panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use the correct kubectl for the cluster (#248)

Browse Source
This commit is contained in:
kfox1111
2023-05-16 20:28:53 +02:00
committed by GitHub
parent ee43c5e36f
commit aed6fdfe4e
7 changed files with 77 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+3 -3
View File
@@ -291,9 +291,9 @@ Kubernetes: `>=1.21.0-0`
| spire-server.controllerManager.service.type | string | `"ClusterIP"` | |
| spire-server.controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"chainguard/kubectl"` | The repository within the registry |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `"latest"` | |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"rancher/kubectl"` | The repository within the registry |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `""` | |
| spire-server.dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
| spire-server.dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
| spire-server.dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |
charts/spire/charts/spire-server/README.md
+3 -3
View File
@@ -52,9 +52,9 @@ A Helm chart to install the SPIRE server.
| controllerManager.service.type | string | `"ClusterIP"` | |
| controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"chainguard/kubectl"` | The repository within the registry |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `"latest"` | |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"rancher/kubectl"` | The repository within the registry |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `""` | |
| dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
| dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
| dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |
charts/spire/charts/spire-server/templates/_helpers.tpl
+8
View File
@@ -105,6 +105,14 @@ Create the name of the service account to use
{{- end }}
{{- end }}
{{- define "spire-server.kubectl-image" }}
{{- $root := deepCopy . }}
{{- if eq (len $root.image.version) 0 }}
{{- $_ := set $root.image "version" $root.KubeVersion }}
{{- end }}
{{- include "spire-lib.image" $root }}
{{- end }}
{{- define "spire-server.config-mysql-query" }}
{{- $lst := list }}
{{- range . }}
charts/spire/charts/spire-server/templates/post-install-hook.yaml
+20 -18
View File
@@ -63,23 +63,25 @@ spec:
- name: post-install-job
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }}
command:
- /bin/sh
- -c
- |-
kubectl patch validatingwebhookconfiguration {{ include "spire-controller-manager.fullname" . }}-webhook --type='strategic' -p '
{
"webhooks":[
{
"name":"vclusterspiffeid.kb.io",
"failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
},
{
"name":"vclusterfederatedtrustdomain.kb.io",
"failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
}
]
}'
image: {{ template "spire-server.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args:
- patch
- validatingwebhookconfiguration
- {{ include "spire-controller-manager.fullname" . }}-webhook
- --type=strategic
- -p
- |
{
"webhooks":[
{
"name":"vclusterspiffeid.kb.io",
"failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
},
{
"name":"vclusterfederatedtrustdomain.kb.io",
"failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
}
]
}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+20 -18
View File
@@ -63,23 +63,25 @@ spec:
- name: post-upgrade-job
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }}
command:
- /bin/sh
- -c
- |-
kubectl patch validatingwebhookconfiguration {{ include "spire-controller-manager.fullname" . }}-webhook --type='strategic' -p '
{
"webhooks":[
{
"name":"vclusterspiffeid.kb.io",
"failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
},
{
"name":"vclusterfederatedtrustdomain.kb.io",
"failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
}
]
}'
image: {{ template "spire-server.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args:
- patch
- validatingwebhookconfiguration
- {{ include "spire-controller-manager.fullname" . }}-webhook
- --type=strategic
- -p
- |
{
"webhooks":[
{
"name":"vclusterspiffeid.kb.io",
"failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
},
{
"name":"vclusterfederatedtrustdomain.kb.io",
"failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
}
]
}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+20 -18
View File
@@ -63,23 +63,25 @@ spec:
- name: post-install-job
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }}
command:
- /bin/sh
- -c
- |-
kubectl patch validatingwebhookconfiguration {{ include "spire-controller-manager.fullname" . }}-webhook --type='strategic' -p '
{
"webhooks":[
{
"name":"vclusterspiffeid.kb.io",
"failurePolicy":"Ignore"
},
{
"name":"vclusterfederatedtrustdomain.kb.io",
"failurePolicy":"Ignore"
}
]
}'
image: {{ template "spire-server.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args:
- patch
- validatingwebhookconfiguration
- {{ include "spire-controller-manager.fullname" . }}-webhook
- --type=strategic
- -p
- |
{
"webhooks":[
{
"name":"vclusterspiffeid.kb.io",
"failurePolicy":"Ignore"
},
{
"name":"vclusterfederatedtrustdomain.kb.io",
"failurePolicy":"Ignore"
}
]
}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/values.yaml
+3 -3
View File
@@ -224,12 +224,12 @@ controllerManager:
upgradeHook:
image:
# -- The OCI registry to pull the image from
registry: cgr.dev
registry: docker.io
# -- The repository within the registry
repository: chainguard/kubectl
repository: rancher/kubectl
# -- The image pull policy
pullPolicy: IfNotPresent
version: latest
version: ""
telemetry:
prometheus: