panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add validating admission policy to restrict upstream driver access (#482)

Browse Source 
* Add validating admission policy to restrict upstream driver access

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spiffe-csi-driver/templates/policy.yaml

Signed-off-by: kfox1111 <[email protected]>

* Fix logic

Signed-off-by: Kevin Fox <[email protected]>

* Upgrade helm

Signed-off-by: Kevin Fox <[email protected]>

* Upgrade kind and fix node version

Signed-off-by: Kevin Fox <[email protected]>

* Upgrade kind and fix node version

Signed-off-by: Kevin Fox <[email protected]>

* Upgrade kind and fix node version

Signed-off-by: Kevin Fox <[email protected]>

* Upgrade kind and fix node version

Signed-off-by: Kevin Fox <[email protected]>

* Add version info

Signed-off-by: Kevin Fox <[email protected]>

* Add version info

Signed-off-by: Kevin Fox <[email protected]>

* Fix kind version

Signed-off-by: Kevin Fox <[email protected]>

* Fix kind version

Signed-off-by: Kevin Fox <[email protected]>

* Fix kind version

Signed-off-by: Kevin Fox <[email protected]>

* Fix detection

Signed-off-by: Kevin Fox <[email protected]>

* Just for testing...

Signed-off-by: Kevin Fox <[email protected]>

* Just for testing...

Signed-off-by: Kevin Fox <[email protected]>

* Just for testing

Signed-off-by: Kevin Fox <[email protected]>

* Fix policy

Signed-off-by: Kevin Fox <[email protected]>

* Fix policy

Signed-off-by: Kevin Fox <[email protected]>

* Fix policy

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spiffe-csi-driver/values.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
2024-10-26 07:40:29 -07:00
committed by GitHub
co-authored by Faisal Memon
parent a7368eee1f
commit a360646842
9 changed files with 144 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/helm-chart-ci-ignore.yaml
+12 -12
View File
@@ -30,9 +30,9 @@ jobs:
strategy:
matrix:
k8s:
- v1.28.0
- v1.27.3
- v1.26.6
- v1.31.1
- v1.30.4
- v1.29.8
steps:
- run: 'echo "Skipping tests"'
@@ -74,9 +74,9 @@ jobs:
strategy:
matrix:
k8s:
- v1.28.0
- v1.27.3
- v1.26.6
- v1.31.1
- v1.30.4
- v1.29.8
example:
- ${{ fromJson(needs.build-matrix.outputs.examples) }}
@@ -92,9 +92,9 @@ jobs:
strategy:
matrix:
k8s:
- v1.28.0
- v1.27.3
- v1.26.6
- v1.31.1
- v1.30.4
- v1.29.8
example:
- ${{ fromJson(needs.build-matrix.outputs.integrationtests) }}
@@ -110,9 +110,9 @@ jobs:
strategy:
matrix:
k8s:
- v1.28.0
- v1.27.3
- v1.26.6
- v1.31.1
- v1.30.4
- v1.29.8
steps:
- run: 'echo "Skipping upgrade-test"'
.github/workflows/helm-chart-ci.yaml
+18 -17
View File
@@ -21,9 +21,9 @@ concurrency:
cancel-in-progress: true
env:
HELM_VERSION: v3.12.0
HELM_VERSION: v3.16.2
PYTHON_VERSION: 3.11.3
KIND_VERSION: v0.19.0
KIND_VERSION: v0.24.0
CHART_TESTING_VERSION: v3.8.0
jobs:
@@ -130,9 +130,9 @@ jobs:
# Kubernetes, but can go back farther as long as we don't need heroics
# to pull it off (i.e. kubectl version juggling).
k8s:
- v1.28.0
- v1.27.3
- v1.26.6
- v1.31.1
- v1.30.4
- v1.29.8
steps:
- name: Checkout
@@ -218,9 +218,9 @@ jobs:
fail-fast: false
matrix:
k8s:
- v1.28.0
- v1.27.3
- v1.26.6
- v1.31.1
- v1.30.4
- v1.29.8
example:
- ${{ fromJson(needs.build-matrix.outputs.examples) }}
@@ -243,7 +243,7 @@ jobs:
# Only build a kind cluster if there are chart changes to test.
with:
version: ${{ env.KIND_VERSION }}
node_image: kindest/node:v1.26.4
node_image: kindest/node:${{ matrix.k8s }}
config: .github/kind/conf/kind-config.yaml
verbosity: 1
@@ -256,6 +256,7 @@ jobs:
kubectl create namespace spire-server
helm install -n spire-server spire-crds charts/spire-crds
fi
export K8S="${{ matrix.k8s }}"
${{ matrix.example }}/run-tests.sh
integration-test:
@@ -269,9 +270,9 @@ jobs:
fail-fast: false
matrix:
k8s:
- v1.28.0
- v1.27.3
- v1.26.6
- v1.31.1
- v1.30.4
- v1.29.8
integrationtest:
- ${{ fromJson(needs.build-matrix.outputs.integrationtests) }}
@@ -294,7 +295,7 @@ jobs:
# Only build a kind cluster if there are chart changes to test.
with:
version: ${{ env.KIND_VERSION }}
node_image: kindest/node:v1.26.4
node_image: kindest/node:${{ matrix.k8s }}
config: .github/kind/conf/kind-config.yaml
verbosity: 1
@@ -314,9 +315,9 @@ jobs:
fail-fast: false
matrix:
k8s:
- v1.28.0
- v1.27.3
- v1.26.6
- v1.31.1
- v1.30.4
- v1.29.8
steps:
- name: Checkout
@@ -337,7 +338,7 @@ jobs:
# Only build a kind cluster if there are chart changes to test.
with:
version: ${{ env.KIND_VERSION }}
node_image: kindest/node:v1.26.4
node_image: kindest/node:${{ matrix.k8s }}
config: .github/kind/conf/kind-config.yaml
verbosity: 1