diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 9380d37..6a780ca 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,16 +2,16 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "81.2.2" + "version": "82.4.3" }, { "name": "cert-manager", "repo": "https://charts.jetstack.io", - "version": "v1.19.2" + "version": "v1.19.4" }, { "name": "ingress-nginx", "repo": "https://kubernetes.github.io/ingress-nginx", - "version": "4.14.1" + "version": "4.14.3" } ] diff --git a/.github/tests/oci-charts.json b/.github/tests/oci-charts.json index 9c926ea..3b39d39 100644 --- a/.github/tests/oci-charts.json +++ b/.github/tests/oci-charts.json @@ -2,16 +2,16 @@ { "name": "mariadb", "registry": "docker.io/bitnamicharts/mariadb", - "version": "24.0.3" + "version": "25.0.1" }, { "name": "postgresql", "registry": "docker.io/bitnamicharts/postgresql", - "version": "18.2.3" + "version": "18.5.1" }, { "name": "envoy-gateway", "registry": "docker.io/envoyproxy/gateway-helm", - "version": "v1.6.2" + "version": "v1.7.0" } ] diff --git a/.github/workflows/helm-chart-ci-ignore.yaml b/.github/workflows/helm-chart-ci-ignore.yaml index 68950d1..733a5bb 100644 --- a/.github/workflows/helm-chart-ci-ignore.yaml +++ b/.github/workflows/helm-chart-ci-ignore.yaml @@ -30,9 +30,9 @@ jobs: strategy: matrix: k8s: - - v1.31.1 - - v1.30.4 - - v1.29.8 + - v1.33.7 + - v1.34.3 + - v1.35.1 steps: - run: 'echo "Skipping tests"' @@ -74,9 +74,9 @@ jobs: strategy: matrix: k8s: - - v1.31.1 - - v1.30.4 - - v1.29.8 + - v1.33.7 + - v1.34.3 + - v1.35.1 example: - ${{ fromJson(needs.build-matrix.outputs.examples) }} @@ -92,9 +92,9 @@ jobs: strategy: matrix: k8s: - - v1.31.1 - - v1.30.4 - - v1.29.8 + - v1.33.7 + - v1.34.3 + - v1.35.1 example: - ${{ fromJson(needs.build-matrix.outputs.integrationtests) }} @@ -110,9 +110,9 @@ jobs: strategy: matrix: k8s: - - v1.31.1 - - v1.30.4 - - v1.29.8 + - v1.33.7 + - v1.34.3 + - v1.35.1 steps: - run: 'echo "Skipping upgrade-test"' diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index fed25b5..f531d50 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -2,6 +2,11 @@ name: Helm Chart CI on: workflow_dispatch: + inputs: + target_branch: + description: 'Target branch to lint/test against (e.g. main, release)' + required: false + default: 'main' pull_request: types: [synchronize, opened, reopened] paths: @@ -114,7 +119,7 @@ jobs: version: ${{ env.CHART_TESTING_VERSION }} - name: Run chart-testing (lint) - run: TARGET_BRANCH=${{ github.base_ref }} make lint${{ github.base_ref == 'release' && '-release' || '' }} + run: TARGET_BRANCH=${{ github.base_ref || inputs.target_branch }} make lint${{ (github.base_ref == 'release' || inputs.target_branch == 'release') && '-release' || '' }} test: runs-on: ubuntu-22.04 @@ -130,9 +135,9 @@ jobs: # Kubernetes, but can go back farther as long as we don't need heroics # to pull it off (i.e. kubectl version juggling). k8s: - - v1.31.1 - - v1.30.4 - - v1.29.8 + - v1.33.7 + - v1.34.3 + - v1.35.1 steps: - name: Checkout @@ -172,7 +177,7 @@ jobs: run: | helm install -n spire-server spire-crds charts/spire-crds ct install --config ct.yaml --excluded-charts spire-crds,spiffe-step-ssh \ - --target-branch ${{ github.base_ref }} + --target-branch ${{ github.base_ref || inputs.target_branch }} - name: Test summary if: always() @@ -218,9 +223,9 @@ jobs: fail-fast: false matrix: k8s: - - v1.31.1 - - v1.30.4 - - v1.29.8 + - v1.33.7 + - v1.34.3 + - v1.35.1 example: - ${{ fromJson(needs.build-matrix.outputs.examples) }} @@ -270,9 +275,9 @@ jobs: fail-fast: false matrix: k8s: - - v1.31.1 - - v1.30.4 - - v1.29.8 + - v1.33.7 + - v1.34.3 + - v1.35.1 integrationtest: - ${{ fromJson(needs.build-matrix.outputs.integrationtests) }} @@ -315,9 +320,9 @@ jobs: fail-fast: false matrix: k8s: - - v1.31.1 - - v1.30.4 - - v1.29.8 + - v1.33.7 + - v1.34.3 + - v1.35.1 steps: - name: Checkout diff --git a/charts/spire-nested/Chart.yaml b/charts/spire-nested/Chart.yaml index 4818038..cd748c0 100644 --- a/charts/spire-nested/Chart.yaml +++ b/charts/spire-nested/Chart.yaml @@ -3,7 +3,7 @@ name: spire-nested description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.28.1 +version: 0.28.2 appVersion: "1.14.1" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire diff --git a/charts/spire-nested/README.md b/charts/spire-nested/README.md index dc752c3..dd84abb 100644 --- a/charts/spire-nested/README.md +++ b/charts/spire-nested/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.28.1](https://img.shields.io/badge/Version-0.28.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.1](https://img.shields.io/badge/AppVersion-1.14.1-informational?style=flat-square) +![Version: 0.28.2](https://img.shields.io/badge/Version-0.28.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.1](https://img.shields.io/badge/AppVersion-1.14.1-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 6e16f03..4407dc1 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -3,7 +3,7 @@ name: spire description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.28.1 +version: 0.28.2 appVersion: "1.14.1" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire diff --git a/charts/spire/README.md b/charts/spire/README.md index 75aac9d..61bdf81 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.28.1](https://img.shields.io/badge/Version-0.28.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.1](https://img.shields.io/badge/AppVersion-1.14.1-informational?style=flat-square) +![Version: 0.28.2](https://img.shields.io/badge/Version-0.28.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.1](https://img.shields.io/badge/AppVersion-1.14.1-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. @@ -273,6 +273,7 @@ Now you can interact with the Spire agent socket from your own application. The | Name | Description | Value | | ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | +| `global.imagePullSecrets` | Image pull secret names | `[]` | | `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` | | `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` | | `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` | diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index 90460dc..d09ccf6 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -51,6 +51,7 @@ A Helm chart to install the SPIFFE CSI driver. | `serviceAccount.annotations` | Annotations to add to the service account | `{}` | | `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | | `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` | +| `podLabels` | Labels to add to pods | `{}` | | `podSecurityContext` | Security context for CSI driver pods | `{}` | | `securityContext` | Security context for CSI driver containers | `{}` | | `nodeSelector` | Node selector for CSI driver pods | `{}` | @@ -72,5 +73,5 @@ A Helm chart to install the SPIFFE CSI driver. | `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` | | `selinux.image.repository` | The repository within the registry | `ubi9` | | `selinux.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1769057030` | +| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1771346757` | diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml index ba97d12..54ceb44 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -31,8 +31,11 @@ spec: {{- end }} labels: {{- include "spiffe-csi-driver.selectorLabels" . | nindent 8 }} + {{- with .Values.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index 79c7863..b199b0a 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -91,6 +91,9 @@ serviceAccount: ## @param podAnnotations [object] Pod annotations for spiffe-csi-driver podAnnotations: {} +## @param podLabels [object] Labels to add to pods +podLabels: {} + ## @param podSecurityContext [object] Security context for CSI driver pods podSecurityContext: {} # fsGroup: 2000 @@ -163,4 +166,4 @@ selinux: registry: registry.access.redhat.com repository: ubi9 pullPolicy: IfNotPresent - tag: 9.7-1769057030 + tag: 9.7-1771346757 diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index ac6dac0..6dfe1d3 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -60,6 +60,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | | `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | | `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` | +| `podLabels` | Labels to add to pods | `{}` | | `tls.spire.enabled` | Use spire to secure the oidc-discovery-provider | `true` | | `tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` | | `tls.externalSecret.secretName` | Specify which Secret to use | `""` | @@ -75,11 +76,12 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from. Only used when TLS is disabled. | `docker.io` | | `insecureScheme.nginx.image.repository` | The repository within the registry. Only used when TLS is disabled. | `nginxinc/nginx-unprivileged` | | `insecureScheme.nginx.image.pullPolicy` | The image pull policy. Only used when TLS is disabled. | `IfNotPresent` | -| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.29.3-alpine` | +| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.29.5-alpine` | | `insecureScheme.nginx.ipMode` | IP modes supported by the cluster. Must be one of [ipv4, ipv6, both] | `both` | | `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | | `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` | | `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | +| `config.logFormat` | The log format, valid values are "text" and "json" | `text` | | `config.jwtDomain` | The JWT domain. Defaults to oidc-discovery.$jwtIssuer URL-parsed host if unset | `""` | | `config.jwksUri` | The JWKS URI | `""` | | `config.serverPathPrefix` | If specified, all endpoints listened to will be prefixed by this value | `""` | @@ -125,11 +127,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0ba70a117710f95ba7d7a9ad0932e920c2785c1bb244ca858cd6445e4526e1f4` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml index 1e7d23d..a423778 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml @@ -21,6 +21,7 @@ {{- $oidcSocket := .oidcSocket }} {{- with .root }} log_level: {{ .Values.config.logLevel | quote }} +log_format: {{ .Values.config.logFormat | quote }} domains: - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}" diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml index 07420bf..044a3b7 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -30,8 +30,11 @@ spec: release: {{ .Release.Name }} release-namespace: {{ .Release.Namespace }} component: oidc-discovery-provider + {{- with .Values.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml index dd64a4a..82986de 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml @@ -57,6 +57,10 @@ spec: name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}-pre-delete spec: restartPolicy: Never + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete securityContext: {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index ea02bd1..c9a3cbd 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -125,6 +125,9 @@ livenessProbe: ## @param podAnnotations [object] Pod annotations for Spire OIDC discovery provider podAnnotations: {} +## @param podLabels [object] Labels to add to pods +podLabels: {} + # Select from one of the options below to be the source of certificates for OIDC Discovery Provider. # If none are enabled, connections won't be TLS encrypted. tls: @@ -184,7 +187,7 @@ insecureScheme: registry: docker.io repository: nginxinc/nginx-unprivileged pullPolicy: IfNotPresent - tag: 1.29.3-alpine + tag: 1.29.5-alpine ## @param insecureScheme.nginx.ipMode IP modes supported by the cluster. Must be one of [ipv4, ipv6, both] ipMode: both ## @param insecureScheme.nginx.resources Resource requests and limits @@ -206,6 +209,8 @@ jwtIssuer: "" config: ## @param config.logLevel The log level, valid values are "debug", "info", "warn", and "error" logLevel: info + ## @param config.logFormat The log format, valid values are "text" and "json" + logFormat: text ## @param config.jwtDomain [string] The JWT domain. Defaults to oidc-discovery.$jwtIssuer URL-parsed host if unset jwtDomain: "" ## @param config.jwksUri [string] The JWKS URI @@ -356,7 +361,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507 + tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -368,7 +373,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:0ba70a117710f95ba7d7a9ad0932e920c2785c1bb244ca858cd6445e4526e1f4 + tag: latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275 step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spike-keeper/templates/statefulset.yaml b/charts/spire/charts/spike-keeper/templates/statefulset.yaml index 6af56c0..40f7e3c 100644 --- a/charts/spire/charts/spike-keeper/templates/statefulset.yaml +++ b/charts/spire/charts/spike-keeper/templates/statefulset.yaml @@ -19,7 +19,7 @@ spec: release-namespace: {{ .Release.Namespace }} component: spike-keeper spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml b/charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml index b272d44..c46cb3a 100644 --- a/charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml +++ b/charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml @@ -68,6 +68,10 @@ spec: component: spike-bootstrap spec: restartPolicy: Never + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} serviceAccountName: {{ include "spike-nexus.serviceAccountName" . }}-bootstrap securityContext: {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} diff --git a/charts/spire/charts/spike-nexus/templates/statefulset.yaml b/charts/spire/charts/spike-nexus/templates/statefulset.yaml index 638998a..2483172 100644 --- a/charts/spire/charts/spike-nexus/templates/statefulset.yaml +++ b/charts/spire/charts/spike-nexus/templates/statefulset.yaml @@ -18,7 +18,7 @@ spec: release-namespace: {{ .Release.Namespace }} component: spike-nexus spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/spike-pilot/templates/deployment.yaml b/charts/spire/charts/spike-pilot/templates/deployment.yaml index f6f8a8f..1417fa0 100644 --- a/charts/spire/charts/spike-pilot/templates/deployment.yaml +++ b/charts/spire/charts/spike-pilot/templates/deployment.yaml @@ -18,7 +18,7 @@ spec: release-namespace: {{ .Release.Namespace }} component: spike-pilot spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index db3c36f..9e7d4d2 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -25,131 +25,133 @@ A Helm chart to install the SPIRE agent. ### Chart parameters -| Name | Description | Value | -| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | -| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `image.repository` | The repository within the registry | `spiffe/spire-agent` | -| `image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `imagePullSecrets` | Pull secrets for images | `[]` | -| `nameOverride` | Name override | `""` | -| `namespaceOverride` | Namespace override | `""` | -| `fullnameOverride` | Fullname override | `""` | -| `serviceAccount.create` | Specifies whether a service account should be created | `true` | -| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | -| `serviceAccount.name` | The name of the service account to use. | `""` | -| `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` | -| `podAnnotations` | Annotations to add to pods | `{}` | -| `podLabels` | Labels to add to pods | `{}` | -| `podSecurityContext` | Pod security context | `{}` | -| `securityContext` | Security context | `{}` | -| `resources` | Resource requests and limits for the spire-agent container and all its initContainers | `{}` | -| `nodeSelector` | Node selector | `{}` | -| `tolerations` | List of tolerations | `[]` | -| `affinity` | Node affinity | `{}` | -| `authorizedDelegates` | A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information. | `[]` | -| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | -| `logFormat` | The log format, valid values are "text" and "json" | `text` | -| `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` | -| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` | -| `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` | -| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `spiffe` | -| `trustBundleHostPath` | If set, obtain trust bundle from a file on the host instead of from the ConfigMap | `""` | -| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` | -| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` | -| `rebootstrapMode` | How the agent will behave when seeing an unknown x509 cert from the server. It can be set to never, auto, or always | `always` | -| `rebootstrapDelay` | The agent will rebootstrap after configured amount of time on unknown x509 cert from the server | `10m` | -| `server.address` | Address for Spire server | `""` | -| `server.port` | Port number for Spire server | `443` | -| `server.namespaceOverride` | Override the namespace for Spire server | `""` | -| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` | -| `healthChecks.port` | override the host port used for health checking | `9982` | -| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` | -| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` | -| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | -| `livenessProbe.periodSeconds` | Period seconds for probe | `60` | -| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` | -| `readinessProbe.periodSeconds` | Period seconds for probe | `30` | -| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | -| `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507` | -| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | -| `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | -| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | -| `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` | -| `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` | -| `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` | -| `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` | -| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` | -| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-agent` | -| `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.9.0` | -| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `22f67063f1699330e70cdedc9b923e517688f5ae71085a26bd9b83b3060ee86e` | -| `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` | -| `nodeAttestor.tpmDirect.pubHash.enabled` | Display pubhash in logs | `true` | -| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-get-tpm-pubhash` | -| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.9.0` | -| `nodeAttestor.awsIID.enabled` | Enable the aws_iid Node Attestor | `false` | -| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | -| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | -| `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` | -| `workloadAttestors.k8s.verification.hostCert.basePath` | Path where kubelet places its certificates | `/var/lib/kubelet/pki` | -| `workloadAttestors.k8s.verification.hostCert.fileName` | File name where kubelet places its certificates. If blank, it will be auto detected. | `""` | -| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` | -| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true | `true` | -| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` | -| `sds.enabled` | Enables Envoy SDS configuration | `false` | -| `sds.defaultSVIDName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` | -| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` | -| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` | -| `sds.disableSPIFFECertValidation` | Disable Envoy SDS custom validation | `false` | -| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | -| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | -| `telemetry.prometheus.host` | Host for prometheus metrics | `0.0.0.0` | -| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | -| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` | -| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | -| `telemetry.datadog.enabled` | Flag to enable datadog monitoring | `false` | -| `telemetry.datadog.address` | The address of the datadog service to send metrics to. The default URL for services are `..svc` | `datadog.kube-system.svc` | -| `telemetry.datadog.port` | The port of the datadog service to send metrics to | `8125` | -| `kubeletConnectByHostname` | (DEPRECATED) Use kubeletAddress.mode instead. If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` | -| `kubeletAddress.mode` | How to connect to kubelet for workload attestation | `auto` | -| `dnsPolicy` | dnsPolicy to assign to the DaemonSet. See valid values here: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy. If left empty, ClusterFirstWithHostNet will be used if kubeletAddress.mode does not resolve to hostip or hostname, otherwise, the default dnsPolicy will be used. | `""` | -| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | -| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` | -| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | -| `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507` | -| `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | -| `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0ba70a117710f95ba7d7a9ad0932e920c2785c1bb244ca858cd6445e4526e1f4` | -| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | -| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` | -| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | -| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` | -| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` | -| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` | -| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` | -| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` | -| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` | -| `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` | -| `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` | -| `experimental.enabled` | Allow configuration of experimental features | `false` | -| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` | -| `experimental.featureFlags` | List of developer feature flags | `[]` | -| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` | -| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | -| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` | -| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` | -| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` | -| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` | -| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` | -| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` | +| Name | Description | Value | +| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/spire-agent` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `imagePullSecrets` | Pull secrets for images | `[]` | +| `nameOverride` | Name override | `""` | +| `namespaceOverride` | Namespace override | `""` | +| `fullnameOverride` | Fullname override | `""` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. | `""` | +| `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` | +| `podAnnotations` | Annotations to add to pods | `{}` | +| `podLabels` | Labels to add to pods | `{}` | +| `podSecurityContext` | Pod security context | `{}` | +| `securityContext` | Security context | `{}` | +| `resources` | Resource requests and limits for the spire-agent container and all its initContainers | `{}` | +| `nodeSelector` | Node selector | `{}` | +| `tolerations` | List of tolerations | `[]` | +| `affinity` | Node affinity | `{}` | +| `authorizedDelegates` | A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information. | `[]` | +| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | +| `logFormat` | The log format, valid values are "text" and "json" | `text` | +| `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` | +| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` | +| `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` | +| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `spiffe` | +| `trustBundleHostPath` | If set, obtain trust bundle from a file on the host instead of from the ConfigMap | `""` | +| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` | +| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` | +| `rebootstrapMode` | How the agent will behave when seeing an unknown x509 cert from the server. It can be set to never, auto, or always | `always` | +| `rebootstrapDelay` | The agent will rebootstrap after configured amount of time on unknown x509 cert from the server | `10m` | +| `server.address` | Address for Spire server | `""` | +| `server.port` | Port number for Spire server | `443` | +| `server.namespaceOverride` | Override the namespace for Spire server | `""` | +| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` | +| `healthChecks.port` | override the host port used for health checking | `9982` | +| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` | +| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | +| `livenessProbe.periodSeconds` | Period seconds for probe | `60` | +| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` | +| `readinessProbe.periodSeconds` | Period seconds for probe | `30` | +| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | +| `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` | +| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | +| `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | +| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | +| `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` | +| `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` | +| `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` | +| `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` | +| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` | +| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-agent` | +| `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.9.0` | +| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `22f67063f1699330e70cdedc9b923e517688f5ae71085a26bd9b83b3060ee86e` | +| `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` | +| `nodeAttestor.tpmDirect.pubHash.enabled` | Display pubhash in logs | `true` | +| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-get-tpm-pubhash` | +| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.9.0` | +| `nodeAttestor.awsIID.enabled` | Enable the aws_iid Node Attestor | `false` | +| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | +| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | +| `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` | +| `workloadAttestors.k8s.verification.hostCert.basePath` | Path where kubelet places its certificates | `/var/lib/kubelet/pki` | +| `workloadAttestors.k8s.verification.hostCert.fileName` | File name where kubelet places its certificates. If blank, it will be auto detected. | `""` | +| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` | +| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true | `true` | +| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` | +| `sds.enabled` | Enables Envoy SDS configuration | `false` | +| `sds.defaultSVIDName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` | +| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` | +| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` | +| `sds.disableSPIFFECertValidation` | Disable Envoy SDS custom validation | `false` | +| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | +| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | +| `telemetry.prometheus.host` | Host for prometheus metrics | `0.0.0.0` | +| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | +| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` | +| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | +| `telemetry.datadog.enabled` | Flag to enable datadog monitoring | `false` | +| `telemetry.datadog.address` | The address of the datadog service to send metrics to. The default URL for services are `..svc` | `datadog.kube-system.svc` | +| `telemetry.datadog.port` | The port of the datadog service to send metrics to | `8125` | +| `kubeletConnectByHostname` | (DEPRECATED) Use kubeletAddress.mode instead. If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` | +| `kubeletAddress.mode` | How to connect to kubelet for workload attestation | `auto` | +| `hostNetwork` | Enable hostNetwork for the DaemonSet. If auto or empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. | `""` | +| `dnsPolicy` | DNS policy for the DaemonSet. If empty, uses ClusterFirstWithHostNet when hostNetwork is enabled. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy | `""` | +| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | +| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` | +| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | +| `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` | +| `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | +| `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275` | +| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | +| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` | +| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | +| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` | +| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` | +| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` | +| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` | +| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` | +| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` | +| `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` | +| `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` | +| `experimental.enabled` | Allow configuration of experimental features | `false` | +| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` | +| `experimental.requirePQKEM` | Require use of a post-quantum-safe key exchange method for TLS handshakes. | `false` | +| `experimental.featureFlags` | List of developer feature flags | `[]` | +| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` | +| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | +| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` | +| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` | +| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` | +| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` | +| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` | +| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 77c15ac..77be88f 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -77,6 +77,7 @@ agent: {{- if eq (.enabled | toString) "true" }} experimental: sync_interval: {{ .syncInterval | quote }} + require_pq_kem: {{ .requirePQKEM }} {{- if gt (len .featureFlags) 0 }} feature_flags: {{- range .featureFlags }} diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 4954d50..83a194b 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -29,9 +29,14 @@ {{- end }} {{- $resolvedMode := include "spire-agent.kubelet-address-mode-resolved" . }} {{- $cbh := or (eq $resolvedMode "hostname") (eq $resolvedMode "hostip") }} +{{- $hostNetwork := not $cbh }} +{{- $hostNetworkValue := .Values.hostNetwork | toString }} +{{- if and (ne $hostNetworkValue "") (ne $hostNetworkValue "auto") }} +{{- $hostNetwork = eq $hostNetworkValue "true" }} +{{- end }} {{- $dnsPolicy := .Values.dnsPolicy }} -{{- if (and (eq $dnsPolicy "") (not $cbh)) }} -{{- $dnsPolicy = "ClusterFirstWithHostNet" }} +{{- if (and (eq $dnsPolicy "") $hostNetwork) }} +{{- $dnsPolicy = "ClusterFirstWithHostNet" }} {{- end }} {{- $socketAlternateNames := index (include "spire-agent.socket-alternate-names" . | fromYaml) "names" }} {{- $socketPath := include "spire-agent.socket-path" . }} @@ -75,12 +80,12 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} hostPID: true - {{- if not $cbh }} + {{- if $hostNetwork }} hostNetwork: true {{- end }} {{- if ne $dnsPolicy "" }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 05829df..75a93a2 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -159,7 +159,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507 + tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a keyManager: memory: @@ -294,7 +294,9 @@ kubeletAddress: ## provided at runtime or SPIRE agent will fail to start. mode: auto -## @param dnsPolicy [string] dnsPolicy to assign to the DaemonSet. See valid values here: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy. If left empty, ClusterFirstWithHostNet will be used if kubeletAddress.mode does not resolve to hostip or hostname, otherwise, the default dnsPolicy will be used. +## @param hostNetwork [string] Enable hostNetwork for the DaemonSet. If auto or empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. +hostNetwork: auto +## @param dnsPolicy [string] DNS policy for the DaemonSet. If empty, uses ClusterFirstWithHostNet when hostNetwork is enabled. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy dnsPolicy: "" ## @param socketPath The unix socket path to the spire-agent socketPath: /run/spire/agent-sockets/spire-agent.sock @@ -315,7 +317,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507 + tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a hostCert: ## @param hostCert.image.registry The OCI registry to pull the image from @@ -327,7 +329,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:0ba70a117710f95ba7d7a9ad0932e920c2785c1bb244ca858cd6445e4526e1f4 + tag: latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275 ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. priorityClassName: "" @@ -374,6 +376,8 @@ experimental: enabled: false ## @param experimental.syncInterval Sync interval with SPIRE server with exponential backoff syncInterval: 5s + ## @param experimental.requirePQKEM Require use of a post-quantum-safe key exchange method for TLS handshakes. + requirePQKEM: false ## @param experimental.featureFlags [array] List of developer feature flags featureFlags: [] diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 118b549..fa4e9b3 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -110,6 +110,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `autoscaling.enabled` | Flag to enable autoscaling | `false` | | `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` | | `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` | +| `autoscaling.scaleOnSPIREServerOnly` | Flag to only consider the main SPIRE container for autoscaling purposes | `false` | | `autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization that triggers autoscaling | `80` | | `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` | | `tolerations` | List of tolerations | `[]` | @@ -142,7 +143,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` | | `dataStore.sql.maxOpenConns` | The maximum number of open db connections | `100` | | `dataStore.sql.maxIdleConns` | The maximum number of idle connections in the pool | `2` | -| `dataStore.sql.connMaxLifetime` | The maximum amount of time a connection may be reused. If 0, time is unlimited | `0` | +| `dataStore.sql.connMaxLifetime` | The maximum amount of time a connection may be reused. Supports duration strings (e.g., "1h", "30m", "3600s") or 0 for unlimited. Duration strings are recommended to prevent connection accumulation. | `0` | | `dataStore.sql.disableMigration` | True to disable auto-migration functionality | `false` | | `dataStore.sql.region` | Region to use when database type is either aws_mysql or aws_postgresql | `""` | | `dataStore.sql.readOnly.enabled` | Set to true to configure a readOnly dartabase connection | `false` | @@ -157,6 +158,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `adminIDs` | SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges. | `[]` | | `auditLogEnabled` | If true, enables audit logging | `false` | | `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | +| `logFormat` | The log format, valid values are "text" and "json" | `text` | | `jwtIssuer` | The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset | `""` | | `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` | | `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | @@ -275,6 +277,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.addEntryIDPrefix` | If true, prepends the clusterName to the entryID of each entry the controller manager registers. | `true` | | `controllerManager.gcInterval` | How often the SPIRE state is reconciled when the controller is otherwise idle. This impacts how quickly SPIRE state will converge after CRDs are removed or SPIRE state is mutated underneath the controller. Values are in nanoseconds. | `10000000000` | | `controllerManager.logLevel` | The log level for the controller manager. Supported values are info, error, warn and debug. | `info` | +| `controllerManager.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` | +| `controllerManager.leaderElection.renewDeadline` | Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. | `10s` | +| `controllerManager.leaderElection.retryPeriod` | Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. | `2s` | | `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` | | `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` | | `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` | @@ -283,7 +288,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.2` | +| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.3` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | @@ -341,6 +346,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `externalControllerManagers.defaults.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` | | `externalControllerManagers.defaults.entryIDPrefixCleanup` | consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` | | `externalControllerManagers.defaults.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` | +| `externalControllerManagers.defaults.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` | +| `externalControllerManagers.defaults.leaderElection.renewDeadline` | Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. | `10s` | +| `externalControllerManagers.defaults.leaderElection.retryPeriod` | Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. | `2s` | | `externalControllerManagers.defaults.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` | | `externalControllerManagers.defaults.extraEnv` | Extra environment variables to add to the controller manager | `[]` | | `externalControllerManagers.defaults.resources` | Resource requests and limits for controller manager | `{}` | @@ -348,7 +356,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `externalControllerManagers.defaults.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` | | `externalControllerManagers.defaults.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` | | `externalControllerManagers.defaults.cacheNamespaces` | If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. | `{}` | -| `externalControllerManagers.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` | +| `externalControllerManagers.clusters` | A dictionary of clusters to add with optional overrides (kubeConfigName, reconcile, healthPortName, prometheusPortName). If empty, all clusters defined in kubeConfigs will be used. | `{}` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | | `tools.kubectl.image.repository` | The repository within the registry | `kubectl` | | `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | @@ -491,6 +499,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | | `experimental.eventsBasedCache` | Use events to update the cache with what's changed since the last update. | `false` | | `experimental.pruneEventsOlderThan` | How old an event can be before being deleted. Used with events based cache. | `12h` | +| `experimental.requirePQKEM` | Require use of a post-quantum-safe key exchange method for TLS handshakes. | `false` | | `experimental.featureFlags` | List of developer feature flags | `[]` | | `experimental.authOpaPolicyEngine` | The [auth opa_policy engine](https://github.com/spiffe/spire/blob/main/doc/authorization_policy_engine.md) used for authorization decisions. Defaults to the default SPIRE authorization policy. | `{}` | | `experimental.authOpaPolicyEngine.local.policy_data` | A JSON blob that defines additional data that can be used in the rego policy. | `""` | @@ -501,5 +510,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/templates/_controller-manager-container.tpl b/charts/spire/charts/spire-server/templates/_controller-manager-container.tpl index 5ce76c3..2b56b78 100644 --- a/charts/spire/charts/spire-server/templates/_controller-manager-container.tpl +++ b/charts/spire/charts/spire-server/templates/_controller-manager-container.tpl @@ -13,7 +13,7 @@ {{- if or .Values.controllerManager.reconcile.clusterSPIFFEIDs .Values.controllerManager.reconcile.clusterStaticEntries }} {{- $reconcileEntries = add $reconcileEntries 1 }} {{- end }} -{{- include "spire-controller-manager.container" (dict "Values" .Values "Chart" .Chart "startPort" $startPort "suffix" "" "settings" $settings "defaults" $defaults "webhooksEnabled" $webhooksEnabled) }} +{{- include "spire-controller-manager.container" (dict "Values" .Values "Chart" .Chart "startPort" $startPort "suffix" "" "portSuffix" "" "healthPortName" "" "prometheusPortName" "" "settings" $settings "defaults" $defaults "webhooksEnabled" $webhooksEnabled) }} {{- end }} {{- if .Values.externalControllerManagers.enabled }} {{- $clusters := default .Values.kubeConfigs .Values.externalControllerManagers.clusters }} @@ -23,7 +23,43 @@ {{- if hasKey $root.Values.externalControllerManagers.clusters $name }} {{- $clusterSettings = index $root.Values.externalControllerManagers.clusters $name }} {{- end }} + +{{/* +Generate port names for controller-manager ports. +Can be explicitly set via healthPortName and prometheusPortName in cluster configuration. +Otherwise uses default prefixes (hp-cm/pm-cm) with auto-generated suffixes. +Auto-generation preserves trailing numbers from cluster names or uses hash for uniqueness. +*/}} {{- $suffix := printf "-%s" $name }} +{{- $portSuffix := $suffix }} +{{- $healthPortName := "" }} +{{- $prometheusPortName := "" }} +{{- if hasKey $clusterSettings "healthPortName" }} +{{- $healthPortName = $clusterSettings.healthPortName }} +{{- end }} +{{- if hasKey $clusterSettings "prometheusPortName" }} +{{- $prometheusPortName = $clusterSettings.prometheusPortName }} +{{- end }} +{{- if or (eq $healthPortName "") (eq $prometheusPortName "") }} +{{- if gt (len $name) 9 }} +{{- $numberMatch := regexFind "[-]?[0-9]{1,2}$" $name }} +{{- if $numberMatch }} +{{- $numLen := len $numberMatch }} +{{- $baseLen := sub (len $name) $numLen | int }} +{{- $baseName := substr 0 $baseLen $name }} +{{- if not (hasPrefix "-" $numberMatch) }} +{{- $numberMatch = printf "-%s" $numberMatch }} +{{- end }} +{{- $maxBase := sub 9 (len $numberMatch) | int }} +{{- $baseName = $baseName | trunc $maxBase | trimSuffix "-" }} +{{- $portSuffix = printf "-%s%s" $baseName $numberMatch }} +{{- else }} +{{- $hash := sha256sum $name | trunc 3 }} +{{- $portSuffix = printf "-%s-%s" ($name | trunc 5 | trimSuffix "-") $hash }} +{{- end }} +{{- end }} +{{- end }} + {{- $startPort = add $startPort 2 }} {{- $kubeConfig := $name }} {{- if hasKey $clusterSettings "kubeConfigName" }} @@ -41,7 +77,7 @@ {{- if gt $reconcileFederation 1 }} {{- fail "You can only have one controller-manager with reconcile.clusterFederatedTrustDomains set to true" }} {{- end }} -{{- include "spire-controller-manager.container" (dict "Values" $root.Values "Chart" $root.Chart "startPort" $startPort "suffix" $suffix "settings" $clusterSettings "defaults" $clusterDefaults "webhooksEnabled" false "kubeConfig" $kubeConfig ) }} +{{- include "spire-controller-manager.container" (dict "Values" $root.Values "Chart" $root.Chart "startPort" $startPort "suffix" $suffix "portSuffix" $portSuffix "healthPortName" $healthPortName "prometheusPortName" $prometheusPortName "settings" $clusterSettings "defaults" $clusterDefaults "webhooksEnabled" false "kubeConfig" $kubeConfig ) }} {{- end }} {{- end }} {{- end }} @@ -83,27 +119,37 @@ {{- if gt (len $extraEnv) 0 }} {{- $extraEnv | toYaml | nindent 4 }} {{- end }} + {{/* Port names: hp-cm (health), pm-cm (prometheus) - abbreviated for 15 char limit */}} + {{/* Can be overridden via healthPortName and prometheusPortName in cluster config */}} ports: {{- if .webhooksEnabled }} - name: https containerPort: 9443 protocol: TCP {{- end }} + {{- $hpName := .healthPortName }} + {{- if eq $hpName "" }} + {{- $hpName = printf "hp-cm%s" .portSuffix }} + {{- end }} - containerPort: {{ $healthPort }} - name: healthz + name: {{ $hpName }} {{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }} + {{- $pmName := .prometheusPortName }} + {{- if eq $pmName "" }} + {{- $pmName = printf "pm-cm%s" .portSuffix }} + {{- end }} - containerPort: {{ $promPort }} - name: prom-cm{{ .suffix }} + name: {{ $pmName }} {{- end }} {{- if eq .Values.controllerManager.staticManifestMode "off" }} livenessProbe: httpGet: path: /healthz - port: healthz + port: {{ $hpName }} readinessProbe: httpGet: path: /readyz - port: healthz + port: {{ $hpName }} {{- end }} resources: {{- toYaml .Values.controllerManager.resources | nindent 4 }} diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 573069b..701187c 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -52,6 +52,9 @@ server: trust_domain: {{ include "spire-lib.trust-domain" . | quote }} data_dir: "/run/spire/data" log_level: {{ .Values.logLevel | quote }} + {{- if .Values.logFormat }} + log_format: {{ .Values.logFormat | quote }} + {{- end }} jwt_issuer: {{ include "spire-lib.jwt-issuer" . | quote }} audit_log_enabled: {{ .Values.auditLogEnabled }} @@ -102,6 +105,7 @@ server: cache_reload_interval: {{ .cacheReloadInterval | quote }} events_based_cache: {{ .eventsBasedCache }} prune_events_older_than: {{ .pruneEventsOlderThan | quote }} + require_pq_kem: {{ .requirePQKEM }} {{- if gt (len .featureFlags) 0 }} feature_flags: {{- range .featureFlags }} @@ -150,7 +154,7 @@ plugins: {{- end }} max_open_conns: {{ .Values.dataStore.sql.maxOpenConns }} max_idle_conns: {{ .Values.dataStore.sql.maxIdleConns }} - {{- if ne (int .Values.dataStore.sql.connMaxLifetime) 0 }} + {{- if and .Values.dataStore.sql.connMaxLifetime (ne (toString .Values.dataStore.sql.connMaxLifetime) "0") }} conn_max_lifetime: {{ .Values.dataStore.sql.connMaxLifetime }} {{- end }} disable_migration: {{ .Values.dataStore.sql.disableMigration }} @@ -295,6 +299,8 @@ plugins: {{- end }} {{- end }} +{{- $keyManagerUsed = add $keyManagerUsed (len .Values.unsupportedBuiltInPlugins.keyManager) }} + {{- if ne $keyManagerUsed 1 }} {{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml index de33c1b..23906c7 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -54,6 +54,9 @@ leaderElection: leaderElect: true resourceName: {{ printf "%s-%s%s" .Release.Namespace (default .Release.Name .Values.crNameOverride) .suffix | sha256sum | trunc 8 }}.spiffe.io resourceNamespace: {{ include "spire-server.namespace" . }} + leaseDuration: {{ .defaults.leaderElection.leaseDuration }} + renewDeadline: {{ .defaults.leaderElection.renewDeadline }} + retryPeriod: {{ .defaults.leaderElection.retryPeriod }} {{- end }} {{- with .settings.cacheNamespaces }} cacheNamespaces: diff --git a/charts/spire/charts/spire-server/templates/hpa.yaml b/charts/spire/charts/spire-server/templates/hpa.yaml index 7fd457a..5d0eb5f 100644 --- a/charts/spire/charts/spire-server/templates/hpa.yaml +++ b/charts/spire/charts/spire-server/templates/hpa.yaml @@ -23,17 +23,31 @@ spec: maxReplicas: {{ .Values.autoscaling.maxReplicas }} metrics: {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} + {{- if .Values.autoscaling.scaleOnSPIREServerOnly }} + - type: ContainerResource + {{- else }} - type: Resource + {{- end }} resource: name: memory + {{- if .Values.autoscaling.scaleOnSPIREServerOnly }} + container: {{ .Chart.Name }} + {{- end }} target: type: Utilization averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} {{- end }} {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} + {{- if .Values.autoscaling.scaleOnSPIREServerOnly }} + - type: ContainerResource + {{- else }} - type: Resource + {{- end }} resource: name: cpu + {{- if .Values.autoscaling.scaleOnSPIREServerOnly }} + container: {{ .Chart.Name }} + {{- end }} target: type: Utilization averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} diff --git a/charts/spire/charts/spire-server/templates/podmonitor.yaml b/charts/spire/charts/spire-server/templates/podmonitor.yaml index 3e736df..d73034c 100644 --- a/charts/spire/charts/spire-server/templates/podmonitor.yaml +++ b/charts/spire/charts/spire-server/templates/podmonitor.yaml @@ -21,6 +21,7 @@ spec: {{- include "spire-server.selectorLabels" . | nindent 6 }} podMetricsEndpoints: - port: prom + - port: prom-cm {{- if ne $namespace $podNamespace }} namespaceSelector: kubernetes.io/metadata.name: {{ $podNamespace }} diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml index 325fbef..ed00051 100644 --- a/charts/spire/charts/spire-server/templates/post-install-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml @@ -58,7 +58,15 @@ spec: metadata: name: {{ include "spire-server.fullname" . }}-post-install spec: + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} restartPolicy: Never + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-install securityContext: {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml index 309b63c..fb42cfb 100644 --- a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml @@ -58,7 +58,15 @@ spec: metadata: name: {{ include "spire-server.fullname" . }}-post-upgrade spec: + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} restartPolicy: Never + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-upgrade securityContext: {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} diff --git a/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml index 6af0a89..20b0666 100644 --- a/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml @@ -61,7 +61,15 @@ spec: metadata: name: {{ include "spire-server.fullname" . }}-pre-delete spec: + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} restartPolicy: Never + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-delete securityContext: {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml index ee92e0d..18a5bc6 100644 --- a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml @@ -58,7 +58,15 @@ spec: metadata: name: {{ include "spire-server.fullname" . }}-pre-upgrade spec: + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} restartPolicy: Never + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-upgrade securityContext: {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} diff --git a/charts/spire/charts/spire-server/templates/server-resource.yaml b/charts/spire/charts/spire-server/templates/server-resource.yaml index f790eff..b8e7422 100644 --- a/charts/spire/charts/spire-server/templates/server-resource.yaml +++ b/charts/spire/charts/spire-server/templates/server-resource.yaml @@ -112,7 +112,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 2ed50f8..19f3299 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -103,12 +103,14 @@ resources: {} ## @param autoscaling.enabled Flag to enable autoscaling ## @param autoscaling.minReplicas Minimum replicas for autoscaling ## @param autoscaling.maxReplicas Maximum replicas for autoscaling +## @param autoscaling.scaleOnSPIREServerOnly Flag to only consider the main SPIRE container for autoscaling purposes ## @param autoscaling.targetCPUUtilizationPercentage Target CPU utilization that triggers autoscaling ## autoscaling: enabled: false minReplicas: 1 maxReplicas: 100 + scaleOnSPIREServerOnly: false targetCPUUtilizationPercentage: 80 # targetMemoryUtilizationPercentage: 80 @@ -194,7 +196,7 @@ dataStore: maxOpenConns: 100 ## @param dataStore.sql.maxIdleConns The maximum number of idle connections in the pool maxIdleConns: 2 - ## @param dataStore.sql.connMaxLifetime The maximum amount of time a connection may be reused. If 0, time is unlimited + ## @param dataStore.sql.connMaxLifetime The maximum amount of time a connection may be reused. Supports duration strings (e.g., "1h", "30m", "3600s") or 0 for unlimited. Duration strings are recommended to prevent connection accumulation. connMaxLifetime: 0 ## @param dataStore.sql.disableMigration True to disable auto-migration functionality disableMigration: false @@ -230,6 +232,8 @@ adminIDs: [] auditLogEnabled: false ## @param logLevel The log level, valid values are "debug", "info", "warn", and "error" logLevel: info +## @param logFormat The log format, valid values are "text" and "json" +logFormat: "text" ## @param jwtIssuer The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset jwtIssuer: "" @@ -568,6 +572,14 @@ controllerManager: ## @param controllerManager.logLevel The log level for the controller manager. Supported values are info, error, warn and debug. logLevel: info + ## @param controllerManager.leaderElection.leaseDuration Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. + ## @param controllerManager.leaderElection.renewDeadline Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. + ## @param controllerManager.leaderElection.retryPeriod Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. + leaderElection: + leaseDuration: "15s" + renewDeadline: "10s" + retryPeriod: "2s" + ## @param controllerManager.parentIDTemplate The template that is used to register workloads. parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}" @@ -593,7 +605,7 @@ controllerManager: registry: ghcr.io repository: spiffe/spire-controller-manager pullPolicy: IfNotPresent - tag: "0.6.2" + tag: "0.6.3" ## @param controllerManager.resources [object] Resource requests and limits for controller manager resources: {} @@ -808,6 +820,13 @@ externalControllerManagers: entryIDPrefixCleanup: false ## @param externalControllerManagers.defaults.parentIDTemplate The template that is used to register workloads. parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}" + ## @param externalControllerManagers.defaults.leaderElection.leaseDuration Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. + ## @param externalControllerManagers.defaults.leaderElection.renewDeadline Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. + ## @param externalControllerManagers.defaults.leaderElection.retryPeriod Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. + leaderElection: + leaseDuration: "15s" + renewDeadline: "10s" + retryPeriod: "2s" ## @param externalControllerManagers.defaults.expandEnv Set to true to enable environment variable substitution of config file options expandEnv: false ## @param externalControllerManagers.defaults.extraEnv [array] Extra environment variables to add to the controller manager @@ -831,13 +850,15 @@ externalControllerManagers: ## @param externalControllerManagers.defaults.cacheNamespaces [object] If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. cacheNamespaces: {} - ## @param externalControllerManagers.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. + ## @param externalControllerManagers.clusters [object] A dictionary of clusters to add with optional overrides (kubeConfigName, reconcile, healthPortName, prometheusPortName). If empty, all clusters defined in kubeConfigs will be used. clusters: {} # clustera: # Should match the name of the config in the kubeConfigs section # kubeConfigName: foo # reconcile: # clusterStaticEntries: true + # healthPortName: "hp-clustera-01" + # prometheusPortName: "pm-clustera-01" # other: {} tools: @@ -1250,6 +1271,8 @@ experimental: eventsBasedCache: false ## @param experimental.pruneEventsOlderThan How old an event can be before being deleted. Used with events based cache. pruneEventsOlderThan: 12h + ## @param experimental.requirePQKEM Require use of a post-quantum-safe key exchange method for TLS handshakes. + requirePQKEM: false ## @param experimental.featureFlags [array] List of developer feature flags featureFlags: [] ## @param experimental.authOpaPolicyEngine [object] The [auth opa_policy engine](https://github.com/spiffe/spire/blob/main/doc/authorization_policy_engine.md) used for authorization decisions. Defaults to the default SPIRE authorization policy. @@ -1278,7 +1301,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507 + tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 76445ee..373f94e 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` | diff --git a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml index e70b5c0..9a4cfeb 100644 --- a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml +++ b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml @@ -15,7 +15,7 @@ spec: labels: {{- include "tornjak-frontend.selectorLabels" . | nindent 8 }} spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 3ca9890..3ede662 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507 + tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 1cff2cf..ceca886 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -5,6 +5,9 @@ ## Note: the parameter values specified here will override the chart level values for these parameters. ## global: + ## @param global.imagePullSecrets [array] Image pull secret names + imagePullSecrets: [] + k8s: ## @param global.k8s.clusterDomain Cluster domain name configured for Spire install clusterDomain: cluster.local diff --git a/tests/go.mod b/tests/go.mod index 4515bfd..1bf1f93 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -3,8 +3,8 @@ module github.com/spiffe/helm-charts/tests go 1.25.0 require ( - github.com/onsi/ginkgo/v2 v2.27.5 - github.com/onsi/gomega v1.39.0 + github.com/onsi/ginkgo/v2 v2.28.1 + github.com/onsi/gomega v1.39.1 helm.sh/helm/v3 v3.20.0 ) @@ -26,7 +26,7 @@ require ( github.com/gobwas/glob v0.2.3 // indirect github.com/google/gnostic-models v0.7.0 // indirect github.com/google/go-cmp v0.7.0 // indirect - github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 // indirect + github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 // indirect github.com/google/uuid v1.6.0 // indirect github.com/huandu/xstrings v1.5.0 // indirect github.com/josharian/intern v1.0.0 // indirect @@ -44,16 +44,16 @@ require ( github.com/x448/float16 v0.8.4 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect - golang.org/x/crypto v0.46.0 // indirect - golang.org/x/mod v0.31.0 // indirect - golang.org/x/net v0.48.0 // indirect + golang.org/x/crypto v0.47.0 // indirect + golang.org/x/mod v0.32.0 // indirect + golang.org/x/net v0.49.0 // indirect golang.org/x/oauth2 v0.30.0 // indirect golang.org/x/sync v0.19.0 // indirect golang.org/x/sys v0.40.0 // indirect golang.org/x/term v0.39.0 // indirect golang.org/x/text v0.33.0 // indirect golang.org/x/time v0.12.0 // indirect - golang.org/x/tools v0.40.0 // indirect + golang.org/x/tools v0.41.0 // indirect google.golang.org/protobuf v1.36.8 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/tests/go.sum b/tests/go.sum index d999970..52bff9a 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -52,8 +52,8 @@ github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7O github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= -github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 h1:EEHtgt9IwisQ2AZ4pIsMjahcegHh6rmhqxzIRQIyepY= -github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6/go.mod h1:I6V7YzU0XDpsHqbsyrghnFZLO1gwK6NPTNvmetQIk9U= +github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc= +github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI= @@ -89,10 +89,10 @@ github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFd github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= -github.com/onsi/ginkgo/v2 v2.27.5 h1:ZeVgZMx2PDMdJm/+w5fE/OyG6ILo1Y3e+QX4zSR0zTE= -github.com/onsi/ginkgo/v2 v2.27.5/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo= -github.com/onsi/gomega v1.39.0 h1:y2ROC3hKFmQZJNFeGAMeHZKkjBL65mIZcvrLQBF9k6Q= -github.com/onsi/gomega v1.39.0/go.mod h1:ZCU1pkQcXDO5Sl9/VVEGlDyp+zm0m1cmeG5TOzLgdh4= +github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI= +github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE= +github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28= +github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= @@ -133,12 +133,12 @@ go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU= -golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0= -golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI= -golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg= -golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU= -golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY= +golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8= +golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A= +golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c= +golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU= +golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o= +golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8= golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI= golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU= golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= @@ -151,8 +151,8 @@ golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE= golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8= golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE= golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg= -golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA= -golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc= +golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc= +golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg= google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc= google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=