Add validating admission policy to restrict upstream driver access (#482)

* Add validating admission policy to restrict upstream driver access Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spiffe-csi-driver/templates/policy.yaml Signed-off-by: kfox1111 <[email protected]> * Fix logic Signed-off-by: Kevin Fox <[email protected]> * Upgrade helm Signed-off-by: Kevin Fox <[email protected]> * Upgrade kind and fix node version Signed-off-by: Kevin Fox <[email protected]> * Upgrade kind and fix node version Signed-off-by: Kevin Fox <[email protected]> * Upgrade kind and fix node version Signed-off-by: Kevin Fox <[email protected]> * Upgrade kind and fix node version Signed-off-by: Kevin Fox <[email protected]> * Add version info Signed-off-by: Kevin Fox <[email protected]> * Add version info Signed-off-by: Kevin Fox <[email protected]> * Fix kind version Signed-off-by: Kevin Fox <[email protected]> * Fix kind version Signed-off-by: Kevin Fox <[email protected]> * Fix kind version Signed-off-by: Kevin Fox <[email protected]> * Fix detection Signed-off-by: Kevin Fox <[email protected]> * Just for testing... Signed-off-by: Kevin Fox <[email protected]> * Just for testing... Signed-off-by: Kevin Fox <[email protected]> * Just for testing Signed-off-by: Kevin Fox <[email protected]> * Fix policy Signed-off-by: Kevin Fox <[email protected]> * Fix policy Signed-off-by: Kevin Fox <[email protected]> * Fix policy Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spiffe-csi-driver/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
2024-10-26 07:40:29 -07:00
parent a7368eee1f
commit a360646842
9 changed files with 144 additions and 78 deletions
@@ -73,7 +73,7 @@ kubectl rollout status -n kube-system -w --timeout=1m deploy/coredns
 for cluster in child; do
  KC="${SCRIPTPATH}/kubeconfig-${cluster}"

-  kind create cluster --name "${cluster}" --kubeconfig "${SCRIPTPATH}/kubeconfig-${cluster}" --config "${SCRIPTPATH}/.test-files/${cluster}-kind-config.yaml"
+  kind create cluster --name "${cluster}" --kubeconfig "${SCRIPTPATH}/kubeconfig-${cluster}" --config "${SCRIPTPATH}/.test-files/${cluster}-kind-config.yaml" --image "kindest/node:${K8S}"
  md5sum "${KC}"
  wc -l "${KC}"

@@ -102,6 +102,7 @@ helm upgrade --install --create-namespace --namespace spire-mgmt --values "${COM
 # The check is being too pedantic.
 # shellcheck shell=bash disable=SC2043
 for cluster in child; do
+  kubectl version --kubeconfig "${SCRIPTPATH}/kubeconfig-${cluster}"
  KC="${SCRIPTPATH}/kubeconfig-${cluster}"
  kubectl --kubeconfig "${KC}" get configmap -n spire-system spire-bundle-upstream -o yaml
  kubectl --kubeconfig "${KC}" rollout restart daemonset spire-agent-downstream -n spire-system