8sPSAT }} {{- if eq (.enabled | toString) "true" }} - {{ include "spire-lib.cluster-name" $root }}: service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }} @@ -121,12 +121,12 @@ plugins: {{ toYaml .allowedPodLabelKeys | nindent 14 }} {{- end }} {{- end }} - {{- if eq (.Values.nodeAttestor.externalK8sPsat.enabled | toString) "true" }} - {{- $clusterDefaults := .Values.nodeAttestor.externalK8sPsat.defaults }} + {{- if eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true" }} + {{- $clusterDefaults := .Values.nodeAttestor.externalK8sPSAT.defaults }} {{- range $name, $_ := $clusters }} {{- $clusterSettings := dict }} - {{- if hasKey $root.Values.nodeAttestor.externalK8sPsat.clusters $name }} - {{- $clusterSettings = index $root.Values.nodeAttestor.externalK8sPsat.clusters $name }} + {{- if hasKey $root.Values.nodeAttestor.externalK8sPSAT.clusters $name }} + {{- $clusterSettings = index $root.Values.nodeAttestor.externalK8sPSAT.clusters $name }} {{- end }} - {{ $name }}: {{- if hasKey $clusterSettings "kubeConfigName" }} @@ -233,11 +233,11 @@ plugins: {{- end }} {{- $externalK8sBundleClusters := default .Values.kubeConfigs .Values.notifier.externalK8sBundle.clusters }} - {{- if or .Values.notifier.k8sbundle.enabled (and .Values.notifier.externalK8sBundle.enabled (ne (len $externalK8sBundleClusters) 0)) }} + {{- if or .Values.notifier.k8sBundle.enabled (and .Values.notifier.externalK8sBundle.enabled (ne (len $externalK8sBundleClusters) 0)) }} Notifier: k8sbundle: plugin_data: - {{- if eq (.Values.notifier.k8sbundle.enabled | toString) "true" }} + {{- if eq (.Values.notifier.k8sBundle.enabled | toString) "true" }} namespace: {{ include "spire-server.bundle-namespace" . | quote }} config_map: {{ include "spire-lib.bundle-configmap" . | quote }} {{- end }} @@ -307,12 +307,12 @@ plugins: UpstreamAuthority: cert-manager: plugin_data: - issuer_name: {{ default (printf "%s-ca" (include "spire-server.fullname" $root)) .issuer_name }} - issuer_kind: {{ .issuer_kind | quote }} - issuer_group: {{ .issuer_group | quote }} + issuer_name: {{ default (printf "%s-ca" (include "spire-server.fullname" $root)) .issuerName }} + issuer_kind: {{ .issuerKind | quote }} + issuer_group: {{ .issuerGroup | quote }} namespace: {{ default $root.Release.Namespace .namespace | quote }} - {{- if ne .kube_config_file "" }} - kube_config_file: {{ .kube_config_file | quote }} + {{- if ne .kubeConfigFile "" }} + kube_config_file: {{ .kubeConfigFile | quote }} {{- end }} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/issuer.yaml b/charts/spire/charts/spire-server/templates/issuer.yaml index 1a9afbd..5894543 100644 --- a/charts/spire/charts/spire-server/templates/issuer.yaml +++ b/charts/spire/charts/spire-server/templates/issuer.yaml @@ -1,6 +1,6 @@ {{- with .Values.upstreamAuthority.certManager }} {{ if and .enabled .ca.create }} -{{ $issuerName := printf "%s-selfsigned" (default (include "spire-server.fullname" $) .issuer_name) }} +{{ $issuerName := printf "%s-selfsigned" (default (include "spire-server.fullname" $) .issuerName) }} {{/* Configuring CA Issuer: https://cert-manager.io/docs/configuration/ca/ */}} @@ -21,14 +21,14 @@ metadata: namespace: {{ include "spire-server.namespace" $ }} spec: isCA: true - commonName: {{ $.Values.ca_subject.common_name }} + commonName: {{ $.Values.caSubject.commonName }} secretName: {{ include "spire-server.fullname" $ }}-ca-keys duration: {{ $.Values.upstreamAuthority.certManager.ca.duration }} subject: countries: - - {{ $.Values.ca_subject.country }} + - {{ $.Values.caSubject.country }} organizations: - - {{ $.Values.ca_subject.organization }} + - {{ $.Values.caSubject.organization }} privateKey: algorithm: {{ $.Values.upstreamAuthority.certManager.ca.privateKey.algorithm }} size: {{ $.Values.upstreamAuthority.certManager.ca.privateKey.size }} diff --git a/charts/spire/charts/spire-server/templates/roles.yaml b/charts/spire/charts/spire-server/templates/roles.yaml index fdf2ac5..197dc02 100644 --- a/charts/spire/charts/spire-server/templates/roles.yaml +++ b/charts/spire/charts/spire-server/templates/roles.yaml @@ -1,7 +1,7 @@ {{- $subject := include "spire-server.subject" . }} {{- $namespace := include "spire-server.namespace" . }} {{- $bundleNamespace := include "spire-server.bundle-namespace" . }} -{{- if .Values.notifier.k8sbundle.enabled }} +{{- if .Values.notifier.k8sBundle.enabled }} # Role to be able to push certificate bundles to a configmap kind: Role apiVersion: rbac.authorization.k8s.io/v1 @@ -48,7 +48,7 @@ roleRef: name: {{ include "spire-server.fullname" . }}-cm apiGroup: rbac.authorization.k8s.io {{- end }} -{{- if .Values.notifier.k8sbundle.enabled }} +{{- if .Values.notifier.k8sBundle.enabled }} --- kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 @@ -61,7 +61,7 @@ roleRef: name: {{ include "spire-lib.bundle-configmap" . }} apiGroup: rbac.authorization.k8s.io {{- end }} -{{- if and .Values.nodeAttestor.k8sPsat.enabled }} +{{- if and .Values.nodeAttestor.k8sPSAT.enabled }} --- # ClusterRole to allow spire-server node attestor to query Token Review API kind: ClusterRole diff --git a/charts/spire/charts/spire-server/templates/server-resource.yaml b/charts/spire/charts/spire-server/templates/server-resource.yaml index 1a52494..e6b5491 100644 --- a/charts/spire/charts/spire-server/templates/server-resource.yaml +++ b/charts/spire/charts/spire-server/templates/server-resource.yaml @@ -6,7 +6,33 @@ {{- $configSum3 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }} {{- $configSumTornjak := (include (print $.Template.BasePath "/tornjak-config.yaml") . | sha256sum) }} {{- $fullname := include "spire-server.fullname" . }} - +{{- if hasKey .Values "ca_subject" }} +{{- fail "ca_subject was renamed to caSubject. Please update your config." }} +{{- end }} +{{- if hasKey .Values.caSubject "common_name" }} +{{- fail "ca_name was renamed to caName. Please update your config." }} +{{- end }} +{{- if hasKey .Values.upstreamAuthority.certManager "issuer_name" }} +{{- fail "issuer_name was renamed to issuerName. Please update your config." }} +{{- end }} +{{- if hasKey .Values.upstreamAuthority.certManager "issuer_group" }} +{{- fail "issuer_group was renamed to issuerGroup. Please update your config." }} +{{- end }} +{{- if hasKey .Values.upstreamAuthority.certManager "issuer_kind" }} +{{- fail "issuer_kind was renamed to issuerKind. Please update your config." }} +{{- end }} +{{- if hasKey .Values.upstreamAuthority.certManager "kube_config_file" }} +{{- fail "kube_config_file was renamed to kubeConfigFile. Please update your config." }} +{{- end }} +{{- if hasKey .Values.nodeAttestor "k8sPsat" }} +{{- fail "k8sPsat was renamed to k8sPSAT. Please update your config." }} +{{- end }} +{{- if hasKey .Values.nodeAttestor "externalK8sPSA" }} +{{- fail "externalK8sPsat was renamed to externalK8sPSAT. Please update your config." }} +{{- end }} +{{- if hasKey .Values.notifier "k8sbundle" }} +{{- fail "k8sbundle was renmaed to k8sBundle. Please update your config." }} +{{- end }} {{- if eq .Values.kind "statefulset" }} {{- if not (has .Values.persistence.type (list "pvc" "hostPath" "emptyDir")) }} {{- fail "persistence.type must be one of [\"pvc\", \"hostPath\", \"emptyDir\"]" }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index d70492f..beab1c7 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -287,13 +287,13 @@ federation: # If Profile Type == https_web: # secretName: spire-server-federation-tls -ca_subject: - ## @param ca_subject.country Country for Spire server CA +caSubject: + ## @param caSubject.country Country for Spire server CA country: ARPA - ## @param ca_subject.organization Organization for Spire server CA + ## @param caSubject.organization Organization for Spire server CA organization: Example - ## @param ca_subject.common_name Common Name for Spire server CA - common_name: example.org + ## @param caSubject.commonName Common Name for Spire server CA + commonName: example.org credentialComposer: uniqueID: @@ -371,16 +371,16 @@ upstreamAuthority: ## @param upstreamAuthority.certManager.rbac.create Flag to create RBAC roles rbac: create: true - ## @param upstreamAuthority.certManager.issuer_name Defaults to the release name, override if CA is provided outside of the chart - issuer_name: "" - ## @param upstreamAuthority.certManager.issuer_kind Defaults to "Issuer", override if CA is provided outside of the chart - issuer_kind: "Issuer" - ## @param upstreamAuthority.certManager.issuer_group Defaults to "cert-manager.io", override if CA is provided outside of the chart - issuer_group: "cert-manager.io" + ## @param upstreamAuthority.certManager.issuerName Defaults to the release name, override if CA is provided outside of the chart + issuerName: "" + ## @param upstreamAuthority.certManager.issuerKind Defaults to "Issuer", override if CA is provided outside of the chart + issuerKind: "Issuer" + ## @param upstreamAuthority.certManager.issuerGroup Defaults to "cert-manager.io", override if CA is provided outside of the chart + issuerGroup: "cert-manager.io" ## @param upstreamAuthority.certManager.namespace Specify to use a namespace other then the one the chart is installed into namespace: "" - ## @param upstreamAuthority.certManager.kube_config_file Path to kube_config_file on node to setup cert manager - kube_config_file: "" + ## @param upstreamAuthority.certManager.kubeConfigFile Path to kube config file on node to setup cert manager + kubeConfigFile: "" ca: ## @param upstreamAuthority.certManager.ca.create Creates a Cert-Manager CA @@ -440,10 +440,10 @@ upstreamAuthority: expiry: 7200 notifier: - k8sbundle: - ## @param notifier.k8sbundle.enabled Enable local k8s bundle uploader + k8sBundle: + ## @param notifier.k8sBundle.enabled Enable local k8s bundle uploader enabled: true - ## @param notifier.k8sbundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace + ## @param notifier.k8sBundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace namespace: "" externalK8sBundle: ## @param notifier.externalK8sBundle.enabled Enable external k8s bundle uploader @@ -795,30 +795,30 @@ defaultX509SvidTTL: 4h defaultJwtSvidTTL: 1h nodeAttestor: - k8sPsat: - ## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s nodeattestor + k8sPSAT: + ## @param nodeAttestor.k8sPSAT.enabled Enable PSAT k8s nodeattestor enabled: true - ## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor. If namespace isn't specified, release namespace will be used. + ## @param nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor. If namespace isn't specified, release namespace will be used. serviceAccountAllowList: [] - ## @param nodeAttestor.k8sPsat.audience [array] Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used + ## @param nodeAttestor.k8sPSAT.audience [array] Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used audience: ["spire-server"] - ## @param nodeAttestor.k8sPsat.allowedNodeLabelKeys [array] Node label keys considered for selectors + ## @param nodeAttestor.k8sPSAT.allowedNodeLabelKeys [array] Node label keys considered for selectors allowedNodeLabelKeys: [] - ## @param nodeAttestor.k8sPsat.allowedPodLabelKeys [array] Pod label keys considered for selectors + ## @param nodeAttestor.k8sPSAT.allowedPodLabelKeys [array] Pod label keys considered for selectors allowedPodLabelKeys: [] - externalK8sPsat: - ## @param nodeAttestor.externalK8sPsat.enabled Enable PSAT k8s nodeattestor for external Kubernetes clusters + externalK8sPSAT: + ## @param nodeAttestor.externalK8sPSAT.enabled Enable PSAT k8s nodeattestor for external Kubernetes clusters enabled: true defaults: - ## @param nodeAttestor.externalK8sPsat.defaults.serviceAccountAllowList [array] Allowed service accounts for PSAT node attestor + ## @param nodeAttestor.externalK8sPSAT.defaults.serviceAccountAllowList [array] Allowed service accounts for PSAT node attestor serviceAccountAllowList: ["spire-system:spire-agent-upstream"] - ## @param nodeAttestor.externalK8sPsat.defaults.audience [array] Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used + ## @param nodeAttestor.externalK8sPSAT.defaults.audience [array] Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used audience: ["spire-server"] - ## @param nodeAttestor.externalK8sPsat.defaults.allowedNodeLabelKeys [array] Node label keys considered for selectors + ## @param nodeAttestor.externalK8sPSAT.defaults.allowedNodeLabelKeys [array] Node label keys considered for selectors allowedNodeLabelKeys: [] - ## @param nodeAttestor.externalK8sPsat.defaults.allowedPodLabelKeys [array] Pod label keys considered for selectors + ## @param nodeAttestor.externalK8sPSAT.defaults.allowedPodLabelKeys [array] Pod label keys considered for selectors allowedPodLabelKeys: [] - ## @param nodeAttestor.externalK8sPsat.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. + ## @param nodeAttestor.externalK8sPSAT.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. clusters: {} # clustera: # kubeConfigName: foo diff --git a/charts/spire/ci/namespace-override-values-skip.yaml b/charts/spire/ci/namespace-override-values-skip.yaml index b91f0c3..8efbaf1 100644 --- a/charts/spire/ci/namespace-override-values-skip.yaml +++ b/charts/spire/ci/namespace-override-values-skip.yaml @@ -8,10 +8,10 @@ spiffe-oidc-discovery-provider: spire-server: namespaceOverride: spire-server nodeAttestor: - k8sPsat: + k8sPSAT: serviceAccountAllowList: ["spire-system:spire-agent"] notifier: - k8sbundle: + k8sBundle: namespace: spire-system spiffe-csi-driver: diff --git a/examples/federation/a-values.yaml b/examples/federation/a-values.yaml index 6ca171f..6dd0f55 100644 --- a/examples/federation/a-values.yaml +++ b/examples/federation/a-values.yaml @@ -9,12 +9,12 @@ global: clusterName: a trustDomain: a-org.local bundleConfigMap: spire-bundle-a + caSubject: + country: US + organization: A + commonName: a.local spire-server: - ca_subject: - country: US - organization: A - common_name: a.local federation: enabled: true ingress: diff --git a/examples/federation/b-values.yaml b/examples/federation/b-values.yaml index b76ec6b..4d295ac 100644 --- a/examples/federation/b-values.yaml +++ b/examples/federation/b-values.yaml @@ -9,12 +9,12 @@ global: clusterName: b trustDomain: b-org.local bundleConfigMap: spire-bundle-b + caSubject: + country: US + organization: B + commonName: b.local spire-server: - ca_subject: - country: US - organization: B - common_name: b.local federation: enabled: true ingress: diff --git a/examples/tpm-direct/different-nodes.yaml b/examples/tpm-direct/different-nodes.yaml index 86d913e..4cc6e20 100644 --- a/examples/tpm-direct/different-nodes.yaml +++ b/examples/tpm-direct/different-nodes.yaml @@ -7,7 +7,7 @@ spire-agent: nodeSelector: tpm: with nodeAttestor: - k8sPsat: + k8sPSAT: enabled: false tpmDirect: enabled: true diff --git a/examples/tpm-direct/same-nodes.yaml b/examples/tpm-direct/same-nodes.yaml index ab53a82..c4cd76c 100644 --- a/examples/tpm-direct/same-nodes.yaml +++ b/examples/tpm-direct/same-nodes.yaml @@ -1,6 +1,6 @@ spire-agent: nodeAttestor: - k8sPsat: + k8sPSAT: enabled: false tpmDirect: enabled: true diff --git a/examples/tpm-direct/values.yaml b/examples/tpm-direct/values.yaml index ab53a82..c4cd76c 100644 --- a/examples/tpm-direct/values.yaml +++ b/examples/tpm-direct/values.yaml @@ -1,6 +1,6 @@ spire-agent: nodeAttestor: - k8sPsat: + k8sPSAT: enabled: false tpmDirect: enabled: true diff --git a/tests/unit/spire_test.go b/tests/unit/spire_test.go index 7e6e1f0..b704d45 100644 --- a/tests/unit/spire_test.go +++ b/tests/unit/spire_test.go @@ -28,13 +28,13 @@ var _ = Describe("Spire", func() { chart, err := helmloader.Load("../../charts/spire") Expect(err).Should(Succeed()) Describe("spire-server.upstream.cert-manager", func() { - It("issuer_name when set is passed through", func() { + It("issuerName when set is passed through", func() { objs, err := ValueStringRender(chart, ` spire-server: upstreamAuthority: certManager: enabled: true - issuer_name: abc123 + issuerName: abc123 `) Expect(err).Should(Succeed()) notes := objs["spire/charts/spire-server/templates/configmap.yaml"] @@ -108,7 +108,7 @@ spire-server: objs, err := ValueStringRender(chart, ` spire-agent: nodeAttestor: - k8sPsat: + k8sPSAT: enabled: false customPlugins: nodeAttestor: @@ -127,7 +127,7 @@ spire-agent: objs, err := ValueStringRender(chart, ` spire-agent: nodeAttestor: - k8sPsat: + k8sPSAT: enabled: false unsupportedBuiltInPlugins: nodeAttestor: From c46179472c9dec9183ab7be295acae10785ce6ac Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 3 Oct 2024 16:27:23 -0700 Subject: [PATCH 13/32] Update the spire-controller-manager to 0.6.0 (#473) Signed-off-by: Kevin Fox Co-authored-by: Faisal Memon --- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index ce2bedc..674c60e 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -249,7 +249,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.5.0` | +| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.0` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index beab1c7..cbb3db0 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -498,7 +498,7 @@ controllerManager: registry: ghcr.io repository: spiffe/spire-controller-manager pullPolicy: IfNotPresent - tag: "0.5.0" + tag: "0.6.0" ## @param controllerManager.resources [object] Resource requests and limits for controller manager resources: {} From 24435156821c9160bf670b4386b62b786b9c20fb Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Mon, 7 Oct 2024 14:04:33 -0700 Subject: [PATCH 14/32] Bump test chart dependencies (#474) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> --- .github/tests/charts.json | 6 +++--- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 8 ++++---- .../charts/spiffe-oidc-discovery-provider/values.yaml | 8 ++++---- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 4 ++-- charts/spire/charts/spire-server/values.yaml | 4 ++-- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 9 files changed, 23 insertions(+), 23 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index ab3729b..eea7530 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,12 +2,12 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "63.1.0" + "version": "65.1.0" }, { "name": "cert-manager", "repo": "https://charts.jetstack.io", - "version": "v1.15.3" + "version": "v1.16.0" }, { "name": "ingress-nginx", @@ -22,6 +22,6 @@ { "name": "postgresql", "repo": "https://charts.bitnami.com/bitnami", - "version": "15.5.36" + "version": "16.0.1" } ] diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 2a8281a..cdc588f 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -69,7 +69,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from. Only used when TLS is disabled. | `docker.io` | | `insecureScheme.nginx.image.repository` | The repository within the registry. Only used when TLS is disabled. | `nginxinc/nginx-unprivileged` | | `insecureScheme.nginx.image.pullPolicy` | The image pull policy. Only used when TLS is disabled. | `IfNotPresent` | -| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.27.1-alpine` | +| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.27.2-alpine` | | `insecureScheme.nginx.ipMode` | IP modes supported by the cluster. Must be one of [ipv4, ipv6, both] | `both` | | `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | | `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` | @@ -117,11 +117,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0fb32be5ecb7e6ee127640b4af3d9e22c5240d5b17149c7647b62d539ea403d8` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:005b7acc8156bcbac2ae1de0befad3350e7c4a7608c91e0558e48b1e77b79b74` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | @@ -129,7 +129,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` | | `tests.busybox.image.repository` | The repository within the registry | `busybox` | | `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` | +| `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` | | `tests.agent.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `tests.agent.image.repository` | The repository within the registry | `spiffe/spire-agent` | | `tests.agent.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 697b832..1816444 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -164,7 +164,7 @@ insecureScheme: registry: docker.io repository: nginxinc/nginx-unprivileged pullPolicy: IfNotPresent - tag: 1.27.1-alpine + tag: 1.27.2-alpine ## @param insecureScheme.nginx.ipMode IP modes supported by the cluster. Must be one of [ipv4, ipv6, both] ipMode: both ## @param insecureScheme.nginx.resources Resource requests and limits @@ -332,7 +332,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4 + tag: latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576 toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -344,7 +344,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:0fb32be5ecb7e6ee127640b4af3d9e22c5240d5b17149c7647b62d539ea403d8 + tag: latest@sha256:005b7acc8156bcbac2ae1de0befad3350e7c4a7608c91e0558e48b1e77b79b74 step: ## @param tests.step.image.registry The OCI registry to pull the image from @@ -368,7 +368,7 @@ tests: registry: "" repository: busybox pullPolicy: IfNotPresent - tag: 1.36.1-uclibc + tag: 1.37.0-uclibc agent: ## @param tests.agent.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 5d83e95..381a252 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -69,7 +69,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | @@ -113,12 +113,12 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `Always` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576` | | `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0fb32be5ecb7e6ee127640b4af3d9e22c5240d5b17149c7647b62d539ea403d8` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:005b7acc8156bcbac2ae1de0befad3350e7c4a7608c91e0558e48b1e77b79b74` | | `hostCert.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 7475397..38eb3cc 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -151,7 +151,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4 + tag: latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576 ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -278,7 +278,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4 + tag: latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576 ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -293,7 +293,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:0fb32be5ecb7e6ee127640b4af3d9e22c5240d5b17149c7647b62d539ea403d8 + tag: latest@sha256:005b7acc8156bcbac2ae1de0befad3350e7c4a7608c91e0558e48b1e77b79b74 ## @param hostCert.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 674c60e..19dc4a1 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -416,7 +416,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `chown.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `chown.image.repository` | The repository within the registry | `chainguard/bash` | | `chown.image.pullPolicy` | The image pull policy | `Always` | -| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4` | +| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576` | | `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `experimental.enabled` | Allow configuration of experimental features | `false` | | `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | @@ -429,5 +429,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index cbb3db0..b88485d 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1052,7 +1052,7 @@ chown: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4 + tag: latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576 ## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -1087,7 +1087,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4 + tag: latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576 ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 76461ec..b60bcdc 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 08a855c..0539072 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4 + tag: latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576 From 898a349297dca80f961a3543c0ff83554573036c Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Mon, 7 Oct 2024 16:18:06 -0700 Subject: [PATCH 15/32] Add remaining data store options (#463) * Add remaining data store options Signed-off-by: Kevin Fox * Fix env var Signed-off-by: Kevin Fox * Update charts/spire/README.md Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Update charts/spire/README.md Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Incorperate feedback Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon --- charts/spire/README.md | 5 +++ charts/spire/charts/spire-server/README.md | 17 +++++++- .../spire-server/templates/_helpers.tpl | 12 +++++- .../spire-server/templates/configmap.yaml | 17 +++++++- .../charts/spire-server/templates/secret.yaml | 3 ++ .../templates/server-resource.yaml | 27 +++++++++++++ charts/spire/charts/spire-server/values.yaml | 39 ++++++++++++++++++- 7 files changed, 115 insertions(+), 5 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 172d736..dd17d84 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -88,6 +88,11 @@ kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeid We only support upgrading one major/minor version at a time. Version skipping isn't supported. Please see for details. +### 0.24.X + +We have added the remaining options needed for the SPIRE Server SQL data store plugin. We have removed `spire-server.dataStore.sql.plugin_data` section as it is no longer needed. If you are using it, please migrate +your settings to the ones under `spire-server.dataStore.sql`. + ### 0.23.X In previous versions, the setting spire-agent.workloadAttestors.k8s.skipKubeletVerification was set to true by default. Starting in 0.23.x, we removed that setting and replaced it with diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 19dc4a1..a2e7852 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -132,10 +132,25 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `dataStore.sql.username` | Only used by "postgres" or "mysql" | `spire` | | `dataStore.sql.password` | Only used by "postgres" or "mysql" | `""` | | `dataStore.sql.options` | Only used by "postgres" or "mysql" | `[]` | -| `dataStore.sql.plugin_data` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section | `{}` | +| `dataStore.sql.rootCAPath` | Path to Root CA bundle (MySQL only) | `""` | +| `dataStore.sql.clientCertPath` | Path to client certificate (MySQL only) | `""` | +| `dataStore.sql.clientKeyPath` | Path to private key for client certificate (MySQL only) | `""` | | `dataStore.sql.externalSecret.enabled` | Enable external secret for datastore creds | `false` | | `dataStore.sql.externalSecret.name` | The name of the secret object | `""` | | `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` | +| `dataStore.sql.maxOpenConns` | The maximum number of open db connections | `100` | +| `dataStore.sql.maxIdleConns` | The maximum number of idle connections in the pool | `2` | +| `dataStore.sql.connMaxLifetime` | The maximum amount of time a connection may be reused. If 0, time is unlimited | `0` | +| `dataStore.sql.disableMigration` | True to disable auto-migration functionality | `false` | +| `dataStore.sql.readOnly.enabled` | Set to true to configure a readOnly dartabase connection | `false` | +| `dataStore.sql.readOnly.host` | Only used by "postgres" or "mysql" | `""` | +| `dataStore.sql.readOnly.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` | +| `dataStore.sql.readOnly.username` | Only used by "postgres" or "mysql" | `spire` | +| `dataStore.sql.readOnly.password` | Only used by "postgres" or "mysql" | `""` | +| `dataStore.sql.readOnly.options` | Only used by "postgres" or "mysql" | `[]` | +| `dataStore.sql.readOnly.externalSecret.enabled` | Enable external secret for datastore creds | `false` | +| `dataStore.sql.readOnly.externalSecret.name` | The name of the secret object | `""` | +| `dataStore.sql.readOnly.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` | | `adminIDs` | SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges. | `[]` | | `auditLogEnabled` | If true, enables audit logging | `false` | | `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index ce0fb91..299dae3 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -189,7 +189,7 @@ Create the name of the service account to use {{- end }} {{- define "spire-server.datastore-config" }} -{{- $config := deepCopy .Values.dataStore.sql.plugin_data }} +{{- $config := dict }} {{- if eq .Values.dataStore.sql.databaseType "sqlite3" }} {{- $_ := set $config "database_type" "sqlite3" }} {{- $_ := set $config "connection_string" "/run/spire/data/datastore.sqlite3" }} @@ -198,11 +198,21 @@ Create the name of the service account to use {{- $port := int .Values.dataStore.sql.port | default 3306 }} {{- $query := include "spire-server.config-mysql-query" .Values.dataStore.sql.options }} {{- $_ := set $config "connection_string" (printf "%s:${DBPW}@tcp(%s:%d)/%s%s" .Values.dataStore.sql.username .Values.dataStore.sql.host $port .Values.dataStore.sql.databaseName $query) }} + {{- if .Values.dataStore.sql.readOnly.enabled }} + {{- $roPort := int .Values.dataStore.sql.readOnly.port | default 3306 }} + {{- $roQuery := include "spire-server.config-mysql-query" .Values.dataStore.sql.readOnly.options }} + {{- $_ := set $config "ro_connection_string" (printf "%s:${RODBPW}@tcp(%s:%d)/%s%s" .Values.dataStore.sql.readOnly.username .Values.dataStore.sql.readOnly.host $roPort .Values.dataStore.sql.readOnly.databaseName $roQuery) }} + {{- end }} {{- else if eq .Values.dataStore.sql.databaseType "postgres" }} {{- $_ := set $config "database_type" "postgres" }} {{- $port := int .Values.dataStore.sql.port | default 5432 }} {{- $options:= include "spire-server.config-postgresql-options" .Values.dataStore.sql.options }} {{- $_ := set $config "connection_string" (printf "dbname=%s user=%s password=${DBPW} host=%s port=%d%s" .Values.dataStore.sql.databaseName .Values.dataStore.sql.username .Values.dataStore.sql.host $port $options) }} + {{- if .Values.dataStore.sql.readOnly.enabled }} + {{- $roPort := int .Values.dataStore.sql.readOnly.port | default 5432 }} + {{- $roOptions:= include "spire-server.config-postgresql-options" .Values.dataStore.sql.readOnly.options }} + {{- $_ := set $config "ro_connection_string" (printf "dbname=%s user=%s password=${RODBPW} host=%s port=%d%s" .Values.dataStore.sql.readOnly.databaseName .Values.dataStore.sql.readOnly.username .Values.dataStore.sql.readOnly.host $roPort $roOptions) }} + {{- end }} {{- else }} {{- fail "Unsupported database type" }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index d5ca253..5f2ed55 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -101,7 +101,22 @@ plugins: DataStore: sql: plugin_data: - {{ include "spire-server.datastore-config" . | nindent 10 }} + {{ include "spire-server.datastore-config" . | nindent 8 }} + {{- if ne .Values.dataStore.sql.rootCAPath "" }} + root_ca_path: {{ .Values.dataStore.sql.rootCAPath }} + {{- end }} + {{- if ne .Values.dataStore.sql.clientCertPath "" }} + client_cert_path: {{ .Values.dataStore.sql.clientCertPath }} + {{- end }} + {{- if ne .Values.dataStore.sql.clientKeyPath "" }} + client_key_path : {{ .Values.dataStore.sql.clientKeyPath }} + {{- end }} + max_open_conns: {{ .Values.dataStore.sql.maxOpenConns }} + max_idle_conns: {{ .Values.dataStore.sql.maxIdleConns }} + {{- if ne (int .Values.dataStore.sql.connMaxLifetime) 0 }} + conn_max_lifetime: {{ .Values.dataStore.sql.connMaxLifetime }} + {{- end }} + disable_migration: {{ .Values.dataStore.sql.disableMigration }} {{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }} NodeAttestor: diff --git a/charts/spire/charts/spire-server/templates/secret.yaml b/charts/spire/charts/spire-server/templates/secret.yaml index c318280..8ba00a2 100644 --- a/charts/spire/charts/spire-server/templates/secret.yaml +++ b/charts/spire/charts/spire-server/templates/secret.yaml @@ -16,5 +16,8 @@ metadata: namespace: {{ include "spire-server.namespace" . }} data: DBPW: {{ .Values.dataStore.sql.password | b64enc }} + {{- if .Values.dataStore.sql.readOnly.enabled }} + RODBPW: {{ .Values.dataStore.sql.readOnly.password | b64enc }} + {{- end }} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/server-resource.yaml b/charts/spire/charts/spire-server/templates/server-resource.yaml index e6b5491..3cf971b 100644 --- a/charts/spire/charts/spire-server/templates/server-resource.yaml +++ b/charts/spire/charts/spire-server/templates/server-resource.yaml @@ -50,6 +50,20 @@ {{- else }} {{- fail "Unsupported kind." }} {{- end }} +{{- if hasKey .Values.dataStore.sql "plugin_data" }} +{{- fail "The plugin_data setting to the sql data store is no longer supported." }} +{{- end }} +{{- if ne .Values.dataStore.sql.databaseType "mysql" }} +{{- if ne .Values.dataStore.sql.rootCAPath "" }} +{{- fail "rootCAPath can only be set with database type mysql." }} +{{- end }} +{{- if ne .Values.dataStore.sql.clientCertPath "" }} +{{- fail "clientCertPath can only be set with database type mysql." }} +{{- end }} +{{- if ne .Values.dataStore.sql.clientKeyPath "" }} +{{- fail "clientKeyPath can only be set with database type mysql." }} +{{- end }} +{{- end }} {{- if not .Values.externalServer }} apiVersion: apps/v1 {{- if eq .Values.kind "statefulset" }} @@ -195,6 +209,19 @@ spec: name: {{ $fullname }}-dbpw key: DBPW {{- end }} + {{- if and .Values.dataStore.sql.readOnly.enabled .Values.dataStore.sql.readOnly.externalSecret.enabled }} + - name: RODBPW + valueFrom: + secretKeyRef: + name: {{ .Values.dataStore.sql.readOnly.externalSecret.name }} + key: {{ .Values.dataStore.sql.readOnly.externalSecret.key }} + {{- else if .Values.dataStore.sql.readOnly.enabled }} + - name: RODBPW + valueFrom: + secretKeyRef: + name: {{ $fullname }}-dbpw + key: RODBPW + {{- end }} {{- end }} {{- if ne .Values.keyManager.awsKMS.accessKeyID "" }} - name: AWS_KMS_ACCESS_KEY_ID diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index b88485d..11a81e9 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -170,8 +170,12 @@ dataStore: ## @param dataStore.sql.options [array] Only used by "postgres" or "mysql" options: [] - ## @param dataStore.sql.plugin_data [object] Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section - plugin_data: {} + ## @param dataStore.sql.rootCAPath Path to Root CA bundle (MySQL only) + rootCAPath: "" + ## @param dataStore.sql.clientCertPath Path to client certificate (MySQL only) + clientCertPath: "" + ## @param dataStore.sql.clientKeyPath Path to private key for client certificate (MySQL only) + clientKeyPath: "" ## When an external source creates the secret. The secret should reside in the same namespace as the spire server externalSecret: @@ -182,6 +186,37 @@ dataStore: ## @param dataStore.sql.externalSecret.key The key of the secret object whose value is the dataStore.sql password key: "" + ## @param dataStore.sql.maxOpenConns The maximum number of open db connections + maxOpenConns: 100 + ## @param dataStore.sql.maxIdleConns The maximum number of idle connections in the pool + maxIdleConns: 2 + ## @param dataStore.sql.connMaxLifetime The maximum amount of time a connection may be reused. If 0, time is unlimited + connMaxLifetime: 0 + ## @param dataStore.sql.disableMigration True to disable auto-migration functionality + disableMigration: false + + readOnly: + ## @param dataStore.sql.readOnly.enabled Set to true to configure a readOnly dartabase connection + enabled: false + ## @param dataStore.sql.readOnly.host Only used by "postgres" or "mysql" + host: "" + ## @param dataStore.sql.readOnly.port If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. + port: 0 + ## @param dataStore.sql.readOnly.username Only used by "postgres" or "mysql" + username: spire + ## @param dataStore.sql.readOnly.password Only used by "postgres" or "mysql" + password: "" + ## @param dataStore.sql.readOnly.options [array] Only used by "postgres" or "mysql" + options: [] + ## When an external source creates the secret. The secret should reside in the same namespace as the spire server + externalSecret: + ## @param dataStore.sql.readOnly.externalSecret.enabled Enable external secret for datastore creds + enabled: false + ## @param dataStore.sql.readOnly.externalSecret.name The name of the secret object + name: "" + ## @param dataStore.sql.readOnly.externalSecret.key The key of the secret object whose value is the dataStore.sql password + key: "" + ## @param adminIDs SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges. adminIDs: [] ## @param auditLogEnabled If true, enables audit logging From c29f45fc3041d22ec8fddb20faf115ffa0e0d086 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Tue, 8 Oct 2024 10:50:32 -0700 Subject: [PATCH 16/32] Add AWS DB types (#464) * Add remaining data store options Signed-off-by: Kevin Fox * Fix env var Signed-off-by: Kevin Fox * Add aws db types Signed-off-by: Kevin Fox * Update charts/spire/README.md Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Update charts/spire/README.md Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix mysql vars Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Fix missing ) Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Marco Franssen Signed-off-by: kfox1111 * Fix readme Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon Co-authored-by: Marco Franssen --- charts/spire/charts/spire-server/README.md | 21 ++++++------- .../spire-server/templates/_helpers.tpl | 30 ++++++++++++++----- .../templates/server-resource.yaml | 8 ++--- charts/spire/charts/spire-server/values.yaml | 23 +++++++------- 4 files changed, 50 insertions(+), 32 deletions(-) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index a2e7852..8c68060 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -125,13 +125,13 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `persistence.accessMode` | What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) | `ReadWriteOnce` | | `persistence.storageClass` | What storage class to use for persistence | `nil` | | `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `""` | -| `dataStore.sql.databaseType` | Other supported databases are "postgres" and "mysql" | `sqlite3` | -| `dataStore.sql.databaseName` | Only used by "postgres" or "mysql" | `spire` | -| `dataStore.sql.host` | Only used by "postgres" or "mysql" | `""` | +| `dataStore.sql.databaseType` | Other supported databases are ["postgres", "mysql", "aws_postgresql", "aws_mysql"]. Note: aws type databases are still experimental | `sqlite3` | +| `dataStore.sql.databaseName` | Only used when type != "sqlite3" | `spire` | +| `dataStore.sql.host` | Only used when type != "sqlite3" | `""` | | `dataStore.sql.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` | -| `dataStore.sql.username` | Only used by "postgres" or "mysql" | `spire` | -| `dataStore.sql.password` | Only used by "postgres" or "mysql" | `""` | -| `dataStore.sql.options` | Only used by "postgres" or "mysql" | `[]` | +| `dataStore.sql.username` | Only used when type != "sqlite3" | `spire` | +| `dataStore.sql.password` | Only used when type != "sqlite3" | `""` | +| `dataStore.sql.options` | Only used when type != "sqlite3" | `[]` | | `dataStore.sql.rootCAPath` | Path to Root CA bundle (MySQL only) | `""` | | `dataStore.sql.clientCertPath` | Path to client certificate (MySQL only) | `""` | | `dataStore.sql.clientKeyPath` | Path to private key for client certificate (MySQL only) | `""` | @@ -142,12 +142,13 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `dataStore.sql.maxIdleConns` | The maximum number of idle connections in the pool | `2` | | `dataStore.sql.connMaxLifetime` | The maximum amount of time a connection may be reused. If 0, time is unlimited | `0` | | `dataStore.sql.disableMigration` | True to disable auto-migration functionality | `false` | +| `dataStore.sql.region` | Region to use when database type is either aws_mysql or aws_postgresql | `""` | | `dataStore.sql.readOnly.enabled` | Set to true to configure a readOnly dartabase connection | `false` | -| `dataStore.sql.readOnly.host` | Only used by "postgres" or "mysql" | `""` | +| `dataStore.sql.readOnly.host` | Only used when type != "sqlite3" | `""` | | `dataStore.sql.readOnly.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` | -| `dataStore.sql.readOnly.username` | Only used by "postgres" or "mysql" | `spire` | -| `dataStore.sql.readOnly.password` | Only used by "postgres" or "mysql" | `""` | -| `dataStore.sql.readOnly.options` | Only used by "postgres" or "mysql" | `[]` | +| `dataStore.sql.readOnly.username` | Only used when type != "sqlite3" | `spire` | +| `dataStore.sql.readOnly.password` | Only used when type != "sqlite3" | `""` | +| `dataStore.sql.readOnly.options` | Only used when type != "sqlite3" | `[]` | | `dataStore.sql.readOnly.externalSecret.enabled` | Enable external secret for datastore creds | `false` | | `dataStore.sql.readOnly.externalSecret.name` | The name of the secret object | `""` | | `dataStore.sql.readOnly.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` | diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index 299dae3..7fb09cd 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -190,28 +190,42 @@ Create the name of the service account to use {{- define "spire-server.datastore-config" }} {{- $config := dict }} +{{- $pw := "" }} +{{- $ropw := "" }} {{- if eq .Values.dataStore.sql.databaseType "sqlite3" }} {{- $_ := set $config "database_type" "sqlite3" }} {{- $_ := set $config "connection_string" "/run/spire/data/datastore.sqlite3" }} -{{- else if eq .Values.dataStore.sql.databaseType "mysql" }} - {{- $_ := set $config "database_type" "mysql" }} +{{- else if or (eq .Values.dataStore.sql.databaseType "mysql") (eq .Values.dataStore.sql.databaseType "aws_mysql") }} + {{- if eq .Values.dataStore.sql.databaseType "mysql" }} + {{- $_ := set $config "database_type" "mysql" }} + {{- $pw = "${DBPW}" }} + {{- $ropw = "${RODBPW}" }} + {{- else }} + {{- $_ := set $config "database_type" (list (dict "aws_mysql" (dict "region" .Values.dataStore.sql.region))) }} + {{- end }} {{- $port := int .Values.dataStore.sql.port | default 3306 }} {{- $query := include "spire-server.config-mysql-query" .Values.dataStore.sql.options }} - {{- $_ := set $config "connection_string" (printf "%s:${DBPW}@tcp(%s:%d)/%s%s" .Values.dataStore.sql.username .Values.dataStore.sql.host $port .Values.dataStore.sql.databaseName $query) }} + {{- $_ := set $config "connection_string" (printf "%s:%s@tcp(%s:%d)/%s%s" .Values.dataStore.sql.username $pw .Values.dataStore.sql.host $port .Values.dataStore.sql.databaseName $query) }} {{- if .Values.dataStore.sql.readOnly.enabled }} {{- $roPort := int .Values.dataStore.sql.readOnly.port | default 3306 }} {{- $roQuery := include "spire-server.config-mysql-query" .Values.dataStore.sql.readOnly.options }} - {{- $_ := set $config "ro_connection_string" (printf "%s:${RODBPW}@tcp(%s:%d)/%s%s" .Values.dataStore.sql.readOnly.username .Values.dataStore.sql.readOnly.host $roPort .Values.dataStore.sql.readOnly.databaseName $roQuery) }} + {{- $_ := set $config "ro_connection_string" (printf "%s:%s@tcp(%s:%d)/%s%s" .Values.dataStore.sql.readOnly.username $ropw .Values.dataStore.sql.readOnly.host $roPort .Values.dataStore.sql.readOnly.databaseName $roQuery) }} + {{- end }} +{{- else if or (eq .Values.dataStore.sql.databaseType "postgres") (eq .Values.dataStore.sql.databaseType "aws_postgres") }} + {{- if eq .Values.dataStore.sql.databaseType "postgres" }} + {{- $_ := set $config "database_type" "postgres" }} + {{- $pw = " password=${DBPW}" }} + {{- $ropw = " password=${RODBPW}" }} + {{- else }} + {{- $_ := set $config "database_type" (list (dict "aws_postgres" (dict "region" .Values.dataStore.sql.region))) }} {{- end }} -{{- else if eq .Values.dataStore.sql.databaseType "postgres" }} - {{- $_ := set $config "database_type" "postgres" }} {{- $port := int .Values.dataStore.sql.port | default 5432 }} {{- $options:= include "spire-server.config-postgresql-options" .Values.dataStore.sql.options }} - {{- $_ := set $config "connection_string" (printf "dbname=%s user=%s password=${DBPW} host=%s port=%d%s" .Values.dataStore.sql.databaseName .Values.dataStore.sql.username .Values.dataStore.sql.host $port $options) }} + {{- $_ := set $config "connection_string" (printf "dbname=%s user=%s%s host=%s port=%d%s" .Values.dataStore.sql.databaseName .Values.dataStore.sql.username $pw .Values.dataStore.sql.host $port $options) }} {{- if .Values.dataStore.sql.readOnly.enabled }} {{- $roPort := int .Values.dataStore.sql.readOnly.port | default 5432 }} {{- $roOptions:= include "spire-server.config-postgresql-options" .Values.dataStore.sql.readOnly.options }} - {{- $_ := set $config "ro_connection_string" (printf "dbname=%s user=%s password=${RODBPW} host=%s port=%d%s" .Values.dataStore.sql.readOnly.databaseName .Values.dataStore.sql.readOnly.username .Values.dataStore.sql.readOnly.host $roPort $roOptions) }} + {{- $_ := set $config "ro_connection_string" (printf "dbname=%s user=%s%s host=%s port=%d%s" .Values.dataStore.sql.readOnly.databaseName $ropw .Values.dataStore.sql.readOnly.username .Values.dataStore.sql.readOnly.host $roPort $roOptions) }} {{- end }} {{- else }} {{- fail "Unsupported database type" }} diff --git a/charts/spire/charts/spire-server/templates/server-resource.yaml b/charts/spire/charts/spire-server/templates/server-resource.yaml index 3cf971b..97a5894 100644 --- a/charts/spire/charts/spire-server/templates/server-resource.yaml +++ b/charts/spire/charts/spire-server/templates/server-resource.yaml @@ -53,15 +53,15 @@ {{- if hasKey .Values.dataStore.sql "plugin_data" }} {{- fail "The plugin_data setting to the sql data store is no longer supported." }} {{- end }} -{{- if ne .Values.dataStore.sql.databaseType "mysql" }} +{{- if and (ne .Values.dataStore.sql.databaseType "mysql") (ne .Values.dataStore.sql.databaseType "aws_mysql") }} {{- if ne .Values.dataStore.sql.rootCAPath "" }} -{{- fail "rootCAPath can only be set with database type mysql." }} +{{- fail "rootCAPath can only be set with database type mysql or aws_mysql." }} {{- end }} {{- if ne .Values.dataStore.sql.clientCertPath "" }} -{{- fail "clientCertPath can only be set with database type mysql." }} +{{- fail "clientCertPath can only be set with database type mysql or aws_mysql." }} {{- end }} {{- if ne .Values.dataStore.sql.clientKeyPath "" }} -{{- fail "clientKeyPath can only be set with database type mysql." }} +{{- fail "clientKeyPath can only be set with database type mysql or aws_mysql." }} {{- end }} {{- end }} {{- if not .Values.externalServer }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 11a81e9..7fe6bd8 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -155,19 +155,19 @@ persistence: dataStore: sql: - ## @param dataStore.sql.databaseType Other supported databases are "postgres" and "mysql" + ## @param dataStore.sql.databaseType Other supported databases are ["postgres", "mysql", "aws_postgresql", "aws_mysql"]. Note: aws type databases are still experimental databaseType: sqlite3 - ## @param dataStore.sql.databaseName Only used by "postgres" or "mysql" + ## @param dataStore.sql.databaseName Only used when type != "sqlite3" databaseName: spire - ## @param dataStore.sql.host Only used by "postgres" or "mysql" + ## @param dataStore.sql.host Only used when type != "sqlite3" host: "" ## @param dataStore.sql.port If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. port: 0 - ## @param dataStore.sql.username Only used by "postgres" or "mysql" + ## @param dataStore.sql.username Only used when type != "sqlite3" username: spire - ## @param dataStore.sql.password Only used by "postgres" or "mysql" + ## @param dataStore.sql.password Only used when type != "sqlite3" password: "" - ## @param dataStore.sql.options [array] Only used by "postgres" or "mysql" + ## @param dataStore.sql.options [array] Only used when type != "sqlite3" options: [] ## @param dataStore.sql.rootCAPath Path to Root CA bundle (MySQL only) @@ -195,18 +195,21 @@ dataStore: ## @param dataStore.sql.disableMigration True to disable auto-migration functionality disableMigration: false + ## @param dataStore.sql.region Region to use when database type is either aws_mysql or aws_postgresql + region: "" + readOnly: ## @param dataStore.sql.readOnly.enabled Set to true to configure a readOnly dartabase connection enabled: false - ## @param dataStore.sql.readOnly.host Only used by "postgres" or "mysql" + ## @param dataStore.sql.readOnly.host Only used when type != "sqlite3" host: "" ## @param dataStore.sql.readOnly.port If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. port: 0 - ## @param dataStore.sql.readOnly.username Only used by "postgres" or "mysql" + ## @param dataStore.sql.readOnly.username Only used when type != "sqlite3" username: spire - ## @param dataStore.sql.readOnly.password Only used by "postgres" or "mysql" + ## @param dataStore.sql.readOnly.password Only used when type != "sqlite3" password: "" - ## @param dataStore.sql.readOnly.options [array] Only used by "postgres" or "mysql" + ## @param dataStore.sql.readOnly.options [array] Only used when type != "sqlite3" options: [] ## When an external source creates the secret. The secret should reside in the same namespace as the spire server externalSecret: From cecf51c27c9e280330b61dcb970df0272c83ae27 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 10 Oct 2024 02:13:56 -0700 Subject: [PATCH 17/32] Bump helm.sh/helm/v3 from 3.16.1 to 3.16.2 in /tests (#475) Bumps [helm.sh/helm/v3](https://github.com/helm/helm) from 3.16.1 to 3.16.2. - [Release notes](https://github.com/helm/helm/releases) - [Commits](https://github.com/helm/helm/compare/v3.16.1...v3.16.2) --- updated-dependencies: - dependency-name: helm.sh/helm/v3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- tests/go.mod | 18 +++++++++--------- tests/go.sum | 36 ++++++++++++++++++------------------ 2 files changed, 27 insertions(+), 27 deletions(-) diff --git a/tests/go.mod b/tests/go.mod index 16e0ac6..9d9e027 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -6,7 +6,7 @@ toolchain go1.22.5 require ( github.com/onsi/ginkgo/v2 v2.20.2 github.com/onsi/gomega v1.34.2 - helm.sh/helm/v3 v3.16.1 + helm.sh/helm/v3 v3.16.2 ) require ( @@ -48,22 +48,22 @@ require ( github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect github.com/xeipuuv/gojsonschema v1.2.0 // indirect - golang.org/x/crypto v0.26.0 // indirect + golang.org/x/crypto v0.27.0 // indirect golang.org/x/net v0.28.0 // indirect golang.org/x/oauth2 v0.21.0 // indirect - golang.org/x/sys v0.24.0 // indirect - golang.org/x/term v0.23.0 // indirect - golang.org/x/text v0.17.0 // indirect + golang.org/x/sys v0.25.0 // indirect + golang.org/x/term v0.24.0 // indirect + golang.org/x/text v0.18.0 // indirect golang.org/x/time v0.3.0 // indirect golang.org/x/tools v0.24.0 // indirect google.golang.org/protobuf v1.34.2 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect - k8s.io/api v0.31.0 // indirect - k8s.io/apiextensions-apiserver v0.31.0 // indirect - k8s.io/apimachinery v0.31.0 // indirect - k8s.io/client-go v0.31.0 // indirect + k8s.io/api v0.31.1 // indirect + k8s.io/apiextensions-apiserver v0.31.1 // indirect + k8s.io/apimachinery v0.31.1 // indirect + k8s.io/client-go v0.31.1 // indirect k8s.io/klog/v2 v2.130.1 // indirect k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect diff --git a/tests/go.sum b/tests/go.sum index 3d91cb1..166f8db 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -118,8 +118,8 @@ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9dec golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= -golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw= -golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54= +golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A= +golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= @@ -136,14 +136,14 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg= -golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/term v0.23.0 h1:F6D4vR+EHoL9/sWAWgAR1H2DcHr4PareCbAaCo1RpuU= -golang.org/x/term v0.23.0/go.mod h1:DgV24QBUrK6jhZXl+20l6UWznPlwAHm1Q1mGHtydmSk= +golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34= +golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/term v0.24.0 h1:Mh5cbb+Zk2hqqXNO7S1iTjEphVL+jb8ZWaqh/g+JWkM= +golang.org/x/term v0.24.0/go.mod h1:lOBK/LVxemqiMij05LGJ0tzNr8xlmwBRJ81PX6wVLH8= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc= -golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY= +golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224= +golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY= golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4= golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -171,16 +171,16 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -helm.sh/helm/v3 v3.16.1 h1:cER6tI/8PgUAsaJaQCVBUg3VI9KN4oVaZJgY60RIc0c= -helm.sh/helm/v3 v3.16.1/go.mod h1:r+xBHHP20qJeEqtvBXMf7W35QDJnzY/eiEBzt+TfHps= -k8s.io/api v0.31.0 h1:b9LiSjR2ym/SzTOlfMHm1tr7/21aD7fSkqgD/CVJBCo= -k8s.io/api v0.31.0/go.mod h1:0YiFF+JfFxMM6+1hQei8FY8M7s1Mth+z/q7eF1aJkTE= -k8s.io/apiextensions-apiserver v0.31.0 h1:fZgCVhGwsclj3qCw1buVXCV6khjRzKC5eCFt24kyLSk= -k8s.io/apiextensions-apiserver v0.31.0/go.mod h1:b9aMDEYaEe5sdK+1T0KU78ApR/5ZVp4i56VacZYEHxk= -k8s.io/apimachinery v0.31.0 h1:m9jOiSr3FoSSL5WO9bjm1n6B9KROYYgNZOb4tyZ1lBc= -k8s.io/apimachinery v0.31.0/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo= -k8s.io/client-go v0.31.0 h1:QqEJzNjbN2Yv1H79SsS+SWnXkBgVu4Pj3CJQgbx0gI8= -k8s.io/client-go v0.31.0/go.mod h1:Y9wvC76g4fLjmU0BA+rV+h2cncoadjvjjkkIGoTLcGU= +helm.sh/helm/v3 v3.16.2 h1:Y9v7ry+ubQmi+cb5zw1Llx8OKHU9Hk9NQ/+P+LGBe2o= +helm.sh/helm/v3 v3.16.2/go.mod h1:SyTXgKBjNqi2NPsHCW5dDAsHqvGIu0kdNYNH9gQaw70= +k8s.io/api v0.31.1 h1:Xe1hX/fPW3PXYYv8BlozYqw63ytA92snr96zMW9gWTU= +k8s.io/api v0.31.1/go.mod h1:sbN1g6eY6XVLeqNsZGLnI5FwVseTrZX7Fv3O26rhAaI= +k8s.io/apiextensions-apiserver v0.31.1 h1:L+hwULvXx+nvTYX/MKM3kKMZyei+UiSXQWciX/N6E40= +k8s.io/apiextensions-apiserver v0.31.1/go.mod h1:tWMPR3sgW+jsl2xm9v7lAyRF1rYEK71i9G5dRtkknoQ= +k8s.io/apimachinery v0.31.1 h1:mhcUBbj7KUjaVhyXILglcVjuS4nYXiwC+KKFBgIVy7U= +k8s.io/apimachinery v0.31.1/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo= +k8s.io/client-go v0.31.1 h1:f0ugtWSbWpxHR7sjVpQwuvw9a3ZKLXX0u0itkFXufb0= +k8s.io/client-go v0.31.1/go.mod h1:sKI8871MJN2OyeqRlmA4W4KM9KBdBUpDLu/43eGemCg= k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk= k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE= k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 h1:BZqlfIlq5YbRMFko6/PM7FjZpUb45WallggurYhKGag= From fcbd64e011d50d9dcf03c3524ef5344d3ecc4304 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 10 Oct 2024 12:03:54 -0700 Subject: [PATCH 18/32] Support federation bundle endpoint profile http_web certificates (#469) * Support federation bundle endpoint profile http_web certificates Signed-off-by: Kevin Fox * Fix var Signed-off-by: Kevin Fox * Fix key Signed-off-by: Kevin Fox * Fix test Signed-off-by: Kevin Fox * Fix test Signed-off-by: Kevin Fox * Fix test Signed-off-by: Kevin Fox * Fix test Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox --- charts/spire/charts/spire-server/README.md | 3 ++- .../spire-server/templates/_helpers.tpl | 2 +- .../spire-server/templates/configmap.yaml | 23 +++++++++++++------ .../templates/federation-ingress.yaml | 21 +++-------------- .../templates/server-resource.yaml | 14 +++++++++++ charts/spire/charts/spire-server/values.yaml | 8 +++++-- tests/integration/production/run-tests.sh | 2 +- ...se-federation-https-web-ingress-nginx.yaml | 13 +++++------ 8 files changed, 49 insertions(+), 37 deletions(-) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 8c68060..61c2931 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -163,7 +163,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `federation.enabled` | Flag to enable federation | `false` | | `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` | | `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` | -| `federation.bundleEndpoint.refresh_hint` | Hint used by federated servers on how often to refresh the bundle. CA TTL must be 3-5x the duration of this value to ensure public keys are loaded on federated servers prior to private key rotation on remote server. | `5m` | +| `federation.bundleEndpoint.refreshHint` | Hint used by federated servers on how often to refresh the bundle. CA TTL must be 3-5x the duration of this value to ensure public keys are loaded on federated servers prior to private key rotation on remote server. | `5m` | +| `federation.bundleEndpoint.profile.httpWeb.fileSyncInterval` | Interval on which to reload the certificate/key from disk | `1h` | | `federation.tls.spire.enabled` | Use spire to secure the federation bundle endpoint | `true` | | `federation.tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` | | `federation.tls.externalSecret.secretName` | Specify which Secret to use | `""` | diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index 7fb09cd..3882890 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -298,7 +298,7 @@ The code below determines what connection type should be used. {{- end }} {{- $args = append $args (printf "https://%s/" $host) }} {{- else }} -{{- $args = append $args (printf "http://%s/" $host) }} +{{- $args = append $args (printf "-k -L http://%s/" $host) }} {{- end }} {{ $args | toYaml }} {{- end -}} diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 5f2ed55..05eb8e3 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -38,9 +38,6 @@ {{- if and (eq (.Values.keyManager.awsKMS.keyIdentifierFile.enabled | toString) "true") (eq (.Values.keyManager.awsKMS.keyIdentifierValue.enabled | toString ) "true") }} {{- fail "You can only enable one of keyIdentifierFile or keyIdentifierValue at a time" }} {{- end }} -{{- if hasKey .Values.federation.bundleEndpoint "profile" }} -{{- fail "Configuring the federation bundle endpoint profile directly isn't supported. You can specify the settings via federation.tls" }} -{{- end }} {{- define "spire-server.yaml-config" -}} {{- $upstreamAuthorityUsed := 0 }} {{- $keyManagerUsed := 0 }} @@ -69,12 +66,24 @@ server: organization: [{{ include "spire-server.ca-subject-organization" . | quote }}] common_name: {{ include "spire-server.ca-subject-common-name" . | quote }} - {{- with .Values.federation }} - {{- if eq (.enabled | toString) "true" }} + {{- if eq (.Values.federation.enabled | toString) "true" }} federation: bundle_endpoint: - - {{ .bundleEndpoint | toYaml | nindent 8 }} - {{- end }} + address: {{ .Values.federation.bundleEndpoint.address | quote }} + port: {{ .Values.federation.bundleEndpoint.port }} + refresh_hint: {{ .Values.federation.bundleEndpoint.refreshHint | quote }} + profile: + {{- if .Values.federation.tls.spire.enabled }} + - https_spiffe: {} + {{ else }} + - https_web: + serving_cert_file: + file_sync_interval: {{ .Values.federation.bundleEndpoint.profile.httpWeb.fileSyncInterval }} + {{- if or .Values.federation.tls.certManager.enabled .Values.federation.tls.externalSecret.enabled }} + cert_file_path: /bundle-endpoint-tls/tls.crt + key_file_path: /bundle-endpoint-tls/tls.key + {{- end }} + {{- end }} {{- end }} {{- with .Values.experimental }} diff --git a/charts/spire/charts/spire-server/templates/federation-ingress.yaml b/charts/spire/charts/spire-server/templates/federation-ingress.yaml index 2eb8979..d3c4975 100644 --- a/charts/spire/charts/spire-server/templates/federation-ingress.yaml +++ b/charts/spire/charts/spire-server/templates/federation-ingress.yaml @@ -4,33 +4,18 @@ {{- $path := "/"}} {{- $pathType := "Prefix" }} {{- $tlsSection := true }} -{{/* Until https://github.com/spiffe/spire/issues/2202 is resolved, use ingress to implement cert-manager and externalSecret support. */}} -{{- $federationIngress := deepCopy .Values.federation.ingress }} -{{- if .Values.federation.tls.certManager.enabled }} -{{- $secret := printf "%s-federation-cert" $svcName }} -{{- $_ := set $federationIngress "tlsSecret" $secret }} -{{- end }} -{{- if .Values.federation.tls.externalSecret.enabled }} -{{- $_ := set $federationIngress "tlsSecret" .Values.federation.tls.externalSecret.secretName }} -{{- end }} {{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.federation.ingress) }} {{- $annotations := deepCopy .Values.federation.ingress.annotations }} {{- if eq $ingressControllerType "ingress-nginx" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }} -{{- if not .Values.federation.ingress.tlsSecret }} -{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }} -{{- end }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }} {{- else if eq $ingressControllerType "openshift" }} -{{- if $federationIngress.tlsSecret }} -{{- $_ := set $annotations "route.openshift.io/termination" "reencrypt" }} -{{- else }} -{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }} +{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }} {{- $path = "" }} {{- $pathType = "ImplementationSpecific" }} {{- $tlsSection = false }} -{{- end }} {{- end }} apiVersion: networking.k8s.io/v1 kind: Ingress @@ -44,6 +29,6 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: - {{ include "spire-lib.ingress-spec" (dict "ingress" $federationIngress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/server-resource.yaml b/charts/spire/charts/spire-server/templates/server-resource.yaml index 97a5894..2a16a5c 100644 --- a/charts/spire/charts/spire-server/templates/server-resource.yaml +++ b/charts/spire/charts/spire-server/templates/server-resource.yaml @@ -315,6 +315,10 @@ spec: mountPath: /tmp-direct-hashes {{- end }} {{- end }} + {{- if or .Values.federation.tls.certManager.enabled .Values.federation.tls.externalSecret.enabled }} + - name: bundle-endpoint-tls + mountPath: /bundle-endpoint-tls + {{- end }} {{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }} - name: upstream-ca mountPath: /run/spire/upstream_ca @@ -450,6 +454,16 @@ spec: name: {{ include "spire-server.fullname" . }}-tpm-direct-hash {{- end }} {{- end }} + {{- if .Values.federation.tls.certManager.enabled }} + - name: bundle-endpoint-tls + secret: + secretName: {{ printf "%s-federation-cert" (include "spire-server.fullname" .) }} + {{- end }} + {{- if .Values.federation.tls.externalSecret.enabled }} + - name: bundle-endpoint-tls + secret: + secretName: {{ .Values.federation.tls.externalSecret.secretName }} + {{- end }} {{- if or (eq (include "spire-tornjak.connectionType" .) "tls") (eq (include "spire-tornjak.connectionType" .) "mtls") }} - name: server-cert secret: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 7fe6bd8..fbaebfd 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -248,8 +248,12 @@ federation: port: 8443 ## @param federation.bundleEndpoint.address Address for trust bundle federation address: "0.0.0.0" - ## @param federation.bundleEndpoint.refresh_hint Hint used by federated servers on how often to refresh the bundle. CA TTL must be 3-5x the duration of this value to ensure public keys are loaded on federated servers prior to private key rotation on remote server. - refresh_hint: "5m" + ## @param federation.bundleEndpoint.refreshHint Hint used by federated servers on how often to refresh the bundle. CA TTL must be 3-5x the duration of this value to ensure public keys are loaded on federated servers prior to private key rotation on remote server. + refreshHint: "5m" + profile: + httpWeb: + ## @param federation.bundleEndpoint.profile.httpWeb.fileSyncInterval Interval on which to reload the certificate/key from disk + fileSyncInterval: 1h tls: spire: diff --git a/tests/integration/production/run-tests.sh b/tests/integration/production/run-tests.sh index c5cd8bb..a61cbac 100755 --- a/tests/integration/production/run-tests.sh +++ b/tests/integration/production/run-tests.sh @@ -129,7 +129,7 @@ install_and_test() { --values /tmp/dummydns \ --set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \ --set spire-agent.server.address=spire-server.production.other,spire-agent.server.port=443 \ - --set spire-server.federation.ingress.tlsSecret=tls-cert,spiffe-oidc-discovery-provider.ingress.tlsSecret=tls-cert \ + --set spire-server.federation.tls.externalSecret.secretName=tls-cert,spiffe-oidc-discovery-provider.ingress.tlsSecret=tls-cert \ --wait helm test --namespace "${ns}" spire diff --git a/tests/integration/production/values-expose-federation-https-web-ingress-nginx.yaml b/tests/integration/production/values-expose-federation-https-web-ingress-nginx.yaml index c2c3879..4d30a3a 100644 --- a/tests/integration/production/values-expose-federation-https-web-ingress-nginx.yaml +++ b/tests/integration/production/values-expose-federation-https-web-ingress-nginx.yaml @@ -4,10 +4,9 @@ spire-server: enabled: true federation: enabled: true - ingress: - enabled: true - controllerType: ingress-nginx - - # className: nginx - - tlsSecret: spire-server-federation-tls + tls: + spire: + enabled: false + externalSecret: + enabled: true + secretName: spire-server-federation-tls From 0a6dd199063aea34f0f61c92ef7efb872c1855cf Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Mon, 14 Oct 2024 06:26:40 -0700 Subject: [PATCH 19/32] Bump test chart dependencies (#477) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> --- .github/tests/charts.json | 6 +++--- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 4 ++-- charts/spire/charts/spire-server/values.yaml | 4 ++-- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 9 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index eea7530..a240462 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,17 +2,17 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "65.1.0" + "version": "65.2.0" }, { "name": "cert-manager", "repo": "https://charts.jetstack.io", - "version": "v1.16.0" + "version": "v1.16.1" }, { "name": "ingress-nginx", "repo": "https://kubernetes.github.io/ingress-nginx", - "version": "4.11.2" + "version": "4.11.3" }, { "name": "mysql", diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index cdc588f..2d7c249 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -117,11 +117,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:005b7acc8156bcbac2ae1de0befad3350e7c4a7608c91e0558e48b1e77b79b74` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:29eafac1f70c1410526450939eba3457f298dc906f5e2143b36439d80d2ba8e2` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 1816444..21c350e 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -332,7 +332,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576 + tag: latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2 toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -344,7 +344,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:005b7acc8156bcbac2ae1de0befad3350e7c4a7608c91e0558e48b1e77b79b74 + tag: latest@sha256:29eafac1f70c1410526450939eba3457f298dc906f5e2143b36439d80d2ba8e2 step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 381a252..9a5279b 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -69,7 +69,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | @@ -113,12 +113,12 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `Always` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2` | | `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:005b7acc8156bcbac2ae1de0befad3350e7c4a7608c91e0558e48b1e77b79b74` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:29eafac1f70c1410526450939eba3457f298dc906f5e2143b36439d80d2ba8e2` | | `hostCert.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 38eb3cc..2b2d12b 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -151,7 +151,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576 + tag: latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2 ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -278,7 +278,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576 + tag: latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2 ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -293,7 +293,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:005b7acc8156bcbac2ae1de0befad3350e7c4a7608c91e0558e48b1e77b79b74 + tag: latest@sha256:29eafac1f70c1410526450939eba3457f298dc906f5e2143b36439d80d2ba8e2 ## @param hostCert.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 61c2931..3104a88 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -433,7 +433,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `chown.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `chown.image.repository` | The repository within the registry | `chainguard/bash` | | `chown.image.pullPolicy` | The image pull policy | `Always` | -| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576` | +| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2` | | `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `experimental.enabled` | Allow configuration of experimental features | `false` | | `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | @@ -446,5 +446,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index fbaebfd..0638446 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1094,7 +1094,7 @@ chown: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576 + tag: latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2 ## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -1129,7 +1129,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576 + tag: latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2 ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index b60bcdc..aa17a9c 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 0539072..e2c9e8b 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:b1b50215810935dd28e7361a17f0cda96e4c3e42521cbcd8db6f38caa9ccf576 + tag: latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2 From 01c7227b13de2527a73d2c9d0b633ff0c36cdf73 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 17 Oct 2024 12:38:25 -0700 Subject: [PATCH 20/32] Add support for the new fallback spire-controller-manager feature (#471) * Add support for the new fallback spire-controller-manager feature Signed-off-by: Kevin Fox * Fix docs Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox --- .../templates/spire.spiffe.io_clusterspiffeids.yaml | 5 +++++ charts/spire/charts/spire-server/README.md | 1 + .../templates/controller-manager-cluster-ids.yaml | 5 ++++- charts/spire/charts/spire-server/values.yaml | 2 ++ 4 files changed, 12 insertions(+), 1 deletion(-) diff --git a/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml b/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml index 951fa0e..b29ad62 100644 --- a/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml +++ b/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml @@ -45,6 +45,11 @@ spec: description: AutoPopulateDNSNames indicates whether or not to auto populate service DNS names. type: boolean + fallback: + description: |- + Apply this ID only if there are no other matching non fallback + ClusterSPIFFEIDs + type: boolean dnsNameTemplates: description: DNSNameTemplate represents templates for extra DNS names that are applicable to SVIDs minted for this ClusterSPIFFEID. The diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 3104a88..2f27236 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -289,6 +289,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.identities.clusterSPIFFEIDs.default.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` | | `controllerManager.identities.clusterSPIFFEIDs.default.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` | | `controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` | +| `controllerManager.identities.clusterSPIFFEIDs.default.fallback` | Apply this ID only if there are no other matching non fallback ClusterSPIFFEIDs | `true` | | `controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled` | Enable this identity for controller manager | `false` | | `controllerManager.identities.clusterSPIFFEIDs.child-servers.type` | The type of rule this is. | `child-servers` | | `controllerManager.identities.clusterSPIFFEIDs.child-servers.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `true` | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml index 7642d7a..e3774c9 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml @@ -30,7 +30,7 @@ matchLabels: {{ $namespaces := list .Release.Namespace .Values.namespaceOverride (dig "spire" "namespaces" "server" "name" "" .Values.global) (dig "spire" "namespaces" "system" "name" "" .Values.global) | compact | uniq }} {{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }} {{- range $skey, $svalue := $value }} -{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "type" "admin" "dnsNameTemplates" "downstream" "federatesWith" "jwtTTL" "namespaceSelector" "podSelector" "spiffeIDTemplate" "ttl" "workloadSelectorTemplates" "autoPopulateDNSNames")) }} +{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "type" "admin" "dnsNameTemplates" "downstream" "federatesWith" "jwtTTL" "namespaceSelector" "podSelector" "spiffeIDTemplate" "ttl" "workloadSelectorTemplates" "autoPopulateDNSNames" "fallback")) }} {{- fail (printf "Unsupported property specified: %s" $skey) }} {{- end }} {{- end }} @@ -103,6 +103,9 @@ spec: {{- with $value.autoPopulateDNSNames }} autoPopulateDNSNames: {{ . }} {{- end }} + {{- with $value.fallback }} + fallback: {{ . }} + {{- end }} {{- end }} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 0638446..daa82b0 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -628,6 +628,8 @@ controllerManager: downstream: false ## @param controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames Auto populate DNS names from services attached to pods autoPopulateDNSNames: false + ## @param controllerManager.identities.clusterSPIFFEIDs.default.fallback Apply this ID only if there are no other matching non fallback ClusterSPIFFEIDs + fallback: true child-servers: ## @param controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable this identity for controller manager From ba8d993ff462e408ac89af4edfb3a56f8a2cec7f Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 17 Oct 2024 12:56:51 -0700 Subject: [PATCH 21/32] Changes to make the nested-full test more reliable (#480) Signed-off-by: Kevin Fox Co-authored-by: Faisal Memon --- examples/nested-full/run-tests.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/examples/nested-full/run-tests.sh b/examples/nested-full/run-tests.sh index 67049b8..ef175b3 100755 --- a/examples/nested-full/run-tests.sh +++ b/examples/nested-full/run-tests.sh @@ -104,12 +104,12 @@ for cluster in child other; do KC="${SCRIPTPATH}/kubeconfig-${cluster}" kubectl --kubeconfig "${KC}" get configmap -n spire-system spire-bundle-upstream -o yaml kubectl --kubeconfig "${KC}" rollout restart daemonset spire-agent-upstream -n spire-system + kubectl --kubeconfig "${KC}" rollout status daemonset spire-agent-upstream -n spire-system --timeout 120s || kubectl logs --kubeconfig "${KC}" daemonset/spire-agent-upstream -n spire-system --prefix --all-containers=true kubectl --kubeconfig "${KC}" rollout restart statefulset spire-internal-server -n spire-server + kubectl --kubeconfig "${KC}" rollout status statefulset spire-internal-server -n spire-server --timeout 120s || kubectl logs --kubeconfig "${KC}" statefulset/spire-internal-server -n spire-server --prefix --all-containers=true kubectl --kubeconfig "${KC}" rollout restart daemonset spire-agent-downstream -n spire-system - kubectl --kubeconfig "${KC}" rollout restart deployment spiffe-oidc-discovery-provider -n spire-server - kubectl --kubeconfig "${KC}" rollout status daemonset spire-agent-upstream -n spire-system --timeout 60s || kubectl logs --kubeconfig "${KC}" daemonset/spire-agent-upstream -n spire-system --prefix --all-containers=true - kubectl --kubeconfig "${KC}" rollout status statefulset spire-internal-server -n spire-server --timeout 60s || kubectl logs --kubeconfig "${KC}" statefulset/spire-internal-server -n spire-server --prefix --all-containers=true kubectl --kubeconfig "${KC}" rollout status daemonset spire-agent-downstream -n spire-system --timeout 60s || kubectl logs --kubeconfig "${KC}" daemonset/spire-agent-downstream -n spire-system --prefix --all-containers=true + kubectl --kubeconfig "${KC}" rollout restart deployment spiffe-oidc-discovery-provider -n spire-server kubectl --kubeconfig "${KC}" rollout status deployment spiffe-oidc-discovery-provider -n spire-server --timeout 60s || kubectl logs --kubeconfig "${KC}" deployment/spiffe-oidc-discovery-provider -n spire-server --prefix --all-containers=true echo Pods on "${cluster}" From 7b409ed91231d6ddda9ac17f4f6389f26bd85cab Mon Sep 17 00:00:00 2001 From: Yann Soubeyrand Date: Thu, 17 Oct 2024 23:14:20 +0200 Subject: [PATCH 22/32] Fix cert-manager upstream authority when enabling recommendations (#476) Signed-off-by: Yann Soubeyrand Co-authored-by: kfox1111 --- charts/spire/charts/spire-server/templates/configmap.yaml | 2 +- charts/spire/charts/spire-server/templates/issuer.yaml | 6 +++--- .../charts/spire-server/templates/server-resource.yaml | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 05eb8e3..f365cec 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -334,7 +334,7 @@ plugins: issuer_name: {{ default (printf "%s-ca" (include "spire-server.fullname" $root)) .issuerName }} issuer_kind: {{ .issuerKind | quote }} issuer_group: {{ .issuerGroup | quote }} - namespace: {{ default $root.Release.Namespace .namespace | quote }} + namespace: {{ default (include "spire-server.namespace" $) .namespace | quote }} {{- if ne .kubeConfigFile "" }} kube_config_file: {{ .kubeConfigFile | quote }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/issuer.yaml b/charts/spire/charts/spire-server/templates/issuer.yaml index 5894543..2029292 100644 --- a/charts/spire/charts/spire-server/templates/issuer.yaml +++ b/charts/spire/charts/spire-server/templates/issuer.yaml @@ -21,14 +21,14 @@ metadata: namespace: {{ include "spire-server.namespace" $ }} spec: isCA: true - commonName: {{ $.Values.caSubject.commonName }} + commonName: {{ include "spire-server.ca-subject-common-name" $ | quote }} secretName: {{ include "spire-server.fullname" $ }}-ca-keys duration: {{ $.Values.upstreamAuthority.certManager.ca.duration }} subject: countries: - - {{ $.Values.caSubject.country }} + - {{ include "spire-server.ca-subject-country" $ | quote }} organizations: - - {{ $.Values.caSubject.organization }} + - {{ include "spire-server.ca-subject-organization" $ | quote }} privateKey: algorithm: {{ $.Values.upstreamAuthority.certManager.ca.privateKey.algorithm }} size: {{ $.Values.upstreamAuthority.certManager.ca.privateKey.size }} diff --git a/charts/spire/charts/spire-server/templates/server-resource.yaml b/charts/spire/charts/spire-server/templates/server-resource.yaml index 2a16a5c..fd25438 100644 --- a/charts/spire/charts/spire-server/templates/server-resource.yaml +++ b/charts/spire/charts/spire-server/templates/server-resource.yaml @@ -168,7 +168,7 @@ spec: args: - wait - --namespace - - {{ .Release.Namespace }} + - {{ include "spire-server.namespace" $ }} - --timeout=3m - --for=condition=ready - issuer From b08e8bf9b18cc4cb09f37b3ebd6f20d47e631bc4 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 17 Oct 2024 15:12:27 -0700 Subject: [PATCH 23/32] Agent support for bundle on host path (#478) * Agent support for bundle on host path Signed-off-by: Kevin Fox * Update charts/spire/charts/spire-agent/values.yaml Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix docs Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon --- charts/spire/charts/spire-agent/README.md | 1 + .../spire/charts/spire-agent/templates/configmap.yaml | 2 ++ .../spire/charts/spire-agent/templates/daemonset.yaml | 11 ++++++++++- charts/spire/charts/spire-agent/values.yaml | 2 ++ 4 files changed, 15 insertions(+), 1 deletion(-) diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 9a5279b..ee7346e 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -53,6 +53,7 @@ A Helm chart to install the SPIRE agent. | `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` | | `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` | | `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `pem` | +| `trustBundleHostPath` | If set, obtain trust bundle from a file on the host instead of from the ConfigMap | `""` | | `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` | | `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` | | `server.address` | Address for Spire server | `""` | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index fad0255..73a003e 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -41,6 +41,8 @@ agent: {{- if ne (len .Values.trustBundleURL) 0 }} trust_bundle_url: {{ .Values.trustBundleURL | quote }} trust_bundle_format: {{ .Values.trustBundleFormat | quote }} + {{- else if ne (len .Values.trustBundleHostPath) 0 }} + trust_bundle_path: {{ .Values.trustBundleHostPath | quote }} {{- else }} trust_bundle_path: "/run/spire/bundle/bundle.crt" {{- end }} diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index fd7a985..805c4c0 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -265,8 +265,12 @@ spec: {{- end }} {{- if eq (len .Values.trustBundleURL) 0 }} - name: spire-bundle - mountPath: /run/spire/bundle readOnly: true + {{- if ne (len .Values.trustBundleHostPath) 0 }} + mountPath: {{ .Values.trustBundleHostPath | dir | quote }} + {{- else }} + mountPath: /run/spire/bundle + {{- end }} {{- end }} {{- if .Values.nodeAttestor.tpmDirect.enabled }} - name: tpm-direct @@ -348,9 +352,14 @@ spec: {{- end }} {{- if eq (len .Values.trustBundleURL) 0 }} - name: spire-bundle + {{- if ne (len .Values.trustBundleHostPath) 0 }} + hostPath: + path: {{ .Values.trustBundleHostPath | dir | quote }} + {{- else }} configMap: name: {{ printf "%s%s" (include "spire-lib.bundle-configmap" .) $nameSuffix | quote }} {{- end }} + {{- end }} {{- if .Values.nodeAttestor.tpmDirect.enabled }} - name: tpm-direct emptyDir: {} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 2b2d12b..4b4e185 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -95,6 +95,8 @@ trustDomain: example.org trustBundleURL: "" ## @param trustBundleFormat If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" trustBundleFormat: pem +## @param trustBundleHostPath If set, obtain trust bundle from a file on the host instead of from the ConfigMap +trustBundleHostPath: "" ## @param bundleConfigMap Configmap name for Spire bundle bundleConfigMap: spire-bundle ## @param availabilityTarget The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. From 13736cdf6ff328ed9ca013090ed6401eeaa645d5 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 17 Oct 2024 15:48:09 -0700 Subject: [PATCH 24/32] Add support for the new hint spire-controller-manager feature (#472) * Add support for the new hint spire-controller-manager feature Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 --- .../templates/spire.spiffe.io_clusterspiffeids.yaml | 3 +++ .../templates/controller-manager-cluster-ids.yaml | 9 ++++++++- charts/spire/charts/spire-server/values.yaml | 2 ++ 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml b/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml index b29ad62..2f34894 100644 --- a/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml +++ b/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml @@ -71,6 +71,9 @@ spec: items: type: string type: array + hint: + description: Set the entry hint + type: string jwtTtl: description: JWTTTL indicates an upper-bound time-to-live for JWT SVIDs minted for this ClusterSPIFFEID. diff --git a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml index e3774c9..1973bda 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml @@ -30,7 +30,7 @@ matchLabels: {{ $namespaces := list .Release.Namespace .Values.namespaceOverride (dig "spire" "namespaces" "server" "name" "" .Values.global) (dig "spire" "namespaces" "system" "name" "" .Values.global) | compact | uniq }} {{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }} {{- range $skey, $svalue := $value }} -{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "type" "admin" "dnsNameTemplates" "downstream" "federatesWith" "jwtTTL" "namespaceSelector" "podSelector" "spiffeIDTemplate" "ttl" "workloadSelectorTemplates" "autoPopulateDNSNames" "fallback")) }} +{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "type" "admin" "dnsNameTemplates" "downstream" "federatesWith" "jwtTTL" "namespaceSelector" "podSelector" "spiffeIDTemplate" "ttl" "workloadSelectorTemplates" "autoPopulateDNSNames" "fallback" "hint")) }} {{- fail (printf "Unsupported property specified: %s" $skey) }} {{- end }} {{- end }} @@ -63,6 +63,13 @@ metadata: {{- end }} spec: className: {{ include "spire-server.controller-manager-class-name" $root | quote }} + {{- if hasKey $value "hint" }} + {{- if ne $value.hint "" }} + hint: {{ $value.hint }} + {{- end }} + {{- else }} + hint: {{ $key }} + {{- end }} {{- if and (hasKey $value "spiffeIDTemplate") (ne (len $value.spiffeIDTemplate) 0) }} spiffeIDTemplate: {{ $value.spiffeIDTemplate | quote }} {{- else }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index daa82b0..8199976 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -630,6 +630,8 @@ controllerManager: autoPopulateDNSNames: false ## @param controllerManager.identities.clusterSPIFFEIDs.default.fallback Apply this ID only if there are no other matching non fallback ClusterSPIFFEIDs fallback: true + # Set what hint to use. If unset, it will be asigned the clusterSPIFFEID name. If set to "", it will be unset. Any other value will set the hint to exactly what is specified. + # hint: "" child-servers: ## @param controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable this identity for controller manager From 29e9866a8cfe81a7dca5ed3ed9dc9df118ae81bc Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Mon, 21 Oct 2024 04:59:26 -0700 Subject: [PATCH 25/32] Bump test chart dependencies (#481) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> --- .github/tests/charts.json | 6 +++--- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 6 +++--- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 6 +++--- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 4 ++-- charts/spire/charts/spire-server/values.yaml | 4 ++-- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 9 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index a240462..9aecc61 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "65.2.0" + "version": "65.3.1" }, { "name": "cert-manager", @@ -17,11 +17,11 @@ { "name": "mysql", "repo": "https://charts.bitnami.com/bitnami", - "version": "11.1.17" + "version": "11.1.19" }, { "name": "postgresql", "repo": "https://charts.bitnami.com/bitnami", - "version": "16.0.1" + "version": "16.0.3" } ] diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 2d7c249..9ed40cd 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -117,15 +117,15 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:29eafac1f70c1410526450939eba3457f298dc906f5e2143b36439d80d2ba8e2` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5d020ebb00ff6fccfe361c4f334b6bfce9472578efde619d5e119c77a49c4a60` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.step.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.27.4` | +| `tests.step.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.27.5` | | `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` | | `tests.busybox.image.repository` | The repository within the registry | `busybox` | | `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 21c350e..9fc6eea 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -332,7 +332,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2 + tag: latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2 toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -344,7 +344,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:29eafac1f70c1410526450939eba3457f298dc906f5e2143b36439d80d2ba8e2 + tag: latest@sha256:5d020ebb00ff6fccfe361c4f334b6bfce9472578efde619d5e119c77a49c4a60 step: ## @param tests.step.image.registry The OCI registry to pull the image from @@ -356,7 +356,7 @@ tests: registry: "docker.io" repository: smallstep/step-cli pullPolicy: IfNotPresent - tag: 0.27.4 + tag: 0.27.5 busybox: ## @param tests.busybox.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index ee7346e..55283e0 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -70,7 +70,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | @@ -114,12 +114,12 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `Always` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2` | | `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:29eafac1f70c1410526450939eba3457f298dc906f5e2143b36439d80d2ba8e2` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5d020ebb00ff6fccfe361c4f334b6bfce9472578efde619d5e119c77a49c4a60` | | `hostCert.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 4b4e185..865e405 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -153,7 +153,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2 + tag: latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2 ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -280,7 +280,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2 + tag: latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2 ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -295,7 +295,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:29eafac1f70c1410526450939eba3457f298dc906f5e2143b36439d80d2ba8e2 + tag: latest@sha256:5d020ebb00ff6fccfe361c4f334b6bfce9472578efde619d5e119c77a49c4a60 ## @param hostCert.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 2f27236..42723a3 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -434,7 +434,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `chown.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `chown.image.repository` | The repository within the registry | `chainguard/bash` | | `chown.image.pullPolicy` | The image pull policy | `Always` | -| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2` | +| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2` | | `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `experimental.enabled` | Allow configuration of experimental features | `false` | | `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | @@ -447,5 +447,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 8199976..16e53e4 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1098,7 +1098,7 @@ chown: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2 + tag: latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2 ## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -1133,7 +1133,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2 + tag: latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2 ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index aa17a9c..bde8457 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index e2c9e8b..027df00 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:e16830b0cc7e9e3258588fbcb82714ee67d9043221632832d7504080151bb1d2 + tag: latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2 From fe5464ba9fec33a7d13c32ad0e2428ae37304f67 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 24 Oct 2024 10:17:46 -0700 Subject: [PATCH 26/32] Update notes (#479) * Update notes Signed-off-by: Kevin Fox * Update charts/spire/README.md Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Update charts/spire/README.md Co-authored-by: Faisal Memon Signed-off-by: kfox1111 --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon --- charts/spire/README.md | 28 ++++++++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index dd17d84..cd1c25f 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -90,8 +90,32 @@ We only support upgrading one major/minor version at a time. Version skipping is ### 0.24.X -We have added the remaining options needed for the SPIRE Server SQL data store plugin. We have removed `spire-server.dataStore.sql.plugin_data` section as it is no longer needed. If you are using it, please migrate -your settings to the ones under `spire-server.dataStore.sql`. +- You must upgrade [spire-crds](https://artifacthub.io/packages/helm/spiffe/spire-crds) to 0.5.0+ before performing this upgrade. + +- In order to make it easier to target specific SPIFFE IDs to workloads, a fallback feature was added to ClusterSPIFFEIDs so that a default ID will only apply when no others do. To change back to the previous behavior, use `spire-server.controllerManager.identities.clusterSPIFFEIDs.default.fallback=false`. The new default is unlikely to need changes. + +- We now set a hint of the ClusterSPIFFEID name on each entry created by default. This can be undone by setting the `hint=""` property on the ClusterSPIFFEID. The new default is unlikely to need changes. + +- We have added the remaining options needed for the SPIRE Server SQL data store plugin as native values. We have removed `spire-server.dataStore.sql.plugin_data` section as it is no longer needed. If you are using it, please migrate your settings to the ones under `spire-server.dataStore.sql`. + +- For users of `spire-server.upstreamAuthority.certManager`, a bug was discovered with templates not honoring `global.spire.caSubject.*`. It has been fixed, but may change values if you are not careful. Please double check the new settings are what you need them to be before completing the upgrade. + +- Lastly, as we approach 1.0.0, we would like to ensure all the values follow the same convention. We have made a bunch of minor changes to the values in this version to make sure they are all camel cased and properly capitalized. If you are upgrading from a previous version, please look though this list carefully to see if a value you are using is impacted: + + - `spire-server.federation.bundleEndpoint.refresh_hint` -> `spire-server.federation.bundleEndpoint.refreshHint` + - `spire-server.nodeAttestor.k8sPsat` -> `spire-server.nodeAttestor.k8sPSAT` + - `spire-server.nodeAttestor.externalK8sPsat` -> `spire-server.nodeAttestor.ExternalK8sPSAT` + - `spire-server.notifier.k8sbundle` -> `spire-server.notifier.k8sBundle` + - `spire-server.ca_subject` -> `spire-server.caSubject` + - `spire-server.ca_subject.common_name -> `spire-server.caSubject.commonName` + - `spire-server.upstreamAuthority.certManager.issuer_name` -> `spire-server.upstreamAuthority.certManager.issuerName` + - `spire-server.upstreamAuthority.certManager.issuer_kind` -> `spire-server.upstreamAuthority.certManager.issuerKind` + - `spire-server.upstreamAuthority.certManager.issuer_group` -> `spire-server.upstreamAuthority.certManager.issuerGroup` + - `spire-server.upstreamAuthority.certManager.kube_config_file` -> `spire-server.upstreamAuthority.certManager.kubeConfigFile` + - `spire-agent.sds.defaultSvidName` -> `spire-agent.sds.defaultSVIDName` + - `spire-agent.sds.disableSpiffeCertValidation` -> `spire-agent.sds.disableSPIFFECertValidation` + - `spire-agent.sds.defaultSvidName` -> `spire-agent.sds.defaultSVIDName` + - `spire-agent.nodeAttestor.k8sPsat` -> `spire-agent.nodeAttestor.k8sPSAT` ### 0.23.X From a7368eee1f3dae5513a7573c5fbe82b717c753be Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Fri, 25 Oct 2024 22:36:59 -0700 Subject: [PATCH 27/32] Upgrade to spire 1.11.0 (#483) Signed-off-by: Kevin Fox --- charts/spire-nested/Chart.yaml | 2 +- charts/spire-nested/README.md | 2 +- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 4 +++- charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml | 2 +- charts/spire/charts/spire-agent/Chart.yaml | 2 +- charts/spire/charts/spire-agent/README.md | 2 +- charts/spire/charts/spire-agent/values.yaml | 4 ++-- charts/spire/charts/spire-server/Chart.yaml | 2 +- 9 files changed, 12 insertions(+), 10 deletions(-) diff --git a/charts/spire-nested/Chart.yaml b/charts/spire-nested/Chart.yaml index 00e86b3..5f51908 100644 --- a/charts/spire-nested/Chart.yaml +++ b/charts/spire-nested/Chart.yaml @@ -4,7 +4,7 @@ description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application version: 0.23.0 -appVersion: "1.10.3" +appVersion: "1.11.0" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire-nested/README.md b/charts/spire-nested/README.md index 759a837..2daaabe 100644 --- a/charts/spire-nested/README.md +++ b/charts/spire-nested/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.23.0](https://img.shields.io/badge/Version-0.23.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.10.3](https://img.shields.io/badge/AppVersion-1.10.3-informational?style=flat-square) +![Version: 0.23.0](https://img.shields.io/badge/Version-0.23.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.11.0](https://img.shields.io/badge/AppVersion-1.11.0-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 8769e45..328d03d 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -4,7 +4,7 @@ description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application version: 0.23.0 -appVersion: "1.10.3" +appVersion: "1.11.0" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index cd1c25f..8970491 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.23.0](https://img.shields.io/badge/Version-0.23.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.10.3](https://img.shields.io/badge/AppVersion-1.10.3-informational?style=flat-square) +![Version: 0.23.0](https://img.shields.io/badge/Version-0.23.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.11.0](https://img.shields.io/badge/AppVersion-1.11.0-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. @@ -92,6 +92,8 @@ We only support upgrading one major/minor version at a time. Version skipping is - You must upgrade [spire-crds](https://artifacthub.io/packages/helm/spiffe/spire-crds) to 0.5.0+ before performing this upgrade. +- SPIRE changed the default in 1.11.0 from `spire-agent.workloadAttestors.k8s.useNewContainerLocator=false` to `spire-agent.workloadAttestors.k8s.useNewContainerLocator=true` + - In order to make it easier to target specific SPIFFE IDs to workloads, a fallback feature was added to ClusterSPIFFEIDs so that a default ID will only apply when no others do. To change back to the previous behavior, use `spire-server.controllerManager.identities.clusterSPIFFEIDs.default.fallback=false`. The new default is unlikely to need changes. - We now set a hint of the ClusterSPIFFEID name on each entry created by default. This can be undone by setting the `hint=""` property on the ClusterSPIFFEID. The new default is unlikely to need changes. diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml index 05f64e9..1dd20c7 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml @@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider description: A Helm chart to install the SPIFFE OIDC discovery provider. type: application version: 0.1.0 -appVersion: "1.10.3" +appVersion: "1.11.0" keywords: ["spiffe", "oidc"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml index 234a5ca..88a2da4 100644 --- a/charts/spire/charts/spire-agent/Chart.yaml +++ b/charts/spire/charts/spire-agent/Chart.yaml @@ -3,7 +3,7 @@ name: spire-agent description: A Helm chart to install the SPIRE agent. type: application version: 0.1.0 -appVersion: "1.10.3" +appVersion: "1.11.0" keywords: ["spiffe", "spire-agent"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 55283e0..986ee4e 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -96,7 +96,7 @@ A Helm chart to install the SPIRE agent. | `workloadAttestors.k8s.verification.hostCert.basePath` | Path where kubelet places its certificates | `/var/lib/kubelet/pki` | | `workloadAttestors.k8s.verification.hostCert.fileName` | File name where kubelet places its certificates. If blank, it will be auto detected. | `""` | | `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` | -| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false | `false` | +| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true | `true` | | `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` | | `sds.enabled` | Enables Envoy SDS configuration | `false` | | `sds.defaultSVIDName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 865e405..0267eb4 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -227,8 +227,8 @@ workloadAttestors: fileName: "" ## @param workloadAttestors.k8s.disableContainerSelectors Set to true if using holdApplicationUntilProxyStarts in Istio disableContainerSelectors: false - ## @param workloadAttestors.k8s.useNewContainerLocator If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false - useNewContainerLocator: false + ## @param workloadAttestors.k8s.useNewContainerLocator If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true + useNewContainerLocator: true ## @param workloadAttestors.k8s.verboseContainerLocatorLogs If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false verboseContainerLocatorLogs: false diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml index 13be7fc..6ba161a 100644 --- a/charts/spire/charts/spire-server/Chart.yaml +++ b/charts/spire/charts/spire-server/Chart.yaml @@ -3,7 +3,7 @@ name: spire-server description: A Helm chart to install the SPIRE server. type: application version: 0.1.0 -appVersion: "1.10.3" +appVersion: "1.11.0" keywords: ["spiffe", "spire-server", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: From a360646842be4da8e85d551869efc20e7981495c Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Sat, 26 Oct 2024 07:40:29 -0700 Subject: [PATCH 28/32] Add validating admission policy to restrict upstream driver access (#482) * Add validating admission policy to restrict upstream driver access Signed-off-by: Kevin Fox * Update charts/spire/charts/spiffe-csi-driver/templates/policy.yaml Signed-off-by: kfox1111 * Fix logic Signed-off-by: Kevin Fox * Upgrade helm Signed-off-by: Kevin Fox * Upgrade kind and fix node version Signed-off-by: Kevin Fox * Upgrade kind and fix node version Signed-off-by: Kevin Fox * Upgrade kind and fix node version Signed-off-by: Kevin Fox * Upgrade kind and fix node version Signed-off-by: Kevin Fox * Add version info Signed-off-by: Kevin Fox * Add version info Signed-off-by: Kevin Fox * Fix kind version Signed-off-by: Kevin Fox * Fix kind version Signed-off-by: Kevin Fox * Fix kind version Signed-off-by: Kevin Fox * Fix detection Signed-off-by: Kevin Fox * Just for testing... Signed-off-by: Kevin Fox * Just for testing... Signed-off-by: Kevin Fox * Just for testing Signed-off-by: Kevin Fox * Fix policy Signed-off-by: Kevin Fox * Fix policy Signed-off-by: Kevin Fox * Fix policy Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Update charts/spire/charts/spiffe-csi-driver/values.yaml Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Update docs Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon --- .github/workflows/helm-chart-ci-ignore.yaml | 24 ++--- .github/workflows/helm-chart-ci.yaml | 35 +++---- .../spire/charts/spiffe-csi-driver/README.md | 94 ++++++++++--------- .../spiffe-csi-driver/templates/_helpers.tpl | 17 ++++ .../spiffe-csi-driver/templates/policy.yaml | 37 ++++++++ .../charts/spiffe-csi-driver/values.yaml | 7 ++ examples/nested-full/child-values.yaml | 1 - examples/nested-full/run-tests.sh | 4 +- examples/nested-security/run-tests.sh | 3 +- 9 files changed, 144 insertions(+), 78 deletions(-) create mode 100644 charts/spire/charts/spiffe-csi-driver/templates/policy.yaml diff --git a/.github/workflows/helm-chart-ci-ignore.yaml b/.github/workflows/helm-chart-ci-ignore.yaml index 1ba17fd..68950d1 100644 --- a/.github/workflows/helm-chart-ci-ignore.yaml +++ b/.github/workflows/helm-chart-ci-ignore.yaml @@ -30,9 +30,9 @@ jobs: strategy: matrix: k8s: - - v1.28.0 - - v1.27.3 - - v1.26.6 + - v1.31.1 + - v1.30.4 + - v1.29.8 steps: - run: 'echo "Skipping tests"' @@ -74,9 +74,9 @@ jobs: strategy: matrix: k8s: - - v1.28.0 - - v1.27.3 - - v1.26.6 + - v1.31.1 + - v1.30.4 + - v1.29.8 example: - ${{ fromJson(needs.build-matrix.outputs.examples) }} @@ -92,9 +92,9 @@ jobs: strategy: matrix: k8s: - - v1.28.0 - - v1.27.3 - - v1.26.6 + - v1.31.1 + - v1.30.4 + - v1.29.8 example: - ${{ fromJson(needs.build-matrix.outputs.integrationtests) }} @@ -110,9 +110,9 @@ jobs: strategy: matrix: k8s: - - v1.28.0 - - v1.27.3 - - v1.26.6 + - v1.31.1 + - v1.30.4 + - v1.29.8 steps: - run: 'echo "Skipping upgrade-test"' diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index d936465..9507094 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -21,9 +21,9 @@ concurrency: cancel-in-progress: true env: - HELM_VERSION: v3.12.0 + HELM_VERSION: v3.16.2 PYTHON_VERSION: 3.11.3 - KIND_VERSION: v0.19.0 + KIND_VERSION: v0.24.0 CHART_TESTING_VERSION: v3.8.0 jobs: @@ -130,9 +130,9 @@ jobs: # Kubernetes, but can go back farther as long as we don't need heroics # to pull it off (i.e. kubectl version juggling). k8s: - - v1.28.0 - - v1.27.3 - - v1.26.6 + - v1.31.1 + - v1.30.4 + - v1.29.8 steps: - name: Checkout @@ -218,9 +218,9 @@ jobs: fail-fast: false matrix: k8s: - - v1.28.0 - - v1.27.3 - - v1.26.6 + - v1.31.1 + - v1.30.4 + - v1.29.8 example: - ${{ fromJson(needs.build-matrix.outputs.examples) }} @@ -243,7 +243,7 @@ jobs: # Only build a kind cluster if there are chart changes to test. with: version: ${{ env.KIND_VERSION }} - node_image: kindest/node:v1.26.4 + node_image: kindest/node:${{ matrix.k8s }} config: .github/kind/conf/kind-config.yaml verbosity: 1 @@ -256,6 +256,7 @@ jobs: kubectl create namespace spire-server helm install -n spire-server spire-crds charts/spire-crds fi + export K8S="${{ matrix.k8s }}" ${{ matrix.example }}/run-tests.sh integration-test: @@ -269,9 +270,9 @@ jobs: fail-fast: false matrix: k8s: - - v1.28.0 - - v1.27.3 - - v1.26.6 + - v1.31.1 + - v1.30.4 + - v1.29.8 integrationtest: - ${{ fromJson(needs.build-matrix.outputs.integrationtests) }} @@ -294,7 +295,7 @@ jobs: # Only build a kind cluster if there are chart changes to test. with: version: ${{ env.KIND_VERSION }} - node_image: kindest/node:v1.26.4 + node_image: kindest/node:${{ matrix.k8s }} config: .github/kind/conf/kind-config.yaml verbosity: 1 @@ -314,9 +315,9 @@ jobs: fail-fast: false matrix: k8s: - - v1.28.0 - - v1.27.3 - - v1.26.6 + - v1.31.1 + - v1.30.4 + - v1.29.8 steps: - name: Checkout @@ -337,7 +338,7 @@ jobs: # Only build a kind cluster if there are chart changes to test. with: version: ${{ env.KIND_VERSION }} - node_image: kindest/node:v1.26.4 + node_image: kindest/node:${{ matrix.k8s }} config: .github/kind/conf/kind-config.yaml verbosity: 1 diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index 5a3bd3a..0005105 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -25,50 +25,52 @@ A Helm chart to install the SPIFFE CSI driver. ### SPIFFE CSI Driver Chart parameters -| Name | Description | Value | -| --------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | ------------------------------------------- | -| `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` | -| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` | -| `image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `resources` | Resource requests and limits for spiffe-csi-driver | `{}` | -| `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` | -| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` | -| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` | -| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | -| `livenessProbe.timeoutSeconds` | Timeout value in seconds for livenessProbe | `5` | -| `imagePullSecrets` | Image pull secret details for spiffe-csi-driver | `[]` | -| `nameOverride` | Name override for spiffe-csi-driver | `""` | -| `namespaceOverride` | Namespace to install spiffe-csi-driver | `""` | -| `fullnameOverride` | Full name override for spiffe-csi-driver | `""` | -| `csiDriverLabels` | Labels to apply to the CSIDriver | `{}` | -| `initContainers` | Init Containers to apply to the CSI Driver DaemonSet | `[]` | -| `serviceAccount.create` | Specifies whether a service account should be created | `true` | -| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | -| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | -| `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` | -| `podSecurityContext` | Security context for CSI driver pods | `{}` | -| `securityContext.readOnlyRootFilesystem` | Flag for read only root filesystem | `true` | -| `securityContext.privileged` | Flag for specifying privileged mode | `true` | -| `nodeSelector` | Node selector for CSI driver pods | `{}` | -| `tolerations` | Tolerations for CSI driver pods | `[]` | -| `affinity` | Node affinity | `{}` | -| `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | -| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` | -| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.4` | -| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` | -| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | -| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` | -| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | -| `restrictedScc.enabled` | Enables the creation of a SecurityContextConstraint based on the restricted SCC with CSI volume support | `false` | -| `restrictedScc.name` | Set the name of the restricted SCC with CSI support | `""` | -| `restrictedScc.version` | Version of the restricted SCC | `2` | -| `selinux.enabled` | Enable selinux support | `false` | -| `selinux.context` | Which selinux context to use | `container_file_t` | -| `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` | -| `selinux.image.repository` | The repository within the registry | `ubi9` | -| `selinux.image.pullPolicy` | The image pull policy | `Always` | -| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest` | +| Name | Description | Value | +| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------- | +| `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `resources` | Resource requests and limits for spiffe-csi-driver | `{}` | +| `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` | +| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` | +| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | +| `livenessProbe.timeoutSeconds` | Timeout value in seconds for livenessProbe | `5` | +| `imagePullSecrets` | Image pull secret details for spiffe-csi-driver | `[]` | +| `nameOverride` | Name override for spiffe-csi-driver | `""` | +| `namespaceOverride` | Namespace to install spiffe-csi-driver | `""` | +| `serverNamespaceOverride` | Override the namespace that the spire-server is installed into | `""` | +| `validatingAdmissionPolicy.enabled` | When set to auto, the validatingAdmissionPolicy will be enabled when the pluginName == "upstream.csi.spiffe.io" and k8s >= 1.30.0. Valid options are [auto, true, false] | `auto` | +| `fullnameOverride` | Full name override for spiffe-csi-driver | `""` | +| `csiDriverLabels` | Labels to apply to the CSIDriver | `{}` | +| `initContainers` | Init Containers to apply to the CSI Driver DaemonSet | `[]` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | +| `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` | +| `podSecurityContext` | Security context for CSI driver pods | `{}` | +| `securityContext.readOnlyRootFilesystem` | Flag for read only root filesystem | `true` | +| `securityContext.privileged` | Flag for specifying privileged mode | `true` | +| `nodeSelector` | Node selector for CSI driver pods | `{}` | +| `tolerations` | Tolerations for CSI driver pods | `[]` | +| `affinity` | Node affinity | `{}` | +| `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | +| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` | +| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.4` | +| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` | +| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | +| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` | +| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | +| `restrictedScc.enabled` | Enables the creation of a SecurityContextConstraint based on the restricted SCC with CSI volume support | `false` | +| `restrictedScc.name` | Set the name of the restricted SCC with CSI support | `""` | +| `restrictedScc.version` | Version of the restricted SCC | `2` | +| `selinux.enabled` | Enable selinux support | `false` | +| `selinux.context` | Which selinux context to use | `container_file_t` | +| `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` | +| `selinux.image.repository` | The repository within the registry | `ubi9` | +| `selinux.image.pullPolicy` | The image pull policy | `Always` | +| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest` | diff --git a/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl b/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl index 4fd5fcd..ddc1be5 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl +++ b/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl @@ -40,6 +40,23 @@ Allow the release namespace to be overridden for multi-namespace deployments in {{- end -}} {{- end -}} +{{/* +Allow the release namespace to be overridden for multi-namespace deployments in combined charts +*/}} +{{- define "spiffe-csi-driver.server-namespace" -}} + {{- if .Values.serverNamespaceOverride -}} + {{- .Values.serverNamespaceOverride -}} + {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }} + {{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }} + {{- .Values.global.spire.namespaces.server.name }} + {{- else }} + {{- printf "spire-server" }} + {{- end }} + {{- else -}} + {{- .Release.Namespace -}} + {{- end -}} +{{- end -}} + {{/* Create chart name and version as used by the chart label. */}} diff --git a/charts/spire/charts/spiffe-csi-driver/templates/policy.yaml b/charts/spire/charts/spiffe-csi-driver/templates/policy.yaml new file mode 100644 index 0000000..6c82b45 --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/policy.yaml @@ -0,0 +1,37 @@ +{{- $upstream := eq .Values.pluginName "upstream.csi.spiffe.io" }} +{{- $detectedValidation := semverCompare ">=1.30-0" .Capabilities.KubeVersion.GitVersion -}} +{{- $policyEnabled := .Values.validatingAdmissionPolicy.enabled | toString }} +{{- $auto := eq $policyEnabled "auto" }} +{{- if or (eq $policyEnabled "true") (and $auto $upstream $detectedValidation) }} +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicy +metadata: + name: {{ .Values.pluginName | quote }} +spec: + failurePolicy: Fail + matchConstraints: + resourceRules: + - apiGroups: [""] + apiVersions: ["v1"] + operations: ["CREATE", "UPDATE"] + resources: ["pods"] + validations: + - expression: | + !object.spec.volumes.exists(c, has(c.csi) && has(c.csi.driver) && c.csi.driver == {{ .Values.pluginName | quote }}) + message: 'you may not use the upstream.csi.spiffe.io csi driver' +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicyBinding +metadata: + name: {{ .Values.pluginName | quote }} +spec: + policyName: {{ .Values.pluginName | quote }} + validationActions: ["Deny"] + matchResources: + namespaceSelector: + matchExpressions: + - key: "kubernetes.io/metadata.name" + operator: NotIn + values: + - {{ include "spiffe-csi-driver.server-namespace" . | quote }} +{{- end }} diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index 3381a96..8e97b37 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -60,6 +60,13 @@ nameOverride: "" ## @param namespaceOverride Namespace to install spiffe-csi-driver namespaceOverride: "" +## @param serverNamespaceOverride Override the namespace that the spire-server is installed into +serverNamespaceOverride: "" + +validatingAdmissionPolicy: + ## @param validatingAdmissionPolicy.enabled When set to auto, the validatingAdmissionPolicy will be enabled when the pluginName == "upstream.csi.spiffe.io" and k8s >= 1.30.0. Valid options are [auto, true, false] + enabled: auto + ## @param fullnameOverride Full name override for spiffe-csi-driver fullnameOverride: "" diff --git a/examples/nested-full/child-values.yaml b/examples/nested-full/child-values.yaml index 0fb62ae..79c24d8 100644 --- a/examples/nested-full/child-values.yaml +++ b/examples/nested-full/child-values.yaml @@ -5,4 +5,3 @@ tags: nestedChildFull: true - diff --git a/examples/nested-full/run-tests.sh b/examples/nested-full/run-tests.sh index ef175b3..d5fd9cd 100755 --- a/examples/nested-full/run-tests.sh +++ b/examples/nested-full/run-tests.sh @@ -71,7 +71,9 @@ kubectl rollout status -n kube-system -w --timeout=1m deploy/coredns for cluster in child other; do KC="${SCRIPTPATH}/kubeconfig-${cluster}" - kind create cluster --name "${cluster}" --kubeconfig "${SCRIPTPATH}/kubeconfig-${cluster}" --config "${SCRIPTPATH}/.test-files/${cluster}-kind-config.yaml" + kind create cluster --name "${cluster}" --kubeconfig "${SCRIPTPATH}/kubeconfig-${cluster}" --config "${SCRIPTPATH}/.test-files/${cluster}-kind-config.yaml" --image "kindest/node:${K8S}" + + kubectl version --kubeconfig "${SCRIPTPATH}/kubeconfig-${cluster}" md5sum "${KC}" wc -l "${KC}" diff --git a/examples/nested-security/run-tests.sh b/examples/nested-security/run-tests.sh index 8551b03..0bb9ab9 100755 --- a/examples/nested-security/run-tests.sh +++ b/examples/nested-security/run-tests.sh @@ -73,7 +73,7 @@ kubectl rollout status -n kube-system -w --timeout=1m deploy/coredns for cluster in child; do KC="${SCRIPTPATH}/kubeconfig-${cluster}" - kind create cluster --name "${cluster}" --kubeconfig "${SCRIPTPATH}/kubeconfig-${cluster}" --config "${SCRIPTPATH}/.test-files/${cluster}-kind-config.yaml" + kind create cluster --name "${cluster}" --kubeconfig "${SCRIPTPATH}/kubeconfig-${cluster}" --config "${SCRIPTPATH}/.test-files/${cluster}-kind-config.yaml" --image "kindest/node:${K8S}" md5sum "${KC}" wc -l "${KC}" @@ -102,6 +102,7 @@ helm upgrade --install --create-namespace --namespace spire-mgmt --values "${COM # The check is being too pedantic. # shellcheck shell=bash disable=SC2043 for cluster in child; do + kubectl version --kubeconfig "${SCRIPTPATH}/kubeconfig-${cluster}" KC="${SCRIPTPATH}/kubeconfig-${cluster}" kubectl --kubeconfig "${KC}" get configmap -n spire-system spire-bundle-upstream -o yaml kubectl --kubeconfig "${KC}" rollout restart daemonset spire-agent-downstream -n spire-system From a3e607e7d84c7aa655aceacb1b4c078719f6706e Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Mon, 28 Oct 2024 06:01:02 -0700 Subject: [PATCH 29/32] Bump test chart dependencies (#484) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> --- .github/tests/charts.json | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 4 ++-- charts/spire/charts/spire-server/values.yaml | 4 ++-- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 9 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 9aecc61..090e64d 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "65.3.1" + "version": "65.5.0" }, { "name": "cert-manager", @@ -22,6 +22,6 @@ { "name": "postgresql", "repo": "https://charts.bitnami.com/bitnami", - "version": "16.0.3" + "version": "16.0.6" } ] diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 9ed40cd..40d50cd 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -117,11 +117,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5d020ebb00ff6fccfe361c4f334b6bfce9472578efde619d5e119c77a49c4a60` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:424ac4637dac08a4594643b548d9af10144dcd6360b4b319a4c143841bf0bfee` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 9fc6eea..7ad04e2 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -332,7 +332,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2 + tag: latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2 toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -344,7 +344,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:5d020ebb00ff6fccfe361c4f334b6bfce9472578efde619d5e119c77a49c4a60 + tag: latest@sha256:424ac4637dac08a4594643b548d9af10144dcd6360b4b319a4c143841bf0bfee step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 986ee4e..a515185 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -70,7 +70,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | @@ -114,12 +114,12 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `Always` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2` | | `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5d020ebb00ff6fccfe361c4f334b6bfce9472578efde619d5e119c77a49c4a60` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:424ac4637dac08a4594643b548d9af10144dcd6360b4b319a4c143841bf0bfee` | | `hostCert.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 0267eb4..94b405d 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -153,7 +153,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2 + tag: latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2 ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -280,7 +280,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2 + tag: latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2 ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -295,7 +295,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:5d020ebb00ff6fccfe361c4f334b6bfce9472578efde619d5e119c77a49c4a60 + tag: latest@sha256:424ac4637dac08a4594643b548d9af10144dcd6360b4b319a4c143841bf0bfee ## @param hostCert.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 42723a3..218eaa2 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -434,7 +434,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `chown.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `chown.image.repository` | The repository within the registry | `chainguard/bash` | | `chown.image.pullPolicy` | The image pull policy | `Always` | -| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2` | +| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2` | | `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `experimental.enabled` | Allow configuration of experimental features | `false` | | `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | @@ -447,5 +447,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 16e53e4..52f13fd 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1098,7 +1098,7 @@ chown: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2 + tag: latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2 ## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} @@ -1133,7 +1133,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2 + tag: latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2 ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index bde8457..d225ba9 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 027df00..19859f1 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:bd3bc36a650516129e804fcbc9664f039bdfba167c1bed320516509f2a6d32c2 + tag: latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2 From cd7c192ad2dae1a4ee16d1577771b2a826726946 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Mon, 28 Oct 2024 11:04:42 -0700 Subject: [PATCH 30/32] Bump spire-crds Helm Chart version from 0.4.0 to 0.5.0 (#485) * 13736cd Add support for the new hint spire-controller-manager feature (#472) * 01c7227 Add support for the new fallback spire-controller-manager feature (#471) Signed-off-by: Faisal Memon --- charts/spire-crds/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/spire-crds/Chart.yaml b/charts/spire-crds/Chart.yaml index 1dfea97..0ccccc0 100644 --- a/charts/spire-crds/Chart.yaml +++ b/charts/spire-crds/Chart.yaml @@ -3,7 +3,7 @@ name: spire-crds description: > A Helm chart for deploying the Spire CRDS type: application -version: 0.4.0 +version: 0.5.0 appVersion: "0.0.1" keywords: ["spire-crds"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire From 6e375ef2607626fbfc3b3ac01aeb2b1939974c1f Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Mon, 28 Oct 2024 11:12:27 -0700 Subject: [PATCH 31/32] Bump spire-nested Helm Chart version from 0.23.0 to 0.24.0 (#486) * a7368ee Upgrade to spire 1.11.0 (#483) * 5d07eaf Align more settings to convention (#467) Signed-off-by: Faisal Memon --- charts/spire-nested/Chart.yaml | 2 +- charts/spire-nested/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire-nested/Chart.yaml b/charts/spire-nested/Chart.yaml index 5f51908..670381c 100644 --- a/charts/spire-nested/Chart.yaml +++ b/charts/spire-nested/Chart.yaml @@ -3,7 +3,7 @@ name: spire-nested description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.23.0 +version: 0.24.0 appVersion: "1.11.0" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire diff --git a/charts/spire-nested/README.md b/charts/spire-nested/README.md index 2daaabe..4ff3b20 100644 --- a/charts/spire-nested/README.md +++ b/charts/spire-nested/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.23.0](https://img.shields.io/badge/Version-0.23.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.11.0](https://img.shields.io/badge/AppVersion-1.11.0-informational?style=flat-square) +![Version: 0.24.0](https://img.shields.io/badge/Version-0.24.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.11.0](https://img.shields.io/badge/AppVersion-1.11.0-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. From 5b16168e70228bea1635c2e62cb6e04f4908f3b6 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Mon, 28 Oct 2024 11:36:17 -0700 Subject: [PATCH 32/32] Bump spire Helm Chart version from 0.23.0 to 0.24.0 (#487) * a3e607e Bump test chart dependencies (#484) * a360646 Add validating admission policy to restrict upstream driver access (#482) * a7368ee Upgrade to spire 1.11.0 (#483) * fe5464b Update notes (#479) * 29e9866 Bump test chart dependencies (#481) * 13736cd Add support for the new hint spire-controller-manager feature (#472) * b08e8bf Agent support for bundle on host path (#478) * 7b409ed Fix cert-manager upstream authority when enabling recommendations (#476) * 01c7227 Add support for the new fallback spire-controller-manager feature (#471) * 0a6dd19 Bump test chart dependencies (#477) * fcbd64e Support federation bundle endpoint profile http_web certificates (#469) * c29f45f Add AWS DB types (#464) * 898a349 Add remaining data store options (#463) * 2443515 Bump test chart dependencies (#474) * c461794 Update the spire-controller-manager to 0.6.0 (#473) * 5d07eaf Align more settings to convention (#467) * ea2d673 Bump test chart dependencies (#470) * 352aee2 Bump test chart dependencies (#468) * c3c8514 Change curl --caPath to --capath (#462) * 68d21cc Add an initial json schema file for spire-agent (#458) * b7e9823 Add new config.jwtDomain value to oidc-discovery chart (#457) * 8832da3 Protects SPIRE Agent's Chart Against YAML Template Injection (#450) * 3bc7025 Update spiffe-helper (#453) * 86d6fca Bump test chart dependencies (#449) Signed-off-by: Faisal Memon --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 328d03d..df06027 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -3,7 +3,7 @@ name: spire description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.23.0 +version: 0.24.0 appVersion: "1.11.0" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire diff --git a/charts/spire/README.md b/charts/spire/README.md index 8970491..14f8d98 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.23.0](https://img.shields.io/badge/Version-0.23.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.11.0](https://img.shields.io/badge/AppVersion-1.11.0-informational?style=flat-square) +![Version: 0.24.0](https://img.shields.io/badge/Version-0.24.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.11.0](https://img.shields.io/badge/AppVersion-1.11.0-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.