panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'main' into release

Browse Source
This commit is contained in:
Faisal Memon
2026-03-03 15:57:39 -08:00
parent ae69e6bede 85989b45eb
commit a754113b2f
42 changed files with 406 additions and 225 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/tests/charts.json
+3 -3
View File
@@ -2,16 +2,16 @@
{ {
"name": "kube-prometheus-stack", "name": "kube-prometheus-stack",
"repo": "https://prometheus-community.github.io/helm-charts", "repo": "https://prometheus-community.github.io/helm-charts",
"version": "81.2.2" "version": "82.4.3"
}, },
{ {
"name": "cert-manager", "name": "cert-manager",
"repo": "https://charts.jetstack.io", "repo": "https://charts.jetstack.io",
"version": "v1.19.2" "version": "v1.19.4"
}, },
{ {
"name": "ingress-nginx", "name": "ingress-nginx",
"repo": "https://kubernetes.github.io/ingress-nginx", "repo": "https://kubernetes.github.io/ingress-nginx",
"version": "4.14.1" "version": "4.14.3"
} }
] ]
.github/tests/oci-charts.json
+3 -3
View File
@@ -2,16 +2,16 @@
{ {
"name": "mariadb", "name": "mariadb",
"registry": "docker.io/bitnamicharts/mariadb", "registry": "docker.io/bitnamicharts/mariadb",
"version": "24.0.3" "version": "25.0.1"
}, },
{ {
"name": "postgresql", "name": "postgresql",
"registry": "docker.io/bitnamicharts/postgresql", "registry": "docker.io/bitnamicharts/postgresql",
"version": "18.2.3" "version": "18.5.1"
}, },
{ {
"name": "envoy-gateway", "name": "envoy-gateway",
"registry": "docker.io/envoyproxy/gateway-helm", "registry": "docker.io/envoyproxy/gateway-helm",
"version": "v1.6.2" "version": "v1.7.0"
} }
] ]
.github/workflows/helm-chart-ci-ignore.yaml
+12 -12
View File
@@ -30,9 +30,9 @@ jobs:
strategy: strategy:
matrix: matrix:
k8s: k8s:
- v1.31.1 - v1.33.7
- v1.30.4 - v1.34.3
- v1.29.8 - v1.35.1
steps: steps:
- run: 'echo "Skipping tests"' - run: 'echo "Skipping tests"'
@@ -74,9 +74,9 @@ jobs:
strategy: strategy:
matrix: matrix:
k8s: k8s:
- v1.31.1 - v1.33.7
- v1.30.4 - v1.34.3
- v1.29.8 - v1.35.1
example: example:
- ${{ fromJson(needs.build-matrix.outputs.examples) }} - ${{ fromJson(needs.build-matrix.outputs.examples) }}
@@ -92,9 +92,9 @@ jobs:
strategy: strategy:
matrix: matrix:
k8s: k8s:
- v1.31.1 - v1.33.7
- v1.30.4 - v1.34.3
- v1.29.8 - v1.35.1
example: example:
- ${{ fromJson(needs.build-matrix.outputs.integrationtests) }} - ${{ fromJson(needs.build-matrix.outputs.integrationtests) }}
@@ -110,9 +110,9 @@ jobs:
strategy: strategy:
matrix: matrix:
k8s: k8s:
- v1.31.1 - v1.33.7
- v1.30.4 - v1.34.3
- v1.29.8 - v1.35.1
steps: steps:
- run: 'echo "Skipping upgrade-test"' - run: 'echo "Skipping upgrade-test"'
.github/workflows/helm-chart-ci.yaml
+19 -14
View File
@@ -2,6 +2,11 @@ name: Helm Chart CI
on: on:
workflow_dispatch: workflow_dispatch:
inputs:
target_branch:
description: 'Target branch to lint/test against (e.g. main, release)'
required: false
default: 'main'
pull_request: pull_request:
types: [synchronize, opened, reopened] types: [synchronize, opened, reopened]
paths: paths:
@@ -114,7 +119,7 @@ jobs:
version: ${{ env.CHART_TESTING_VERSION }} version: ${{ env.CHART_TESTING_VERSION }}
- name: Run chart-testing (lint) - name: Run chart-testing (lint)
run: TARGET_BRANCH=${{ github.base_ref }} make lint${{ github.base_ref == 'release' && '-release' || '' }} run: TARGET_BRANCH=${{ github.base_ref || inputs.target_branch }} make lint${{ (github.base_ref == 'release' || inputs.target_branch == 'release') && '-release' || '' }}
test: test:
runs-on: ubuntu-22.04 runs-on: ubuntu-22.04
@@ -130,9 +135,9 @@ jobs:
# Kubernetes, but can go back farther as long as we don't need heroics # Kubernetes, but can go back farther as long as we don't need heroics
# to pull it off (i.e. kubectl version juggling). # to pull it off (i.e. kubectl version juggling).
k8s: k8s:
- v1.31.1 - v1.33.7
- v1.30.4 - v1.34.3
- v1.29.8 - v1.35.1
steps: steps:
- name: Checkout - name: Checkout
@@ -172,7 +177,7 @@ jobs:
run: | run: |
helm install -n spire-server spire-crds charts/spire-crds helm install -n spire-server spire-crds charts/spire-crds
ct install --config ct.yaml --excluded-charts spire-crds,spiffe-step-ssh \ ct install --config ct.yaml --excluded-charts spire-crds,spiffe-step-ssh \
--target-branch ${{ github.base_ref }} --target-branch ${{ github.base_ref || inputs.target_branch }}
- name: Test summary - name: Test summary
if: always() if: always()
@@ -218,9 +223,9 @@ jobs:
fail-fast: false fail-fast: false
matrix: matrix:
k8s: k8s:
- v1.31.1 - v1.33.7
- v1.30.4 - v1.34.3
- v1.29.8 - v1.35.1
example: example:
- ${{ fromJson(needs.build-matrix.outputs.examples) }} - ${{ fromJson(needs.build-matrix.outputs.examples) }}
@@ -270,9 +275,9 @@ jobs:
fail-fast: false fail-fast: false
matrix: matrix:
k8s: k8s:
- v1.31.1 - v1.33.7
- v1.30.4 - v1.34.3
- v1.29.8 - v1.35.1
integrationtest: integrationtest:
- ${{ fromJson(needs.build-matrix.outputs.integrationtests) }} - ${{ fromJson(needs.build-matrix.outputs.integrationtests) }}
@@ -315,9 +320,9 @@ jobs:
fail-fast: false fail-fast: false
matrix: matrix:
k8s: k8s:
- v1.31.1 - v1.33.7
- v1.30.4 - v1.34.3
- v1.29.8 - v1.35.1
steps: steps:
- name: Checkout - name: Checkout
charts/spire-nested/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spire-nested
description: > description: >
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
type: application type: application
version: 0.28.1 version: 0.28.2
appVersion: "1.14.1" appVersion: "1.14.1"
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
charts/spire-nested/README.md
+1 -1
View File
@@ -1,6 +1,6 @@
# spire # spire
![Version: 0.28.1](https://img.shields.io/badge/Version-0.28.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.1](https://img.shields.io/badge/AppVersion-1.14.1-informational?style=flat-square) ![Version: 0.28.2](https://img.shields.io/badge/Version-0.28.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.1](https://img.shields.io/badge/AppVersion-1.14.1-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
charts/spire/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spire
description: > description: >
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
type: application type: application
version: 0.28.1 version: 0.28.2
appVersion: "1.14.1" appVersion: "1.14.1"
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
charts/spire/README.md
+2 -1
View File
@@ -1,6 +1,6 @@
# spire # spire
![Version: 0.28.1](https://img.shields.io/badge/Version-0.28.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.1](https://img.shields.io/badge/AppVersion-1.14.1-informational?style=flat-square) ![Version: 0.28.2](https://img.shields.io/badge/Version-0.28.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.14.1](https://img.shields.io/badge/AppVersion-1.14.1-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
@@ -273,6 +273,7 @@ Now you can interact with the Spire agent socket from your own application. The
| Name | Description | Value | | Name | Description | Value |
| ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | | ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- |
| `global.imagePullSecrets` | Image pull secret names | `[]` |
| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` | | `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` |
| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` | | `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` |
| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` | | `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` |
charts/spire/charts/spiffe-csi-driver/README.md
+2 -1
View File
@@ -51,6 +51,7 @@ A Helm chart to install the SPIFFE CSI driver.
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | | `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | | `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
| `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` | | `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` |
| `podLabels` | Labels to add to pods | `{}` |
| `podSecurityContext` | Security context for CSI driver pods | `{}` | | `podSecurityContext` | Security context for CSI driver pods | `{}` |
| `securityContext` | Security context for CSI driver containers | `{}` | | `securityContext` | Security context for CSI driver containers | `{}` |
| `nodeSelector` | Node selector for CSI driver pods | `{}` | | `nodeSelector` | Node selector for CSI driver pods | `{}` |
@@ -72,5 +73,5 @@ A Helm chart to install the SPIFFE CSI driver.
| `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` | | `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` |
| `selinux.image.repository` | The repository within the registry | `ubi9` | | `selinux.image.repository` | The repository within the registry | `ubi9` |
| `selinux.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `selinux.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1769057030` | | `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `9.7-1771346757` |
charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
+4 -1
View File
@@ -31,8 +31,11 @@ spec:
{{- end }} {{- end }}
labels: labels:
{{- include "spiffe-csi-driver.selectorLabels" . | nindent 8 }} {{- include "spiffe-csi-driver.selectorLabels" . | nindent 8 }}
{{- with .Values.podLabels }}
{{- toYaml . | nindent 8 }}
{{- end }}
spec: spec:
{{- with .Values.imagePullSecrets }} {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
imagePullSecrets: imagePullSecrets:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
charts/spire/charts/spiffe-csi-driver/values.yaml
+4 -1
View File
@@ -91,6 +91,9 @@ serviceAccount:
## @param podAnnotations [object] Pod annotations for spiffe-csi-driver ## @param podAnnotations [object] Pod annotations for spiffe-csi-driver
podAnnotations: {} podAnnotations: {}
## @param podLabels [object] Labels to add to pods
podLabels: {}
## @param podSecurityContext [object] Security context for CSI driver pods ## @param podSecurityContext [object] Security context for CSI driver pods
podSecurityContext: {} podSecurityContext: {}
# fsGroup: 2000 # fsGroup: 2000
@@ -163,4 +166,4 @@ selinux:
registry: registry.access.redhat.com registry: registry.access.redhat.com
repository: ubi9 repository: ubi9
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: 9.7-1769057030 tag: 9.7-1771346757
charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+5 -3
View File
@@ -60,6 +60,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | | `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | | `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` |
| `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` | | `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` |
| `podLabels` | Labels to add to pods | `{}` |
| `tls.spire.enabled` | Use spire to secure the oidc-discovery-provider | `true` | | `tls.spire.enabled` | Use spire to secure the oidc-discovery-provider | `true` |
| `tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` | | `tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` |
| `tls.externalSecret.secretName` | Specify which Secret to use | `""` | | `tls.externalSecret.secretName` | Specify which Secret to use | `""` |
@@ -75,11 +76,12 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from. Only used when TLS is disabled. | `docker.io` | | `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from. Only used when TLS is disabled. | `docker.io` |
| `insecureScheme.nginx.image.repository` | The repository within the registry. Only used when TLS is disabled. | `nginxinc/nginx-unprivileged` | | `insecureScheme.nginx.image.repository` | The repository within the registry. Only used when TLS is disabled. | `nginxinc/nginx-unprivileged` |
| `insecureScheme.nginx.image.pullPolicy` | The image pull policy. Only used when TLS is disabled. | `IfNotPresent` | | `insecureScheme.nginx.image.pullPolicy` | The image pull policy. Only used when TLS is disabled. | `IfNotPresent` |
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.29.3-alpine` | | `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.29.5-alpine` |
| `insecureScheme.nginx.ipMode` | IP modes supported by the cluster. Must be one of [ipv4, ipv6, both] | `both` | | `insecureScheme.nginx.ipMode` | IP modes supported by the cluster. Must be one of [ipv4, ipv6, both] | `both` |
| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | | `insecureScheme.nginx.resources` | Resource requests and limits | `{}` |
| `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` | | `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` |
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | | `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
| `config.logFormat` | The log format, valid values are "text" and "json" | `text` |
| `config.jwtDomain` | The JWT domain. Defaults to oidc-discovery.$jwtIssuer URL-parsed host if unset | `""` | | `config.jwtDomain` | The JWT domain. Defaults to oidc-discovery.$jwtIssuer URL-parsed host if unset | `""` |
| `config.jwksUri` | The JWKS URI | `""` | | `config.jwksUri` | The JWKS URI | `""` |
| `config.serverPathPrefix` | If specified, all endpoints listened to will be prefixed by this value | `""` | | `config.serverPathPrefix` | If specified, all endpoints listened to will be prefixed by this value | `""` |
@@ -125,11 +127,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` |
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0ba70a117710f95ba7d7a9ad0932e920c2785c1bb244ca858cd6445e4526e1f4` | | `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275` |
| `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` |
| `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` |
charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml
+1
View File
@@ -21,6 +21,7 @@
{{- $oidcSocket := .oidcSocket }} {{- $oidcSocket := .oidcSocket }}
{{- with .root }} {{- with .root }}
log_level: {{ .Values.config.logLevel | quote }} log_level: {{ .Values.config.logLevel | quote }}
log_format: {{ .Values.config.logFormat | quote }}
domains: domains:
- "{{ include "spiffe-oidc-discovery-provider.fullname" . }}" - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}"
charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml
+4 -1
View File
@@ -30,8 +30,11 @@ spec:
release: {{ .Release.Name }} release: {{ .Release.Name }}
release-namespace: {{ .Release.Namespace }} release-namespace: {{ .Release.Namespace }}
component: oidc-discovery-provider component: oidc-discovery-provider
{{- with .Values.podLabels }}
{{- toYaml . | nindent 8 }}
{{- end }}
spec: spec:
{{- with .Values.imagePullSecrets }} {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
imagePullSecrets: imagePullSecrets:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml
+4
View File
@@ -57,6 +57,10 @@ spec:
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}-pre-delete name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}-pre-delete
spec: spec:
restartPolicy: Never restartPolicy: Never
{{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete
securityContext: securityContext:
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }} {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+8 -3
View File
@@ -125,6 +125,9 @@ livenessProbe:
## @param podAnnotations [object] Pod annotations for Spire OIDC discovery provider ## @param podAnnotations [object] Pod annotations for Spire OIDC discovery provider
podAnnotations: {} podAnnotations: {}
## @param podLabels [object] Labels to add to pods
podLabels: {}
# Select from one of the options below to be the source of certificates for OIDC Discovery Provider. # Select from one of the options below to be the source of certificates for OIDC Discovery Provider.
# If none are enabled, connections won't be TLS encrypted. # If none are enabled, connections won't be TLS encrypted.
tls: tls:
@@ -184,7 +187,7 @@ insecureScheme:
registry: docker.io registry: docker.io
repository: nginxinc/nginx-unprivileged repository: nginxinc/nginx-unprivileged
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: 1.29.3-alpine tag: 1.29.5-alpine
## @param insecureScheme.nginx.ipMode IP modes supported by the cluster. Must be one of [ipv4, ipv6, both] ## @param insecureScheme.nginx.ipMode IP modes supported by the cluster. Must be one of [ipv4, ipv6, both]
ipMode: both ipMode: both
## @param insecureScheme.nginx.resources Resource requests and limits ## @param insecureScheme.nginx.resources Resource requests and limits
@@ -206,6 +209,8 @@ jwtIssuer: ""
config: config:
## @param config.logLevel The log level, valid values are "debug", "info", "warn", and "error" ## @param config.logLevel The log level, valid values are "debug", "info", "warn", and "error"
logLevel: info logLevel: info
## @param config.logFormat The log format, valid values are "text" and "json"
logFormat: text
## @param config.jwtDomain [string] The JWT domain. Defaults to oidc-discovery.$jwtIssuer URL-parsed host if unset ## @param config.jwtDomain [string] The JWT domain. Defaults to oidc-discovery.$jwtIssuer URL-parsed host if unset
jwtDomain: "" jwtDomain: ""
## @param config.jwksUri [string] The JWKS URI ## @param config.jwksUri [string] The JWKS URI
@@ -356,7 +361,7 @@ tests:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507 tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a
toolkit: toolkit:
## @param tests.toolkit.image.registry The OCI registry to pull the image from ## @param tests.toolkit.image.registry The OCI registry to pull the image from
@@ -368,7 +373,7 @@ tests:
registry: cgr.dev registry: cgr.dev
repository: chainguard/min-toolkit-debug repository: chainguard/min-toolkit-debug
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:0ba70a117710f95ba7d7a9ad0932e920c2785c1bb244ca858cd6445e4526e1f4 tag: latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275
step: step:
## @param tests.step.image.registry The OCI registry to pull the image from ## @param tests.step.image.registry The OCI registry to pull the image from
charts/spire/charts/spike-keeper/templates/statefulset.yaml
+1 -1
View File
@@ -19,7 +19,7 @@ spec:
release-namespace: {{ .Release.Namespace }} release-namespace: {{ .Release.Namespace }}
component: spike-keeper component: spike-keeper
spec: spec:
{{- with .Values.imagePullSecrets }} {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
imagePullSecrets: imagePullSecrets:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml
+4
View File
@@ -68,6 +68,10 @@ spec:
component: spike-bootstrap component: spike-bootstrap
spec: spec:
restartPolicy: Never restartPolicy: Never
{{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "spike-nexus.serviceAccountName" . }}-bootstrap serviceAccountName: {{ include "spike-nexus.serviceAccountName" . }}-bootstrap
securityContext: securityContext:
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }} {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
charts/spire/charts/spike-nexus/templates/statefulset.yaml
+1 -1
View File
@@ -18,7 +18,7 @@ spec:
release-namespace: {{ .Release.Namespace }} release-namespace: {{ .Release.Namespace }}
component: spike-nexus component: spike-nexus
spec: spec:
{{- with .Values.imagePullSecrets }} {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
imagePullSecrets: imagePullSecrets:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
charts/spire/charts/spike-pilot/templates/deployment.yaml
+1 -1
View File
@@ -18,7 +18,7 @@ spec:
release-namespace: {{ .Release.Namespace }} release-namespace: {{ .Release.Namespace }}
component: spike-pilot component: spike-pilot
spec: spec:
{{- with .Values.imagePullSecrets }} {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
imagePullSecrets: imagePullSecrets:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
charts/spire/charts/spire-agent/README.md
+130 -128
View File
@@ -25,131 +25,133 @@ A Helm chart to install the SPIRE agent.
### Chart parameters ### Chart parameters
| Name | Description | Value | | Name | Description | Value |
| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | | ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `image.repository` | The repository within the registry | `spiffe/spire-agent` | | `image.repository` | The repository within the registry | `spiffe/spire-agent` |
| `image.pullPolicy` | The image pull policy | `IfNotPresent` | | `image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `imagePullSecrets` | Pull secrets for images | `[]` | | `imagePullSecrets` | Pull secrets for images | `[]` |
| `nameOverride` | Name override | `""` | | `nameOverride` | Name override | `""` |
| `namespaceOverride` | Namespace override | `""` | | `namespaceOverride` | Namespace override | `""` |
| `fullnameOverride` | Fullname override | `""` | | `fullnameOverride` | Fullname override | `""` |
| `serviceAccount.create` | Specifies whether a service account should be created | `true` | | `serviceAccount.create` | Specifies whether a service account should be created | `true` |
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | | `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
| `serviceAccount.name` | The name of the service account to use. | `""` | | `serviceAccount.name` | The name of the service account to use. | `""` |
| `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` | | `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` |
| `podAnnotations` | Annotations to add to pods | `{}` | | `podAnnotations` | Annotations to add to pods | `{}` |
| `podLabels` | Labels to add to pods | `{}` | | `podLabels` | Labels to add to pods | `{}` |
| `podSecurityContext` | Pod security context | `{}` | | `podSecurityContext` | Pod security context | `{}` |
| `securityContext` | Security context | `{}` | | `securityContext` | Security context | `{}` |
| `resources` | Resource requests and limits for the spire-agent container and all its initContainers | `{}` | | `resources` | Resource requests and limits for the spire-agent container and all its initContainers | `{}` |
| `nodeSelector` | Node selector | `{}` | | `nodeSelector` | Node selector | `{}` |
| `tolerations` | List of tolerations | `[]` | | `tolerations` | List of tolerations | `[]` |
| `affinity` | Node affinity | `{}` | | `affinity` | Node affinity | `{}` |
| `authorizedDelegates` | A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information. | `[]` | | `authorizedDelegates` | A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information. | `[]` |
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | | `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
| `logFormat` | The log format, valid values are "text" and "json" | `text` | | `logFormat` | The log format, valid values are "text" and "json" | `text` |
| `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` | | `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` |
| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` | | `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` |
| `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` | | `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` |
| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `spiffe` | | `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `spiffe` |
| `trustBundleHostPath` | If set, obtain trust bundle from a file on the host instead of from the ConfigMap | `""` | | `trustBundleHostPath` | If set, obtain trust bundle from a file on the host instead of from the ConfigMap | `""` |
| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` | | `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` |
| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` | | `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` |
| `rebootstrapMode` | How the agent will behave when seeing an unknown x509 cert from the server. It can be set to never, auto, or always | `always` | | `rebootstrapMode` | How the agent will behave when seeing an unknown x509 cert from the server. It can be set to never, auto, or always | `always` |
| `rebootstrapDelay` | The agent will rebootstrap after configured amount of time on unknown x509 cert from the server | `10m` | | `rebootstrapDelay` | The agent will rebootstrap after configured amount of time on unknown x509 cert from the server | `10m` |
| `server.address` | Address for Spire server | `""` | | `server.address` | Address for Spire server | `""` |
| `server.port` | Port number for Spire server | `443` | | `server.port` | Port number for Spire server | `443` |
| `server.namespaceOverride` | Override the namespace for Spire server | `""` | | `server.namespaceOverride` | Override the namespace for Spire server | `""` |
| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` | | `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
| `healthChecks.port` | override the host port used for health checking | `9982` | | `healthChecks.port` | override the host port used for health checking | `9982` |
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` | | `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` | | `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` |
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | | `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` | | `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` | | `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` |
| `readinessProbe.periodSeconds` | Period seconds for probe | `30` | | `readinessProbe.periodSeconds` | Period seconds for probe | `30` |
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
| `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507` | | `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` |
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
| `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | | `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` |
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` |
| `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` | | `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` |
| `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` | | `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` |
| `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` | | `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` |
| `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` | | `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` |
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` | | `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-agent` | | `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-agent` |
| `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.9.0` | | `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.9.0` |
| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `22f67063f1699330e70cdedc9b923e517688f5ae71085a26bd9b83b3060ee86e` | | `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `22f67063f1699330e70cdedc9b923e517688f5ae71085a26bd9b83b3060ee86e` |
| `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` | | `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` |
| `nodeAttestor.tpmDirect.pubHash.enabled` | Display pubhash in logs | `true` | | `nodeAttestor.tpmDirect.pubHash.enabled` | Display pubhash in logs | `true` |
| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-get-tpm-pubhash` | | `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-get-tpm-pubhash` |
| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.9.0` | | `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.9.0` |
| `nodeAttestor.awsIID.enabled` | Enable the aws_iid Node Attestor | `false` | | `nodeAttestor.awsIID.enabled` | Enable the aws_iid Node Attestor | `false` |
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
| `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` | | `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` |
| `workloadAttestors.k8s.verification.hostCert.basePath` | Path where kubelet places its certificates | `/var/lib/kubelet/pki` | | `workloadAttestors.k8s.verification.hostCert.basePath` | Path where kubelet places its certificates | `/var/lib/kubelet/pki` |
| `workloadAttestors.k8s.verification.hostCert.fileName` | File name where kubelet places its certificates. If blank, it will be auto detected. | `""` | | `workloadAttestors.k8s.verification.hostCert.fileName` | File name where kubelet places its certificates. If blank, it will be auto detected. | `""` |
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` | | `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true | `true` | | `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true | `true` |
| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` | | `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` |
| `sds.enabled` | Enables Envoy SDS configuration | `false` | | `sds.enabled` | Enables Envoy SDS configuration | `false` |
| `sds.defaultSVIDName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` | | `sds.defaultSVIDName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` |
| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` | | `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` |
| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` | | `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` |
| `sds.disableSPIFFECertValidation` | Disable Envoy SDS custom validation | `false` | | `sds.disableSPIFFECertValidation` | Disable Envoy SDS custom validation | `false` |
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | | `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | | `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
| `telemetry.prometheus.host` | Host for prometheus metrics | `0.0.0.0` | | `telemetry.prometheus.host` | Host for prometheus metrics | `0.0.0.0` |
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | | `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` | | `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | | `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
| `telemetry.datadog.enabled` | Flag to enable datadog monitoring | `false` | | `telemetry.datadog.enabled` | Flag to enable datadog monitoring | `false` |
| `telemetry.datadog.address` | The address of the datadog service to send metrics to. The default URL for services are `<service-name>.<namespace>.svc` | `datadog.kube-system.svc` | | `telemetry.datadog.address` | The address of the datadog service to send metrics to. The default URL for services are `<service-name>.<namespace>.svc` | `datadog.kube-system.svc` |
| `telemetry.datadog.port` | The port of the datadog service to send metrics to | `8125` | | `telemetry.datadog.port` | The port of the datadog service to send metrics to | `8125` |
| `kubeletConnectByHostname` | (DEPRECATED) Use kubeletAddress.mode instead. If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` | | `kubeletConnectByHostname` | (DEPRECATED) Use kubeletAddress.mode instead. If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
| `kubeletAddress.mode` | How to connect to kubelet for workload attestation | `auto` | | `kubeletAddress.mode` | How to connect to kubelet for workload attestation | `auto` |
| `dnsPolicy` | dnsPolicy to assign to the DaemonSet. See valid values here: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy. If left empty, ClusterFirstWithHostNet will be used if kubeletAddress.mode does not resolve to hostip or hostname, otherwise, the default dnsPolicy will be used. | `""` | | `hostNetwork` | Enable hostNetwork for the DaemonSet. If auto or empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. | `""` |
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | | `dnsPolicy` | DNS policy for the DaemonSet. If empty, uses ClusterFirstWithHostNet when hostNetwork is enabled. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy | `""` |
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` | | `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` |
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507` | | `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` |
| `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0ba70a117710f95ba7d7a9ad0932e920c2785c1bb244ca858cd6445e4526e1f4` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275` |
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` |
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` | | `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` |
| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` | | `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` | | `initContainers` | Additional init containers to create with Spire Agent pods | `[]` |
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` | | `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` |
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` | | `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
| `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` | | `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
| `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` | | `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` |
| `experimental.enabled` | Allow configuration of experimental features | `false` | | `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` |
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` | | `experimental.enabled` | Allow configuration of experimental features | `false` |
| `experimental.featureFlags` | List of developer feature flags | `[]` | | `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` | | `experimental.requirePQKEM` | Require use of a post-quantum-safe key exchange method for TLS handshakes. | `false` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | | `experimental.featureFlags` | List of developer feature flags | `[]` |
| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` | | `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` |
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `tools.kubectl.image.repository` | The repository within the registry | `kubectl` |
| `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` | | `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` | | `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` | | `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` |
| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` | | `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` |
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` | | `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` |
| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` |
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` |
charts/spire/charts/spire-agent/templates/configmap.yaml
+1
View File
@@ -77,6 +77,7 @@ agent:
{{- if eq (.enabled | toString) "true" }} {{- if eq (.enabled | toString) "true" }}
experimental: experimental:
sync_interval: {{ .syncInterval | quote }} sync_interval: {{ .syncInterval | quote }}
require_pq_kem: {{ .requirePQKEM }}
{{- if gt (len .featureFlags) 0 }} {{- if gt (len .featureFlags) 0 }}
feature_flags: feature_flags:
{{- range .featureFlags }} {{- range .featureFlags }}
charts/spire/charts/spire-agent/templates/daemonset.yaml
+9 -4
View File
@@ -29,9 +29,14 @@
{{- end }} {{- end }}
{{- $resolvedMode := include "spire-agent.kubelet-address-mode-resolved" . }} {{- $resolvedMode := include "spire-agent.kubelet-address-mode-resolved" . }}
{{- $cbh := or (eq $resolvedMode "hostname") (eq $resolvedMode "hostip") }} {{- $cbh := or (eq $resolvedMode "hostname") (eq $resolvedMode "hostip") }}
{{- $hostNetwork := not $cbh }}
{{- $hostNetworkValue := .Values.hostNetwork | toString }}
{{- if and (ne $hostNetworkValue "") (ne $hostNetworkValue "auto") }}
{{- $hostNetwork = eq $hostNetworkValue "true" }}
{{- end }}
{{- $dnsPolicy := .Values.dnsPolicy }} {{- $dnsPolicy := .Values.dnsPolicy }}
{{- if (and (eq $dnsPolicy "") (not $cbh)) }} {{- if (and (eq $dnsPolicy "") $hostNetwork) }}
{{- $dnsPolicy = "ClusterFirstWithHostNet" }} {{- $dnsPolicy = "ClusterFirstWithHostNet" }}
{{- end }} {{- end }}
{{- $socketAlternateNames := index (include "spire-agent.socket-alternate-names" . | fromYaml) "names" }} {{- $socketAlternateNames := index (include "spire-agent.socket-alternate-names" . | fromYaml) "names" }}
{{- $socketPath := include "spire-agent.socket-path" . }} {{- $socketPath := include "spire-agent.socket-path" . }}
@@ -75,12 +80,12 @@ spec:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
spec: spec:
{{- with .Values.imagePullSecrets }} {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
imagePullSecrets: imagePullSecrets:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
hostPID: true hostPID: true
{{- if not $cbh }} {{- if $hostNetwork }}
hostNetwork: true hostNetwork: true
{{- end }} {{- end }}
{{- if ne $dnsPolicy "" }} {{- if ne $dnsPolicy "" }}
charts/spire/charts/spire-agent/values.yaml
+8 -4
View File
@@ -159,7 +159,7 @@ fsGroupFix:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507 tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a
keyManager: keyManager:
memory: memory:
@@ -294,7 +294,9 @@ kubeletAddress:
## provided at runtime or SPIRE agent will fail to start. ## provided at runtime or SPIRE agent will fail to start.
mode: auto mode: auto
## @param dnsPolicy [string] dnsPolicy to assign to the DaemonSet. See valid values here: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy. If left empty, ClusterFirstWithHostNet will be used if kubeletAddress.mode does not resolve to hostip or hostname, otherwise, the default dnsPolicy will be used. ## @param hostNetwork [string] Enable hostNetwork for the DaemonSet. If auto or empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override.
hostNetwork: auto
## @param dnsPolicy [string] DNS policy for the DaemonSet. If empty, uses ClusterFirstWithHostNet when hostNetwork is enabled. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
dnsPolicy: "" dnsPolicy: ""
## @param socketPath The unix socket path to the spire-agent ## @param socketPath The unix socket path to the spire-agent
socketPath: /run/spire/agent-sockets/spire-agent.sock socketPath: /run/spire/agent-sockets/spire-agent.sock
@@ -315,7 +317,7 @@ socketAlternate:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507 tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a
hostCert: hostCert:
## @param hostCert.image.registry The OCI registry to pull the image from ## @param hostCert.image.registry The OCI registry to pull the image from
@@ -327,7 +329,7 @@ hostCert:
registry: cgr.dev registry: cgr.dev
repository: chainguard/min-toolkit-debug repository: chainguard/min-toolkit-debug
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:0ba70a117710f95ba7d7a9ad0932e920c2785c1bb244ca858cd6445e4526e1f4 tag: latest@sha256:808212996e8bb2f3a0fa1dfa3e28e5a6687b22a3d8524a2ae2e5d87d7bb71275
## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.
priorityClassName: "" priorityClassName: ""
@@ -374,6 +376,8 @@ experimental:
enabled: false enabled: false
## @param experimental.syncInterval Sync interval with SPIRE server with exponential backoff ## @param experimental.syncInterval Sync interval with SPIRE server with exponential backoff
syncInterval: 5s syncInterval: 5s
## @param experimental.requirePQKEM Require use of a post-quantum-safe key exchange method for TLS handshakes.
requirePQKEM: false
## @param experimental.featureFlags [array] List of developer feature flags ## @param experimental.featureFlags [array] List of developer feature flags
featureFlags: [] featureFlags: []
charts/spire/charts/spire-server/README.md
+13 -4
View File
@@ -110,6 +110,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `autoscaling.enabled` | Flag to enable autoscaling | `false` | | `autoscaling.enabled` | Flag to enable autoscaling | `false` |
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` | | `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` | | `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` |
| `autoscaling.scaleOnSPIREServerOnly` | Flag to only consider the main SPIRE container for autoscaling purposes | `false` |
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization that triggers autoscaling | `80` | | `autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization that triggers autoscaling | `80` |
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` | | `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` |
| `tolerations` | List of tolerations | `[]` | | `tolerations` | List of tolerations | `[]` |
@@ -142,7 +143,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` | | `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
| `dataStore.sql.maxOpenConns` | The maximum number of open db connections | `100` | | `dataStore.sql.maxOpenConns` | The maximum number of open db connections | `100` |
| `dataStore.sql.maxIdleConns` | The maximum number of idle connections in the pool | `2` | | `dataStore.sql.maxIdleConns` | The maximum number of idle connections in the pool | `2` |
| `dataStore.sql.connMaxLifetime` | The maximum amount of time a connection may be reused. If 0, time is unlimited | `0` | | `dataStore.sql.connMaxLifetime` | The maximum amount of time a connection may be reused. Supports duration strings (e.g., "1h", "30m", "3600s") or 0 for unlimited. Duration strings are recommended to prevent connection accumulation. | `0` |
| `dataStore.sql.disableMigration` | True to disable auto-migration functionality | `false` | | `dataStore.sql.disableMigration` | True to disable auto-migration functionality | `false` |
| `dataStore.sql.region` | Region to use when database type is either aws_mysql or aws_postgresql | `""` | | `dataStore.sql.region` | Region to use when database type is either aws_mysql or aws_postgresql | `""` |
| `dataStore.sql.readOnly.enabled` | Set to true to configure a readOnly dartabase connection | `false` | | `dataStore.sql.readOnly.enabled` | Set to true to configure a readOnly dartabase connection | `false` |
@@ -157,6 +158,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `adminIDs` | SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges. | `[]` | | `adminIDs` | SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges. | `[]` |
| `auditLogEnabled` | If true, enables audit logging | `false` | | `auditLogEnabled` | If true, enables audit logging | `false` |
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | | `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
| `logFormat` | The log format, valid values are "text" and "json" | `text` |
| `jwtIssuer` | The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset | `""` | | `jwtIssuer` | The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset | `""` |
| `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` | | `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` |
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | | `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
@@ -275,6 +277,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.addEntryIDPrefix` | If true, prepends the clusterName to the entryID of each entry the controller manager registers. | `true` | | `controllerManager.addEntryIDPrefix` | If true, prepends the clusterName to the entryID of each entry the controller manager registers. | `true` |
| `controllerManager.gcInterval` | How often the SPIRE state is reconciled when the controller is otherwise idle. This impacts how quickly SPIRE state will converge after CRDs are removed or SPIRE state is mutated underneath the controller. Values are in nanoseconds. | `10000000000` | | `controllerManager.gcInterval` | How often the SPIRE state is reconciled when the controller is otherwise idle. This impacts how quickly SPIRE state will converge after CRDs are removed or SPIRE state is mutated underneath the controller. Values are in nanoseconds. | `10000000000` |
| `controllerManager.logLevel` | The log level for the controller manager. Supported values are info, error, warn and debug. | `info` | | `controllerManager.logLevel` | The log level for the controller manager. Supported values are info, error, warn and debug. | `info` |
| `controllerManager.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` |
| `controllerManager.leaderElection.renewDeadline` | Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. | `10s` |
| `controllerManager.leaderElection.retryPeriod` | Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. | `2s` |
| `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` | | `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
| `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` | | `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` |
| `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` | | `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` |
@@ -283,7 +288,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.2` | | `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.3` |
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
| `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.securityContext` | Security context | `{}` |
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
@@ -341,6 +346,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `externalControllerManagers.defaults.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` | | `externalControllerManagers.defaults.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
| `externalControllerManagers.defaults.entryIDPrefixCleanup` | consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` | | `externalControllerManagers.defaults.entryIDPrefixCleanup` | consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` |
| `externalControllerManagers.defaults.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` | | `externalControllerManagers.defaults.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
| `externalControllerManagers.defaults.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` |
| `externalControllerManagers.defaults.leaderElection.renewDeadline` | Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. | `10s` |
| `externalControllerManagers.defaults.leaderElection.retryPeriod` | Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. | `2s` |
| `externalControllerManagers.defaults.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` | | `externalControllerManagers.defaults.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` |
| `externalControllerManagers.defaults.extraEnv` | Extra environment variables to add to the controller manager | `[]` | | `externalControllerManagers.defaults.extraEnv` | Extra environment variables to add to the controller manager | `[]` |
| `externalControllerManagers.defaults.resources` | Resource requests and limits for controller manager | `{}` | | `externalControllerManagers.defaults.resources` | Resource requests and limits for controller manager | `{}` |
@@ -348,7 +356,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `externalControllerManagers.defaults.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` | | `externalControllerManagers.defaults.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` |
| `externalControllerManagers.defaults.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` | | `externalControllerManagers.defaults.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` |
| `externalControllerManagers.defaults.cacheNamespaces` | If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. | `{}` | | `externalControllerManagers.defaults.cacheNamespaces` | If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. | `{}` |
| `externalControllerManagers.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` | | `externalControllerManagers.clusters` | A dictionary of clusters to add with optional overrides (kubeConfigName, reconcile, healthPortName, prometheusPortName). If empty, all clusters defined in kubeConfigs will be used. | `{}` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` | | `tools.kubectl.image.repository` | The repository within the registry | `kubectl` |
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
@@ -491,6 +499,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | | `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` |
| `experimental.eventsBasedCache` | Use events to update the cache with what's changed since the last update. | `false` | | `experimental.eventsBasedCache` | Use events to update the cache with what's changed since the last update. | `false` |
| `experimental.pruneEventsOlderThan` | How old an event can be before being deleted. Used with events based cache. | `12h` | | `experimental.pruneEventsOlderThan` | How old an event can be before being deleted. Used with events based cache. | `12h` |
| `experimental.requirePQKEM` | Require use of a post-quantum-safe key exchange method for TLS handshakes. | `false` |
| `experimental.featureFlags` | List of developer feature flags | `[]` | | `experimental.featureFlags` | List of developer feature flags | `[]` |
| `experimental.authOpaPolicyEngine` | The [auth opa_policy engine](https://github.com/spiffe/spire/blob/main/doc/authorization_policy_engine.md) used for authorization decisions. Defaults to the default SPIRE authorization policy. | `{}` | | `experimental.authOpaPolicyEngine` | The [auth opa_policy engine](https://github.com/spiffe/spire/blob/main/doc/authorization_policy_engine.md) used for authorization decisions. Defaults to the default SPIRE authorization policy. | `{}` |
| `experimental.authOpaPolicyEngine.local.policy_data` | A JSON blob that defines additional data that can be used in the rego policy. | `""` | | `experimental.authOpaPolicyEngine.local.policy_data` | A JSON blob that defines additional data that can be used in the rego policy. | `""` |
@@ -501,5 +510,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` |
| `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` |
charts/spire/charts/spire-server/templates/_controller-manager-container.tpl
+52 -6
View File
@@ -13,7 +13,7 @@
{{- if or .Values.controllerManager.reconcile.clusterSPIFFEIDs .Values.controllerManager.reconcile.clusterStaticEntries }} {{- if or .Values.controllerManager.reconcile.clusterSPIFFEIDs .Values.controllerManager.reconcile.clusterStaticEntries }}
{{- $reconcileEntries = add $reconcileEntries 1 }} {{- $reconcileEntries = add $reconcileEntries 1 }}
{{- end }} {{- end }}
{{- include "spire-controller-manager.container" (dict "Values" .Values "Chart" .Chart "startPort" $startPort "suffix" "" "settings" $settings "defaults" $defaults "webhooksEnabled" $webhooksEnabled) }} {{- include "spire-controller-manager.container" (dict "Values" .Values "Chart" .Chart "startPort" $startPort "suffix" "" "portSuffix" "" "healthPortName" "" "prometheusPortName" "" "settings" $settings "defaults" $defaults "webhooksEnabled" $webhooksEnabled) }}
{{- end }} {{- end }}
{{- if .Values.externalControllerManagers.enabled }} {{- if .Values.externalControllerManagers.enabled }}
{{- $clusters := default .Values.kubeConfigs .Values.externalControllerManagers.clusters }} {{- $clusters := default .Values.kubeConfigs .Values.externalControllerManagers.clusters }}
@@ -23,7 +23,43 @@
{{- if hasKey $root.Values.externalControllerManagers.clusters $name }} {{- if hasKey $root.Values.externalControllerManagers.clusters $name }}
{{- $clusterSettings = index $root.Values.externalControllerManagers.clusters $name }} {{- $clusterSettings = index $root.Values.externalControllerManagers.clusters $name }}
{{- end }} {{- end }}
{{/*
Generate port names for controller-manager ports.
Can be explicitly set via healthPortName and prometheusPortName in cluster configuration.
Otherwise uses default prefixes (hp-cm/pm-cm) with auto-generated suffixes.
Auto-generation preserves trailing numbers from cluster names or uses hash for uniqueness.
*/}}
{{- $suffix := printf "-%s" $name }} {{- $suffix := printf "-%s" $name }}
{{- $portSuffix := $suffix }}
{{- $healthPortName := "" }}
{{- $prometheusPortName := "" }}
{{- if hasKey $clusterSettings "healthPortName" }}
{{- $healthPortName = $clusterSettings.healthPortName }}
{{- end }}
{{- if hasKey $clusterSettings "prometheusPortName" }}
{{- $prometheusPortName = $clusterSettings.prometheusPortName }}
{{- end }}
{{- if or (eq $healthPortName "") (eq $prometheusPortName "") }}
{{- if gt (len $name) 9 }}
{{- $numberMatch := regexFind "[-]?[0-9]{1,2}$" $name }}
{{- if $numberMatch }}
{{- $numLen := len $numberMatch }}
{{- $baseLen := sub (len $name) $numLen | int }}
{{- $baseName := substr 0 $baseLen $name }}
{{- if not (hasPrefix "-" $numberMatch) }}
{{- $numberMatch = printf "-%s" $numberMatch }}
{{- end }}
{{- $maxBase := sub 9 (len $numberMatch) | int }}
{{- $baseName = $baseName | trunc $maxBase | trimSuffix "-" }}
{{- $portSuffix = printf "-%s%s" $baseName $numberMatch }}
{{- else }}
{{- $hash := sha256sum $name | trunc 3 }}
{{- $portSuffix = printf "-%s-%s" ($name | trunc 5 | trimSuffix "-") $hash }}
{{- end }}
{{- end }}
{{- end }}
{{- $startPort = add $startPort 2 }} {{- $startPort = add $startPort 2 }}
{{- $kubeConfig := $name }} {{- $kubeConfig := $name }}
{{- if hasKey $clusterSettings "kubeConfigName" }} {{- if hasKey $clusterSettings "kubeConfigName" }}
@@ -41,7 +77,7 @@
{{- if gt $reconcileFederation 1 }} {{- if gt $reconcileFederation 1 }}
{{- fail "You can only have one controller-manager with reconcile.clusterFederatedTrustDomains set to true" }} {{- fail "You can only have one controller-manager with reconcile.clusterFederatedTrustDomains set to true" }}
{{- end }} {{- end }}
{{- include "spire-controller-manager.container" (dict "Values" $root.Values "Chart" $root.Chart "startPort" $startPort "suffix" $suffix "settings" $clusterSettings "defaults" $clusterDefaults "webhooksEnabled" false "kubeConfig" $kubeConfig ) }} {{- include "spire-controller-manager.container" (dict "Values" $root.Values "Chart" $root.Chart "startPort" $startPort "suffix" $suffix "portSuffix" $portSuffix "healthPortName" $healthPortName "prometheusPortName" $prometheusPortName "settings" $clusterSettings "defaults" $clusterDefaults "webhooksEnabled" false "kubeConfig" $kubeConfig ) }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
@@ -83,27 +119,37 @@
{{- if gt (len $extraEnv) 0 }} {{- if gt (len $extraEnv) 0 }}
{{- $extraEnv | toYaml | nindent 4 }} {{- $extraEnv | toYaml | nindent 4 }}
{{- end }} {{- end }}
{{/* Port names: hp-cm (health), pm-cm (prometheus) - abbreviated for 15 char limit */}}
{{/* Can be overridden via healthPortName and prometheusPortName in cluster config */}}
ports: ports:
{{- if .webhooksEnabled }} {{- if .webhooksEnabled }}
- name: https - name: https
containerPort: 9443 containerPort: 9443
protocol: TCP protocol: TCP
{{- end }} {{- end }}
{{- $hpName := .healthPortName }}
{{- if eq $hpName "" }}
{{- $hpName = printf "hp-cm%s" .portSuffix }}
{{- end }}
- containerPort: {{ $healthPort }} - containerPort: {{ $healthPort }}
name: healthz name: {{ $hpName }}
{{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }} {{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }}
{{- $pmName := .prometheusPortName }}
{{- if eq $pmName "" }}
{{- $pmName = printf "pm-cm%s" .portSuffix }}
{{- end }}
- containerPort: {{ $promPort }} - containerPort: {{ $promPort }}
name: prom-cm{{ .suffix }} name: {{ $pmName }}
{{- end }} {{- end }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }} {{- if eq .Values.controllerManager.staticManifestMode "off" }}
livenessProbe: livenessProbe:
httpGet: httpGet:
path: /healthz path: /healthz
port: healthz port: {{ $hpName }}
readinessProbe: readinessProbe:
httpGet: httpGet:
path: /readyz path: /readyz
port: healthz port: {{ $hpName }}
{{- end }} {{- end }}
resources: resources:
{{- toYaml .Values.controllerManager.resources | nindent 4 }} {{- toYaml .Values.controllerManager.resources | nindent 4 }}
charts/spire/charts/spire-server/templates/configmap.yaml
+7 -1
View File
@@ -52,6 +52,9 @@ server:
trust_domain: {{ include "spire-lib.trust-domain" . | quote }} trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
data_dir: "/run/spire/data" data_dir: "/run/spire/data"
log_level: {{ .Values.logLevel | quote }} log_level: {{ .Values.logLevel | quote }}
{{- if .Values.logFormat }}
log_format: {{ .Values.logFormat | quote }}
{{- end }}
jwt_issuer: {{ include "spire-lib.jwt-issuer" . | quote }} jwt_issuer: {{ include "spire-lib.jwt-issuer" . | quote }}
audit_log_enabled: {{ .Values.auditLogEnabled }} audit_log_enabled: {{ .Values.auditLogEnabled }}
@@ -102,6 +105,7 @@ server:
cache_reload_interval: {{ .cacheReloadInterval | quote }} cache_reload_interval: {{ .cacheReloadInterval | quote }}
events_based_cache: {{ .eventsBasedCache }} events_based_cache: {{ .eventsBasedCache }}
prune_events_older_than: {{ .pruneEventsOlderThan | quote }} prune_events_older_than: {{ .pruneEventsOlderThan | quote }}
require_pq_kem: {{ .requirePQKEM }}
{{- if gt (len .featureFlags) 0 }} {{- if gt (len .featureFlags) 0 }}
feature_flags: feature_flags:
{{- range .featureFlags }} {{- range .featureFlags }}
@@ -150,7 +154,7 @@ plugins:
{{- end }} {{- end }}
max_open_conns: {{ .Values.dataStore.sql.maxOpenConns }} max_open_conns: {{ .Values.dataStore.sql.maxOpenConns }}
max_idle_conns: {{ .Values.dataStore.sql.maxIdleConns }} max_idle_conns: {{ .Values.dataStore.sql.maxIdleConns }}
{{- if ne (int .Values.dataStore.sql.connMaxLifetime) 0 }} {{- if and .Values.dataStore.sql.connMaxLifetime (ne (toString .Values.dataStore.sql.connMaxLifetime) "0") }}
conn_max_lifetime: {{ .Values.dataStore.sql.connMaxLifetime }} conn_max_lifetime: {{ .Values.dataStore.sql.connMaxLifetime }}
{{- end }} {{- end }}
disable_migration: {{ .Values.dataStore.sql.disableMigration }} disable_migration: {{ .Values.dataStore.sql.disableMigration }}
@@ -295,6 +299,8 @@ plugins:
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- $keyManagerUsed = add $keyManagerUsed (len .Values.unsupportedBuiltInPlugins.keyManager) }}
{{- if ne $keyManagerUsed 1 }} {{- if ne $keyManagerUsed 1 }}
{{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }} {{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
+3
View File
@@ -54,6 +54,9 @@ leaderElection:
leaderElect: true leaderElect: true
resourceName: {{ printf "%s-%s%s" .Release.Namespace (default .Release.Name .Values.crNameOverride) .suffix | sha256sum | trunc 8 }}.spiffe.io resourceName: {{ printf "%s-%s%s" .Release.Namespace (default .Release.Name .Values.crNameOverride) .suffix | sha256sum | trunc 8 }}.spiffe.io
resourceNamespace: {{ include "spire-server.namespace" . }} resourceNamespace: {{ include "spire-server.namespace" . }}
leaseDuration: {{ .defaults.leaderElection.leaseDuration }}
renewDeadline: {{ .defaults.leaderElection.renewDeadline }}
retryPeriod: {{ .defaults.leaderElection.retryPeriod }}
{{- end }} {{- end }}
{{- with .settings.cacheNamespaces }} {{- with .settings.cacheNamespaces }}
cacheNamespaces: cacheNamespaces:
charts/spire/charts/spire-server/templates/hpa.yaml
+14
View File
@@ -23,17 +23,31 @@ spec:
maxReplicas: {{ .Values.autoscaling.maxReplicas }} maxReplicas: {{ .Values.autoscaling.maxReplicas }}
metrics: metrics:
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
{{- if .Values.autoscaling.scaleOnSPIREServerOnly }}
- type: ContainerResource
{{- else }}
- type: Resource - type: Resource
{{- end }}
resource: resource:
name: memory name: memory
{{- if .Values.autoscaling.scaleOnSPIREServerOnly }}
container: {{ .Chart.Name }}
{{- end }}
target: target:
type: Utilization type: Utilization
averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
{{- end }} {{- end }}
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }} {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
{{- if .Values.autoscaling.scaleOnSPIREServerOnly }}
- type: ContainerResource
{{- else }}
- type: Resource - type: Resource
{{- end }}
resource: resource:
name: cpu name: cpu
{{- if .Values.autoscaling.scaleOnSPIREServerOnly }}
container: {{ .Chart.Name }}
{{- end }}
target: target:
type: Utilization type: Utilization
averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
charts/spire/charts/spire-server/templates/podmonitor.yaml
+1
View File
@@ -21,6 +21,7 @@ spec:
{{- include "spire-server.selectorLabels" . | nindent 6 }} {{- include "spire-server.selectorLabels" . | nindent 6 }}
podMetricsEndpoints: podMetricsEndpoints:
- port: prom - port: prom
- port: prom-cm
{{- if ne $namespace $podNamespace }} {{- if ne $namespace $podNamespace }}
namespaceSelector: namespaceSelector:
kubernetes.io/metadata.name: {{ $podNamespace }} kubernetes.io/metadata.name: {{ $podNamespace }}
charts/spire/charts/spire-server/templates/post-install-hook.yaml
+8
View File
@@ -58,7 +58,15 @@ spec:
metadata: metadata:
name: {{ include "spire-server.fullname" . }}-post-install name: {{ include "spire-server.fullname" . }}-post-install
spec: spec:
{{- with .Values.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
restartPolicy: Never restartPolicy: Never
{{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-install serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-install
securityContext: securityContext:
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }} {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+8
View File
@@ -58,7 +58,15 @@ spec:
metadata: metadata:
name: {{ include "spire-server.fullname" . }}-post-upgrade name: {{ include "spire-server.fullname" . }}-post-upgrade
spec: spec:
{{- with .Values.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
restartPolicy: Never restartPolicy: Never
{{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-upgrade serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-upgrade
securityContext: securityContext:
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }} {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
charts/spire/charts/spire-server/templates/pre-delete-hook.yaml
+8
View File
@@ -61,7 +61,15 @@ spec:
metadata: metadata:
name: {{ include "spire-server.fullname" . }}-pre-delete name: {{ include "spire-server.fullname" . }}-pre-delete
spec: spec:
{{- with .Values.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
restartPolicy: Never restartPolicy: Never
{{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-delete serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-delete
securityContext: securityContext:
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }} {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+8
View File
@@ -58,7 +58,15 @@ spec:
metadata: metadata:
name: {{ include "spire-server.fullname" . }}-pre-upgrade name: {{ include "spire-server.fullname" . }}-pre-upgrade
spec: spec:
{{- with .Values.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
restartPolicy: Never restartPolicy: Never
{{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-upgrade serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-upgrade
securityContext: securityContext:
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }} {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
charts/spire/charts/spire-server/templates/server-resource.yaml
+1 -1
View File
@@ -112,7 +112,7 @@ spec:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
spec: spec:
{{- with .Values.imagePullSecrets }} {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
imagePullSecrets: imagePullSecrets:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/values.yaml
+27 -4
View File
@@ -103,12 +103,14 @@ resources: {}
## @param autoscaling.enabled Flag to enable autoscaling ## @param autoscaling.enabled Flag to enable autoscaling
## @param autoscaling.minReplicas Minimum replicas for autoscaling ## @param autoscaling.minReplicas Minimum replicas for autoscaling
## @param autoscaling.maxReplicas Maximum replicas for autoscaling ## @param autoscaling.maxReplicas Maximum replicas for autoscaling
## @param autoscaling.scaleOnSPIREServerOnly Flag to only consider the main SPIRE container for autoscaling purposes
## @param autoscaling.targetCPUUtilizationPercentage Target CPU utilization that triggers autoscaling ## @param autoscaling.targetCPUUtilizationPercentage Target CPU utilization that triggers autoscaling
## ##
autoscaling: autoscaling:
enabled: false enabled: false
minReplicas: 1 minReplicas: 1
maxReplicas: 100 maxReplicas: 100
scaleOnSPIREServerOnly: false
targetCPUUtilizationPercentage: 80 targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80 # targetMemoryUtilizationPercentage: 80
@@ -194,7 +196,7 @@ dataStore:
maxOpenConns: 100 maxOpenConns: 100
## @param dataStore.sql.maxIdleConns The maximum number of idle connections in the pool ## @param dataStore.sql.maxIdleConns The maximum number of idle connections in the pool
maxIdleConns: 2 maxIdleConns: 2
## @param dataStore.sql.connMaxLifetime The maximum amount of time a connection may be reused. If 0, time is unlimited ## @param dataStore.sql.connMaxLifetime The maximum amount of time a connection may be reused. Supports duration strings (e.g., "1h", "30m", "3600s") or 0 for unlimited. Duration strings are recommended to prevent connection accumulation.
connMaxLifetime: 0 connMaxLifetime: 0
## @param dataStore.sql.disableMigration True to disable auto-migration functionality ## @param dataStore.sql.disableMigration True to disable auto-migration functionality
disableMigration: false disableMigration: false
@@ -230,6 +232,8 @@ adminIDs: []
auditLogEnabled: false auditLogEnabled: false
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error" ## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
logLevel: info logLevel: info
## @param logFormat The log format, valid values are "text" and "json"
logFormat: "text"
## @param jwtIssuer The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset ## @param jwtIssuer The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset
jwtIssuer: "" jwtIssuer: ""
@@ -568,6 +572,14 @@ controllerManager:
## @param controllerManager.logLevel The log level for the controller manager. Supported values are info, error, warn and debug. ## @param controllerManager.logLevel The log level for the controller manager. Supported values are info, error, warn and debug.
logLevel: info logLevel: info
## @param controllerManager.leaderElection.leaseDuration Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure.
## @param controllerManager.leaderElection.renewDeadline Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration.
## @param controllerManager.leaderElection.retryPeriod Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline.
leaderElection:
leaseDuration: "15s"
renewDeadline: "10s"
retryPeriod: "2s"
## @param controllerManager.parentIDTemplate The template that is used to register workloads. ## @param controllerManager.parentIDTemplate The template that is used to register workloads.
parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}" parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"
@@ -593,7 +605,7 @@ controllerManager:
registry: ghcr.io registry: ghcr.io
repository: spiffe/spire-controller-manager repository: spiffe/spire-controller-manager
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: "0.6.2" tag: "0.6.3"
## @param controllerManager.resources [object] Resource requests and limits for controller manager ## @param controllerManager.resources [object] Resource requests and limits for controller manager
resources: {} resources: {}
@@ -808,6 +820,13 @@ externalControllerManagers:
entryIDPrefixCleanup: false entryIDPrefixCleanup: false
## @param externalControllerManagers.defaults.parentIDTemplate The template that is used to register workloads. ## @param externalControllerManagers.defaults.parentIDTemplate The template that is used to register workloads.
parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}" parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"
## @param externalControllerManagers.defaults.leaderElection.leaseDuration Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure.
## @param externalControllerManagers.defaults.leaderElection.renewDeadline Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration.
## @param externalControllerManagers.defaults.leaderElection.retryPeriod Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline.
leaderElection:
leaseDuration: "15s"
renewDeadline: "10s"
retryPeriod: "2s"
## @param externalControllerManagers.defaults.expandEnv Set to true to enable environment variable substitution of config file options ## @param externalControllerManagers.defaults.expandEnv Set to true to enable environment variable substitution of config file options
expandEnv: false expandEnv: false
## @param externalControllerManagers.defaults.extraEnv [array] Extra environment variables to add to the controller manager ## @param externalControllerManagers.defaults.extraEnv [array] Extra environment variables to add to the controller manager
@@ -831,13 +850,15 @@ externalControllerManagers:
## @param externalControllerManagers.defaults.cacheNamespaces [object] If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. ## @param externalControllerManagers.defaults.cacheNamespaces [object] If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces.
cacheNamespaces: {} cacheNamespaces: {}
## @param externalControllerManagers.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. ## @param externalControllerManagers.clusters [object] A dictionary of clusters to add with optional overrides (kubeConfigName, reconcile, healthPortName, prometheusPortName). If empty, all clusters defined in kubeConfigs will be used.
clusters: {} clusters: {}
# clustera: # clustera:
# Should match the name of the config in the kubeConfigs section # Should match the name of the config in the kubeConfigs section
# kubeConfigName: foo # kubeConfigName: foo
# reconcile: # reconcile:
# clusterStaticEntries: true # clusterStaticEntries: true
# healthPortName: "hp-clustera-01"
# prometheusPortName: "pm-clustera-01"
# other: {} # other: {}
tools: tools:
@@ -1250,6 +1271,8 @@ experimental:
eventsBasedCache: false eventsBasedCache: false
## @param experimental.pruneEventsOlderThan How old an event can be before being deleted. Used with events based cache. ## @param experimental.pruneEventsOlderThan How old an event can be before being deleted. Used with events based cache.
pruneEventsOlderThan: 12h pruneEventsOlderThan: 12h
## @param experimental.requirePQKEM Require use of a post-quantum-safe key exchange method for TLS handshakes.
requirePQKEM: false
## @param experimental.featureFlags [array] List of developer feature flags ## @param experimental.featureFlags [array] List of developer feature flags
featureFlags: [] featureFlags: []
## @param experimental.authOpaPolicyEngine [object] The [auth opa_policy engine](https://github.com/spiffe/spire/blob/main/doc/authorization_policy_engine.md) used for authorization decisions. Defaults to the default SPIRE authorization policy. ## @param experimental.authOpaPolicyEngine [object] The [auth opa_policy engine](https://github.com/spiffe/spire/blob/main/doc/authorization_policy_engine.md) used for authorization decisions. Defaults to the default SPIRE authorization policy.
@@ -1278,7 +1301,7 @@ tests:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507 tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a
## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters
kubeConfigs: {} kubeConfigs: {}
charts/spire/charts/tornjak-frontend/README.md
+1 -1
View File
@@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details.
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a` |
charts/spire/charts/tornjak-frontend/templates/deployment.yaml
+1 -1
View File
@@ -15,7 +15,7 @@ spec:
labels: labels:
{{- include "tornjak-frontend.selectorLabels" . | nindent 8 }} {{- include "tornjak-frontend.selectorLabels" . | nindent 8 }}
spec: spec:
{{- with .Values.imagePullSecrets }} {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
imagePullSecrets: imagePullSecrets:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
charts/spire/charts/tornjak-frontend/values.yaml
+1 -1
View File
@@ -162,4 +162,4 @@ tests:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:a4b8f2ec447f0e2b229d8f41711f9ffd1833f7015d2834046567b75a1a1db507 tag: latest@sha256:3a1830320b1d57167a7317fcd6efd8c72cd872440da8055fa25730d600c9c39a
charts/spire/values.yaml
+3
View File
@@ -5,6 +5,9 @@
## Note: the parameter values specified here will override the chart level values for these parameters. ## Note: the parameter values specified here will override the chart level values for these parameters.
## ##
global: global:
## @param global.imagePullSecrets [array] Image pull secret names
imagePullSecrets: []
k8s: k8s:
## @param global.k8s.clusterDomain Cluster domain name configured for Spire install ## @param global.k8s.clusterDomain Cluster domain name configured for Spire install
clusterDomain: cluster.local clusterDomain: cluster.local
tests/go.mod
+7 -7
View File
@@ -3,8 +3,8 @@ module github.com/spiffe/helm-charts/tests
go 1.25.0 go 1.25.0
require ( require (
github.com/onsi/ginkgo/v2 v2.27.5 github.com/onsi/ginkgo/v2 v2.28.1
github.com/onsi/gomega v1.39.0 github.com/onsi/gomega v1.39.1
helm.sh/helm/v3 v3.20.0 helm.sh/helm/v3 v3.20.0
) )
@@ -26,7 +26,7 @@ require (
github.com/gobwas/glob v0.2.3 // indirect github.com/gobwas/glob v0.2.3 // indirect
github.com/google/gnostic-models v0.7.0 // indirect github.com/google/gnostic-models v0.7.0 // indirect
github.com/google/go-cmp v0.7.0 // indirect github.com/google/go-cmp v0.7.0 // indirect
github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 // indirect github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 // indirect
github.com/google/uuid v1.6.0 // indirect github.com/google/uuid v1.6.0 // indirect
github.com/huandu/xstrings v1.5.0 // indirect github.com/huandu/xstrings v1.5.0 // indirect
github.com/josharian/intern v1.0.0 // indirect github.com/josharian/intern v1.0.0 // indirect
@@ -44,16 +44,16 @@ require (
github.com/x448/float16 v0.8.4 // indirect github.com/x448/float16 v0.8.4 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/crypto v0.46.0 // indirect golang.org/x/crypto v0.47.0 // indirect
golang.org/x/mod v0.31.0 // indirect golang.org/x/mod v0.32.0 // indirect
golang.org/x/net v0.48.0 // indirect golang.org/x/net v0.49.0 // indirect
golang.org/x/oauth2 v0.30.0 // indirect golang.org/x/oauth2 v0.30.0 // indirect
golang.org/x/sync v0.19.0 // indirect golang.org/x/sync v0.19.0 // indirect
golang.org/x/sys v0.40.0 // indirect golang.org/x/sys v0.40.0 // indirect
golang.org/x/term v0.39.0 // indirect golang.org/x/term v0.39.0 // indirect
golang.org/x/text v0.33.0 // indirect golang.org/x/text v0.33.0 // indirect
golang.org/x/time v0.12.0 // indirect golang.org/x/time v0.12.0 // indirect
golang.org/x/tools v0.40.0 // indirect golang.org/x/tools v0.41.0 // indirect
google.golang.org/protobuf v1.36.8 // indirect google.golang.org/protobuf v1.36.8 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect
tests/go.sum
+14 -14
View File
@@ -52,8 +52,8 @@ github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7O
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 h1:EEHtgt9IwisQ2AZ4pIsMjahcegHh6rmhqxzIRQIyepY= github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc=
github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6/go.mod h1:I6V7YzU0XDpsHqbsyrghnFZLO1gwK6NPTNvmetQIk9U= github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI= github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
@@ -89,10 +89,10 @@ github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFd
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
github.com/onsi/ginkgo/v2 v2.27.5 h1:ZeVgZMx2PDMdJm/+w5fE/OyG6ILo1Y3e+QX4zSR0zTE= github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
github.com/onsi/ginkgo/v2 v2.27.5/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo= github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
github.com/onsi/gomega v1.39.0 h1:y2ROC3hKFmQZJNFeGAMeHZKkjBL65mIZcvrLQBF9k6Q= github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
github.com/onsi/gomega v1.39.0/go.mod h1:ZCU1pkQcXDO5Sl9/VVEGlDyp+zm0m1cmeG5TOzLgdh4= github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -133,12 +133,12 @@ go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU= golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0= golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI= golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg= golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU= golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY= golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI= golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU= golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
@@ -151,8 +151,8 @@ golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8= golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE= golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg= golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA= golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc= golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc= google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU= google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=