diff --git a/.github/kind/conf/kind-config.yaml b/.github/kind/conf/kind-config.yaml index 7c0cd3f..536dbcb 100644 --- a/.github/kind/conf/kind-config.yaml +++ b/.github/kind/conf/kind-config.yaml @@ -16,3 +16,5 @@ kubeadmConfigPatches: nodes: - role: control-plane - role: worker + - role: worker + - role: worker diff --git a/.github/scripts/update-tags.sh b/.github/scripts/update-tags.sh index 4ba69e5..9162226 100755 --- a/.github/scripts/update-tags.sh +++ b/.github/scripts/update-tags.sh @@ -20,6 +20,11 @@ if ! command -v yq &> /dev/null; then exit 1 fi +if ! command -v npm &> /dev/null; then + echo Please install npm + exit 1 +fi + if ! command -v python3 -c 'import ruamel.yaml' &> /dev/null; then echo Please install python3 with the ruamel.yaml module exit 1 @@ -46,10 +51,13 @@ jq -r '. | keys[]' "$IMAGEJSON" | while read -r CHART; do REGISTRY=$(yq e ".${QUERY}.registry" "$VALUES") REPOSITORY=$(yq e ".${QUERY}.repository" "$VALUES") VERSION=$(yq e ".${QUERY}.tag" "$VALUES") + if [[ "$REGISTRY" != "" ]]; then + REGISTRY="$REGISTRY/" + fi if [[ "$FILTER" == "LATESTSHA" ]]; then - LATEST_VERSION="latest@"$(crane digest "${REGISTRY}/${REPOSITORY}:latest") + LATEST_VERSION="latest@"$(crane digest "${REGISTRY}${REPOSITORY}:latest") else - LATEST_VERSION=$(crane ls "${REGISTRY}/${REPOSITORY}" | grep "${FILTER}" | sort "${SORTFLAGS[@]}"| tail -n 1) + LATEST_VERSION=$(crane ls "${REGISTRY}${REPOSITORY}" | grep "${FILTER}" | sort "${SORTFLAGS[@]}" | tail -n 1) fi export QUERY @@ -57,7 +65,7 @@ jq -r '. | keys[]' "$IMAGEJSON" | while read -r CHART; do export LATEST_VERSION if [ "${VERSION}" != "${LATEST_VERSION}" ]; then - echo "New image version found: ${REGISTRY}/${REPOSITORY}:${LATEST_VERSION}" + echo "New image version found: ${REGISTRY}${REPOSITORY}:${LATEST_VERSION}" "${SCRIPTPATH}/edit-yaml.py" > /tmp/$$ mv /tmp/$$ "${VALUES}" fi diff --git a/.github/tests/dependencies/testcert.yaml b/.github/tests/dependencies/testcert.yaml new file mode 100644 index 0000000..a16b5c9 --- /dev/null +++ b/.github/tests/dependencies/testcert.yaml @@ -0,0 +1,52 @@ +--- +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: selfsigned-issuer +spec: + selfSigned: {} +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: demo-selfsigned-ca +spec: + isCA: true + commonName: demo-selfsigned-ca + secretName: root-secret + privateKey: + algorithm: ECDSA + size: 256 + issuerRef: + name: selfsigned-issuer + kind: Issuer + group: cert-manager.io + subject: + countries: + - US + organizations: + - test + organizationalUnits: + - test +--- +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: demo-ca +spec: + ca: + secretName: root-secret +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: oidc +spec: + dnsNames: + - oidc-discovery.example.org + - spire-server-federation.example.org + secretName: tls-cert + issuerRef: + name: demo-ca + kind: Issuer + group: cert-manager.io diff --git a/.github/tests/images.json b/.github/tests/images.json index d33d64c..7ecacdb 100644 --- a/.github/tests/images.json +++ b/.github/tests/images.json @@ -39,6 +39,16 @@ "query": "tests.bash.image", "filter": "LATESTSHA", "sort-flags": [] + }, + { + "query": "tests.toolkit.image", + "filter": "LATESTSHA", + "sort-flags": [] + }, + { + "query": "tests.busybox.image", + "filter": "^[0-9]\\+\\.[0-9]\\+\\.[0-9]\\+-uclibc$", + "sort-flags": ["-t", ".", "-k1,1n", "-k2,2n", "-k3,3n"] } ], "tornjak-frontend/values.yaml": [ diff --git a/.github/workflows/check-versions.yaml b/.github/workflows/check-versions.yaml index f28d1b4..6436e40 100644 --- a/.github/workflows/check-versions.yaml +++ b/.github/workflows/check-versions.yaml @@ -20,7 +20,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3.5.3 + uses: actions/checkout@v4.0.0 - name: Set up Helm uses: azure/setup-helm@v3.5 @@ -34,6 +34,8 @@ jobs: - name: Setup go uses: actions/setup-go@v4.1.0 + with: + go-version: '1.21' - name: Setup crane uses: imjasonh/setup-crane@v0.3 @@ -42,13 +44,17 @@ jobs: with: python-version: '3.9' + - name: Install ubuntu packages + run: sudo apt-get install wget apt-transport-https gnupg lsb-release + + - name: Install yq + run: go install github.com/mikefarah/yq/v4@latest + + - name: Install python dependencies + run: pip install -r .github/scripts/requirements.txt + - name: Update image tags run: | - go install github.com/mikefarah/yq/v4@latest - - sudo apt-get install wget apt-transport-https gnupg lsb-release - sudo pip install -r .github/scripts/requirements.txt - ./.github/scripts/update-tags.sh git diff diff --git a/.github/workflows/helm-chart-ci-ignore.yaml b/.github/workflows/helm-chart-ci-ignore.yaml index 1269466..eb02165 100644 --- a/.github/workflows/helm-chart-ci-ignore.yaml +++ b/.github/workflows/helm-chart-ci-ignore.yaml @@ -43,7 +43,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3.5.3 + uses: actions/checkout@v4.0.0 - id: set-matrix name: Collect all examples diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index 57a1ede..87fba53 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -32,7 +32,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3.5.3 + uses: actions/checkout@v4.0.0 - name: Verify Docs updated run: ./helm-docs.sh @@ -94,7 +94,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3.5.3 + uses: actions/checkout@v4.0.0 with: fetch-depth: 0 @@ -136,7 +136,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3.5.3 + uses: actions/checkout@v4.0.0 with: fetch-depth: 0 @@ -184,7 +184,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3.5.3 + uses: actions/checkout@v4.0.0 - id: set-matrix name: Collect all examples @@ -216,7 +216,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3.5.3 + uses: actions/checkout@v4.0.0 - name: Set up Helm uses: azure/setup-helm@v3.5 diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml index a245624..5201f55 100644 --- a/.github/workflows/helm-release.yaml +++ b/.github/workflows/helm-release.yaml @@ -19,7 +19,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3.5.3 + uses: actions/checkout@v4.0.0 with: fetch-depth: 0 @@ -29,9 +29,9 @@ jobs: git config user.email "$GITHUB_ACTOR@users.noreply.github.com" - name: Setup cosign - uses: sigstore/cosign-installer@v3.1.1 + uses: sigstore/cosign-installer@v3.1.2 with: - cosign-release: v2.1.1 + cosign-release: v2.2.0 - name: Set up Helm uses: azure/setup-helm@v3.5 @@ -44,7 +44,7 @@ jobs: CR_TOKEN: '${{ secrets.GITHUB_TOKEN }}' - name: Login to GitHub Container Registry - uses: docker/login-action@v2 + uses: docker/login-action@v3 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/shellcheck.yaml b/.github/workflows/shellcheck.yaml index 71a5ec2..5f59c66 100644 --- a/.github/workflows/shellcheck.yaml +++ b/.github/workflows/shellcheck.yaml @@ -21,7 +21,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3.5.3 + uses: actions/checkout@v4.0.0 - name: Run Shellcheck uses: ludeeus/action-shellcheck@2.0.0 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 11f1c1c..005d03c 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -48,14 +48,14 @@ Another approach to testing the chart is by installing one of the examples in yo ## Generating documentation -Any changes to Chart.yaml or values.yaml require an update of the README.md. This update can easily be generated using [helm-docs][]. +Any changes to Chart.yaml or values.yaml require an update of the README.md. This update can easily be generated using [readme-generator](https://github.com/bitnami-labs/readme-generator-for-helm). ```shell -./helm-docs.sh charts/«chart-name» +./helm-docs.sh ``` ## Bumping Chart version In contrary to many other Helm repositories we do NOT require contributors to increate the Chart version. We have customized our release pipeline so we can bundle various PRs in a single release. Maintainers of the helm-charts in this repo will take care of the semantic versioning. -[helm-docs]: https://github.com/norwoodj/helm-docs "Generate documentation for your Helm chart." +[readme-generator]: https://github.com/bitnami-labs/readme-generator-for-helm "Auto generate READMEs for Helm Charts." diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index e5619d6..0d06c79 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -3,7 +3,7 @@ name: spire description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.12.0 +version: 0.13.0 appVersion: "1.7.2" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire diff --git a/charts/spire/README.md b/charts/spire/README.md index b7c72ab..107f980 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,8 +1,6 @@ # spire - - -![Version: 0.12.0](https://img.shields.io/badge/Version-0.12.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) +![Version: 0.13.0](https://img.shields.io/badge/Version-0.13.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. @@ -85,498 +83,79 @@ Now you can interact with the Spire agent socket from your own application. The | file://./charts/spire-server | spire-server | 0.1.0 | | file://./charts/tornjak-frontend | tornjak-frontend | 0.1.0 | -## Values + -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| global.deleteHooks.enabled | bool | `true` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | -| global.installAndUpgradeHooks.enabled | bool | `true` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | -| global.k8s.clusterDomain | string | `"cluster.local"` | | -| global.spire.bundleConfigMap | string | `""` | Override all instances of bundleConfigMap | -| global.spire.clusterName | string | `"example-cluster"` | | -| global.spire.image.registry | string | `""` | Override all Spire image registries at once | -| global.spire.jwtIssuer | string | `"https://oidc-discovery.example.org"` | Set the jwt issuer | -| global.spire.trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers | -| global.spire.upstreamServerAddress | string | `""` | Set what address to use for the upstream server when using nested spire | -| spiffe-csi-driver.enabled | bool | `true` | Enables deployment of CSI driver | -| spiffe-oidc-discovery-provider.enabled | bool | `false` | Enables deployment of OIDC discovery provider | -| spire-agent.enabled | bool | `true` | Enables deployment of SPIRE Agent(s) | -| spire-agent.nameOverride | string | `"agent"` | | -| spire-server.controllerManager.enabled | bool | `true` | Enables deployment of Controller Manager | -| spire-server.enabled | bool | `true` | Enables deployment of SPIRE Server | -| spire-server.nameOverride | string | `"server"` | | -| tornjak-frontend.enabled | bool | `false` | Enables deployment of Tornjak frontend/UI (Not for production) | -| upstream-spiffe-csi-driver.agentSocketPath | string | `"/run/spire/agent-sockets-upstream/spire-agent.sock"` | | -| upstream-spiffe-csi-driver.healthChecks.port | int | `9810` | | -| upstream-spiffe-csi-driver.pluginName | string | `"upstream.csi.spiffe.io"` | | -| upstream-spire-agent.bundleConfigMap | string | `"spire-bundle-upstream"` | | -| upstream-spire-agent.healthChecks.port | int | `9981` | | -| upstream-spire-agent.nameOverride | string | `"agent-upstream"` | | -| upstream-spire-agent.serviceAccount.name | string | `"spire-agent-upstream"` | | -| upstream-spire-agent.socketPath | string | `"/run/spire/agent-sockets-upstream/spire-agent.sock"` | | -| upstream-spire-agent.telemetry.prometheus.port | int | `9989` | | -| upstream.enabled | bool | `false` | enable upstream agent and driver for use with nested spire. | -| spiffe-csi-driver.agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent | -| spiffe-csi-driver.fullnameOverride | string | `""` | | -| spiffe-csi-driver.healthChecks.port | int | `9809` | | -| spiffe-csi-driver.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| spiffe-csi-driver.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | -| spiffe-csi-driver.image.repository | string | `"spiffe/spiffe-csi-driver"` | The repository within the registry | -| spiffe-csi-driver.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion | -| spiffe-csi-driver.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| spiffe-csi-driver.imagePullSecrets | list | `[]` | | -| spiffe-csi-driver.kubeletPath | string | `"/var/lib/kubelet"` | | -| spiffe-csi-driver.livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe | -| spiffe-csi-driver.livenessProbe.timeoutSeconds | int | `5` | Timeout value in seconds for livenessProbe | -| spiffe-csi-driver.nameOverride | string | `""` | | -| spiffe-csi-driver.namespaceOverride | string | `""` | | -| spiffe-csi-driver.nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| spiffe-csi-driver.nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | The OCI registry to pull the image from | -| spiffe-csi-driver.nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | The repository within the registry | -| spiffe-csi-driver.nodeDriverRegistrar.image.tag | string | `"v2.8.0"` | Overrides the image tag | -| spiffe-csi-driver.nodeDriverRegistrar.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| spiffe-csi-driver.nodeDriverRegistrar.resources | object | `{}` | | -| spiffe-csi-driver.nodeSelector | object | `{}` | | -| spiffe-csi-driver.pluginName | string | `"csi.spiffe.io"` | Set the csi driver name deployed to Kubernetes. | -| spiffe-csi-driver.podAnnotations | object | `{}` | | -| spiffe-csi-driver.podSecurityContext | object | `{}` | | -| spiffe-csi-driver.priorityClassName | string | `""` | Priority class assigned to daemonset pods | -| spiffe-csi-driver.resources | object | `{}` | | -| spiffe-csi-driver.securityContext.privileged | bool | `true` | | -| spiffe-csi-driver.securityContext.readOnlyRootFilesystem | bool | `true` | | -| spiffe-csi-driver.serviceAccount.annotations | object | `{}` | Annotations to add to the service account | -| spiffe-csi-driver.serviceAccount.create | bool | `true` | Specifies whether a service account should be created | -| spiffe-csi-driver.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | -| spiffe-csi-driver.tolerations | list | `[]` | | -| spiffe-oidc-discovery-provider.affinity | object | `{}` | | -| spiffe-oidc-discovery-provider.agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket | -| spiffe-oidc-discovery-provider.annotations | object | `{}` | Annotations for the deployment | -| spiffe-oidc-discovery-provider.autoscaling.enabled | bool | `false` | | -| spiffe-oidc-discovery-provider.autoscaling.maxReplicas | int | `5` | | -| spiffe-oidc-discovery-provider.autoscaling.minReplicas | int | `1` | | -| spiffe-oidc-discovery-provider.autoscaling.targetCPUUtilizationPercentage | int | `80` | | -| spiffe-oidc-discovery-provider.autoscaling.targetMemoryUtilizationPercentage | int | `80` | | -| spiffe-oidc-discovery-provider.clusterDomain | string | `"cluster.local"` | | -| spiffe-oidc-discovery-provider.config.acme.cacheDir | string | `"/run/spire"` | | -| spiffe-oidc-discovery-provider.config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | -| spiffe-oidc-discovery-provider.config.acme.emailAddress | string | `"letsencrypt@example.org"` | | -| spiffe-oidc-discovery-provider.config.acme.tosAccepted | bool | `false` | | -| spiffe-oidc-discovery-provider.config.additionalDomains | list | `["localhost"]` | Add additional domains that can be used for oidc discovery | -| spiffe-oidc-discovery-provider.config.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" | -| spiffe-oidc-discovery-provider.configMap.annotations | object | `{}` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | -| spiffe-oidc-discovery-provider.deleteHook.enabled | bool | `true` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | -| spiffe-oidc-discovery-provider.fullnameOverride | string | `""` | | -| spiffe-oidc-discovery-provider.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| spiffe-oidc-discovery-provider.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | -| spiffe-oidc-discovery-provider.image.repository | string | `"spiffe/oidc-discovery-provider"` | The repository within the registry | -| spiffe-oidc-discovery-provider.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion | -| spiffe-oidc-discovery-provider.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| spiffe-oidc-discovery-provider.imagePullSecrets | list | `[]` | | -| spiffe-oidc-discovery-provider.ingress.annotations | object | `{}` | | -| spiffe-oidc-discovery-provider.ingress.className | string | `""` | | -| spiffe-oidc-discovery-provider.ingress.enabled | bool | `false` | | -| spiffe-oidc-discovery-provider.ingress.hosts[0].host | string | `"oidc-discovery.example.org"` | | -| spiffe-oidc-discovery-provider.ingress.hosts[0].paths[0].path | string | `"/"` | | -| spiffe-oidc-discovery-provider.ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | | -| spiffe-oidc-discovery-provider.ingress.tls | list | `[]` | | -| spiffe-oidc-discovery-provider.insecureScheme.enabled | bool | `false` | | -| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.registry | string | `"docker.io"` | The OCI registry to pull the image from | -| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.repository | string | `"nginxinc/nginx-unprivileged"` | The repository within the registry | -| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.tag | string | `"1.24.0-alpine"` | Overrides the image tag | -| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| spiffe-oidc-discovery-provider.insecureScheme.nginx.resources | object | `{}` | | -| spiffe-oidc-discovery-provider.jwtIssuer | string | `"https://oidc-discovery.example.org"` | | -| spiffe-oidc-discovery-provider.livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe | -| spiffe-oidc-discovery-provider.livenessProbe.periodSeconds | int | `5` | Period seconds for livenessProbe | -| spiffe-oidc-discovery-provider.nameOverride | string | `""` | | -| spiffe-oidc-discovery-provider.namespaceOverride | string | `""` | | -| spiffe-oidc-discovery-provider.nodeSelector | object | `{}` | | -| spiffe-oidc-discovery-provider.podAnnotations | object | `{}` | | -| spiffe-oidc-discovery-provider.podSecurityContext | object | `{}` | | -| spiffe-oidc-discovery-provider.readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe | -| spiffe-oidc-discovery-provider.readinessProbe.periodSeconds | int | `5` | Period seconds for readinessProbe | -| spiffe-oidc-discovery-provider.replicaCount | int | `1` | | -| spiffe-oidc-discovery-provider.resources | object | `{}` | | -| spiffe-oidc-discovery-provider.securityContext | object | `{}` | | -| spiffe-oidc-discovery-provider.service.annotations | object | `{}` | | -| spiffe-oidc-discovery-provider.service.port | int | `80` | | -| spiffe-oidc-discovery-provider.service.type | string | `"ClusterIP"` | | -| spiffe-oidc-discovery-provider.serviceAccount.annotations | object | `{}` | Annotations to add to the service account | -| spiffe-oidc-discovery-provider.serviceAccount.create | bool | `true` | Specifies whether a service account should be created | -| spiffe-oidc-discovery-provider.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | -| spiffe-oidc-discovery-provider.telemetry.prometheus.enabled | bool | `false` | | -| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.registry | string | `"docker.io"` | The OCI registry to pull the image from | -| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` | The repository within the registry | -| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.tag | string | `"0.11.0"` | Overrides the image tag | -| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.resources | object | `{}` | | -| spiffe-oidc-discovery-provider.telemetry.prometheus.podMonitor.enabled | bool | `false` | | -| spiffe-oidc-discovery-provider.telemetry.prometheus.podMonitor.labels | object | `{}` | | -| spiffe-oidc-discovery-provider.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider | -| spiffe-oidc-discovery-provider.telemetry.prometheus.port | int | `9988` | | -| spiffe-oidc-discovery-provider.tolerations | list | `[]` | | -| spiffe-oidc-discovery-provider.tools.kubectl.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| spiffe-oidc-discovery-provider.tools.kubectl.image.registry | string | `"docker.io"` | The OCI registry to pull the image from | -| spiffe-oidc-discovery-provider.tools.kubectl.image.repository | string | `"rancher/kubectl"` | The repository within the registry | -| spiffe-oidc-discovery-provider.tools.kubectl.image.tag | string | `""` | Overrides the image tag | -| spiffe-oidc-discovery-provider.tools.kubectl.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| spiffe-oidc-discovery-provider.trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers | -| spire-agent.bundleConfigMap | string | `"spire-bundle"` | | -| spire-agent.clusterName | string | `"example-cluster"` | | -| spire-agent.configMap.annotations | object | `{}` | Annotations to add to the SPIRE Agent ConfigMap | -| spire-agent.extraContainers | list | `[]` | | -| spire-agent.extraVolumeMounts | list | `[]` | | -| spire-agent.extraVolumes | list | `[]` | | -| spire-agent.fsGroupFix.image.pullPolicy | string | `"Always"` | The image pull policy | -| spire-agent.fsGroupFix.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from | -| spire-agent.fsGroupFix.image.repository | string | `"chainguard/bash"` | The repository within the registry | -| spire-agent.fsGroupFix.image.tag | string | `"latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4"` | Overrides the image tag | -| spire-agent.fsGroupFix.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| spire-agent.fsGroupFix.resources | object | `{}` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | -| spire-agent.fullnameOverride | string | `""` | | -| spire-agent.healthChecks.port | int | `9980` | override the host port used for health checking | -| spire-agent.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| spire-agent.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | -| spire-agent.image.repository | string | `"spiffe/spire-agent"` | The repository within the registry | -| spire-agent.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. | -| spire-agent.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| spire-agent.imagePullSecrets | list | `[]` | | -| spire-agent.initContainers | list | `[]` | | -| spire-agent.livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe | -| spire-agent.livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe | -| spire-agent.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" | -| spire-agent.nameOverride | string | `""` | | -| spire-agent.namespaceOverride | string | `""` | | -| spire-agent.nodeSelector | object | `{}` | | -| spire-agent.podAnnotations | object | `{}` | | -| spire-agent.podSecurityContext | object | `{}` | | -| spire-agent.priorityClassName | string | `""` | Priority class assigned to daemonset pods | -| spire-agent.readinessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for readinessProbe | -| spire-agent.readinessProbe.periodSeconds | int | `60` | Period seconds for readinessProbe | -| spire-agent.resources | object | `{}` | | -| spire-agent.securityContext | object | `{}` | | -| spire-agent.server.address | string | `""` | | -| spire-agent.server.namespaceOverride | string | `""` | | -| spire-agent.server.port | int | `8081` | | -| spire-agent.serviceAccount.annotations | object | `{}` | Annotations to add to the service account | -| spire-agent.serviceAccount.create | bool | `true` | Specifies whether a service account should be created | -| spire-agent.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | -| spire-agent.socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent | -| spire-agent.telemetry.prometheus.enabled | bool | `false` | | -| spire-agent.telemetry.prometheus.podMonitor.enabled | bool | `false` | | -| spire-agent.telemetry.prometheus.podMonitor.labels | object | `{}` | | -| spire-agent.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | -| spire-agent.telemetry.prometheus.port | int | `9988` | | -| spire-agent.tolerations | list | `[]` | | -| spire-agent.trustBundleFormat | string | `"pem"` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | -| spire-agent.trustBundleURL | string | `""` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | -| spire-agent.trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers | -| spire-agent.waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| spire-agent.waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from | -| spire-agent.waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry | -| spire-agent.waitForIt.image.tag | string | `"latest@sha256:deeaccb164a67a4d7f585c4d416641b1f422c029911a29d72beae28221f823df"` | Overrides the image tag | -| spire-agent.waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| spire-agent.waitForIt.resources | object | `{}` | | -| spire-agent.workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio | -| spire-agent.workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped | -| spire-agent.workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor | -| spire-server.affinity | object | `{}` | | -| spire-server.autoscaling.enabled | bool | `false` | | -| spire-server.autoscaling.maxReplicas | int | `100` | | -| spire-server.autoscaling.minReplicas | int | `1` | | -| spire-server.autoscaling.targetCPUUtilizationPercentage | int | `80` | | -| spire-server.bundleConfigMap | string | `"spire-bundle"` | | -| spire-server.caKeyType | string | `"rsa-2048"` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) | -| spire-server.caTTL | string | `"24h"` | | -| spire-server.ca_subject.common_name | string | `"example.org"` | | -| spire-server.ca_subject.country | string | `"NL"` | | -| spire-server.ca_subject.organization | string | `"Example"` | | -| spire-server.clusterDomain | string | `"cluster.local"` | | -| spire-server.clusterName | string | `"example-cluster"` | | -| spire-server.configMap.annotations | object | `{}` | Annotations to add to the SPIRE Server ConfigMap | -| spire-server.controllerManager.configMap.annotations | object | `{}` | Annotations to add to the Controller Manager ConfigMap | -| spire-server.controllerManager.deleteHook.enabled | bool | `true` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | -| spire-server.controllerManager.enabled | bool | `false` | | -| spire-server.controllerManager.identities.dnsNameTemplates | list | `[]` | | -| spire-server.controllerManager.identities.enabled | bool | `true` | | -| spire-server.controllerManager.identities.federatesWith | list | `[]` | | -| spire-server.controllerManager.identities.namespaceSelector | object | `{}` | | -| spire-server.controllerManager.identities.podSelector | object | `{}` | | -| spire-server.controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | | -| spire-server.controllerManager.ignoreNamespaces[0] | string | `"kube-system"` | | -| spire-server.controllerManager.ignoreNamespaces[1] | string | `"kube-public"` | | -| spire-server.controllerManager.ignoreNamespaces[2] | string | `"local-path-storage"` | | -| spire-server.controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| spire-server.controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | -| spire-server.controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry | -| spire-server.controllerManager.image.tag | string | `"0.2.3"` | Overrides the image tag | -| spire-server.controllerManager.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| spire-server.controllerManager.installAndUpgradeHook.enabled | bool | `true` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | -| spire-server.controllerManager.resources | object | `{}` | | -| spire-server.controllerManager.securityContext | object | `{}` | | -| spire-server.controllerManager.service.annotations | object | `{}` | | -| spire-server.controllerManager.service.port | int | `443` | | -| spire-server.controllerManager.service.type | string | `"ClusterIP"` | | -| spire-server.controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | | -| spire-server.dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" | -| spire-server.dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" | -| spire-server.dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" | -| spire-server.dataStore.sql.options | list | `[]` | Only used by "postgres" or "mysql" | -| spire-server.dataStore.sql.password | string | `""` | Only used by "postgres" or "mysql" | -| spire-server.dataStore.sql.plugin_data | object | `{}` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section | -| spire-server.dataStore.sql.port | int | `0` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | -| spire-server.dataStore.sql.username | string | `"spire"` | Only used by "postgres" or "mysql" | -| spire-server.defaultJwtSvidTTL | string | `"1h"` | | -| spire-server.defaultX509SvidTTL | string | `"4h"` | | -| spire-server.extraContainers | list | `[]` | | -| spire-server.extraVolumeMounts | list | `[]` | | -| spire-server.extraVolumes | list | `[]` | | -| spire-server.federation.bundleEndpoint.address | string | `"0.0.0.0"` | | -| spire-server.federation.bundleEndpoint.port | int | `8443` | | -| spire-server.federation.enabled | bool | `false` | | -| spire-server.federation.ingress.annotations | object | `{}` | | -| spire-server.federation.ingress.className | string | `""` | | -| spire-server.federation.ingress.enabled | bool | `false` | | -| spire-server.federation.ingress.hosts[0].host | string | `"spire-server-federation.example.org"` | | -| spire-server.federation.ingress.hosts[0].paths[0].path | string | `"/"` | | -| spire-server.federation.ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | | -| spire-server.federation.ingress.tls | list | `[]` | | -| spire-server.fullnameOverride | string | `""` | | -| spire-server.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| spire-server.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | -| spire-server.image.repository | string | `"spiffe/spire-server"` | The repository within the registry | -| spire-server.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. | -| spire-server.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| spire-server.imagePullSecrets | list | `[]` | | -| spire-server.ingress.annotations | object | `{}` | | -| spire-server.ingress.className | string | `""` | | -| spire-server.ingress.enabled | bool | `false` | | -| spire-server.ingress.hosts[0].host | string | `"spire-server.example.org"` | | -| spire-server.ingress.hosts[0].paths[0].path | string | `"/"` | | -| spire-server.ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | | -| spire-server.ingress.tls | list | `[]` | | -| spire-server.initContainers | list | `[]` | | -| spire-server.jwtIssuer | string | `"https://oidc-discovery.example.org"` | The JWT issuer domain | -| spire-server.keyManager.awsKMS.accessKeyID | Optional | `""` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. | -| spire-server.keyManager.awsKMS.enabled | bool | `false` | | -| spire-server.keyManager.awsKMS.keyPolicy | object | `{"existingConfigMap":"","policy":""}` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | -| spire-server.keyManager.awsKMS.keyPolicy.existingConfigMap | Optional | `""` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | -| spire-server.keyManager.awsKMS.keyPolicy.policy | Optional | `""` | Key policy in JSON format. | -| spire-server.keyManager.awsKMS.region | string | `""` | | -| spire-server.keyManager.awsKMS.secretAccessKey | Optional | `""` | Secret access key for the AWS account. | -| spire-server.keyManager.disk.enabled | bool | `true` | | -| spire-server.keyManager.memory.enabled | bool | `false` | | -| spire-server.livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe | -| spire-server.livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe | -| spire-server.livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe | -| spire-server.livenessProbe.timeoutSeconds | int | `3` | Timeout in seconds for livenessProbe | -| spire-server.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" | -| spire-server.nameOverride | string | `""` | | -| spire-server.namespaceOverride | string | `""` | | -| spire-server.nodeAttestor.k8sPsat.enabled | bool | `true` | | -| spire-server.nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` | | -| spire-server.nodeSelector | object | `{}` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | -| spire-server.notifier.k8sbundle.namespace | string | `""` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | -| spire-server.persistence.accessMode | string | `"ReadWriteOnce"` | | -| spire-server.persistence.hostPath | string | `""` | Which path to use on the host when type = hostPath | -| spire-server.persistence.size | string | `"1Gi"` | | -| spire-server.persistence.storageClass | string | `nil` | | -| spire-server.persistence.type | string | `"pvc"` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | -| spire-server.podAnnotations | object | `{}` | | -| spire-server.podSecurityContext | object | `{}` | | -| spire-server.readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe | -| spire-server.readinessProbe.periodSeconds | int | `5` | Period seconds for readinessProbe | -| spire-server.replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | -| spire-server.resources | object | `{}` | | -| spire-server.securityContext | object | `{}` | | -| spire-server.service.annotations | object | `{}` | | -| spire-server.service.port | int | `8081` | | -| spire-server.service.type | string | `"ClusterIP"` | | -| spire-server.serviceAccount.annotations | object | `{}` | Annotations to add to the service account | -| spire-server.serviceAccount.create | bool | `true` | Specifies whether a service account should be created | -| spire-server.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | -| spire-server.telemetry.prometheus.enabled | bool | `false` | | -| spire-server.telemetry.prometheus.podMonitor.enabled | bool | `false` | | -| spire-server.telemetry.prometheus.podMonitor.labels | object | `{}` | | -| spire-server.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server | -| spire-server.tolerations | list | `[]` | | -| spire-server.tools.kubectl.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| spire-server.tools.kubectl.image.registry | string | `"docker.io"` | The OCI registry to pull the image from | -| spire-server.tools.kubectl.image.repository | string | `"rancher/kubectl"` | The repository within the registry | -| spire-server.tools.kubectl.image.tag | string | `""` | Overrides the image tag | -| spire-server.tools.kubectl.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| spire-server.topologySpreadConstraints | list | `[]` | | -| spire-server.tornjak.config.clientCA.name | string | `"tornjak-client-ca"` | | -| spire-server.tornjak.config.clientCA.type | string | `"Secret"` | Type of delivery for the user CA for mTLS client verification options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | -| spire-server.tornjak.config.dataStore | object | `{"driver":"sqlite3","file":"/run/spire/data/tornjak.sqlite3"}` | Persistent DB for storing Tornjak specific information | -| spire-server.tornjak.config.tlsSecret | string | `"tornjak-tls-secret"` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | -| spire-server.tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) (Not for production) | -| spire-server.tornjak.image.pullPolicy | string | `"IfNotPresent"` | The Tornjak image pull policy | -| spire-server.tornjak.image.registry | string | `"ghcr.io"` | The OCI registry to pull the Tornjak image from | -| spire-server.tornjak.image.repository | string | `"spiffe/tornjak-backend"` | The repository within the registry | -| spire-server.tornjak.image.tag | string | `"v1.2.2"` | Overrides the image tag | -| spire-server.tornjak.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| spire-server.tornjak.resources | object | `{}` | | -| spire-server.tornjak.service.annotations | object | `{}` | | -| spire-server.tornjak.service.ports | object | `{"http":10000,"https":10443}` | Ports for tornjak | -| spire-server.tornjak.service.type | string | `"ClusterIP"` | | -| spire-server.tornjak.startupProbe.failureThreshold | int | `3` | | -| spire-server.tornjak.startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for | -| spire-server.tornjak.startupProbe.periodSeconds | int | `10` | | -| spire-server.tornjak.startupProbe.successThreshold | int | `1` | | -| spire-server.tornjak.startupProbe.timeoutSeconds | int | `5` | | -| spire-server.trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers | -| spire-server.upstreamAuthority.awsPCA.assumeRoleARN | Optional | `""` | ARN of an IAM role to assume | -| spire-server.upstreamAuthority.awsPCA.caSigningTemplateARN | string | `""` | See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. | -| spire-server.upstreamAuthority.awsPCA.certificateAuthorityARN | string | `""` | ARN of the "upstream" CA certificate | -| spire-server.upstreamAuthority.awsPCA.enabled | bool | `false` | | -| spire-server.upstreamAuthority.awsPCA.endpoint | string | `""` | See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | -| spire-server.upstreamAuthority.awsPCA.region | string | `""` | AWS Region to use | -| spire-server.upstreamAuthority.awsPCA.signingAlgorithm | string | `""` | See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | -| spire-server.upstreamAuthority.awsPCA.supplementalBundlePath | Optional | `""` | Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | -| spire-server.upstreamAuthority.certManager.ca.create | bool | `false` | Creates a Cert-Manager CA | -| spire-server.upstreamAuthority.certManager.ca.duration | string | `"87600h"` | Duration of the CA. Defaults to 10 years. | -| spire-server.upstreamAuthority.certManager.ca.privateKey.algorithm | string | `"ECDSA"` | | -| spire-server.upstreamAuthority.certManager.ca.privateKey.rotationPolicy | string | `""` | | -| spire-server.upstreamAuthority.certManager.ca.privateKey.size | int | `256` | | -| spire-server.upstreamAuthority.certManager.ca.renewBefore | string | `""` | How long to wait before renewing the CA | -| spire-server.upstreamAuthority.certManager.enabled | bool | `false` | | -| spire-server.upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` | | -| spire-server.upstreamAuthority.certManager.issuer_kind | string | `"Issuer"` | | -| spire-server.upstreamAuthority.certManager.issuer_name | string | `""` | Defaults to the release name, override if CA is provided outside of the chart | -| spire-server.upstreamAuthority.certManager.kube_config_file | string | `""` | | -| spire-server.upstreamAuthority.certManager.namespace | string | `""` | Specify to use a namespace other then the one the chart is installed into | -| spire-server.upstreamAuthority.certManager.rbac.create | bool | `true` | | -| spire-server.upstreamAuthority.disk.enabled | bool | `false` | | -| spire-server.upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | -| spire-server.upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info | -| spire-server.upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. | -| spire-server.upstreamAuthority.spire.enabled | bool | `false` | | -| spire-server.upstreamAuthority.spire.server.address | string | `""` | | -| spire-server.upstreamAuthority.spire.server.port | int | `8081` | | -| spire-server.upstreamAuthority.spire.upstreamDriver | string | `""` | | -| tornjak-frontend.affinity | object | `{}` | | -| tornjak-frontend.apiServerURL | string | `"http://localhost:10000/"` | URL of the Tornjak APIs (backend) Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. | -| tornjak-frontend.fullnameOverride | string | `""` | | -| tornjak-frontend.image.pullPolicy | string | `"IfNotPresent"` | | -| tornjak-frontend.image.registry | string | `"ghcr.io"` | | -| tornjak-frontend.image.repository | string | `"spiffe/tornjak-frontend"` | | -| tornjak-frontend.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. | -| tornjak-frontend.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| tornjak-frontend.imagePullSecrets | list | `[]` | | -| tornjak-frontend.labels | object | `{}` | | -| tornjak-frontend.nameOverride | string | `""` | | -| tornjak-frontend.namespaceOverride | string | `""` | | -| tornjak-frontend.nodeSelector | object | `{"kubernetes.io/arch":"amd64"}` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | -| tornjak-frontend.podSecurityContext | object | `{}` | | -| tornjak-frontend.securityContext | object | `{}` | | -| tornjak-frontend.service.annotations | object | `{}` | | -| tornjak-frontend.service.port | int | `3000` | | -| tornjak-frontend.service.type | string | `"ClusterIP"` | | -| tornjak-frontend.serviceAccount.annotations | object | `{}` | Annotations to add to the service account | -| tornjak-frontend.serviceAccount.create | bool | `true` | Specifies whether a service account should be created | -| tornjak-frontend.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | -| tornjak-frontend.spireHealthCheck.enabled | bool | `true` | Enables the SPIRE Healthchecker indicator | -| tornjak-frontend.startupProbe.enabled | bool | `true` | Enable startupProbe on Tornjak frontend container | -| tornjak-frontend.startupProbe.failureThreshold | int | `6` | Failure threshold count for startupProbe | -| tornjak-frontend.startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for startupProbe | -| tornjak-frontend.startupProbe.periodSeconds | int | `10` | Period seconds for startupProbe | -| tornjak-frontend.startupProbe.successThreshold | int | `1` | Success threshold count for startupProbe | -| tornjak-frontend.startupProbe.timeoutSeconds | int | `5` | Timeout seconds for startupProbe | -| tornjak-frontend.tolerations | list | `[]` | | -| tornjak-frontend.topologySpreadConstraints | list | `[]` | | -| upstream-spiffe-csi-driver.agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent | -| upstream-spiffe-csi-driver.fullnameOverride | string | `""` | | -| upstream-spiffe-csi-driver.healthChecks.port | int | `9809` | | -| upstream-spiffe-csi-driver.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| upstream-spiffe-csi-driver.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | -| upstream-spiffe-csi-driver.image.repository | string | `"spiffe/spiffe-csi-driver"` | The repository within the registry | -| upstream-spiffe-csi-driver.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion | -| upstream-spiffe-csi-driver.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| upstream-spiffe-csi-driver.imagePullSecrets | list | `[]` | | -| upstream-spiffe-csi-driver.kubeletPath | string | `"/var/lib/kubelet"` | | -| upstream-spiffe-csi-driver.livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe | -| upstream-spiffe-csi-driver.livenessProbe.timeoutSeconds | int | `5` | Timeout value in seconds for livenessProbe | -| upstream-spiffe-csi-driver.nameOverride | string | `""` | | -| upstream-spiffe-csi-driver.namespaceOverride | string | `""` | | -| upstream-spiffe-csi-driver.nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| upstream-spiffe-csi-driver.nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | The OCI registry to pull the image from | -| upstream-spiffe-csi-driver.nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | The repository within the registry | -| upstream-spiffe-csi-driver.nodeDriverRegistrar.image.tag | string | `"v2.8.0"` | Overrides the image tag | -| upstream-spiffe-csi-driver.nodeDriverRegistrar.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| upstream-spiffe-csi-driver.nodeDriverRegistrar.resources | object | `{}` | | -| upstream-spiffe-csi-driver.nodeSelector | object | `{}` | | -| upstream-spiffe-csi-driver.pluginName | string | `"csi.spiffe.io"` | Set the csi driver name deployed to Kubernetes. | -| upstream-spiffe-csi-driver.podAnnotations | object | `{}` | | -| upstream-spiffe-csi-driver.podSecurityContext | object | `{}` | | -| upstream-spiffe-csi-driver.priorityClassName | string | `""` | Priority class assigned to daemonset pods | -| upstream-spiffe-csi-driver.resources | object | `{}` | | -| upstream-spiffe-csi-driver.securityContext.privileged | bool | `true` | | -| upstream-spiffe-csi-driver.securityContext.readOnlyRootFilesystem | bool | `true` | | -| upstream-spiffe-csi-driver.serviceAccount.annotations | object | `{}` | Annotations to add to the service account | -| upstream-spiffe-csi-driver.serviceAccount.create | bool | `true` | Specifies whether a service account should be created | -| upstream-spiffe-csi-driver.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | -| upstream-spiffe-csi-driver.tolerations | list | `[]` | | -| upstream-spire-agent.bundleConfigMap | string | `"spire-bundle"` | | -| upstream-spire-agent.clusterName | string | `"example-cluster"` | | -| upstream-spire-agent.configMap.annotations | object | `{}` | Annotations to add to the SPIRE Agent ConfigMap | -| upstream-spire-agent.extraContainers | list | `[]` | | -| upstream-spire-agent.extraVolumeMounts | list | `[]` | | -| upstream-spire-agent.extraVolumes | list | `[]` | | -| upstream-spire-agent.fsGroupFix.image.pullPolicy | string | `"Always"` | The image pull policy | -| upstream-spire-agent.fsGroupFix.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from | -| upstream-spire-agent.fsGroupFix.image.repository | string | `"chainguard/bash"` | The repository within the registry | -| upstream-spire-agent.fsGroupFix.image.tag | string | `"latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4"` | Overrides the image tag | -| upstream-spire-agent.fsGroupFix.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| upstream-spire-agent.fsGroupFix.resources | object | `{}` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | -| upstream-spire-agent.fullnameOverride | string | `""` | | -| upstream-spire-agent.healthChecks.port | int | `9980` | override the host port used for health checking | -| upstream-spire-agent.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| upstream-spire-agent.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | -| upstream-spire-agent.image.repository | string | `"spiffe/spire-agent"` | The repository within the registry | -| upstream-spire-agent.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. | -| upstream-spire-agent.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| upstream-spire-agent.imagePullSecrets | list | `[]` | | -| upstream-spire-agent.initContainers | list | `[]` | | -| upstream-spire-agent.livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe | -| upstream-spire-agent.livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe | -| upstream-spire-agent.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" | -| upstream-spire-agent.nameOverride | string | `""` | | -| upstream-spire-agent.namespaceOverride | string | `""` | | -| upstream-spire-agent.nodeSelector | object | `{}` | | -| upstream-spire-agent.podAnnotations | object | `{}` | | -| upstream-spire-agent.podSecurityContext | object | `{}` | | -| upstream-spire-agent.priorityClassName | string | `""` | Priority class assigned to daemonset pods | -| upstream-spire-agent.readinessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for readinessProbe | -| upstream-spire-agent.readinessProbe.periodSeconds | int | `60` | Period seconds for readinessProbe | -| upstream-spire-agent.resources | object | `{}` | | -| upstream-spire-agent.securityContext | object | `{}` | | -| upstream-spire-agent.server.address | string | `""` | | -| upstream-spire-agent.server.namespaceOverride | string | `""` | | -| upstream-spire-agent.server.port | int | `8081` | | -| upstream-spire-agent.serviceAccount.annotations | object | `{}` | Annotations to add to the service account | -| upstream-spire-agent.serviceAccount.create | bool | `true` | Specifies whether a service account should be created | -| upstream-spire-agent.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | -| upstream-spire-agent.socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent | -| upstream-spire-agent.telemetry.prometheus.enabled | bool | `false` | | -| upstream-spire-agent.telemetry.prometheus.podMonitor.enabled | bool | `false` | | -| upstream-spire-agent.telemetry.prometheus.podMonitor.labels | object | `{}` | | -| upstream-spire-agent.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | -| upstream-spire-agent.telemetry.prometheus.port | int | `9988` | | -| upstream-spire-agent.tolerations | list | `[]` | | -| upstream-spire-agent.trustBundleFormat | string | `"pem"` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | -| upstream-spire-agent.trustBundleURL | string | `""` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | -| upstream-spire-agent.trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers | -| upstream-spire-agent.waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| upstream-spire-agent.waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from | -| upstream-spire-agent.waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry | -| upstream-spire-agent.waitForIt.image.tag | string | `"latest@sha256:deeaccb164a67a4d7f585c4d416641b1f422c029911a29d72beae28221f823df"` | Overrides the image tag | -| upstream-spire-agent.waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| upstream-spire-agent.waitForIt.resources | object | `{}` | | -| upstream-spire-agent.workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio | -| upstream-spire-agent.workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped | -| upstream-spire-agent.workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor | +## Parameters ----------------------------------------------- +### Global parameters + +| Name | Description | Value | +| --------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ---------------------------- | +| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` | +| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` | +| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` | +| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens | `oidc-discovery.example.org` | +| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` | +| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` | +| `global.spire.image.registry` | Override all Spire image registries at once | `""` | +| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | +| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | + +### Spire server parameters + +| Name | Description | Value | +| ---------------------------------------- | --------------------------------------------- | -------- | +| `spire-server.enabled` | Flag to enable Spire server | `true` | +| `spire-server.nameOverride` | Overrides the name of Spire server pods | `server` | +| `spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` | + +### Spire agent parameters + +| Name | Description | Value | +| -------------------------- | -------------------------------------- | ------- | +| `spire-agent.enabled` | Flag to enable Spire agent | `true` | +| `spire-agent.nameOverride` | Overrides the name of Spire agent pods | `agent` | + +### Upstream Spire agent and CSI driver configuration + +| Name | Description | Value | +| ------------------ | ---------------------------------------------------------- | ------- | +| `upstream.enabled` | Enable upstream agent and driver for use with nested spire | `false` | + +### Upstream Spire agent parameters + +| Name | Description | Value | +| ------------------------------------------------ | -------------------------------------------------- | ---------------------------------------------------- | +| `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` | +| `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` | +| `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` | +| `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` | +| `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` | +| `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` | +| `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` | + +### SPIFFE CSI Driver parameters + +| Name | Description | Value | +| --------------------------- | ------------------------------------------------ | ------ | +| `spiffe-csi-driver.enabled` | Flag to enable spiffe-csi-driver for the cluster | `true` | + +### Upstream SPIFFE CSI Driver parameters + +| Name | Description | Value | +| ---------------------------------------------- | ----------------------------------------------------------- | ---------------------------------------------------- | +| `upstream-spiffe-csi-driver.pluginName` | The plugin name for configuring upstream Spiffe CSI driver | `upstream.csi.spiffe.io` | +| `upstream-spiffe-csi-driver.agentSocketPath` | The socket path where Spiffe CSI driver mounts agent socket | `/run/spire/agent-sockets-upstream/spire-agent.sock` | +| `upstream-spiffe-csi-driver.healthChecks.port` | The port where Spiffe CSI driver health checks are exposed | `9810` | + +### SPIFFE oidc discovery provider parameters + +| Name | Description | Value | +| ---------------------------------------- | ------------------------------------------------------------- | ------- | +| `spiffe-oidc-discovery-provider.enabled` | Flag to enable spiffe-oidc-discovery-provider for the cluster | `false` | + +### Tornjak frontend parameters + +| Name | Description | Value | +| -------------------------- | -------------------------------------------------------------- | ------- | +| `tornjak-frontend.enabled` | Enables deployment of Tornjak frontend/UI (Not for production) | `false` | diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index 2cf643d..64774b2 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -24,41 +24,41 @@ A Helm chart to install the SPIFFE CSI driver. * -## Values +## Parameters -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent | -| fullnameOverride | string | `""` | | -| healthChecks.port | int | `9809` | | -| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | -| image.repository | string | `"spiffe/spiffe-csi-driver"` | The repository within the registry | -| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion | -| image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| imagePullSecrets | list | `[]` | | -| kubeletPath | string | `"/var/lib/kubelet"` | | -| livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe | -| livenessProbe.timeoutSeconds | int | `5` | Timeout value in seconds for livenessProbe | -| nameOverride | string | `""` | | -| namespaceOverride | string | `""` | | -| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | The OCI registry to pull the image from | -| nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | The repository within the registry | -| nodeDriverRegistrar.image.tag | string | `"v2.8.0"` | Overrides the image tag | -| nodeDriverRegistrar.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| nodeDriverRegistrar.resources | object | `{}` | | -| nodeSelector | object | `{}` | | -| pluginName | string | `"csi.spiffe.io"` | Set the csi driver name deployed to Kubernetes. | -| podAnnotations | object | `{}` | | -| podSecurityContext | object | `{}` | | -| priorityClassName | string | `""` | Priority class assigned to daemonset pods | -| resources | object | `{}` | | -| securityContext.privileged | bool | `true` | | -| securityContext.readOnlyRootFilesystem | bool | `true` | | -| serviceAccount.annotations | object | `{}` | Annotations to add to the service account | -| serviceAccount.create | bool | `true` | Specifies whether a service account should be created | -| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | -| tolerations | list | `[]` | | +### SPIFFE CSI Driver Chart parameters ----------------------------------------------- +| Name | Description | Value | +| ---------------------------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------- | +| `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `resources` | Resource requests and limits for spiffe-csi-driver | `{}` | +| `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | +| `livenessProbe.timeoutSeconds` | Timeout value in seconds for livenessProbe | `5` | +| `imagePullSecrets` | Image pull secret details for spiffe-csi-driver | `[]` | +| `nameOverride` | Name override for spiffe-csi-driver | `""` | +| `namespaceOverride` | Namespace to install spiffe-csi-driver | `""` | +| `fullnameOverride` | Full name override for spiffe-csi-driver | `""` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | +| `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` | +| `podSecurityContext` | Security context for CSI driver pods | `{}` | +| `securityContext.readOnlyRootFilesystem` | Flag for read only root filesystem | `true` | +| `securityContext.privileged` | Flag for specifying privileged mode | `true` | +| `nodeSelector` | Node selector for CSI driver pods | `{}` | +| `tolerations` | Tolerations for CSI driver pods | `[]` | +| `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | +| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` | +| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `nodeDriverRegistrar.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.8.0` | +| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` | +| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | +| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` | +| `priorityClassName` | Priority class assigned to daemonset pods | `""` | diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index b200827..a6dc54c 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -1,20 +1,28 @@ -# @ignored +# Default configuration for SPIFFE CSI Driver chart +# SPDX-License-Identifier: APACHE-2.0 + +## @skip global global: {} -# -- Set the csi driver name deployed to Kubernetes. +## @section SPIFFE CSI Driver Chart parameters +## +## @param pluginName Set the csi driver name deployed to Kubernetes. pluginName: csi.spiffe.io +## @param image.registry The OCI registry to pull the image from +## @param image.repository The repository within the registry +## @param image.pullPolicy The image pull policy +## @param image.version This value is deprecated in favor of tag. (Will be removed in a future release) +## @param image.tag Overrides the image tag whose default is the chart appVersion +## image: - # -- The OCI registry to pull the image from registry: ghcr.io - # -- The repository within the registry repository: spiffe/spiffe-csi-driver - # -- The image pull policy pullPolicy: IfNotPresent - # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" - # -- Overrides the image tag whose default is the chart appVersion tag: "" + +## @param resources [object] Resource requests and limits for spiffe-csi-driver resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little @@ -28,33 +36,47 @@ resources: {} # memory: 64Mi healthChecks: + ## @param healthChecks.port The healthcheck port for spiffe-csi-driver port: 9809 +## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe +## @param livenessProbe.timeoutSeconds Timeout value in seconds for livenessProbe +## livenessProbe: - # -- Initial delay seconds for livenessProbe initialDelaySeconds: 5 - # -- Timeout value in seconds for livenessProbe timeoutSeconds: 5 +## @param imagePullSecrets Image pull secret details for spiffe-csi-driver imagePullSecrets: [] + +## @param nameOverride Name override for spiffe-csi-driver nameOverride: "" + +## @param namespaceOverride Namespace to install spiffe-csi-driver namespaceOverride: "" + +## @param fullnameOverride Full name override for spiffe-csi-driver fullnameOverride: "" +## @param serviceAccount.create Specifies whether a service account should be created +## @param serviceAccount.annotations Annotations to add to the service account +## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated. +## serviceAccount: - # -- Specifies whether a service account should be created create: true - # -- Annotations to add to the service account annotations: {} - # -- The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template name: "" +## @param podAnnotations [object] Pod annotations for spiffe-csi-driver podAnnotations: {} +## @param podSecurityContext [object] Security context for CSI driver pods podSecurityContext: {} # fsGroup: 2000 +## @param securityContext.readOnlyRootFilesystem Flag for read only root filesystem +## @param securityContext.privileged Flag for specifying privileged mode +## securityContext: readOnlyRootFilesystem: true privileged: true @@ -64,22 +86,26 @@ securityContext: # drop: # - ALL +## @param nodeSelector [object] Node selector for CSI driver pods nodeSelector: {} +## @param tolerations [array] Tolerations for CSI driver pods tolerations: [] nodeDriverRegistrar: + ## @param nodeDriverRegistrar.image.registry The OCI registry to pull the image from + ## @param nodeDriverRegistrar.image.repository The repository within the registry + ## @param nodeDriverRegistrar.image.pullPolicy The image pull policy + ## @param nodeDriverRegistrar.image.version This value is deprecated in favor of tag. (Will be removed in a future release) + ## @param nodeDriverRegistrar.image.tag Overrides the image tag + ## image: - # -- The OCI registry to pull the image from registry: registry.k8s.io - # -- The repository within the registry repository: sig-storage/csi-node-driver-registrar - # -- The image pull policy pullPolicy: IfNotPresent - # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" - # -- Overrides the image tag tag: v2.8.0 + ## @param nodeDriverRegistrar.resources Resource requests and limits for CSI driver pods resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little @@ -92,10 +118,11 @@ nodeDriverRegistrar: # cpu: 100m # memory: 64Mi -# -- The unix socket path to the spire-agent +## @param agentSocketPath The unix socket path to the spire-agent agentSocketPath: /run/spire/agent-sockets/spire-agent.sock +## @param kubeletPath Path to kubelet file kubeletPath: /var/lib/kubelet -# -- Priority class assigned to daemonset pods +## @param priorityClassName Priority class assigned to daemonset pods priorityClassName: "" diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 74ef3aa..3c2991e 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -25,84 +25,105 @@ A Helm chart to install the SPIFFE OIDC discovery provider. * -## Values +## Parameters -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| affinity | object | `{}` | | -| agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket | -| annotations | object | `{}` | Annotations for the deployment | -| autoscaling.enabled | bool | `false` | | -| autoscaling.maxReplicas | int | `5` | | -| autoscaling.minReplicas | int | `1` | | -| autoscaling.targetCPUUtilizationPercentage | int | `80` | | -| autoscaling.targetMemoryUtilizationPercentage | int | `80` | | -| clusterDomain | string | `"cluster.local"` | | -| config.acme.cacheDir | string | `"/run/spire"` | | -| config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | -| config.acme.emailAddress | string | `"letsencrypt@example.org"` | | -| config.acme.tosAccepted | bool | `false` | | -| config.additionalDomains | list | `["localhost"]` | Add additional domains that can be used for oidc discovery | -| config.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" | -| configMap.annotations | object | `{}` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | -| deleteHook.enabled | bool | `true` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | -| fullnameOverride | string | `""` | | -| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | -| image.repository | string | `"spiffe/oidc-discovery-provider"` | The repository within the registry | -| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion | -| image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| imagePullSecrets | list | `[]` | | -| ingress.annotations | object | `{}` | | -| ingress.className | string | `""` | | -| ingress.enabled | bool | `false` | | -| ingress.hosts[0].host | string | `"oidc-discovery.example.org"` | | -| ingress.hosts[0].paths[0].path | string | `"/"` | | -| ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | | -| ingress.tls | list | `[]` | | -| insecureScheme.enabled | bool | `false` | | -| insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| insecureScheme.nginx.image.registry | string | `"docker.io"` | The OCI registry to pull the image from | -| insecureScheme.nginx.image.repository | string | `"nginxinc/nginx-unprivileged"` | The repository within the registry | -| insecureScheme.nginx.image.tag | string | `"1.24.0-alpine"` | Overrides the image tag | -| insecureScheme.nginx.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| insecureScheme.nginx.resources | object | `{}` | | -| jwtIssuer | string | `"https://oidc-discovery.example.org"` | | -| livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe | -| livenessProbe.periodSeconds | int | `5` | Period seconds for livenessProbe | -| nameOverride | string | `""` | | -| namespaceOverride | string | `""` | | -| nodeSelector | object | `{}` | | -| podAnnotations | object | `{}` | | -| podSecurityContext | object | `{}` | | -| readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe | -| readinessProbe.periodSeconds | int | `5` | Period seconds for readinessProbe | -| replicaCount | int | `1` | | -| resources | object | `{}` | | -| securityContext | object | `{}` | | -| service.annotations | object | `{}` | | -| service.port | int | `80` | | -| service.type | string | `"ClusterIP"` | | -| serviceAccount.annotations | object | `{}` | Annotations to add to the service account | -| serviceAccount.create | bool | `true` | Specifies whether a service account should be created | -| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | -| telemetry.prometheus.enabled | bool | `false` | | -| telemetry.prometheus.nginxExporter.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| telemetry.prometheus.nginxExporter.image.registry | string | `"docker.io"` | The OCI registry to pull the image from | -| telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` | The repository within the registry | -| telemetry.prometheus.nginxExporter.image.tag | string | `"0.11.0"` | Overrides the image tag | -| telemetry.prometheus.nginxExporter.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| telemetry.prometheus.nginxExporter.resources | object | `{}` | | -| telemetry.prometheus.podMonitor.enabled | bool | `false` | | -| telemetry.prometheus.podMonitor.labels | object | `{}` | | -| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider | -| telemetry.prometheus.port | int | `9988` | | -| tolerations | list | `[]` | | -| tools.kubectl.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| tools.kubectl.image.registry | string | `"docker.io"` | The OCI registry to pull the image from | -| tools.kubectl.image.repository | string | `"rancher/kubectl"` | The repository within the registry | -| tools.kubectl.image.tag | string | `""` | Overrides the image tag | -| tools.kubectl.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers | +### Chart parameters ----------------------------------------------- +| Name | Description | Value | +| ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | +| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | +| `replicaCount` | Replica count | `1` | +| `namespaceOverride` | Namespace override | `""` | +| `annotations` | Annotations for the deployment | `{}` | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/oidc-discovery-provider` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `resources` | Resource requests and limits | `{}` | +| `service.type` | Service type | `ClusterIP` | +| `service.port` | Service port | `80` | +| `service.annotations` | Annotations for service resource | `{}` | +| `configMap.annotations` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | `{}` | +| `podSecurityContext` | Pod security context for OIDC discovery provider pods | `{}` | +| `securityContext` | Security context for OIDC discovery provider deployment | `{}` | +| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | +| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | +| `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` | +| `insecureScheme.enabled` | Flag to enable insecure schema | `false` | +| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from | `docker.io` | +| `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` | +| `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.24.0-alpine` | +| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | +| `jwtIssuer` | Path to JWT issuer | `https://oidc-discovery.example.org` | +| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | +| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` | +| `config.acme.tosAccepted` | Flag for Terms of Service acceptance | `false` | +| `config.acme.cacheDir` | Path for cache directory | `/run/spire` | +| `config.acme.directoryUrl` | URL for acme directory | `https://acme-v02.api.letsencrypt.org/directory` | +| `config.acme.emailAddress` | Email address for registration | `letsencrypt@example.org` | +| `imagePullSecrets` | Image pull secret names | `[]` | +| `nameOverride` | Name override | `""` | +| `fullnameOverride` | Full name override | `""` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | +| `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | +| `autoscaling.enabled` | Flag to enable autoscaling | `false` | +| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` | +| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` | +| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` | +| `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` | +| `nodeSelector` | Node selector | `{}` | +| `tolerations` | iist of tolerations | `[]` | +| `affinity` | Node affinity | `{}` | +| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | +| `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` | +| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | +| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | +| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | +| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the helm release | `""` | +| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | +| `telemetry.prometheus.nginxExporter.image.registry` | The OCI registry to pull the image from | `docker.io` | +| `telemetry.prometheus.nginxExporter.image.repository` | The repository within the registry | `nginx/nginx-prometheus-exporter` | +| `telemetry.prometheus.nginxExporter.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `telemetry.prometheus.nginxExporter.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `telemetry.prometheus.nginxExporter.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.11.0` | +| `telemetry.prometheus.nginxExporter.resources` | Resource requests and limits | `{}` | +| `ingress.enabled` | Flag to enable ingress | `false` | +| `ingress.className` | Ingress class name | `""` | +| `ingress.annotations` | Annotations for ingress object | `{}` | +| `ingress.hosts` | Host paths for ingress object | `[]` | +| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` | +| `tests.hostAliases` | List of host aliases for testing | `[]` | +| `tests.tls.enabled` | Flag for enabling tls for tests | `false` | +| `tests.tls.customCA` | Custom CA value for tests | `""` | +| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | +| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` | +| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | +| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d717d0a2c88518f8e36d9cfe1571639a40617e8c4291e34876d46bdeefb1ab5a` | +| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` | +| `tests.busybox.image.repository` | The repository within the registry | `busybox` | +| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.busybox.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `uclibc@sha256:3e516f71d8801b0ce6c3f8f8e4f11093ec04e168177a90f1da4498014ee06b6b` | +| `tests.agent.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `tests.agent.image.repository` | The repository within the registry | `spiffe/spire-agent` | +| `tests.agent.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.agent.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.agent.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | +| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | +| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/files/test/jwt-decode.sh b/charts/spire/charts/spiffe-oidc-discovery-provider/files/test/jwt-decode.sh new file mode 100755 index 0000000..aedb696 --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/files/test/jwt-decode.sh @@ -0,0 +1,116 @@ +#!/usr/bin/env bash + +set -x + +# https://gist.github.com/stokito/f2d7ea0b300f14638a9063559384ec89/ +# Decode a JWT from stdin and verify it's signature with the JWT issuer public key +# Only RS256 keys are supported for signature check +# +# HOW TO USE: +# $ export JWTTOKEN="eyF......g" +# $ ./jwt-decode.sh https://example.com/keys "${JWTTOKEN}" +# if signature check failed then error code will be non-zero + +URL=$1 + +JWT=$2 + +if [ -z "$(command -v jq)" ]; then + echo "This script will NOT work on your machine." + echo "Please install jq first: https://stedolan.github.io/jq/download/" + exit 1 +fi + +base64_padding() { + local len=$(( ${#1} % 4 )) + local padded_b64='' + if [ ${len} = 2 ]; then + padded_b64="${1}==" + elif [ ${len} = 3 ]; then + padded_b64="${1}=" + else + padded_b64="${1}" + fi + echo -n "$padded_b64" +} + +base64url_to_b64() { + base64_padding "${1}" | tr -- '-_' '+/' +} + +b2hex() { echo -n "$1"==== | fold -w 4 | sed '$ d' | tr -d '\n' |base64 -d | xxd -p | tr -d \\n; } + +mint_rsa_key() { + JWK=$1 + + # Extract the modulus and exponent from the JWK, converting from URL-safe Base64 to standard Base64 + MODULUS=$(echo "$JWK" | jq -r '.n' | tr '_-' '/+') + EXPONENT=$(echo "$JWK" | jq -r '.e' | tr '_-' '/+') + + modulus=$(b2hex "$MODULUS") + exponent=$(b2hex "$EXPONENT") + + asnconf=$(mktemp) + + asnconf="asn1=SEQUENCE:pubkeyinfo\n[pubkeyinfo]\nalgorithm=SEQUENCE:rsa_alg\npubkey=BITWRAP,SEQUENCE:rsapubkey\n[rsa_alg]\nalgorithm=OID:rsaEncryption\nparameter=NULL\n[rsapubkey]\nn=INTEGER:0x$modulus\ne=INTEGER:0x$exponent" + + derfile=$(mktemp) + echo >&2 "derfile: $derfile" + echo -e "$asnconf" | openssl asn1parse -genconf /dev/stdin -noout -out "$derfile" + + openssl rsa -in "$derfile" -inform DER -pubin +} + +# read the JWT from stdin and split by comma into three variables +IFS='.' read -r JWT_HEADER_B64URL JWT_PAYLOAD_B64URL JWT_SIGNATURE_B64URL <<< "${JWT}" + +JWT_HEADER_B64=$(base64url_to_b64 "${JWT_HEADER_B64URL}") +JWT_PAYLOAD_B64=$(base64url_to_b64 "${JWT_PAYLOAD_B64URL}") +JWT_SIGNATURE_B64=$(base64url_to_b64 "${JWT_SIGNATURE_B64URL}") + +JWT_HEADER=$(echo "${JWT_HEADER_B64}" | base64 -d) +JWT_PAYLOAD=$(echo "${JWT_PAYLOAD_B64}" | base64 -d) + +echo "JWT Header:" +echo "${JWT_HEADER}" | jq +echo "JWT Payload:" +echo "${JWT_PAYLOAD}" | jq +echo "JWT Signature (Base 64 padded):" +echo "${JWT_SIGNATURE_B64}" + +JWT_ALG=$(echo "$JWT_HEADER" | jq -r .alg) +JWT_KID=$(echo "$JWT_HEADER" | jq -r .kid) +#JWT_TYP=$(echo "$JWT_HEADER" | jq -r .typ) +#JWT_ISS=$(echo "$JWT_PAYLOAD" | jq -r .iss) +JWT_SUB=$(echo "$JWT_PAYLOAD" | jq -r .sub) +JWT_EMAIL=$(echo "$JWT_PAYLOAD" | jq -r .email) +JWT_IAT=$(echo "$JWT_PAYLOAD" | jq -r .iat) +echo "alg: $JWT_ALG kid: $JWT_KID" +echo "sub: $JWT_SUB email: $JWT_EMAIL iat: $JWT_IAT" + +echo "URL: ${URL}" +JWK_SET=$(curl -k -s "${URL}") +echo >&2 "JWK_SET: $JWK_SET" +JWK=$(echo "$JWK_SET" | jq -c -r --arg KID "$JWT_KID" '.keys[] | select(.kid==$KID)') +echo >&2 "JWK: $JWK" + +PUB_KEY_FILE=$(mktemp) +mint_rsa_key "$JWK" > "$PUB_KEY_FILE" + +# verify signature +if [ "${JWT_ALG}" = "RS256" ]; then + #SIG_FILE="/tmp/$JWT_SUB-$JWT_IAT.sig.dat" + SIG_FILE=$(mktemp) + echo -n "$JWT_SIGNATURE_B64" | base64 -d > "${SIG_FILE}" + JWT_BODY=$(echo -n "$JWT_HEADER_B64URL.$JWT_PAYLOAD_B64URL") + echo -n "$JWT_BODY" | openssl dgst -sha256 -verify "${PUB_KEY_FILE}" -signature "${SIG_FILE}" + JWT_SIG_VERIFIED=$? + rm "${SIG_FILE}" + if [ ${JWT_SIG_VERIFIED} -ne 0 ]; then + >&2 echo "Bad Signature" + exit ${JWT_SIG_VERIFIED}; + fi +else + >&2 echo "Error 3: Unsupported signature algorithm $JWT_ALG" + exit 3 +fi diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml index 393cafe..af9063e 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml @@ -1,3 +1,4 @@ +{{ $values := merge .Values }} apiVersion: v1 kind: Pod metadata: @@ -33,8 +34,31 @@ spec: - name: curl-ingress image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} command: ['curl'] + {{- if dig "tests" "tls" "enabled" false $values }} + {{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }} + args: ['-s', '-f', '--cacert', '/ca/ca.crt', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration'] + {{- else }} + args: ['-s', '-f', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration'] + {{- end }} + {{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }} + volumeMounts: + - name: custom-ca + mountPath: /ca + {{- end }} + {{- else }} args: ['-s', '-f', 'http://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration'] + {{- end }} securityContext: {{- toYaml .Values.securityContext | nindent 8 }} {{- end }} + {{- if ne (len (dig "tests" "hostAliases" "" $values)) 0 }} + hostAliases: + {{- toYaml .Values.tests.hostAliases | nindent 4 }} + {{- end }} + {{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }} + volumes: + - name: custom-ca + secret: + secretName: {{ .Values.tests.tls.customCA }} + {{- end }} restartPolicy: Never diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-keys.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-keys.yaml new file mode 100644 index 0000000..e2bbc43 --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-keys.yaml @@ -0,0 +1,87 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "spiffe-oidc-discovery-provider.fullname" . }}-test-keys" + namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }} + labels: + {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test +spec: + {{- with .Values.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 4 }} + {{- end }} + serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }} + initContainers: + - name: static-busybox + image: {{ template "spire-lib.image" (dict "image" .Values.tests.busybox.image "global" .Values.global) }} + command: + - sh + - -c + - | + cp /bin/busybox /data/busybox + chmod +x /data/busybox + {{- with .Values.securityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + volumeMounts: + - name: data-volume + mountPath: /data + - name: gettoken + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version "image" .Values.tests.agent.image) }} + command: + - /data/busybox + - sh + - -c + - | + while true; do + /opt/spire/bin/spire-agent api fetch jwt -audience foo -format json -socketPath /spire-agent/spire-agent.sock -timeout 5s > /data/token.svid + [ $? -eq 0 ] && break + sleep 1 + done + {{- with .Values.securityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + volumeMounts: + - name: data-volume + mountPath: /data + - name: spire-api + mountPath: /spire-agent + readOnly: true + containers: + - name: verify-keys + image: {{ template "spire-lib.image" (dict "image" .Values.tests.toolkit.image "global" .Values.global) }} + command: + - bash + env: + - name: TMPDIR + value: /data + args: + - -c + - | + URL=http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }} + curl -k -s -f "${URL}"/keys + JWT=$(cat /data/token.svid | jq -r '.[].svids[0].svid' | xargs) + cat <<'EOF' >> /data/jwt-decode.sh + {{- (.Files.Get "files/test/jwt-decode.sh") | nindent 10 }} + EOF + bash /data/jwt-decode.sh "${URL}"/keys "${JWT}" + {{- with .Values.securityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + volumeMounts: + - mountPath: /data + name: data-volume + restartPolicy: Never + volumes: + - csi: + driver: csi.spiffe.io + readOnly: true + name: spire-api + - name: data-volume + emptyDir: {} +--- diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 5430819..1d3be3a 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -1,32 +1,37 @@ -# Default values for spiffe-oidc-discovery-provider. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. +# Default configuration for Spire OIDC Provider chart +# SPDX-License-Identifier: APACHE-2.0 -# @ignored +## @skip global global: {} -# -- The name of the spire-agent unix socket +## @section Chart parameters +## +## @param agentSocketName The name of the spire-agent unix socket agentSocketName: spire-agent.sock +## @param replicaCount Replica count replicaCount: 1 +## @param namespaceOverride Namespace override namespaceOverride: "" -# -- Annotations for the deployment +## @param annotations [object] Annotations for the deployment annotations: {} image: - # -- The OCI registry to pull the image from + ## @param image.registry The OCI registry to pull the image from + ## @param image.repository The repository within the registry + ## @param image.pullPolicy The image pull policy + ## @param image.version This value is deprecated in favor of tag. (Will be removed in a future release) + ## @param image.tag Overrides the image tag whose default is the chart appVersion + ## registry: ghcr.io - # -- The repository within the registry repository: spiffe/oidc-discovery-provider - # -- The image pull policy pullPolicy: IfNotPresent - # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" - # -- Overrides the image tag whose default is the chart appVersion tag: "" +## @param resources [object] Resource requests and limits resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little @@ -39,19 +44,25 @@ resources: {} # cpu: 100m # memory: 64Mi +## @param service.type Service type +## @param service.port Service port +## @param service.annotations Annotations for service resource +## service: type: ClusterIP port: 80 annotations: {} - # external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org + # external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org configMap: - # -- Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap + ## @param configMap.annotations [object] Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap annotations: {} +## @param podSecurityContext [object] Pod security context for OIDC discovery provider pods podSecurityContext: {} # fsGroup: 2000 +## @param securityContext [object] Security context for OIDC discovery provider deployment securityContext: {} # capabilities: # drop: @@ -60,41 +71,48 @@ securityContext: {} # runAsNonRoot: true # runAsUser: 1000 +## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe +## @param readinessProbe.periodSeconds Period seconds for readinessProbe +## readinessProbe: - # -- Initial delay seconds for readinessProbe initialDelaySeconds: 5 - # -- Period seconds for readinessProbe periodSeconds: 5 +## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe +## @param livenessProbe.periodSeconds Period seconds for livenessProbe +## livenessProbe: - # -- Initial delay seconds for livenessProbe initialDelaySeconds: 5 - # -- Period seconds for livenessProbe periodSeconds: 5 +## @param podAnnotations [object] Pod annotations for Spire OIDC discovery provider podAnnotations: {} insecureScheme: + ## @param insecureScheme.enabled Flag to enable insecure schema enabled: false nginx: + ## @param insecureScheme.nginx.image.registry The OCI registry to pull the image from + ## @param insecureScheme.nginx.image.repository The repository within the registry + ## @param insecureScheme.nginx.image.pullPolicy The image pull policy + ## @param insecureScheme.nginx.image.version This value is deprecated in favor of tag. (Will be removed in a future release) + ## @param insecureScheme.nginx.image.tag Overrides the image tag whose default is the chart appVersion + ## Example: + ## chainguard image does not support the templates feature + ## https://github.com/chainguard-images/nginx/issues/43 + ## registry: cgr.dev + ## repository: chainguard/nginx + ## pullPolicy: IfNotPresent + ## tag: "1.23.2" + ## image: - # -- The OCI registry to pull the image from registry: docker.io - # -- The repository within the registry repository: nginxinc/nginx-unprivileged - # -- The image pull policy pullPolicy: IfNotPresent - # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" - # -- Overrides the image tag tag: 1.24.0-alpine - # chainguard image does not support the templates feature - # https://github.com/chainguard-images/nginx/issues/43 - # registry: cgr.dev - # repository: chainguard/nginx - # pullPolicy: IfNotPresent - # tag: "1.23.2" + ## @param insecureScheme.nginx.resources Resource requests and limits resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little @@ -107,38 +125,54 @@ insecureScheme: # cpu: 100m # memory: 64Mi +## @param jwtIssuer Path to JWT issuer jwtIssuer: https://oidc-discovery.example.org config: - # -- The log level, valid values are "debug", "info", "warn", and "error" + ## @param config.logLevel The log level, valid values are "debug", "info", "warn", and "error" logLevel: info - # -- Add additional domains that can be used for oidc discovery + ## @param config.additionalDomains [array] Add additional domains that can be used for oidc discovery additionalDomains: - localhost acme: + ## @param config.acme.tosAccepted Flag for Terms of Service acceptance tosAccepted: false + ## @param config.acme.cacheDir Path for cache directory cacheDir: /run/spire + ## @param config.acme.directoryUrl URL for acme directory directoryUrl: https://acme-v02.api.letsencrypt.org/directory + ## @param config.acme.emailAddress Email address for registration emailAddress: letsencrypt@example.org +## @param imagePullSecrets [array] Image pull secret names imagePullSecrets: [] + +## @param nameOverride Name override nameOverride: "" + +## @param fullnameOverride Full name override fullnameOverride: "" +## @param serviceAccount.create Specifies whether a service account should be created +## @param serviceAccount.annotations Annotations to add to the service account +## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated. +## serviceAccount: - # -- Specifies whether a service account should be created create: true - # -- Annotations to add to the service account annotations: {} - # -- The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template name: "" deleteHook: - # -- Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) + ## @param deleteHook.enabled Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) enabled: true +## @param autoscaling.enabled Flag to enable autoscaling +## @param autoscaling.minReplicas Minimum replicas for autoscaling +## @param autoscaling.maxReplicas Maximum replicas for autoscaling +## @param autoscaling.targetCPUUtilizationPercentage Target CPU utlization that triggers autoscaling +## @param autoscaling.targetMemoryUtilizationPercentage Target Memory utlization that triggers autoscaling +## autoscaling: enabled: false minReplicas: 1 @@ -146,40 +180,50 @@ autoscaling: targetCPUUtilizationPercentage: 80 targetMemoryUtilizationPercentage: 80 +## @param nodeSelector [object] Node selector nodeSelector: {} +## @param tolerations [array] iist of tolerations tolerations: [] +## @param affinity [object] Node affinity affinity: {} -# -- Set the trust domain to be used for the SPIFFE identifiers +## @param trustDomain Set the trust domain to be used for the SPIFFE identifiers trustDomain: example.org -# -- The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) + +## @param clusterDomain The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) clusterDomain: cluster.local telemetry: prometheus: + ## @param telemetry.prometheus.enabled Flag to enable prometheus monitoring enabled: false + ## @param telemetry.prometheus.port Port for prometheus metrics port: 9988 podMonitor: + ## @param telemetry.prometheus.podMonitor.enabled Enable podMonitor for prometheus enabled: false - # -- Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider + ## @param telemetry.prometheus.podMonitor.namespace Override where to install the podMonitor, if not set will use the same namespace as the helm release namespace: "" + ## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring labels: {} nginxExporter: + ## @param telemetry.prometheus.nginxExporter.image.registry The OCI registry to pull the image from + ## @param telemetry.prometheus.nginxExporter.image.repository The repository within the registry + ## @param telemetry.prometheus.nginxExporter.image.pullPolicy The image pull policy + ## @param telemetry.prometheus.nginxExporter.image.version This value is deprecated in favor of tag. (Will be removed in a future release) + ## @param telemetry.prometheus.nginxExporter.image.tag Overrides the image tag whose default is the chart appVersion + ## image: - # -- The OCI registry to pull the image from registry: docker.io - # -- The repository within the registry repository: nginx/nginx-prometheus-exporter - # -- The image pull policy pullPolicy: IfNotPresent - # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" - # -- Overrides the image tag tag: "0.11.0" + ## @param telemetry.prometheus.nginxExporter.resources [object] Resource requests and limits resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little @@ -193,48 +237,104 @@ telemetry: # memory: 64Mi ingress: + ## @param ingress.enabled Flag to enable ingress enabled: false + ## @param ingress.className Ingress class name className: "" + ## @param ingress.annotations [object] Annotations for ingress object annotations: {} # kubernetes.io/ingress.class: nginx # kubernetes.io/tls-acme: "true" # nginx.ingress.kubernetes.io/ssl-redirect: "true" # nginx.ingress.kubernetes.io/force-ssl-redirect: "true" + + ## @param ingress.hosts [array] Host paths for ingress object hosts: - host: oidc-discovery.example.org paths: - path: / pathType: Prefix + ## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress tls: [] # - secretName: chart-example-tls # hosts: # - oidc-discovery.example.org -# @ignored tests: + ## @param tests.hostAliases [array] List of host aliases for testing + hostAliases: [] + tls: + ## @param tests.tls.enabled Flag for enabling tls for tests + enabled: false + ## @param tests.tls.customCA Custom CA value for tests + customCA: "" bash: + ## @param tests.bash.image.registry The OCI registry to pull the image from + ## @param tests.bash.image.repository The repository within the registry + ## @param tests.bash.image.pullPolicy The image pull policy + ## @param tests.bash.image.version This value is deprecated in favor of tag. (Will be removed in a future release) + ## @param tests.bash.image.tag Overrides the image tag whose default is the chart appVersion + ## image: - # -- The OCI registry to pull the tests image from registry: cgr.dev - # -- The repository within the registry repository: chainguard/bash - # -- The tests image pull policy pullPolicy: IfNotPresent - # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" - # -- Overrides the image tag tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4 + toolkit: + ## @param tests.toolkit.image.registry The OCI registry to pull the image from + ## @param tests.toolkit.image.repository The repository within the registry + ## @param tests.toolkit.image.pullPolicy The image pull policy + ## @param tests.toolkit.image.version This value is deprecated in favor of tag. (Will be removed in a future release) + ## @param tests.toolkit.image.tag Overrides the image tag whose default is the chart appVersion + ## + image: + registry: cgr.dev + repository: chainguard/slim-toolkit-debug + pullPolicy: IfNotPresent + version: "" + tag: latest@sha256:d717d0a2c88518f8e36d9cfe1571639a40617e8c4291e34876d46bdeefb1ab5a + + busybox: + ## @param tests.busybox.image.registry The OCI registry to pull the image from + ## @param tests.busybox.image.repository The repository within the registry + ## @param tests.busybox.image.pullPolicy The image pull policy + ## @param tests.busybox.image.version This value is deprecated in favor of tag. (Will be removed in a future release) + ## @param tests.busybox.image.tag Overrides the image tag whose default is the chart appVersion + ## + image: + registry: "" + repository: busybox + pullPolicy: IfNotPresent + version: "" + tag: uclibc@sha256:3e516f71d8801b0ce6c3f8f8e4f11093ec04e168177a90f1da4498014ee06b6b + + agent: + ## @param tests.agent.image.registry The OCI registry to pull the image from + ## @param tests.agent.image.repository The repository within the registry + ## @param tests.agent.image.pullPolicy The image pull policy + ## @param tests.agent.image.version This value is deprecated in favor of tag. (Will be removed in a future release) + ## @param tests.agent.image.tag Overrides the image tag whose default is the chart appVersion + ## + image: + registry: ghcr.io + repository: spiffe/spire-agent + pullPolicy: IfNotPresent + version: "" + tag: "" + tools: kubectl: + ## @param tools.kubectl.image.registry The OCI registry to pull the image from + ## @param tools.kubectl.image.repository The repository within the registry + ## @param tools.kubectl.image.pullPolicy The image pull policy + ## @param tools.kubectl.image.version This value is deprecated in favor of tag. (Will be removed in a future release) + ## @param tools.kubectl.image.tag Overrides the image tag whose default is the chart appVersion + ## image: - # -- The OCI registry to pull the image from registry: docker.io - # -- The repository within the registry repository: rancher/kubectl - # -- The image pull policy pullPolicy: IfNotPresent - # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" - # -- Overrides the image tag tag: "" diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 136f09f..9f339bc 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -25,68 +25,74 @@ A Helm chart to install the SPIRE agent. * -## Values +## Parameters -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| bundleConfigMap | string | `"spire-bundle"` | | -| clusterName | string | `"example-cluster"` | | -| configMap.annotations | object | `{}` | Annotations to add to the SPIRE Agent ConfigMap | -| extraContainers | list | `[]` | | -| extraVolumeMounts | list | `[]` | | -| extraVolumes | list | `[]` | | -| fsGroupFix.image.pullPolicy | string | `"Always"` | The image pull policy | -| fsGroupFix.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from | -| fsGroupFix.image.repository | string | `"chainguard/bash"` | The repository within the registry | -| fsGroupFix.image.tag | string | `"latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4"` | Overrides the image tag | -| fsGroupFix.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| fsGroupFix.resources | object | `{}` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | -| fullnameOverride | string | `""` | | -| healthChecks.port | int | `9980` | override the host port used for health checking | -| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | -| image.repository | string | `"spiffe/spire-agent"` | The repository within the registry | -| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. | -| image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| imagePullSecrets | list | `[]` | | -| initContainers | list | `[]` | | -| livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe | -| livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe | -| logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" | -| nameOverride | string | `""` | | -| namespaceOverride | string | `""` | | -| nodeSelector | object | `{}` | | -| podAnnotations | object | `{}` | | -| podSecurityContext | object | `{}` | | -| priorityClassName | string | `""` | Priority class assigned to daemonset pods | -| readinessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for readinessProbe | -| readinessProbe.periodSeconds | int | `60` | Period seconds for readinessProbe | -| resources | object | `{}` | | -| securityContext | object | `{}` | | -| server.address | string | `""` | | -| server.namespaceOverride | string | `""` | | -| server.port | int | `8081` | | -| serviceAccount.annotations | object | `{}` | Annotations to add to the service account | -| serviceAccount.create | bool | `true` | Specifies whether a service account should be created | -| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | -| socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent | -| telemetry.prometheus.enabled | bool | `false` | | -| telemetry.prometheus.podMonitor.enabled | bool | `false` | | -| telemetry.prometheus.podMonitor.labels | object | `{}` | | -| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | -| telemetry.prometheus.port | int | `9988` | | -| tolerations | list | `[]` | | -| trustBundleFormat | string | `"pem"` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | -| trustBundleURL | string | `""` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | -| trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers | -| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from | -| waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry | -| waitForIt.image.tag | string | `"latest@sha256:deeaccb164a67a4d7f585c4d416641b1f422c029911a29d72beae28221f823df"` | Overrides the image tag | -| waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| waitForIt.resources | object | `{}` | | -| workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio | -| workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped | -| workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor | +### Chart parameters ----------------------------------------------- +| Name | Description | Value | +| ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/spire-agent` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `imagePullSecrets` | Pull secrets for images | `[]` | +| `nameOverride` | Name override | `""` | +| `namespaceOverride` | Namespace override | `""` | +| `fullnameOverride` | Fullname override | `""` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. | `""` | +| `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` | +| `podAnnotations` | Annotations to add to pods | `{}` | +| `podSecurityContext` | Pod security context | `{}` | +| `securityContext` | Security context | `{}` | +| `resources` | Resource requests and limits | `{}` | +| `nodeSelector` | Node selector | `{}` | +| `tolerations` | List of tolerations | `[]` | +| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | +| `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` | +| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` | +| `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` | +| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `pem` | +| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` | +| `server.address` | Address for Spire server | `""` | +| `server.port` | Port number for Spire server | `8081` | +| `server.namespaceOverride` | Override the namespace for Spire server | `""` | +| `healthChecks.port` | override the host port used for health checking | `9980` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | +| `livenessProbe.periodSeconds` | Period seconds for probe | `60` | +| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | +| `readinessProbe.periodSeconds` | Period seconds for probe | `60` | +| `waitForIt.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` | +| `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `waitForIt.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:deeaccb164a67a4d7f585c4d416641b1f422c029911a29d72beae28221f823df` | +| `waitForIt.resources` | Resource requests and limits | `{}` | +| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | +| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | +| `fsGroupFix.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` | +| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | +| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | +| `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` | +| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` | +| `sds.enabled` | Enables Envoy SDS configuration | `false` | +| `sds.defaultSvidName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` | +| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` | +| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` | +| `sds.disableSpiffeCertValidation` | Disable Envoy SDS custom validation | `false` | +| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | +| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | +| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | +| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` | +| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | +| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | +| `priorityClassName` | Priority class assigned to daemonset pods | `""` | +| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | +| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` | +| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` | +| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` | +| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 9adfcc7..b1662e4 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -12,6 +12,13 @@ agent: trust_bundle_path: "/run/spire/bundle/bundle.crt" {{- end }} trust_domain: {{ include "spire-lib.trust-domain" . | quote }} + {{- if .Values.sds.enabled }} + sds: + default_svid_name: {{ .Values.sds.defaultSvidName | quote }} + default_bundle_name: {{ .Values.sds.defaultBundleName | quote }} + default_all_bundles_name: {{ .Values.sds.defaultAllBundlesName | quote }} + disable_spiffe_cert_validation: {{ .Values.sds.disableSpiffeCertValidation }} + {{- end }} plugins: NodeAttestor: diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index f1687e6..c463212 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -33,6 +33,10 @@ spec: {{- if .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }} {{- end }} + {{- if ne (len .Values.hostAliases) 0 }} + hostAliases: + {{- toYaml .Values.hostAliases | nindent 8 }} + {{- end }} initContainers: - name: init # This is a small image with wait-for-it, choose whatever image diff --git a/charts/spire/charts/spire-agent/templates/podmonitor.yaml b/charts/spire/charts/spire-agent/templates/podmonitor.yaml index 92fd0e3..409bfb3 100644 --- a/charts/spire/charts/spire-agent/templates/podmonitor.yaml +++ b/charts/spire/charts/spire-agent/templates/podmonitor.yaml @@ -1,13 +1,13 @@ {{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }} -{{- $namespace := include "spiffe-oidc-discovery-provider.podMonitor.namespace" . }} -{{- $podNamespace := ( include "spiffe-oidc-discovery-provider.namespace" . ) }} +{{- $namespace := include "spire-agent.podMonitor.namespace" . }} +{{- $podNamespace := ( include "spire-agent.namespace" . ) }} apiVersion: monitoring.coreos.com/v1 kind: PodMonitor metadata: - name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} + name: {{ include "spire-agent.fullname" . }} namespace: {{ $namespace }} labels: - {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} + {{- include "spire-agent.labels" . | nindent 4 }} {{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }} {{- .Values.global.telemetry.prometheus.podMonitor.labels | toYaml | nindent 4 }} {{- end }} @@ -17,7 +17,7 @@ metadata: spec: selector: matchLabels: - {{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 6 }} + {{- include "spire-agent.selectorLabels" . | nindent 6 }} podMetricsEndpoints: - port: prom {{- if ne $namespace $podNamespace }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index a444759..631ff30 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -1,45 +1,57 @@ -# Default values for spire-agent. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. +# Default configuration for Spire Agent +# SPDX-License-Identifier: APACHE-2.0 -# @ignored +## @skip global global: {} +## @section Chart parameters +## +## @param image.registry The OCI registry to pull the image from +## @param image.repository The repository within the registry +## @param image.pullPolicy The image pull policy +## @param image.version This value is deprecated in favor of tag. (Will be removed in a future release) +## @param image.tag Overrides the image tag whose default is the chart appVersion +## image: - # -- The OCI registry to pull the image from registry: ghcr.io - # -- The repository within the registry repository: spiffe/spire-agent - # -- The image pull policy pullPolicy: IfNotPresent - # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" - # -- Overrides the image tag whose default is the chart appVersion. tag: "" +## @param imagePullSecrets [array] Pull secrets for images imagePullSecrets: [] + +## @param nameOverride Name override nameOverride: "" + +## @param namespaceOverride Namespace override namespaceOverride: "" + +## @param fullnameOverride Fullname override fullnameOverride: "" serviceAccount: - # -- Specifies whether a service account should be created + ## @param serviceAccount.create Specifies whether a service account should be created create: true - # -- Annotations to add to the service account + ## @param serviceAccount.annotations [object] Annotations to add to the service account annotations: {} - # -- The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template + ## @param serviceAccount.name The name of the service account to use. + ## If not set and create is true, a name is generated using the fullname template name: "" configMap: - # -- Annotations to add to the SPIRE Agent ConfigMap + ## @param configMap.annotations [object] Annotations to add to the SPIRE Agent ConfigMap annotations: {} +## @param podAnnotations [object] Annotations to add to pods podAnnotations: {} +## @param podSecurityContext [object] Pod security context podSecurityContext: {} # fsGroup: 2000 +## @param securityContext [object] Security context securityContext: {} # capabilities: # drop: @@ -48,6 +60,7 @@ securityContext: {} # runAsNonRoot: true # runAsUser: 1000 +## @param resources [object] Resource requests and limits resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little @@ -60,107 +73,145 @@ resources: {} # cpu: 100m # memory: 128Mi +## @param nodeSelector [object] Node selector nodeSelector: {} +## @param tolerations [array] List of tolerations tolerations: [] -# -- The log level, valid values are "debug", "info", "warn", and "error" +## @param logLevel The log level, valid values are "debug", "info", "warn", and "error" logLevel: info -# -- The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) +## @param clusterName The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) clusterName: example-cluster -# -- The trust domain to be used for the SPIFFE identifiers +## @param trustDomain The trust domain to be used for the SPIFFE identifiers trustDomain: example.org -# -- If set, obtain trust bundle from url instead of Kubernetes ConfigMap +## @param trustBundleURL If set, obtain trust bundle from url instead of Kubernetes ConfigMap trustBundleURL: "" -# -- If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" +## @param trustBundleFormat If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" trustBundleFormat: pem +## @param bundleConfigMap Configmap name for Spire bundle bundleConfigMap: spire-bundle -# @ignored +## @skip upstream upstream: false +## @param server.address Address for Spire server +## @param server.port Port number for Spire server +## @param server.namespaceOverride Override the namespace for Spire server +## server: address: "" port: 8081 namespaceOverride: "" healthChecks: - # -- override the host port used for health checking + ## @param healthChecks.port override the host port used for health checking port: 9980 +## @param livenessProbe.initialDelaySeconds Initial delay seconds for probe +## @param livenessProbe.periodSeconds Period seconds for probe +## livenessProbe: - # -- Initial delay seconds for livenessProbe initialDelaySeconds: 15 - # -- Period seconds for livenessProbe periodSeconds: 60 +## @param readinessProbe.initialDelaySeconds Initial delay seconds for probe +## @param readinessProbe.periodSeconds Period seconds for probe +## readinessProbe: - # -- Initial delay seconds for readinessProbe initialDelaySeconds: 15 - # -- Period seconds for readinessProbe periodSeconds: 60 waitForIt: + ## @param waitForIt.image.registry The OCI registry to pull the image from + ## @param waitForIt.image.repository The repository within the registry + ## @param waitForIt.image.pullPolicy The image pull policy + ## @param waitForIt.image.version This value is deprecated in favor of tag. (Will be removed in a future release) + ## @param waitForIt.image.tag Overrides the image tag whose default is the chart appVersion + ## image: - # -- The OCI registry to pull the image from registry: cgr.dev - # -- The repository within the registry repository: chainguard/wait-for-it - # -- The image pull policy pullPolicy: IfNotPresent - # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" - # -- Overrides the image tag tag: latest@sha256:deeaccb164a67a4d7f585c4d416641b1f422c029911a29d72beae28221f823df + + ## @param waitForIt.resources [object] Resource requests and limits resources: {} # When running as non root, needed to ensure the socket path has the correct permissions. # Set runAsUser to a non-zero value in podSecurityContext to run as non-root user. fsGroupFix: + ## @param fsGroupFix.image.registry The OCI registry to pull the image from + ## @param fsGroupFix.image.repository The repository within the registry + ## @param fsGroupFix.image.pullPolicy The image pull policy + ## @param fsGroupFix.image.version This value is deprecated in favor of tag. (Will be removed in a future release) + ## @param fsGroupFix.image.tag Overrides the image tag whose default is the chart appVersion + ## image: - # -- The OCI registry to pull the image from registry: cgr.dev - # -- The repository within the registry repository: chainguard/bash - # -- The image pull policy pullPolicy: Always - # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" - # -- Overrides the image tag tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4 - # -- Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + + ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} # workloadAttestors determine a workload's properties and then generate a set of selectors associated with it. workloadAttestors: # unix is a workload attestor which generates unix-based selectors like 'uid' and 'gid'. unix: - # -- enables the Unix workload attestor + ## @param workloadAttestors.unix.enabled Enables the Unix workload attestor enabled: false k8s: - # -- If true, kubelet certificate verification is skipped + ## @param workloadAttestors.k8s.skipKubeletVerification If true, kubelet certificate verification is skipped skipKubeletVerification: true - # -- Set to true if using holdApplicationUntilProxyStarts in Istio + ## @param workloadAttestors.k8s.disableContainerSelectors Set to true if using holdApplicationUntilProxyStarts in Istio disableContainerSelectors: false +sds: + ## @param sds.enabled Enables Envoy SDS configuration + enabled: false + ## @param sds.defaultSvidName The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS + defaultSvidName: "default" + ## @param sds.defaultBundleName The Validation Context resource name to use for the default X.509 bundle with Envoy SDS + defaultBundleName: "ROOTCA" + ## @param sds.defaultAllBundlesName The Validation Context resource name to use for all bundles (including federated) with Envoy SDS + defaultAllBundlesName: "ALL" + ## @param sds.disableSpiffeCertValidation Disable Envoy SDS custom validation + disableSpiffeCertValidation: false + telemetry: prometheus: + ## @param telemetry.prometheus.enabled Flag to enable prometheus monitoring enabled: false + ## @param telemetry.prometheus.port Port for prometheus metrics port: 9988 podMonitor: + ## @param telemetry.prometheus.podMonitor.enabled Enable podMonitor for prometheus enabled: false - # -- Override where to install the podMonitor, if not set will use the same namespace as the spire-agent + ## @param telemetry.prometheus.podMonitor.namespace Override where to install the podMonitor, if not set will use the same namespace as the spire-agent namespace: "" + ## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring labels: {} -# -- The unix socket path to the spire-agent +## @param socketPath The unix socket path to the spire-agent socketPath: /run/spire/agent-sockets/spire-agent.sock -# -- Priority class assigned to daemonset pods +## @param priorityClassName Priority class assigned to daemonset pods priorityClassName: "" +## @param extraVolumes [array] Extra volumes to be mounted on Spire Agent pods extraVolumes: [] + +## @param extraVolumeMounts [array] Extra volume mounts for Spire Agent pods extraVolumeMounts: [] + +## @param extraContainers [array] Additional containers to create with Spire Agent pods extraContainers: [] +## @param initContainers [array] Additional init containers to create with Spire Agent pods initContainers: [] +## @param hostAliases [array] Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ +hostAliases: [] diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 84fc6ef..9222c7a 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -81,184 +81,209 @@ curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhos In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above. -## Values +## Parameters -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| affinity | object | `{}` | | -| autoscaling.enabled | bool | `false` | | -| autoscaling.maxReplicas | int | `100` | | -| autoscaling.minReplicas | int | `1` | | -| autoscaling.targetCPUUtilizationPercentage | int | `80` | | -| bundleConfigMap | string | `"spire-bundle"` | | -| caKeyType | string | `"rsa-2048"` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) | -| caTTL | string | `"24h"` | | -| ca_subject.common_name | string | `"example.org"` | | -| ca_subject.country | string | `"NL"` | | -| ca_subject.organization | string | `"Example"` | | -| clusterDomain | string | `"cluster.local"` | | -| clusterName | string | `"example-cluster"` | | -| configMap.annotations | object | `{}` | Annotations to add to the SPIRE Server ConfigMap | -| controllerManager.configMap.annotations | object | `{}` | Annotations to add to the Controller Manager ConfigMap | -| controllerManager.deleteHook.enabled | bool | `true` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | -| controllerManager.enabled | bool | `false` | | -| controllerManager.identities.dnsNameTemplates | list | `[]` | | -| controllerManager.identities.enabled | bool | `true` | | -| controllerManager.identities.federatesWith | list | `[]` | | -| controllerManager.identities.namespaceSelector | object | `{}` | | -| controllerManager.identities.podSelector | object | `{}` | | -| controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | | -| controllerManager.ignoreNamespaces[0] | string | `"kube-system"` | | -| controllerManager.ignoreNamespaces[1] | string | `"kube-public"` | | -| controllerManager.ignoreNamespaces[2] | string | `"local-path-storage"` | | -| controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | -| controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry | -| controllerManager.image.tag | string | `"0.2.3"` | Overrides the image tag | -| controllerManager.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| controllerManager.installAndUpgradeHook.enabled | bool | `true` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | -| controllerManager.resources | object | `{}` | | -| controllerManager.securityContext | object | `{}` | | -| controllerManager.service.annotations | object | `{}` | | -| controllerManager.service.port | int | `443` | | -| controllerManager.service.type | string | `"ClusterIP"` | | -| controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | | -| dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" | -| dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" | -| dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" | -| dataStore.sql.options | list | `[]` | Only used by "postgres" or "mysql" | -| dataStore.sql.password | string | `""` | Only used by "postgres" or "mysql" | -| dataStore.sql.plugin_data | object | `{}` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section | -| dataStore.sql.port | int | `0` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | -| dataStore.sql.username | string | `"spire"` | Only used by "postgres" or "mysql" | -| defaultJwtSvidTTL | string | `"1h"` | | -| defaultX509SvidTTL | string | `"4h"` | | -| extraContainers | list | `[]` | | -| extraVolumeMounts | list | `[]` | | -| extraVolumes | list | `[]` | | -| federation.bundleEndpoint.address | string | `"0.0.0.0"` | | -| federation.bundleEndpoint.port | int | `8443` | | -| federation.enabled | bool | `false` | | -| federation.ingress.annotations | object | `{}` | | -| federation.ingress.className | string | `""` | | -| federation.ingress.enabled | bool | `false` | | -| federation.ingress.hosts[0].host | string | `"spire-server-federation.example.org"` | | -| federation.ingress.hosts[0].paths[0].path | string | `"/"` | | -| federation.ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | | -| federation.ingress.tls | list | `[]` | | -| fullnameOverride | string | `""` | | -| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | -| image.repository | string | `"spiffe/spire-server"` | The repository within the registry | -| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. | -| image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| imagePullSecrets | list | `[]` | | -| ingress.annotations | object | `{}` | | -| ingress.className | string | `""` | | -| ingress.enabled | bool | `false` | | -| ingress.hosts[0].host | string | `"spire-server.example.org"` | | -| ingress.hosts[0].paths[0].path | string | `"/"` | | -| ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | | -| ingress.tls | list | `[]` | | -| initContainers | list | `[]` | | -| jwtIssuer | string | `"https://oidc-discovery.example.org"` | The JWT issuer domain | -| keyManager.awsKMS.accessKeyID | Optional | `""` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. | -| keyManager.awsKMS.enabled | bool | `false` | | -| keyManager.awsKMS.keyPolicy | object | `{"existingConfigMap":"","policy":""}` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | -| keyManager.awsKMS.keyPolicy.existingConfigMap | Optional | `""` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | -| keyManager.awsKMS.keyPolicy.policy | Optional | `""` | Key policy in JSON format. | -| keyManager.awsKMS.region | string | `""` | | -| keyManager.awsKMS.secretAccessKey | Optional | `""` | Secret access key for the AWS account. | -| keyManager.disk.enabled | bool | `true` | | -| keyManager.memory.enabled | bool | `false` | | -| livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe | -| livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe | -| livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe | -| livenessProbe.timeoutSeconds | int | `3` | Timeout in seconds for livenessProbe | -| logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" | -| nameOverride | string | `""` | | -| namespaceOverride | string | `""` | | -| nodeAttestor.k8sPsat.enabled | bool | `true` | | -| nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` | | -| nodeSelector | object | `{}` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | -| notifier.k8sbundle.namespace | string | `""` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | -| persistence.accessMode | string | `"ReadWriteOnce"` | | -| persistence.hostPath | string | `""` | Which path to use on the host when type = hostPath | -| persistence.size | string | `"1Gi"` | | -| persistence.storageClass | string | `nil` | | -| persistence.type | string | `"pvc"` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | -| podAnnotations | object | `{}` | | -| podSecurityContext | object | `{}` | | -| readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe | -| readinessProbe.periodSeconds | int | `5` | Period seconds for readinessProbe | -| replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | -| resources | object | `{}` | | -| securityContext | object | `{}` | | -| service.annotations | object | `{}` | | -| service.port | int | `8081` | | -| service.type | string | `"ClusterIP"` | | -| serviceAccount.annotations | object | `{}` | Annotations to add to the service account | -| serviceAccount.create | bool | `true` | Specifies whether a service account should be created | -| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | -| telemetry.prometheus.enabled | bool | `false` | | -| telemetry.prometheus.podMonitor.enabled | bool | `false` | | -| telemetry.prometheus.podMonitor.labels | object | `{}` | | -| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server | -| tolerations | list | `[]` | | -| tools.kubectl.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | -| tools.kubectl.image.registry | string | `"docker.io"` | The OCI registry to pull the image from | -| tools.kubectl.image.repository | string | `"rancher/kubectl"` | The repository within the registry | -| tools.kubectl.image.tag | string | `""` | Overrides the image tag | -| tools.kubectl.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| topologySpreadConstraints | list | `[]` | | -| tornjak.config.clientCA.name | string | `"tornjak-client-ca"` | | -| tornjak.config.clientCA.type | string | `"Secret"` | Type of delivery for the user CA for mTLS client verification options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | -| tornjak.config.dataStore | object | `{"driver":"sqlite3","file":"/run/spire/data/tornjak.sqlite3"}` | Persistent DB for storing Tornjak specific information | -| tornjak.config.tlsSecret | string | `"tornjak-tls-secret"` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | -| tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) (Not for production) | -| tornjak.image.pullPolicy | string | `"IfNotPresent"` | The Tornjak image pull policy | -| tornjak.image.registry | string | `"ghcr.io"` | The OCI registry to pull the Tornjak image from | -| tornjak.image.repository | string | `"spiffe/tornjak-backend"` | The repository within the registry | -| tornjak.image.tag | string | `"v1.2.2"` | Overrides the image tag | -| tornjak.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| tornjak.resources | object | `{}` | | -| tornjak.service.annotations | object | `{}` | | -| tornjak.service.ports | object | `{"http":10000,"https":10443}` | Ports for tornjak | -| tornjak.service.type | string | `"ClusterIP"` | | -| tornjak.startupProbe.failureThreshold | int | `3` | | -| tornjak.startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for | -| tornjak.startupProbe.periodSeconds | int | `10` | | -| tornjak.startupProbe.successThreshold | int | `1` | | -| tornjak.startupProbe.timeoutSeconds | int | `5` | | -| trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers | -| upstreamAuthority.awsPCA.assumeRoleARN | Optional | `""` | ARN of an IAM role to assume | -| upstreamAuthority.awsPCA.caSigningTemplateARN | string | `""` | See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. | -| upstreamAuthority.awsPCA.certificateAuthorityARN | string | `""` | ARN of the "upstream" CA certificate | -| upstreamAuthority.awsPCA.enabled | bool | `false` | | -| upstreamAuthority.awsPCA.endpoint | string | `""` | See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | -| upstreamAuthority.awsPCA.region | string | `""` | AWS Region to use | -| upstreamAuthority.awsPCA.signingAlgorithm | string | `""` | See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | -| upstreamAuthority.awsPCA.supplementalBundlePath | Optional | `""` | Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | -| upstreamAuthority.certManager.ca.create | bool | `false` | Creates a Cert-Manager CA | -| upstreamAuthority.certManager.ca.duration | string | `"87600h"` | Duration of the CA. Defaults to 10 years. | -| upstreamAuthority.certManager.ca.privateKey.algorithm | string | `"ECDSA"` | | -| upstreamAuthority.certManager.ca.privateKey.rotationPolicy | string | `""` | | -| upstreamAuthority.certManager.ca.privateKey.size | int | `256` | | -| upstreamAuthority.certManager.ca.renewBefore | string | `""` | How long to wait before renewing the CA | -| upstreamAuthority.certManager.enabled | bool | `false` | | -| upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` | | -| upstreamAuthority.certManager.issuer_kind | string | `"Issuer"` | | -| upstreamAuthority.certManager.issuer_name | string | `""` | Defaults to the release name, override if CA is provided outside of the chart | -| upstreamAuthority.certManager.kube_config_file | string | `""` | | -| upstreamAuthority.certManager.namespace | string | `""` | Specify to use a namespace other then the one the chart is installed into | -| upstreamAuthority.certManager.rbac.create | bool | `true` | | -| upstreamAuthority.disk.enabled | bool | `false` | | -| upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | -| upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info | -| upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. | -| upstreamAuthority.spire.enabled | bool | `false` | | -| upstreamAuthority.spire.server.address | string | `""` | | -| upstreamAuthority.spire.server.port | int | `8081` | | -| upstreamAuthority.spire.upstreamDriver | string | `""` | | +### Chart parameters ----------------------------------------------- +| Name | Description | Value | +| ---------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | +| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/spire-server` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `imagePullSecrets` | Pull secrets for images | `[]` | +| `nameOverride` | Name override | `""` | +| `namespaceOverride` | Namespace override | `""` | +| `fullnameOverride` | Fullname override | `""` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | +| `podAnnotations` | Annotations to add to pods | `{}` | +| `podSecurityContext` | Pod security context | `{}` | +| `securityContext` | Security context | `{}` | +| `priorityClassName` | Priority class assigned to statefulset pods | `""` | +| `service.type` | Type of the Spire server service created | `ClusterIP` | +| `service.port` | Port for the created service | `8081` | +| `service.annotations` | Annotations to add to the service object | `{}` | +| `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` | +| `resources` | Resource requests and limits | `{}` | +| `autoscaling.enabled` | Flag to enable autoscaling | `false` | +| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` | +| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` | +| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` | +| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` | +| `tolerations` | List of tolerations | `[]` | +| `affinity` | List of node affinities | `{}` | +| `topologySpreadConstraints` | Topology spread constraints for resilience | `[]` | +| `livenessProbe.failureThreshold` | Failure threshold count for livenessProbe | `2` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `15` | +| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `60` | +| `livenessProbe.timeoutSeconds` | Timeout in seconds for livenessProbe | `3` | +| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `persistence.type` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `pvc` | +| `persistence.size` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `1Gi` | +| `persistence.accessMode` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `ReadWriteOnce` | +| `persistence.storageClass` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `nil` | +| `persistence.hostPath` | Which path to use on the host when type = hostPath | `""` | +| `dataStore.sql.databaseType` | Other supported databases are "postgres" and "mysql" | `sqlite3` | +| `dataStore.sql.databaseName` | Only used by "postgres" or "mysql" | `spire` | +| `dataStore.sql.host` | Only used by "postgres" or "mysql" | `""` | +| `dataStore.sql.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` | +| `dataStore.sql.username` | Only used by "postgres" or "mysql" | `spire` | +| `dataStore.sql.password` | Only used by "postgres" or "mysql" | `""` | +| `dataStore.sql.options` | Only used by "postgres" or "mysql" | `[]` | +| `dataStore.sql.plugin_data` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section | `{}` | +| `dataStore.sql.externalSecret.enabled` | Enable external secret for datastore creds | `false` | +| `dataStore.sql.externalSecret.name` | The name of the secret object | `""` | +| `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` | +| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | +| `jwtIssuer` | The JWT issuer domain | `https://oidc-discovery.example.org` | +| `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` | +| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | +| `bundleConfigMap` | Set the trust domain to be used for the SPIFFE identifiers | `spire-bundle` | +| `clusterDomain` | This is the value of your clusters `kubeadm init --service-dns-domain` flag | `cluster.local` | +| `federation.enabled` | Flag to enable federation | `false` | +| `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` | +| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` | +| `federation.ingress.enabled` | Flag to enable ingress for federation | `false` | +| `federation.ingress.className` | Ingress class name for federation | `""` | +| `federation.ingress.annotations` | Annotations for the ingress object | `{}` | +| `federation.ingress.hosts` | Host paths for ingress object | `[]` | +| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` | +| `ca_subject.country` | Country for Spire server CA | `NL` | +| `ca_subject.organization` | Organization for Spire server CA | `Example` | +| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` | +| `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` | +| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` | +| `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` | +| `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` | +| `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | | +| `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` | +| `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` | +| `keyManager.awsKMS.accessKeyID` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. | `""` | +| `keyManager.awsKMS.secretAccessKey` | Secret access key for the AWS account. | `""` | +| `upstreamAuthority.disk.enabled` | Flag to enable upstream authority plugin on disk | `false` | +| `upstreamAuthority.disk.secret.create` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | `true` | +| `upstreamAuthority.disk.secret.name` | If secret creation is disabled, the secret with this name will be used. | `spiffe-upstream-ca` | +| `upstreamAuthority.disk.secret.data` | If secret creation is enabled, will create a secret with following certificate info | | +| `upstreamAuthority.disk.secret.data.certificate` | Certificate to store within disk upstreamAuthority. | `""` | +| `upstreamAuthority.disk.secret.data.key` | Key corresponding to the upstreamAuthority. | `""` | +| `upstreamAuthority.disk.secret.data.bundle` | Trust bundle for upstreamAuthority. | `""` | +| `upstreamAuthority.awsPCA.enabled` | Flag to enable upstream authority plugin with AWS PCA | `false` | +| `upstreamAuthority.awsPCA.region` | AWS Region to use | `""` | +| `upstreamAuthority.awsPCA.certificateAuthorityARN` | ARN of the "upstream" CA certificate | `""` | +| `upstreamAuthority.awsPCA.assumeRoleARN` | (Optional) ARN of an IAM role to assume | `""` | +| `upstreamAuthority.awsPCA.caSigningTemplateARN` | (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. | `""` | +| `upstreamAuthority.awsPCA.signingAlgorithm` | (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | `""` | +| `upstreamAuthority.awsPCA.endpoint` | (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | `""` | +| `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` | +| `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` | +| `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` | +| `upstreamAuthority.certManager.issuer_name` | Defaults to the release name, override if CA is provided outside of the chart | `""` | +| `upstreamAuthority.certManager.issuer_kind` | Defaults to "Issuer", override if CA is provided outside of the chart | `Issuer` | +| `upstreamAuthority.certManager.issuer_group` | Defaults to "cert-manager.io", override if CA is provided outside of the chart | `cert-manager.io` | +| `upstreamAuthority.certManager.namespace` | Specify to use a namespace other then the one the chart is installed into | `""` | +| `upstreamAuthority.certManager.kube_config_file` | Path to kube_config_file on node to setup cert manager | `""` | +| `upstreamAuthority.certManager.ca.create` | Creates a Cert-Manager CA | `false` | +| `upstreamAuthority.certManager.ca.duration` | Duration of the CA. Defaults to 10 years | `87600h` | +| `upstreamAuthority.certManager.ca.privateKey.algorithm` | Algorithm to generate private key for CA | `ECDSA` | +| `upstreamAuthority.certManager.ca.privateKey.size` | Size of generated private key for CA | `256` | +| `upstreamAuthority.certManager.ca.privateKey.rotationPolicy` | Rotation policy for generated private key | `""` | +| `upstreamAuthority.certManager.ca.renewBefore` | How long to wait before renewing the CA | `""` | +| `upstreamAuthority.spire.enabled` | Flag to use another Spire install as upstream CA | `false` | +| `upstreamAuthority.spire.upstreamDriver` | Driver for Spire as upstream CA | `""` | +| `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | | +| `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` | +| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `8081` | +| `upstreamAuthority.vault.enabled` | Enable Hashicorp Vault as upstream CA | `false` | +| `upstreamAuthority.vault.vaultAddr` | The URL of the Vault server. (e.g., https://vault.example.com:8443/) | `""` | +| `upstreamAuthority.vault.namespace` | Name of the Vault namespace. This is only available in the Vault Enterprise. | `""` | +| `upstreamAuthority.vault.pkiMountPoint` | Name of the mount point where PKI secret engine is mounted | `pki` | +| `upstreamAuthority.vault.insecureSkipVerify` | If true, caCert options are ignored and Spire accepts any server certificates claiming to be Vault | `false` | +| `upstreamAuthority.vault.caCert.type` | Type of resource representing the Vault server certificate, options are 'Secret' or 'Configmap', the item must be named `ca.crt` | `Secret` | +| `upstreamAuthority.vault.caCert.name` | Name of the Kubernetes resource containing the Vault server certificate | `vault-ca` | +| `upstreamAuthority.vault.k8sAuth.enabled` | Enable k8s authentication to Hashicorp Vault | `false` | +| `upstreamAuthority.vault.k8sAuth.k8sAuthMountPoint` | Name of the mount point where the Kubernetes auth method is mounted | `kubernetes` | +| `upstreamAuthority.vault.k8sAuth.k8sAuthRoleName` | Required - Name of the Vault role. The plugin authenticates against the named role | `""` | +| `upstreamAuthority.vault.k8sAuth.token.audience` | Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info. | `vault` | +| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` | +| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` | +| `controllerManager.enabled` | Flag to enable controller manager | `false` | +| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | +| `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` | +| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | +| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.2.3` | +| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | +| `controllerManager.securityContext` | Security context | `{}` | +| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | +| `controllerManager.service.port` | Service port for controller manager | `443` | +| `controllerManager.service.annotations` | Annotations for service resource | `{}` | +| `controllerManager.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` | +| `controllerManager.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` | +| `controllerManager.identities.enabled` | Flag to enable default identities for controller manager | `true` | +| `controllerManager.identities.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` | +| `controllerManager.identities.podSelector` | Selector for pods to issue identity | `{}` | +| `controllerManager.identities.namespaceSelector` | Selector for namespacs to issue identity | `{}` | +| `controllerManager.identities.dnsNameTemplates` | DNS name template for issued identities | `[]` | +| `controllerManager.identities.federatesWith` | Other Spire server URLs for identity federation | `[]` | +| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` | +| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | +| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | +| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | +| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | +| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` | +| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | +| `ingress.enabled` | Flag to enable ingress | `false` | +| `ingress.className` | Ingress class name | `""` | +| `ingress.annotations` | Annotations for the ingress object | `{}` | +| `ingress.hosts` | Host paths for ingress object | `[]` | +| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` | +| `extraVolumes` | Extra volumes to be mounted | `[]` | +| `extraVolumeMounts` | Extra volume mounts | `[]` | +| `extraContainers` | Additional containers to create | `[]` | +| `initContainers` | Additional init containers to create | `[]` | +| `caKeyType` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) | `rsa-2048` | +| `caTTL` | TTL for CA | `24h` | +| `defaultX509SvidTTL` | TTL for X509 Svids | `4h` | +| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` | +| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` | +| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` | +| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` | +| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` | +| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.2.2` | +| `tornjak.service.type` | Type of service resource | `ClusterIP` | +| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` | +| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` | +| `tornjak.service.annotations` | Annotations for the service | `{}` | +| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` | +| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` | +| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` | +| `tornjak.startupProbe.successThreshold` | Success threshold count | `1` | +| `tornjak.startupProbe.timeoutSeconds` | Timeout in seconds | `5` | +| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | | +| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` | +| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` | +| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` | +| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` | +| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` | +| `tornjak.resources` | Resource requests and limits | `{}` | +| `tests.hostAliases` | List of host aliases for testing | `[]` | +| `tests.tls.enabled` | Flag for enabling tls for tests | `false` | +| `tests.tls.customCA` | Custom CA value for tests | `""` | +| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | +| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` | diff --git a/charts/spire/charts/spire-server/README.md.gotmpl b/charts/spire/charts/spire-server/README.md.gotmpl deleted file mode 100644 index c66ec6f..0000000 --- a/charts/spire/charts/spire-server/README.md.gotmpl +++ /dev/null @@ -1,81 +0,0 @@ -{{ template "chart.header" . }} - - - -{{ template "chart.deprecationWarning" . }} - -{{ template "chart.badgesSection" . }} - -{{ template "chart.description" . }} - -{{ template "chart.homepageLine" . }} - -> **Note**: Minimum Spire version is `1.5.3`. -> The recommended version is `1.6.0` to support arm64 nodes. If running with any -> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. -> -> The recommended spire-controller-manager version is `0.2.2` to support arm64 nodes. If running with any -> prior version to `0.2.2` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`. - -{{ template "chart.maintainersSection" . }} - -{{ template "chart.sourcesSection" . }} - -{{ template "chart.requirementsSection" . }} - -## Tornjak - -Tornjak is the UI and Control Plane for SPIRE [https://github.com/spiffe/tornjak](https://github.com/spiffe/tornjak) and it is composed of two components: - -* Backend (this chart) - Tornjak APIs that extend SPIRE APIs with Control Plane functionality -* [Frontend](../tornjak-frontend/README.md) - Tornjak UI - -When Tornjak is enabled, it is exposed on both http and https (if TLS server certs are configured). Tornjak handles a permanent redirect from `http` to `https` to ensure users always use the https endpoint. - -In addition, you can configure a `client certificate authority`, this will make Tornjak backend verify Client certificates signed by this authority to enable mTLS authentication. - -**Warning**: For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access. - -### Tornjak with TLS Connection Type - -TLS connection requires Tornjak to have access to TLS key and certificate. -Complete instruction on creating your own TLS certificate can be found [here](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md). -TLS Certificate and the private key must be provided to Tornjak via *TLS Secret*. Prior to deploying this Helm chart, create TLS Secret in the deployment namespace (e.g. `spire-server`) - -```console -kubectl -n spire-server create secret tls tornjak-tls-secret --cert=client.crt --key=client.key -``` - -Once the charts are deployed, you can test the TLS connection with the following command (assuming localhost): - -```console -curl --cacert CA/rootCA.crt https://localhost:10443 -``` - -### Tornjak with mTLS Connection Type - -mTLS connection allows Tornjak server validation by client and Tornjak client validation by Tornjak server. The server validation is identical to above TLS. Follow the steps to create -TLS secret with key and the certificate. - -Additionally, you must provide the user CA to Tornjak server via `Secret` or `ConfigMap`. -Follow the steps to [create user CA for mTLS](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md), then create a *Secret* (or *ConfigMap*) prior to deploying this Helm chart. - -Here is an example using a *Secret* in `spire-server` namespace: - -```console -kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt" -``` - -Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost): - -```console -curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhost:10443 -``` - -### Tornjak with HTTP Connection Type - -In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above. - -{{ template "chart.valuesSection" . }} - ----------------------------------------------- diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index e0076aa..f1a9263 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -202,3 +202,67 @@ The code below determines what connection type should be used. {{- define "spire-tornjak.servicename" -}} {{- include "spire-tornjak.backend" . -}} {{- end -}} + +{{- define "spire-server.test.federation-ingress-args" }} +{{- $args := list }} +{{- $host := index (index (index .Values.federation.ingress.tls 0) "hosts") 0 }} +{{- if dig "tests" "tls" "enabled" false .Values }} +{{- if ne (len (dig "tests" "tls" "customCA" "" .Values)) 0 }} +{{- $args = append $args "--cacert" }} +{{- $args = append $args "/ca/ca.crt" }} +{{- end }} +{{- $args = append $args (printf "https://%s/" $host) }} +{{- else }} +{{- $args = append $args (printf "http://%s/" $host) }} +{{- end }} +{{ $args | toYaml }} +{{- end -}} + +{{/* +Take a copy of the config and merge in .Values.customPlugins and .Values.unsupportedBuiltInPlugins passed through as root. +*/}} +{{- define "spire-server.config_merge" }} +{{- $pluginsToMerge := dict "plugins" dict }} +{{- range $type, $val := .root.Values.customPlugins }} +{{- if . }} +{{- $nt := printf "%s%s" (substr 0 1 $type | upper) (substr 1 -1 $type) }} +{{- $_ := set $pluginsToMerge.plugins $nt (deepCopy $val) }} +{{- end }} +{{- end }} +{{- range $type, $val := .root.Values.unsupportedBuiltInPlugins }} +{{- if . }} +{{- $nt := printf "%s%s" (substr 0 1 $type | upper) (substr 1 -1 $type) }} +{{- $_ := set $pluginsToMerge.plugins $nt (deepCopy $val) }} +{{- end }} +{{- end }} +{{- $newConfig := .config | fromYaml | mustMerge $pluginsToMerge }} +{{- $newConfig | toYaml }} +{{- end }} + +{{/* +Take a copy of the plugin section and return a yaml string based version +reformatted from a dict of dicts to a dict of lists of dicts +*/}} +{{- define "spire-server.plugins_reformat" }} +{{- range $type, $v := . }} +{{ $type }}: +{{- range $name, $v2 := $v }} + - {{ $name }}: {{ $v2 | toYaml | nindent 8 }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Take a copy of the config as a yaml config and root var. +Merge in .root.Values.customPlugins and .Values.unsupportedBuiltInPlugins into config, +Reformat the plugin section from a dict of dicts to a dict of lists of dicts, +and export it back as as json string. +This makes it much easier for users to merge in plugin configs, as dicts are easier +to merge in values, but spire needs arrays. +*/}} +{{- define "spire-server.reformat-and-yaml2json" -}} +{{- $config := include "spire-server.config_merge" . | fromYaml }} +{{- $plugins := include "spire-server.plugins_reformat" $config.plugins | fromYaml }} +{{- $_ := set $config "plugins" $plugins }} +{{- $config | toPrettyJson }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index d72eae9..33c70c5 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -1,3 +1,21 @@ +{{- range $type, $tvals := .Values.customPlugins }} +{{- if not (has $type (list "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }} +{{- fail (printf "Unknown plugin type specified: %s" $type) }} +{{- end }} +{{- range $name, $nval := $tvals }} +{{- if not (hasKey $nval "plugin_cmd") }} +{{- fail (printf "plugin_cmd is a required field. %s" $name) }} +{{- end }} +{{- if not (hasKey $nval "plugin_checksum") }} +{{- fail (printf "plugin_checksum is a required field.") }} +{{- end }} +{{- range $sname, $svals := $nval }} +{{- if not (has $sname (list "plugin_cmd" "plugin_checksum" "plugin_data")) }} +{{- fail (printf "Unknown plugin setting specified: %s" $sname) }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} {{- define "spire-server.yaml-config" -}} {{- $upstreamAuthorityUsed := 0 }} {{- $keyManagerUsed := 0 }} @@ -33,18 +51,18 @@ server: plugins: DataStore: - - sql: - plugin_data: - {{ include "spire-server.datastore-config" . | nindent 10 }} + sql: + plugin_data: + {{ include "spire-server.datastore-config" . | nindent 10 }} {{- with .Values.nodeAttestor.k8sPsat }} {{- if eq (.enabled | toString) "true" }} NodeAttestor: - - k8s_psat: - plugin_data: - clusters: - {{ include "spire-lib.cluster-name" $root }}: - service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }} + k8s_psat: + plugin_data: + clusters: + {{ include "spire-lib.cluster-name" $root }}: + service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }} {{- end }} {{- end }} @@ -52,9 +70,9 @@ plugins: {{- if eq (.enabled | toString) "true" }} {{- $keyManagerUsed = add1 $keyManagerUsed }} KeyManager: - - disk: - plugin_data: - keys_path: "/run/spire/data/keys.json" + disk: + plugin_data: + keys_path: "/run/spire/data/keys.json" {{- end }} {{- end }} @@ -62,8 +80,8 @@ plugins: {{- if eq (.enabled | toString) "true" }} {{- $keyManagerUsed = add1 $keyManagerUsed }} KeyManager: - - memory: - plugin_data: + memory: + plugin_data: {{- end }} {{- end }} @@ -92,22 +110,22 @@ plugins: {{- end }} Notifier: - - k8sbundle: - plugin_data: - namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }} - config_map: {{ include "spire-lib.bundle-configmap" . | quote }} + k8sbundle: + plugin_data: + namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }} + config_map: {{ include "spire-lib.bundle-configmap" . | quote }} {{- with .Values.upstreamAuthority.disk }} {{- if eq (.enabled | toString) "true" }} {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }} UpstreamAuthority: - - disk: - plugin_data: - cert_file_path: "/run/spire/upstream_ca/tls.crt" - key_file_path: "/run/spire/upstream_ca/tls.key" - {{- if ne .secret.data.bundle "" }} - bundle_file_path: "/run/spire/upstream_ca/bundle.crt" - {{- end }} + disk: + plugin_data: + cert_file_path: "/run/spire/upstream_ca/tls.crt" + key_file_path: "/run/spire/upstream_ca/tls.key" + {{- if ne .secret.data.bundle "" }} + bundle_file_path: "/run/spire/upstream_ca/bundle.crt" + {{- end }} {{- end }} {{- end }} @@ -115,15 +133,15 @@ plugins: {{- if eq (.enabled | toString) "true" }} {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }} UpstreamAuthority: - - cert-manager: - plugin_data: - issuer_name: {{ default (include "spire-server.fullname" $root) .issuer_name }}-ca - issuer_kind: {{ .issuer_kind | quote }} - issuer_group: {{ .issuer_group | quote }} - namespace: {{ default $root.Release.Namespace .namespace | quote }} - {{- if ne .kube_config_file "" }} - kube_config_file: {{ .kube_config_file | quote }} - {{- end }} + cert-manager: + plugin_data: + issuer_name: {{ default (include "spire-server.fullname" $root) .issuer_name }}-ca + issuer_kind: {{ .issuer_kind | quote }} + issuer_group: {{ .issuer_group | quote }} + namespace: {{ default $root.Release.Namespace .namespace | quote }} + {{- if ne .kube_config_file "" }} + kube_config_file: {{ .kube_config_file | quote }} + {{- end }} {{- end }} {{- end }} @@ -131,14 +149,46 @@ plugins: {{- if eq (.enabled | toString) "true" }} {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }} UpstreamAuthority: - - spire: - plugin_data: - server_address: {{ include "spire-server.upstream-spire-address" $root | quote }} - server_port: {{ .server.port }} - workload_api_socket: "/run/spire/upstream_agent/spire-agent.sock" + spire: + plugin_data: + server_address: {{ include "spire-server.upstream-spire-address" $root | quote }} + server_port: {{ .server.port }} + workload_api_socket: "/run/spire/upstream_agent/spire-agent.sock" {{- end }} {{- end }} + {{- with .Values.upstreamAuthority.vault }} + {{- if eq (.enabled | toString) "true" }} + {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }} + UpstreamAuthority: + vault: + plugin_data: + vault_addr: {{ .vaultAddr | quote }} + pki_mount_point: {{ .pkiMountPoint | quote }} + insecure_skip_verify: {{ .insecureSkipVerify }} + {{- if ne (.insecureSkipVerify | toString) "true" }} + ca_cert_path: "/run/spire/vault-upstream/ca.crt" + {{- end }} + {{- if ne .namespace "" }} + namespace: {{ .namespace | quote }} + {{- end }} + + {{- $vaultAuthMethodUsed := 0 }} + {{- with .k8sAuth }} + {{- if eq (.enabled | toString) "true" }} + {{- $vaultAuthMethodUsed = add1 $vaultAuthMethodUsed }} + k8s_auth: + k8s_auth_mount_point: {{ .k8sAuthMountPoint | quote }} + k8s_auth_role_name: {{ .k8sAuthRoleName | quote }} + token_path: "/var/run/secrets/tokens/spire-server" + {{- end }} + {{- end }} + {{- if gt $vaultAuthMethodUsed 1 }} + {{- fail "You can only enable a single authentication mechanism to an upstream Vault." }} + {{- end }} + {{- end }} + {{- end }} + {{- with .Values.upstreamAuthority.awsPCA }} {{- if eq (.enabled | toString) "true" }} {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }} @@ -191,4 +241,4 @@ metadata: {{- end }} data: server.conf: | - {{- include "spire-server.yaml-config" . | fromYaml | toPrettyJson | nindent 4 }} + {{- include "spire-server.reformat-and-yaml2json" (dict "config" (include "spire-server.yaml-config" .) "root" .) | nindent 4 }} diff --git a/charts/spire/charts/spire-server/templates/secret.yaml b/charts/spire/charts/spire-server/templates/secret.yaml index fe06f7e..c318280 100644 --- a/charts/spire/charts/spire-server/templates/secret.yaml +++ b/charts/spire/charts/spire-server/templates/secret.yaml @@ -1,4 +1,14 @@ +{{- if and (.Values.dataStore.sql.externalSecret.enabled) (ne .Values.dataStore.sql.password "") }} +{{- fail "dataStore.sql.password should not be set when dataStore.sql.externalSecret is enabled" }} +{{- end }} +{{- if and (.Values.dataStore.sql.externalSecret.enabled) (eq .Values.dataStore.sql.externalSecret.name "") }} +{{- fail "dataStore.sql.externalSecret.name cannot be empty string when dataStore.sql.externalSecret is enabled" }} +{{- end }} +{{- if and (.Values.dataStore.sql.externalSecret.enabled) (eq .Values.dataStore.sql.externalSecret.key "") }} +{{- fail "dataStore.sql.externalSecret.key cannot be empty string when dataStore.sql.externalSecret is enabled" }} +{{- end }} {{- if ne .Values.dataStore.sql.databaseType "sqlite3" }} +{{- if not .Values.dataStore.sql.externalSecret.enabled }} apiVersion: v1 kind: Secret metadata: @@ -7,3 +17,4 @@ metadata: data: DBPW: {{ .Values.dataStore.sql.password | b64enc }} {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index d9fc9a6..aef398c 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -49,6 +49,9 @@ spec: securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} {{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }} + {{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName }} + {{- end }} initContainers: {{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }} - name: wait @@ -83,12 +86,20 @@ spec: - name: PATH value: "/opt/spire/bin:/bin" {{- if ne .Values.dataStore.sql.databaseType "sqlite3" }} + {{- if .Values.dataStore.sql.externalSecret.enabled }} + - name: DBPW + valueFrom: + secretKeyRef: + name: {{ .Values.dataStore.sql.externalSecret.name }} + key: {{ .Values.dataStore.sql.externalSecret.key }} + {{- else }} - name: DBPW valueFrom: secretKeyRef: name: {{ $fullname }}-dbpw key: DBPW {{- end }} + {{- end }} {{- if ne .Values.keyManager.awsKMS.accessKeyID "" }} - name: AWS_KMS_ACCESS_KEY_ID valueFrom: @@ -159,7 +170,19 @@ spec: subPath: policy.json readOnly: true {{ end }} - {{ end }} + {{- end }} + {{- with .Values.upstreamAuthority.vault }} + {{- if eq (.enabled | toString) "true" }} + {{- if eq (.k8sAuth.enabled | toString) "true" }} + - name: spire-psat + mountPath: /var/run/secrets/tokens + {{- end }} + {{- if ne (.insecureSkipVerify | toString) "true" }} + - name: vault-ca + mountPath: /run/spire/vault-upstream + {{- end }} + {{- end }} + {{- end }} {{- if gt (len .Values.extraVolumeMounts) 0 }} {{- toYaml .Values.extraVolumeMounts | nindent 12 }} {{- end }} @@ -346,6 +369,33 @@ spec: path: {{ .Values.persistence.hostPath }} type: Directory {{- end }} + {{- with .Values.upstreamAuthority.vault }} + {{- if eq (.enabled | toString) "true" }} + {{- if ne (.insecureSkipVerify | toString) "true" }} + {{- if eq (.caCert.type | lower) "configmap" }} + - name: vault-ca + configMap: + name: {{ .caCert.name }} + {{- else if eq (.caCert.type | lower) "secret" }} + - name: vault-ca + secret: + secretName: {{ .caCert.name }} + optional: false + {{- end }} + {{- end -}} + {{- if eq (.k8sAuth.enabled | toString) "true" }} + - name: spire-psat + projected: + sources: + - serviceAccountToken: + path: spire-server + expirationSeconds: {{ .k8sAuth.token.expiry }} + {{- if ne .k8sAuth.token.audience "" }} + audience: {{ .k8sAuth.token.audience }} + {{- end }} + {{- end }} + {{- end -}} + {{- end -}} {{- if eq .Values.persistence.type "pvc" }} volumeClaimTemplates: - metadata: diff --git a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml index ec3a9d2..12850e9 100644 --- a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml @@ -1,3 +1,4 @@ +{{ $values := merge .Values }} apiVersion: v1 kind: Pod metadata: @@ -38,4 +39,28 @@ spec: securityContext: {{- toYaml .Values.securityContext | nindent 8 }} {{- end }} + {{- if .Values.federation.ingress.enabled }} + - name: federation-ingress + image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} + command: ['curl'] + args: + {{ include "spire-server.test.federation-ingress-args" (dict "Values" $values) | nindent 8 }} + {{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }} + volumeMounts: + - name: custom-ca + mountPath: /ca + {{- end }} + securityContext: + {{- toYaml .Values.securityContext | nindent 8 }} + {{- end }} + {{- if ne (len (dig "tests" "hostAliases" "" $values)) 0 }} + hostAliases: + {{- toYaml .Values.tests.hostAliases | nindent 4 }} + {{- end }} + {{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }} + volumes: + - name: custom-ca + secret: + secretName: {{ .Values.tests.tls.customCA }} + {{- end }} restartPolicy: Never diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 3b943ba..c66ed60 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1,44 +1,56 @@ -# Default values for spire-server. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. +# Default configuration for Spire server +# SPDX-License-Identifier: APACHE-2.0 -# @ignored +## @skip global global: {} -# -- SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. +## @section Chart parameters +## +## @param replicaCount SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. replicaCount: 1 +## @param image.registry The OCI registry to pull the image from +## @param image.repository The repository within the registry +## @param image.pullPolicy The image pull policy +## @param image.version This value is deprecated in favor of tag. (Will be removed in a future release) +## @param image.tag Overrides the image tag whose default is the chart appVersion +## image: - # -- The OCI registry to pull the image from registry: ghcr.io - # -- The repository within the registry repository: spiffe/spire-server - # -- The image pull policy pullPolicy: IfNotPresent - # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" - # -- Overrides the image tag whose default is the chart appVersion. tag: "" +## @param imagePullSecrets [array] Pull secrets for images imagePullSecrets: [] + +## @param nameOverride Name override nameOverride: "" + +## @param namespaceOverride Namespace override namespaceOverride: "" + +## @param fullnameOverride Fullname override fullnameOverride: "" +## @param serviceAccount.create Specifies whether a service account should be created +## @param serviceAccount.annotations [object] Annotations to add to the service account +## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated. +## serviceAccount: - # -- Specifies whether a service account should be created create: true - # -- Annotations to add to the service account annotations: {} - # -- The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template name: "" +## @param podAnnotations [object] Annotations to add to pods podAnnotations: {} +## @param podSecurityContext [object] Pod security context podSecurityContext: {} # fsGroup: 2000 +## @param securityContext [object] Security context securityContext: {} # capabilities: # drop: @@ -47,15 +59,23 @@ securityContext: {} # runAsNonRoot: true # runAsUser: 1000 +## @param priorityClassName Priority class assigned to statefulset pods +priorityClassName: "" + +## @param service.type Type of the Spire server service created +## @param service.port Port for the created service +## @param service.annotations [object] Annotations to add to the service object +## service: type: ClusterIP port: 8081 annotations: {} configMap: - # -- Annotations to add to the SPIRE Server ConfigMap + ## @param configMap.annotations [object] Annotations to add to the SPIRE Server ConfigMap annotations: {} +## @param resources [object] Resource requests and limits resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little @@ -68,6 +88,11 @@ resources: {} # cpu: 200m # memory: 256Mi +## @param autoscaling.enabled Flag to enable autoscaling +## @param autoscaling.minReplicas Minimum replicas for autoscaling +## @param autoscaling.maxReplicas Maximum replicas for autoscaling +## @param autoscaling.targetCPUUtilizationPercentage Target CPU utlization that triggers autoscaling +## autoscaling: enabled: false minReplicas: 1 @@ -75,95 +100,123 @@ autoscaling: targetCPUUtilizationPercentage: 80 # targetMemoryUtilizationPercentage: 80 -# -- Select specific nodes to run on (currently only amd64 is supported by Tornjak) +## @param nodeSelector [object] Select specific nodes to run on (currently only amd64 is supported by Tornjak) nodeSelector: {} +## @param tolerations [array] List of tolerations tolerations: [] +## @param affinity [object] List of node affinities affinity: {} +## @param topologySpreadConstraints [array] Topology spread constraints for resilience topologySpreadConstraints: [] +## @param livenessProbe.failureThreshold Failure threshold count for livenessProbe +## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe +## @param livenessProbe.periodSeconds Period seconds for livenessProbe +## @param livenessProbe.timeoutSeconds Timeout in seconds for livenessProbe +## livenessProbe: - # -- Failure threshold count for livenessProbe failureThreshold: 2 - # -- Initial delay seconds for livenessProbe initialDelaySeconds: 15 - # -- Period seconds for livenessProbe periodSeconds: 60 - # -- Timeout in seconds for livenessProbe timeoutSeconds: 3 +## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe +## @param readinessProbe.periodSeconds Period seconds for readinessProbe +## readinessProbe: - # -- Initial delay seconds for readinessProbe initialDelaySeconds: 5 - # -- Period seconds for readinessProbe periodSeconds: 5 +## @param persistence.type What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) +## @param persistence.size What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) +## @param persistence.accessMode What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) +## @param persistence.storageClass What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) +## @param persistence.hostPath Which path to use on the host when type = hostPath +## persistence: - # -- What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) type: pvc size: 1Gi accessMode: ReadWriteOnce storageClass: null - # -- Which path to use on the host when type = hostPath hostPath: "" dataStore: sql: - # -- Other supported databases are "postgres" and "mysql" + ## @param dataStore.sql.databaseType Other supported databases are "postgres" and "mysql" databaseType: sqlite3 - # -- Only used by "postgres" or "mysql" + ## @param dataStore.sql.databaseName Only used by "postgres" or "mysql" databaseName: spire - # -- Only used by "postgres" or "mysql" + ## @param dataStore.sql.host Only used by "postgres" or "mysql" host: "" - # -- If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. + ## @param dataStore.sql.port If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. port: 0 - # -- Only used by "postgres" or "mysql" + ## @param dataStore.sql.username Only used by "postgres" or "mysql" username: spire - # -- Only used by "postgres" or "mysql" + ## @param dataStore.sql.password Only used by "postgres" or "mysql" password: "" - # -- Only used by "postgres" or "mysql" + ## @param dataStore.sql.options [array] Only used by "postgres" or "mysql" options: [] - # -- Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section + ## @param dataStore.sql.plugin_data [object] Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section plugin_data: {} -# -- The log level, valid values are "debug", "info", "warn", and "error" + ## When an external source creates the secret. The secret should reside in the same namespace as the spire server + externalSecret: + ## @param dataStore.sql.externalSecret.enabled Enable external secret for datastore creds + enabled: false + ## @param dataStore.sql.externalSecret.name The name of the secret object + name: "" + ## @param dataStore.sql.externalSecret.key The key of the secret object whose value is the dataStore.sql password + key: "" + +## @param logLevel The log level, valid values are "debug", "info", "warn", and "error" logLevel: info -# -- The JWT issuer domain +## @param jwtIssuer The JWT issuer domain jwtIssuer: https://oidc-discovery.example.org -# -- Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) +## @param clusterName Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) clusterName: example-cluster -# -- Set the trust domain to be used for the SPIFFE identifiers +## @param trustDomain Set the trust domain to be used for the SPIFFE identifiers trustDomain: example.org +## @param bundleConfigMap Set the trust domain to be used for the SPIFFE identifiers bundleConfigMap: spire-bundle -# -- This is the value of your clusters `kubeadm init --service-dns-domain` flag +## @param clusterDomain This is the value of your clusters `kubeadm init --service-dns-domain` flag clusterDomain: cluster.local federation: + ## @param federation.enabled Flag to enable federation enabled: false bundleEndpoint: + ## @param federation.bundleEndpoint.port Port value for trust bundle federation port: 8443 + ## @param federation.bundleEndpoint.address Address for trust bundle federation address: "0.0.0.0" ingress: + ## @param federation.ingress.enabled Flag to enable ingress for federation enabled: false + ## @param federation.ingress.className Ingress class name for federation className: "" + ## @param federation.ingress.annotations [object] Annotations for the ingress object annotations: {} # kubernetes.io/ingress.class: nginx # kubernetes.io/tls-acme: "true" # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" # If Profile Type == https_spiffe: # nginx.ingress.kubernetes.io/ssl-passthrough: "true" + ## @param federation.ingress.hosts [array] Host paths for ingress object hosts: - host: spire-server-federation.example.org paths: - path: / pathType: Prefix + + ## @param federation.ingress.tls [array] Secrets containining TLS certs to enable https on ingress tls: [] # - hosts: # - spire-server-federation.example.org @@ -171,117 +224,171 @@ federation: # secretName: spire-server-federation-tls ca_subject: + ## @param ca_subject.country Country for Spire server CA country: NL + ## @param ca_subject.organization Organization for Spire server CA organization: Example + ## @param ca_subject.common_name Common Name for Spire server CA common_name: example.org keyManager: disk: + ## @param keyManager.disk.enabled Flag to enable keyManager on disk enabled: true memory: + ## @param keyManager.memory.enabled Flag to enable keyManager in memory enabled: false awsKMS: + ## @param keyManager.awsKMS.enabled Flag to enable keyManager in memory enabled: false + ## @param keyManager.awsKMS.region Specify the region for AWS KMS region: "" - # -- Policy to use when creating keys. If no policy is specified, a default policy will be used. + ## @extra keyManager.awsKMS.keyPolicy Policy to use when creating keys. If no policy is specified, a default policy will be used. keyPolicy: - # -- (Optional) Key policy in JSON format. + ## @param keyManager.awsKMS.keyPolicy.policy [nullable] Key policy in JSON format. policy: "" - # -- (Optional) Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. + ## @param keyManager.awsKMS.keyPolicy.existingConfigMap [nullable] Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. existingConfigMap: "" - # -- (Optional) Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. + ## @param keyManager.awsKMS.accessKeyID [nullable] Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. accessKeyID: "" - # -- (Optional) Secret access key for the AWS account. + ## @param keyManager.awsKMS.secretAccessKey [nullable] Secret access key for the AWS account. secretAccessKey: "" upstreamAuthority: disk: + ## @param upstreamAuthority.disk.enabled Flag to enable upstream authority plugin on disk enabled: false secret: - # -- If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. + ## @param upstreamAuthority.disk.secret.create If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. create: true - # -- If secret creation is disabled, the secret with this name will be used. + ## @param upstreamAuthority.disk.secret.name If secret creation is disabled, the secret with this name will be used. name: "spiffe-upstream-ca" - # -- If secret creation is enabled, will create a secret with following certificate info + ## @extra upstreamAuthority.disk.secret.data If secret creation is enabled, will create a secret with following certificate info data: + ## @param upstreamAuthority.disk.secret.data.certificate Certificate to store within disk upstreamAuthority. certificate: "" + ## @param upstreamAuthority.disk.secret.data.key Key corresponding to the upstreamAuthority. key: "" + ## @param upstreamAuthority.disk.secret.data.bundle Trust bundle for upstreamAuthority. bundle: "" awsPCA: + ## @param upstreamAuthority.awsPCA.enabled Flag to enable upstream authority plugin with AWS PCA enabled: false - # -- AWS Region to use + ## @param upstreamAuthority.awsPCA.region AWS Region to use region: "" - # -- ARN of the "upstream" CA certificate + ## @param upstreamAuthority.awsPCA.certificateAuthorityARN ARN of the "upstream" CA certificate certificateAuthorityARN: "" - # -- (Optional) ARN of an IAM role to assume + ## @param upstreamAuthority.awsPCA.assumeRoleARN (Optional) ARN of an IAM role to assume assumeRoleARN: "" - # -- (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. - # -- See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. + ## @param upstreamAuthority.awsPCA.caSigningTemplateARN (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. caSigningTemplateARN: "" - # -- (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. - # -- See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. + ## @param upstreamAuthority.awsPCA.signingAlgorithm (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. signingAlgorithm: "" - # -- (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. - # -- See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. + ## @param upstreamAuthority.awsPCA.endpoint (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. endpoint: "" - # -- (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. + ## @param upstreamAuthority.awsPCA.supplementalBundlePath (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. supplementalBundlePath: "" certManager: + ## @param upstreamAuthority.certManager.enabled Flag to enable upstream authority plugin with cert manager enabled: false + ## @param upstreamAuthority.certManager.rbac.create Flag to create RBAC roles rbac: create: true - # -- Defaults to the release name, override if CA is provided outside of the chart + ## @param upstreamAuthority.certManager.issuer_name Defaults to the release name, override if CA is provided outside of the chart issuer_name: "" + ## @param upstreamAuthority.certManager.issuer_kind Defaults to "Issuer", override if CA is provided outside of the chart issuer_kind: "Issuer" + ## @param upstreamAuthority.certManager.issuer_group Defaults to "cert-manager.io", override if CA is provided outside of the chart issuer_group: "cert-manager.io" - # -- Specify to use a namespace other then the one the chart is installed into + ## @param upstreamAuthority.certManager.namespace Specify to use a namespace other then the one the chart is installed into namespace: "" + ## @param upstreamAuthority.certManager.kube_config_file Path to kube_config_file on node to setup cert manager kube_config_file: "" ca: - # -- Creates a Cert-Manager CA + ## @param upstreamAuthority.certManager.ca.create Creates a Cert-Manager CA create: false - # -- Duration of the CA. Defaults to 10 years. + ## @param upstreamAuthority.certManager.ca.duration Duration of the CA. Defaults to 10 years duration: 87600h privateKey: + ## @param upstreamAuthority.certManager.ca.privateKey.algorithm Algorithm to generate private key for CA algorithm: ECDSA + ## @param upstreamAuthority.certManager.ca.privateKey.size Size of generated private key for CA size: 256 + ## @param upstreamAuthority.certManager.ca.privateKey.rotationPolicy Rotation policy for generated private key rotationPolicy: "" - # -- How long to wait before renewing the CA + ## @param upstreamAuthority.certManager.ca.renewBefore How long to wait before renewing the CA renewBefore: "" spire: + ## @param upstreamAuthority.spire.enabled Flag to use another Spire install as upstream CA enabled: false + ## @param upstreamAuthority.spire.upstreamDriver Driver for Spire as upstream CA upstreamDriver: "" + ## @extra upstreamAuthority.spire.server Server details for the Spire instance use as upstream CA server: + ## @param upstreamAuthority.spire.server.address Address for upstream Spire server address: "" + ## @param upstreamAuthority.spire.server.port Port for upstream Spire server port: 8081 + vault: + ## @param upstreamAuthority.vault.enabled Enable Hashicorp Vault as upstream CA + enabled: false + ## @param upstreamAuthority.vault.vaultAddr The URL of the Vault server. (e.g., https://vault.example.com:8443/) + vaultAddr: "" + ## @param upstreamAuthority.vault.namespace Name of the Vault namespace. This is only available in the Vault Enterprise. + namespace: "" + ## @param upstreamAuthority.vault.pkiMountPoint Name of the mount point where PKI secret engine is mounted + pkiMountPoint: "pki" + ## @param upstreamAuthority.vault.insecureSkipVerify If true, caCert options are ignored and Spire accepts any server certificates claiming to be Vault + insecureSkipVerify: false + caCert: + ## @param upstreamAuthority.vault.caCert.type Type of resource representing the Vault server certificate, options are 'Secret' or 'Configmap', the item must be named `ca.crt` + type: Secret + ## @param upstreamAuthority.vault.caCert.name Name of the Kubernetes resource containing the Vault server certificate + name: vault-ca + + k8sAuth: + ## @param upstreamAuthority.vault.k8sAuth.enabled Enable k8s authentication to Hashicorp Vault + enabled: false + ## @param upstreamAuthority.vault.k8sAuth.k8sAuthMountPoint Name of the mount point where the Kubernetes auth method is mounted + k8sAuthMountPoint: "kubernetes" + ## @param upstreamAuthority.vault.k8sAuth.k8sAuthRoleName Required - Name of the Vault role. The plugin authenticates against the named role + k8sAuthRoleName: "" + token: + ## @param upstreamAuthority.vault.k8sAuth.token.audience Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info. + audience: "vault" + ## @param upstreamAuthority.vault.k8sAuth.token.expiry Expiry time in seconds for the token + expiry: 7200 notifier: k8sbundle: - # -- Namespace to push the bundle into, if blank will default to SPIRE Server namespace + ## @param notifier.k8sbundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace namespace: "" controllerManager: + ## @param controllerManager.enabled Flag to enable controller manager enabled: false installAndUpgradeHook: - # -- Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) + ## @param controllerManager.installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) enabled: true deleteHook: - # -- Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) + ## @param controllerManager.deleteHook.enabled Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) enabled: true + ## @param controllerManager.image.registry The OCI registry to pull the image from + ## @param controllerManager.image.repository The repository within the registry + ## @param controllerManager.image.pullPolicy The image pull policy + ## @param controllerManager.image.version This value is deprecated in favor of tag. (Will be removed in a future release) + ## @param controllerManager.image.tag Overrides the image tag whose default is the chart appVersion + ## image: - # -- The OCI registry to pull the image from registry: ghcr.io - # -- The repository within the registry repository: spiffe/spire-controller-manager - # -- The image pull policy pullPolicy: IfNotPresent - # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" - # -- Overrides the image tag tag: "0.2.3" + ## @param controllerManager.resources [object] Resource requests and limits for controller manager resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little @@ -294,6 +401,7 @@ controllerManager: # cpu: 100m # memory: 128Mi + ## @param controllerManager.securityContext [object] Security context securityContext: {} # capabilities: # drop: @@ -302,124 +410,166 @@ controllerManager: # runAsNonRoot: true # runAsUser: 1000 + ## @param controllerManager.service.type Service type for controller manager + ## @param controllerManager.service.port Service port for controller manager + ## @param controllerManager.service.annotations Annotations for service resource + ## service: type: ClusterIP port: 443 annotations: {} configMap: - # -- Annotations to add to the Controller Manager ConfigMap + ## @param controllerManager.configMap.annotations [object] Annotations to add to the Controller Manager ConfigMap annotations: {} + ## @param controllerManager.ignoreNamespaces [array] These namespaces are ignored by controller manager ignoreNamespaces: - kube-system - kube-public - local-path-storage identities: + ## @param controllerManager.identities.enabled Flag to enable default identities for controller manager enabled: true + ## @param controllerManager.identities.spiffeIDTemplate Spiffe ID template for identities spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }} + ## @param controllerManager.identities.podSelector [object] Selector for pods to issue identity podSelector: {} # matchLabels: # spiffe.io/spiffe-id: "true" + ## @param controllerManager.identities.namespaceSelector [object] Selector for namespacs to issue identity namespaceSelector: {} # matchLabels: # spiffe.io/spiffe-id: "true" + ## @param controllerManager.identities.dnsNameTemplates [array] DNS name template for issued identities dnsNameTemplates: [] # - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local' + ## @param controllerManager.identities.federatesWith [array] Other Spire server URLs for identity federation federatesWith: [] # - example.io # - example.ai validatingWebhookConfiguration: + ## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued failurePolicy: Fail tools: kubectl: + ## @param tools.kubectl.image.registry The OCI registry to pull the image from + ## @param tools.kubectl.image.repository The repository within the registry + ## @param tools.kubectl.image.pullPolicy The image pull policy + ## @param tools.kubectl.image.version This value is deprecated in favor of tag. (Will be removed in a future release) + ## @param tools.kubectl.image.tag Overrides the image tag whose default is the chart appVersion + ## image: - # -- The OCI registry to pull the image from registry: docker.io - # -- The repository within the registry repository: rancher/kubectl - # -- The image pull policy pullPolicy: IfNotPresent - # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" - # -- Overrides the image tag tag: "" telemetry: prometheus: + ## @param telemetry.prometheus.enabled Flag to enable prometheus monitoring enabled: false podMonitor: + ## @param telemetry.prometheus.podMonitor.enabled Enable podMonitor for prometheus enabled: false - # -- Override where to install the podMonitor, if not set will use the same namespace as the spire-server + ## @param telemetry.prometheus.podMonitor.namespace Override where to install the podMonitor, if not set will use the same namespace as the spire-agent namespace: "" + ## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring labels: {} ingress: + ## @param ingress.enabled Flag to enable ingress enabled: false + ## @param ingress.className Ingress class name className: "" + ## @param ingress.annotations [object] Annotations for the ingress object annotations: {} # kubernetes.io/ingress.class: nginx # kubernetes.io/tls-acme: "true" # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" # nginx.ingress.kubernetes.io/ssl-passthrough: "true" + + ## @param ingress.hosts [array] Host paths for ingress object hosts: - host: spire-server.example.org paths: - path: / pathType: Prefix + ## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress tls: [] # - secretName: spire-server-tls # hosts: # - spire-server.example.org +## @param extraVolumes [array] Extra volumes to be mounted extraVolumes: [] + +## @param extraVolumeMounts [array] Extra volume mounts extraVolumeMounts: [] + +## @param extraContainers [array] Additional containers to create extraContainers: [] +## @param initContainers [array] Additional init containers to create initContainers: [] -# -- The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) +## @param caKeyType The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) caKeyType: rsa-2048 +## @param caTTL TTL for CA caTTL: 24h +## @param defaultX509SvidTTL TTL for X509 Svids defaultX509SvidTTL: 4h +## @param defaultJwtSvidTTL TTL for JWT Svids defaultJwtSvidTTL: 1h nodeAttestor: k8sPsat: + ## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s nodeattestor enabled: true + ## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor serviceAccountAllowList: [] # tornjak - Tornjak default values tornjak: - # -- Deploys Tornjak API (backend) (Not for production) + ## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production) enabled: false + ## @param tornjak.image.registry The OCI registry to pull the image from + ## @param tornjak.image.repository The repository within the registry + ## @param tornjak.image.pullPolicy The image pull policy + ## @param tornjak.image.version This value is deprecated in favor of tag. (Will be removed in a future release) + ## @param tornjak.image.tag Overrides the image tag whose default is the chart appVersion + ## image: - # -- The OCI registry to pull the Tornjak image from registry: ghcr.io - # -- The repository within the registry repository: spiffe/tornjak-backend - # -- The Tornjak image pull policy pullPolicy: IfNotPresent - # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" - # -- Overrides the image tag tag: "v1.2.2" service: + ## @param tornjak.service.type Type of service resource type: ClusterIP - # -- Ports for tornjak ports: + ## @param tornjak.service.ports.http Insecure port for tornjak service http: 10000 + ## @param tornjak.service.ports.https Secure port for tornjak service https: 10443 + ## @param tornjak.service.annotations [object] Annotations for the service annotations: {} + ## @param tornjak.startupProbe.failureThreshold Failure threshold count + ## @param tornjak.startupProbe.initialDelaySeconds Initial delay seconds + ## @param tornjak.startupProbe.periodSeconds Period seconds + ## @param tornjak.startupProbe.successThreshold Success threshold count + ## @param tornjak.startupProbe.timeoutSeconds Timeout in seconds + ## startupProbe: failureThreshold: 3 - # -- Initial delay seconds for initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 @@ -427,9 +577,11 @@ tornjak: # tornjak - Tornjak default values config: - # -- Persistent DB for storing Tornjak specific information + ## @extra tornjak.config.dataStore [object] Persistent DB for storing Tornjak specific information dataStore: + ## @param tornjak.config.dataStore.driver Database driver name driver: "sqlite3" + ## @param tornjak.config.dataStore.file File path for sqlite3 file file: "/run/spire/data/tornjak.sqlite3" # Tornjak supports 3 connection types: `http`, `tls`, and `mtls`. @@ -438,16 +590,15 @@ tornjak: # When `tlsSecret` and `clientCA.tornjak-client-ca` are created in this chart namespace, the mTLS connection is started # When none of them are created, Tornjak starts with HTTP connection only - # -- Name of the secret containing server side key and certificate for TLS verification - # (required for `tls` or `mtls` connectionType) + ## @param tornjak.config.tlsSecret Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) tlsSecret: tornjak-tls-secret clientCA: - # -- Type of delivery for the user CA for mTLS client verification - # options are `Secret` or `ConfigMap` - # (required for `mtls` connectionType) + ## @param tornjak.config.clientCA.type Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) type: Secret + ## @param tornjak.config.clientCA.name Name of the resource secret or configMap with user CA for TLS name: tornjak-client-ca + ## @param tornjak.resources [object] Resource requests and limits resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little @@ -460,17 +611,41 @@ tornjak: # cpu: 100m # memory: 128Mi -# @ignored +# NOTE: This is unsupported and only to configure currently supported spire built in plugins but plugins unsupported by the chart. +# Upgrades wont be tested for anything under this config. If you need this, please let the chart developers know your needs so we +# can prioritize proper support. +## @skip unsupportedBuiltInPlugins +unsupportedBuiltInPlugins: + keyManager: {} + nodeAttestor: {} + upstreamAuthority: {} + notifier: {} + +## @skip customPlugins +customPlugins: + keyManager: {} + nodeAttestor: {} + upstreamAuthority: {} + notifier: {} + tests: + ## @param tests.hostAliases [array] List of host aliases for testing + hostAliases: [] + tls: + ## @param tests.tls.enabled Flag for enabling tls for tests + enabled: false + ## @param tests.tls.customCA Custom CA value for tests + customCA: "" bash: + ## @param tests.bash.image.registry The OCI registry to pull the image from + ## @param tests.bash.image.repository The repository within the registry + ## @param tests.bash.image.pullPolicy The image pull policy + ## @param tests.bash.image.version This value is deprecated in favor of tag. (Will be removed in a future release) + ## @param tests.bash.image.tag Overrides the image tag whose default is the chart appVersion + ## image: - # -- The OCI registry to pull the image from registry: cgr.dev - # -- The repository within the registry repository: chainguard/bash - # -- The image pull policy pullPolicy: IfNotPresent - # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" - # -- Overrides the image tag tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4 diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 1105e4c..00e3857 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -52,38 +52,44 @@ port forwarding. See the chart NOTES output for more details. * -## Values +## Parameters -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| affinity | object | `{}` | | -| apiServerURL | string | `"http://localhost:10000/"` | URL of the Tornjak APIs (backend) Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. | -| fullnameOverride | string | `""` | | -| image.pullPolicy | string | `"IfNotPresent"` | | -| image.registry | string | `"ghcr.io"` | | -| image.repository | string | `"spiffe/tornjak-frontend"` | | -| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. | -| image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | -| imagePullSecrets | list | `[]` | | -| labels | object | `{}` | | -| nameOverride | string | `""` | | -| namespaceOverride | string | `""` | | -| nodeSelector | object | `{"kubernetes.io/arch":"amd64"}` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | -| podSecurityContext | object | `{}` | | -| securityContext | object | `{}` | | -| service.annotations | object | `{}` | | -| service.port | int | `3000` | | -| service.type | string | `"ClusterIP"` | | -| serviceAccount.annotations | object | `{}` | Annotations to add to the service account | -| serviceAccount.create | bool | `true` | Specifies whether a service account should be created | -| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | -| spireHealthCheck.enabled | bool | `true` | Enables the SPIRE Healthchecker indicator | -| startupProbe.enabled | bool | `true` | Enable startupProbe on Tornjak frontend container | -| startupProbe.failureThreshold | int | `6` | Failure threshold count for startupProbe | -| startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for startupProbe | -| startupProbe.periodSeconds | int | `10` | Period seconds for startupProbe | -| startupProbe.successThreshold | int | `1` | Success threshold count for startupProbe | -| startupProbe.timeoutSeconds | int | `5` | Timeout seconds for startupProbe | -| tolerations | list | `[]` | | -| topologySpreadConstraints | list | `[]` | | ----------------------------------------------- +### Chart parameters + +| Name | Description | Value | +| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `imagePullSecrets` | Pull secrets for images | `[]` | +| `nameOverride` | Name override | `""` | +| `namespaceOverride` | Namespace override | `""` | +| `fullnameOverride` | Fullname override | `""` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | +| `labels` | Labels for tornjak frontend pods | `{}` | +| `podSecurityContext` | Pod security context | `{}` | +| `securityContext` | Security context | `{}` | +| `service.type` | Service type | `ClusterIP` | +| `service.port` | Service port | `3000` | +| `service.annotations` | Annotations for service resource | `{}` | +| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | | +| `affinity` | Affinity rules | `{}` | +| `tolerations` | List of tolerations | `[]` | +| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` | +| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. | `http://localhost:10000/` | +| `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` | +| `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` | +| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | +| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` | +| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` | +| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | +| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index e947e7b..d39d8ee 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -1,38 +1,53 @@ -# Default values for Tornjak UI (Frontend). -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. +# Default configuration for Tornjak UI (Frontend) +# SPDX-License-Identifier: APACHE-2.0 -# @ignored +## @skip global global: {} +## @section Chart parameters +## +## @param image.registry The OCI registry to pull the image from +## @param image.repository The repository within the registry +## @param image.pullPolicy The image pull policy +## @param image.version This value is deprecated in favor of tag. (Will be removed in a future release) +## @param image.tag Overrides the image tag whose default is the chart appVersion +## image: registry: ghcr.io repository: spiffe/tornjak-frontend pullPolicy: IfNotPresent - # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" - # -- Overrides the image tag whose default is the chart appVersion. tag: "" +## @param imagePullSecrets [array] Pull secrets for images imagePullSecrets: [] + +## @param nameOverride Name override nameOverride: "" + +## @param namespaceOverride Namespace override namespaceOverride: "" + +## @param fullnameOverride Fullname override fullnameOverride: "" +## @param serviceAccount.create Specifies whether a service account should be created +## @param serviceAccount.annotations [object] Annotations to add to the service account +## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated. +## serviceAccount: - # -- Specifies whether a service account should be created create: true - # -- Annotations to add to the service account annotations: {} - # -- The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template name: "" +## @param labels [object] Labels for tornjak frontend pods labels: {} +## @param podSecurityContext [object] Pod security context podSecurityContext: {} # fsGroup: 2000 +## @param securityContext [object] Security context securityContext: {} # capabilities: # drop: @@ -41,22 +56,30 @@ securityContext: {} # runAsNonRoot: true # runAsUser: 1000 +## @param service.type Service type +## @param service.port Service port +## @param service.annotations Annotations for service resource +## service: type: ClusterIP port: 3000 annotations: {} -# -- Select specific nodes to run on (currently only amd64 is supported by Tornjak) +## @extra nodeSelector Select specific nodes to run on (currently only amd64 is supported by Tornjak) nodeSelector: + ## @skip nodeSelector.kubernetes.io/arch kubernetes.io/arch: amd64 +## @param affinity [object] Affinity rules affinity: {} +## @param tolerations [array] List of tolerations tolerations: [] +## @param topologySpreadConstraints [array] List of topology spread constraints for resilience topologySpreadConstraints: [] -# -- Provide minimal resources to prevent accidental crashes due to resource exhaustion +## Provide minimal resources to prevent accidental crashes due to resource exhaustion # resources: # requests: # cpu: 50m @@ -65,44 +88,42 @@ topologySpreadConstraints: [] # cpu: 100m # memory: 512Mi -# -- URL of the Tornjak APIs (backend) -# Since Tornjak Frontend runs in the browser, this URL must be accessible from -# the machine running a browser. +## @param apiServerURL URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. apiServerURL: "http://localhost:10000/" # 👈 Use it for minikube or kind # SPIRE Healthchecker indicator spireHealthCheck: - # -- Enables the SPIRE Healthchecker indicator + ## @param spireHealthCheck.enabled Enables the SPIRE Healthchecker indicator enabled: true ## Configure extra options for Tornjak frontend container's startup probe ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes +## @param startupProbe.enabled Enable startupProbe on Tornjak frontend container +## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe +## @param startupProbe.periodSeconds Period seconds for startupProbe +## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe +## @param startupProbe.failureThreshold Failure threshold count for startupProbe +## @param startupProbe.successThreshold Success threshold count for startupProbe ## startupProbe: - # -- Enable startupProbe on Tornjak frontend container enabled: true - # -- Initial delay seconds for startupProbe initialDelaySeconds: 5 - # -- Period seconds for startupProbe periodSeconds: 10 - # -- Timeout seconds for startupProbe timeoutSeconds: 5 - # -- Failure threshold count for startupProbe failureThreshold: 6 - # -- Success threshold count for startupProbe successThreshold: 1 -# @ignored tests: bash: + ## @param tests.bash.image.registry The OCI registry to pull the image from + ## @param tests.bash.image.repository The repository within the registry + ## @param tests.bash.image.pullPolicy The image pull policy + ## @param tests.bash.image.version This value is deprecated in favor of tag. (Will be removed in a future release) + ## @param tests.bash.image.tag Overrides the image tag whose default is the chart appVersion + ## image: - # -- The OCI registry to pull the image from registry: cgr.dev - # -- The repository within the registry repository: chainguard/bash - # -- The image pull policy pullPolicy: IfNotPresent - # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" - # -- Overrides the image tag tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4 diff --git a/charts/spire/templates/NOTES.txt b/charts/spire/templates/NOTES.txt index dfe3e24..519b6c1 100644 --- a/charts/spire/templates/NOTES.txt +++ b/charts/spire/templates/NOTES.txt @@ -1 +1,8 @@ Installed {{ .Chart.Name }}… +{{- $up := (index .Values "spire-server").unsupportedBuiltInPlugins }} +{{- $s := add (len $up.keyManager) (len $up.nodeAttestor) (len $up.upstreamAuthority) (len $up.notifier) }} +{{- if gt $s 0 }} + +Warning: + You are using an unsupported plugin. Functionality of this release and future upgrades are not guaranteed to work smoothly. +{{- end }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 8b18fbc..06493fa 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -1,30 +1,34 @@ -# You can enable config/features that affect all services here. +# Default configuration for Spire chart +# SPDX-License-Identifier: APACHE-2.0 + +## @section Global parameters +## Note: the parameter values specified here will override the chart level values for these parameters. +## global: k8s: - # -- This is the value of your clusters `kubeadm init --service-dns-domain` flag + ## @param global.k8s.clusterDomain Cluster domain name configured for Spire install clusterDomain: cluster.local spire: - # -- The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) - clusterName: example-cluster - # -- The trust domain to be used for the SPIFFE identifiers - trustDomain: example.org - # -- Set the jwt issuer - jwtIssuer: https://oidc-discovery.example.org - # -- Override all instances of bundleConfigMap + ## @param global.spire.bundleConfigMap A configmap containing the Spire bundle bundleConfigMap: "" - - # -- Set what address to use for the upstream server when using nested spire + ## @param global.spire.clusterName The name of the k8s cluster for Spire install + clusterName: example-cluster + ## @param global.spire.jwtIssuer The issuer for Spire JWT tokens + jwtIssuer: oidc-discovery.example.org + ## @param global.spire.trustDomain The trust domain for Spire install + trustDomain: example.org + ## @param global.spire.upstreamServerAddress Set what address to use for the upstream server when using nested spire upstreamServerAddress: "" image: - # -- Override all Spire image registries at once + ## @param global.spire.image.registry Override all Spire image registries at once registry: "" installAndUpgradeHooks: - # -- Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) + ## @param global.installAndUpgradeHooks.enabled Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) enabled: true deleteHooks: - # -- Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) + ## @param global.deleteHooks.enabled Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) enabled: true # telemetry: @@ -36,54 +40,88 @@ global: # namespace: "kube-prometheus-system" # labels: {} -# subcharts -spire-server: - # -- Enables deployment of SPIRE Server - enabled: true - nameOverride: server +## subcharts +## @section Spire server parameters +## Parameter values for Spire server +## +spire-server: + ## @param spire-server.enabled Flag to enable Spire server + enabled: true + ## @param spire-server.nameOverride Overrides the name of Spire server pods + nameOverride: server controllerManager: - # -- Enables deployment of Controller Manager + ## @param spire-server.controllerManager.enabled Enable controller manager and provision CRD's enabled: true +## @section Spire agent parameters +## Parameter values for Spire agent +## spire-agent: - # -- Enables deployment of SPIRE Agent(s) + ## @param spire-agent.enabled Flag to enable Spire agent enabled: true + ## @param spire-agent.nameOverride Overrides the name of Spire agent pods nameOverride: agent +## @section Upstream Spire agent and CSI driver configuration +## Parameter values enabling upstream spire agent and CSI driver +## upstream: - # -- enable upstream agent and driver for use with nested spire. + ## @param upstream.enabled Enable upstream agent and driver for use with nested spire enabled: false +## @section Upstream Spire agent parameters +## Parameter values for upstream Spire agent +## upstream-spire-agent: - # @ignored + ## @param upstream-spire-agent.upstream Flag for enabling upstream Spire agent upstream: true + ## @param upstream-spire-agent.nameOverride Name override for upstream Spire agent nameOverride: agent-upstream + ## @param upstream-spire-agent.bundleConfigMap The configmap name for upstream Spire agent bundle bundleConfigMap: spire-bundle-upstream - + ## @param upstream-spire-agent.socketPath Socket path where Spire agent socket is mounted socketPath: /run/spire/agent-sockets-upstream/spire-agent.sock serviceAccount: + ## @param upstream-spire-agent.serviceAccount.name Service account name for upstream Spire agent name: spire-agent-upstream healthChecks: + ## @param upstream-spire-agent.healthChecks.port Health check port number for upstream Spire agent port: 9981 telemetry: prometheus: + ## @param upstream-spire-agent.telemetry.prometheus.port The port where prometheus metrics are available port: 9989 +## @section SPIFFE CSI Driver parameters +## Parameter values for spiffe-csi-driver +## spiffe-csi-driver: - # -- Enables deployment of CSI driver + ## @param spiffe-csi-driver.enabled Flag to enable spiffe-csi-driver for the cluster enabled: true +## @section Upstream SPIFFE CSI Driver parameters +## Parameter values for upstream spiffe-csi-driver +## upstream-spiffe-csi-driver: + ## @param upstream-spiffe-csi-driver.pluginName The plugin name for configuring upstream Spiffe CSI driver pluginName: upstream.csi.spiffe.io + ## @param upstream-spiffe-csi-driver.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket agentSocketPath: /run/spire/agent-sockets-upstream/spire-agent.sock healthChecks: + ## @param upstream-spiffe-csi-driver.healthChecks.port The port where Spiffe CSI driver health checks are exposed port: 9810 +## @section SPIFFE oidc discovery provider parameters +## Parameter values for spiffe-oidc-discovery-provider +## spiffe-oidc-discovery-provider: - # -- Enables deployment of OIDC discovery provider + ## @param spiffe-oidc-discovery-provider.enabled Flag to enable spiffe-oidc-discovery-provider for the cluster enabled: false +## @section Tornjak frontend parameters +## Parameter values for Tornjak frontend +## tornjak-frontend: - # -- Enables deployment of Tornjak frontend/UI (Not for production) + ## @param tornjak-frontend.enabled Enables deployment of Tornjak frontend/UI (Not for production) enabled: false diff --git a/examples/external-mysql/run-tests.sh b/examples/external-mysql/run-tests.sh index b6b5ee5..76d6c1b 100755 --- a/examples/external-mysql/run-tests.sh +++ b/examples/external-mysql/run-tests.sh @@ -12,31 +12,35 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh" # shellcheck source=/dev/null source "${TESTDIR}/common.sh" -helm_install=(helm upgrade --install --create-namespace) -ns=spire-system - teardown() { - helm uninstall --namespace "${ns}" spire 2>/dev/null || true - kubectl delete ns "${ns}" 2>/dev/null || true - + helm uninstall --namespace "spire-server" spire 2>/dev/null || true helm uninstall --namespace mysql mysql 2>/dev/null || true - kubectl delete ns mysql 2>/dev/null || true + kubectl delete ns spire-server 2>/dev/null || true + kubectl delete ns spire-system 2>/dev/null || true } trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT -"${helm_install[@]}" mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \ - --namespace mysql \ +kubectl create namespace spire-system --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true +kubectl create namespace spire-server --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted || true + +helm upgrade --install mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \ + --namespace spire-server \ --values "${DEPS}/mysql.yaml" \ --wait -"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" \ +helm upgrade --install --namespace "spire-server" \ + --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml" \ --set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire -helm test --namespace "${ns}" spire +helm test --namespace "spire-server" spire print_helm_releases -print_spire_workload_status "${ns}" +print_spire_workload_status spire-server +print_spire_workload_status spire-system if [[ "$1" -ne 0 ]]; then - get_namespace_details "${ns}" + get_namespace_details spire-server + get_namespace_details spire-system fi diff --git a/examples/external-mysql/values.yaml b/examples/external-mysql/values.yaml index 129ee27..c6354a4 100644 --- a/examples/external-mysql/values.yaml +++ b/examples/external-mysql/values.yaml @@ -1,9 +1,10 @@ spire-server: + replicaCount: 2 dataStore: sql: databaseType: mysql databaseName: spire-server - host: mysql.mysql + host: mysql port: 3306 username: spire # password: CHANGE_ME diff --git a/examples/external-postgresql/run-tests.sh b/examples/external-postgresql/run-tests.sh index 1ffe1f6..fdb310d 100755 --- a/examples/external-postgresql/run-tests.sh +++ b/examples/external-postgresql/run-tests.sh @@ -12,31 +12,35 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh" # shellcheck source=/dev/null source "${TESTDIR}/common.sh" -helm_install=(helm upgrade --install --create-namespace) -ns=spire-system - teardown() { - helm uninstall --namespace "${ns}" spire 2>/dev/null || true - kubectl delete ns "${ns}" 2>/dev/null || true - - helm uninstall --namespace postgresql postgresql 2>/dev/null || true - kubectl delete ns postgresql 2>/dev/null || true + helm uninstall --namespace "spire-server" spire 2>/dev/null || true + helm uninstall --namespace "spire-server" postgresql 2>/dev/null || true + kubectl delete ns spire-server 2>/dev/null || true + kubectl delete ns spire-system 2>/dev/null || true } trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT -"${helm_install[@]}" postgresql postgresql --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \ - --namespace postgresql \ - --values "${DEPS}/postgresql.yaml" \ +kubectl create namespace spire-system --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true +kubectl create namespace spire-server --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted || true + +helm upgrade --install postgresql postgresql --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \ + --namespace spire-server \ + --values "${DEPS}/postgresql.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml" \ --wait -"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" \ +helm upgrade --install --namespace "spire-server" \ + --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml" \ --set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire -helm test --namespace "${ns}" spire +helm test --namespace "spire-server" spire print_helm_releases -print_spire_workload_status "${ns}" +print_spire_workload_status spire-server +print_spire_workload_status spire-system if [[ "$1" -ne 0 ]]; then - get_namespace_details "${ns}" + get_namespace_details spire-server + get_namespace_details spire-system fi diff --git a/examples/external-postgresql/values.yaml b/examples/external-postgresql/values.yaml index 8972e87..4d191a2 100644 --- a/examples/external-postgresql/values.yaml +++ b/examples/external-postgresql/values.yaml @@ -1,9 +1,10 @@ spire-server: + replicaCount: 2 dataStore: sql: databaseType: postgres databaseName: spire-server - host: postgresql.postgresql + host: postgresql port: 5432 username: spire # password: CHANGE_ME diff --git a/examples/production/README.md b/examples/production/README.md index 8b7b196..7787c2c 100644 --- a/examples/production/README.md +++ b/examples/production/README.md @@ -8,16 +8,26 @@ kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privil kubectl create namespace "spire-server" kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted +```shell helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml ``` -See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup. +If your using ingress-nginx and want to expose the spiffe oidc discovery provider outside the +cluster, add the following to the end of the helm upgrade example: + +```shell +-f values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml +``` If you want to expose your spire-server outside of Kubernetes and are using ingress-nginx, add following values file when running `helm template/install/upgrade`. ```shell -f values-expose-spire-server-ingress-nginx.yaml ``` +For example: +```shell +helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-spire-server-ingress-nginx.yaml +``` If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx you have two options as described here: @@ -28,9 +38,20 @@ If you chose profile https_web, use: ```shell -f values-expose-federation-https-web-ingress-nginx.yaml ``` +For example: +```shell +helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-web-ingress-nginx.yaml +``` If you chose profile https_spiffe, use: ```shell -f values-expose-federation-https-spiffe-ingress-nginx.yaml ``` +For example: +```shell +helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-spiffe-ingress-nginx.yaml +``` + +See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup. + diff --git a/examples/production/run-tests.sh b/examples/production/run-tests.sh index f64f6c2..f47f53a 100755 --- a/examples/production/run-tests.sh +++ b/examples/production/run-tests.sh @@ -5,7 +5,10 @@ set -xe SCRIPT="$(readlink -f "$0")" SCRIPTPATH="$(dirname "${SCRIPT}")" TESTDIR="${SCRIPTPATH}/../../.github/tests" +DEPS="${TESTDIR}/dependencies" +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh" # shellcheck source=/dev/null source "${TESTDIR}/common.sh" @@ -16,6 +19,10 @@ teardown() { helm uninstall --namespace "${ns}" spire 2>/dev/null || true kubectl delete ns "${ns}" 2>/dev/null || true kubectl delete ns spire-system 2>/dev/null || true + helm uninstall --namespace cert-manager cert-manager 2>/dev/null || true + kubectl delete ns cert-manager 2>/dev/null || true + helm uninstall --namespace ingress-nginx 2>/dev/null || true + kubectl delete ns ingress-nginx 2>/dev/null || true } trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT @@ -25,7 +32,61 @@ kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileg kubectl create namespace "${ns}" 2>/dev/null || true kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true -"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" --wait spire charts/spire +"${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \ + --namespace cert-manager \ + --create-namespace \ + --set installCRDs=true \ + --wait + +kubectl apply -f "${DEPS}/testcert.yaml" -n spire-server + +"${helm_install[@]}" ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \ + --namespace ingress-nginx \ + --create-namespace \ + --set controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP \ + --set controller.ingressClassResource.default=true \ + --wait + +ip=$(kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ .spec.clusterIP }}') +echo "$ip" oidc-discovery.example.org + +cat > /tmp/dummydns </dev/null; then + echo >&2 "readme-generator not installed. Installing..." + hash npm 2>/dev/null || { echo >&2 "npm is required to install ${README_GENERATOR_EXE}. Please install npm and rerun the script. Aborting."; exit 1; } + # platform agnostic npm install, also adds into the path + npm install -g "@bitnami/readme-generator-for-helm@${README_GENERATOR_VERSION}" fi -# validate docs -"$SCRIPTPATH/bin/${exe}" --document-dependency-values +# generate docs and show the diff +mapfile -t chart_paths < <(find "$SCRIPTPATH/charts" -type f -iname "Chart.yaml" -exec dirname {} +) +for cpath in "${chart_paths[@]}" +do + echo >&2 "Generating Chart documentation for ${cpath}…" + readme-generator --values="${cpath}/values.yaml" --readme="${cpath}/README.md" +done git diff --exit-code diff --git a/release-chart.sh b/release-chart.sh index 6b3f273..54eedf2 100755 --- a/release-chart.sh +++ b/release-chart.sh @@ -107,7 +107,7 @@ git pull git checkout --track -B "${branch_name}" main commits_since_previous_release="$(git log "${chart}-${current_version}..HEAD" --pretty=format:'* %h %s')" "${SED}" -i "s/version: ${current_version}/version: ${new_version}/" "charts/${chart}/Chart.yaml" -./helm-docs.sh +"${SED}" -i "s/${current_version}/${new_version}/" "charts/${chart}/README.md" git add "charts/${chart}/"{Chart.yaml,README.md} git commit -m "Bump ${chart} Helm Chart version from ${current_version} to ${new_version}" \ -m "${commits_since_previous_release}" \ diff --git a/tests/go.mod b/tests/go.mod index 785c3cd..1f07383 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -3,23 +3,23 @@ module github.com/spiffe/helm-charts/tests go 1.20 require ( - github.com/onsi/ginkgo/v2 v2.11.0 + github.com/onsi/ginkgo/v2 v2.12.0 github.com/onsi/gomega v1.27.10 - helm.sh/helm/v3 v3.11.3 + helm.sh/helm/v3 v3.12.3 ) require ( github.com/BurntSushi/toml v1.2.1 // indirect github.com/Masterminds/goutils v1.1.1 // indirect - github.com/Masterminds/semver/v3 v3.2.0 // indirect + github.com/Masterminds/semver/v3 v3.2.1 // indirect github.com/Masterminds/sprig/v3 v3.2.3 // indirect github.com/cyphar/filepath-securejoin v0.2.3 // indirect github.com/davecgh/go-spew v1.1.1 // indirect github.com/emicklei/go-restful/v3 v3.10.1 // indirect github.com/go-logr/logr v1.2.4 // indirect - github.com/go-openapi/jsonpointer v0.19.5 // indirect - github.com/go-openapi/jsonreference v0.20.0 // indirect - github.com/go-openapi/swag v0.19.14 // indirect + github.com/go-openapi/jsonpointer v0.19.6 // indirect + github.com/go-openapi/jsonreference v0.20.1 // indirect + github.com/go-openapi/swag v0.22.3 // indirect github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect github.com/gobwas/glob v0.2.3 // indirect github.com/gogo/protobuf v1.3.2 // indirect @@ -27,13 +27,13 @@ require ( github.com/google/gnostic v0.5.7-v3refs // indirect github.com/google/go-cmp v0.5.9 // indirect github.com/google/gofuzz v1.2.0 // indirect - github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 // indirect + github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect github.com/google/uuid v1.3.0 // indirect github.com/huandu/xstrings v1.4.0 // indirect github.com/imdario/mergo v0.3.13 // indirect github.com/josharian/intern v1.0.0 // indirect github.com/json-iterator/go v1.1.12 // indirect - github.com/mailru/easyjson v0.7.6 // indirect + github.com/mailru/easyjson v0.7.7 // indirect github.com/mitchellh/copystructure v1.2.0 // indirect github.com/mitchellh/reflectwalk v1.0.2 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect @@ -45,27 +45,27 @@ require ( github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect github.com/xeipuuv/gojsonschema v1.2.0 // indirect - golang.org/x/crypto v0.11.0 // indirect - golang.org/x/net v0.12.0 // indirect + golang.org/x/crypto v0.12.0 // indirect + golang.org/x/net v0.14.0 // indirect golang.org/x/oauth2 v0.4.0 // indirect - golang.org/x/sys v0.10.0 // indirect - golang.org/x/term v0.10.0 // indirect - golang.org/x/text v0.11.0 // indirect + golang.org/x/sys v0.11.0 // indirect + golang.org/x/term v0.11.0 // indirect + golang.org/x/text v0.12.0 // indirect golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect - golang.org/x/tools v0.9.3 // indirect + golang.org/x/tools v0.12.0 // indirect google.golang.org/appengine v1.6.7 // indirect google.golang.org/protobuf v1.28.1 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect - k8s.io/api v0.26.2 // indirect - k8s.io/apiextensions-apiserver v0.26.0 // indirect - k8s.io/apimachinery v0.26.2 // indirect - k8s.io/client-go v0.26.2 // indirect - k8s.io/klog/v2 v2.90.1 // indirect - k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 // indirect + k8s.io/api v0.27.3 // indirect + k8s.io/apiextensions-apiserver v0.27.3 // indirect + k8s.io/apimachinery v0.27.3 // indirect + k8s.io/client-go v0.27.3 // indirect + k8s.io/klog/v2 v2.100.1 // indirect + k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // indirect k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5 // indirect - sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect + sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect sigs.k8s.io/yaml v1.3.0 // indirect ) diff --git a/tests/go.sum b/tests/go.sum index 950921b..187b74f 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -4,8 +4,9 @@ github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ= github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI= github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU= -github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g= github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ= +github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0= +github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ= github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA= github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM= github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU= @@ -28,14 +29,12 @@ github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3 github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ= github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= -github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg= -github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY= -github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg= -github.com/go-openapi/jsonreference v0.20.0 h1:MYlu0sBgChmCfJxxUKZ8g1cPWFOB37YSZqewK7OKeyA= -github.com/go-openapi/jsonreference v0.20.0/go.mod h1:Ag74Ico3lPc+zR+qjn4XBUmXymS4zJbYVCZmcgkasdo= -github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk= -github.com/go-openapi/swag v0.19.14 h1:gm3vOOXfiuw5i9p5N9xJvfjvuofpyvLA9Wr6QfK5Fng= -github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ= +github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE= +github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs= +github.com/go-openapi/jsonreference v0.20.1 h1:FBLnyygC4/IZZr893oiomc9XaghoveYTrLC1F86HID8= +github.com/go-openapi/jsonreference v0.20.1/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k= +github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g= +github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14= github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI= github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls= github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y= @@ -69,8 +68,8 @@ github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0= github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= -github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 h1:yAJXTCF9TqKcTiHJAE8dj7HMvPfh66eeA2JYW7eFpSE= -github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= +github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec= +github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I= github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= @@ -87,17 +86,15 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= +github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0= github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= -github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= -github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= -github.com/mailru/easyjson v0.7.6 h1:8yTIVnZgCoiM1TgqoeTl+LfU5Jg6/xL3QhGQnimLYnA= -github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc= +github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0= +github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc= github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw= github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw= github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s= @@ -111,10 +108,8 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= -github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs= -github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno= -github.com/onsi/ginkgo/v2 v2.11.0 h1:WgqUCUt/lT6yXoQ8Wef0fsNn5cAuMK7+KT9UFRz2tcU= -github.com/onsi/ginkgo/v2 v2.11.0/go.mod h1:ZhrRA5XmEE3x3rhlzamx/JJvujdZoJ2uvgI7kR0iZvM= +github.com/onsi/ginkgo/v2 v2.12.0 h1:UIVDowFPwpg6yMUpPjGkYvf06K3RAiJXUhCxEwQVHRI= +github.com/onsi/ginkgo/v2 v2.12.0/go.mod h1:ZNEzXISYlqpb8S36iN71ifqLi3vVD1rVJGvWRCJOUpQ= github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI= github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= @@ -122,7 +117,7 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= -github.com/rogpeppe/go-internal v1.6.1 h1:/FiVV8dS/e+YqF2JvO3yXRFbBLTIuSDkuC7aBOAvL+k= +github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ= github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o= github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8= github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o= @@ -132,10 +127,15 @@ github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= +github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= +github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8= github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU= github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo= @@ -152,8 +152,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4= -golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA= -golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio= +golang.org/x/crypto v0.12.0 h1:tFM/ta59kqch6LlvYnPa0yx5a83cL2nHflFhYKvv9Yk= +golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE= golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU= @@ -161,7 +161,7 @@ golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHl golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= -golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk= +golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -174,8 +174,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY= -golang.org/x/net v0.12.0 h1:cfawfvKITfUsFCeJIHJrbSxpeu/E81khclypR0GVT50= -golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA= +golang.org/x/net v0.14.0 h1:BONx9s002vGdD9umnlX1Po8vOZmrgH34qlHcD1MfK14= +golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.4.0 h1:NF0gk8LVPg1Ml7SSbGyySuoxdsXitj7TvgvuRxIMc/M= golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec= @@ -195,20 +195,20 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA= -golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.11.0 h1:eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM= +golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc= -golang.org/x/term v0.10.0 h1:3R7pNqamzBraeqj/Tj8qt1aQ2HpmlC+Cx/qL/7hn4/c= -golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o= +golang.org/x/term v0.11.0 h1:F9tnn/DA/Im8nCwm+fX+1/eBwi4qFjRT++MhtVC4ZX0= +golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= -golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4= -golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= +golang.org/x/text v0.12.0 h1:k+n5B8goJNdU7hSvEtMUz3d1Q6D/XW4COJSJR6fN0mc= +golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 h1:vVKdlvoWBphwdxWKrFZEuM0kGgGLxUOYcY4U/2Vjg44= golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -220,8 +220,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= -golang.org/x/tools v0.9.3 h1:Gn1I8+64MsuTb/HpH+LmQtNas23LhUVr3rYZ0eKuaMM= -golang.org/x/tools v0.9.3/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc= +golang.org/x/tools v0.12.0 h1:YW6HUoUmYBpwSgyaGaZq1fHjrBjX1rlpZ54T6mu2kss= +golang.org/x/tools v0.12.0/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= @@ -250,10 +250,9 @@ google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQ google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w= google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU= -gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc= gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw= gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= @@ -266,26 +265,26 @@ gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -helm.sh/helm/v3 v3.11.3 h1:n1X5yaQTP5DYywlBOZMl2gX398Gp6YwFp/IAVj6+5D4= -helm.sh/helm/v3 v3.11.3/go.mod h1:S+sOdQc3BLvt09a9rSlKKVs9x0N/yx+No0y3qFw+FQ8= +helm.sh/helm/v3 v3.12.3 h1:5y1+Sbty12t48T/t/CGNYUIME5BJ0WKfmW/sobYqkFg= +helm.sh/helm/v3 v3.12.3/go.mod h1:KPKQiX9IP5HX7o5YnnhViMnNuKiL/lJBVQ47GHe1R0k= honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= -k8s.io/api v0.26.2 h1:dM3cinp3PGB6asOySalOZxEG4CZ0IAdJsrYZXE/ovGQ= -k8s.io/api v0.26.2/go.mod h1:1kjMQsFE+QHPfskEcVNgL3+Hp88B80uj0QtSOlj8itU= -k8s.io/apiextensions-apiserver v0.26.0 h1:Gy93Xo1eg2ZIkNX/8vy5xviVSxwQulsnUdQ00nEdpDo= -k8s.io/apiextensions-apiserver v0.26.0/go.mod h1:7ez0LTiyW5nq3vADtK6C3kMESxadD51Bh6uz3JOlqWQ= -k8s.io/apimachinery v0.26.2 h1:da1u3D5wfR5u2RpLhE/ZtZS2P7QvDgLZTi9wrNZl/tQ= -k8s.io/apimachinery v0.26.2/go.mod h1:ats7nN1LExKHvJ9TmwootT00Yz05MuYqPXEXaVeOy5I= -k8s.io/client-go v0.26.2 h1:s1WkVujHX3kTp4Zn4yGNFK+dlDXy1bAAkIl+cFAiuYI= -k8s.io/client-go v0.26.2/go.mod h1:u5EjOuSyBa09yqqyY7m3abZeovO/7D/WehVVlZ2qcqU= -k8s.io/klog/v2 v2.90.1 h1:m4bYOKall2MmOiRaR1J+We67Do7vm9KiQVlT96lnHUw= -k8s.io/klog/v2 v2.90.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= -k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+OGxg8HsuBr/5f6tVAjDu6E= -k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4= +k8s.io/api v0.27.3 h1:yR6oQXXnUEBWEWcvPWS0jQL575KoAboQPfJAuKNrw5Y= +k8s.io/api v0.27.3/go.mod h1:C4BNvZnQOF7JA/0Xed2S+aUyJSfTGkGFxLXz9MnpIpg= +k8s.io/apiextensions-apiserver v0.27.3 h1:xAwC1iYabi+TDfpRhxh4Eapl14Hs2OftM2DN5MpgKX4= +k8s.io/apiextensions-apiserver v0.27.3/go.mod h1:BH3wJ5NsB9XE1w+R6SSVpKmYNyIiyIz9xAmBl8Mb+84= +k8s.io/apimachinery v0.27.3 h1:Ubye8oBufD04l9QnNtW05idcOe9Z3GQN8+7PqmuVcUM= +k8s.io/apimachinery v0.27.3/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E= +k8s.io/client-go v0.27.3 h1:7dnEGHZEJld3lYwxvLl7WoehK6lAq7GvgjxpA3nv1E8= +k8s.io/client-go v0.27.3/go.mod h1:2MBEKuTo6V1lbKy3z1euEGnhPfGZLKTS9tiJ2xodM48= +k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg= +k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= +k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f h1:2kWPakN3i/k81b0gvD5C5FJ2kxm1WrQFanWchyKuqGg= +k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f/go.mod h1:byini6yhqGC14c3ebc/QwanvYwhuMWF6yz2F8uwW8eg= k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5 h1:kmDqav+P+/5e1i9tFfHq1qcF3sOrDp+YEkVDAHu7Jwk= k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= -sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 h1:iXTIw73aPyC+oRdyqqvVJuloN1p0AC/kzH07hu3NE+k= -sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0= +sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo= +sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0= sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE= sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E= sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo= diff --git a/tests/unit/spire_test.go b/tests/unit/spire_test.go index 417b7c2..d22c0b8 100644 --- a/tests/unit/spire_test.go +++ b/tests/unit/spire_test.go @@ -41,4 +41,34 @@ spire-server: Expect(notes).Should(ContainSubstring("abc123")) }) }) + Describe("spire-server.customPlugin.tpm", func() { + It("plugin set ok", func() { + objs, err := ValueStringRender(chart, ` +spire-server: + customPlugins: + nodeAttestor: + tpm: + plugin_cmd: /bin/tpm_attestor_server + plugin_checksum: 97442358ae946e3fb8f2464432b8c23efdc0b5d44ec1eea27babe59ef646cc2f + plugin_data: {} +`) + Expect(err).Should(Succeed()) + notes := objs["spire/charts/spire-server/templates/configmap.yaml"] + Expect(notes).Should(ContainSubstring("tpm")) + }) + }) + Describe("spire-server.unsupportedBuiltInPlugins", func() { + It("plugin set ok", func() { + objs, err := ValueStringRender(chart, ` +spire-server: + unsupportedBuiltInPlugins: + nodeAttestor: + join_token: + plugin_data: {} +`) + Expect(err).Should(Succeed()) + notes := objs["spire/charts/spire-server/templates/configmap.yaml"] + Expect(notes).Should(ContainSubstring("join_token")) + }) + }) })