panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial SPIRE 1.9.0 support (#262)

Browse Source
This commit is contained in:
kfox1111
2024-02-28 17:54:53 +00:00
committed by GitHub
parent 40d5fefcfe
commit ac83694970
14 changed files with 55 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spire-server
description: A Helm chart to install the SPIRE server.
type: application
version: 0.1.0
appVersion: "1.8.7"
appVersion: "1.9.0"
keywords: ["spiffe", "spire-server", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources:
charts/spire/charts/spire-server/README.md
+2
View File
@@ -167,6 +167,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `ca_subject.country` | Country for Spire server CA | `ARPA` |
| `ca_subject.organization` | Organization for Spire server CA | `Example` |
| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` |
| `credentialComposer.uniqueID.enabled` | Add the x509UniqueIdentifier attribute to workload X509-SVIDs | `false` |
| `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` |
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
| `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` |
@@ -332,6 +333,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `tornjak.resources` | Resource requests and limits | `{}` |
| `tornjak.securityContext` | Security Context to use | `{}` |
| `customPlugins.bundlePublisher` | Custom plugins of type BundlePublisher are configured here | `{}` |
| `customPlugins.credentialComposer` | Custom plugins of type CredentialComposer are configured here | `{}` |
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
| `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` |
charts/spire/charts/spire-server/templates/configmap.yaml
+6 -1
View File
@@ -5,7 +5,7 @@
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.organization must be set" (eq .Values.ca_subject.organization "Example"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.common_name must be set" (eq .Values.ca_subject.common_name "example.org"))}}
{{- range $type, $tvals := .Values.customPlugins }}
{{- if not (has $type (list "bundlePublisher" "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }}
{{- if not (has $type (list "bundlePublisher" "credentialComposer" "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }}
{{- fail (printf "Unknown plugin type specified: %s" $type) }}
{{- end }}
{{- range $name, $nval := $tvals }}
@@ -87,6 +87,11 @@ server:
{{- end }}
plugins:
{{- if .Values.credentialComposer.uniqueID.enabled }}
CredentialComposer:
uniqueid: {}
{{- end }}
DataStore:
sql:
plugin_data:
charts/spire/charts/spire-server/values.yaml
+8
View File
@@ -284,6 +284,11 @@ ca_subject:
## @param ca_subject.common_name Common Name for Spire server CA
common_name: example.org
credentialComposer:
uniqueID:
## @param credentialComposer.uniqueID.enabled Add the x509UniqueIdentifier attribute to workload X509-SVIDs
enabled: false
keyManager:
disk:
## @param keyManager.disk.enabled Flag to enable keyManager on disk
@@ -811,18 +816,21 @@ tornjak:
## @skip unsupportedBuiltInPlugins
unsupportedBuiltInPlugins:
bundlePublisher: {}
credentialComposer: {}
keyManager: {}
nodeAttestor: {}
upstreamAuthority: {}
notifier: {}
## @param customPlugins.bundlePublisher Custom plugins of type BundlePublisher are configured here
## @param customPlugins.credentialComposer Custom plugins of type CredentialComposer are configured here
## @param customPlugins.keyManager Custom plugins of type KeyManager are configured here
## @param customPlugins.nodeAttestor Custom plugins of type NodeAttestor are configured here
## @param customPlugins.upstreamAuthority Custom plugins of type upstreamAuthority are configured here
## @param customPlugins.notifier Custom plugins of type notifier are configured here
customPlugins:
bundlePublisher: {}
credentialComposer: {}
keyManager: {}
nodeAttestor: {}
upstreamAuthority: {}