panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add a FAQ and switch rare issue from README to it (#437)

Browse Source 
fixes https://github.com/spiffe/helm-charts/issues/433
closes #385

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
2023-08-15 09:42:51 -07:00
committed by GitHub
co-authored by Marco Franssen Faisal Memon
parent e60f5287e0
commit a52818a72e
3 changed files with 54 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+2 -23
View File
@@ -23,29 +23,8 @@ A Helm chart for deploying the complete Spire stack including: spire-server, spi
> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden.
## Prerequisites
Please note this chart requires `Projected Service Account Tokens` which has to be enabled on your k8s api server.
To enable Projected Service Account Tokens on Docker for Mac/Windows run the following
command to SSH into the Docker Desktop K8s VM.
```bash
docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh
```
Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml`
```yaml
spec:
containers:
- command:
- kube-apiserver
- --api-audiences=api,spire-server
- --service-account-issuer=api,spire-agent
- --service-account-key-file=/run/config/pki/sa.pub
- --service-account-signing-key-file=/run/config/pki/sa.key
```
## FAQ
For any issues see our [FAQ](../../FAQ.md)…
## Usage
charts/spire/README.md.gotmpl
+2 -23
View File
@@ -25,29 +25,8 @@
> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden.
## Prerequisites
Please note this chart requires `Projected Service Account Tokens` which has to be enabled on your k8s api server.
To enable Projected Service Account Tokens on Docker for Mac/Windows run the following
command to SSH into the Docker Desktop K8s VM.
```bash
docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh
```
Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml`
```yaml
spec:
containers:
- command:
- kube-apiserver
- --api-audiences=api,spire-server
- --service-account-issuer=api,spire-agent
- --service-account-key-file=/run/config/pki/sa.pub
- --service-account-signing-key-file=/run/config/pki/sa.key
```
## FAQ
For any issues see our [FAQ](../../FAQ.md)…
## Usage