From c620065ef67cb1651ae858dbc8eb2de243154127 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 30 Jan 2026 00:29:17 -0800 Subject: [PATCH 01/25] Bump github.com/onsi/ginkgo/v2 from 2.27.5 to 2.28.1 in /tests (#736) Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.27.5 to 2.28.1. - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](https://github.com/onsi/ginkgo/compare/v2.27.5...v2.28.1) --- updated-dependencies: - dependency-name: github.com/onsi/ginkgo/v2 dependency-version: 2.28.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- tests/go.mod | 12 ++++++------ tests/go.sum | 24 ++++++++++++------------ 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/tests/go.mod b/tests/go.mod index 4515bfd..d0ea014 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -3,7 +3,7 @@ module github.com/spiffe/helm-charts/tests go 1.25.0 require ( - github.com/onsi/ginkgo/v2 v2.27.5 + github.com/onsi/ginkgo/v2 v2.28.1 github.com/onsi/gomega v1.39.0 helm.sh/helm/v3 v3.20.0 ) @@ -26,7 +26,7 @@ require ( github.com/gobwas/glob v0.2.3 // indirect github.com/google/gnostic-models v0.7.0 // indirect github.com/google/go-cmp v0.7.0 // indirect - github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 // indirect + github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 // indirect github.com/google/uuid v1.6.0 // indirect github.com/huandu/xstrings v1.5.0 // indirect github.com/josharian/intern v1.0.0 // indirect @@ -44,16 +44,16 @@ require ( github.com/x448/float16 v0.8.4 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect - golang.org/x/crypto v0.46.0 // indirect - golang.org/x/mod v0.31.0 // indirect - golang.org/x/net v0.48.0 // indirect + golang.org/x/crypto v0.47.0 // indirect + golang.org/x/mod v0.32.0 // indirect + golang.org/x/net v0.49.0 // indirect golang.org/x/oauth2 v0.30.0 // indirect golang.org/x/sync v0.19.0 // indirect golang.org/x/sys v0.40.0 // indirect golang.org/x/term v0.39.0 // indirect golang.org/x/text v0.33.0 // indirect golang.org/x/time v0.12.0 // indirect - golang.org/x/tools v0.40.0 // indirect + golang.org/x/tools v0.41.0 // indirect google.golang.org/protobuf v1.36.8 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/tests/go.sum b/tests/go.sum index d999970..6fb324e 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -52,8 +52,8 @@ github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7O github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= -github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 h1:EEHtgt9IwisQ2AZ4pIsMjahcegHh6rmhqxzIRQIyepY= -github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6/go.mod h1:I6V7YzU0XDpsHqbsyrghnFZLO1gwK6NPTNvmetQIk9U= +github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc= +github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI= @@ -89,8 +89,8 @@ github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFd github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= -github.com/onsi/ginkgo/v2 v2.27.5 h1:ZeVgZMx2PDMdJm/+w5fE/OyG6ILo1Y3e+QX4zSR0zTE= -github.com/onsi/ginkgo/v2 v2.27.5/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo= +github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI= +github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE= github.com/onsi/gomega v1.39.0 h1:y2ROC3hKFmQZJNFeGAMeHZKkjBL65mIZcvrLQBF9k6Q= github.com/onsi/gomega v1.39.0/go.mod h1:ZCU1pkQcXDO5Sl9/VVEGlDyp+zm0m1cmeG5TOzLgdh4= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= @@ -133,12 +133,12 @@ go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU= -golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0= -golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI= -golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg= -golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU= -golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY= +golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8= +golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A= +golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c= +golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU= +golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o= +golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8= golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI= golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU= golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= @@ -151,8 +151,8 @@ golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE= golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8= golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE= golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg= -golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA= -golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc= +golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc= +golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg= google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc= google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From a7ac6a494d1820947e8c007586553afbf0e2b566 Mon Sep 17 00:00:00 2001 From: Shubham Hibare <20609766+hibare@users.noreply.github.com> Date: Sat, 31 Jan 2026 03:09:47 +0530 Subject: [PATCH 02/25] feat(spire-server): add logFormat configuration option (#735) * Add logFormat support to spire-server chart Adds the ability to configure SPIRE server log format (text or json) via the logFormat helm value. When set, it renders as log_format in the server configuration. Signed-off-by: Shubham Hibare * add default value Signed-off-by: Shubham Hibare * fix Signed-off-by: Shubham Hibare * fix Signed-off-by: Shubham Hibare --------- Signed-off-by: Shubham Hibare --- charts/spire/charts/spire-server/README.md | 1 + charts/spire/charts/spire-server/templates/configmap.yaml | 3 +++ charts/spire/charts/spire-server/values.yaml | 2 ++ 3 files changed, 6 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 118b549..3688ce4 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -157,6 +157,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `adminIDs` | SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges. | `[]` | | `auditLogEnabled` | If true, enables audit logging | `false` | | `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | +| `logFormat` | The log format, valid values are "text" and "json" | `text` | | `jwtIssuer` | The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset | `""` | | `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` | | `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 573069b..4e22858 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -52,6 +52,9 @@ server: trust_domain: {{ include "spire-lib.trust-domain" . | quote }} data_dir: "/run/spire/data" log_level: {{ .Values.logLevel | quote }} + {{- if .Values.logFormat }} + log_format: {{ .Values.logFormat | quote }} + {{- end }} jwt_issuer: {{ include "spire-lib.jwt-issuer" . | quote }} audit_log_enabled: {{ .Values.auditLogEnabled }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 2ed50f8..9db8d29 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -230,6 +230,8 @@ adminIDs: [] auditLogEnabled: false ## @param logLevel The log level, valid values are "debug", "info", "warn", and "error" logLevel: info +## @param logFormat The log format, valid values are "text" and "json" +logFormat: "text" ## @param jwtIssuer The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset jwtIssuer: "" From 666d304ce2a538c10d11375b8d37508f2742b1d9 Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Mon, 2 Feb 2026 11:52:44 +0100 Subject: [PATCH 03/25] Bump test chart dependencies (#738) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> --- .github/tests/charts.json | 4 ++-- .github/tests/oci-charts.json | 2 +- charts/spire/charts/spiffe-csi-driver/README.md | 2 +- charts/spire/charts/spiffe-csi-driver/values.yaml | 2 +- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 12 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 9380d37..d09d1ea 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "81.2.2" + "version": "81.4.2" }, { "name": "cert-manager", @@ -12,6 +12,6 @@ { "name": "ingress-nginx", "repo": "https://kubernetes.github.io/ingress-nginx", - "version": "4.14.1" + "version": "4.14.2" } ] diff --git a/.github/tests/oci-charts.json b/.github/tests/oci-charts.json index 9c926ea..0b2777a 100644 --- a/.github/tests/oci-charts.json +++ b/.github/tests/oci-charts.json @@ -12,6 +12,6 @@ { "name": "envoy-gateway", "registry": "docker.io/envoyproxy/gateway-helm", - "version": "v1.6.2" + "version": "v1.6.3" } ] diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index 90460dc..4babd67 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -72,5 +72,5 @@ A Helm chart to install the SPIFFE CSI driver. | `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` | | `selinux.image.repository` | The repository within the registry | `ubi9` | | `selinux.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1769057030` | +| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1769417801` | diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index 79c7863..56be047 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -163,4 +163,4 @@ selinux: registry: registry.access.redhat.com repository: ubi9 pullPolicy: IfNotPresent - tag: 9.7-1769057030 + tag: 9.7-1769417801 diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index ac6dac0..8b65a71 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -125,11 +125,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0ba70a117710f95ba7d7a9ad0932e920c2785c1bb244ca858cd6445e4526e1f4` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:fe25a67bebf425a79c623c5edd9c82a37c71a8e3c45e1f51178dbde2080706d2` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index ea02bd1..437b007 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -356,7 +356,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507 + tag: latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -368,7 +368,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:0ba70a117710f95ba7d7a9ad0932e920c2785c1bb244ca858cd6445e4526e1f4 + tag: latest@sha256:fe25a67bebf425a79c623c5edd9c82a37c71a8e3c45e1f51178dbde2080706d2 step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index db3c36f..8382431 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -73,7 +73,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | @@ -124,11 +124,11 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0ba70a117710f95ba7d7a9ad0932e920c2785c1bb244ca858cd6445e4526e1f4` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:fe25a67bebf425a79c623c5edd9c82a37c71a8e3c45e1f51178dbde2080706d2` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 05829df..a35688a 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -159,7 +159,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507 + tag: latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca keyManager: memory: @@ -315,7 +315,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507 + tag: latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca hostCert: ## @param hostCert.image.registry The OCI registry to pull the image from @@ -327,7 +327,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:0ba70a117710f95ba7d7a9ad0932e920c2785c1bb244ca858cd6445e4526e1f4 + tag: latest@sha256:fe25a67bebf425a79c623c5edd9c82a37c71a8e3c45e1f51178dbde2080706d2 ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. priorityClassName: "" diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 3688ce4..7072669 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -502,5 +502,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 9db8d29..726a41e 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1280,7 +1280,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507 + tag: latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 76445ee..49d3d11 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 3ca9890..3989e7e 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507 + tag: latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca From 45fdf9f7c04e8daab2f400a25ae0682229687976 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 3 Feb 2026 08:40:14 +0100 Subject: [PATCH 04/25] Bump github.com/onsi/gomega from 1.39.0 to 1.39.1 in /tests (#739) Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.39.0 to 1.39.1. - [Release notes](https://github.com/onsi/gomega/releases) - [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md) - [Commits](https://github.com/onsi/gomega/compare/v1.39.0...v1.39.1) --- updated-dependencies: - dependency-name: github.com/onsi/gomega dependency-version: 1.39.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- tests/go.mod | 2 +- tests/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/go.mod b/tests/go.mod index d0ea014..1bf1f93 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -4,7 +4,7 @@ go 1.25.0 require ( github.com/onsi/ginkgo/v2 v2.28.1 - github.com/onsi/gomega v1.39.0 + github.com/onsi/gomega v1.39.1 helm.sh/helm/v3 v3.20.0 ) diff --git a/tests/go.sum b/tests/go.sum index 6fb324e..52bff9a 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -91,8 +91,8 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI= github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE= -github.com/onsi/gomega v1.39.0 h1:y2ROC3hKFmQZJNFeGAMeHZKkjBL65mIZcvrLQBF9k6Q= -github.com/onsi/gomega v1.39.0/go.mod h1:ZCU1pkQcXDO5Sl9/VVEGlDyp+zm0m1cmeG5TOzLgdh4= +github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28= +github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= From 7d2664544d82735ebe135a4e64b455081fd9dc0e Mon Sep 17 00:00:00 2001 From: Alec Wilson Date: Mon, 9 Feb 2026 00:13:43 +0000 Subject: [PATCH 05/25] Fix keyManager check stopping use of unsupported bulit-in plugin (#715) Adds unsupported built-in plugins (built-in plugins that do not have direct toggles in the helm chart) to the check that exactly one key manager plugin is enabled - the previous check only allowed usage of key manager plugins with explicit values in the helm chart. This still doesn't allow usage of custom key manager plugins - as they will not be present in the count that is checked. Signed-off-by: Alec Wilson --- charts/spire/charts/spire-server/templates/configmap.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 4e22858..0d297c6 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -298,6 +298,8 @@ plugins: {{- end }} {{- end }} +{{- $keyManagerUsed = add $keyManagerUsed (len .Values.unsupportedBuiltInPlugins.keyManager) }} + {{- if ne $keyManagerUsed 1 }} {{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }} {{- end }} From 86a806f3c6df5aad8b1b0f8a6a5450582921680d Mon Sep 17 00:00:00 2001 From: Alec Wilson Date: Mon, 9 Feb 2026 00:32:56 +0000 Subject: [PATCH 06/25] Add tolerations to spire-server hook pods (#742) Applies the tolerations in the spire-server chart to the pods created by the hooks. Previously they were only applied to the pods of the server itself. Signed-off-by: Alec Wilson --- .../charts/spire-server/templates/post-install-hook.yaml | 4 ++++ .../charts/spire-server/templates/post-upgrade-hook.yaml | 4 ++++ .../spire/charts/spire-server/templates/pre-delete-hook.yaml | 4 ++++ .../spire/charts/spire-server/templates/pre-upgrade-hook.yaml | 4 ++++ 4 files changed, 16 insertions(+) diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml index 325fbef..e432a52 100644 --- a/charts/spire/charts/spire-server/templates/post-install-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml @@ -58,6 +58,10 @@ spec: metadata: name: {{ include "spire-server.fullname" . }}-post-install spec: + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} restartPolicy: Never serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-install securityContext: diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml index 309b63c..a4583a2 100644 --- a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml @@ -58,6 +58,10 @@ spec: metadata: name: {{ include "spire-server.fullname" . }}-post-upgrade spec: + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} restartPolicy: Never serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-upgrade securityContext: diff --git a/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml index 6af0a89..e06cbd8 100644 --- a/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml @@ -61,6 +61,10 @@ spec: metadata: name: {{ include "spire-server.fullname" . }}-pre-delete spec: + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} restartPolicy: Never serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-delete securityContext: diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml index ee92e0d..84c6760 100644 --- a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml @@ -58,6 +58,10 @@ spec: metadata: name: {{ include "spire-server.fullname" . }}-pre-upgrade spec: + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} restartPolicy: Never serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-upgrade securityContext: From ba2b6a5a024a8d4475f48617b47e112ad2542084 Mon Sep 17 00:00:00 2001 From: Pratik Lotia Date: Tue, 10 Feb 2026 16:23:33 -0500 Subject: [PATCH 07/25] Add controller-manager metrics to PodMonitor (#748) Signed-off-by: pratik-lotia --- charts/spire/charts/spire-server/templates/podmonitor.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/charts/spire/charts/spire-server/templates/podmonitor.yaml b/charts/spire/charts/spire-server/templates/podmonitor.yaml index 3e736df..d73034c 100644 --- a/charts/spire/charts/spire-server/templates/podmonitor.yaml +++ b/charts/spire/charts/spire-server/templates/podmonitor.yaml @@ -21,6 +21,7 @@ spec: {{- include "spire-server.selectorLabels" . | nindent 6 }} podMetricsEndpoints: - port: prom + - port: prom-cm {{- if ne $namespace $podNamespace }} namespaceSelector: kubernetes.io/metadata.name: {{ $podNamespace }} From 6b5d01b74c5d199dc62412c6b9559686fb5935c5 Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Tue, 10 Feb 2026 22:03:09 +0000 Subject: [PATCH 08/25] Bump test chart dependencies (#743) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> Co-authored-by: kfox1111 --- .github/tests/charts.json | 6 +++--- .github/tests/oci-charts.json | 6 +++--- charts/spire/charts/spiffe-csi-driver/README.md | 2 +- charts/spire/charts/spiffe-csi-driver/values.yaml | 2 +- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 6 +++--- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 6 +++--- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 12 files changed, 24 insertions(+), 24 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index d09d1ea..63cf234 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,16 +2,16 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "81.4.2" + "version": "81.5.0" }, { "name": "cert-manager", "repo": "https://charts.jetstack.io", - "version": "v1.19.2" + "version": "v1.19.3" }, { "name": "ingress-nginx", "repo": "https://kubernetes.github.io/ingress-nginx", - "version": "4.14.2" + "version": "4.14.3" } ] diff --git a/.github/tests/oci-charts.json b/.github/tests/oci-charts.json index 0b2777a..a9481e3 100644 --- a/.github/tests/oci-charts.json +++ b/.github/tests/oci-charts.json @@ -2,16 +2,16 @@ { "name": "mariadb", "registry": "docker.io/bitnamicharts/mariadb", - "version": "24.0.3" + "version": "24.0.4" }, { "name": "postgresql", "registry": "docker.io/bitnamicharts/postgresql", - "version": "18.2.3" + "version": "18.2.4" }, { "name": "envoy-gateway", "registry": "docker.io/envoyproxy/gateway-helm", - "version": "v1.6.3" + "version": "v1.7.0" } ] diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index 4babd67..ac5840a 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -72,5 +72,5 @@ A Helm chart to install the SPIFFE CSI driver. | `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` | | `selinux.image.repository` | The repository within the registry | `ubi9` | | `selinux.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1769417801` | +| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1770238273` | diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index 56be047..bc86e5d 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -163,4 +163,4 @@ selinux: registry: registry.access.redhat.com repository: ubi9 pullPolicy: IfNotPresent - tag: 9.7-1769417801 + tag: 9.7-1770238273 diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 8b65a71..f396a8d 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -75,7 +75,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from. Only used when TLS is disabled. | `docker.io` | | `insecureScheme.nginx.image.repository` | The repository within the registry. Only used when TLS is disabled. | `nginxinc/nginx-unprivileged` | | `insecureScheme.nginx.image.pullPolicy` | The image pull policy. Only used when TLS is disabled. | `IfNotPresent` | -| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.29.3-alpine` | +| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.29.5-alpine` | | `insecureScheme.nginx.ipMode` | IP modes supported by the cluster. Must be one of [ipv4, ipv6, both] | `both` | | `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | | `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` | @@ -125,11 +125,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:fe25a67bebf425a79c623c5edd9c82a37c71a8e3c45e1f51178dbde2080706d2` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:33b562fbfff272827f9a70b85e7ffdd36112716d57a9e52a315bd5e7315cc97e` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 437b007..953492a 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -184,7 +184,7 @@ insecureScheme: registry: docker.io repository: nginxinc/nginx-unprivileged pullPolicy: IfNotPresent - tag: 1.29.3-alpine + tag: 1.29.5-alpine ## @param insecureScheme.nginx.ipMode IP modes supported by the cluster. Must be one of [ipv4, ipv6, both] ipMode: both ## @param insecureScheme.nginx.resources Resource requests and limits @@ -356,7 +356,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca + tag: latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -368,7 +368,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:fe25a67bebf425a79c623c5edd9c82a37c71a8e3c45e1f51178dbde2080706d2 + tag: latest@sha256:33b562fbfff272827f9a70b85e7ffdd36112716d57a9e52a315bd5e7315cc97e step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 8382431..f2e44f4 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -73,7 +73,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | @@ -124,11 +124,11 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:fe25a67bebf425a79c623c5edd9c82a37c71a8e3c45e1f51178dbde2080706d2` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:33b562fbfff272827f9a70b85e7ffdd36112716d57a9e52a315bd5e7315cc97e` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index a35688a..dae0bbb 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -159,7 +159,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca + tag: latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c keyManager: memory: @@ -315,7 +315,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca + tag: latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c hostCert: ## @param hostCert.image.registry The OCI registry to pull the image from @@ -327,7 +327,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:fe25a67bebf425a79c623c5edd9c82a37c71a8e3c45e1f51178dbde2080706d2 + tag: latest@sha256:33b562fbfff272827f9a70b85e7ffdd36112716d57a9e52a315bd5e7315cc97e ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. priorityClassName: "" diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 7072669..aac0279 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -502,5 +502,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 726a41e..c0cc105 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1280,7 +1280,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca + tag: latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 49d3d11..d375e6f 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 3989e7e..5edf6d0 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:9ef1ae8ce2ecc540ca45188df13141afd42a77359efe9958080df90659a314ca + tag: latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c From 141c8865a302c2565a868fbcbbcf309cf96398e3 Mon Sep 17 00:00:00 2001 From: Rowan Ruseler Date: Wed, 11 Feb 2026 00:03:54 +0100 Subject: [PATCH 09/25] Add pobLabels support to csi and oidc (#744) spiffe-csi-driver and spiffe-oidc-discovery provider are now brought in line with spire-server and spire-agent, which already support podLabels. Changes: * Add podLabels parameter Fixes #719 Signed-off-by: Rowan Ruseler Co-authored-by: kfox1111 --- charts/spire/charts/spiffe-csi-driver/README.md | 1 + charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml | 3 +++ charts/spire/charts/spiffe-csi-driver/values.yaml | 3 +++ charts/spire/charts/spiffe-oidc-discovery-provider/README.md | 1 + .../spiffe-oidc-discovery-provider/templates/deployment.yaml | 3 +++ charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml | 3 +++ 6 files changed, 14 insertions(+) diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index ac5840a..1f117f3 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -51,6 +51,7 @@ A Helm chart to install the SPIFFE CSI driver. | `serviceAccount.annotations` | Annotations to add to the service account | `{}` | | `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | | `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` | +| `podLabels` | Labels to add to pods | `{}` | | `podSecurityContext` | Security context for CSI driver pods | `{}` | | `securityContext` | Security context for CSI driver containers | `{}` | | `nodeSelector` | Node selector for CSI driver pods | `{}` | diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml index ba97d12..6740bad 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -31,6 +31,9 @@ spec: {{- end }} labels: {{- include "spiffe-csi-driver.selectorLabels" . | nindent 8 }} + {{- with .Values.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} spec: {{- with .Values.imagePullSecrets }} imagePullSecrets: diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index bc86e5d..b01a2e0 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -91,6 +91,9 @@ serviceAccount: ## @param podAnnotations [object] Pod annotations for spiffe-csi-driver podAnnotations: {} +## @param podLabels [object] Labels to add to pods +podLabels: {} + ## @param podSecurityContext [object] Security context for CSI driver pods podSecurityContext: {} # fsGroup: 2000 diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index f396a8d..3d62405 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -60,6 +60,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | | `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | | `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` | +| `podLabels` | Labels to add to pods | `{}` | | `tls.spire.enabled` | Use spire to secure the oidc-discovery-provider | `true` | | `tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` | | `tls.externalSecret.secretName` | Specify which Secret to use | `""` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml index 07420bf..99c4a54 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -30,6 +30,9 @@ spec: release: {{ .Release.Name }} release-namespace: {{ .Release.Namespace }} component: oidc-discovery-provider + {{- with .Values.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} spec: {{- with .Values.imagePullSecrets }} imagePullSecrets: diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 953492a..2f02591 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -125,6 +125,9 @@ livenessProbe: ## @param podAnnotations [object] Pod annotations for Spire OIDC discovery provider podAnnotations: {} +## @param podLabels [object] Labels to add to pods +podLabels: {} + # Select from one of the options below to be the source of certificates for OIDC Discovery Provider. # If none are enabled, connections won't be TLS encrypted. tls: From 75ffbd06f593712ac63615ac51bae3cd4741f938 Mon Sep 17 00:00:00 2001 From: Rowan Ruseler Date: Thu, 12 Feb 2026 00:16:16 +0100 Subject: [PATCH 10/25] Add imagePullSecrets support to helm hook jobs (#741) * Add imagePullSecrets support to helm hook jobs Hook jobs lacked imagePullSecrets configuration on their pod specs, causing image pull failures in environments using private registries with authentication * spire-server: post-install, pre-upgrade, post-upgrade, pre-delete hooks * spire-oidc-discovery-provider: pre-delete hook * spike-nexus: bootstrap hook * spire: global imagePullSecrets Fixes #649 Signed-off-by: Rowan Ruseler * Document global.imagePullSecrets parameter Signed-off-by: Rowan Ruseler * Replaced non functioning 'or' with 'coalesce' Signed-off-by: Rowan Ruseler --------- Signed-off-by: Rowan Ruseler --- charts/spire/README.md | 1 + .../spire/charts/spiffe-csi-driver/templates/daemonset.yaml | 2 +- .../spiffe-oidc-discovery-provider/templates/deployment.yaml | 2 +- .../templates/pre-delete-hook.yaml | 4 ++++ charts/spire/charts/spike-keeper/templates/statefulset.yaml | 2 +- charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml | 4 ++++ charts/spire/charts/spike-nexus/templates/statefulset.yaml | 2 +- charts/spire/charts/spike-pilot/templates/deployment.yaml | 2 +- charts/spire/charts/spire-agent/templates/daemonset.yaml | 2 +- .../charts/spire-server/templates/post-install-hook.yaml | 4 ++++ .../charts/spire-server/templates/post-upgrade-hook.yaml | 4 ++++ .../spire/charts/spire-server/templates/pre-delete-hook.yaml | 4 ++++ .../spire/charts/spire-server/templates/pre-upgrade-hook.yaml | 4 ++++ .../spire/charts/spire-server/templates/server-resource.yaml | 2 +- .../spire/charts/tornjak-frontend/templates/deployment.yaml | 2 +- charts/spire/values.yaml | 3 +++ 16 files changed, 36 insertions(+), 8 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 75aac9d..7f85487 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -273,6 +273,7 @@ Now you can interact with the Spire agent socket from your own application. The | Name | Description | Value | | ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | +| `global.imagePullSecrets` | Image pull secret names | `[]` | | `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` | | `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` | | `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` | diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml index 6740bad..54ceb44 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -35,7 +35,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml index 99c4a54..044a3b7 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -34,7 +34,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml index dd64a4a..82986de 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml @@ -57,6 +57,10 @@ spec: name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}-pre-delete spec: restartPolicy: Never + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete securityContext: {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} diff --git a/charts/spire/charts/spike-keeper/templates/statefulset.yaml b/charts/spire/charts/spike-keeper/templates/statefulset.yaml index 6af56c0..40f7e3c 100644 --- a/charts/spire/charts/spike-keeper/templates/statefulset.yaml +++ b/charts/spire/charts/spike-keeper/templates/statefulset.yaml @@ -19,7 +19,7 @@ spec: release-namespace: {{ .Release.Namespace }} component: spike-keeper spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml b/charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml index b272d44..c46cb3a 100644 --- a/charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml +++ b/charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml @@ -68,6 +68,10 @@ spec: component: spike-bootstrap spec: restartPolicy: Never + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} serviceAccountName: {{ include "spike-nexus.serviceAccountName" . }}-bootstrap securityContext: {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} diff --git a/charts/spire/charts/spike-nexus/templates/statefulset.yaml b/charts/spire/charts/spike-nexus/templates/statefulset.yaml index 638998a..2483172 100644 --- a/charts/spire/charts/spike-nexus/templates/statefulset.yaml +++ b/charts/spire/charts/spike-nexus/templates/statefulset.yaml @@ -18,7 +18,7 @@ spec: release-namespace: {{ .Release.Namespace }} component: spike-nexus spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/spike-pilot/templates/deployment.yaml b/charts/spire/charts/spike-pilot/templates/deployment.yaml index f6f8a8f..1417fa0 100644 --- a/charts/spire/charts/spike-pilot/templates/deployment.yaml +++ b/charts/spire/charts/spike-pilot/templates/deployment.yaml @@ -18,7 +18,7 @@ spec: release-namespace: {{ .Release.Namespace }} component: spike-pilot spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 4954d50..4122fab 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -75,7 +75,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml index e432a52..ed00051 100644 --- a/charts/spire/charts/spire-server/templates/post-install-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml @@ -63,6 +63,10 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} restartPolicy: Never + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-install securityContext: {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml index a4583a2..fb42cfb 100644 --- a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml @@ -63,6 +63,10 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} restartPolicy: Never + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-upgrade securityContext: {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} diff --git a/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml index e06cbd8..20b0666 100644 --- a/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml @@ -66,6 +66,10 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} restartPolicy: Never + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-delete securityContext: {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml index 84c6760..18a5bc6 100644 --- a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml @@ -63,6 +63,10 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} restartPolicy: Never + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-upgrade securityContext: {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} diff --git a/charts/spire/charts/spire-server/templates/server-resource.yaml b/charts/spire/charts/spire-server/templates/server-resource.yaml index f790eff..b8e7422 100644 --- a/charts/spire/charts/spire-server/templates/server-resource.yaml +++ b/charts/spire/charts/spire-server/templates/server-resource.yaml @@ -112,7 +112,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml index e70b5c0..9a4cfeb 100644 --- a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml +++ b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml @@ -15,7 +15,7 @@ spec: labels: {{- include "tornjak-frontend.selectorLabels" . | nindent 8 }} spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 1cff2cf..ceca886 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -5,6 +5,9 @@ ## Note: the parameter values specified here will override the chart level values for these parameters. ## global: + ## @param global.imagePullSecrets [array] Image pull secret names + imagePullSecrets: [] + k8s: ## @param global.k8s.clusterDomain Cluster domain name configured for Spire install clusterDomain: cluster.local From 8abac78a15ecf58d889bea3b3a8333a9ed05abda Mon Sep 17 00:00:00 2001 From: Pratik Lotia Date: Wed, 11 Feb 2026 18:58:54 -0500 Subject: [PATCH 11/25] Support leaderElection values in controller manager (#740) --- charts/spire/charts/spire-server/README.md | 6 ++++++ .../templates/controller-manager-configmap.yaml | 3 +++ charts/spire/charts/spire-server/values.yaml | 15 +++++++++++++++ 3 files changed, 24 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index aac0279..0294f87 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -276,6 +276,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.addEntryIDPrefix` | If true, prepends the clusterName to the entryID of each entry the controller manager registers. | `true` | | `controllerManager.gcInterval` | How often the SPIRE state is reconciled when the controller is otherwise idle. This impacts how quickly SPIRE state will converge after CRDs are removed or SPIRE state is mutated underneath the controller. Values are in nanoseconds. | `10000000000` | | `controllerManager.logLevel` | The log level for the controller manager. Supported values are info, error, warn and debug. | `info` | +| `controllerManager.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` | +| `controllerManager.leaderElection.renewDeadline` | Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. | `10s` | +| `controllerManager.leaderElection.retryPeriod` | Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. | `2s` | | `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` | | `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` | | `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` | @@ -342,6 +345,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `externalControllerManagers.defaults.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` | | `externalControllerManagers.defaults.entryIDPrefixCleanup` | consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` | | `externalControllerManagers.defaults.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` | +| `externalControllerManagers.defaults.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` | +| `externalControllerManagers.defaults.leaderElection.renewDeadline` | Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. | `10s` | +| `externalControllerManagers.defaults.leaderElection.retryPeriod` | Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. | `2s` | | `externalControllerManagers.defaults.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` | | `externalControllerManagers.defaults.extraEnv` | Extra environment variables to add to the controller manager | `[]` | | `externalControllerManagers.defaults.resources` | Resource requests and limits for controller manager | `{}` | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml index de33c1b..23906c7 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -54,6 +54,9 @@ leaderElection: leaderElect: true resourceName: {{ printf "%s-%s%s" .Release.Namespace (default .Release.Name .Values.crNameOverride) .suffix | sha256sum | trunc 8 }}.spiffe.io resourceNamespace: {{ include "spire-server.namespace" . }} + leaseDuration: {{ .defaults.leaderElection.leaseDuration }} + renewDeadline: {{ .defaults.leaderElection.renewDeadline }} + retryPeriod: {{ .defaults.leaderElection.retryPeriod }} {{- end }} {{- with .settings.cacheNamespaces }} cacheNamespaces: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index c0cc105..bf093c6 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -570,6 +570,14 @@ controllerManager: ## @param controllerManager.logLevel The log level for the controller manager. Supported values are info, error, warn and debug. logLevel: info + ## @param controllerManager.leaderElection.leaseDuration Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. + ## @param controllerManager.leaderElection.renewDeadline Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. + ## @param controllerManager.leaderElection.retryPeriod Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. + leaderElection: + leaseDuration: "15s" + renewDeadline: "10s" + retryPeriod: "2s" + ## @param controllerManager.parentIDTemplate The template that is used to register workloads. parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}" @@ -810,6 +818,13 @@ externalControllerManagers: entryIDPrefixCleanup: false ## @param externalControllerManagers.defaults.parentIDTemplate The template that is used to register workloads. parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}" + ## @param externalControllerManagers.defaults.leaderElection.leaseDuration Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. + ## @param externalControllerManagers.defaults.leaderElection.renewDeadline Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. + ## @param externalControllerManagers.defaults.leaderElection.retryPeriod Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. + leaderElection: + leaseDuration: "15s" + renewDeadline: "10s" + retryPeriod: "2s" ## @param externalControllerManagers.defaults.expandEnv Set to true to enable environment variable substitution of config file options expandEnv: false ## @param externalControllerManagers.defaults.extraEnv [array] Extra environment variables to add to the controller manager From 982d53c2003116607f21f398e177b86356386784 Mon Sep 17 00:00:00 2001 From: Jayme Howard Date: Fri, 13 Feb 2026 18:29:22 -0600 Subject: [PATCH 12/25] Add ContainerResource scaling to spire-server HPA (#746) * Add ContainerResource scaling to spire-server HPA Signed-off-by: Jayme Howard * Amend flag name to address feedback Signed-off-by: Jayme Howard --------- Signed-off-by: Jayme Howard Co-authored-by: kfox1111 --- charts/spire/charts/spire-server/README.md | 1 + .../spire/charts/spire-server/templates/hpa.yaml | 14 ++++++++++++++ charts/spire/charts/spire-server/values.yaml | 2 ++ 3 files changed, 17 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 0294f87..1d7e6a7 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -110,6 +110,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `autoscaling.enabled` | Flag to enable autoscaling | `false` | | `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` | | `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` | +| `autoscaling.scaleOnSPIREServerOnly` | Flag to only consider the main SPIRE container for autoscaling purposes | `false` | | `autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization that triggers autoscaling | `80` | | `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` | | `tolerations` | List of tolerations | `[]` | diff --git a/charts/spire/charts/spire-server/templates/hpa.yaml b/charts/spire/charts/spire-server/templates/hpa.yaml index 7fd457a..5d0eb5f 100644 --- a/charts/spire/charts/spire-server/templates/hpa.yaml +++ b/charts/spire/charts/spire-server/templates/hpa.yaml @@ -23,17 +23,31 @@ spec: maxReplicas: {{ .Values.autoscaling.maxReplicas }} metrics: {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} + {{- if .Values.autoscaling.scaleOnSPIREServerOnly }} + - type: ContainerResource + {{- else }} - type: Resource + {{- end }} resource: name: memory + {{- if .Values.autoscaling.scaleOnSPIREServerOnly }} + container: {{ .Chart.Name }} + {{- end }} target: type: Utilization averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} {{- end }} {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} + {{- if .Values.autoscaling.scaleOnSPIREServerOnly }} + - type: ContainerResource + {{- else }} - type: Resource + {{- end }} resource: name: cpu + {{- if .Values.autoscaling.scaleOnSPIREServerOnly }} + container: {{ .Chart.Name }} + {{- end }} target: type: Utilization averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index bf093c6..e30b624 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -103,12 +103,14 @@ resources: {} ## @param autoscaling.enabled Flag to enable autoscaling ## @param autoscaling.minReplicas Minimum replicas for autoscaling ## @param autoscaling.maxReplicas Maximum replicas for autoscaling +## @param autoscaling.scaleOnSPIREServerOnly Flag to only consider the main SPIRE container for autoscaling purposes ## @param autoscaling.targetCPUUtilizationPercentage Target CPU utilization that triggers autoscaling ## autoscaling: enabled: false minReplicas: 1 maxReplicas: 100 + scaleOnSPIREServerOnly: false targetCPUUtilizationPercentage: 80 # targetMemoryUtilizationPercentage: 80 From e849a1fbd61105f07bfc5823b0ca0a3e41f2f7f7 Mon Sep 17 00:00:00 2001 From: Rowan Ruseler Date: Sat, 14 Feb 2026 01:57:20 +0100 Subject: [PATCH 13/25] Add configurable hostNetwork parameter for spire-agent (#749) * Add configurable hostNetwork parameter for spire-agent Adds `hostNetwork` as a configurable parameter in the spire-agent chart. We can now explicitly control whether the spire-agent daemonset uses host networking. Changes: * Updated daemonset template * Changed `dnsPolicy` logic to follow the computed `hostNetwork` instead of kubelet mode directly * Updated documentation Behaviour: If you leave `hostNetwork` empty (the default), it behaves like PR #705: * automatically disables when using hostname or hostip kubelet modes * automatically enables for localhost If you set it explicitly to `true` or `false`, that overrides the automatic behaviour. When `hostNetwork` is enabled and you haven't set a custom `dnsPolicy`, it defaults to `ClusterFirstWithHostNet`. Fixes #704 Signed-off-by: Rowan Ruseler * Fix merge conflict, different default value for fsGroupFix.image.tag Signed-off-by: Rowan Ruseler --------- Signed-off-by: Rowan Ruseler Co-authored-by: kfox1111 --- charts/spire/charts/spire-agent/README.md | 257 +++++++++--------- .../spire-agent/templates/daemonset.yaml | 10 +- charts/spire/charts/spire-agent/values.yaml | 4 +- 3 files changed, 139 insertions(+), 132 deletions(-) diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index f2e44f4..c1b787c 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -25,131 +25,132 @@ A Helm chart to install the SPIRE agent. ### Chart parameters -| Name | Description | Value | -| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | -| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `image.repository` | The repository within the registry | `spiffe/spire-agent` | -| `image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `imagePullSecrets` | Pull secrets for images | `[]` | -| `nameOverride` | Name override | `""` | -| `namespaceOverride` | Namespace override | `""` | -| `fullnameOverride` | Fullname override | `""` | -| `serviceAccount.create` | Specifies whether a service account should be created | `true` | -| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | -| `serviceAccount.name` | The name of the service account to use. | `""` | -| `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` | -| `podAnnotations` | Annotations to add to pods | `{}` | -| `podLabels` | Labels to add to pods | `{}` | -| `podSecurityContext` | Pod security context | `{}` | -| `securityContext` | Security context | `{}` | -| `resources` | Resource requests and limits for the spire-agent container and all its initContainers | `{}` | -| `nodeSelector` | Node selector | `{}` | -| `tolerations` | List of tolerations | `[]` | -| `affinity` | Node affinity | `{}` | -| `authorizedDelegates` | A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information. | `[]` | -| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | -| `logFormat` | The log format, valid values are "text" and "json" | `text` | -| `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` | -| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` | -| `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` | -| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `spiffe` | -| `trustBundleHostPath` | If set, obtain trust bundle from a file on the host instead of from the ConfigMap | `""` | -| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` | -| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` | -| `rebootstrapMode` | How the agent will behave when seeing an unknown x509 cert from the server. It can be set to never, auto, or always | `always` | -| `rebootstrapDelay` | The agent will rebootstrap after configured amount of time on unknown x509 cert from the server | `10m` | -| `server.address` | Address for Spire server | `""` | -| `server.port` | Port number for Spire server | `443` | -| `server.namespaceOverride` | Override the namespace for Spire server | `""` | -| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` | -| `healthChecks.port` | override the host port used for health checking | `9982` | -| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` | -| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` | -| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | -| `livenessProbe.periodSeconds` | Period seconds for probe | `60` | -| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` | -| `readinessProbe.periodSeconds` | Period seconds for probe | `30` | -| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | -| `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c` | -| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | -| `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | -| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | -| `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` | -| `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` | -| `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` | -| `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` | -| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` | -| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-agent` | -| `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.9.0` | -| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `22f67063f1699330e70cdedc9b923e517688f5ae71085a26bd9b83b3060ee86e` | -| `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` | -| `nodeAttestor.tpmDirect.pubHash.enabled` | Display pubhash in logs | `true` | -| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-get-tpm-pubhash` | -| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.9.0` | -| `nodeAttestor.awsIID.enabled` | Enable the aws_iid Node Attestor | `false` | -| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | -| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | -| `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` | -| `workloadAttestors.k8s.verification.hostCert.basePath` | Path where kubelet places its certificates | `/var/lib/kubelet/pki` | -| `workloadAttestors.k8s.verification.hostCert.fileName` | File name where kubelet places its certificates. If blank, it will be auto detected. | `""` | -| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` | -| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true | `true` | -| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` | -| `sds.enabled` | Enables Envoy SDS configuration | `false` | -| `sds.defaultSVIDName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` | -| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` | -| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` | -| `sds.disableSPIFFECertValidation` | Disable Envoy SDS custom validation | `false` | -| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | -| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | -| `telemetry.prometheus.host` | Host for prometheus metrics | `0.0.0.0` | -| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | -| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` | -| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | -| `telemetry.datadog.enabled` | Flag to enable datadog monitoring | `false` | -| `telemetry.datadog.address` | The address of the datadog service to send metrics to. The default URL for services are `..svc` | `datadog.kube-system.svc` | -| `telemetry.datadog.port` | The port of the datadog service to send metrics to | `8125` | -| `kubeletConnectByHostname` | (DEPRECATED) Use kubeletAddress.mode instead. If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` | -| `kubeletAddress.mode` | How to connect to kubelet for workload attestation | `auto` | -| `dnsPolicy` | dnsPolicy to assign to the DaemonSet. See valid values here: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy. If left empty, ClusterFirstWithHostNet will be used if kubeletAddress.mode does not resolve to hostip or hostname, otherwise, the default dnsPolicy will be used. | `""` | -| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | -| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` | -| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | -| `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c` | -| `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | -| `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:33b562fbfff272827f9a70b85e7ffdd36112716d57a9e52a315bd5e7315cc97e` | -| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | -| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` | -| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | -| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` | -| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` | -| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` | -| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` | -| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` | -| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` | -| `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` | -| `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` | -| `experimental.enabled` | Allow configuration of experimental features | `false` | -| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` | -| `experimental.featureFlags` | List of developer feature flags | `[]` | -| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` | -| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | -| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` | -| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` | -| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` | -| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` | -| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` | -| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` | +| Name | Description | Value | +| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/spire-agent` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `imagePullSecrets` | Pull secrets for images | `[]` | +| `nameOverride` | Name override | `""` | +| `namespaceOverride` | Namespace override | `""` | +| `fullnameOverride` | Fullname override | `""` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. | `""` | +| `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` | +| `podAnnotations` | Annotations to add to pods | `{}` | +| `podLabels` | Labels to add to pods | `{}` | +| `podSecurityContext` | Pod security context | `{}` | +| `securityContext` | Security context | `{}` | +| `resources` | Resource requests and limits for the spire-agent container and all its initContainers | `{}` | +| `nodeSelector` | Node selector | `{}` | +| `tolerations` | List of tolerations | `[]` | +| `affinity` | Node affinity | `{}` | +| `authorizedDelegates` | A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information. | `[]` | +| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | +| `logFormat` | The log format, valid values are "text" and "json" | `text` | +| `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` | +| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` | +| `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` | +| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `spiffe` | +| `trustBundleHostPath` | If set, obtain trust bundle from a file on the host instead of from the ConfigMap | `""` | +| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` | +| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` | +| `rebootstrapMode` | How the agent will behave when seeing an unknown x509 cert from the server. It can be set to never, auto, or always | `always` | +| `rebootstrapDelay` | The agent will rebootstrap after configured amount of time on unknown x509 cert from the server | `10m` | +| `server.address` | Address for Spire server | `""` | +| `server.port` | Port number for Spire server | `443` | +| `server.namespaceOverride` | Override the namespace for Spire server | `""` | +| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` | +| `healthChecks.port` | override the host port used for health checking | `9982` | +| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` | +| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | +| `livenessProbe.periodSeconds` | Period seconds for probe | `60` | +| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` | +| `readinessProbe.periodSeconds` | Period seconds for probe | `30` | +| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | +| `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c` | +| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | +| `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | +| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | +| `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` | +| `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` | +| `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` | +| `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` | +| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` | +| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-agent` | +| `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.9.0` | +| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `22f67063f1699330e70cdedc9b923e517688f5ae71085a26bd9b83b3060ee86e` | +| `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` | +| `nodeAttestor.tpmDirect.pubHash.enabled` | Display pubhash in logs | `true` | +| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-get-tpm-pubhash` | +| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.9.0` | +| `nodeAttestor.awsIID.enabled` | Enable the aws_iid Node Attestor | `false` | +| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | +| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | +| `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` | +| `workloadAttestors.k8s.verification.hostCert.basePath` | Path where kubelet places its certificates | `/var/lib/kubelet/pki` | +| `workloadAttestors.k8s.verification.hostCert.fileName` | File name where kubelet places its certificates. If blank, it will be auto detected. | `""` | +| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` | +| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true | `true` | +| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` | +| `sds.enabled` | Enables Envoy SDS configuration | `false` | +| `sds.defaultSVIDName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` | +| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` | +| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` | +| `sds.disableSPIFFECertValidation` | Disable Envoy SDS custom validation | `false` | +| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | +| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | +| `telemetry.prometheus.host` | Host for prometheus metrics | `0.0.0.0` | +| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | +| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` | +| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | +| `telemetry.datadog.enabled` | Flag to enable datadog monitoring | `false` | +| `telemetry.datadog.address` | The address of the datadog service to send metrics to. The default URL for services are `..svc` | `datadog.kube-system.svc` | +| `telemetry.datadog.port` | The port of the datadog service to send metrics to | `8125` | +| `kubeletConnectByHostname` | (DEPRECATED) Use kubeletAddress.mode instead. If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` | +| `kubeletAddress.mode` | How to connect to kubelet for workload attestation | `auto` | +| `hostNetwork` | Enable hostNetwork for the DaemonSet. If empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. | `""` | +| `dnsPolicy` | DNS policy for the DaemonSet. If empty, uses ClusterFirstWithHostNet when hostNetwork is enabled. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy | `""` | +| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | +| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` | +| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | +| `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c` | +| `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | +| `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:33b562fbfff272827f9a70b85e7ffdd36112716d57a9e52a315bd5e7315cc97e` | +| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | +| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` | +| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | +| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` | +| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` | +| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` | +| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` | +| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` | +| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` | +| `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` | +| `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` | +| `experimental.enabled` | Allow configuration of experimental features | `false` | +| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` | +| `experimental.featureFlags` | List of developer feature flags | `[]` | +| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` | +| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | +| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` | +| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` | +| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` | +| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` | +| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` | +| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` | diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 4122fab..5257606 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -29,9 +29,13 @@ {{- end }} {{- $resolvedMode := include "spire-agent.kubelet-address-mode-resolved" . }} {{- $cbh := or (eq $resolvedMode "hostname") (eq $resolvedMode "hostip") }} +{{- $hostNetwork := not $cbh }} +{{- if ne (.Values.hostNetwork | toString) "" }} +{{- $hostNetwork = eq (.Values.hostNetwork | toString) "true" }} +{{- end }} {{- $dnsPolicy := .Values.dnsPolicy }} -{{- if (and (eq $dnsPolicy "") (not $cbh)) }} -{{- $dnsPolicy = "ClusterFirstWithHostNet" }} +{{- if (and (eq $dnsPolicy "") $hostNetwork) }} +{{- $dnsPolicy = "ClusterFirstWithHostNet" }} {{- end }} {{- $socketAlternateNames := index (include "spire-agent.socket-alternate-names" . | fromYaml) "names" }} {{- $socketPath := include "spire-agent.socket-path" . }} @@ -80,7 +84,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} hostPID: true - {{- if not $cbh }} + {{- if $hostNetwork }} hostNetwork: true {{- end }} {{- if ne $dnsPolicy "" }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index dae0bbb..ec7d165 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -294,7 +294,9 @@ kubeletAddress: ## provided at runtime or SPIRE agent will fail to start. mode: auto -## @param dnsPolicy [string] dnsPolicy to assign to the DaemonSet. See valid values here: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy. If left empty, ClusterFirstWithHostNet will be used if kubeletAddress.mode does not resolve to hostip or hostname, otherwise, the default dnsPolicy will be used. +## @param hostNetwork [string] Enable hostNetwork for the DaemonSet. If empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. +hostNetwork: "" +## @param dnsPolicy [string] DNS policy for the DaemonSet. If empty, uses ClusterFirstWithHostNet when hostNetwork is enabled. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy dnsPolicy: "" ## @param socketPath The unix socket path to the spire-agent socketPath: /run/spire/agent-sockets/spire-agent.sock From 730b76bbaa8fbb1f32f0faaa5400166305071d7c Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Mon, 16 Feb 2026 05:48:10 -0800 Subject: [PATCH 14/25] Bump test chart dependencies (#750) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> --- .github/tests/charts.json | 2 +- .github/tests/oci-charts.json | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 10 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 63cf234..2bea179 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "81.5.0" + "version": "82.0.0" }, { "name": "cert-manager", diff --git a/.github/tests/oci-charts.json b/.github/tests/oci-charts.json index a9481e3..a91d5cf 100644 --- a/.github/tests/oci-charts.json +++ b/.github/tests/oci-charts.json @@ -2,12 +2,12 @@ { "name": "mariadb", "registry": "docker.io/bitnamicharts/mariadb", - "version": "24.0.4" + "version": "24.1.1" }, { "name": "postgresql", "registry": "docker.io/bitnamicharts/postgresql", - "version": "18.2.4" + "version": "18.3.0" }, { "name": "envoy-gateway", diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 3d62405..97ff782 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -126,11 +126,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:33b562fbfff272827f9a70b85e7ffdd36112716d57a9e52a315bd5e7315cc97e` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:68d2eec2bb2b3d864384c13d531aa5da7c39a49c2e05a134b35984f9a4ffaa43` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 2f02591..d3d90f4 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -359,7 +359,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c + tag: latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -371,7 +371,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:33b562fbfff272827f9a70b85e7ffdd36112716d57a9e52a315bd5e7315cc97e + tag: latest@sha256:68d2eec2bb2b3d864384c13d531aa5da7c39a49c2e05a134b35984f9a4ffaa43 step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index c1b787c..2011487 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -73,7 +73,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | @@ -125,11 +125,11 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:33b562fbfff272827f9a70b85e7ffdd36112716d57a9e52a315bd5e7315cc97e` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:68d2eec2bb2b3d864384c13d531aa5da7c39a49c2e05a134b35984f9a4ffaa43` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index ec7d165..8718144 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -159,7 +159,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c + tag: latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae keyManager: memory: @@ -317,7 +317,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c + tag: latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae hostCert: ## @param hostCert.image.registry The OCI registry to pull the image from @@ -329,7 +329,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:33b562fbfff272827f9a70b85e7ffdd36112716d57a9e52a315bd5e7315cc97e + tag: latest@sha256:68d2eec2bb2b3d864384c13d531aa5da7c39a49c2e05a134b35984f9a4ffaa43 ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. priorityClassName: "" diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 1d7e6a7..186f209 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -509,5 +509,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index e30b624..f1b9d2d 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1297,7 +1297,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c + tag: latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index d375e6f..2a3af15 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 5edf6d0..81568b2 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:65403bab01e0f5049456b75d148fdddf91109dbef46c6c69e2c386050826ba0c + tag: latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae From 3daadc64566d4c68bb115f46c9491a47fbe59a6c Mon Sep 17 00:00:00 2001 From: Shubham Hibare <20609766+hibare@users.noreply.github.com> Date: Fri, 20 Feb 2026 00:25:11 +0530 Subject: [PATCH 15/25] fix(spire-server): Support duration strings for connMaxLifetime (#752) * fix(spire-server): Support duration strings for connMaxLifetime Signed-off-by: Shubham Hibare * fix Signed-off-by: Shubham Hibare --------- Signed-off-by: Shubham Hibare --- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/templates/configmap.yaml | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 186f209..4d827ff 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -143,7 +143,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` | | `dataStore.sql.maxOpenConns` | The maximum number of open db connections | `100` | | `dataStore.sql.maxIdleConns` | The maximum number of idle connections in the pool | `2` | -| `dataStore.sql.connMaxLifetime` | The maximum amount of time a connection may be reused. If 0, time is unlimited | `0` | +| `dataStore.sql.connMaxLifetime` | The maximum amount of time a connection may be reused. Supports duration strings (e.g., "1h", "30m", "3600s") or 0 for unlimited. Duration strings are recommended to prevent connection accumulation. | `0` | | `dataStore.sql.disableMigration` | True to disable auto-migration functionality | `false` | | `dataStore.sql.region` | Region to use when database type is either aws_mysql or aws_postgresql | `""` | | `dataStore.sql.readOnly.enabled` | Set to true to configure a readOnly dartabase connection | `false` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 0d297c6..07a10ed 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -153,7 +153,7 @@ plugins: {{- end }} max_open_conns: {{ .Values.dataStore.sql.maxOpenConns }} max_idle_conns: {{ .Values.dataStore.sql.maxIdleConns }} - {{- if ne (int .Values.dataStore.sql.connMaxLifetime) 0 }} + {{- if and .Values.dataStore.sql.connMaxLifetime (ne (toString .Values.dataStore.sql.connMaxLifetime) "0") }} conn_max_lifetime: {{ .Values.dataStore.sql.connMaxLifetime }} {{- end }} disable_migration: {{ .Values.dataStore.sql.disableMigration }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index f1b9d2d..b9fd12a 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -196,7 +196,7 @@ dataStore: maxOpenConns: 100 ## @param dataStore.sql.maxIdleConns The maximum number of idle connections in the pool maxIdleConns: 2 - ## @param dataStore.sql.connMaxLifetime The maximum amount of time a connection may be reused. If 0, time is unlimited + ## @param dataStore.sql.connMaxLifetime The maximum amount of time a connection may be reused. Supports duration strings (e.g., "1h", "30m", "3600s") or 0 for unlimited. Duration strings are recommended to prevent connection accumulation. connMaxLifetime: 0 ## @param dataStore.sql.disableMigration True to disable auto-migration functionality disableMigration: false From b0aa3e4266a7548c55d81af82068a33bc8c4018c Mon Sep 17 00:00:00 2001 From: Rowan Ruseler Date: Mon, 23 Feb 2026 15:20:25 +0100 Subject: [PATCH 16/25] Fix duplicate port names in controller-manager containers (#751) * Fix duplicate port names in controller-manager containers Multiple controller-manager containers were using the same "heathz" port name, causing Kubernetes warnings about duplicate ports in the StatefulSet. This also affected the prometheus port "prom-cm". Changes: * Renamed healthz port to hp-cm (health port - controller manager) * Renamed prom-cm to pm-cm for consistency * Addedd {{ .portSuffix }} variable to differentiate external controller ports * Implemented port suffix logic The suffix logic handles cluster names by: 1. Names <9 chars: use full name as suffic * e.g.: child01 -> -child01 2. Names with trailing numbers: preserve the number format users chose * Detects 1-2 digit numbers with optional hyphen * Truncates base name to fit within 15 chars * e.g.: verlongcluster-01 -> -verylo-01 3. Names without numbers: use SHA-256 hash for uniqueness * Trunactes name to 5 chars and appends 3-char hash * e.g.: verlongclustername -> -veryl-a3f The logic separates container suffix (full name) from port suffix (truncated) so container names remain descriptive while port names stay compliant. Fixes #525 #655 Signed-off-by: Rowan Ruseler * Add optional port name overrides for ext. controller The auto-generated port name suffixes for external controller manager can collide when cluster names are similar, as the 3-character has provides only 4,096 possibilities. With the optional healthPortName and prometheusPortName fields to cluster configuration, allows users to explicity set port names when automatica generation creates collisions. Signed-off-by: Rowan Ruseler * Fix portSuffix generation Changed from "and" to "or", so portSuffic is calculated when either healthPortName or prometheusPortName is unset. Signed-off-by: Rowan Ruseler --------- Signed-off-by: Rowan Ruseler Co-authored-by: kfox1111 --- charts/spire/charts/spire-server/README.md | 2 +- .../_controller-manager-container.tpl | 58 +++++++++++++++++-- charts/spire/charts/spire-server/values.yaml | 4 +- 3 files changed, 56 insertions(+), 8 deletions(-) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 4d827ff..1b0c2bf 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -356,7 +356,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `externalControllerManagers.defaults.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` | | `externalControllerManagers.defaults.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` | | `externalControllerManagers.defaults.cacheNamespaces` | If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. | `{}` | -| `externalControllerManagers.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` | +| `externalControllerManagers.clusters` | A dictionary of clusters to add with optional overrides (kubeConfigName, reconcile, healthPortName, prometheusPortName). If empty, all clusters defined in kubeConfigs will be used. | `{}` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | | `tools.kubectl.image.repository` | The repository within the registry | `kubectl` | | `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spire-server/templates/_controller-manager-container.tpl b/charts/spire/charts/spire-server/templates/_controller-manager-container.tpl index 5ce76c3..2b56b78 100644 --- a/charts/spire/charts/spire-server/templates/_controller-manager-container.tpl +++ b/charts/spire/charts/spire-server/templates/_controller-manager-container.tpl @@ -13,7 +13,7 @@ {{- if or .Values.controllerManager.reconcile.clusterSPIFFEIDs .Values.controllerManager.reconcile.clusterStaticEntries }} {{- $reconcileEntries = add $reconcileEntries 1 }} {{- end }} -{{- include "spire-controller-manager.container" (dict "Values" .Values "Chart" .Chart "startPort" $startPort "suffix" "" "settings" $settings "defaults" $defaults "webhooksEnabled" $webhooksEnabled) }} +{{- include "spire-controller-manager.container" (dict "Values" .Values "Chart" .Chart "startPort" $startPort "suffix" "" "portSuffix" "" "healthPortName" "" "prometheusPortName" "" "settings" $settings "defaults" $defaults "webhooksEnabled" $webhooksEnabled) }} {{- end }} {{- if .Values.externalControllerManagers.enabled }} {{- $clusters := default .Values.kubeConfigs .Values.externalControllerManagers.clusters }} @@ -23,7 +23,43 @@ {{- if hasKey $root.Values.externalControllerManagers.clusters $name }} {{- $clusterSettings = index $root.Values.externalControllerManagers.clusters $name }} {{- end }} + +{{/* +Generate port names for controller-manager ports. +Can be explicitly set via healthPortName and prometheusPortName in cluster configuration. +Otherwise uses default prefixes (hp-cm/pm-cm) with auto-generated suffixes. +Auto-generation preserves trailing numbers from cluster names or uses hash for uniqueness. +*/}} {{- $suffix := printf "-%s" $name }} +{{- $portSuffix := $suffix }} +{{- $healthPortName := "" }} +{{- $prometheusPortName := "" }} +{{- if hasKey $clusterSettings "healthPortName" }} +{{- $healthPortName = $clusterSettings.healthPortName }} +{{- end }} +{{- if hasKey $clusterSettings "prometheusPortName" }} +{{- $prometheusPortName = $clusterSettings.prometheusPortName }} +{{- end }} +{{- if or (eq $healthPortName "") (eq $prometheusPortName "") }} +{{- if gt (len $name) 9 }} +{{- $numberMatch := regexFind "[-]?[0-9]{1,2}$" $name }} +{{- if $numberMatch }} +{{- $numLen := len $numberMatch }} +{{- $baseLen := sub (len $name) $numLen | int }} +{{- $baseName := substr 0 $baseLen $name }} +{{- if not (hasPrefix "-" $numberMatch) }} +{{- $numberMatch = printf "-%s" $numberMatch }} +{{- end }} +{{- $maxBase := sub 9 (len $numberMatch) | int }} +{{- $baseName = $baseName | trunc $maxBase | trimSuffix "-" }} +{{- $portSuffix = printf "-%s%s" $baseName $numberMatch }} +{{- else }} +{{- $hash := sha256sum $name | trunc 3 }} +{{- $portSuffix = printf "-%s-%s" ($name | trunc 5 | trimSuffix "-") $hash }} +{{- end }} +{{- end }} +{{- end }} + {{- $startPort = add $startPort 2 }} {{- $kubeConfig := $name }} {{- if hasKey $clusterSettings "kubeConfigName" }} @@ -41,7 +77,7 @@ {{- if gt $reconcileFederation 1 }} {{- fail "You can only have one controller-manager with reconcile.clusterFederatedTrustDomains set to true" }} {{- end }} -{{- include "spire-controller-manager.container" (dict "Values" $root.Values "Chart" $root.Chart "startPort" $startPort "suffix" $suffix "settings" $clusterSettings "defaults" $clusterDefaults "webhooksEnabled" false "kubeConfig" $kubeConfig ) }} +{{- include "spire-controller-manager.container" (dict "Values" $root.Values "Chart" $root.Chart "startPort" $startPort "suffix" $suffix "portSuffix" $portSuffix "healthPortName" $healthPortName "prometheusPortName" $prometheusPortName "settings" $clusterSettings "defaults" $clusterDefaults "webhooksEnabled" false "kubeConfig" $kubeConfig ) }} {{- end }} {{- end }} {{- end }} @@ -83,27 +119,37 @@ {{- if gt (len $extraEnv) 0 }} {{- $extraEnv | toYaml | nindent 4 }} {{- end }} + {{/* Port names: hp-cm (health), pm-cm (prometheus) - abbreviated for 15 char limit */}} + {{/* Can be overridden via healthPortName and prometheusPortName in cluster config */}} ports: {{- if .webhooksEnabled }} - name: https containerPort: 9443 protocol: TCP {{- end }} + {{- $hpName := .healthPortName }} + {{- if eq $hpName "" }} + {{- $hpName = printf "hp-cm%s" .portSuffix }} + {{- end }} - containerPort: {{ $healthPort }} - name: healthz + name: {{ $hpName }} {{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }} + {{- $pmName := .prometheusPortName }} + {{- if eq $pmName "" }} + {{- $pmName = printf "pm-cm%s" .portSuffix }} + {{- end }} - containerPort: {{ $promPort }} - name: prom-cm{{ .suffix }} + name: {{ $pmName }} {{- end }} {{- if eq .Values.controllerManager.staticManifestMode "off" }} livenessProbe: httpGet: path: /healthz - port: healthz + port: {{ $hpName }} readinessProbe: httpGet: path: /readyz - port: healthz + port: {{ $hpName }} {{- end }} resources: {{- toYaml .Values.controllerManager.resources | nindent 4 }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index b9fd12a..926898b 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -850,13 +850,15 @@ externalControllerManagers: ## @param externalControllerManagers.defaults.cacheNamespaces [object] If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. cacheNamespaces: {} - ## @param externalControllerManagers.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. + ## @param externalControllerManagers.clusters [object] A dictionary of clusters to add with optional overrides (kubeConfigName, reconcile, healthPortName, prometheusPortName). If empty, all clusters defined in kubeConfigs will be used. clusters: {} # clustera: # Should match the name of the config in the kubeConfigs section # kubeConfigName: foo # reconcile: # clusterStaticEntries: true + # healthPortName: "hp-clustera-01" + # prometheusPortName: "pm-clustera-01" # other: {} tools: From 3e8f3f18930d0e792e3859cb15d78f16f923829c Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Mon, 23 Feb 2026 16:15:40 +0000 Subject: [PATCH 17/25] Bump test chart dependencies (#753) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> Co-authored-by: kfox1111 --- .github/tests/charts.json | 2 +- .github/tests/oci-charts.json | 4 ++-- charts/spire/charts/spiffe-csi-driver/README.md | 2 +- charts/spire/charts/spiffe-csi-driver/values.yaml | 2 +- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 12 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 2bea179..ae20510 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "82.0.0" + "version": "82.2.1" }, { "name": "cert-manager", diff --git a/.github/tests/oci-charts.json b/.github/tests/oci-charts.json index a91d5cf..91bef89 100644 --- a/.github/tests/oci-charts.json +++ b/.github/tests/oci-charts.json @@ -2,12 +2,12 @@ { "name": "mariadb", "registry": "docker.io/bitnamicharts/mariadb", - "version": "24.1.1" + "version": "25.0.0" }, { "name": "postgresql", "registry": "docker.io/bitnamicharts/postgresql", - "version": "18.3.0" + "version": "18.4.0" }, { "name": "envoy-gateway", diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index 1f117f3..d09ccf6 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -73,5 +73,5 @@ A Helm chart to install the SPIFFE CSI driver. | `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` | | `selinux.image.repository` | The repository within the registry | `ubi9` | | `selinux.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1770238273` | +| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1771346757` | diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index b01a2e0..b199b0a 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -166,4 +166,4 @@ selinux: registry: registry.access.redhat.com repository: ubi9 pullPolicy: IfNotPresent - tag: 9.7-1770238273 + tag: 9.7-1771346757 diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 97ff782..11edb4f 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -126,11 +126,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:68d2eec2bb2b3d864384c13d531aa5da7c39a49c2e05a134b35984f9a4ffaa43` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:205a8659ce60374de61aa1e439e48eaf52caa1bf32fa498c1a93a1f3c6c9ab6f` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index d3d90f4..dbea77f 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -359,7 +359,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae + tag: latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7 toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -371,7 +371,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:68d2eec2bb2b3d864384c13d531aa5da7c39a49c2e05a134b35984f9a4ffaa43 + tag: latest@sha256:205a8659ce60374de61aa1e439e48eaf52caa1bf32fa498c1a93a1f3c6c9ab6f step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 2011487..bc475f3 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -73,7 +73,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | @@ -125,11 +125,11 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:68d2eec2bb2b3d864384c13d531aa5da7c39a49c2e05a134b35984f9a4ffaa43` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:205a8659ce60374de61aa1e439e48eaf52caa1bf32fa498c1a93a1f3c6c9ab6f` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 8718144..3e32556 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -159,7 +159,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae + tag: latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7 keyManager: memory: @@ -317,7 +317,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae + tag: latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7 hostCert: ## @param hostCert.image.registry The OCI registry to pull the image from @@ -329,7 +329,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:68d2eec2bb2b3d864384c13d531aa5da7c39a49c2e05a134b35984f9a4ffaa43 + tag: latest@sha256:205a8659ce60374de61aa1e439e48eaf52caa1bf32fa498c1a93a1f3c6c9ab6f ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. priorityClassName: "" diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 1b0c2bf..711fa49 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -509,5 +509,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 926898b..7d6e126 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1299,7 +1299,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae + tag: latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7 ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 2a3af15..eb888ae 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 81568b2..133eaa8 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:e3eebefe1806fd4e67100167655894211fb2f8bd4166a8e1d87055a8e8465cae + tag: latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7 From bb4c0f33ce146dcec68f75aaff2d34bd4823dc8d Mon Sep 17 00:00:00 2001 From: Shubham Hibare <20609766+hibare@users.noreply.github.com> Date: Wed, 25 Feb 2026 20:25:42 +0530 Subject: [PATCH 18/25] chore: Bump controller manager image tag to 0.6.3 in README and values.yaml (#756) * chore: Bump controller manager image tag to 0.6.3 in README and values.yaml Signed-off-by: Shubham Hibare * chore: Trigger CI rerun Signed-off-by: Shubham Hibare --------- Signed-off-by: Shubham Hibare --- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 711fa49..0b133d1 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -288,7 +288,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.2` | +| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.3` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 7d6e126..a0b3fd1 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -605,7 +605,7 @@ controllerManager: registry: ghcr.io repository: spiffe/spire-controller-manager pullPolicy: IfNotPresent - tag: "0.6.2" + tag: "0.6.3" ## @param controllerManager.resources [object] Resource requests and limits for controller manager resources: {} From a9bee70c0b6a31f1661d386c2aed2c2b4b256e1d Mon Sep 17 00:00:00 2001 From: Shubham Hibare <20609766+hibare@users.noreply.github.com> Date: Thu, 26 Feb 2026 03:50:59 +0530 Subject: [PATCH 19/25] feat(spiffe-oidc-discovery-provider): Add configurable log format option. (#757) Signed-off-by: Shubham Hibare --- charts/spire/charts/spiffe-oidc-discovery-provider/README.md | 1 + .../spiffe-oidc-discovery-provider/templates/configmap.yaml | 1 + charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml | 2 ++ 3 files changed, 4 insertions(+) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 11edb4f..68b5c34 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -81,6 +81,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | | `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` | | `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | +| `config.logFormat` | The log format, valid values are "text" and "json" | `text` | | `config.jwtDomain` | The JWT domain. Defaults to oidc-discovery.$jwtIssuer URL-parsed host if unset | `""` | | `config.jwksUri` | The JWKS URI | `""` | | `config.serverPathPrefix` | If specified, all endpoints listened to will be prefixed by this value | `""` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml index 1e7d23d..a423778 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml @@ -21,6 +21,7 @@ {{- $oidcSocket := .oidcSocket }} {{- with .root }} log_level: {{ .Values.config.logLevel | quote }} +log_format: {{ .Values.config.logFormat | quote }} domains: - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}" diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index dbea77f..957f806 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -209,6 +209,8 @@ jwtIssuer: "" config: ## @param config.logLevel The log level, valid values are "debug", "info", "warn", and "error" logLevel: info + ## @param config.logFormat The log format, valid values are "text" and "json" + logFormat: text ## @param config.jwtDomain [string] The JWT domain. Defaults to oidc-discovery.$jwtIssuer URL-parsed host if unset jwtDomain: "" ## @param config.jwksUri [string] The JWKS URI From 0a841c76a20310ef8c71eca1c1d11b86606ea4e6 Mon Sep 17 00:00:00 2001 From: "spire-helm-version-checker[bot]" <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Date: Mon, 2 Mar 2026 10:03:57 +0100 Subject: [PATCH 20/25] Bump test chart dependencies (#759) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> --- .github/tests/charts.json | 4 ++-- .github/tests/oci-charts.json | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- charts/spire/charts/spire-agent/README.md | 6 +++--- charts/spire/charts/spire-agent/values.yaml | 6 +++--- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 10 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index ae20510..6a780ca 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,12 +2,12 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "82.2.1" + "version": "82.4.3" }, { "name": "cert-manager", "repo": "https://charts.jetstack.io", - "version": "v1.19.3" + "version": "v1.19.4" }, { "name": "ingress-nginx", diff --git a/.github/tests/oci-charts.json b/.github/tests/oci-charts.json index 91bef89..3b39d39 100644 --- a/.github/tests/oci-charts.json +++ b/.github/tests/oci-charts.json @@ -2,12 +2,12 @@ { "name": "mariadb", "registry": "docker.io/bitnamicharts/mariadb", - "version": "25.0.0" + "version": "25.0.1" }, { "name": "postgresql", "registry": "docker.io/bitnamicharts/postgresql", - "version": "18.4.0" + "version": "18.5.1" }, { "name": "envoy-gateway", diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 68b5c34..6dfe1d3 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -127,11 +127,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:205a8659ce60374de61aa1e439e48eaf52caa1bf32fa498c1a93a1f3c6c9ab6f` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 957f806..c9a3cbd 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -361,7 +361,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7 + tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -373,7 +373,7 @@ tests: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:205a8659ce60374de61aa1e439e48eaf52caa1bf32fa498c1a93a1f3c6c9ab6f + tag: latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275 step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index bc475f3..56fd066 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -73,7 +73,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | @@ -125,11 +125,11 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:205a8659ce60374de61aa1e439e48eaf52caa1bf32fa498c1a93a1f3c6c9ab6f` | +| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 3e32556..d76f1fc 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -159,7 +159,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7 + tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a keyManager: memory: @@ -317,7 +317,7 @@ socketAlternate: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7 + tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a hostCert: ## @param hostCert.image.registry The OCI registry to pull the image from @@ -329,7 +329,7 @@ hostCert: registry: cgr.dev repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:205a8659ce60374de61aa1e439e48eaf52caa1bf32fa498c1a93a1f3c6c9ab6f + tag: latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275 ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. priorityClassName: "" diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 0b133d1..b4b9022 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -509,5 +509,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index a0b3fd1..2fb5ee0 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1299,7 +1299,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7 + tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters kubeConfigs: {} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index eb888ae..373f94e 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 133eaa8..3ede662 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -162,4 +162,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:79edecdfa354dc659753cdd2e78ade9a4e94f4df0f1b7bcec6a2c1ed215abeb7 + tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a From 50afee93c0c5fe24eb4556d9dcbedc63cb5c2ad6 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 2 Mar 2026 10:15:03 +0100 Subject: [PATCH 21/25] Bump CI to last 3 k8s minors Signed-off-by: Marco Franssen --- .github/workflows/helm-chart-ci-ignore.yaml | 24 +++++++-------- .github/workflows/helm-chart-ci.yaml | 33 ++++++++++++--------- 2 files changed, 31 insertions(+), 26 deletions(-) diff --git a/.github/workflows/helm-chart-ci-ignore.yaml b/.github/workflows/helm-chart-ci-ignore.yaml index 68950d1..733a5bb 100644 --- a/.github/workflows/helm-chart-ci-ignore.yaml +++ b/.github/workflows/helm-chart-ci-ignore.yaml @@ -30,9 +30,9 @@ jobs: strategy: matrix: k8s: - - v1.31.1 - - v1.30.4 - - v1.29.8 + - v1.33.7 + - v1.34.3 + - v1.35.1 steps: - run: 'echo "Skipping tests"' @@ -74,9 +74,9 @@ jobs: strategy: matrix: k8s: - - v1.31.1 - - v1.30.4 - - v1.29.8 + - v1.33.7 + - v1.34.3 + - v1.35.1 example: - ${{ fromJson(needs.build-matrix.outputs.examples) }} @@ -92,9 +92,9 @@ jobs: strategy: matrix: k8s: - - v1.31.1 - - v1.30.4 - - v1.29.8 + - v1.33.7 + - v1.34.3 + - v1.35.1 example: - ${{ fromJson(needs.build-matrix.outputs.integrationtests) }} @@ -110,9 +110,9 @@ jobs: strategy: matrix: k8s: - - v1.31.1 - - v1.30.4 - - v1.29.8 + - v1.33.7 + - v1.34.3 + - v1.35.1 steps: - run: 'echo "Skipping upgrade-test"' diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index fed25b5..f531d50 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -2,6 +2,11 @@ name: Helm Chart CI on: workflow_dispatch: + inputs: + target_branch: + description: 'Target branch to lint/test against (e.g. main, release)' + required: false + default: 'main' pull_request: types: [synchronize, opened, reopened] paths: @@ -114,7 +119,7 @@ jobs: version: ${{ env.CHART_TESTING_VERSION }} - name: Run chart-testing (lint) - run: TARGET_BRANCH=${{ github.base_ref }} make lint${{ github.base_ref == 'release' && '-release' || '' }} + run: TARGET_BRANCH=${{ github.base_ref || inputs.target_branch }} make lint${{ (github.base_ref == 'release' || inputs.target_branch == 'release') && '-release' || '' }} test: runs-on: ubuntu-22.04 @@ -130,9 +135,9 @@ jobs: # Kubernetes, but can go back farther as long as we don't need heroics # to pull it off (i.e. kubectl version juggling). k8s: - - v1.31.1 - - v1.30.4 - - v1.29.8 + - v1.33.7 + - v1.34.3 + - v1.35.1 steps: - name: Checkout @@ -172,7 +177,7 @@ jobs: run: | helm install -n spire-server spire-crds charts/spire-crds ct install --config ct.yaml --excluded-charts spire-crds,spiffe-step-ssh \ - --target-branch ${{ github.base_ref }} + --target-branch ${{ github.base_ref || inputs.target_branch }} - name: Test summary if: always() @@ -218,9 +223,9 @@ jobs: fail-fast: false matrix: k8s: - - v1.31.1 - - v1.30.4 - - v1.29.8 + - v1.33.7 + - v1.34.3 + - v1.35.1 example: - ${{ fromJson(needs.build-matrix.outputs.examples) }} @@ -270,9 +275,9 @@ jobs: fail-fast: false matrix: k8s: - - v1.31.1 - - v1.30.4 - - v1.29.8 + - v1.33.7 + - v1.34.3 + - v1.35.1 integrationtest: - ${{ fromJson(needs.build-matrix.outputs.integrationtests) }} @@ -315,9 +320,9 @@ jobs: fail-fast: false matrix: k8s: - - v1.31.1 - - v1.30.4 - - v1.29.8 + - v1.33.7 + - v1.34.3 + - v1.35.1 steps: - name: Checkout From 0133d4a5a7c0cbaee732ba8fddf11d4af58b20a2 Mon Sep 17 00:00:00 2001 From: Daniel Schlatter Date: Tue, 3 Mar 2026 07:31:44 -0700 Subject: [PATCH 22/25] add key experimental.requirePQKEM for spire-server and spire-agent (#755) Signed-off-by: Daniel Schlatter Co-authored-by: kfox1111 --- charts/spire/charts/spire-agent/README.md | 1 + charts/spire/charts/spire-agent/templates/configmap.yaml | 1 + charts/spire/charts/spire-agent/values.yaml | 2 ++ charts/spire/charts/spire-server/README.md | 1 + charts/spire/charts/spire-server/templates/configmap.yaml | 1 + charts/spire/charts/spire-server/values.yaml | 2 ++ 6 files changed, 8 insertions(+) diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 56fd066..9a50493 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -143,6 +143,7 @@ A Helm chart to install the SPIRE agent. | `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` | | `experimental.enabled` | Allow configuration of experimental features | `false` | | `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` | +| `experimental.requirePQKEM` | Require use of a post-quantum-safe key exchange method for TLS handshakes. | `false` | | `experimental.featureFlags` | List of developer feature flags | `[]` | | `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 77c15ac..77be88f 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -77,6 +77,7 @@ agent: {{- if eq (.enabled | toString) "true" }} experimental: sync_interval: {{ .syncInterval | quote }} + require_pq_kem: {{ .requirePQKEM }} {{- if gt (len .featureFlags) 0 }} feature_flags: {{- range .featureFlags }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index d76f1fc..d5dbc2c 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -376,6 +376,8 @@ experimental: enabled: false ## @param experimental.syncInterval Sync interval with SPIRE server with exponential backoff syncInterval: 5s + ## @param experimental.requirePQKEM Require use of a post-quantum-safe key exchange method for TLS handshakes. + requirePQKEM: false ## @param experimental.featureFlags [array] List of developer feature flags featureFlags: [] diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index b4b9022..fa4e9b3 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -499,6 +499,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | | `experimental.eventsBasedCache` | Use events to update the cache with what's changed since the last update. | `false` | | `experimental.pruneEventsOlderThan` | How old an event can be before being deleted. Used with events based cache. | `12h` | +| `experimental.requirePQKEM` | Require use of a post-quantum-safe key exchange method for TLS handshakes. | `false` | | `experimental.featureFlags` | List of developer feature flags | `[]` | | `experimental.authOpaPolicyEngine` | The [auth opa_policy engine](https://github.com/spiffe/spire/blob/main/doc/authorization_policy_engine.md) used for authorization decisions. Defaults to the default SPIRE authorization policy. | `{}` | | `experimental.authOpaPolicyEngine.local.policy_data` | A JSON blob that defines additional data that can be used in the rego policy. | `""` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 07a10ed..701187c 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -105,6 +105,7 @@ server: cache_reload_interval: {{ .cacheReloadInterval | quote }} events_based_cache: {{ .eventsBasedCache }} prune_events_older_than: {{ .pruneEventsOlderThan | quote }} + require_pq_kem: {{ .requirePQKEM }} {{- if gt (len .featureFlags) 0 }} feature_flags: {{- range .featureFlags }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 2fb5ee0..19f3299 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1271,6 +1271,8 @@ experimental: eventsBasedCache: false ## @param experimental.pruneEventsOlderThan How old an event can be before being deleted. Used with events based cache. pruneEventsOlderThan: 12h + ## @param experimental.requirePQKEM Require use of a post-quantum-safe key exchange method for TLS handshakes. + requirePQKEM: false ## @param experimental.featureFlags [array] List of developer feature flags featureFlags: [] ## @param experimental.authOpaPolicyEngine [object] The [auth opa_policy engine](https://github.com/spiffe/spire/blob/main/doc/authorization_policy_engine.md) used for authorization decisions. Defaults to the default SPIRE authorization policy. From 24b3a1730e1bd7d30cb0b9100e47c2f94f466d69 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Tue, 3 Mar 2026 13:56:48 -0800 Subject: [PATCH 23/25] Change hostNetwork to auto (#758) --- charts/spire/charts/spire-agent/README.md | 2 +- charts/spire/charts/spire-agent/templates/daemonset.yaml | 5 +++-- charts/spire/charts/spire-agent/values.yaml | 4 ++-- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 9a50493..9e7d4d2 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -118,7 +118,7 @@ A Helm chart to install the SPIRE agent. | `telemetry.datadog.port` | The port of the datadog service to send metrics to | `8125` | | `kubeletConnectByHostname` | (DEPRECATED) Use kubeletAddress.mode instead. If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` | | `kubeletAddress.mode` | How to connect to kubelet for workload attestation | `auto` | -| `hostNetwork` | Enable hostNetwork for the DaemonSet. If empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. | `""` | +| `hostNetwork` | Enable hostNetwork for the DaemonSet. If auto or empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. | `""` | | `dnsPolicy` | DNS policy for the DaemonSet. If empty, uses ClusterFirstWithHostNet when hostNetwork is enabled. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy | `""` | | `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | | `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` | diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 5257606..83a194b 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -30,8 +30,9 @@ {{- $resolvedMode := include "spire-agent.kubelet-address-mode-resolved" . }} {{- $cbh := or (eq $resolvedMode "hostname") (eq $resolvedMode "hostip") }} {{- $hostNetwork := not $cbh }} -{{- if ne (.Values.hostNetwork | toString) "" }} -{{- $hostNetwork = eq (.Values.hostNetwork | toString) "true" }} +{{- $hostNetworkValue := .Values.hostNetwork | toString }} +{{- if and (ne $hostNetworkValue "") (ne $hostNetworkValue "auto") }} +{{- $hostNetwork = eq $hostNetworkValue "true" }} {{- end }} {{- $dnsPolicy := .Values.dnsPolicy }} {{- if (and (eq $dnsPolicy "") $hostNetwork) }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index d5dbc2c..75a93a2 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -294,8 +294,8 @@ kubeletAddress: ## provided at runtime or SPIRE agent will fail to start. mode: auto -## @param hostNetwork [string] Enable hostNetwork for the DaemonSet. If empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. -hostNetwork: "" +## @param hostNetwork [string] Enable hostNetwork for the DaemonSet. If auto or empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. +hostNetwork: auto ## @param dnsPolicy [string] DNS policy for the DaemonSet. If empty, uses ClusterFirstWithHostNet when hostNetwork is enabled. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy dnsPolicy: "" ## @param socketPath The unix socket path to the spire-agent From 6937ae01a23ebaee5485ba93c305b9187fbe7bfa Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Tue, 3 Mar 2026 14:06:46 -0800 Subject: [PATCH 24/25] Bump spire-nested Helm Chart version from 0.28.1 to 0.28.2 Signed-off-by: Faisal Memon --- charts/spire-nested/Chart.yaml | 2 +- charts/spire-nested/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire-nested/Chart.yaml b/charts/spire-nested/Chart.yaml index 4818038..cd748c0 100644 --- a/charts/spire-nested/Chart.yaml +++ b/charts/spire-nested/Chart.yaml @@ -3,7 +3,7 @@ name: spire-nested description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.28.1 +version: 0.28.2 appVersion: "1.14.1" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire diff --git a/charts/spire-nested/README.md b/charts/spire-nested/README.md index dc752c3..dd84abb 100644 --- a/charts/spire-nested/README.md +++ b/charts/spire-nested/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.28.1](https://img.shields.io/badge/Version-0.28.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.1](https://img.shields.io/badge/AppVersion-1.14.1-informational?style=flat-square) +![Version: 0.28.2](https://img.shields.io/badge/Version-0.28.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.1](https://img.shields.io/badge/AppVersion-1.14.1-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. From 85989b45ebc9f6469fc378d14d6f85895c68a70d Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Tue, 3 Mar 2026 14:07:18 -0800 Subject: [PATCH 25/25] Bump spire Helm Chart version from 0.28.1 to 0.28.2 * 24b3a173 Change hostNetwork to auto (#758) * 0133d4a5 add key experimental.requirePQKEM for spire-server and spire-agent (#755) * 0a841c76 Bump test chart dependencies (#759) * a9bee70c feat(spiffe-oidc-discovery-provider): Add configurable log format option. (#757) * bb4c0f33 chore: Bump controller manager image tag to 0.6.3 in README and values.yaml (#756) * 3e8f3f18 Bump test chart dependencies (#753) * b0aa3e42 Fix duplicate port names in controller-manager containers (#751) * 3daadc64 fix(spire-server): Support duration strings for connMaxLifetime (#752) * 730b76bb Bump test chart dependencies (#750) * e849a1fb Add configurable hostNetwork parameter for spire-agent (#749) * 982d53c2 Add ContainerResource scaling to spire-server HPA (#746) * 8abac78a Support leaderElection values in controller manager (#740) * 75ffbd06 Add imagePullSecrets support to helm hook jobs (#741) * 141c8865 Add pobLabels support to csi and oidc (#744) * 6b5d01b7 Bump test chart dependencies (#743) * ba2b6a5a Add controller-manager metrics to PodMonitor (#748) * 86a806f3 Add tolerations to spire-server hook pods (#742) * 7d266454 Fix keyManager check stopping use of unsupported bulit-in plugin (#715) * 666d304c Bump test chart dependencies (#738) * a7ac6a49 feat(spire-server): add logFormat configuration option (#735) Signed-off-by: Faisal Memon --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 6e16f03..4407dc1 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -3,7 +3,7 @@ name: spire description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.28.1 +version: 0.28.2 appVersion: "1.14.1" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire diff --git a/charts/spire/README.md b/charts/spire/README.md index 7f85487..61bdf81 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.28.1](https://img.shields.io/badge/Version-0.28.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.1](https://img.shields.io/badge/AppVersion-1.14.1-informational?style=flat-square) +![Version: 0.28.2](https://img.shields.io/badge/Version-0.28.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.1](https://img.shields.io/badge/AppVersion-1.14.1-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.