Merge branch 'main' into release
This commit is contained in:
Marco Franssen
@@ -16,3 +16,5 @@ kubeadmConfigPatches:
|
|||||||
nodes:
|
nodes:
|
||||||
- role: control-plane
|
- role: control-plane
|
||||||
- role: worker
|
- role: worker
|
||||||
|
- role: worker
|
||||||
|
- role: worker
|
||||||
|
|||||||
@@ -20,6 +20,11 @@ if ! command -v yq &> /dev/null; then
|
|||||||
exit 1
|
exit 1
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
if ! command -v npm &> /dev/null; then
|
||||||
|
echo Please install npm
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
if ! command -v python3 -c 'import ruamel.yaml' &> /dev/null; then
|
if ! command -v python3 -c 'import ruamel.yaml' &> /dev/null; then
|
||||||
echo Please install python3 with the ruamel.yaml module
|
echo Please install python3 with the ruamel.yaml module
|
||||||
exit 1
|
exit 1
|
||||||
@@ -46,10 +51,13 @@ jq -r '. | keys[]' "$IMAGEJSON" | while read -r CHART; do
|
|||||||
REGISTRY=$(yq e ".${QUERY}.registry" "$VALUES")
|
REGISTRY=$(yq e ".${QUERY}.registry" "$VALUES")
|
||||||
REPOSITORY=$(yq e ".${QUERY}.repository" "$VALUES")
|
REPOSITORY=$(yq e ".${QUERY}.repository" "$VALUES")
|
||||||
VERSION=$(yq e ".${QUERY}.tag" "$VALUES")
|
VERSION=$(yq e ".${QUERY}.tag" "$VALUES")
|
||||||
|
if [[ "$REGISTRY" != "" ]]; then
|
||||||
|
REGISTRY="$REGISTRY/"
|
||||||
|
fi
|
||||||
if [[ "$FILTER" == "LATESTSHA" ]]; then
|
if [[ "$FILTER" == "LATESTSHA" ]]; then
|
||||||
LATEST_VERSION="latest@"$(crane digest "${REGISTRY}/${REPOSITORY}:latest")
|
LATEST_VERSION="latest@"$(crane digest "${REGISTRY}${REPOSITORY}:latest")
|
||||||
else
|
else
|
||||||
LATEST_VERSION=$(crane ls "${REGISTRY}/${REPOSITORY}" | grep "${FILTER}" | sort "${SORTFLAGS[@]}"| tail -n 1)
|
LATEST_VERSION=$(crane ls "${REGISTRY}${REPOSITORY}" | grep "${FILTER}" | sort "${SORTFLAGS[@]}" | tail -n 1)
|
||||||
fi
|
fi
|
||||||
|
|
||||||
export QUERY
|
export QUERY
|
||||||
@@ -57,7 +65,7 @@ jq -r '. | keys[]' "$IMAGEJSON" | while read -r CHART; do
|
|||||||
export LATEST_VERSION
|
export LATEST_VERSION
|
||||||
|
|
||||||
if [ "${VERSION}" != "${LATEST_VERSION}" ]; then
|
if [ "${VERSION}" != "${LATEST_VERSION}" ]; then
|
||||||
echo "New image version found: ${REGISTRY}/${REPOSITORY}:${LATEST_VERSION}"
|
echo "New image version found: ${REGISTRY}${REPOSITORY}:${LATEST_VERSION}"
|
||||||
"${SCRIPTPATH}/edit-yaml.py" > /tmp/$$
|
"${SCRIPTPATH}/edit-yaml.py" > /tmp/$$
|
||||||
mv /tmp/$$ "${VALUES}"
|
mv /tmp/$$ "${VALUES}"
|
||||||
fi
|
fi
|
||||||
|
|||||||
@@ -0,0 +1,52 @@
|
|||||||
|
---
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: Issuer
|
||||||
|
metadata:
|
||||||
|
name: selfsigned-issuer
|
||||||
|
spec:
|
||||||
|
selfSigned: {}
|
||||||
|
---
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: Certificate
|
||||||
|
metadata:
|
||||||
|
name: demo-selfsigned-ca
|
||||||
|
spec:
|
||||||
|
isCA: true
|
||||||
|
commonName: demo-selfsigned-ca
|
||||||
|
secretName: root-secret
|
||||||
|
privateKey:
|
||||||
|
algorithm: ECDSA
|
||||||
|
size: 256
|
||||||
|
issuerRef:
|
||||||
|
name: selfsigned-issuer
|
||||||
|
kind: Issuer
|
||||||
|
group: cert-manager.io
|
||||||
|
subject:
|
||||||
|
countries:
|
||||||
|
- US
|
||||||
|
organizations:
|
||||||
|
- test
|
||||||
|
organizationalUnits:
|
||||||
|
- test
|
||||||
|
---
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: Issuer
|
||||||
|
metadata:
|
||||||
|
name: demo-ca
|
||||||
|
spec:
|
||||||
|
ca:
|
||||||
|
secretName: root-secret
|
||||||
|
---
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: Certificate
|
||||||
|
metadata:
|
||||||
|
name: oidc
|
||||||
|
spec:
|
||||||
|
dnsNames:
|
||||||
|
- oidc-discovery.example.org
|
||||||
|
- spire-server-federation.example.org
|
||||||
|
secretName: tls-cert
|
||||||
|
issuerRef:
|
||||||
|
name: demo-ca
|
||||||
|
kind: Issuer
|
||||||
|
group: cert-manager.io
|
||||||
@@ -39,6 +39,16 @@
|
|||||||
"query": "tests.bash.image",
|
"query": "tests.bash.image",
|
||||||
"filter": "LATESTSHA",
|
"filter": "LATESTSHA",
|
||||||
"sort-flags": []
|
"sort-flags": []
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"query": "tests.toolkit.image",
|
||||||
|
"filter": "LATESTSHA",
|
||||||
|
"sort-flags": []
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"query": "tests.busybox.image",
|
||||||
|
"filter": "^[0-9]\\+\\.[0-9]\\+\\.[0-9]\\+-uclibc$",
|
||||||
|
"sort-flags": ["-t", ".", "-k1,1n", "-k2,2n", "-k3,3n"]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"tornjak-frontend/values.yaml": [
|
"tornjak-frontend/values.yaml": [
|
||||||
|
|||||||
@@ -20,7 +20,7 @@ jobs:
|
|||||||
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout
|
- name: Checkout
|
||||||
uses: actions/checkout@v3.5.3
|
uses: actions/checkout@v4.0.0
|
||||||
|
|
||||||
- name: Set up Helm
|
- name: Set up Helm
|
||||||
uses: azure/[email protected]
|
uses: azure/[email protected]
|
||||||
@@ -34,6 +34,8 @@ jobs:
|
|||||||
|
|
||||||
- name: Setup go
|
- name: Setup go
|
||||||
uses: actions/[email protected]
|
uses: actions/[email protected]
|
||||||
|
with:
|
||||||
|
go-version: '1.21'
|
||||||
|
|
||||||
- name: Setup crane
|
- name: Setup crane
|
||||||
uses: imjasonh/[email protected]
|
uses: imjasonh/[email protected]
|
||||||
@@ -42,13 +44,17 @@ jobs:
|
|||||||
with:
|
with:
|
||||||
python-version: '3.9'
|
python-version: '3.9'
|
||||||
|
|
||||||
|
- name: Install ubuntu packages
|
||||||
|
run: sudo apt-get install wget apt-transport-https gnupg lsb-release
|
||||||
|
|
||||||
|
- name: Install yq
|
||||||
|
run: go install github.com/mikefarah/yq/v4@latest
|
||||||
|
|
||||||
|
- name: Install python dependencies
|
||||||
|
run: pip install -r .github/scripts/requirements.txt
|
||||||
|
|
||||||
- name: Update image tags
|
- name: Update image tags
|
||||||
run: |
|
run: |
|
||||||
go install github.com/mikefarah/yq/v4@latest
|
|
||||||
|
|
||||||
sudo apt-get install wget apt-transport-https gnupg lsb-release
|
|
||||||
sudo pip install -r .github/scripts/requirements.txt
|
|
||||||
|
|
||||||
./.github/scripts/update-tags.sh
|
./.github/scripts/update-tags.sh
|
||||||
git diff
|
git diff
|
||||||
|
|
||||||
|
|||||||
@@ -43,7 +43,7 @@ jobs:
|
|||||||
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout
|
- name: Checkout
|
||||||
uses: actions/checkout@v3.5.3
|
uses: actions/checkout@v4.0.0
|
||||||
|
|
||||||
- id: set-matrix
|
- id: set-matrix
|
||||||
name: Collect all examples
|
name: Collect all examples
|
||||||
|
|||||||
@@ -32,7 +32,7 @@ jobs:
|
|||||||
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout
|
- name: Checkout
|
||||||
uses: actions/checkout@v3.5.3
|
uses: actions/checkout@v4.0.0
|
||||||
|
|
||||||
- name: Verify Docs updated
|
- name: Verify Docs updated
|
||||||
run: ./helm-docs.sh
|
run: ./helm-docs.sh
|
||||||
@@ -94,7 +94,7 @@ jobs:
|
|||||||
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout
|
- name: Checkout
|
||||||
uses: actions/checkout@v3.5.3
|
uses: actions/checkout@v4.0.0
|
||||||
with:
|
with:
|
||||||
fetch-depth: 0
|
fetch-depth: 0
|
||||||
|
|
||||||
@@ -136,7 +136,7 @@ jobs:
|
|||||||
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout
|
- name: Checkout
|
||||||
uses: actions/checkout@v3.5.3
|
uses: actions/checkout@v4.0.0
|
||||||
with:
|
with:
|
||||||
fetch-depth: 0
|
fetch-depth: 0
|
||||||
|
|
||||||
@@ -184,7 +184,7 @@ jobs:
|
|||||||
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout
|
- name: Checkout
|
||||||
uses: actions/checkout@v3.5.3
|
uses: actions/checkout@v4.0.0
|
||||||
|
|
||||||
- id: set-matrix
|
- id: set-matrix
|
||||||
name: Collect all examples
|
name: Collect all examples
|
||||||
@@ -216,7 +216,7 @@ jobs:
|
|||||||
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout
|
- name: Checkout
|
||||||
uses: actions/checkout@v3.5.3
|
uses: actions/checkout@v4.0.0
|
||||||
|
|
||||||
- name: Set up Helm
|
- name: Set up Helm
|
||||||
uses: azure/[email protected]
|
uses: azure/[email protected]
|
||||||
|
|||||||
@@ -19,7 +19,7 @@ jobs:
|
|||||||
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout
|
- name: Checkout
|
||||||
uses: actions/checkout@v3.5.3
|
uses: actions/checkout@v4.0.0
|
||||||
with:
|
with:
|
||||||
fetch-depth: 0
|
fetch-depth: 0
|
||||||
|
|
||||||
@@ -29,9 +29,9 @@ jobs:
|
|||||||
git config user.email "[email protected]"
|
git config user.email "[email protected]"
|
||||||
|
|
||||||
- name: Setup cosign
|
- name: Setup cosign
|
||||||
uses: sigstore/[email protected].1
|
uses: sigstore/[email protected].2
|
||||||
with:
|
with:
|
||||||
cosign-release: v2.1.1
|
cosign-release: v2.2.0
|
||||||
|
|
||||||
- name: Set up Helm
|
- name: Set up Helm
|
||||||
uses: azure/[email protected]
|
uses: azure/[email protected]
|
||||||
@@ -44,7 +44,7 @@ jobs:
|
|||||||
CR_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
|
CR_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
|
||||||
|
|
||||||
- name: Login to GitHub Container Registry
|
- name: Login to GitHub Container Registry
|
||||||
uses: docker/login-action@v2
|
uses: docker/login-action@v3
|
||||||
with:
|
with:
|
||||||
registry: ghcr.io
|
registry: ghcr.io
|
||||||
username: ${{ github.actor }}
|
username: ${{ github.actor }}
|
||||||
|
|||||||
@@ -21,7 +21,7 @@ jobs:
|
|||||||
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout
|
- name: Checkout
|
||||||
uses: actions/checkout@v3.5.3
|
uses: actions/checkout@v4.0.0
|
||||||
|
|
||||||
- name: Run Shellcheck
|
- name: Run Shellcheck
|
||||||
uses: ludeeus/[email protected]
|
uses: ludeeus/[email protected]
|
||||||
|
|||||||
+3
-3
@@ -48,14 +48,14 @@ Another approach to testing the chart is by installing one of the examples in yo
|
|||||||
|
|
||||||
## Generating documentation
|
## Generating documentation
|
||||||
|
|
||||||
Any changes to Chart.yaml or values.yaml require an update of the README.md. This update can easily be generated using [helm-docs][].
|
Any changes to Chart.yaml or values.yaml require an update of the README.md. This update can easily be generated using [readme-generator](https://github.com/bitnami-labs/readme-generator-for-helm).
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
./helm-docs.sh charts/«chart-name»
|
./helm-docs.sh
|
||||||
```
|
```
|
||||||
|
|
||||||
## Bumping Chart version
|
## Bumping Chart version
|
||||||
|
|
||||||
In contrary to many other Helm repositories we do NOT require contributors to increate the Chart version. We have customized our release pipeline so we can bundle various PRs in a single release. Maintainers of the helm-charts in this repo will take care of the semantic versioning.
|
In contrary to many other Helm repositories we do NOT require contributors to increate the Chart version. We have customized our release pipeline so we can bundle various PRs in a single release. Maintainers of the helm-charts in this repo will take care of the semantic versioning.
|
||||||
|
|
||||||
[helm-docs]: https://github.com/norwoodj/helm-docs "Generate documentation for your Helm chart."
|
[readme-generator]: https://github.com/bitnami-labs/readme-generator-for-helm "Auto generate READMEs for Helm Charts."
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ name: spire
|
|||||||
description: >
|
description: >
|
||||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||||
type: application
|
type: application
|
||||||
version: 0.12.0
|
version: 0.13.0
|
||||||
appVersion: "1.7.2"
|
appVersion: "1.7.2"
|
||||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||||
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
||||||
|
|||||||
+75
-496
@@ -1,8 +1,6 @@
|
|||||||
# spire
|
# spire
|
||||||
|
|
||||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
  
|
||||||
|
|
||||||
  
|
|
||||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||||
|
|
||||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||||
@@ -85,498 +83,79 @@ Now you can interact with the Spire agent socket from your own application. The
|
|||||||
| file://./charts/spire-server | spire-server | 0.1.0 |
|
| file://./charts/spire-server | spire-server | 0.1.0 |
|
||||||
| file://./charts/tornjak-frontend | tornjak-frontend | 0.1.0 |
|
| file://./charts/tornjak-frontend | tornjak-frontend | 0.1.0 |
|
||||||
|
|
||||||
## Values
|
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||||
|
|
||||||
| Key | Type | Default | Description |
|
## Parameters
|
||||||
|-----|------|---------|-------------|
|
|
||||||
| global.deleteHooks.enabled | bool | `true` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) |
|
|
||||||
| global.installAndUpgradeHooks.enabled | bool | `true` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) |
|
|
||||||
| global.k8s.clusterDomain | string | `"cluster.local"` | |
|
|
||||||
| global.spire.bundleConfigMap | string | `""` | Override all instances of bundleConfigMap |
|
|
||||||
| global.spire.clusterName | string | `"example-cluster"` | |
|
|
||||||
| global.spire.image.registry | string | `""` | Override all Spire image registries at once |
|
|
||||||
| global.spire.jwtIssuer | string | `"https://oidc-discovery.example.org"` | Set the jwt issuer |
|
|
||||||
| global.spire.trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers |
|
|
||||||
| global.spire.upstreamServerAddress | string | `""` | Set what address to use for the upstream server when using nested spire |
|
|
||||||
| spiffe-csi-driver.enabled | bool | `true` | Enables deployment of CSI driver |
|
|
||||||
| spiffe-oidc-discovery-provider.enabled | bool | `false` | Enables deployment of OIDC discovery provider |
|
|
||||||
| spire-agent.enabled | bool | `true` | Enables deployment of SPIRE Agent(s) |
|
|
||||||
| spire-agent.nameOverride | string | `"agent"` | |
|
|
||||||
| spire-server.controllerManager.enabled | bool | `true` | Enables deployment of Controller Manager |
|
|
||||||
| spire-server.enabled | bool | `true` | Enables deployment of SPIRE Server |
|
|
||||||
| spire-server.nameOverride | string | `"server"` | |
|
|
||||||
| tornjak-frontend.enabled | bool | `false` | Enables deployment of Tornjak frontend/UI (Not for production) |
|
|
||||||
| upstream-spiffe-csi-driver.agentSocketPath | string | `"/run/spire/agent-sockets-upstream/spire-agent.sock"` | |
|
|
||||||
| upstream-spiffe-csi-driver.healthChecks.port | int | `9810` | |
|
|
||||||
| upstream-spiffe-csi-driver.pluginName | string | `"upstream.csi.spiffe.io"` | |
|
|
||||||
| upstream-spire-agent.bundleConfigMap | string | `"spire-bundle-upstream"` | |
|
|
||||||
| upstream-spire-agent.healthChecks.port | int | `9981` | |
|
|
||||||
| upstream-spire-agent.nameOverride | string | `"agent-upstream"` | |
|
|
||||||
| upstream-spire-agent.serviceAccount.name | string | `"spire-agent-upstream"` | |
|
|
||||||
| upstream-spire-agent.socketPath | string | `"/run/spire/agent-sockets-upstream/spire-agent.sock"` | |
|
|
||||||
| upstream-spire-agent.telemetry.prometheus.port | int | `9989` | |
|
|
||||||
| upstream.enabled | bool | `false` | enable upstream agent and driver for use with nested spire. |
|
|
||||||
| spiffe-csi-driver.agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent |
|
|
||||||
| spiffe-csi-driver.fullnameOverride | string | `""` | |
|
|
||||||
| spiffe-csi-driver.healthChecks.port | int | `9809` | |
|
|
||||||
| spiffe-csi-driver.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| spiffe-csi-driver.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
|
|
||||||
| spiffe-csi-driver.image.repository | string | `"spiffe/spiffe-csi-driver"` | The repository within the registry |
|
|
||||||
| spiffe-csi-driver.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion |
|
|
||||||
| spiffe-csi-driver.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| spiffe-csi-driver.imagePullSecrets | list | `[]` | |
|
|
||||||
| spiffe-csi-driver.kubeletPath | string | `"/var/lib/kubelet"` | |
|
|
||||||
| spiffe-csi-driver.livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe |
|
|
||||||
| spiffe-csi-driver.livenessProbe.timeoutSeconds | int | `5` | Timeout value in seconds for livenessProbe |
|
|
||||||
| spiffe-csi-driver.nameOverride | string | `""` | |
|
|
||||||
| spiffe-csi-driver.namespaceOverride | string | `""` | |
|
|
||||||
| spiffe-csi-driver.nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| spiffe-csi-driver.nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | The OCI registry to pull the image from |
|
|
||||||
| spiffe-csi-driver.nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | The repository within the registry |
|
|
||||||
| spiffe-csi-driver.nodeDriverRegistrar.image.tag | string | `"v2.8.0"` | Overrides the image tag |
|
|
||||||
| spiffe-csi-driver.nodeDriverRegistrar.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| spiffe-csi-driver.nodeDriverRegistrar.resources | object | `{}` | |
|
|
||||||
| spiffe-csi-driver.nodeSelector | object | `{}` | |
|
|
||||||
| spiffe-csi-driver.pluginName | string | `"csi.spiffe.io"` | Set the csi driver name deployed to Kubernetes. |
|
|
||||||
| spiffe-csi-driver.podAnnotations | object | `{}` | |
|
|
||||||
| spiffe-csi-driver.podSecurityContext | object | `{}` | |
|
|
||||||
| spiffe-csi-driver.priorityClassName | string | `""` | Priority class assigned to daemonset pods |
|
|
||||||
| spiffe-csi-driver.resources | object | `{}` | |
|
|
||||||
| spiffe-csi-driver.securityContext.privileged | bool | `true` | |
|
|
||||||
| spiffe-csi-driver.securityContext.readOnlyRootFilesystem | bool | `true` | |
|
|
||||||
| spiffe-csi-driver.serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
|
|
||||||
| spiffe-csi-driver.serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
|
|
||||||
| spiffe-csi-driver.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
|
|
||||||
| spiffe-csi-driver.tolerations | list | `[]` | |
|
|
||||||
| spiffe-oidc-discovery-provider.affinity | object | `{}` | |
|
|
||||||
| spiffe-oidc-discovery-provider.agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket |
|
|
||||||
| spiffe-oidc-discovery-provider.annotations | object | `{}` | Annotations for the deployment |
|
|
||||||
| spiffe-oidc-discovery-provider.autoscaling.enabled | bool | `false` | |
|
|
||||||
| spiffe-oidc-discovery-provider.autoscaling.maxReplicas | int | `5` | |
|
|
||||||
| spiffe-oidc-discovery-provider.autoscaling.minReplicas | int | `1` | |
|
|
||||||
| spiffe-oidc-discovery-provider.autoscaling.targetCPUUtilizationPercentage | int | `80` | |
|
|
||||||
| spiffe-oidc-discovery-provider.autoscaling.targetMemoryUtilizationPercentage | int | `80` | |
|
|
||||||
| spiffe-oidc-discovery-provider.clusterDomain | string | `"cluster.local"` | |
|
|
||||||
| spiffe-oidc-discovery-provider.config.acme.cacheDir | string | `"/run/spire"` | |
|
|
||||||
| spiffe-oidc-discovery-provider.config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | |
|
|
||||||
| spiffe-oidc-discovery-provider.config.acme.emailAddress | string | `"[email protected]"` | |
|
|
||||||
| spiffe-oidc-discovery-provider.config.acme.tosAccepted | bool | `false` | |
|
|
||||||
| spiffe-oidc-discovery-provider.config.additionalDomains | list | `["localhost"]` | Add additional domains that can be used for oidc discovery |
|
|
||||||
| spiffe-oidc-discovery-provider.config.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
|
|
||||||
| spiffe-oidc-discovery-provider.configMap.annotations | object | `{}` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap |
|
|
||||||
| spiffe-oidc-discovery-provider.deleteHook.enabled | bool | `true` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) |
|
|
||||||
| spiffe-oidc-discovery-provider.fullnameOverride | string | `""` | |
|
|
||||||
| spiffe-oidc-discovery-provider.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| spiffe-oidc-discovery-provider.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
|
|
||||||
| spiffe-oidc-discovery-provider.image.repository | string | `"spiffe/oidc-discovery-provider"` | The repository within the registry |
|
|
||||||
| spiffe-oidc-discovery-provider.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion |
|
|
||||||
| spiffe-oidc-discovery-provider.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| spiffe-oidc-discovery-provider.imagePullSecrets | list | `[]` | |
|
|
||||||
| spiffe-oidc-discovery-provider.ingress.annotations | object | `{}` | |
|
|
||||||
| spiffe-oidc-discovery-provider.ingress.className | string | `""` | |
|
|
||||||
| spiffe-oidc-discovery-provider.ingress.enabled | bool | `false` | |
|
|
||||||
| spiffe-oidc-discovery-provider.ingress.hosts[0].host | string | `"oidc-discovery.example.org"` | |
|
|
||||||
| spiffe-oidc-discovery-provider.ingress.hosts[0].paths[0].path | string | `"/"` | |
|
|
||||||
| spiffe-oidc-discovery-provider.ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | |
|
|
||||||
| spiffe-oidc-discovery-provider.ingress.tls | list | `[]` | |
|
|
||||||
| spiffe-oidc-discovery-provider.insecureScheme.enabled | bool | `false` | |
|
|
||||||
| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
|
|
||||||
| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.repository | string | `"nginxinc/nginx-unprivileged"` | The repository within the registry |
|
|
||||||
| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.tag | string | `"1.24.0-alpine"` | Overrides the image tag |
|
|
||||||
| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| spiffe-oidc-discovery-provider.insecureScheme.nginx.resources | object | `{}` | |
|
|
||||||
| spiffe-oidc-discovery-provider.jwtIssuer | string | `"https://oidc-discovery.example.org"` | |
|
|
||||||
| spiffe-oidc-discovery-provider.livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe |
|
|
||||||
| spiffe-oidc-discovery-provider.livenessProbe.periodSeconds | int | `5` | Period seconds for livenessProbe |
|
|
||||||
| spiffe-oidc-discovery-provider.nameOverride | string | `""` | |
|
|
||||||
| spiffe-oidc-discovery-provider.namespaceOverride | string | `""` | |
|
|
||||||
| spiffe-oidc-discovery-provider.nodeSelector | object | `{}` | |
|
|
||||||
| spiffe-oidc-discovery-provider.podAnnotations | object | `{}` | |
|
|
||||||
| spiffe-oidc-discovery-provider.podSecurityContext | object | `{}` | |
|
|
||||||
| spiffe-oidc-discovery-provider.readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe |
|
|
||||||
| spiffe-oidc-discovery-provider.readinessProbe.periodSeconds | int | `5` | Period seconds for readinessProbe |
|
|
||||||
| spiffe-oidc-discovery-provider.replicaCount | int | `1` | |
|
|
||||||
| spiffe-oidc-discovery-provider.resources | object | `{}` | |
|
|
||||||
| spiffe-oidc-discovery-provider.securityContext | object | `{}` | |
|
|
||||||
| spiffe-oidc-discovery-provider.service.annotations | object | `{}` | |
|
|
||||||
| spiffe-oidc-discovery-provider.service.port | int | `80` | |
|
|
||||||
| spiffe-oidc-discovery-provider.service.type | string | `"ClusterIP"` | |
|
|
||||||
| spiffe-oidc-discovery-provider.serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
|
|
||||||
| spiffe-oidc-discovery-provider.serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
|
|
||||||
| spiffe-oidc-discovery-provider.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
|
|
||||||
| spiffe-oidc-discovery-provider.telemetry.prometheus.enabled | bool | `false` | |
|
|
||||||
| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
|
|
||||||
| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` | The repository within the registry |
|
|
||||||
| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.tag | string | `"0.11.0"` | Overrides the image tag |
|
|
||||||
| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.resources | object | `{}` | |
|
|
||||||
| spiffe-oidc-discovery-provider.telemetry.prometheus.podMonitor.enabled | bool | `false` | |
|
|
||||||
| spiffe-oidc-discovery-provider.telemetry.prometheus.podMonitor.labels | object | `{}` | |
|
|
||||||
| spiffe-oidc-discovery-provider.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider |
|
|
||||||
| spiffe-oidc-discovery-provider.telemetry.prometheus.port | int | `9988` | |
|
|
||||||
| spiffe-oidc-discovery-provider.tolerations | list | `[]` | |
|
|
||||||
| spiffe-oidc-discovery-provider.tools.kubectl.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| spiffe-oidc-discovery-provider.tools.kubectl.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
|
|
||||||
| spiffe-oidc-discovery-provider.tools.kubectl.image.repository | string | `"rancher/kubectl"` | The repository within the registry |
|
|
||||||
| spiffe-oidc-discovery-provider.tools.kubectl.image.tag | string | `""` | Overrides the image tag |
|
|
||||||
| spiffe-oidc-discovery-provider.tools.kubectl.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| spiffe-oidc-discovery-provider.trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
|
|
||||||
| spire-agent.bundleConfigMap | string | `"spire-bundle"` | |
|
|
||||||
| spire-agent.clusterName | string | `"example-cluster"` | |
|
|
||||||
| spire-agent.configMap.annotations | object | `{}` | Annotations to add to the SPIRE Agent ConfigMap |
|
|
||||||
| spire-agent.extraContainers | list | `[]` | |
|
|
||||||
| spire-agent.extraVolumeMounts | list | `[]` | |
|
|
||||||
| spire-agent.extraVolumes | list | `[]` | |
|
|
||||||
| spire-agent.fsGroupFix.image.pullPolicy | string | `"Always"` | The image pull policy |
|
|
||||||
| spire-agent.fsGroupFix.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
|
|
||||||
| spire-agent.fsGroupFix.image.repository | string | `"chainguard/bash"` | The repository within the registry |
|
|
||||||
| spire-agent.fsGroupFix.image.tag | string | `"latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4"` | Overrides the image tag |
|
|
||||||
| spire-agent.fsGroupFix.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| spire-agent.fsGroupFix.resources | object | `{}` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
|
|
||||||
| spire-agent.fullnameOverride | string | `""` | |
|
|
||||||
| spire-agent.healthChecks.port | int | `9980` | override the host port used for health checking |
|
|
||||||
| spire-agent.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| spire-agent.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
|
|
||||||
| spire-agent.image.repository | string | `"spiffe/spire-agent"` | The repository within the registry |
|
|
||||||
| spire-agent.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
|
|
||||||
| spire-agent.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| spire-agent.imagePullSecrets | list | `[]` | |
|
|
||||||
| spire-agent.initContainers | list | `[]` | |
|
|
||||||
| spire-agent.livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe |
|
|
||||||
| spire-agent.livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe |
|
|
||||||
| spire-agent.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
|
|
||||||
| spire-agent.nameOverride | string | `""` | |
|
|
||||||
| spire-agent.namespaceOverride | string | `""` | |
|
|
||||||
| spire-agent.nodeSelector | object | `{}` | |
|
|
||||||
| spire-agent.podAnnotations | object | `{}` | |
|
|
||||||
| spire-agent.podSecurityContext | object | `{}` | |
|
|
||||||
| spire-agent.priorityClassName | string | `""` | Priority class assigned to daemonset pods |
|
|
||||||
| spire-agent.readinessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for readinessProbe |
|
|
||||||
| spire-agent.readinessProbe.periodSeconds | int | `60` | Period seconds for readinessProbe |
|
|
||||||
| spire-agent.resources | object | `{}` | |
|
|
||||||
| spire-agent.securityContext | object | `{}` | |
|
|
||||||
| spire-agent.server.address | string | `""` | |
|
|
||||||
| spire-agent.server.namespaceOverride | string | `""` | |
|
|
||||||
| spire-agent.server.port | int | `8081` | |
|
|
||||||
| spire-agent.serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
|
|
||||||
| spire-agent.serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
|
|
||||||
| spire-agent.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
|
|
||||||
| spire-agent.socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent |
|
|
||||||
| spire-agent.telemetry.prometheus.enabled | bool | `false` | |
|
|
||||||
| spire-agent.telemetry.prometheus.podMonitor.enabled | bool | `false` | |
|
|
||||||
| spire-agent.telemetry.prometheus.podMonitor.labels | object | `{}` | |
|
|
||||||
| spire-agent.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent |
|
|
||||||
| spire-agent.telemetry.prometheus.port | int | `9988` | |
|
|
||||||
| spire-agent.tolerations | list | `[]` | |
|
|
||||||
| spire-agent.trustBundleFormat | string | `"pem"` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" |
|
|
||||||
| spire-agent.trustBundleURL | string | `""` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap |
|
|
||||||
| spire-agent.trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers |
|
|
||||||
| spire-agent.waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| spire-agent.waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
|
|
||||||
| spire-agent.waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry |
|
|
||||||
| spire-agent.waitForIt.image.tag | string | `"latest@sha256:deeaccb164a67a4d7f585c4d416641b1f422c029911a29d72beae28221f823df"` | Overrides the image tag |
|
|
||||||
| spire-agent.waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| spire-agent.waitForIt.resources | object | `{}` | |
|
|
||||||
| spire-agent.workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio |
|
|
||||||
| spire-agent.workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped |
|
|
||||||
| spire-agent.workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor |
|
|
||||||
| spire-server.affinity | object | `{}` | |
|
|
||||||
| spire-server.autoscaling.enabled | bool | `false` | |
|
|
||||||
| spire-server.autoscaling.maxReplicas | int | `100` | |
|
|
||||||
| spire-server.autoscaling.minReplicas | int | `1` | |
|
|
||||||
| spire-server.autoscaling.targetCPUUtilizationPercentage | int | `80` | |
|
|
||||||
| spire-server.bundleConfigMap | string | `"spire-bundle"` | |
|
|
||||||
| spire-server.caKeyType | string | `"rsa-2048"` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) |
|
|
||||||
| spire-server.caTTL | string | `"24h"` | |
|
|
||||||
| spire-server.ca_subject.common_name | string | `"example.org"` | |
|
|
||||||
| spire-server.ca_subject.country | string | `"NL"` | |
|
|
||||||
| spire-server.ca_subject.organization | string | `"Example"` | |
|
|
||||||
| spire-server.clusterDomain | string | `"cluster.local"` | |
|
|
||||||
| spire-server.clusterName | string | `"example-cluster"` | |
|
|
||||||
| spire-server.configMap.annotations | object | `{}` | Annotations to add to the SPIRE Server ConfigMap |
|
|
||||||
| spire-server.controllerManager.configMap.annotations | object | `{}` | Annotations to add to the Controller Manager ConfigMap |
|
|
||||||
| spire-server.controllerManager.deleteHook.enabled | bool | `true` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) |
|
|
||||||
| spire-server.controllerManager.enabled | bool | `false` | |
|
|
||||||
| spire-server.controllerManager.identities.dnsNameTemplates | list | `[]` | |
|
|
||||||
| spire-server.controllerManager.identities.enabled | bool | `true` | |
|
|
||||||
| spire-server.controllerManager.identities.federatesWith | list | `[]` | |
|
|
||||||
| spire-server.controllerManager.identities.namespaceSelector | object | `{}` | |
|
|
||||||
| spire-server.controllerManager.identities.podSelector | object | `{}` | |
|
|
||||||
| spire-server.controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | |
|
|
||||||
| spire-server.controllerManager.ignoreNamespaces[0] | string | `"kube-system"` | |
|
|
||||||
| spire-server.controllerManager.ignoreNamespaces[1] | string | `"kube-public"` | |
|
|
||||||
| spire-server.controllerManager.ignoreNamespaces[2] | string | `"local-path-storage"` | |
|
|
||||||
| spire-server.controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| spire-server.controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
|
|
||||||
| spire-server.controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry |
|
|
||||||
| spire-server.controllerManager.image.tag | string | `"0.2.3"` | Overrides the image tag |
|
|
||||||
| spire-server.controllerManager.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| spire-server.controllerManager.installAndUpgradeHook.enabled | bool | `true` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) |
|
|
||||||
| spire-server.controllerManager.resources | object | `{}` | |
|
|
||||||
| spire-server.controllerManager.securityContext | object | `{}` | |
|
|
||||||
| spire-server.controllerManager.service.annotations | object | `{}` | |
|
|
||||||
| spire-server.controllerManager.service.port | int | `443` | |
|
|
||||||
| spire-server.controllerManager.service.type | string | `"ClusterIP"` | |
|
|
||||||
| spire-server.controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | |
|
|
||||||
| spire-server.dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
|
|
||||||
| spire-server.dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
|
|
||||||
| spire-server.dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |
|
|
||||||
| spire-server.dataStore.sql.options | list | `[]` | Only used by "postgres" or "mysql" |
|
|
||||||
| spire-server.dataStore.sql.password | string | `""` | Only used by "postgres" or "mysql" |
|
|
||||||
| spire-server.dataStore.sql.plugin_data | object | `{}` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section |
|
|
||||||
| spire-server.dataStore.sql.port | int | `0` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. |
|
|
||||||
| spire-server.dataStore.sql.username | string | `"spire"` | Only used by "postgres" or "mysql" |
|
|
||||||
| spire-server.defaultJwtSvidTTL | string | `"1h"` | |
|
|
||||||
| spire-server.defaultX509SvidTTL | string | `"4h"` | |
|
|
||||||
| spire-server.extraContainers | list | `[]` | |
|
|
||||||
| spire-server.extraVolumeMounts | list | `[]` | |
|
|
||||||
| spire-server.extraVolumes | list | `[]` | |
|
|
||||||
| spire-server.federation.bundleEndpoint.address | string | `"0.0.0.0"` | |
|
|
||||||
| spire-server.federation.bundleEndpoint.port | int | `8443` | |
|
|
||||||
| spire-server.federation.enabled | bool | `false` | |
|
|
||||||
| spire-server.federation.ingress.annotations | object | `{}` | |
|
|
||||||
| spire-server.federation.ingress.className | string | `""` | |
|
|
||||||
| spire-server.federation.ingress.enabled | bool | `false` | |
|
|
||||||
| spire-server.federation.ingress.hosts[0].host | string | `"spire-server-federation.example.org"` | |
|
|
||||||
| spire-server.federation.ingress.hosts[0].paths[0].path | string | `"/"` | |
|
|
||||||
| spire-server.federation.ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | |
|
|
||||||
| spire-server.federation.ingress.tls | list | `[]` | |
|
|
||||||
| spire-server.fullnameOverride | string | `""` | |
|
|
||||||
| spire-server.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| spire-server.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
|
|
||||||
| spire-server.image.repository | string | `"spiffe/spire-server"` | The repository within the registry |
|
|
||||||
| spire-server.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
|
|
||||||
| spire-server.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| spire-server.imagePullSecrets | list | `[]` | |
|
|
||||||
| spire-server.ingress.annotations | object | `{}` | |
|
|
||||||
| spire-server.ingress.className | string | `""` | |
|
|
||||||
| spire-server.ingress.enabled | bool | `false` | |
|
|
||||||
| spire-server.ingress.hosts[0].host | string | `"spire-server.example.org"` | |
|
|
||||||
| spire-server.ingress.hosts[0].paths[0].path | string | `"/"` | |
|
|
||||||
| spire-server.ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | |
|
|
||||||
| spire-server.ingress.tls | list | `[]` | |
|
|
||||||
| spire-server.initContainers | list | `[]` | |
|
|
||||||
| spire-server.jwtIssuer | string | `"https://oidc-discovery.example.org"` | The JWT issuer domain |
|
|
||||||
| spire-server.keyManager.awsKMS.accessKeyID | Optional | `""` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. |
|
|
||||||
| spire-server.keyManager.awsKMS.enabled | bool | `false` | |
|
|
||||||
| spire-server.keyManager.awsKMS.keyPolicy | object | `{"existingConfigMap":"","policy":""}` | Policy to use when creating keys. If no policy is specified, a default policy will be used. |
|
|
||||||
| spire-server.keyManager.awsKMS.keyPolicy.existingConfigMap | Optional | `""` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. |
|
|
||||||
| spire-server.keyManager.awsKMS.keyPolicy.policy | Optional | `""` | Key policy in JSON format. |
|
|
||||||
| spire-server.keyManager.awsKMS.region | string | `""` | |
|
|
||||||
| spire-server.keyManager.awsKMS.secretAccessKey | Optional | `""` | Secret access key for the AWS account. |
|
|
||||||
| spire-server.keyManager.disk.enabled | bool | `true` | |
|
|
||||||
| spire-server.keyManager.memory.enabled | bool | `false` | |
|
|
||||||
| spire-server.livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe |
|
|
||||||
| spire-server.livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe |
|
|
||||||
| spire-server.livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe |
|
|
||||||
| spire-server.livenessProbe.timeoutSeconds | int | `3` | Timeout in seconds for livenessProbe |
|
|
||||||
| spire-server.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
|
|
||||||
| spire-server.nameOverride | string | `""` | |
|
|
||||||
| spire-server.namespaceOverride | string | `""` | |
|
|
||||||
| spire-server.nodeAttestor.k8sPsat.enabled | bool | `true` | |
|
|
||||||
| spire-server.nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` | |
|
|
||||||
| spire-server.nodeSelector | object | `{}` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) |
|
|
||||||
| spire-server.notifier.k8sbundle.namespace | string | `""` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace |
|
|
||||||
| spire-server.persistence.accessMode | string | `"ReadWriteOnce"` | |
|
|
||||||
| spire-server.persistence.hostPath | string | `""` | Which path to use on the host when type = hostPath |
|
|
||||||
| spire-server.persistence.size | string | `"1Gi"` | |
|
|
||||||
| spire-server.persistence.storageClass | string | `nil` | |
|
|
||||||
| spire-server.persistence.type | string | `"pvc"` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) |
|
|
||||||
| spire-server.podAnnotations | object | `{}` | |
|
|
||||||
| spire-server.podSecurityContext | object | `{}` | |
|
|
||||||
| spire-server.readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe |
|
|
||||||
| spire-server.readinessProbe.periodSeconds | int | `5` | Period seconds for readinessProbe |
|
|
||||||
| spire-server.replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. |
|
|
||||||
| spire-server.resources | object | `{}` | |
|
|
||||||
| spire-server.securityContext | object | `{}` | |
|
|
||||||
| spire-server.service.annotations | object | `{}` | |
|
|
||||||
| spire-server.service.port | int | `8081` | |
|
|
||||||
| spire-server.service.type | string | `"ClusterIP"` | |
|
|
||||||
| spire-server.serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
|
|
||||||
| spire-server.serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
|
|
||||||
| spire-server.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
|
|
||||||
| spire-server.telemetry.prometheus.enabled | bool | `false` | |
|
|
||||||
| spire-server.telemetry.prometheus.podMonitor.enabled | bool | `false` | |
|
|
||||||
| spire-server.telemetry.prometheus.podMonitor.labels | object | `{}` | |
|
|
||||||
| spire-server.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
|
|
||||||
| spire-server.tolerations | list | `[]` | |
|
|
||||||
| spire-server.tools.kubectl.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| spire-server.tools.kubectl.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
|
|
||||||
| spire-server.tools.kubectl.image.repository | string | `"rancher/kubectl"` | The repository within the registry |
|
|
||||||
| spire-server.tools.kubectl.image.tag | string | `""` | Overrides the image tag |
|
|
||||||
| spire-server.tools.kubectl.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| spire-server.topologySpreadConstraints | list | `[]` | |
|
|
||||||
| spire-server.tornjak.config.clientCA.name | string | `"tornjak-client-ca"` | |
|
|
||||||
| spire-server.tornjak.config.clientCA.type | string | `"Secret"` | Type of delivery for the user CA for mTLS client verification options are `Secret` or `ConfigMap` (required for `mtls` connectionType) |
|
|
||||||
| spire-server.tornjak.config.dataStore | object | `{"driver":"sqlite3","file":"/run/spire/data/tornjak.sqlite3"}` | Persistent DB for storing Tornjak specific information |
|
|
||||||
| spire-server.tornjak.config.tlsSecret | string | `"tornjak-tls-secret"` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) |
|
|
||||||
| spire-server.tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) (Not for production) |
|
|
||||||
| spire-server.tornjak.image.pullPolicy | string | `"IfNotPresent"` | The Tornjak image pull policy |
|
|
||||||
| spire-server.tornjak.image.registry | string | `"ghcr.io"` | The OCI registry to pull the Tornjak image from |
|
|
||||||
| spire-server.tornjak.image.repository | string | `"spiffe/tornjak-backend"` | The repository within the registry |
|
|
||||||
| spire-server.tornjak.image.tag | string | `"v1.2.2"` | Overrides the image tag |
|
|
||||||
| spire-server.tornjak.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| spire-server.tornjak.resources | object | `{}` | |
|
|
||||||
| spire-server.tornjak.service.annotations | object | `{}` | |
|
|
||||||
| spire-server.tornjak.service.ports | object | `{"http":10000,"https":10443}` | Ports for tornjak |
|
|
||||||
| spire-server.tornjak.service.type | string | `"ClusterIP"` | |
|
|
||||||
| spire-server.tornjak.startupProbe.failureThreshold | int | `3` | |
|
|
||||||
| spire-server.tornjak.startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for |
|
|
||||||
| spire-server.tornjak.startupProbe.periodSeconds | int | `10` | |
|
|
||||||
| spire-server.tornjak.startupProbe.successThreshold | int | `1` | |
|
|
||||||
| spire-server.tornjak.startupProbe.timeoutSeconds | int | `5` | |
|
|
||||||
| spire-server.trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
|
|
||||||
| spire-server.upstreamAuthority.awsPCA.assumeRoleARN | Optional | `""` | ARN of an IAM role to assume |
|
|
||||||
| spire-server.upstreamAuthority.awsPCA.caSigningTemplateARN | string | `""` | See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. |
|
|
||||||
| spire-server.upstreamAuthority.awsPCA.certificateAuthorityARN | string | `""` | ARN of the "upstream" CA certificate |
|
|
||||||
| spire-server.upstreamAuthority.awsPCA.enabled | bool | `false` | |
|
|
||||||
| spire-server.upstreamAuthority.awsPCA.endpoint | string | `""` | See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. |
|
|
||||||
| spire-server.upstreamAuthority.awsPCA.region | string | `""` | AWS Region to use |
|
|
||||||
| spire-server.upstreamAuthority.awsPCA.signingAlgorithm | string | `""` | See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. |
|
|
||||||
| spire-server.upstreamAuthority.awsPCA.supplementalBundlePath | Optional | `""` | Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. |
|
|
||||||
| spire-server.upstreamAuthority.certManager.ca.create | bool | `false` | Creates a Cert-Manager CA |
|
|
||||||
| spire-server.upstreamAuthority.certManager.ca.duration | string | `"87600h"` | Duration of the CA. Defaults to 10 years. |
|
|
||||||
| spire-server.upstreamAuthority.certManager.ca.privateKey.algorithm | string | `"ECDSA"` | |
|
|
||||||
| spire-server.upstreamAuthority.certManager.ca.privateKey.rotationPolicy | string | `""` | |
|
|
||||||
| spire-server.upstreamAuthority.certManager.ca.privateKey.size | int | `256` | |
|
|
||||||
| spire-server.upstreamAuthority.certManager.ca.renewBefore | string | `""` | How long to wait before renewing the CA |
|
|
||||||
| spire-server.upstreamAuthority.certManager.enabled | bool | `false` | |
|
|
||||||
| spire-server.upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` | |
|
|
||||||
| spire-server.upstreamAuthority.certManager.issuer_kind | string | `"Issuer"` | |
|
|
||||||
| spire-server.upstreamAuthority.certManager.issuer_name | string | `""` | Defaults to the release name, override if CA is provided outside of the chart |
|
|
||||||
| spire-server.upstreamAuthority.certManager.kube_config_file | string | `""` | |
|
|
||||||
| spire-server.upstreamAuthority.certManager.namespace | string | `""` | Specify to use a namespace other then the one the chart is installed into |
|
|
||||||
| spire-server.upstreamAuthority.certManager.rbac.create | bool | `true` | |
|
|
||||||
| spire-server.upstreamAuthority.disk.enabled | bool | `false` | |
|
|
||||||
| spire-server.upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. |
|
|
||||||
| spire-server.upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info |
|
|
||||||
| spire-server.upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. |
|
|
||||||
| spire-server.upstreamAuthority.spire.enabled | bool | `false` | |
|
|
||||||
| spire-server.upstreamAuthority.spire.server.address | string | `""` | |
|
|
||||||
| spire-server.upstreamAuthority.spire.server.port | int | `8081` | |
|
|
||||||
| spire-server.upstreamAuthority.spire.upstreamDriver | string | `""` | |
|
|
||||||
| tornjak-frontend.affinity | object | `{}` | |
|
|
||||||
| tornjak-frontend.apiServerURL | string | `"http://localhost:10000/"` | URL of the Tornjak APIs (backend) Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. |
|
|
||||||
| tornjak-frontend.fullnameOverride | string | `""` | |
|
|
||||||
| tornjak-frontend.image.pullPolicy | string | `"IfNotPresent"` | |
|
|
||||||
| tornjak-frontend.image.registry | string | `"ghcr.io"` | |
|
|
||||||
| tornjak-frontend.image.repository | string | `"spiffe/tornjak-frontend"` | |
|
|
||||||
| tornjak-frontend.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
|
|
||||||
| tornjak-frontend.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| tornjak-frontend.imagePullSecrets | list | `[]` | |
|
|
||||||
| tornjak-frontend.labels | object | `{}` | |
|
|
||||||
| tornjak-frontend.nameOverride | string | `""` | |
|
|
||||||
| tornjak-frontend.namespaceOverride | string | `""` | |
|
|
||||||
| tornjak-frontend.nodeSelector | object | `{"kubernetes.io/arch":"amd64"}` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) |
|
|
||||||
| tornjak-frontend.podSecurityContext | object | `{}` | |
|
|
||||||
| tornjak-frontend.securityContext | object | `{}` | |
|
|
||||||
| tornjak-frontend.service.annotations | object | `{}` | |
|
|
||||||
| tornjak-frontend.service.port | int | `3000` | |
|
|
||||||
| tornjak-frontend.service.type | string | `"ClusterIP"` | |
|
|
||||||
| tornjak-frontend.serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
|
|
||||||
| tornjak-frontend.serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
|
|
||||||
| tornjak-frontend.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
|
|
||||||
| tornjak-frontend.spireHealthCheck.enabled | bool | `true` | Enables the SPIRE Healthchecker indicator |
|
|
||||||
| tornjak-frontend.startupProbe.enabled | bool | `true` | Enable startupProbe on Tornjak frontend container |
|
|
||||||
| tornjak-frontend.startupProbe.failureThreshold | int | `6` | Failure threshold count for startupProbe |
|
|
||||||
| tornjak-frontend.startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for startupProbe |
|
|
||||||
| tornjak-frontend.startupProbe.periodSeconds | int | `10` | Period seconds for startupProbe |
|
|
||||||
| tornjak-frontend.startupProbe.successThreshold | int | `1` | Success threshold count for startupProbe |
|
|
||||||
| tornjak-frontend.startupProbe.timeoutSeconds | int | `5` | Timeout seconds for startupProbe |
|
|
||||||
| tornjak-frontend.tolerations | list | `[]` | |
|
|
||||||
| tornjak-frontend.topologySpreadConstraints | list | `[]` | |
|
|
||||||
| upstream-spiffe-csi-driver.agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent |
|
|
||||||
| upstream-spiffe-csi-driver.fullnameOverride | string | `""` | |
|
|
||||||
| upstream-spiffe-csi-driver.healthChecks.port | int | `9809` | |
|
|
||||||
| upstream-spiffe-csi-driver.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| upstream-spiffe-csi-driver.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
|
|
||||||
| upstream-spiffe-csi-driver.image.repository | string | `"spiffe/spiffe-csi-driver"` | The repository within the registry |
|
|
||||||
| upstream-spiffe-csi-driver.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion |
|
|
||||||
| upstream-spiffe-csi-driver.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| upstream-spiffe-csi-driver.imagePullSecrets | list | `[]` | |
|
|
||||||
| upstream-spiffe-csi-driver.kubeletPath | string | `"/var/lib/kubelet"` | |
|
|
||||||
| upstream-spiffe-csi-driver.livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe |
|
|
||||||
| upstream-spiffe-csi-driver.livenessProbe.timeoutSeconds | int | `5` | Timeout value in seconds for livenessProbe |
|
|
||||||
| upstream-spiffe-csi-driver.nameOverride | string | `""` | |
|
|
||||||
| upstream-spiffe-csi-driver.namespaceOverride | string | `""` | |
|
|
||||||
| upstream-spiffe-csi-driver.nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| upstream-spiffe-csi-driver.nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | The OCI registry to pull the image from |
|
|
||||||
| upstream-spiffe-csi-driver.nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | The repository within the registry |
|
|
||||||
| upstream-spiffe-csi-driver.nodeDriverRegistrar.image.tag | string | `"v2.8.0"` | Overrides the image tag |
|
|
||||||
| upstream-spiffe-csi-driver.nodeDriverRegistrar.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| upstream-spiffe-csi-driver.nodeDriverRegistrar.resources | object | `{}` | |
|
|
||||||
| upstream-spiffe-csi-driver.nodeSelector | object | `{}` | |
|
|
||||||
| upstream-spiffe-csi-driver.pluginName | string | `"csi.spiffe.io"` | Set the csi driver name deployed to Kubernetes. |
|
|
||||||
| upstream-spiffe-csi-driver.podAnnotations | object | `{}` | |
|
|
||||||
| upstream-spiffe-csi-driver.podSecurityContext | object | `{}` | |
|
|
||||||
| upstream-spiffe-csi-driver.priorityClassName | string | `""` | Priority class assigned to daemonset pods |
|
|
||||||
| upstream-spiffe-csi-driver.resources | object | `{}` | |
|
|
||||||
| upstream-spiffe-csi-driver.securityContext.privileged | bool | `true` | |
|
|
||||||
| upstream-spiffe-csi-driver.securityContext.readOnlyRootFilesystem | bool | `true` | |
|
|
||||||
| upstream-spiffe-csi-driver.serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
|
|
||||||
| upstream-spiffe-csi-driver.serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
|
|
||||||
| upstream-spiffe-csi-driver.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
|
|
||||||
| upstream-spiffe-csi-driver.tolerations | list | `[]` | |
|
|
||||||
| upstream-spire-agent.bundleConfigMap | string | `"spire-bundle"` | |
|
|
||||||
| upstream-spire-agent.clusterName | string | `"example-cluster"` | |
|
|
||||||
| upstream-spire-agent.configMap.annotations | object | `{}` | Annotations to add to the SPIRE Agent ConfigMap |
|
|
||||||
| upstream-spire-agent.extraContainers | list | `[]` | |
|
|
||||||
| upstream-spire-agent.extraVolumeMounts | list | `[]` | |
|
|
||||||
| upstream-spire-agent.extraVolumes | list | `[]` | |
|
|
||||||
| upstream-spire-agent.fsGroupFix.image.pullPolicy | string | `"Always"` | The image pull policy |
|
|
||||||
| upstream-spire-agent.fsGroupFix.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
|
|
||||||
| upstream-spire-agent.fsGroupFix.image.repository | string | `"chainguard/bash"` | The repository within the registry |
|
|
||||||
| upstream-spire-agent.fsGroupFix.image.tag | string | `"latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4"` | Overrides the image tag |
|
|
||||||
| upstream-spire-agent.fsGroupFix.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| upstream-spire-agent.fsGroupFix.resources | object | `{}` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
|
|
||||||
| upstream-spire-agent.fullnameOverride | string | `""` | |
|
|
||||||
| upstream-spire-agent.healthChecks.port | int | `9980` | override the host port used for health checking |
|
|
||||||
| upstream-spire-agent.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| upstream-spire-agent.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
|
|
||||||
| upstream-spire-agent.image.repository | string | `"spiffe/spire-agent"` | The repository within the registry |
|
|
||||||
| upstream-spire-agent.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
|
|
||||||
| upstream-spire-agent.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| upstream-spire-agent.imagePullSecrets | list | `[]` | |
|
|
||||||
| upstream-spire-agent.initContainers | list | `[]` | |
|
|
||||||
| upstream-spire-agent.livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe |
|
|
||||||
| upstream-spire-agent.livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe |
|
|
||||||
| upstream-spire-agent.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
|
|
||||||
| upstream-spire-agent.nameOverride | string | `""` | |
|
|
||||||
| upstream-spire-agent.namespaceOverride | string | `""` | |
|
|
||||||
| upstream-spire-agent.nodeSelector | object | `{}` | |
|
|
||||||
| upstream-spire-agent.podAnnotations | object | `{}` | |
|
|
||||||
| upstream-spire-agent.podSecurityContext | object | `{}` | |
|
|
||||||
| upstream-spire-agent.priorityClassName | string | `""` | Priority class assigned to daemonset pods |
|
|
||||||
| upstream-spire-agent.readinessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for readinessProbe |
|
|
||||||
| upstream-spire-agent.readinessProbe.periodSeconds | int | `60` | Period seconds for readinessProbe |
|
|
||||||
| upstream-spire-agent.resources | object | `{}` | |
|
|
||||||
| upstream-spire-agent.securityContext | object | `{}` | |
|
|
||||||
| upstream-spire-agent.server.address | string | `""` | |
|
|
||||||
| upstream-spire-agent.server.namespaceOverride | string | `""` | |
|
|
||||||
| upstream-spire-agent.server.port | int | `8081` | |
|
|
||||||
| upstream-spire-agent.serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
|
|
||||||
| upstream-spire-agent.serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
|
|
||||||
| upstream-spire-agent.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
|
|
||||||
| upstream-spire-agent.socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent |
|
|
||||||
| upstream-spire-agent.telemetry.prometheus.enabled | bool | `false` | |
|
|
||||||
| upstream-spire-agent.telemetry.prometheus.podMonitor.enabled | bool | `false` | |
|
|
||||||
| upstream-spire-agent.telemetry.prometheus.podMonitor.labels | object | `{}` | |
|
|
||||||
| upstream-spire-agent.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent |
|
|
||||||
| upstream-spire-agent.telemetry.prometheus.port | int | `9988` | |
|
|
||||||
| upstream-spire-agent.tolerations | list | `[]` | |
|
|
||||||
| upstream-spire-agent.trustBundleFormat | string | `"pem"` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" |
|
|
||||||
| upstream-spire-agent.trustBundleURL | string | `""` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap |
|
|
||||||
| upstream-spire-agent.trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers |
|
|
||||||
| upstream-spire-agent.waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| upstream-spire-agent.waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
|
|
||||||
| upstream-spire-agent.waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry |
|
|
||||||
| upstream-spire-agent.waitForIt.image.tag | string | `"latest@sha256:deeaccb164a67a4d7f585c4d416641b1f422c029911a29d72beae28221f823df"` | Overrides the image tag |
|
|
||||||
| upstream-spire-agent.waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| upstream-spire-agent.waitForIt.resources | object | `{}` | |
|
|
||||||
| upstream-spire-agent.workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio |
|
|
||||||
| upstream-spire-agent.workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped |
|
|
||||||
| upstream-spire-agent.workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor |
|
|
||||||
|
|
||||||
----------------------------------------------
|
### Global parameters
|
||||||
|
|
||||||
|
| Name | Description | Value |
|
||||||
|
| --------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ---------------------------- |
|
||||||
|
| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` |
|
||||||
|
| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` |
|
||||||
|
| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` |
|
||||||
|
| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens | `oidc-discovery.example.org` |
|
||||||
|
| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` |
|
||||||
|
| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` |
|
||||||
|
| `global.spire.image.registry` | Override all Spire image registries at once | `""` |
|
||||||
|
| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||||
|
| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||||
|
|
||||||
|
### Spire server parameters
|
||||||
|
|
||||||
|
| Name | Description | Value |
|
||||||
|
| ---------------------------------------- | --------------------------------------------- | -------- |
|
||||||
|
| `spire-server.enabled` | Flag to enable Spire server | `true` |
|
||||||
|
| `spire-server.nameOverride` | Overrides the name of Spire server pods | `server` |
|
||||||
|
| `spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
|
||||||
|
|
||||||
|
### Spire agent parameters
|
||||||
|
|
||||||
|
| Name | Description | Value |
|
||||||
|
| -------------------------- | -------------------------------------- | ------- |
|
||||||
|
| `spire-agent.enabled` | Flag to enable Spire agent | `true` |
|
||||||
|
| `spire-agent.nameOverride` | Overrides the name of Spire agent pods | `agent` |
|
||||||
|
|
||||||
|
### Upstream Spire agent and CSI driver configuration
|
||||||
|
|
||||||
|
| Name | Description | Value |
|
||||||
|
| ------------------ | ---------------------------------------------------------- | ------- |
|
||||||
|
| `upstream.enabled` | Enable upstream agent and driver for use with nested spire | `false` |
|
||||||
|
|
||||||
|
### Upstream Spire agent parameters
|
||||||
|
|
||||||
|
| Name | Description | Value |
|
||||||
|
| ------------------------------------------------ | -------------------------------------------------- | ---------------------------------------------------- |
|
||||||
|
| `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` |
|
||||||
|
| `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` |
|
||||||
|
| `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` |
|
||||||
|
| `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` |
|
||||||
|
| `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` |
|
||||||
|
| `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` |
|
||||||
|
| `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` |
|
||||||
|
|
||||||
|
### SPIFFE CSI Driver parameters
|
||||||
|
|
||||||
|
| Name | Description | Value |
|
||||||
|
| --------------------------- | ------------------------------------------------ | ------ |
|
||||||
|
| `spiffe-csi-driver.enabled` | Flag to enable spiffe-csi-driver for the cluster | `true` |
|
||||||
|
|
||||||
|
### Upstream SPIFFE CSI Driver parameters
|
||||||
|
|
||||||
|
| Name | Description | Value |
|
||||||
|
| ---------------------------------------------- | ----------------------------------------------------------- | ---------------------------------------------------- |
|
||||||
|
| `upstream-spiffe-csi-driver.pluginName` | The plugin name for configuring upstream Spiffe CSI driver | `upstream.csi.spiffe.io` |
|
||||||
|
| `upstream-spiffe-csi-driver.agentSocketPath` | The socket path where Spiffe CSI driver mounts agent socket | `/run/spire/agent-sockets-upstream/spire-agent.sock` |
|
||||||
|
| `upstream-spiffe-csi-driver.healthChecks.port` | The port where Spiffe CSI driver health checks are exposed | `9810` |
|
||||||
|
|
||||||
|
### SPIFFE oidc discovery provider parameters
|
||||||
|
|
||||||
|
| Name | Description | Value |
|
||||||
|
| ---------------------------------------- | ------------------------------------------------------------- | ------- |
|
||||||
|
| `spiffe-oidc-discovery-provider.enabled` | Flag to enable spiffe-oidc-discovery-provider for the cluster | `false` |
|
||||||
|
|
||||||
|
### Tornjak frontend parameters
|
||||||
|
|
||||||
|
| Name | Description | Value |
|
||||||
|
| -------------------------- | -------------------------------------------------------------- | ------- |
|
||||||
|
| `tornjak-frontend.enabled` | Enables deployment of Tornjak frontend/UI (Not for production) | `false` |
|
||||||
|
|||||||
@@ -24,41 +24,41 @@ A Helm chart to install the SPIFFE CSI driver.
|
|||||||
|
|
||||||
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||||
|
|
||||||
## Values
|
## Parameters
|
||||||
|
|
||||||
| Key | Type | Default | Description |
|
### SPIFFE CSI Driver Chart parameters
|
||||||
|-----|------|---------|-------------|
|
|
||||||
| agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent |
|
|
||||||
| fullnameOverride | string | `""` | |
|
|
||||||
| healthChecks.port | int | `9809` | |
|
|
||||||
| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
|
|
||||||
| image.repository | string | `"spiffe/spiffe-csi-driver"` | The repository within the registry |
|
|
||||||
| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion |
|
|
||||||
| image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| imagePullSecrets | list | `[]` | |
|
|
||||||
| kubeletPath | string | `"/var/lib/kubelet"` | |
|
|
||||||
| livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe |
|
|
||||||
| livenessProbe.timeoutSeconds | int | `5` | Timeout value in seconds for livenessProbe |
|
|
||||||
| nameOverride | string | `""` | |
|
|
||||||
| namespaceOverride | string | `""` | |
|
|
||||||
| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | The OCI registry to pull the image from |
|
|
||||||
| nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | The repository within the registry |
|
|
||||||
| nodeDriverRegistrar.image.tag | string | `"v2.8.0"` | Overrides the image tag |
|
|
||||||
| nodeDriverRegistrar.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| nodeDriverRegistrar.resources | object | `{}` | |
|
|
||||||
| nodeSelector | object | `{}` | |
|
|
||||||
| pluginName | string | `"csi.spiffe.io"` | Set the csi driver name deployed to Kubernetes. |
|
|
||||||
| podAnnotations | object | `{}` | |
|
|
||||||
| podSecurityContext | object | `{}` | |
|
|
||||||
| priorityClassName | string | `""` | Priority class assigned to daemonset pods |
|
|
||||||
| resources | object | `{}` | |
|
|
||||||
| securityContext.privileged | bool | `true` | |
|
|
||||||
| securityContext.readOnlyRootFilesystem | bool | `true` | |
|
|
||||||
| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
|
|
||||||
| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
|
|
||||||
| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
|
|
||||||
| tolerations | list | `[]` | |
|
|
||||||
|
|
||||||
----------------------------------------------
|
| Name | Description | Value |
|
||||||
|
| ---------------------------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------- |
|
||||||
|
| `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` |
|
||||||
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
|
| `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` |
|
||||||
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
|
| `resources` | Resource requests and limits for spiffe-csi-driver | `{}` |
|
||||||
|
| `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` |
|
||||||
|
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
|
||||||
|
| `livenessProbe.timeoutSeconds` | Timeout value in seconds for livenessProbe | `5` |
|
||||||
|
| `imagePullSecrets` | Image pull secret details for spiffe-csi-driver | `[]` |
|
||||||
|
| `nameOverride` | Name override for spiffe-csi-driver | `""` |
|
||||||
|
| `namespaceOverride` | Namespace to install spiffe-csi-driver | `""` |
|
||||||
|
| `fullnameOverride` | Full name override for spiffe-csi-driver | `""` |
|
||||||
|
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||||
|
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||||
|
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
||||||
|
| `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` |
|
||||||
|
| `podSecurityContext` | Security context for CSI driver pods | `{}` |
|
||||||
|
| `securityContext.readOnlyRootFilesystem` | Flag for read only root filesystem | `true` |
|
||||||
|
| `securityContext.privileged` | Flag for specifying privileged mode | `true` |
|
||||||
|
| `nodeSelector` | Node selector for CSI driver pods | `{}` |
|
||||||
|
| `tolerations` | Tolerations for CSI driver pods | `[]` |
|
||||||
|
| `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
|
||||||
|
| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` |
|
||||||
|
| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `nodeDriverRegistrar.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.8.0` |
|
||||||
|
| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` |
|
||||||
|
| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||||
|
| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` |
|
||||||
|
| `priorityClassName` | Priority class assigned to daemonset pods | `""` |
|
||||||
|
|||||||
@@ -1,20 +1,28 @@
|
|||||||
# @ignored
|
# Default configuration for SPIFFE CSI Driver chart
|
||||||
|
# SPDX-License-Identifier: APACHE-2.0
|
||||||
|
|
||||||
|
## @skip global
|
||||||
global: {}
|
global: {}
|
||||||
|
|
||||||
# -- Set the csi driver name deployed to Kubernetes.
|
## @section SPIFFE CSI Driver Chart parameters
|
||||||
|
##
|
||||||
|
## @param pluginName Set the csi driver name deployed to Kubernetes.
|
||||||
pluginName: csi.spiffe.io
|
pluginName: csi.spiffe.io
|
||||||
|
|
||||||
|
## @param image.registry The OCI registry to pull the image from
|
||||||
|
## @param image.repository The repository within the registry
|
||||||
|
## @param image.pullPolicy The image pull policy
|
||||||
|
## @param image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
image:
|
image:
|
||||||
# -- The OCI registry to pull the image from
|
|
||||||
registry: ghcr.io
|
registry: ghcr.io
|
||||||
# -- The repository within the registry
|
|
||||||
repository: spiffe/spiffe-csi-driver
|
repository: spiffe/spiffe-csi-driver
|
||||||
# -- The image pull policy
|
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
||||||
version: ""
|
version: ""
|
||||||
# -- Overrides the image tag whose default is the chart appVersion
|
|
||||||
tag: ""
|
tag: ""
|
||||||
|
|
||||||
|
## @param resources [object] Resource requests and limits for spiffe-csi-driver
|
||||||
resources: {}
|
resources: {}
|
||||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
# choice for the user. This also increases chances charts run on environments with little
|
# choice for the user. This also increases chances charts run on environments with little
|
||||||
@@ -28,33 +36,47 @@ resources: {}
|
|||||||
# memory: 64Mi
|
# memory: 64Mi
|
||||||
|
|
||||||
healthChecks:
|
healthChecks:
|
||||||
|
## @param healthChecks.port The healthcheck port for spiffe-csi-driver
|
||||||
port: 9809
|
port: 9809
|
||||||
|
|
||||||
|
## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
|
||||||
|
## @param livenessProbe.timeoutSeconds Timeout value in seconds for livenessProbe
|
||||||
|
##
|
||||||
livenessProbe:
|
livenessProbe:
|
||||||
# -- Initial delay seconds for livenessProbe
|
|
||||||
initialDelaySeconds: 5
|
initialDelaySeconds: 5
|
||||||
# -- Timeout value in seconds for livenessProbe
|
|
||||||
timeoutSeconds: 5
|
timeoutSeconds: 5
|
||||||
|
|
||||||
|
## @param imagePullSecrets Image pull secret details for spiffe-csi-driver
|
||||||
imagePullSecrets: []
|
imagePullSecrets: []
|
||||||
|
|
||||||
|
## @param nameOverride Name override for spiffe-csi-driver
|
||||||
nameOverride: ""
|
nameOverride: ""
|
||||||
|
|
||||||
|
## @param namespaceOverride Namespace to install spiffe-csi-driver
|
||||||
namespaceOverride: ""
|
namespaceOverride: ""
|
||||||
|
|
||||||
|
## @param fullnameOverride Full name override for spiffe-csi-driver
|
||||||
fullnameOverride: ""
|
fullnameOverride: ""
|
||||||
|
|
||||||
|
## @param serviceAccount.create Specifies whether a service account should be created
|
||||||
|
## @param serviceAccount.annotations Annotations to add to the service account
|
||||||
|
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
|
||||||
|
##
|
||||||
serviceAccount:
|
serviceAccount:
|
||||||
# -- Specifies whether a service account should be created
|
|
||||||
create: true
|
create: true
|
||||||
# -- Annotations to add to the service account
|
|
||||||
annotations: {}
|
annotations: {}
|
||||||
# -- The name of the service account to use.
|
|
||||||
# If not set and create is true, a name is generated using the fullname template
|
|
||||||
name: ""
|
name: ""
|
||||||
|
|
||||||
|
## @param podAnnotations [object] Pod annotations for spiffe-csi-driver
|
||||||
podAnnotations: {}
|
podAnnotations: {}
|
||||||
|
|
||||||
|
## @param podSecurityContext [object] Security context for CSI driver pods
|
||||||
podSecurityContext: {}
|
podSecurityContext: {}
|
||||||
# fsGroup: 2000
|
# fsGroup: 2000
|
||||||
|
|
||||||
|
## @param securityContext.readOnlyRootFilesystem Flag for read only root filesystem
|
||||||
|
## @param securityContext.privileged Flag for specifying privileged mode
|
||||||
|
##
|
||||||
securityContext:
|
securityContext:
|
||||||
readOnlyRootFilesystem: true
|
readOnlyRootFilesystem: true
|
||||||
privileged: true
|
privileged: true
|
||||||
@@ -64,22 +86,26 @@ securityContext:
|
|||||||
# drop:
|
# drop:
|
||||||
# - ALL
|
# - ALL
|
||||||
|
|
||||||
|
## @param nodeSelector [object] Node selector for CSI driver pods
|
||||||
nodeSelector: {}
|
nodeSelector: {}
|
||||||
|
|
||||||
|
## @param tolerations [array] Tolerations for CSI driver pods
|
||||||
tolerations: []
|
tolerations: []
|
||||||
|
|
||||||
nodeDriverRegistrar:
|
nodeDriverRegistrar:
|
||||||
|
## @param nodeDriverRegistrar.image.registry The OCI registry to pull the image from
|
||||||
|
## @param nodeDriverRegistrar.image.repository The repository within the registry
|
||||||
|
## @param nodeDriverRegistrar.image.pullPolicy The image pull policy
|
||||||
|
## @param nodeDriverRegistrar.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param nodeDriverRegistrar.image.tag Overrides the image tag
|
||||||
|
##
|
||||||
image:
|
image:
|
||||||
# -- The OCI registry to pull the image from
|
|
||||||
registry: registry.k8s.io
|
registry: registry.k8s.io
|
||||||
# -- The repository within the registry
|
|
||||||
repository: sig-storage/csi-node-driver-registrar
|
repository: sig-storage/csi-node-driver-registrar
|
||||||
# -- The image pull policy
|
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
||||||
version: ""
|
version: ""
|
||||||
# -- Overrides the image tag
|
|
||||||
tag: v2.8.0
|
tag: v2.8.0
|
||||||
|
## @param nodeDriverRegistrar.resources Resource requests and limits for CSI driver pods
|
||||||
resources: {}
|
resources: {}
|
||||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
# choice for the user. This also increases chances charts run on environments with little
|
# choice for the user. This also increases chances charts run on environments with little
|
||||||
@@ -92,10 +118,11 @@ nodeDriverRegistrar:
|
|||||||
# cpu: 100m
|
# cpu: 100m
|
||||||
# memory: 64Mi
|
# memory: 64Mi
|
||||||
|
|
||||||
# -- The unix socket path to the spire-agent
|
## @param agentSocketPath The unix socket path to the spire-agent
|
||||||
agentSocketPath: /run/spire/agent-sockets/spire-agent.sock
|
agentSocketPath: /run/spire/agent-sockets/spire-agent.sock
|
||||||
|
|
||||||
|
## @param kubeletPath Path to kubelet file
|
||||||
kubeletPath: /var/lib/kubelet
|
kubeletPath: /var/lib/kubelet
|
||||||
|
|
||||||
# -- Priority class assigned to daemonset pods
|
## @param priorityClassName Priority class assigned to daemonset pods
|
||||||
priorityClassName: ""
|
priorityClassName: ""
|
||||||
|
|||||||
@@ -25,84 +25,105 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
|||||||
|
|
||||||
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||||
|
|
||||||
## Values
|
## Parameters
|
||||||
|
|
||||||
| Key | Type | Default | Description |
|
### Chart parameters
|
||||||
|-----|------|---------|-------------|
|
|
||||||
| affinity | object | `{}` | |
|
|
||||||
| agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket |
|
|
||||||
| annotations | object | `{}` | Annotations for the deployment |
|
|
||||||
| autoscaling.enabled | bool | `false` | |
|
|
||||||
| autoscaling.maxReplicas | int | `5` | |
|
|
||||||
| autoscaling.minReplicas | int | `1` | |
|
|
||||||
| autoscaling.targetCPUUtilizationPercentage | int | `80` | |
|
|
||||||
| autoscaling.targetMemoryUtilizationPercentage | int | `80` | |
|
|
||||||
| clusterDomain | string | `"cluster.local"` | |
|
|
||||||
| config.acme.cacheDir | string | `"/run/spire"` | |
|
|
||||||
| config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | |
|
|
||||||
| config.acme.emailAddress | string | `"[email protected]"` | |
|
|
||||||
| config.acme.tosAccepted | bool | `false` | |
|
|
||||||
| config.additionalDomains | list | `["localhost"]` | Add additional domains that can be used for oidc discovery |
|
|
||||||
| config.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
|
|
||||||
| configMap.annotations | object | `{}` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap |
|
|
||||||
| deleteHook.enabled | bool | `true` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) |
|
|
||||||
| fullnameOverride | string | `""` | |
|
|
||||||
| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
|
|
||||||
| image.repository | string | `"spiffe/oidc-discovery-provider"` | The repository within the registry |
|
|
||||||
| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion |
|
|
||||||
| image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| imagePullSecrets | list | `[]` | |
|
|
||||||
| ingress.annotations | object | `{}` | |
|
|
||||||
| ingress.className | string | `""` | |
|
|
||||||
| ingress.enabled | bool | `false` | |
|
|
||||||
| ingress.hosts[0].host | string | `"oidc-discovery.example.org"` | |
|
|
||||||
| ingress.hosts[0].paths[0].path | string | `"/"` | |
|
|
||||||
| ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | |
|
|
||||||
| ingress.tls | list | `[]` | |
|
|
||||||
| insecureScheme.enabled | bool | `false` | |
|
|
||||||
| insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| insecureScheme.nginx.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
|
|
||||||
| insecureScheme.nginx.image.repository | string | `"nginxinc/nginx-unprivileged"` | The repository within the registry |
|
|
||||||
| insecureScheme.nginx.image.tag | string | `"1.24.0-alpine"` | Overrides the image tag |
|
|
||||||
| insecureScheme.nginx.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| insecureScheme.nginx.resources | object | `{}` | |
|
|
||||||
| jwtIssuer | string | `"https://oidc-discovery.example.org"` | |
|
|
||||||
| livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe |
|
|
||||||
| livenessProbe.periodSeconds | int | `5` | Period seconds for livenessProbe |
|
|
||||||
| nameOverride | string | `""` | |
|
|
||||||
| namespaceOverride | string | `""` | |
|
|
||||||
| nodeSelector | object | `{}` | |
|
|
||||||
| podAnnotations | object | `{}` | |
|
|
||||||
| podSecurityContext | object | `{}` | |
|
|
||||||
| readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe |
|
|
||||||
| readinessProbe.periodSeconds | int | `5` | Period seconds for readinessProbe |
|
|
||||||
| replicaCount | int | `1` | |
|
|
||||||
| resources | object | `{}` | |
|
|
||||||
| securityContext | object | `{}` | |
|
|
||||||
| service.annotations | object | `{}` | |
|
|
||||||
| service.port | int | `80` | |
|
|
||||||
| service.type | string | `"ClusterIP"` | |
|
|
||||||
| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
|
|
||||||
| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
|
|
||||||
| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
|
|
||||||
| telemetry.prometheus.enabled | bool | `false` | |
|
|
||||||
| telemetry.prometheus.nginxExporter.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| telemetry.prometheus.nginxExporter.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
|
|
||||||
| telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` | The repository within the registry |
|
|
||||||
| telemetry.prometheus.nginxExporter.image.tag | string | `"0.11.0"` | Overrides the image tag |
|
|
||||||
| telemetry.prometheus.nginxExporter.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| telemetry.prometheus.nginxExporter.resources | object | `{}` | |
|
|
||||||
| telemetry.prometheus.podMonitor.enabled | bool | `false` | |
|
|
||||||
| telemetry.prometheus.podMonitor.labels | object | `{}` | |
|
|
||||||
| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider |
|
|
||||||
| telemetry.prometheus.port | int | `9988` | |
|
|
||||||
| tolerations | list | `[]` | |
|
|
||||||
| tools.kubectl.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| tools.kubectl.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
|
|
||||||
| tools.kubectl.image.repository | string | `"rancher/kubectl"` | The repository within the registry |
|
|
||||||
| tools.kubectl.image.tag | string | `""` | Overrides the image tag |
|
|
||||||
| tools.kubectl.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
|
|
||||||
|
|
||||||
----------------------------------------------
|
| Name | Description | Value |
|
||||||
|
| ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||||
|
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
||||||
|
| `replicaCount` | Replica count | `1` |
|
||||||
|
| `namespaceOverride` | Namespace override | `""` |
|
||||||
|
| `annotations` | Annotations for the deployment | `{}` |
|
||||||
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
|
| `image.repository` | The repository within the registry | `spiffe/oidc-discovery-provider` |
|
||||||
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
|
| `resources` | Resource requests and limits | `{}` |
|
||||||
|
| `service.type` | Service type | `ClusterIP` |
|
||||||
|
| `service.port` | Service port | `80` |
|
||||||
|
| `service.annotations` | Annotations for service resource | `{}` |
|
||||||
|
| `configMap.annotations` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | `{}` |
|
||||||
|
| `podSecurityContext` | Pod security context for OIDC discovery provider pods | `{}` |
|
||||||
|
| `securityContext` | Security context for OIDC discovery provider deployment | `{}` |
|
||||||
|
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
||||||
|
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
||||||
|
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
|
||||||
|
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` |
|
||||||
|
| `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` |
|
||||||
|
| `insecureScheme.enabled` | Flag to enable insecure schema | `false` |
|
||||||
|
| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||||
|
| `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` |
|
||||||
|
| `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.24.0-alpine` |
|
||||||
|
| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` |
|
||||||
|
| `jwtIssuer` | Path to JWT issuer | `https://oidc-discovery.example.org` |
|
||||||
|
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||||
|
| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` |
|
||||||
|
| `config.acme.tosAccepted` | Flag for Terms of Service acceptance | `false` |
|
||||||
|
| `config.acme.cacheDir` | Path for cache directory | `/run/spire` |
|
||||||
|
| `config.acme.directoryUrl` | URL for acme directory | `https://acme-v02.api.letsencrypt.org/directory` |
|
||||||
|
| `config.acme.emailAddress` | Email address for registration | `[email protected]` |
|
||||||
|
| `imagePullSecrets` | Image pull secret names | `[]` |
|
||||||
|
| `nameOverride` | Name override | `""` |
|
||||||
|
| `fullnameOverride` | Full name override | `""` |
|
||||||
|
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||||
|
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||||
|
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
||||||
|
| `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||||
|
| `autoscaling.enabled` | Flag to enable autoscaling | `false` |
|
||||||
|
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
|
||||||
|
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` |
|
||||||
|
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` |
|
||||||
|
| `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` |
|
||||||
|
| `nodeSelector` | Node selector | `{}` |
|
||||||
|
| `tolerations` | iist of tolerations | `[]` |
|
||||||
|
| `affinity` | Node affinity | `{}` |
|
||||||
|
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||||
|
| `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` |
|
||||||
|
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
||||||
|
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
|
||||||
|
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
||||||
|
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the helm release | `""` |
|
||||||
|
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||||
|
| `telemetry.prometheus.nginxExporter.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||||
|
| `telemetry.prometheus.nginxExporter.image.repository` | The repository within the registry | `nginx/nginx-prometheus-exporter` |
|
||||||
|
| `telemetry.prometheus.nginxExporter.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `telemetry.prometheus.nginxExporter.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `telemetry.prometheus.nginxExporter.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.11.0` |
|
||||||
|
| `telemetry.prometheus.nginxExporter.resources` | Resource requests and limits | `{}` |
|
||||||
|
| `ingress.enabled` | Flag to enable ingress | `false` |
|
||||||
|
| `ingress.className` | Ingress class name | `""` |
|
||||||
|
| `ingress.annotations` | Annotations for ingress object | `{}` |
|
||||||
|
| `ingress.hosts` | Host paths for ingress object | `[]` |
|
||||||
|
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
|
||||||
|
| `tests.hostAliases` | List of host aliases for testing | `[]` |
|
||||||
|
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
|
||||||
|
| `tests.tls.customCA` | Custom CA value for tests | `""` |
|
||||||
|
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||||
|
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||||
|
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` |
|
||||||
|
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||||
|
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` |
|
||||||
|
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d717d0a2c88518f8e36d9cfe1571639a40617e8c4291e34876d46bdeefb1ab5a` |
|
||||||
|
| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` |
|
||||||
|
| `tests.busybox.image.repository` | The repository within the registry | `busybox` |
|
||||||
|
| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `tests.busybox.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `uclibc@sha256:3e516f71d8801b0ce6c3f8f8e4f11093ec04e168177a90f1da4498014ee06b6b` |
|
||||||
|
| `tests.agent.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
|
| `tests.agent.image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
||||||
|
| `tests.agent.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `tests.agent.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `tests.agent.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
|
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||||
|
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
|
||||||
|
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
|
|||||||
+116
@@ -0,0 +1,116 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
set -x
|
||||||
|
|
||||||
|
# https://gist.github.com/stokito/f2d7ea0b300f14638a9063559384ec89/
|
||||||
|
# Decode a JWT from stdin and verify it's signature with the JWT issuer public key
|
||||||
|
# Only RS256 keys are supported for signature check
|
||||||
|
#
|
||||||
|
# HOW TO USE:
|
||||||
|
# $ export JWTTOKEN="eyF...<your token here>...g"
|
||||||
|
# $ ./jwt-decode.sh https://example.com/keys "${JWTTOKEN}"
|
||||||
|
# if signature check failed then error code will be non-zero
|
||||||
|
|
||||||
|
URL=$1
|
||||||
|
|
||||||
|
JWT=$2
|
||||||
|
|
||||||
|
if [ -z "$(command -v jq)" ]; then
|
||||||
|
echo "This script will NOT work on your machine."
|
||||||
|
echo "Please install jq first: https://stedolan.github.io/jq/download/"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
base64_padding() {
|
||||||
|
local len=$(( ${#1} % 4 ))
|
||||||
|
local padded_b64=''
|
||||||
|
if [ ${len} = 2 ]; then
|
||||||
|
padded_b64="${1}=="
|
||||||
|
elif [ ${len} = 3 ]; then
|
||||||
|
padded_b64="${1}="
|
||||||
|
else
|
||||||
|
padded_b64="${1}"
|
||||||
|
fi
|
||||||
|
echo -n "$padded_b64"
|
||||||
|
}
|
||||||
|
|
||||||
|
base64url_to_b64() {
|
||||||
|
base64_padding "${1}" | tr -- '-_' '+/'
|
||||||
|
}
|
||||||
|
|
||||||
|
b2hex() { echo -n "$1"==== | fold -w 4 | sed '$ d' | tr -d '\n' |base64 -d | xxd -p | tr -d \\n; }
|
||||||
|
|
||||||
|
mint_rsa_key() {
|
||||||
|
JWK=$1
|
||||||
|
|
||||||
|
# Extract the modulus and exponent from the JWK, converting from URL-safe Base64 to standard Base64
|
||||||
|
MODULUS=$(echo "$JWK" | jq -r '.n' | tr '_-' '/+')
|
||||||
|
EXPONENT=$(echo "$JWK" | jq -r '.e' | tr '_-' '/+')
|
||||||
|
|
||||||
|
modulus=$(b2hex "$MODULUS")
|
||||||
|
exponent=$(b2hex "$EXPONENT")
|
||||||
|
|
||||||
|
asnconf=$(mktemp)
|
||||||
|
|
||||||
|
asnconf="asn1=SEQUENCE:pubkeyinfo\n[pubkeyinfo]\nalgorithm=SEQUENCE:rsa_alg\npubkey=BITWRAP,SEQUENCE:rsapubkey\n[rsa_alg]\nalgorithm=OID:rsaEncryption\nparameter=NULL\n[rsapubkey]\nn=INTEGER:0x$modulus\ne=INTEGER:0x$exponent"
|
||||||
|
|
||||||
|
derfile=$(mktemp)
|
||||||
|
echo >&2 "derfile: $derfile"
|
||||||
|
echo -e "$asnconf" | openssl asn1parse -genconf /dev/stdin -noout -out "$derfile"
|
||||||
|
|
||||||
|
openssl rsa -in "$derfile" -inform DER -pubin
|
||||||
|
}
|
||||||
|
|
||||||
|
# read the JWT from stdin and split by comma into three variables
|
||||||
|
IFS='.' read -r JWT_HEADER_B64URL JWT_PAYLOAD_B64URL JWT_SIGNATURE_B64URL <<< "${JWT}"
|
||||||
|
|
||||||
|
JWT_HEADER_B64=$(base64url_to_b64 "${JWT_HEADER_B64URL}")
|
||||||
|
JWT_PAYLOAD_B64=$(base64url_to_b64 "${JWT_PAYLOAD_B64URL}")
|
||||||
|
JWT_SIGNATURE_B64=$(base64url_to_b64 "${JWT_SIGNATURE_B64URL}")
|
||||||
|
|
||||||
|
JWT_HEADER=$(echo "${JWT_HEADER_B64}" | base64 -d)
|
||||||
|
JWT_PAYLOAD=$(echo "${JWT_PAYLOAD_B64}" | base64 -d)
|
||||||
|
|
||||||
|
echo "JWT Header:"
|
||||||
|
echo "${JWT_HEADER}" | jq
|
||||||
|
echo "JWT Payload:"
|
||||||
|
echo "${JWT_PAYLOAD}" | jq
|
||||||
|
echo "JWT Signature (Base 64 padded):"
|
||||||
|
echo "${JWT_SIGNATURE_B64}"
|
||||||
|
|
||||||
|
JWT_ALG=$(echo "$JWT_HEADER" | jq -r .alg)
|
||||||
|
JWT_KID=$(echo "$JWT_HEADER" | jq -r .kid)
|
||||||
|
#JWT_TYP=$(echo "$JWT_HEADER" | jq -r .typ)
|
||||||
|
#JWT_ISS=$(echo "$JWT_PAYLOAD" | jq -r .iss)
|
||||||
|
JWT_SUB=$(echo "$JWT_PAYLOAD" | jq -r .sub)
|
||||||
|
JWT_EMAIL=$(echo "$JWT_PAYLOAD" | jq -r .email)
|
||||||
|
JWT_IAT=$(echo "$JWT_PAYLOAD" | jq -r .iat)
|
||||||
|
echo "alg: $JWT_ALG kid: $JWT_KID"
|
||||||
|
echo "sub: $JWT_SUB email: $JWT_EMAIL iat: $JWT_IAT"
|
||||||
|
|
||||||
|
echo "URL: ${URL}"
|
||||||
|
JWK_SET=$(curl -k -s "${URL}")
|
||||||
|
echo >&2 "JWK_SET: $JWK_SET"
|
||||||
|
JWK=$(echo "$JWK_SET" | jq -c -r --arg KID "$JWT_KID" '.keys[] | select(.kid==$KID)')
|
||||||
|
echo >&2 "JWK: $JWK"
|
||||||
|
|
||||||
|
PUB_KEY_FILE=$(mktemp)
|
||||||
|
mint_rsa_key "$JWK" > "$PUB_KEY_FILE"
|
||||||
|
|
||||||
|
# verify signature
|
||||||
|
if [ "${JWT_ALG}" = "RS256" ]; then
|
||||||
|
#SIG_FILE="/tmp/$JWT_SUB-$JWT_IAT.sig.dat"
|
||||||
|
SIG_FILE=$(mktemp)
|
||||||
|
echo -n "$JWT_SIGNATURE_B64" | base64 -d > "${SIG_FILE}"
|
||||||
|
JWT_BODY=$(echo -n "$JWT_HEADER_B64URL.$JWT_PAYLOAD_B64URL")
|
||||||
|
echo -n "$JWT_BODY" | openssl dgst -sha256 -verify "${PUB_KEY_FILE}" -signature "${SIG_FILE}"
|
||||||
|
JWT_SIG_VERIFIED=$?
|
||||||
|
rm "${SIG_FILE}"
|
||||||
|
if [ ${JWT_SIG_VERIFIED} -ne 0 ]; then
|
||||||
|
>&2 echo "Bad Signature"
|
||||||
|
exit ${JWT_SIG_VERIFIED};
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
>&2 echo "Error 3: Unsupported signature algorithm $JWT_ALG"
|
||||||
|
exit 3
|
||||||
|
fi
|
||||||
+24
@@ -1,3 +1,4 @@
|
|||||||
|
{{ $values := merge .Values }}
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: Pod
|
kind: Pod
|
||||||
metadata:
|
metadata:
|
||||||
@@ -33,8 +34,31 @@ spec:
|
|||||||
- name: curl-ingress
|
- name: curl-ingress
|
||||||
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
|
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
|
||||||
command: ['curl']
|
command: ['curl']
|
||||||
|
{{- if dig "tests" "tls" "enabled" false $values }}
|
||||||
|
{{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
|
||||||
|
args: ['-s', '-f', '--cacert', '/ca/ca.crt', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
|
||||||
|
{{- else }}
|
||||||
|
args: ['-s', '-f', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: custom-ca
|
||||||
|
mountPath: /ca
|
||||||
|
{{- end }}
|
||||||
|
{{- else }}
|
||||||
args: ['-s', '-f', 'http://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
|
args: ['-s', '-f', 'http://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
|
||||||
|
{{- end }}
|
||||||
securityContext:
|
securityContext:
|
||||||
{{- toYaml .Values.securityContext | nindent 8 }}
|
{{- toYaml .Values.securityContext | nindent 8 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if ne (len (dig "tests" "hostAliases" "" $values)) 0 }}
|
||||||
|
hostAliases:
|
||||||
|
{{- toYaml .Values.tests.hostAliases | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
|
||||||
|
volumes:
|
||||||
|
- name: custom-ca
|
||||||
|
secret:
|
||||||
|
secretName: {{ .Values.tests.tls.customCA }}
|
||||||
|
{{- end }}
|
||||||
restartPolicy: Never
|
restartPolicy: Never
|
||||||
|
|||||||
@@ -0,0 +1,87 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata:
|
||||||
|
name: "{{ include "spiffe-oidc-discovery-provider.fullname" . }}-test-keys"
|
||||||
|
namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": test
|
||||||
|
spec:
|
||||||
|
{{- with .Values.podSecurityContext }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}
|
||||||
|
initContainers:
|
||||||
|
- name: static-busybox
|
||||||
|
image: {{ template "spire-lib.image" (dict "image" .Values.tests.busybox.image "global" .Values.global) }}
|
||||||
|
command:
|
||||||
|
- sh
|
||||||
|
- -c
|
||||||
|
- |
|
||||||
|
cp /bin/busybox /data/busybox
|
||||||
|
chmod +x /data/busybox
|
||||||
|
{{- with .Values.securityContext }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: data-volume
|
||||||
|
mountPath: /data
|
||||||
|
- name: gettoken
|
||||||
|
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version "image" .Values.tests.agent.image) }}
|
||||||
|
command:
|
||||||
|
- /data/busybox
|
||||||
|
- sh
|
||||||
|
- -c
|
||||||
|
- |
|
||||||
|
while true; do
|
||||||
|
/opt/spire/bin/spire-agent api fetch jwt -audience foo -format json -socketPath /spire-agent/spire-agent.sock -timeout 5s > /data/token.svid
|
||||||
|
[ $? -eq 0 ] && break
|
||||||
|
sleep 1
|
||||||
|
done
|
||||||
|
{{- with .Values.securityContext }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: data-volume
|
||||||
|
mountPath: /data
|
||||||
|
- name: spire-api
|
||||||
|
mountPath: /spire-agent
|
||||||
|
readOnly: true
|
||||||
|
containers:
|
||||||
|
- name: verify-keys
|
||||||
|
image: {{ template "spire-lib.image" (dict "image" .Values.tests.toolkit.image "global" .Values.global) }}
|
||||||
|
command:
|
||||||
|
- bash
|
||||||
|
env:
|
||||||
|
- name: TMPDIR
|
||||||
|
value: /data
|
||||||
|
args:
|
||||||
|
- -c
|
||||||
|
- |
|
||||||
|
URL=http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}
|
||||||
|
curl -k -s -f "${URL}"/keys
|
||||||
|
JWT=$(cat /data/token.svid | jq -r '.[].svids[0].svid' | xargs)
|
||||||
|
cat <<'EOF' >> /data/jwt-decode.sh
|
||||||
|
{{- (.Files.Get "files/test/jwt-decode.sh") | nindent 10 }}
|
||||||
|
EOF
|
||||||
|
bash /data/jwt-decode.sh "${URL}"/keys "${JWT}"
|
||||||
|
{{- with .Values.securityContext }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /data
|
||||||
|
name: data-volume
|
||||||
|
restartPolicy: Never
|
||||||
|
volumes:
|
||||||
|
- csi:
|
||||||
|
driver: csi.spiffe.io
|
||||||
|
readOnly: true
|
||||||
|
name: spire-api
|
||||||
|
- name: data-volume
|
||||||
|
emptyDir: {}
|
||||||
|
---
|
||||||
@@ -1,32 +1,37 @@
|
|||||||
# Default values for spiffe-oidc-discovery-provider.
|
# Default configuration for Spire OIDC Provider chart
|
||||||
# This is a YAML-formatted file.
|
# SPDX-License-Identifier: APACHE-2.0
|
||||||
# Declare variables to be passed into your templates.
|
|
||||||
|
|
||||||
# @ignored
|
## @skip global
|
||||||
global: {}
|
global: {}
|
||||||
|
|
||||||
# -- The name of the spire-agent unix socket
|
## @section Chart parameters
|
||||||
|
##
|
||||||
|
## @param agentSocketName The name of the spire-agent unix socket
|
||||||
agentSocketName: spire-agent.sock
|
agentSocketName: spire-agent.sock
|
||||||
|
|
||||||
|
## @param replicaCount Replica count
|
||||||
replicaCount: 1
|
replicaCount: 1
|
||||||
|
|
||||||
|
## @param namespaceOverride Namespace override
|
||||||
namespaceOverride: ""
|
namespaceOverride: ""
|
||||||
|
|
||||||
# -- Annotations for the deployment
|
## @param annotations [object] Annotations for the deployment
|
||||||
annotations: {}
|
annotations: {}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
# -- The OCI registry to pull the image from
|
## @param image.registry The OCI registry to pull the image from
|
||||||
|
## @param image.repository The repository within the registry
|
||||||
|
## @param image.pullPolicy The image pull policy
|
||||||
|
## @param image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
registry: ghcr.io
|
registry: ghcr.io
|
||||||
# -- The repository within the registry
|
|
||||||
repository: spiffe/oidc-discovery-provider
|
repository: spiffe/oidc-discovery-provider
|
||||||
# -- The image pull policy
|
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
||||||
version: ""
|
version: ""
|
||||||
# -- Overrides the image tag whose default is the chart appVersion
|
|
||||||
tag: ""
|
tag: ""
|
||||||
|
|
||||||
|
## @param resources [object] Resource requests and limits
|
||||||
resources: {}
|
resources: {}
|
||||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
# choice for the user. This also increases chances charts run on environments with little
|
# choice for the user. This also increases chances charts run on environments with little
|
||||||
@@ -39,19 +44,25 @@ resources: {}
|
|||||||
# cpu: 100m
|
# cpu: 100m
|
||||||
# memory: 64Mi
|
# memory: 64Mi
|
||||||
|
|
||||||
|
## @param service.type Service type
|
||||||
|
## @param service.port Service port
|
||||||
|
## @param service.annotations Annotations for service resource
|
||||||
|
##
|
||||||
service:
|
service:
|
||||||
type: ClusterIP
|
type: ClusterIP
|
||||||
port: 80
|
port: 80
|
||||||
annotations: {}
|
annotations: {}
|
||||||
# external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org
|
# external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org
|
||||||
|
|
||||||
configMap:
|
configMap:
|
||||||
# -- Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap
|
## @param configMap.annotations [object] Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap
|
||||||
annotations: {}
|
annotations: {}
|
||||||
|
|
||||||
|
## @param podSecurityContext [object] Pod security context for OIDC discovery provider pods
|
||||||
podSecurityContext: {}
|
podSecurityContext: {}
|
||||||
# fsGroup: 2000
|
# fsGroup: 2000
|
||||||
|
|
||||||
|
## @param securityContext [object] Security context for OIDC discovery provider deployment
|
||||||
securityContext: {}
|
securityContext: {}
|
||||||
# capabilities:
|
# capabilities:
|
||||||
# drop:
|
# drop:
|
||||||
@@ -60,41 +71,48 @@ securityContext: {}
|
|||||||
# runAsNonRoot: true
|
# runAsNonRoot: true
|
||||||
# runAsUser: 1000
|
# runAsUser: 1000
|
||||||
|
|
||||||
|
## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
|
||||||
|
## @param readinessProbe.periodSeconds Period seconds for readinessProbe
|
||||||
|
##
|
||||||
readinessProbe:
|
readinessProbe:
|
||||||
# -- Initial delay seconds for readinessProbe
|
|
||||||
initialDelaySeconds: 5
|
initialDelaySeconds: 5
|
||||||
# -- Period seconds for readinessProbe
|
|
||||||
periodSeconds: 5
|
periodSeconds: 5
|
||||||
|
|
||||||
|
## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
|
||||||
|
## @param livenessProbe.periodSeconds Period seconds for livenessProbe
|
||||||
|
##
|
||||||
livenessProbe:
|
livenessProbe:
|
||||||
# -- Initial delay seconds for livenessProbe
|
|
||||||
initialDelaySeconds: 5
|
initialDelaySeconds: 5
|
||||||
# -- Period seconds for livenessProbe
|
|
||||||
periodSeconds: 5
|
periodSeconds: 5
|
||||||
|
|
||||||
|
## @param podAnnotations [object] Pod annotations for Spire OIDC discovery provider
|
||||||
podAnnotations: {}
|
podAnnotations: {}
|
||||||
|
|
||||||
insecureScheme:
|
insecureScheme:
|
||||||
|
## @param insecureScheme.enabled Flag to enable insecure schema
|
||||||
enabled: false
|
enabled: false
|
||||||
|
|
||||||
nginx:
|
nginx:
|
||||||
|
## @param insecureScheme.nginx.image.registry The OCI registry to pull the image from
|
||||||
|
## @param insecureScheme.nginx.image.repository The repository within the registry
|
||||||
|
## @param insecureScheme.nginx.image.pullPolicy The image pull policy
|
||||||
|
## @param insecureScheme.nginx.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param insecureScheme.nginx.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
## Example:
|
||||||
|
## chainguard image does not support the templates feature
|
||||||
|
## https://github.com/chainguard-images/nginx/issues/43
|
||||||
|
## registry: cgr.dev
|
||||||
|
## repository: chainguard/nginx
|
||||||
|
## pullPolicy: IfNotPresent
|
||||||
|
## tag: "1.23.2"
|
||||||
|
##
|
||||||
image:
|
image:
|
||||||
# -- The OCI registry to pull the image from
|
|
||||||
registry: docker.io
|
registry: docker.io
|
||||||
# -- The repository within the registry
|
|
||||||
repository: nginxinc/nginx-unprivileged
|
repository: nginxinc/nginx-unprivileged
|
||||||
# -- The image pull policy
|
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
||||||
version: ""
|
version: ""
|
||||||
# -- Overrides the image tag
|
|
||||||
tag: 1.24.0-alpine
|
tag: 1.24.0-alpine
|
||||||
# chainguard image does not support the templates feature
|
## @param insecureScheme.nginx.resources Resource requests and limits
|
||||||
# https://github.com/chainguard-images/nginx/issues/43
|
|
||||||
# registry: cgr.dev
|
|
||||||
# repository: chainguard/nginx
|
|
||||||
# pullPolicy: IfNotPresent
|
|
||||||
# tag: "1.23.2"
|
|
||||||
resources: {}
|
resources: {}
|
||||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
# choice for the user. This also increases chances charts run on environments with little
|
# choice for the user. This also increases chances charts run on environments with little
|
||||||
@@ -107,38 +125,54 @@ insecureScheme:
|
|||||||
# cpu: 100m
|
# cpu: 100m
|
||||||
# memory: 64Mi
|
# memory: 64Mi
|
||||||
|
|
||||||
|
## @param jwtIssuer Path to JWT issuer
|
||||||
jwtIssuer: https://oidc-discovery.example.org
|
jwtIssuer: https://oidc-discovery.example.org
|
||||||
|
|
||||||
config:
|
config:
|
||||||
# -- The log level, valid values are "debug", "info", "warn", and "error"
|
## @param config.logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
||||||
logLevel: info
|
logLevel: info
|
||||||
# -- Add additional domains that can be used for oidc discovery
|
## @param config.additionalDomains [array] Add additional domains that can be used for oidc discovery
|
||||||
additionalDomains:
|
additionalDomains:
|
||||||
- localhost
|
- localhost
|
||||||
|
|
||||||
acme:
|
acme:
|
||||||
|
## @param config.acme.tosAccepted Flag for Terms of Service acceptance
|
||||||
tosAccepted: false
|
tosAccepted: false
|
||||||
|
## @param config.acme.cacheDir Path for cache directory
|
||||||
cacheDir: /run/spire
|
cacheDir: /run/spire
|
||||||
|
## @param config.acme.directoryUrl URL for acme directory
|
||||||
directoryUrl: https://acme-v02.api.letsencrypt.org/directory
|
directoryUrl: https://acme-v02.api.letsencrypt.org/directory
|
||||||
|
## @param config.acme.emailAddress Email address for registration
|
||||||
emailAddress: [email protected]
|
emailAddress: [email protected]
|
||||||
|
|
||||||
|
## @param imagePullSecrets [array] Image pull secret names
|
||||||
imagePullSecrets: []
|
imagePullSecrets: []
|
||||||
|
|
||||||
|
## @param nameOverride Name override
|
||||||
nameOverride: ""
|
nameOverride: ""
|
||||||
|
|
||||||
|
## @param fullnameOverride Full name override
|
||||||
fullnameOverride: ""
|
fullnameOverride: ""
|
||||||
|
|
||||||
|
## @param serviceAccount.create Specifies whether a service account should be created
|
||||||
|
## @param serviceAccount.annotations Annotations to add to the service account
|
||||||
|
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
|
||||||
|
##
|
||||||
serviceAccount:
|
serviceAccount:
|
||||||
# -- Specifies whether a service account should be created
|
|
||||||
create: true
|
create: true
|
||||||
# -- Annotations to add to the service account
|
|
||||||
annotations: {}
|
annotations: {}
|
||||||
# -- The name of the service account to use.
|
|
||||||
# If not set and create is true, a name is generated using the fullname template
|
|
||||||
name: ""
|
name: ""
|
||||||
|
|
||||||
deleteHook:
|
deleteHook:
|
||||||
# -- Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`)
|
## @param deleteHook.enabled Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`)
|
||||||
enabled: true
|
enabled: true
|
||||||
|
|
||||||
|
## @param autoscaling.enabled Flag to enable autoscaling
|
||||||
|
## @param autoscaling.minReplicas Minimum replicas for autoscaling
|
||||||
|
## @param autoscaling.maxReplicas Maximum replicas for autoscaling
|
||||||
|
## @param autoscaling.targetCPUUtilizationPercentage Target CPU utlization that triggers autoscaling
|
||||||
|
## @param autoscaling.targetMemoryUtilizationPercentage Target Memory utlization that triggers autoscaling
|
||||||
|
##
|
||||||
autoscaling:
|
autoscaling:
|
||||||
enabled: false
|
enabled: false
|
||||||
minReplicas: 1
|
minReplicas: 1
|
||||||
@@ -146,40 +180,50 @@ autoscaling:
|
|||||||
targetCPUUtilizationPercentage: 80
|
targetCPUUtilizationPercentage: 80
|
||||||
targetMemoryUtilizationPercentage: 80
|
targetMemoryUtilizationPercentage: 80
|
||||||
|
|
||||||
|
## @param nodeSelector [object] Node selector
|
||||||
nodeSelector: {}
|
nodeSelector: {}
|
||||||
|
|
||||||
|
## @param tolerations [array] iist of tolerations
|
||||||
tolerations: []
|
tolerations: []
|
||||||
|
|
||||||
|
## @param affinity [object] Node affinity
|
||||||
affinity: {}
|
affinity: {}
|
||||||
|
|
||||||
# -- Set the trust domain to be used for the SPIFFE identifiers
|
## @param trustDomain Set the trust domain to be used for the SPIFFE identifiers
|
||||||
trustDomain: example.org
|
trustDomain: example.org
|
||||||
# -- The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)
|
|
||||||
|
## @param clusterDomain The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)
|
||||||
clusterDomain: cluster.local
|
clusterDomain: cluster.local
|
||||||
|
|
||||||
telemetry:
|
telemetry:
|
||||||
prometheus:
|
prometheus:
|
||||||
|
## @param telemetry.prometheus.enabled Flag to enable prometheus monitoring
|
||||||
enabled: false
|
enabled: false
|
||||||
|
## @param telemetry.prometheus.port Port for prometheus metrics
|
||||||
port: 9988
|
port: 9988
|
||||||
podMonitor:
|
podMonitor:
|
||||||
|
## @param telemetry.prometheus.podMonitor.enabled Enable podMonitor for prometheus
|
||||||
enabled: false
|
enabled: false
|
||||||
# -- Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider
|
## @param telemetry.prometheus.podMonitor.namespace Override where to install the podMonitor, if not set will use the same namespace as the helm release
|
||||||
namespace: ""
|
namespace: ""
|
||||||
|
## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring
|
||||||
labels: {}
|
labels: {}
|
||||||
|
|
||||||
nginxExporter:
|
nginxExporter:
|
||||||
|
## @param telemetry.prometheus.nginxExporter.image.registry The OCI registry to pull the image from
|
||||||
|
## @param telemetry.prometheus.nginxExporter.image.repository The repository within the registry
|
||||||
|
## @param telemetry.prometheus.nginxExporter.image.pullPolicy The image pull policy
|
||||||
|
## @param telemetry.prometheus.nginxExporter.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param telemetry.prometheus.nginxExporter.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
image:
|
image:
|
||||||
# -- The OCI registry to pull the image from
|
|
||||||
registry: docker.io
|
registry: docker.io
|
||||||
# -- The repository within the registry
|
|
||||||
repository: nginx/nginx-prometheus-exporter
|
repository: nginx/nginx-prometheus-exporter
|
||||||
# -- The image pull policy
|
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
||||||
version: ""
|
version: ""
|
||||||
# -- Overrides the image tag
|
|
||||||
tag: "0.11.0"
|
tag: "0.11.0"
|
||||||
|
|
||||||
|
## @param telemetry.prometheus.nginxExporter.resources [object] Resource requests and limits
|
||||||
resources: {}
|
resources: {}
|
||||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
# choice for the user. This also increases chances charts run on environments with little
|
# choice for the user. This also increases chances charts run on environments with little
|
||||||
@@ -193,48 +237,104 @@ telemetry:
|
|||||||
# memory: 64Mi
|
# memory: 64Mi
|
||||||
|
|
||||||
ingress:
|
ingress:
|
||||||
|
## @param ingress.enabled Flag to enable ingress
|
||||||
enabled: false
|
enabled: false
|
||||||
|
## @param ingress.className Ingress class name
|
||||||
className: ""
|
className: ""
|
||||||
|
## @param ingress.annotations [object] Annotations for ingress object
|
||||||
annotations: {}
|
annotations: {}
|
||||||
# kubernetes.io/ingress.class: nginx
|
# kubernetes.io/ingress.class: nginx
|
||||||
# kubernetes.io/tls-acme: "true"
|
# kubernetes.io/tls-acme: "true"
|
||||||
# nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
# nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||||
# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||||
|
|
||||||
|
## @param ingress.hosts [array] Host paths for ingress object
|
||||||
hosts:
|
hosts:
|
||||||
- host: oidc-discovery.example.org
|
- host: oidc-discovery.example.org
|
||||||
paths:
|
paths:
|
||||||
- path: /
|
- path: /
|
||||||
pathType: Prefix
|
pathType: Prefix
|
||||||
|
## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress
|
||||||
tls: []
|
tls: []
|
||||||
# - secretName: chart-example-tls
|
# - secretName: chart-example-tls
|
||||||
# hosts:
|
# hosts:
|
||||||
# - oidc-discovery.example.org
|
# - oidc-discovery.example.org
|
||||||
|
|
||||||
# @ignored
|
|
||||||
tests:
|
tests:
|
||||||
|
## @param tests.hostAliases [array] List of host aliases for testing
|
||||||
|
hostAliases: []
|
||||||
|
tls:
|
||||||
|
## @param tests.tls.enabled Flag for enabling tls for tests
|
||||||
|
enabled: false
|
||||||
|
## @param tests.tls.customCA Custom CA value for tests
|
||||||
|
customCA: ""
|
||||||
bash:
|
bash:
|
||||||
|
## @param tests.bash.image.registry The OCI registry to pull the image from
|
||||||
|
## @param tests.bash.image.repository The repository within the registry
|
||||||
|
## @param tests.bash.image.pullPolicy The image pull policy
|
||||||
|
## @param tests.bash.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param tests.bash.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
image:
|
image:
|
||||||
# -- The OCI registry to pull the tests image from
|
|
||||||
registry: cgr.dev
|
registry: cgr.dev
|
||||||
# -- The repository within the registry
|
|
||||||
repository: chainguard/bash
|
repository: chainguard/bash
|
||||||
# -- The tests image pull policy
|
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
||||||
version: ""
|
version: ""
|
||||||
# -- Overrides the image tag
|
|
||||||
tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4
|
tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4
|
||||||
|
|
||||||
|
toolkit:
|
||||||
|
## @param tests.toolkit.image.registry The OCI registry to pull the image from
|
||||||
|
## @param tests.toolkit.image.repository The repository within the registry
|
||||||
|
## @param tests.toolkit.image.pullPolicy The image pull policy
|
||||||
|
## @param tests.toolkit.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param tests.toolkit.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
|
image:
|
||||||
|
registry: cgr.dev
|
||||||
|
repository: chainguard/slim-toolkit-debug
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
version: ""
|
||||||
|
tag: latest@sha256:d717d0a2c88518f8e36d9cfe1571639a40617e8c4291e34876d46bdeefb1ab5a
|
||||||
|
|
||||||
|
busybox:
|
||||||
|
## @param tests.busybox.image.registry The OCI registry to pull the image from
|
||||||
|
## @param tests.busybox.image.repository The repository within the registry
|
||||||
|
## @param tests.busybox.image.pullPolicy The image pull policy
|
||||||
|
## @param tests.busybox.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param tests.busybox.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
|
image:
|
||||||
|
registry: ""
|
||||||
|
repository: busybox
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
version: ""
|
||||||
|
tag: uclibc@sha256:3e516f71d8801b0ce6c3f8f8e4f11093ec04e168177a90f1da4498014ee06b6b
|
||||||
|
|
||||||
|
agent:
|
||||||
|
## @param tests.agent.image.registry The OCI registry to pull the image from
|
||||||
|
## @param tests.agent.image.repository The repository within the registry
|
||||||
|
## @param tests.agent.image.pullPolicy The image pull policy
|
||||||
|
## @param tests.agent.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param tests.agent.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
|
image:
|
||||||
|
registry: ghcr.io
|
||||||
|
repository: spiffe/spire-agent
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
version: ""
|
||||||
|
tag: ""
|
||||||
|
|
||||||
tools:
|
tools:
|
||||||
kubectl:
|
kubectl:
|
||||||
|
## @param tools.kubectl.image.registry The OCI registry to pull the image from
|
||||||
|
## @param tools.kubectl.image.repository The repository within the registry
|
||||||
|
## @param tools.kubectl.image.pullPolicy The image pull policy
|
||||||
|
## @param tools.kubectl.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param tools.kubectl.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
image:
|
image:
|
||||||
# -- The OCI registry to pull the image from
|
|
||||||
registry: docker.io
|
registry: docker.io
|
||||||
# -- The repository within the registry
|
|
||||||
repository: rancher/kubectl
|
repository: rancher/kubectl
|
||||||
# -- The image pull policy
|
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
||||||
version: ""
|
version: ""
|
||||||
# -- Overrides the image tag
|
|
||||||
tag: ""
|
tag: ""
|
||||||
|
|||||||
@@ -25,68 +25,74 @@ A Helm chart to install the SPIRE agent.
|
|||||||
|
|
||||||
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||||
|
|
||||||
## Values
|
## Parameters
|
||||||
|
|
||||||
| Key | Type | Default | Description |
|
### Chart parameters
|
||||||
|-----|------|---------|-------------|
|
|
||||||
| bundleConfigMap | string | `"spire-bundle"` | |
|
|
||||||
| clusterName | string | `"example-cluster"` | |
|
|
||||||
| configMap.annotations | object | `{}` | Annotations to add to the SPIRE Agent ConfigMap |
|
|
||||||
| extraContainers | list | `[]` | |
|
|
||||||
| extraVolumeMounts | list | `[]` | |
|
|
||||||
| extraVolumes | list | `[]` | |
|
|
||||||
| fsGroupFix.image.pullPolicy | string | `"Always"` | The image pull policy |
|
|
||||||
| fsGroupFix.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
|
|
||||||
| fsGroupFix.image.repository | string | `"chainguard/bash"` | The repository within the registry |
|
|
||||||
| fsGroupFix.image.tag | string | `"latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4"` | Overrides the image tag |
|
|
||||||
| fsGroupFix.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| fsGroupFix.resources | object | `{}` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
|
|
||||||
| fullnameOverride | string | `""` | |
|
|
||||||
| healthChecks.port | int | `9980` | override the host port used for health checking |
|
|
||||||
| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
|
|
||||||
| image.repository | string | `"spiffe/spire-agent"` | The repository within the registry |
|
|
||||||
| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
|
|
||||||
| image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| imagePullSecrets | list | `[]` | |
|
|
||||||
| initContainers | list | `[]` | |
|
|
||||||
| livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe |
|
|
||||||
| livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe |
|
|
||||||
| logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
|
|
||||||
| nameOverride | string | `""` | |
|
|
||||||
| namespaceOverride | string | `""` | |
|
|
||||||
| nodeSelector | object | `{}` | |
|
|
||||||
| podAnnotations | object | `{}` | |
|
|
||||||
| podSecurityContext | object | `{}` | |
|
|
||||||
| priorityClassName | string | `""` | Priority class assigned to daemonset pods |
|
|
||||||
| readinessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for readinessProbe |
|
|
||||||
| readinessProbe.periodSeconds | int | `60` | Period seconds for readinessProbe |
|
|
||||||
| resources | object | `{}` | |
|
|
||||||
| securityContext | object | `{}` | |
|
|
||||||
| server.address | string | `""` | |
|
|
||||||
| server.namespaceOverride | string | `""` | |
|
|
||||||
| server.port | int | `8081` | |
|
|
||||||
| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
|
|
||||||
| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
|
|
||||||
| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
|
|
||||||
| socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent |
|
|
||||||
| telemetry.prometheus.enabled | bool | `false` | |
|
|
||||||
| telemetry.prometheus.podMonitor.enabled | bool | `false` | |
|
|
||||||
| telemetry.prometheus.podMonitor.labels | object | `{}` | |
|
|
||||||
| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent |
|
|
||||||
| telemetry.prometheus.port | int | `9988` | |
|
|
||||||
| tolerations | list | `[]` | |
|
|
||||||
| trustBundleFormat | string | `"pem"` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" |
|
|
||||||
| trustBundleURL | string | `""` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap |
|
|
||||||
| trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers |
|
|
||||||
| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
|
|
||||||
| waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry |
|
|
||||||
| waitForIt.image.tag | string | `"latest@sha256:deeaccb164a67a4d7f585c4d416641b1f422c029911a29d72beae28221f823df"` | Overrides the image tag |
|
|
||||||
| waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| waitForIt.resources | object | `{}` | |
|
|
||||||
| workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio |
|
|
||||||
| workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped |
|
|
||||||
| workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor |
|
|
||||||
|
|
||||||
----------------------------------------------
|
| Name | Description | Value |
|
||||||
|
| ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||||
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
|
| `image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
||||||
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
|
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||||
|
| `nameOverride` | Name override | `""` |
|
||||||
|
| `namespaceOverride` | Namespace override | `""` |
|
||||||
|
| `fullnameOverride` | Fullname override | `""` |
|
||||||
|
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||||
|
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||||
|
| `serviceAccount.name` | The name of the service account to use. | `""` |
|
||||||
|
| `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` |
|
||||||
|
| `podAnnotations` | Annotations to add to pods | `{}` |
|
||||||
|
| `podSecurityContext` | Pod security context | `{}` |
|
||||||
|
| `securityContext` | Security context | `{}` |
|
||||||
|
| `resources` | Resource requests and limits | `{}` |
|
||||||
|
| `nodeSelector` | Node selector | `{}` |
|
||||||
|
| `tolerations` | List of tolerations | `[]` |
|
||||||
|
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||||
|
| `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` |
|
||||||
|
| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||||
|
| `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` |
|
||||||
|
| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `pem` |
|
||||||
|
| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` |
|
||||||
|
| `server.address` | Address for Spire server | `""` |
|
||||||
|
| `server.port` | Port number for Spire server | `8081` |
|
||||||
|
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
||||||
|
| `healthChecks.port` | override the host port used for health checking | `9980` |
|
||||||
|
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
|
||||||
|
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
|
||||||
|
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
|
||||||
|
| `readinessProbe.periodSeconds` | Period seconds for probe | `60` |
|
||||||
|
| `waitForIt.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||||
|
| `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` |
|
||||||
|
| `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `waitForIt.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:deeaccb164a67a4d7f585c4d416641b1f422c029911a29d72beae28221f823df` |
|
||||||
|
| `waitForIt.resources` | Resource requests and limits | `{}` |
|
||||||
|
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||||
|
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||||
|
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
|
||||||
|
| `fsGroupFix.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` |
|
||||||
|
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||||
|
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
|
||||||
|
| `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` |
|
||||||
|
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
|
||||||
|
| `sds.enabled` | Enables Envoy SDS configuration | `false` |
|
||||||
|
| `sds.defaultSvidName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` |
|
||||||
|
| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` |
|
||||||
|
| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` |
|
||||||
|
| `sds.disableSpiffeCertValidation` | Disable Envoy SDS custom validation | `false` |
|
||||||
|
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
||||||
|
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
|
||||||
|
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
||||||
|
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
|
||||||
|
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||||
|
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||||
|
| `priorityClassName` | Priority class assigned to daemonset pods | `""` |
|
||||||
|
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
|
||||||
|
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` |
|
||||||
|
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
|
||||||
|
| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` |
|
||||||
|
| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` |
|
||||||
|
|||||||
@@ -12,6 +12,13 @@ agent:
|
|||||||
trust_bundle_path: "/run/spire/bundle/bundle.crt"
|
trust_bundle_path: "/run/spire/bundle/bundle.crt"
|
||||||
{{- end }}
|
{{- end }}
|
||||||
trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
|
trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
|
||||||
|
{{- if .Values.sds.enabled }}
|
||||||
|
sds:
|
||||||
|
default_svid_name: {{ .Values.sds.defaultSvidName | quote }}
|
||||||
|
default_bundle_name: {{ .Values.sds.defaultBundleName | quote }}
|
||||||
|
default_all_bundles_name: {{ .Values.sds.defaultAllBundlesName | quote }}
|
||||||
|
disable_spiffe_cert_validation: {{ .Values.sds.disableSpiffeCertValidation }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
plugins:
|
plugins:
|
||||||
NodeAttestor:
|
NodeAttestor:
|
||||||
|
|||||||
@@ -33,6 +33,10 @@ spec:
|
|||||||
{{- if .Values.priorityClassName }}
|
{{- if .Values.priorityClassName }}
|
||||||
priorityClassName: {{ .Values.priorityClassName }}
|
priorityClassName: {{ .Values.priorityClassName }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if ne (len .Values.hostAliases) 0 }}
|
||||||
|
hostAliases:
|
||||||
|
{{- toYaml .Values.hostAliases | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
initContainers:
|
initContainers:
|
||||||
- name: init
|
- name: init
|
||||||
# This is a small image with wait-for-it, choose whatever image
|
# This is a small image with wait-for-it, choose whatever image
|
||||||
|
|||||||
@@ -1,13 +1,13 @@
|
|||||||
{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
|
{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
|
||||||
{{- $namespace := include "spiffe-oidc-discovery-provider.podMonitor.namespace" . }}
|
{{- $namespace := include "spire-agent.podMonitor.namespace" . }}
|
||||||
{{- $podNamespace := ( include "spiffe-oidc-discovery-provider.namespace" . ) }}
|
{{- $podNamespace := ( include "spire-agent.namespace" . ) }}
|
||||||
apiVersion: monitoring.coreos.com/v1
|
apiVersion: monitoring.coreos.com/v1
|
||||||
kind: PodMonitor
|
kind: PodMonitor
|
||||||
metadata:
|
metadata:
|
||||||
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
name: {{ include "spire-agent.fullname" . }}
|
||||||
namespace: {{ $namespace }}
|
namespace: {{ $namespace }}
|
||||||
labels:
|
labels:
|
||||||
{{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
|
{{- include "spire-agent.labels" . | nindent 4 }}
|
||||||
{{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }}
|
{{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }}
|
||||||
{{- .Values.global.telemetry.prometheus.podMonitor.labels | toYaml | nindent 4 }}
|
{{- .Values.global.telemetry.prometheus.podMonitor.labels | toYaml | nindent 4 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
@@ -17,7 +17,7 @@ metadata:
|
|||||||
spec:
|
spec:
|
||||||
selector:
|
selector:
|
||||||
matchLabels:
|
matchLabels:
|
||||||
{{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 6 }}
|
{{- include "spire-agent.selectorLabels" . | nindent 6 }}
|
||||||
podMetricsEndpoints:
|
podMetricsEndpoints:
|
||||||
- port: prom
|
- port: prom
|
||||||
{{- if ne $namespace $podNamespace }}
|
{{- if ne $namespace $podNamespace }}
|
||||||
|
|||||||
@@ -1,45 +1,57 @@
|
|||||||
# Default values for spire-agent.
|
# Default configuration for Spire Agent
|
||||||
# This is a YAML-formatted file.
|
# SPDX-License-Identifier: APACHE-2.0
|
||||||
# Declare variables to be passed into your templates.
|
|
||||||
|
|
||||||
# @ignored
|
## @skip global
|
||||||
global: {}
|
global: {}
|
||||||
|
|
||||||
|
## @section Chart parameters
|
||||||
|
##
|
||||||
|
## @param image.registry The OCI registry to pull the image from
|
||||||
|
## @param image.repository The repository within the registry
|
||||||
|
## @param image.pullPolicy The image pull policy
|
||||||
|
## @param image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
image:
|
image:
|
||||||
# -- The OCI registry to pull the image from
|
|
||||||
registry: ghcr.io
|
registry: ghcr.io
|
||||||
# -- The repository within the registry
|
|
||||||
repository: spiffe/spire-agent
|
repository: spiffe/spire-agent
|
||||||
# -- The image pull policy
|
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
||||||
version: ""
|
version: ""
|
||||||
# -- Overrides the image tag whose default is the chart appVersion.
|
|
||||||
tag: ""
|
tag: ""
|
||||||
|
|
||||||
|
## @param imagePullSecrets [array] Pull secrets for images
|
||||||
imagePullSecrets: []
|
imagePullSecrets: []
|
||||||
|
|
||||||
|
## @param nameOverride Name override
|
||||||
nameOverride: ""
|
nameOverride: ""
|
||||||
|
|
||||||
|
## @param namespaceOverride Namespace override
|
||||||
namespaceOverride: ""
|
namespaceOverride: ""
|
||||||
|
|
||||||
|
## @param fullnameOverride Fullname override
|
||||||
fullnameOverride: ""
|
fullnameOverride: ""
|
||||||
|
|
||||||
serviceAccount:
|
serviceAccount:
|
||||||
# -- Specifies whether a service account should be created
|
## @param serviceAccount.create Specifies whether a service account should be created
|
||||||
create: true
|
create: true
|
||||||
# -- Annotations to add to the service account
|
## @param serviceAccount.annotations [object] Annotations to add to the service account
|
||||||
annotations: {}
|
annotations: {}
|
||||||
# -- The name of the service account to use.
|
## @param serviceAccount.name The name of the service account to use.
|
||||||
# If not set and create is true, a name is generated using the fullname template
|
## If not set and create is true, a name is generated using the fullname template
|
||||||
name: ""
|
name: ""
|
||||||
|
|
||||||
configMap:
|
configMap:
|
||||||
# -- Annotations to add to the SPIRE Agent ConfigMap
|
## @param configMap.annotations [object] Annotations to add to the SPIRE Agent ConfigMap
|
||||||
annotations: {}
|
annotations: {}
|
||||||
|
|
||||||
|
## @param podAnnotations [object] Annotations to add to pods
|
||||||
podAnnotations: {}
|
podAnnotations: {}
|
||||||
|
|
||||||
|
## @param podSecurityContext [object] Pod security context
|
||||||
podSecurityContext: {}
|
podSecurityContext: {}
|
||||||
# fsGroup: 2000
|
# fsGroup: 2000
|
||||||
|
|
||||||
|
## @param securityContext [object] Security context
|
||||||
securityContext: {}
|
securityContext: {}
|
||||||
# capabilities:
|
# capabilities:
|
||||||
# drop:
|
# drop:
|
||||||
@@ -48,6 +60,7 @@ securityContext: {}
|
|||||||
# runAsNonRoot: true
|
# runAsNonRoot: true
|
||||||
# runAsUser: 1000
|
# runAsUser: 1000
|
||||||
|
|
||||||
|
## @param resources [object] Resource requests and limits
|
||||||
resources: {}
|
resources: {}
|
||||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
# choice for the user. This also increases chances charts run on environments with little
|
# choice for the user. This also increases chances charts run on environments with little
|
||||||
@@ -60,107 +73,145 @@ resources: {}
|
|||||||
# cpu: 100m
|
# cpu: 100m
|
||||||
# memory: 128Mi
|
# memory: 128Mi
|
||||||
|
|
||||||
|
## @param nodeSelector [object] Node selector
|
||||||
nodeSelector: {}
|
nodeSelector: {}
|
||||||
|
|
||||||
|
## @param tolerations [array] List of tolerations
|
||||||
tolerations: []
|
tolerations: []
|
||||||
|
|
||||||
# -- The log level, valid values are "debug", "info", "warn", and "error"
|
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
||||||
logLevel: info
|
logLevel: info
|
||||||
# -- The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)
|
## @param clusterName The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)
|
||||||
clusterName: example-cluster
|
clusterName: example-cluster
|
||||||
# -- The trust domain to be used for the SPIFFE identifiers
|
## @param trustDomain The trust domain to be used for the SPIFFE identifiers
|
||||||
trustDomain: example.org
|
trustDomain: example.org
|
||||||
# -- If set, obtain trust bundle from url instead of Kubernetes ConfigMap
|
## @param trustBundleURL If set, obtain trust bundle from url instead of Kubernetes ConfigMap
|
||||||
trustBundleURL: ""
|
trustBundleURL: ""
|
||||||
# -- If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe"
|
## @param trustBundleFormat If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe"
|
||||||
trustBundleFormat: pem
|
trustBundleFormat: pem
|
||||||
|
## @param bundleConfigMap Configmap name for Spire bundle
|
||||||
bundleConfigMap: spire-bundle
|
bundleConfigMap: spire-bundle
|
||||||
|
|
||||||
# @ignored
|
## @skip upstream
|
||||||
upstream: false
|
upstream: false
|
||||||
|
|
||||||
|
## @param server.address Address for Spire server
|
||||||
|
## @param server.port Port number for Spire server
|
||||||
|
## @param server.namespaceOverride Override the namespace for Spire server
|
||||||
|
##
|
||||||
server:
|
server:
|
||||||
address: ""
|
address: ""
|
||||||
port: 8081
|
port: 8081
|
||||||
namespaceOverride: ""
|
namespaceOverride: ""
|
||||||
|
|
||||||
healthChecks:
|
healthChecks:
|
||||||
# -- override the host port used for health checking
|
## @param healthChecks.port override the host port used for health checking
|
||||||
port: 9980
|
port: 9980
|
||||||
|
|
||||||
|
## @param livenessProbe.initialDelaySeconds Initial delay seconds for probe
|
||||||
|
## @param livenessProbe.periodSeconds Period seconds for probe
|
||||||
|
##
|
||||||
livenessProbe:
|
livenessProbe:
|
||||||
# -- Initial delay seconds for livenessProbe
|
|
||||||
initialDelaySeconds: 15
|
initialDelaySeconds: 15
|
||||||
# -- Period seconds for livenessProbe
|
|
||||||
periodSeconds: 60
|
periodSeconds: 60
|
||||||
|
|
||||||
|
## @param readinessProbe.initialDelaySeconds Initial delay seconds for probe
|
||||||
|
## @param readinessProbe.periodSeconds Period seconds for probe
|
||||||
|
##
|
||||||
readinessProbe:
|
readinessProbe:
|
||||||
# -- Initial delay seconds for readinessProbe
|
|
||||||
initialDelaySeconds: 15
|
initialDelaySeconds: 15
|
||||||
# -- Period seconds for readinessProbe
|
|
||||||
periodSeconds: 60
|
periodSeconds: 60
|
||||||
|
|
||||||
waitForIt:
|
waitForIt:
|
||||||
|
## @param waitForIt.image.registry The OCI registry to pull the image from
|
||||||
|
## @param waitForIt.image.repository The repository within the registry
|
||||||
|
## @param waitForIt.image.pullPolicy The image pull policy
|
||||||
|
## @param waitForIt.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param waitForIt.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
image:
|
image:
|
||||||
# -- The OCI registry to pull the image from
|
|
||||||
registry: cgr.dev
|
registry: cgr.dev
|
||||||
# -- The repository within the registry
|
|
||||||
repository: chainguard/wait-for-it
|
repository: chainguard/wait-for-it
|
||||||
# -- The image pull policy
|
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
||||||
version: ""
|
version: ""
|
||||||
# -- Overrides the image tag
|
|
||||||
tag: latest@sha256:deeaccb164a67a4d7f585c4d416641b1f422c029911a29d72beae28221f823df
|
tag: latest@sha256:deeaccb164a67a4d7f585c4d416641b1f422c029911a29d72beae28221f823df
|
||||||
|
|
||||||
|
## @param waitForIt.resources [object] Resource requests and limits
|
||||||
resources: {}
|
resources: {}
|
||||||
|
|
||||||
# When running as non root, needed to ensure the socket path has the correct permissions.
|
# When running as non root, needed to ensure the socket path has the correct permissions.
|
||||||
# Set runAsUser to a non-zero value in podSecurityContext to run as non-root user.
|
# Set runAsUser to a non-zero value in podSecurityContext to run as non-root user.
|
||||||
fsGroupFix:
|
fsGroupFix:
|
||||||
|
## @param fsGroupFix.image.registry The OCI registry to pull the image from
|
||||||
|
## @param fsGroupFix.image.repository The repository within the registry
|
||||||
|
## @param fsGroupFix.image.pullPolicy The image pull policy
|
||||||
|
## @param fsGroupFix.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param fsGroupFix.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
image:
|
image:
|
||||||
# -- The OCI registry to pull the image from
|
|
||||||
registry: cgr.dev
|
registry: cgr.dev
|
||||||
# -- The repository within the registry
|
|
||||||
repository: chainguard/bash
|
repository: chainguard/bash
|
||||||
# -- The image pull policy
|
|
||||||
pullPolicy: Always
|
pullPolicy: Always
|
||||||
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
||||||
version: ""
|
version: ""
|
||||||
# -- Overrides the image tag
|
|
||||||
tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4
|
tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4
|
||||||
# -- Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
|
||||||
|
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||||
resources: {}
|
resources: {}
|
||||||
|
|
||||||
# workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
|
# workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
|
||||||
workloadAttestors:
|
workloadAttestors:
|
||||||
# unix is a workload attestor which generates unix-based selectors like 'uid' and 'gid'.
|
# unix is a workload attestor which generates unix-based selectors like 'uid' and 'gid'.
|
||||||
unix:
|
unix:
|
||||||
# -- enables the Unix workload attestor
|
## @param workloadAttestors.unix.enabled Enables the Unix workload attestor
|
||||||
enabled: false
|
enabled: false
|
||||||
k8s:
|
k8s:
|
||||||
# -- If true, kubelet certificate verification is skipped
|
## @param workloadAttestors.k8s.skipKubeletVerification If true, kubelet certificate verification is skipped
|
||||||
skipKubeletVerification: true
|
skipKubeletVerification: true
|
||||||
# -- Set to true if using holdApplicationUntilProxyStarts in Istio
|
## @param workloadAttestors.k8s.disableContainerSelectors Set to true if using holdApplicationUntilProxyStarts in Istio
|
||||||
disableContainerSelectors: false
|
disableContainerSelectors: false
|
||||||
|
|
||||||
|
sds:
|
||||||
|
## @param sds.enabled Enables Envoy SDS configuration
|
||||||
|
enabled: false
|
||||||
|
## @param sds.defaultSvidName The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS
|
||||||
|
defaultSvidName: "default"
|
||||||
|
## @param sds.defaultBundleName The Validation Context resource name to use for the default X.509 bundle with Envoy SDS
|
||||||
|
defaultBundleName: "ROOTCA"
|
||||||
|
## @param sds.defaultAllBundlesName The Validation Context resource name to use for all bundles (including federated) with Envoy SDS
|
||||||
|
defaultAllBundlesName: "ALL"
|
||||||
|
## @param sds.disableSpiffeCertValidation Disable Envoy SDS custom validation
|
||||||
|
disableSpiffeCertValidation: false
|
||||||
|
|
||||||
telemetry:
|
telemetry:
|
||||||
prometheus:
|
prometheus:
|
||||||
|
## @param telemetry.prometheus.enabled Flag to enable prometheus monitoring
|
||||||
enabled: false
|
enabled: false
|
||||||
|
## @param telemetry.prometheus.port Port for prometheus metrics
|
||||||
port: 9988
|
port: 9988
|
||||||
podMonitor:
|
podMonitor:
|
||||||
|
## @param telemetry.prometheus.podMonitor.enabled Enable podMonitor for prometheus
|
||||||
enabled: false
|
enabled: false
|
||||||
# -- Override where to install the podMonitor, if not set will use the same namespace as the spire-agent
|
## @param telemetry.prometheus.podMonitor.namespace Override where to install the podMonitor, if not set will use the same namespace as the spire-agent
|
||||||
namespace: ""
|
namespace: ""
|
||||||
|
## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring
|
||||||
labels: {}
|
labels: {}
|
||||||
|
|
||||||
# -- The unix socket path to the spire-agent
|
## @param socketPath The unix socket path to the spire-agent
|
||||||
socketPath: /run/spire/agent-sockets/spire-agent.sock
|
socketPath: /run/spire/agent-sockets/spire-agent.sock
|
||||||
|
|
||||||
# -- Priority class assigned to daemonset pods
|
## @param priorityClassName Priority class assigned to daemonset pods
|
||||||
priorityClassName: ""
|
priorityClassName: ""
|
||||||
|
|
||||||
|
## @param extraVolumes [array] Extra volumes to be mounted on Spire Agent pods
|
||||||
extraVolumes: []
|
extraVolumes: []
|
||||||
|
|
||||||
|
## @param extraVolumeMounts [array] Extra volume mounts for Spire Agent pods
|
||||||
extraVolumeMounts: []
|
extraVolumeMounts: []
|
||||||
|
|
||||||
|
## @param extraContainers [array] Additional containers to create with Spire Agent pods
|
||||||
extraContainers: []
|
extraContainers: []
|
||||||
|
|
||||||
|
## @param initContainers [array] Additional init containers to create with Spire Agent pods
|
||||||
initContainers: []
|
initContainers: []
|
||||||
|
## @param hostAliases [array] Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/
|
||||||
|
hostAliases: []
|
||||||
|
|||||||
@@ -81,184 +81,209 @@ curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhos
|
|||||||
|
|
||||||
In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above.
|
In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above.
|
||||||
|
|
||||||
## Values
|
## Parameters
|
||||||
|
|
||||||
| Key | Type | Default | Description |
|
### Chart parameters
|
||||||
|-----|------|---------|-------------|
|
|
||||||
| affinity | object | `{}` | |
|
|
||||||
| autoscaling.enabled | bool | `false` | |
|
|
||||||
| autoscaling.maxReplicas | int | `100` | |
|
|
||||||
| autoscaling.minReplicas | int | `1` | |
|
|
||||||
| autoscaling.targetCPUUtilizationPercentage | int | `80` | |
|
|
||||||
| bundleConfigMap | string | `"spire-bundle"` | |
|
|
||||||
| caKeyType | string | `"rsa-2048"` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) |
|
|
||||||
| caTTL | string | `"24h"` | |
|
|
||||||
| ca_subject.common_name | string | `"example.org"` | |
|
|
||||||
| ca_subject.country | string | `"NL"` | |
|
|
||||||
| ca_subject.organization | string | `"Example"` | |
|
|
||||||
| clusterDomain | string | `"cluster.local"` | |
|
|
||||||
| clusterName | string | `"example-cluster"` | |
|
|
||||||
| configMap.annotations | object | `{}` | Annotations to add to the SPIRE Server ConfigMap |
|
|
||||||
| controllerManager.configMap.annotations | object | `{}` | Annotations to add to the Controller Manager ConfigMap |
|
|
||||||
| controllerManager.deleteHook.enabled | bool | `true` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) |
|
|
||||||
| controllerManager.enabled | bool | `false` | |
|
|
||||||
| controllerManager.identities.dnsNameTemplates | list | `[]` | |
|
|
||||||
| controllerManager.identities.enabled | bool | `true` | |
|
|
||||||
| controllerManager.identities.federatesWith | list | `[]` | |
|
|
||||||
| controllerManager.identities.namespaceSelector | object | `{}` | |
|
|
||||||
| controllerManager.identities.podSelector | object | `{}` | |
|
|
||||||
| controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | |
|
|
||||||
| controllerManager.ignoreNamespaces[0] | string | `"kube-system"` | |
|
|
||||||
| controllerManager.ignoreNamespaces[1] | string | `"kube-public"` | |
|
|
||||||
| controllerManager.ignoreNamespaces[2] | string | `"local-path-storage"` | |
|
|
||||||
| controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
|
|
||||||
| controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry |
|
|
||||||
| controllerManager.image.tag | string | `"0.2.3"` | Overrides the image tag |
|
|
||||||
| controllerManager.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| controllerManager.installAndUpgradeHook.enabled | bool | `true` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) |
|
|
||||||
| controllerManager.resources | object | `{}` | |
|
|
||||||
| controllerManager.securityContext | object | `{}` | |
|
|
||||||
| controllerManager.service.annotations | object | `{}` | |
|
|
||||||
| controllerManager.service.port | int | `443` | |
|
|
||||||
| controllerManager.service.type | string | `"ClusterIP"` | |
|
|
||||||
| controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | |
|
|
||||||
| dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
|
|
||||||
| dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
|
|
||||||
| dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |
|
|
||||||
| dataStore.sql.options | list | `[]` | Only used by "postgres" or "mysql" |
|
|
||||||
| dataStore.sql.password | string | `""` | Only used by "postgres" or "mysql" |
|
|
||||||
| dataStore.sql.plugin_data | object | `{}` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section |
|
|
||||||
| dataStore.sql.port | int | `0` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. |
|
|
||||||
| dataStore.sql.username | string | `"spire"` | Only used by "postgres" or "mysql" |
|
|
||||||
| defaultJwtSvidTTL | string | `"1h"` | |
|
|
||||||
| defaultX509SvidTTL | string | `"4h"` | |
|
|
||||||
| extraContainers | list | `[]` | |
|
|
||||||
| extraVolumeMounts | list | `[]` | |
|
|
||||||
| extraVolumes | list | `[]` | |
|
|
||||||
| federation.bundleEndpoint.address | string | `"0.0.0.0"` | |
|
|
||||||
| federation.bundleEndpoint.port | int | `8443` | |
|
|
||||||
| federation.enabled | bool | `false` | |
|
|
||||||
| federation.ingress.annotations | object | `{}` | |
|
|
||||||
| federation.ingress.className | string | `""` | |
|
|
||||||
| federation.ingress.enabled | bool | `false` | |
|
|
||||||
| federation.ingress.hosts[0].host | string | `"spire-server-federation.example.org"` | |
|
|
||||||
| federation.ingress.hosts[0].paths[0].path | string | `"/"` | |
|
|
||||||
| federation.ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | |
|
|
||||||
| federation.ingress.tls | list | `[]` | |
|
|
||||||
| fullnameOverride | string | `""` | |
|
|
||||||
| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
|
|
||||||
| image.repository | string | `"spiffe/spire-server"` | The repository within the registry |
|
|
||||||
| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
|
|
||||||
| image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| imagePullSecrets | list | `[]` | |
|
|
||||||
| ingress.annotations | object | `{}` | |
|
|
||||||
| ingress.className | string | `""` | |
|
|
||||||
| ingress.enabled | bool | `false` | |
|
|
||||||
| ingress.hosts[0].host | string | `"spire-server.example.org"` | |
|
|
||||||
| ingress.hosts[0].paths[0].path | string | `"/"` | |
|
|
||||||
| ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | |
|
|
||||||
| ingress.tls | list | `[]` | |
|
|
||||||
| initContainers | list | `[]` | |
|
|
||||||
| jwtIssuer | string | `"https://oidc-discovery.example.org"` | The JWT issuer domain |
|
|
||||||
| keyManager.awsKMS.accessKeyID | Optional | `""` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. |
|
|
||||||
| keyManager.awsKMS.enabled | bool | `false` | |
|
|
||||||
| keyManager.awsKMS.keyPolicy | object | `{"existingConfigMap":"","policy":""}` | Policy to use when creating keys. If no policy is specified, a default policy will be used. |
|
|
||||||
| keyManager.awsKMS.keyPolicy.existingConfigMap | Optional | `""` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. |
|
|
||||||
| keyManager.awsKMS.keyPolicy.policy | Optional | `""` | Key policy in JSON format. |
|
|
||||||
| keyManager.awsKMS.region | string | `""` | |
|
|
||||||
| keyManager.awsKMS.secretAccessKey | Optional | `""` | Secret access key for the AWS account. |
|
|
||||||
| keyManager.disk.enabled | bool | `true` | |
|
|
||||||
| keyManager.memory.enabled | bool | `false` | |
|
|
||||||
| livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe |
|
|
||||||
| livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe |
|
|
||||||
| livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe |
|
|
||||||
| livenessProbe.timeoutSeconds | int | `3` | Timeout in seconds for livenessProbe |
|
|
||||||
| logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
|
|
||||||
| nameOverride | string | `""` | |
|
|
||||||
| namespaceOverride | string | `""` | |
|
|
||||||
| nodeAttestor.k8sPsat.enabled | bool | `true` | |
|
|
||||||
| nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` | |
|
|
||||||
| nodeSelector | object | `{}` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) |
|
|
||||||
| notifier.k8sbundle.namespace | string | `""` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace |
|
|
||||||
| persistence.accessMode | string | `"ReadWriteOnce"` | |
|
|
||||||
| persistence.hostPath | string | `""` | Which path to use on the host when type = hostPath |
|
|
||||||
| persistence.size | string | `"1Gi"` | |
|
|
||||||
| persistence.storageClass | string | `nil` | |
|
|
||||||
| persistence.type | string | `"pvc"` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) |
|
|
||||||
| podAnnotations | object | `{}` | |
|
|
||||||
| podSecurityContext | object | `{}` | |
|
|
||||||
| readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe |
|
|
||||||
| readinessProbe.periodSeconds | int | `5` | Period seconds for readinessProbe |
|
|
||||||
| replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. |
|
|
||||||
| resources | object | `{}` | |
|
|
||||||
| securityContext | object | `{}` | |
|
|
||||||
| service.annotations | object | `{}` | |
|
|
||||||
| service.port | int | `8081` | |
|
|
||||||
| service.type | string | `"ClusterIP"` | |
|
|
||||||
| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
|
|
||||||
| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
|
|
||||||
| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
|
|
||||||
| telemetry.prometheus.enabled | bool | `false` | |
|
|
||||||
| telemetry.prometheus.podMonitor.enabled | bool | `false` | |
|
|
||||||
| telemetry.prometheus.podMonitor.labels | object | `{}` | |
|
|
||||||
| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
|
|
||||||
| tolerations | list | `[]` | |
|
|
||||||
| tools.kubectl.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
|
||||||
| tools.kubectl.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
|
|
||||||
| tools.kubectl.image.repository | string | `"rancher/kubectl"` | The repository within the registry |
|
|
||||||
| tools.kubectl.image.tag | string | `""` | Overrides the image tag |
|
|
||||||
| tools.kubectl.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| topologySpreadConstraints | list | `[]` | |
|
|
||||||
| tornjak.config.clientCA.name | string | `"tornjak-client-ca"` | |
|
|
||||||
| tornjak.config.clientCA.type | string | `"Secret"` | Type of delivery for the user CA for mTLS client verification options are `Secret` or `ConfigMap` (required for `mtls` connectionType) |
|
|
||||||
| tornjak.config.dataStore | object | `{"driver":"sqlite3","file":"/run/spire/data/tornjak.sqlite3"}` | Persistent DB for storing Tornjak specific information |
|
|
||||||
| tornjak.config.tlsSecret | string | `"tornjak-tls-secret"` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) |
|
|
||||||
| tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) (Not for production) |
|
|
||||||
| tornjak.image.pullPolicy | string | `"IfNotPresent"` | The Tornjak image pull policy |
|
|
||||||
| tornjak.image.registry | string | `"ghcr.io"` | The OCI registry to pull the Tornjak image from |
|
|
||||||
| tornjak.image.repository | string | `"spiffe/tornjak-backend"` | The repository within the registry |
|
|
||||||
| tornjak.image.tag | string | `"v1.2.2"` | Overrides the image tag |
|
|
||||||
| tornjak.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
|
||||||
| tornjak.resources | object | `{}` | |
|
|
||||||
| tornjak.service.annotations | object | `{}` | |
|
|
||||||
| tornjak.service.ports | object | `{"http":10000,"https":10443}` | Ports for tornjak |
|
|
||||||
| tornjak.service.type | string | `"ClusterIP"` | |
|
|
||||||
| tornjak.startupProbe.failureThreshold | int | `3` | |
|
|
||||||
| tornjak.startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for |
|
|
||||||
| tornjak.startupProbe.periodSeconds | int | `10` | |
|
|
||||||
| tornjak.startupProbe.successThreshold | int | `1` | |
|
|
||||||
| tornjak.startupProbe.timeoutSeconds | int | `5` | |
|
|
||||||
| trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
|
|
||||||
| upstreamAuthority.awsPCA.assumeRoleARN | Optional | `""` | ARN of an IAM role to assume |
|
|
||||||
| upstreamAuthority.awsPCA.caSigningTemplateARN | string | `""` | See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. |
|
|
||||||
| upstreamAuthority.awsPCA.certificateAuthorityARN | string | `""` | ARN of the "upstream" CA certificate |
|
|
||||||
| upstreamAuthority.awsPCA.enabled | bool | `false` | |
|
|
||||||
| upstreamAuthority.awsPCA.endpoint | string | `""` | See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. |
|
|
||||||
| upstreamAuthority.awsPCA.region | string | `""` | AWS Region to use |
|
|
||||||
| upstreamAuthority.awsPCA.signingAlgorithm | string | `""` | See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. |
|
|
||||||
| upstreamAuthority.awsPCA.supplementalBundlePath | Optional | `""` | Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. |
|
|
||||||
| upstreamAuthority.certManager.ca.create | bool | `false` | Creates a Cert-Manager CA |
|
|
||||||
| upstreamAuthority.certManager.ca.duration | string | `"87600h"` | Duration of the CA. Defaults to 10 years. |
|
|
||||||
| upstreamAuthority.certManager.ca.privateKey.algorithm | string | `"ECDSA"` | |
|
|
||||||
| upstreamAuthority.certManager.ca.privateKey.rotationPolicy | string | `""` | |
|
|
||||||
| upstreamAuthority.certManager.ca.privateKey.size | int | `256` | |
|
|
||||||
| upstreamAuthority.certManager.ca.renewBefore | string | `""` | How long to wait before renewing the CA |
|
|
||||||
| upstreamAuthority.certManager.enabled | bool | `false` | |
|
|
||||||
| upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` | |
|
|
||||||
| upstreamAuthority.certManager.issuer_kind | string | `"Issuer"` | |
|
|
||||||
| upstreamAuthority.certManager.issuer_name | string | `""` | Defaults to the release name, override if CA is provided outside of the chart |
|
|
||||||
| upstreamAuthority.certManager.kube_config_file | string | `""` | |
|
|
||||||
| upstreamAuthority.certManager.namespace | string | `""` | Specify to use a namespace other then the one the chart is installed into |
|
|
||||||
| upstreamAuthority.certManager.rbac.create | bool | `true` | |
|
|
||||||
| upstreamAuthority.disk.enabled | bool | `false` | |
|
|
||||||
| upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. |
|
|
||||||
| upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info |
|
|
||||||
| upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. |
|
|
||||||
| upstreamAuthority.spire.enabled | bool | `false` | |
|
|
||||||
| upstreamAuthority.spire.server.address | string | `""` | |
|
|
||||||
| upstreamAuthority.spire.server.port | int | `8081` | |
|
|
||||||
| upstreamAuthority.spire.upstreamDriver | string | `""` | |
|
|
||||||
|
|
||||||
----------------------------------------------
|
| Name | Description | Value |
|
||||||
|
| ---------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
|
||||||
|
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
|
||||||
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
|
| `image.repository` | The repository within the registry | `spiffe/spire-server` |
|
||||||
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
|
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||||
|
| `nameOverride` | Name override | `""` |
|
||||||
|
| `namespaceOverride` | Namespace override | `""` |
|
||||||
|
| `fullnameOverride` | Fullname override | `""` |
|
||||||
|
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||||
|
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||||
|
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
||||||
|
| `podAnnotations` | Annotations to add to pods | `{}` |
|
||||||
|
| `podSecurityContext` | Pod security context | `{}` |
|
||||||
|
| `securityContext` | Security context | `{}` |
|
||||||
|
| `priorityClassName` | Priority class assigned to statefulset pods | `""` |
|
||||||
|
| `service.type` | Type of the Spire server service created | `ClusterIP` |
|
||||||
|
| `service.port` | Port for the created service | `8081` |
|
||||||
|
| `service.annotations` | Annotations to add to the service object | `{}` |
|
||||||
|
| `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` |
|
||||||
|
| `resources` | Resource requests and limits | `{}` |
|
||||||
|
| `autoscaling.enabled` | Flag to enable autoscaling | `false` |
|
||||||
|
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
|
||||||
|
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` |
|
||||||
|
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` |
|
||||||
|
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` |
|
||||||
|
| `tolerations` | List of tolerations | `[]` |
|
||||||
|
| `affinity` | List of node affinities | `{}` |
|
||||||
|
| `topologySpreadConstraints` | Topology spread constraints for resilience | `[]` |
|
||||||
|
| `livenessProbe.failureThreshold` | Failure threshold count for livenessProbe | `2` |
|
||||||
|
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `15` |
|
||||||
|
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `60` |
|
||||||
|
| `livenessProbe.timeoutSeconds` | Timeout in seconds for livenessProbe | `3` |
|
||||||
|
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
||||||
|
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
||||||
|
| `persistence.type` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `pvc` |
|
||||||
|
| `persistence.size` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `1Gi` |
|
||||||
|
| `persistence.accessMode` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `ReadWriteOnce` |
|
||||||
|
| `persistence.storageClass` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `nil` |
|
||||||
|
| `persistence.hostPath` | Which path to use on the host when type = hostPath | `""` |
|
||||||
|
| `dataStore.sql.databaseType` | Other supported databases are "postgres" and "mysql" | `sqlite3` |
|
||||||
|
| `dataStore.sql.databaseName` | Only used by "postgres" or "mysql" | `spire` |
|
||||||
|
| `dataStore.sql.host` | Only used by "postgres" or "mysql" | `""` |
|
||||||
|
| `dataStore.sql.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` |
|
||||||
|
| `dataStore.sql.username` | Only used by "postgres" or "mysql" | `spire` |
|
||||||
|
| `dataStore.sql.password` | Only used by "postgres" or "mysql" | `""` |
|
||||||
|
| `dataStore.sql.options` | Only used by "postgres" or "mysql" | `[]` |
|
||||||
|
| `dataStore.sql.plugin_data` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section | `{}` |
|
||||||
|
| `dataStore.sql.externalSecret.enabled` | Enable external secret for datastore creds | `false` |
|
||||||
|
| `dataStore.sql.externalSecret.name` | The name of the secret object | `""` |
|
||||||
|
| `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
|
||||||
|
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||||
|
| `jwtIssuer` | The JWT issuer domain | `https://oidc-discovery.example.org` |
|
||||||
|
| `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` |
|
||||||
|
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||||
|
| `bundleConfigMap` | Set the trust domain to be used for the SPIFFE identifiers | `spire-bundle` |
|
||||||
|
| `clusterDomain` | This is the value of your clusters `kubeadm init --service-dns-domain` flag | `cluster.local` |
|
||||||
|
| `federation.enabled` | Flag to enable federation | `false` |
|
||||||
|
| `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` |
|
||||||
|
| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` |
|
||||||
|
| `federation.ingress.enabled` | Flag to enable ingress for federation | `false` |
|
||||||
|
| `federation.ingress.className` | Ingress class name for federation | `""` |
|
||||||
|
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||||
|
| `federation.ingress.hosts` | Host paths for ingress object | `[]` |
|
||||||
|
| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
|
||||||
|
| `ca_subject.country` | Country for Spire server CA | `NL` |
|
||||||
|
| `ca_subject.organization` | Organization for Spire server CA | `Example` |
|
||||||
|
| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` |
|
||||||
|
| `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` |
|
||||||
|
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
|
||||||
|
| `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` |
|
||||||
|
| `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` |
|
||||||
|
| `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | |
|
||||||
|
| `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` |
|
||||||
|
| `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` |
|
||||||
|
| `keyManager.awsKMS.accessKeyID` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. | `""` |
|
||||||
|
| `keyManager.awsKMS.secretAccessKey` | Secret access key for the AWS account. | `""` |
|
||||||
|
| `upstreamAuthority.disk.enabled` | Flag to enable upstream authority plugin on disk | `false` |
|
||||||
|
| `upstreamAuthority.disk.secret.create` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | `true` |
|
||||||
|
| `upstreamAuthority.disk.secret.name` | If secret creation is disabled, the secret with this name will be used. | `spiffe-upstream-ca` |
|
||||||
|
| `upstreamAuthority.disk.secret.data` | If secret creation is enabled, will create a secret with following certificate info | |
|
||||||
|
| `upstreamAuthority.disk.secret.data.certificate` | Certificate to store within disk upstreamAuthority. | `""` |
|
||||||
|
| `upstreamAuthority.disk.secret.data.key` | Key corresponding to the upstreamAuthority. | `""` |
|
||||||
|
| `upstreamAuthority.disk.secret.data.bundle` | Trust bundle for upstreamAuthority. | `""` |
|
||||||
|
| `upstreamAuthority.awsPCA.enabled` | Flag to enable upstream authority plugin with AWS PCA | `false` |
|
||||||
|
| `upstreamAuthority.awsPCA.region` | AWS Region to use | `""` |
|
||||||
|
| `upstreamAuthority.awsPCA.certificateAuthorityARN` | ARN of the "upstream" CA certificate | `""` |
|
||||||
|
| `upstreamAuthority.awsPCA.assumeRoleARN` | (Optional) ARN of an IAM role to assume | `""` |
|
||||||
|
| `upstreamAuthority.awsPCA.caSigningTemplateARN` | (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. | `""` |
|
||||||
|
| `upstreamAuthority.awsPCA.signingAlgorithm` | (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | `""` |
|
||||||
|
| `upstreamAuthority.awsPCA.endpoint` | (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | `""` |
|
||||||
|
| `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` |
|
||||||
|
| `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` |
|
||||||
|
| `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` |
|
||||||
|
| `upstreamAuthority.certManager.issuer_name` | Defaults to the release name, override if CA is provided outside of the chart | `""` |
|
||||||
|
| `upstreamAuthority.certManager.issuer_kind` | Defaults to "Issuer", override if CA is provided outside of the chart | `Issuer` |
|
||||||
|
| `upstreamAuthority.certManager.issuer_group` | Defaults to "cert-manager.io", override if CA is provided outside of the chart | `cert-manager.io` |
|
||||||
|
| `upstreamAuthority.certManager.namespace` | Specify to use a namespace other then the one the chart is installed into | `""` |
|
||||||
|
| `upstreamAuthority.certManager.kube_config_file` | Path to kube_config_file on node to setup cert manager | `""` |
|
||||||
|
| `upstreamAuthority.certManager.ca.create` | Creates a Cert-Manager CA | `false` |
|
||||||
|
| `upstreamAuthority.certManager.ca.duration` | Duration of the CA. Defaults to 10 years | `87600h` |
|
||||||
|
| `upstreamAuthority.certManager.ca.privateKey.algorithm` | Algorithm to generate private key for CA | `ECDSA` |
|
||||||
|
| `upstreamAuthority.certManager.ca.privateKey.size` | Size of generated private key for CA | `256` |
|
||||||
|
| `upstreamAuthority.certManager.ca.privateKey.rotationPolicy` | Rotation policy for generated private key | `""` |
|
||||||
|
| `upstreamAuthority.certManager.ca.renewBefore` | How long to wait before renewing the CA | `""` |
|
||||||
|
| `upstreamAuthority.spire.enabled` | Flag to use another Spire install as upstream CA | `false` |
|
||||||
|
| `upstreamAuthority.spire.upstreamDriver` | Driver for Spire as upstream CA | `""` |
|
||||||
|
| `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | |
|
||||||
|
| `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` |
|
||||||
|
| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `8081` |
|
||||||
|
| `upstreamAuthority.vault.enabled` | Enable Hashicorp Vault as upstream CA | `false` |
|
||||||
|
| `upstreamAuthority.vault.vaultAddr` | The URL of the Vault server. (e.g., https://vault.example.com:8443/) | `""` |
|
||||||
|
| `upstreamAuthority.vault.namespace` | Name of the Vault namespace. This is only available in the Vault Enterprise. | `""` |
|
||||||
|
| `upstreamAuthority.vault.pkiMountPoint` | Name of the mount point where PKI secret engine is mounted | `pki` |
|
||||||
|
| `upstreamAuthority.vault.insecureSkipVerify` | If true, caCert options are ignored and Spire accepts any server certificates claiming to be Vault | `false` |
|
||||||
|
| `upstreamAuthority.vault.caCert.type` | Type of resource representing the Vault server certificate, options are 'Secret' or 'Configmap', the item must be named `ca.crt` | `Secret` |
|
||||||
|
| `upstreamAuthority.vault.caCert.name` | Name of the Kubernetes resource containing the Vault server certificate | `vault-ca` |
|
||||||
|
| `upstreamAuthority.vault.k8sAuth.enabled` | Enable k8s authentication to Hashicorp Vault | `false` |
|
||||||
|
| `upstreamAuthority.vault.k8sAuth.k8sAuthMountPoint` | Name of the mount point where the Kubernetes auth method is mounted | `kubernetes` |
|
||||||
|
| `upstreamAuthority.vault.k8sAuth.k8sAuthRoleName` | Required - Name of the Vault role. The plugin authenticates against the named role | `""` |
|
||||||
|
| `upstreamAuthority.vault.k8sAuth.token.audience` | Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info. | `vault` |
|
||||||
|
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
|
||||||
|
| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||||
|
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
||||||
|
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||||
|
| `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||||
|
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
|
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
||||||
|
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.2.3` |
|
||||||
|
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
||||||
|
| `controllerManager.securityContext` | Security context | `{}` |
|
||||||
|
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
||||||
|
| `controllerManager.service.port` | Service port for controller manager | `443` |
|
||||||
|
| `controllerManager.service.annotations` | Annotations for service resource | `{}` |
|
||||||
|
| `controllerManager.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` |
|
||||||
|
| `controllerManager.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` |
|
||||||
|
| `controllerManager.identities.enabled` | Flag to enable default identities for controller manager | `true` |
|
||||||
|
| `controllerManager.identities.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` |
|
||||||
|
| `controllerManager.identities.podSelector` | Selector for pods to issue identity | `{}` |
|
||||||
|
| `controllerManager.identities.namespaceSelector` | Selector for namespacs to issue identity | `{}` |
|
||||||
|
| `controllerManager.identities.dnsNameTemplates` | DNS name template for issued identities | `[]` |
|
||||||
|
| `controllerManager.identities.federatesWith` | Other Spire server URLs for identity federation | `[]` |
|
||||||
|
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
|
||||||
|
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||||
|
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
|
||||||
|
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
|
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
||||||
|
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
||||||
|
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
|
||||||
|
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||||
|
| `ingress.enabled` | Flag to enable ingress | `false` |
|
||||||
|
| `ingress.className` | Ingress class name | `""` |
|
||||||
|
| `ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||||
|
| `ingress.hosts` | Host paths for ingress object | `[]` |
|
||||||
|
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
|
||||||
|
| `extraVolumes` | Extra volumes to be mounted | `[]` |
|
||||||
|
| `extraVolumeMounts` | Extra volume mounts | `[]` |
|
||||||
|
| `extraContainers` | Additional containers to create | `[]` |
|
||||||
|
| `initContainers` | Additional init containers to create | `[]` |
|
||||||
|
| `caKeyType` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) | `rsa-2048` |
|
||||||
|
| `caTTL` | TTL for CA | `24h` |
|
||||||
|
| `defaultX509SvidTTL` | TTL for X509 Svids | `4h` |
|
||||||
|
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
|
||||||
|
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` |
|
||||||
|
| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` |
|
||||||
|
| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` |
|
||||||
|
| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
|
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
|
||||||
|
| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.2.2` |
|
||||||
|
| `tornjak.service.type` | Type of service resource | `ClusterIP` |
|
||||||
|
| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` |
|
||||||
|
| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` |
|
||||||
|
| `tornjak.service.annotations` | Annotations for the service | `{}` |
|
||||||
|
| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` |
|
||||||
|
| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` |
|
||||||
|
| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` |
|
||||||
|
| `tornjak.startupProbe.successThreshold` | Success threshold count | `1` |
|
||||||
|
| `tornjak.startupProbe.timeoutSeconds` | Timeout in seconds | `5` |
|
||||||
|
| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | |
|
||||||
|
| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` |
|
||||||
|
| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` |
|
||||||
|
| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` |
|
||||||
|
| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` |
|
||||||
|
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
|
||||||
|
| `tornjak.resources` | Resource requests and limits | `{}` |
|
||||||
|
| `tests.hostAliases` | List of host aliases for testing | `[]` |
|
||||||
|
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
|
||||||
|
| `tests.tls.customCA` | Custom CA value for tests | `""` |
|
||||||
|
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||||
|
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||||
|
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` |
|
||||||
|
|||||||
@@ -1,81 +0,0 @@
|
|||||||
{{ template "chart.header" . }}
|
|
||||||
|
|
||||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
|
||||||
|
|
||||||
{{ template "chart.deprecationWarning" . }}
|
|
||||||
|
|
||||||
{{ template "chart.badgesSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.description" . }}
|
|
||||||
|
|
||||||
{{ template "chart.homepageLine" . }}
|
|
||||||
|
|
||||||
> **Note**: Minimum Spire version is `1.5.3`.
|
|
||||||
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
|
||||||
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
|
||||||
>
|
|
||||||
> The recommended spire-controller-manager version is `0.2.2` to support arm64 nodes. If running with any
|
|
||||||
> prior version to `0.2.2` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
|
||||||
|
|
||||||
{{ template "chart.maintainersSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.sourcesSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.requirementsSection" . }}
|
|
||||||
|
|
||||||
## Tornjak
|
|
||||||
|
|
||||||
Tornjak is the UI and Control Plane for SPIRE [https://github.com/spiffe/tornjak](https://github.com/spiffe/tornjak) and it is composed of two components:
|
|
||||||
|
|
||||||
* Backend (this chart) - Tornjak APIs that extend SPIRE APIs with Control Plane functionality
|
|
||||||
* [Frontend](../tornjak-frontend/README.md) - Tornjak UI
|
|
||||||
|
|
||||||
When Tornjak is enabled, it is exposed on both http and https (if TLS server certs are configured). Tornjak handles a permanent redirect from `http` to `https` to ensure users always use the https endpoint.
|
|
||||||
|
|
||||||
In addition, you can configure a `client certificate authority`, this will make Tornjak backend verify Client certificates signed by this authority to enable mTLS authentication.
|
|
||||||
|
|
||||||
**Warning**: For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access.
|
|
||||||
|
|
||||||
### Tornjak with TLS Connection Type
|
|
||||||
|
|
||||||
TLS connection requires Tornjak to have access to TLS key and certificate.
|
|
||||||
Complete instruction on creating your own TLS certificate can be found [here](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md).
|
|
||||||
TLS Certificate and the private key must be provided to Tornjak via *TLS Secret*. Prior to deploying this Helm chart, create TLS Secret in the deployment namespace (e.g. `spire-server`)
|
|
||||||
|
|
||||||
```console
|
|
||||||
kubectl -n spire-server create secret tls tornjak-tls-secret --cert=client.crt --key=client.key
|
|
||||||
```
|
|
||||||
|
|
||||||
Once the charts are deployed, you can test the TLS connection with the following command (assuming localhost):
|
|
||||||
|
|
||||||
```console
|
|
||||||
curl --cacert CA/rootCA.crt https://localhost:10443
|
|
||||||
```
|
|
||||||
|
|
||||||
### Tornjak with mTLS Connection Type
|
|
||||||
|
|
||||||
mTLS connection allows Tornjak server validation by client and Tornjak client validation by Tornjak server. The server validation is identical to above TLS. Follow the steps to create
|
|
||||||
TLS secret with key and the certificate.
|
|
||||||
|
|
||||||
Additionally, you must provide the user CA to Tornjak server via `Secret` or `ConfigMap`.
|
|
||||||
Follow the steps to [create user CA for mTLS](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md), then create a *Secret* (or *ConfigMap*) prior to deploying this Helm chart.
|
|
||||||
|
|
||||||
Here is an example using a *Secret* in `spire-server` namespace:
|
|
||||||
|
|
||||||
```console
|
|
||||||
kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt"
|
|
||||||
```
|
|
||||||
|
|
||||||
Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost):
|
|
||||||
|
|
||||||
```console
|
|
||||||
curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhost:10443
|
|
||||||
```
|
|
||||||
|
|
||||||
### Tornjak with HTTP Connection Type
|
|
||||||
|
|
||||||
In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above.
|
|
||||||
|
|
||||||
{{ template "chart.valuesSection" . }}
|
|
||||||
|
|
||||||
----------------------------------------------
|
|
||||||
@@ -202,3 +202,67 @@ The code below determines what connection type should be used.
|
|||||||
{{- define "spire-tornjak.servicename" -}}
|
{{- define "spire-tornjak.servicename" -}}
|
||||||
{{- include "spire-tornjak.backend" . -}}
|
{{- include "spire-tornjak.backend" . -}}
|
||||||
{{- end -}}
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- define "spire-server.test.federation-ingress-args" }}
|
||||||
|
{{- $args := list }}
|
||||||
|
{{- $host := index (index (index .Values.federation.ingress.tls 0) "hosts") 0 }}
|
||||||
|
{{- if dig "tests" "tls" "enabled" false .Values }}
|
||||||
|
{{- if ne (len (dig "tests" "tls" "customCA" "" .Values)) 0 }}
|
||||||
|
{{- $args = append $args "--cacert" }}
|
||||||
|
{{- $args = append $args "/ca/ca.crt" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $args = append $args (printf "https://%s/" $host) }}
|
||||||
|
{{- else }}
|
||||||
|
{{- $args = append $args (printf "http://%s/" $host) }}
|
||||||
|
{{- end }}
|
||||||
|
{{ $args | toYaml }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Take a copy of the config and merge in .Values.customPlugins and .Values.unsupportedBuiltInPlugins passed through as root.
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-server.config_merge" }}
|
||||||
|
{{- $pluginsToMerge := dict "plugins" dict }}
|
||||||
|
{{- range $type, $val := .root.Values.customPlugins }}
|
||||||
|
{{- if . }}
|
||||||
|
{{- $nt := printf "%s%s" (substr 0 1 $type | upper) (substr 1 -1 $type) }}
|
||||||
|
{{- $_ := set $pluginsToMerge.plugins $nt (deepCopy $val) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- range $type, $val := .root.Values.unsupportedBuiltInPlugins }}
|
||||||
|
{{- if . }}
|
||||||
|
{{- $nt := printf "%s%s" (substr 0 1 $type | upper) (substr 1 -1 $type) }}
|
||||||
|
{{- $_ := set $pluginsToMerge.plugins $nt (deepCopy $val) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $newConfig := .config | fromYaml | mustMerge $pluginsToMerge }}
|
||||||
|
{{- $newConfig | toYaml }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Take a copy of the plugin section and return a yaml string based version
|
||||||
|
reformatted from a dict of dicts to a dict of lists of dicts
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-server.plugins_reformat" }}
|
||||||
|
{{- range $type, $v := . }}
|
||||||
|
{{ $type }}:
|
||||||
|
{{- range $name, $v2 := $v }}
|
||||||
|
- {{ $name }}: {{ $v2 | toYaml | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Take a copy of the config as a yaml config and root var.
|
||||||
|
Merge in .root.Values.customPlugins and .Values.unsupportedBuiltInPlugins into config,
|
||||||
|
Reformat the plugin section from a dict of dicts to a dict of lists of dicts,
|
||||||
|
and export it back as as json string.
|
||||||
|
This makes it much easier for users to merge in plugin configs, as dicts are easier
|
||||||
|
to merge in values, but spire needs arrays.
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-server.reformat-and-yaml2json" -}}
|
||||||
|
{{- $config := include "spire-server.config_merge" . | fromYaml }}
|
||||||
|
{{- $plugins := include "spire-server.plugins_reformat" $config.plugins | fromYaml }}
|
||||||
|
{{- $_ := set $config "plugins" $plugins }}
|
||||||
|
{{- $config | toPrettyJson }}
|
||||||
|
{{- end }}
|
||||||
|
|||||||
@@ -1,3 +1,21 @@
|
|||||||
|
{{- range $type, $tvals := .Values.customPlugins }}
|
||||||
|
{{- if not (has $type (list "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }}
|
||||||
|
{{- fail (printf "Unknown plugin type specified: %s" $type) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- range $name, $nval := $tvals }}
|
||||||
|
{{- if not (hasKey $nval "plugin_cmd") }}
|
||||||
|
{{- fail (printf "plugin_cmd is a required field. %s" $name) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if not (hasKey $nval "plugin_checksum") }}
|
||||||
|
{{- fail (printf "plugin_checksum is a required field.") }}
|
||||||
|
{{- end }}
|
||||||
|
{{- range $sname, $svals := $nval }}
|
||||||
|
{{- if not (has $sname (list "plugin_cmd" "plugin_checksum" "plugin_data")) }}
|
||||||
|
{{- fail (printf "Unknown plugin setting specified: %s" $sname) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
{{- define "spire-server.yaml-config" -}}
|
{{- define "spire-server.yaml-config" -}}
|
||||||
{{- $upstreamAuthorityUsed := 0 }}
|
{{- $upstreamAuthorityUsed := 0 }}
|
||||||
{{- $keyManagerUsed := 0 }}
|
{{- $keyManagerUsed := 0 }}
|
||||||
@@ -33,18 +51,18 @@ server:
|
|||||||
|
|
||||||
plugins:
|
plugins:
|
||||||
DataStore:
|
DataStore:
|
||||||
- sql:
|
sql:
|
||||||
plugin_data:
|
plugin_data:
|
||||||
{{ include "spire-server.datastore-config" . | nindent 10 }}
|
{{ include "spire-server.datastore-config" . | nindent 10 }}
|
||||||
|
|
||||||
{{- with .Values.nodeAttestor.k8sPsat }}
|
{{- with .Values.nodeAttestor.k8sPsat }}
|
||||||
{{- if eq (.enabled | toString) "true" }}
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
NodeAttestor:
|
NodeAttestor:
|
||||||
- k8s_psat:
|
k8s_psat:
|
||||||
plugin_data:
|
plugin_data:
|
||||||
clusters:
|
clusters:
|
||||||
{{ include "spire-lib.cluster-name" $root }}:
|
{{ include "spire-lib.cluster-name" $root }}:
|
||||||
service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
|
service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
@@ -52,9 +70,9 @@ plugins:
|
|||||||
{{- if eq (.enabled | toString) "true" }}
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
{{- $keyManagerUsed = add1 $keyManagerUsed }}
|
{{- $keyManagerUsed = add1 $keyManagerUsed }}
|
||||||
KeyManager:
|
KeyManager:
|
||||||
- disk:
|
disk:
|
||||||
plugin_data:
|
plugin_data:
|
||||||
keys_path: "/run/spire/data/keys.json"
|
keys_path: "/run/spire/data/keys.json"
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
@@ -62,8 +80,8 @@ plugins:
|
|||||||
{{- if eq (.enabled | toString) "true" }}
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
{{- $keyManagerUsed = add1 $keyManagerUsed }}
|
{{- $keyManagerUsed = add1 $keyManagerUsed }}
|
||||||
KeyManager:
|
KeyManager:
|
||||||
- memory:
|
memory:
|
||||||
plugin_data:
|
plugin_data:
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
@@ -92,22 +110,22 @@ plugins:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
Notifier:
|
Notifier:
|
||||||
- k8sbundle:
|
k8sbundle:
|
||||||
plugin_data:
|
plugin_data:
|
||||||
namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }}
|
namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }}
|
||||||
config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
|
config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
|
||||||
|
|
||||||
{{- with .Values.upstreamAuthority.disk }}
|
{{- with .Values.upstreamAuthority.disk }}
|
||||||
{{- if eq (.enabled | toString) "true" }}
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
||||||
UpstreamAuthority:
|
UpstreamAuthority:
|
||||||
- disk:
|
disk:
|
||||||
plugin_data:
|
plugin_data:
|
||||||
cert_file_path: "/run/spire/upstream_ca/tls.crt"
|
cert_file_path: "/run/spire/upstream_ca/tls.crt"
|
||||||
key_file_path: "/run/spire/upstream_ca/tls.key"
|
key_file_path: "/run/spire/upstream_ca/tls.key"
|
||||||
{{- if ne .secret.data.bundle "" }}
|
{{- if ne .secret.data.bundle "" }}
|
||||||
bundle_file_path: "/run/spire/upstream_ca/bundle.crt"
|
bundle_file_path: "/run/spire/upstream_ca/bundle.crt"
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
@@ -115,15 +133,15 @@ plugins:
|
|||||||
{{- if eq (.enabled | toString) "true" }}
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
||||||
UpstreamAuthority:
|
UpstreamAuthority:
|
||||||
- cert-manager:
|
cert-manager:
|
||||||
plugin_data:
|
plugin_data:
|
||||||
issuer_name: {{ default (include "spire-server.fullname" $root) .issuer_name }}-ca
|
issuer_name: {{ default (include "spire-server.fullname" $root) .issuer_name }}-ca
|
||||||
issuer_kind: {{ .issuer_kind | quote }}
|
issuer_kind: {{ .issuer_kind | quote }}
|
||||||
issuer_group: {{ .issuer_group | quote }}
|
issuer_group: {{ .issuer_group | quote }}
|
||||||
namespace: {{ default $root.Release.Namespace .namespace | quote }}
|
namespace: {{ default $root.Release.Namespace .namespace | quote }}
|
||||||
{{- if ne .kube_config_file "" }}
|
{{- if ne .kube_config_file "" }}
|
||||||
kube_config_file: {{ .kube_config_file | quote }}
|
kube_config_file: {{ .kube_config_file | quote }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
@@ -131,14 +149,46 @@ plugins:
|
|||||||
{{- if eq (.enabled | toString) "true" }}
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
||||||
UpstreamAuthority:
|
UpstreamAuthority:
|
||||||
- spire:
|
spire:
|
||||||
plugin_data:
|
plugin_data:
|
||||||
server_address: {{ include "spire-server.upstream-spire-address" $root | quote }}
|
server_address: {{ include "spire-server.upstream-spire-address" $root | quote }}
|
||||||
server_port: {{ .server.port }}
|
server_port: {{ .server.port }}
|
||||||
workload_api_socket: "/run/spire/upstream_agent/spire-agent.sock"
|
workload_api_socket: "/run/spire/upstream_agent/spire-agent.sock"
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
|
{{- with .Values.upstreamAuthority.vault }}
|
||||||
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
||||||
|
UpstreamAuthority:
|
||||||
|
vault:
|
||||||
|
plugin_data:
|
||||||
|
vault_addr: {{ .vaultAddr | quote }}
|
||||||
|
pki_mount_point: {{ .pkiMountPoint | quote }}
|
||||||
|
insecure_skip_verify: {{ .insecureSkipVerify }}
|
||||||
|
{{- if ne (.insecureSkipVerify | toString) "true" }}
|
||||||
|
ca_cert_path: "/run/spire/vault-upstream/ca.crt"
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne .namespace "" }}
|
||||||
|
namespace: {{ .namespace | quote }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- $vaultAuthMethodUsed := 0 }}
|
||||||
|
{{- with .k8sAuth }}
|
||||||
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
|
{{- $vaultAuthMethodUsed = add1 $vaultAuthMethodUsed }}
|
||||||
|
k8s_auth:
|
||||||
|
k8s_auth_mount_point: {{ .k8sAuthMountPoint | quote }}
|
||||||
|
k8s_auth_role_name: {{ .k8sAuthRoleName | quote }}
|
||||||
|
token_path: "/var/run/secrets/tokens/spire-server"
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if gt $vaultAuthMethodUsed 1 }}
|
||||||
|
{{- fail "You can only enable a single authentication mechanism to an upstream Vault." }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
{{- with .Values.upstreamAuthority.awsPCA }}
|
{{- with .Values.upstreamAuthority.awsPCA }}
|
||||||
{{- if eq (.enabled | toString) "true" }}
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
||||||
@@ -191,4 +241,4 @@ metadata:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
data:
|
data:
|
||||||
server.conf: |
|
server.conf: |
|
||||||
{{- include "spire-server.yaml-config" . | fromYaml | toPrettyJson | nindent 4 }}
|
{{- include "spire-server.reformat-and-yaml2json" (dict "config" (include "spire-server.yaml-config" .) "root" .) | nindent 4 }}
|
||||||
|
|||||||
@@ -1,4 +1,14 @@
|
|||||||
|
{{- if and (.Values.dataStore.sql.externalSecret.enabled) (ne .Values.dataStore.sql.password "") }}
|
||||||
|
{{- fail "dataStore.sql.password should not be set when dataStore.sql.externalSecret is enabled" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and (.Values.dataStore.sql.externalSecret.enabled) (eq .Values.dataStore.sql.externalSecret.name "") }}
|
||||||
|
{{- fail "dataStore.sql.externalSecret.name cannot be empty string when dataStore.sql.externalSecret is enabled" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and (.Values.dataStore.sql.externalSecret.enabled) (eq .Values.dataStore.sql.externalSecret.key "") }}
|
||||||
|
{{- fail "dataStore.sql.externalSecret.key cannot be empty string when dataStore.sql.externalSecret is enabled" }}
|
||||||
|
{{- end }}
|
||||||
{{- if ne .Values.dataStore.sql.databaseType "sqlite3" }}
|
{{- if ne .Values.dataStore.sql.databaseType "sqlite3" }}
|
||||||
|
{{- if not .Values.dataStore.sql.externalSecret.enabled }}
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: Secret
|
kind: Secret
|
||||||
metadata:
|
metadata:
|
||||||
@@ -7,3 +17,4 @@ metadata:
|
|||||||
data:
|
data:
|
||||||
DBPW: {{ .Values.dataStore.sql.password | b64enc }}
|
DBPW: {{ .Values.dataStore.sql.password | b64enc }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|||||||
@@ -49,6 +49,9 @@ spec:
|
|||||||
securityContext:
|
securityContext:
|
||||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||||
{{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }}
|
{{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }}
|
||||||
|
{{- if .Values.priorityClassName }}
|
||||||
|
priorityClassName: {{ .Values.priorityClassName }}
|
||||||
|
{{- end }}
|
||||||
initContainers:
|
initContainers:
|
||||||
{{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }}
|
{{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }}
|
||||||
- name: wait
|
- name: wait
|
||||||
@@ -83,12 +86,20 @@ spec:
|
|||||||
- name: PATH
|
- name: PATH
|
||||||
value: "/opt/spire/bin:/bin"
|
value: "/opt/spire/bin:/bin"
|
||||||
{{- if ne .Values.dataStore.sql.databaseType "sqlite3" }}
|
{{- if ne .Values.dataStore.sql.databaseType "sqlite3" }}
|
||||||
|
{{- if .Values.dataStore.sql.externalSecret.enabled }}
|
||||||
|
- name: DBPW
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ .Values.dataStore.sql.externalSecret.name }}
|
||||||
|
key: {{ .Values.dataStore.sql.externalSecret.key }}
|
||||||
|
{{- else }}
|
||||||
- name: DBPW
|
- name: DBPW
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: {{ $fullname }}-dbpw
|
name: {{ $fullname }}-dbpw
|
||||||
key: DBPW
|
key: DBPW
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
{{- if ne .Values.keyManager.awsKMS.accessKeyID "" }}
|
{{- if ne .Values.keyManager.awsKMS.accessKeyID "" }}
|
||||||
- name: AWS_KMS_ACCESS_KEY_ID
|
- name: AWS_KMS_ACCESS_KEY_ID
|
||||||
valueFrom:
|
valueFrom:
|
||||||
@@ -159,7 +170,19 @@ spec:
|
|||||||
subPath: policy.json
|
subPath: policy.json
|
||||||
readOnly: true
|
readOnly: true
|
||||||
{{ end }}
|
{{ end }}
|
||||||
{{ end }}
|
{{- end }}
|
||||||
|
{{- with .Values.upstreamAuthority.vault }}
|
||||||
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
|
{{- if eq (.k8sAuth.enabled | toString) "true" }}
|
||||||
|
- name: spire-psat
|
||||||
|
mountPath: /var/run/secrets/tokens
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne (.insecureSkipVerify | toString) "true" }}
|
||||||
|
- name: vault-ca
|
||||||
|
mountPath: /run/spire/vault-upstream
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
{{- if gt (len .Values.extraVolumeMounts) 0 }}
|
{{- if gt (len .Values.extraVolumeMounts) 0 }}
|
||||||
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
|
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
@@ -346,6 +369,33 @@ spec:
|
|||||||
path: {{ .Values.persistence.hostPath }}
|
path: {{ .Values.persistence.hostPath }}
|
||||||
type: Directory
|
type: Directory
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- with .Values.upstreamAuthority.vault }}
|
||||||
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
|
{{- if ne (.insecureSkipVerify | toString) "true" }}
|
||||||
|
{{- if eq (.caCert.type | lower) "configmap" }}
|
||||||
|
- name: vault-ca
|
||||||
|
configMap:
|
||||||
|
name: {{ .caCert.name }}
|
||||||
|
{{- else if eq (.caCert.type | lower) "secret" }}
|
||||||
|
- name: vault-ca
|
||||||
|
secret:
|
||||||
|
secretName: {{ .caCert.name }}
|
||||||
|
optional: false
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if eq (.k8sAuth.enabled | toString) "true" }}
|
||||||
|
- name: spire-psat
|
||||||
|
projected:
|
||||||
|
sources:
|
||||||
|
- serviceAccountToken:
|
||||||
|
path: spire-server
|
||||||
|
expirationSeconds: {{ .k8sAuth.token.expiry }}
|
||||||
|
{{- if ne .k8sAuth.token.audience "" }}
|
||||||
|
audience: {{ .k8sAuth.token.audience }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
{{- if eq .Values.persistence.type "pvc" }}
|
{{- if eq .Values.persistence.type "pvc" }}
|
||||||
volumeClaimTemplates:
|
volumeClaimTemplates:
|
||||||
- metadata:
|
- metadata:
|
||||||
|
|||||||
@@ -1,3 +1,4 @@
|
|||||||
|
{{ $values := merge .Values }}
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: Pod
|
kind: Pod
|
||||||
metadata:
|
metadata:
|
||||||
@@ -38,4 +39,28 @@ spec:
|
|||||||
securityContext:
|
securityContext:
|
||||||
{{- toYaml .Values.securityContext | nindent 8 }}
|
{{- toYaml .Values.securityContext | nindent 8 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if .Values.federation.ingress.enabled }}
|
||||||
|
- name: federation-ingress
|
||||||
|
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
|
||||||
|
command: ['curl']
|
||||||
|
args:
|
||||||
|
{{ include "spire-server.test.federation-ingress-args" (dict "Values" $values) | nindent 8 }}
|
||||||
|
{{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: custom-ca
|
||||||
|
mountPath: /ca
|
||||||
|
{{- end }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml .Values.securityContext | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne (len (dig "tests" "hostAliases" "" $values)) 0 }}
|
||||||
|
hostAliases:
|
||||||
|
{{- toYaml .Values.tests.hostAliases | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
|
||||||
|
volumes:
|
||||||
|
- name: custom-ca
|
||||||
|
secret:
|
||||||
|
secretName: {{ .Values.tests.tls.customCA }}
|
||||||
|
{{- end }}
|
||||||
restartPolicy: Never
|
restartPolicy: Never
|
||||||
|
|||||||
@@ -1,44 +1,56 @@
|
|||||||
# Default values for spire-server.
|
# Default configuration for Spire server
|
||||||
# This is a YAML-formatted file.
|
# SPDX-License-Identifier: APACHE-2.0
|
||||||
# Declare variables to be passed into your templates.
|
|
||||||
|
|
||||||
# @ignored
|
## @skip global
|
||||||
global: {}
|
global: {}
|
||||||
|
|
||||||
# -- SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database.
|
## @section Chart parameters
|
||||||
|
##
|
||||||
|
## @param replicaCount SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database.
|
||||||
replicaCount: 1
|
replicaCount: 1
|
||||||
|
|
||||||
|
## @param image.registry The OCI registry to pull the image from
|
||||||
|
## @param image.repository The repository within the registry
|
||||||
|
## @param image.pullPolicy The image pull policy
|
||||||
|
## @param image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
image:
|
image:
|
||||||
# -- The OCI registry to pull the image from
|
|
||||||
registry: ghcr.io
|
registry: ghcr.io
|
||||||
# -- The repository within the registry
|
|
||||||
repository: spiffe/spire-server
|
repository: spiffe/spire-server
|
||||||
# -- The image pull policy
|
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
||||||
version: ""
|
version: ""
|
||||||
# -- Overrides the image tag whose default is the chart appVersion.
|
|
||||||
tag: ""
|
tag: ""
|
||||||
|
|
||||||
|
## @param imagePullSecrets [array] Pull secrets for images
|
||||||
imagePullSecrets: []
|
imagePullSecrets: []
|
||||||
|
|
||||||
|
## @param nameOverride Name override
|
||||||
nameOverride: ""
|
nameOverride: ""
|
||||||
|
|
||||||
|
## @param namespaceOverride Namespace override
|
||||||
namespaceOverride: ""
|
namespaceOverride: ""
|
||||||
|
|
||||||
|
## @param fullnameOverride Fullname override
|
||||||
fullnameOverride: ""
|
fullnameOverride: ""
|
||||||
|
|
||||||
|
## @param serviceAccount.create Specifies whether a service account should be created
|
||||||
|
## @param serviceAccount.annotations [object] Annotations to add to the service account
|
||||||
|
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
|
||||||
|
##
|
||||||
serviceAccount:
|
serviceAccount:
|
||||||
# -- Specifies whether a service account should be created
|
|
||||||
create: true
|
create: true
|
||||||
# -- Annotations to add to the service account
|
|
||||||
annotations: {}
|
annotations: {}
|
||||||
# -- The name of the service account to use.
|
|
||||||
# If not set and create is true, a name is generated using the fullname template
|
|
||||||
name: ""
|
name: ""
|
||||||
|
|
||||||
|
## @param podAnnotations [object] Annotations to add to pods
|
||||||
podAnnotations: {}
|
podAnnotations: {}
|
||||||
|
|
||||||
|
## @param podSecurityContext [object] Pod security context
|
||||||
podSecurityContext: {}
|
podSecurityContext: {}
|
||||||
# fsGroup: 2000
|
# fsGroup: 2000
|
||||||
|
|
||||||
|
## @param securityContext [object] Security context
|
||||||
securityContext: {}
|
securityContext: {}
|
||||||
# capabilities:
|
# capabilities:
|
||||||
# drop:
|
# drop:
|
||||||
@@ -47,15 +59,23 @@ securityContext: {}
|
|||||||
# runAsNonRoot: true
|
# runAsNonRoot: true
|
||||||
# runAsUser: 1000
|
# runAsUser: 1000
|
||||||
|
|
||||||
|
## @param priorityClassName Priority class assigned to statefulset pods
|
||||||
|
priorityClassName: ""
|
||||||
|
|
||||||
|
## @param service.type Type of the Spire server service created
|
||||||
|
## @param service.port Port for the created service
|
||||||
|
## @param service.annotations [object] Annotations to add to the service object
|
||||||
|
##
|
||||||
service:
|
service:
|
||||||
type: ClusterIP
|
type: ClusterIP
|
||||||
port: 8081
|
port: 8081
|
||||||
annotations: {}
|
annotations: {}
|
||||||
|
|
||||||
configMap:
|
configMap:
|
||||||
# -- Annotations to add to the SPIRE Server ConfigMap
|
## @param configMap.annotations [object] Annotations to add to the SPIRE Server ConfigMap
|
||||||
annotations: {}
|
annotations: {}
|
||||||
|
|
||||||
|
## @param resources [object] Resource requests and limits
|
||||||
resources: {}
|
resources: {}
|
||||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
# choice for the user. This also increases chances charts run on environments with little
|
# choice for the user. This also increases chances charts run on environments with little
|
||||||
@@ -68,6 +88,11 @@ resources: {}
|
|||||||
# cpu: 200m
|
# cpu: 200m
|
||||||
# memory: 256Mi
|
# memory: 256Mi
|
||||||
|
|
||||||
|
## @param autoscaling.enabled Flag to enable autoscaling
|
||||||
|
## @param autoscaling.minReplicas Minimum replicas for autoscaling
|
||||||
|
## @param autoscaling.maxReplicas Maximum replicas for autoscaling
|
||||||
|
## @param autoscaling.targetCPUUtilizationPercentage Target CPU utlization that triggers autoscaling
|
||||||
|
##
|
||||||
autoscaling:
|
autoscaling:
|
||||||
enabled: false
|
enabled: false
|
||||||
minReplicas: 1
|
minReplicas: 1
|
||||||
@@ -75,95 +100,123 @@ autoscaling:
|
|||||||
targetCPUUtilizationPercentage: 80
|
targetCPUUtilizationPercentage: 80
|
||||||
# targetMemoryUtilizationPercentage: 80
|
# targetMemoryUtilizationPercentage: 80
|
||||||
|
|
||||||
# -- Select specific nodes to run on (currently only amd64 is supported by Tornjak)
|
## @param nodeSelector [object] Select specific nodes to run on (currently only amd64 is supported by Tornjak)
|
||||||
nodeSelector: {}
|
nodeSelector: {}
|
||||||
|
|
||||||
|
## @param tolerations [array] List of tolerations
|
||||||
tolerations: []
|
tolerations: []
|
||||||
|
|
||||||
|
## @param affinity [object] List of node affinities
|
||||||
affinity: {}
|
affinity: {}
|
||||||
|
|
||||||
|
## @param topologySpreadConstraints [array] Topology spread constraints for resilience
|
||||||
topologySpreadConstraints: []
|
topologySpreadConstraints: []
|
||||||
|
|
||||||
|
## @param livenessProbe.failureThreshold Failure threshold count for livenessProbe
|
||||||
|
## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
|
||||||
|
## @param livenessProbe.periodSeconds Period seconds for livenessProbe
|
||||||
|
## @param livenessProbe.timeoutSeconds Timeout in seconds for livenessProbe
|
||||||
|
##
|
||||||
livenessProbe:
|
livenessProbe:
|
||||||
# -- Failure threshold count for livenessProbe
|
|
||||||
failureThreshold: 2
|
failureThreshold: 2
|
||||||
# -- Initial delay seconds for livenessProbe
|
|
||||||
initialDelaySeconds: 15
|
initialDelaySeconds: 15
|
||||||
# -- Period seconds for livenessProbe
|
|
||||||
periodSeconds: 60
|
periodSeconds: 60
|
||||||
# -- Timeout in seconds for livenessProbe
|
|
||||||
timeoutSeconds: 3
|
timeoutSeconds: 3
|
||||||
|
|
||||||
|
## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
|
||||||
|
## @param readinessProbe.periodSeconds Period seconds for readinessProbe
|
||||||
|
##
|
||||||
readinessProbe:
|
readinessProbe:
|
||||||
# -- Initial delay seconds for readinessProbe
|
|
||||||
initialDelaySeconds: 5
|
initialDelaySeconds: 5
|
||||||
# -- Period seconds for readinessProbe
|
|
||||||
periodSeconds: 5
|
periodSeconds: 5
|
||||||
|
|
||||||
|
## @param persistence.type What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only)
|
||||||
|
## @param persistence.size What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only)
|
||||||
|
## @param persistence.accessMode What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only)
|
||||||
|
## @param persistence.storageClass What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only)
|
||||||
|
## @param persistence.hostPath Which path to use on the host when type = hostPath
|
||||||
|
##
|
||||||
persistence:
|
persistence:
|
||||||
# -- What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only)
|
|
||||||
type: pvc
|
type: pvc
|
||||||
size: 1Gi
|
size: 1Gi
|
||||||
accessMode: ReadWriteOnce
|
accessMode: ReadWriteOnce
|
||||||
storageClass: null
|
storageClass: null
|
||||||
# -- Which path to use on the host when type = hostPath
|
|
||||||
hostPath: ""
|
hostPath: ""
|
||||||
|
|
||||||
dataStore:
|
dataStore:
|
||||||
sql:
|
sql:
|
||||||
# -- Other supported databases are "postgres" and "mysql"
|
## @param dataStore.sql.databaseType Other supported databases are "postgres" and "mysql"
|
||||||
databaseType: sqlite3
|
databaseType: sqlite3
|
||||||
# -- Only used by "postgres" or "mysql"
|
## @param dataStore.sql.databaseName Only used by "postgres" or "mysql"
|
||||||
databaseName: spire
|
databaseName: spire
|
||||||
# -- Only used by "postgres" or "mysql"
|
## @param dataStore.sql.host Only used by "postgres" or "mysql"
|
||||||
host: ""
|
host: ""
|
||||||
# -- If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases.
|
## @param dataStore.sql.port If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases.
|
||||||
port: 0
|
port: 0
|
||||||
# -- Only used by "postgres" or "mysql"
|
## @param dataStore.sql.username Only used by "postgres" or "mysql"
|
||||||
username: spire
|
username: spire
|
||||||
# -- Only used by "postgres" or "mysql"
|
## @param dataStore.sql.password Only used by "postgres" or "mysql"
|
||||||
password: ""
|
password: ""
|
||||||
# -- Only used by "postgres" or "mysql"
|
## @param dataStore.sql.options [array] Only used by "postgres" or "mysql"
|
||||||
options: []
|
options: []
|
||||||
|
|
||||||
# -- Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section
|
## @param dataStore.sql.plugin_data [object] Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section
|
||||||
plugin_data: {}
|
plugin_data: {}
|
||||||
|
|
||||||
# -- The log level, valid values are "debug", "info", "warn", and "error"
|
## When an external source creates the secret. The secret should reside in the same namespace as the spire server
|
||||||
|
externalSecret:
|
||||||
|
## @param dataStore.sql.externalSecret.enabled Enable external secret for datastore creds
|
||||||
|
enabled: false
|
||||||
|
## @param dataStore.sql.externalSecret.name The name of the secret object
|
||||||
|
name: ""
|
||||||
|
## @param dataStore.sql.externalSecret.key The key of the secret object whose value is the dataStore.sql password
|
||||||
|
key: ""
|
||||||
|
|
||||||
|
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
||||||
logLevel: info
|
logLevel: info
|
||||||
# -- The JWT issuer domain
|
## @param jwtIssuer The JWT issuer domain
|
||||||
jwtIssuer: https://oidc-discovery.example.org
|
jwtIssuer: https://oidc-discovery.example.org
|
||||||
|
|
||||||
# -- Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`)
|
## @param clusterName Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`)
|
||||||
clusterName: example-cluster
|
clusterName: example-cluster
|
||||||
# -- Set the trust domain to be used for the SPIFFE identifiers
|
## @param trustDomain Set the trust domain to be used for the SPIFFE identifiers
|
||||||
trustDomain: example.org
|
trustDomain: example.org
|
||||||
|
|
||||||
|
## @param bundleConfigMap Set the trust domain to be used for the SPIFFE identifiers
|
||||||
bundleConfigMap: spire-bundle
|
bundleConfigMap: spire-bundle
|
||||||
|
|
||||||
# -- This is the value of your clusters `kubeadm init --service-dns-domain` flag
|
## @param clusterDomain This is the value of your clusters `kubeadm init --service-dns-domain` flag
|
||||||
clusterDomain: cluster.local
|
clusterDomain: cluster.local
|
||||||
|
|
||||||
federation:
|
federation:
|
||||||
|
## @param federation.enabled Flag to enable federation
|
||||||
enabled: false
|
enabled: false
|
||||||
bundleEndpoint:
|
bundleEndpoint:
|
||||||
|
## @param federation.bundleEndpoint.port Port value for trust bundle federation
|
||||||
port: 8443
|
port: 8443
|
||||||
|
## @param federation.bundleEndpoint.address Address for trust bundle federation
|
||||||
address: "0.0.0.0"
|
address: "0.0.0.0"
|
||||||
|
|
||||||
ingress:
|
ingress:
|
||||||
|
## @param federation.ingress.enabled Flag to enable ingress for federation
|
||||||
enabled: false
|
enabled: false
|
||||||
|
## @param federation.ingress.className Ingress class name for federation
|
||||||
className: ""
|
className: ""
|
||||||
|
## @param federation.ingress.annotations [object] Annotations for the ingress object
|
||||||
annotations: {}
|
annotations: {}
|
||||||
# kubernetes.io/ingress.class: nginx
|
# kubernetes.io/ingress.class: nginx
|
||||||
# kubernetes.io/tls-acme: "true"
|
# kubernetes.io/tls-acme: "true"
|
||||||
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||||
# If Profile Type == https_spiffe:
|
# If Profile Type == https_spiffe:
|
||||||
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||||
|
## @param federation.ingress.hosts [array] Host paths for ingress object
|
||||||
hosts:
|
hosts:
|
||||||
- host: spire-server-federation.example.org
|
- host: spire-server-federation.example.org
|
||||||
paths:
|
paths:
|
||||||
- path: /
|
- path: /
|
||||||
pathType: Prefix
|
pathType: Prefix
|
||||||
|
|
||||||
|
## @param federation.ingress.tls [array] Secrets containining TLS certs to enable https on ingress
|
||||||
tls: []
|
tls: []
|
||||||
# - hosts:
|
# - hosts:
|
||||||
# - spire-server-federation.example.org
|
# - spire-server-federation.example.org
|
||||||
@@ -171,117 +224,171 @@ federation:
|
|||||||
# secretName: spire-server-federation-tls
|
# secretName: spire-server-federation-tls
|
||||||
|
|
||||||
ca_subject:
|
ca_subject:
|
||||||
|
## @param ca_subject.country Country for Spire server CA
|
||||||
country: NL
|
country: NL
|
||||||
|
## @param ca_subject.organization Organization for Spire server CA
|
||||||
organization: Example
|
organization: Example
|
||||||
|
## @param ca_subject.common_name Common Name for Spire server CA
|
||||||
common_name: example.org
|
common_name: example.org
|
||||||
|
|
||||||
keyManager:
|
keyManager:
|
||||||
disk:
|
disk:
|
||||||
|
## @param keyManager.disk.enabled Flag to enable keyManager on disk
|
||||||
enabled: true
|
enabled: true
|
||||||
memory:
|
memory:
|
||||||
|
## @param keyManager.memory.enabled Flag to enable keyManager in memory
|
||||||
enabled: false
|
enabled: false
|
||||||
awsKMS:
|
awsKMS:
|
||||||
|
## @param keyManager.awsKMS.enabled Flag to enable keyManager in memory
|
||||||
enabled: false
|
enabled: false
|
||||||
|
## @param keyManager.awsKMS.region Specify the region for AWS KMS
|
||||||
region: ""
|
region: ""
|
||||||
# -- Policy to use when creating keys. If no policy is specified, a default policy will be used.
|
## @extra keyManager.awsKMS.keyPolicy Policy to use when creating keys. If no policy is specified, a default policy will be used.
|
||||||
keyPolicy:
|
keyPolicy:
|
||||||
# -- (Optional) Key policy in JSON format.
|
## @param keyManager.awsKMS.keyPolicy.policy [nullable] Key policy in JSON format.
|
||||||
policy: ""
|
policy: ""
|
||||||
# -- (Optional) Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format.
|
## @param keyManager.awsKMS.keyPolicy.existingConfigMap [nullable] Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format.
|
||||||
existingConfigMap: ""
|
existingConfigMap: ""
|
||||||
# -- (Optional) Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role.
|
## @param keyManager.awsKMS.accessKeyID [nullable] Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role.
|
||||||
accessKeyID: ""
|
accessKeyID: ""
|
||||||
# -- (Optional) Secret access key for the AWS account.
|
## @param keyManager.awsKMS.secretAccessKey [nullable] Secret access key for the AWS account.
|
||||||
secretAccessKey: ""
|
secretAccessKey: ""
|
||||||
|
|
||||||
upstreamAuthority:
|
upstreamAuthority:
|
||||||
disk:
|
disk:
|
||||||
|
## @param upstreamAuthority.disk.enabled Flag to enable upstream authority plugin on disk
|
||||||
enabled: false
|
enabled: false
|
||||||
secret:
|
secret:
|
||||||
# -- If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself.
|
## @param upstreamAuthority.disk.secret.create If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself.
|
||||||
create: true
|
create: true
|
||||||
# -- If secret creation is disabled, the secret with this name will be used.
|
## @param upstreamAuthority.disk.secret.name If secret creation is disabled, the secret with this name will be used.
|
||||||
name: "spiffe-upstream-ca"
|
name: "spiffe-upstream-ca"
|
||||||
# -- If secret creation is enabled, will create a secret with following certificate info
|
## @extra upstreamAuthority.disk.secret.data If secret creation is enabled, will create a secret with following certificate info
|
||||||
data:
|
data:
|
||||||
|
## @param upstreamAuthority.disk.secret.data.certificate Certificate to store within disk upstreamAuthority.
|
||||||
certificate: ""
|
certificate: ""
|
||||||
|
## @param upstreamAuthority.disk.secret.data.key Key corresponding to the upstreamAuthority.
|
||||||
key: ""
|
key: ""
|
||||||
|
## @param upstreamAuthority.disk.secret.data.bundle Trust bundle for upstreamAuthority.
|
||||||
bundle: ""
|
bundle: ""
|
||||||
awsPCA:
|
awsPCA:
|
||||||
|
## @param upstreamAuthority.awsPCA.enabled Flag to enable upstream authority plugin with AWS PCA
|
||||||
enabled: false
|
enabled: false
|
||||||
# -- AWS Region to use
|
## @param upstreamAuthority.awsPCA.region AWS Region to use
|
||||||
region: ""
|
region: ""
|
||||||
# -- ARN of the "upstream" CA certificate
|
## @param upstreamAuthority.awsPCA.certificateAuthorityARN ARN of the "upstream" CA certificate
|
||||||
certificateAuthorityARN: ""
|
certificateAuthorityARN: ""
|
||||||
# -- (Optional) ARN of an IAM role to assume
|
## @param upstreamAuthority.awsPCA.assumeRoleARN (Optional) ARN of an IAM role to assume
|
||||||
assumeRoleARN: ""
|
assumeRoleARN: ""
|
||||||
# -- (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only.
|
## @param upstreamAuthority.awsPCA.caSigningTemplateARN (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values.
|
||||||
# -- See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values.
|
|
||||||
caSigningTemplateARN: ""
|
caSigningTemplateARN: ""
|
||||||
# -- (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default.
|
## @param upstreamAuthority.awsPCA.signingAlgorithm (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values.
|
||||||
# -- See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values.
|
|
||||||
signingAlgorithm: ""
|
signingAlgorithm: ""
|
||||||
# -- (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint.
|
## @param upstreamAuthority.awsPCA.endpoint (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information.
|
||||||
# -- See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information.
|
|
||||||
endpoint: ""
|
endpoint: ""
|
||||||
# -- (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle.
|
## @param upstreamAuthority.awsPCA.supplementalBundlePath (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle.
|
||||||
supplementalBundlePath: ""
|
supplementalBundlePath: ""
|
||||||
certManager:
|
certManager:
|
||||||
|
## @param upstreamAuthority.certManager.enabled Flag to enable upstream authority plugin with cert manager
|
||||||
enabled: false
|
enabled: false
|
||||||
|
## @param upstreamAuthority.certManager.rbac.create Flag to create RBAC roles
|
||||||
rbac:
|
rbac:
|
||||||
create: true
|
create: true
|
||||||
# -- Defaults to the release name, override if CA is provided outside of the chart
|
## @param upstreamAuthority.certManager.issuer_name Defaults to the release name, override if CA is provided outside of the chart
|
||||||
issuer_name: ""
|
issuer_name: ""
|
||||||
|
## @param upstreamAuthority.certManager.issuer_kind Defaults to "Issuer", override if CA is provided outside of the chart
|
||||||
issuer_kind: "Issuer"
|
issuer_kind: "Issuer"
|
||||||
|
## @param upstreamAuthority.certManager.issuer_group Defaults to "cert-manager.io", override if CA is provided outside of the chart
|
||||||
issuer_group: "cert-manager.io"
|
issuer_group: "cert-manager.io"
|
||||||
# -- Specify to use a namespace other then the one the chart is installed into
|
## @param upstreamAuthority.certManager.namespace Specify to use a namespace other then the one the chart is installed into
|
||||||
namespace: ""
|
namespace: ""
|
||||||
|
## @param upstreamAuthority.certManager.kube_config_file Path to kube_config_file on node to setup cert manager
|
||||||
kube_config_file: ""
|
kube_config_file: ""
|
||||||
|
|
||||||
ca:
|
ca:
|
||||||
# -- Creates a Cert-Manager CA
|
## @param upstreamAuthority.certManager.ca.create Creates a Cert-Manager CA
|
||||||
create: false
|
create: false
|
||||||
# -- Duration of the CA. Defaults to 10 years.
|
## @param upstreamAuthority.certManager.ca.duration Duration of the CA. Defaults to 10 years
|
||||||
duration: 87600h
|
duration: 87600h
|
||||||
privateKey:
|
privateKey:
|
||||||
|
## @param upstreamAuthority.certManager.ca.privateKey.algorithm Algorithm to generate private key for CA
|
||||||
algorithm: ECDSA
|
algorithm: ECDSA
|
||||||
|
## @param upstreamAuthority.certManager.ca.privateKey.size Size of generated private key for CA
|
||||||
size: 256
|
size: 256
|
||||||
|
## @param upstreamAuthority.certManager.ca.privateKey.rotationPolicy Rotation policy for generated private key
|
||||||
rotationPolicy: ""
|
rotationPolicy: ""
|
||||||
# -- How long to wait before renewing the CA
|
## @param upstreamAuthority.certManager.ca.renewBefore How long to wait before renewing the CA
|
||||||
renewBefore: ""
|
renewBefore: ""
|
||||||
spire:
|
spire:
|
||||||
|
## @param upstreamAuthority.spire.enabled Flag to use another Spire install as upstream CA
|
||||||
enabled: false
|
enabled: false
|
||||||
|
## @param upstreamAuthority.spire.upstreamDriver Driver for Spire as upstream CA
|
||||||
upstreamDriver: ""
|
upstreamDriver: ""
|
||||||
|
## @extra upstreamAuthority.spire.server Server details for the Spire instance use as upstream CA
|
||||||
server:
|
server:
|
||||||
|
## @param upstreamAuthority.spire.server.address Address for upstream Spire server
|
||||||
address: ""
|
address: ""
|
||||||
|
## @param upstreamAuthority.spire.server.port Port for upstream Spire server
|
||||||
port: 8081
|
port: 8081
|
||||||
|
vault:
|
||||||
|
## @param upstreamAuthority.vault.enabled Enable Hashicorp Vault as upstream CA
|
||||||
|
enabled: false
|
||||||
|
## @param upstreamAuthority.vault.vaultAddr The URL of the Vault server. (e.g., https://vault.example.com:8443/)
|
||||||
|
vaultAddr: ""
|
||||||
|
## @param upstreamAuthority.vault.namespace Name of the Vault namespace. This is only available in the Vault Enterprise.
|
||||||
|
namespace: ""
|
||||||
|
## @param upstreamAuthority.vault.pkiMountPoint Name of the mount point where PKI secret engine is mounted
|
||||||
|
pkiMountPoint: "pki"
|
||||||
|
## @param upstreamAuthority.vault.insecureSkipVerify If true, caCert options are ignored and Spire accepts any server certificates claiming to be Vault
|
||||||
|
insecureSkipVerify: false
|
||||||
|
caCert:
|
||||||
|
## @param upstreamAuthority.vault.caCert.type Type of resource representing the Vault server certificate, options are 'Secret' or 'Configmap', the item must be named `ca.crt`
|
||||||
|
type: Secret
|
||||||
|
## @param upstreamAuthority.vault.caCert.name Name of the Kubernetes resource containing the Vault server certificate
|
||||||
|
name: vault-ca
|
||||||
|
|
||||||
|
k8sAuth:
|
||||||
|
## @param upstreamAuthority.vault.k8sAuth.enabled Enable k8s authentication to Hashicorp Vault
|
||||||
|
enabled: false
|
||||||
|
## @param upstreamAuthority.vault.k8sAuth.k8sAuthMountPoint Name of the mount point where the Kubernetes auth method is mounted
|
||||||
|
k8sAuthMountPoint: "kubernetes"
|
||||||
|
## @param upstreamAuthority.vault.k8sAuth.k8sAuthRoleName Required - Name of the Vault role. The plugin authenticates against the named role
|
||||||
|
k8sAuthRoleName: ""
|
||||||
|
token:
|
||||||
|
## @param upstreamAuthority.vault.k8sAuth.token.audience Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info.
|
||||||
|
audience: "vault"
|
||||||
|
## @param upstreamAuthority.vault.k8sAuth.token.expiry Expiry time in seconds for the token
|
||||||
|
expiry: 7200
|
||||||
|
|
||||||
notifier:
|
notifier:
|
||||||
k8sbundle:
|
k8sbundle:
|
||||||
# -- Namespace to push the bundle into, if blank will default to SPIRE Server namespace
|
## @param notifier.k8sbundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace
|
||||||
namespace: ""
|
namespace: ""
|
||||||
|
|
||||||
controllerManager:
|
controllerManager:
|
||||||
|
## @param controllerManager.enabled Flag to enable controller manager
|
||||||
enabled: false
|
enabled: false
|
||||||
installAndUpgradeHook:
|
installAndUpgradeHook:
|
||||||
# -- Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`)
|
## @param controllerManager.installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`)
|
||||||
enabled: true
|
enabled: true
|
||||||
deleteHook:
|
deleteHook:
|
||||||
# -- Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`)
|
## @param controllerManager.deleteHook.enabled Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`)
|
||||||
enabled: true
|
enabled: true
|
||||||
|
|
||||||
|
## @param controllerManager.image.registry The OCI registry to pull the image from
|
||||||
|
## @param controllerManager.image.repository The repository within the registry
|
||||||
|
## @param controllerManager.image.pullPolicy The image pull policy
|
||||||
|
## @param controllerManager.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param controllerManager.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
image:
|
image:
|
||||||
# -- The OCI registry to pull the image from
|
|
||||||
registry: ghcr.io
|
registry: ghcr.io
|
||||||
# -- The repository within the registry
|
|
||||||
repository: spiffe/spire-controller-manager
|
repository: spiffe/spire-controller-manager
|
||||||
# -- The image pull policy
|
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
||||||
version: ""
|
version: ""
|
||||||
# -- Overrides the image tag
|
|
||||||
tag: "0.2.3"
|
tag: "0.2.3"
|
||||||
|
|
||||||
|
## @param controllerManager.resources [object] Resource requests and limits for controller manager
|
||||||
resources: {}
|
resources: {}
|
||||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
# choice for the user. This also increases chances charts run on environments with little
|
# choice for the user. This also increases chances charts run on environments with little
|
||||||
@@ -294,6 +401,7 @@ controllerManager:
|
|||||||
# cpu: 100m
|
# cpu: 100m
|
||||||
# memory: 128Mi
|
# memory: 128Mi
|
||||||
|
|
||||||
|
## @param controllerManager.securityContext [object] Security context
|
||||||
securityContext: {}
|
securityContext: {}
|
||||||
# capabilities:
|
# capabilities:
|
||||||
# drop:
|
# drop:
|
||||||
@@ -302,124 +410,166 @@ controllerManager:
|
|||||||
# runAsNonRoot: true
|
# runAsNonRoot: true
|
||||||
# runAsUser: 1000
|
# runAsUser: 1000
|
||||||
|
|
||||||
|
## @param controllerManager.service.type Service type for controller manager
|
||||||
|
## @param controllerManager.service.port Service port for controller manager
|
||||||
|
## @param controllerManager.service.annotations Annotations for service resource
|
||||||
|
##
|
||||||
service:
|
service:
|
||||||
type: ClusterIP
|
type: ClusterIP
|
||||||
port: 443
|
port: 443
|
||||||
annotations: {}
|
annotations: {}
|
||||||
|
|
||||||
configMap:
|
configMap:
|
||||||
# -- Annotations to add to the Controller Manager ConfigMap
|
## @param controllerManager.configMap.annotations [object] Annotations to add to the Controller Manager ConfigMap
|
||||||
annotations: {}
|
annotations: {}
|
||||||
|
|
||||||
|
## @param controllerManager.ignoreNamespaces [array] These namespaces are ignored by controller manager
|
||||||
ignoreNamespaces:
|
ignoreNamespaces:
|
||||||
- kube-system
|
- kube-system
|
||||||
- kube-public
|
- kube-public
|
||||||
- local-path-storage
|
- local-path-storage
|
||||||
|
|
||||||
identities:
|
identities:
|
||||||
|
## @param controllerManager.identities.enabled Flag to enable default identities for controller manager
|
||||||
enabled: true
|
enabled: true
|
||||||
|
|
||||||
|
## @param controllerManager.identities.spiffeIDTemplate Spiffe ID template for identities
|
||||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
||||||
|
## @param controllerManager.identities.podSelector [object] Selector for pods to issue identity
|
||||||
podSelector: {}
|
podSelector: {}
|
||||||
# matchLabels:
|
# matchLabels:
|
||||||
# spiffe.io/spiffe-id: "true"
|
# spiffe.io/spiffe-id: "true"
|
||||||
|
## @param controllerManager.identities.namespaceSelector [object] Selector for namespacs to issue identity
|
||||||
namespaceSelector: {}
|
namespaceSelector: {}
|
||||||
# matchLabels:
|
# matchLabels:
|
||||||
# spiffe.io/spiffe-id: "true"
|
# spiffe.io/spiffe-id: "true"
|
||||||
|
## @param controllerManager.identities.dnsNameTemplates [array] DNS name template for issued identities
|
||||||
dnsNameTemplates: []
|
dnsNameTemplates: []
|
||||||
# - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local'
|
# - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local'
|
||||||
|
## @param controllerManager.identities.federatesWith [array] Other Spire server URLs for identity federation
|
||||||
federatesWith: []
|
federatesWith: []
|
||||||
# - example.io
|
# - example.io
|
||||||
# - example.ai
|
# - example.ai
|
||||||
|
|
||||||
validatingWebhookConfiguration:
|
validatingWebhookConfiguration:
|
||||||
|
## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued
|
||||||
failurePolicy: Fail
|
failurePolicy: Fail
|
||||||
|
|
||||||
tools:
|
tools:
|
||||||
kubectl:
|
kubectl:
|
||||||
|
## @param tools.kubectl.image.registry The OCI registry to pull the image from
|
||||||
|
## @param tools.kubectl.image.repository The repository within the registry
|
||||||
|
## @param tools.kubectl.image.pullPolicy The image pull policy
|
||||||
|
## @param tools.kubectl.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param tools.kubectl.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
image:
|
image:
|
||||||
# -- The OCI registry to pull the image from
|
|
||||||
registry: docker.io
|
registry: docker.io
|
||||||
# -- The repository within the registry
|
|
||||||
repository: rancher/kubectl
|
repository: rancher/kubectl
|
||||||
# -- The image pull policy
|
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
||||||
version: ""
|
version: ""
|
||||||
# -- Overrides the image tag
|
|
||||||
tag: ""
|
tag: ""
|
||||||
|
|
||||||
telemetry:
|
telemetry:
|
||||||
prometheus:
|
prometheus:
|
||||||
|
## @param telemetry.prometheus.enabled Flag to enable prometheus monitoring
|
||||||
enabled: false
|
enabled: false
|
||||||
podMonitor:
|
podMonitor:
|
||||||
|
## @param telemetry.prometheus.podMonitor.enabled Enable podMonitor for prometheus
|
||||||
enabled: false
|
enabled: false
|
||||||
# -- Override where to install the podMonitor, if not set will use the same namespace as the spire-server
|
## @param telemetry.prometheus.podMonitor.namespace Override where to install the podMonitor, if not set will use the same namespace as the spire-agent
|
||||||
namespace: ""
|
namespace: ""
|
||||||
|
## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring
|
||||||
labels: {}
|
labels: {}
|
||||||
|
|
||||||
ingress:
|
ingress:
|
||||||
|
## @param ingress.enabled Flag to enable ingress
|
||||||
enabled: false
|
enabled: false
|
||||||
|
## @param ingress.className Ingress class name
|
||||||
className: ""
|
className: ""
|
||||||
|
## @param ingress.annotations [object] Annotations for the ingress object
|
||||||
annotations: {}
|
annotations: {}
|
||||||
# kubernetes.io/ingress.class: nginx
|
# kubernetes.io/ingress.class: nginx
|
||||||
# kubernetes.io/tls-acme: "true"
|
# kubernetes.io/tls-acme: "true"
|
||||||
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||||
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||||
|
|
||||||
|
## @param ingress.hosts [array] Host paths for ingress object
|
||||||
hosts:
|
hosts:
|
||||||
- host: spire-server.example.org
|
- host: spire-server.example.org
|
||||||
paths:
|
paths:
|
||||||
- path: /
|
- path: /
|
||||||
pathType: Prefix
|
pathType: Prefix
|
||||||
|
## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress
|
||||||
tls: []
|
tls: []
|
||||||
# - secretName: spire-server-tls
|
# - secretName: spire-server-tls
|
||||||
# hosts:
|
# hosts:
|
||||||
# - spire-server.example.org
|
# - spire-server.example.org
|
||||||
|
|
||||||
|
## @param extraVolumes [array] Extra volumes to be mounted
|
||||||
extraVolumes: []
|
extraVolumes: []
|
||||||
|
|
||||||
|
## @param extraVolumeMounts [array] Extra volume mounts
|
||||||
extraVolumeMounts: []
|
extraVolumeMounts: []
|
||||||
|
|
||||||
|
## @param extraContainers [array] Additional containers to create
|
||||||
extraContainers: []
|
extraContainers: []
|
||||||
|
|
||||||
|
## @param initContainers [array] Additional init containers to create
|
||||||
initContainers: []
|
initContainers: []
|
||||||
|
|
||||||
# -- The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported)
|
## @param caKeyType The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported)
|
||||||
caKeyType: rsa-2048
|
caKeyType: rsa-2048
|
||||||
|
## @param caTTL TTL for CA
|
||||||
caTTL: 24h
|
caTTL: 24h
|
||||||
|
## @param defaultX509SvidTTL TTL for X509 Svids
|
||||||
defaultX509SvidTTL: 4h
|
defaultX509SvidTTL: 4h
|
||||||
|
## @param defaultJwtSvidTTL TTL for JWT Svids
|
||||||
defaultJwtSvidTTL: 1h
|
defaultJwtSvidTTL: 1h
|
||||||
|
|
||||||
nodeAttestor:
|
nodeAttestor:
|
||||||
k8sPsat:
|
k8sPsat:
|
||||||
|
## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s nodeattestor
|
||||||
enabled: true
|
enabled: true
|
||||||
|
## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor
|
||||||
serviceAccountAllowList: []
|
serviceAccountAllowList: []
|
||||||
|
|
||||||
# tornjak - Tornjak default values
|
# tornjak - Tornjak default values
|
||||||
tornjak:
|
tornjak:
|
||||||
# -- Deploys Tornjak API (backend) (Not for production)
|
## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production)
|
||||||
enabled: false
|
enabled: false
|
||||||
|
## @param tornjak.image.registry The OCI registry to pull the image from
|
||||||
|
## @param tornjak.image.repository The repository within the registry
|
||||||
|
## @param tornjak.image.pullPolicy The image pull policy
|
||||||
|
## @param tornjak.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param tornjak.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
image:
|
image:
|
||||||
# -- The OCI registry to pull the Tornjak image from
|
|
||||||
registry: ghcr.io
|
registry: ghcr.io
|
||||||
# -- The repository within the registry
|
|
||||||
repository: spiffe/tornjak-backend
|
repository: spiffe/tornjak-backend
|
||||||
# -- The Tornjak image pull policy
|
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
||||||
version: ""
|
version: ""
|
||||||
# -- Overrides the image tag
|
|
||||||
tag: "v1.2.2"
|
tag: "v1.2.2"
|
||||||
|
|
||||||
service:
|
service:
|
||||||
|
## @param tornjak.service.type Type of service resource
|
||||||
type: ClusterIP
|
type: ClusterIP
|
||||||
# -- Ports for tornjak
|
|
||||||
ports:
|
ports:
|
||||||
|
## @param tornjak.service.ports.http Insecure port for tornjak service
|
||||||
http: 10000
|
http: 10000
|
||||||
|
## @param tornjak.service.ports.https Secure port for tornjak service
|
||||||
https: 10443
|
https: 10443
|
||||||
|
## @param tornjak.service.annotations [object] Annotations for the service
|
||||||
annotations: {}
|
annotations: {}
|
||||||
|
|
||||||
|
## @param tornjak.startupProbe.failureThreshold Failure threshold count
|
||||||
|
## @param tornjak.startupProbe.initialDelaySeconds Initial delay seconds
|
||||||
|
## @param tornjak.startupProbe.periodSeconds Period seconds
|
||||||
|
## @param tornjak.startupProbe.successThreshold Success threshold count
|
||||||
|
## @param tornjak.startupProbe.timeoutSeconds Timeout in seconds
|
||||||
|
##
|
||||||
startupProbe:
|
startupProbe:
|
||||||
failureThreshold: 3
|
failureThreshold: 3
|
||||||
# -- Initial delay seconds for
|
|
||||||
initialDelaySeconds: 5
|
initialDelaySeconds: 5
|
||||||
periodSeconds: 10
|
periodSeconds: 10
|
||||||
successThreshold: 1
|
successThreshold: 1
|
||||||
@@ -427,9 +577,11 @@ tornjak:
|
|||||||
|
|
||||||
# tornjak - Tornjak default values
|
# tornjak - Tornjak default values
|
||||||
config:
|
config:
|
||||||
# -- Persistent DB for storing Tornjak specific information
|
## @extra tornjak.config.dataStore [object] Persistent DB for storing Tornjak specific information
|
||||||
dataStore:
|
dataStore:
|
||||||
|
## @param tornjak.config.dataStore.driver Database driver name
|
||||||
driver: "sqlite3"
|
driver: "sqlite3"
|
||||||
|
## @param tornjak.config.dataStore.file File path for sqlite3 file
|
||||||
file: "/run/spire/data/tornjak.sqlite3"
|
file: "/run/spire/data/tornjak.sqlite3"
|
||||||
|
|
||||||
# Tornjak supports 3 connection types: `http`, `tls`, and `mtls`.
|
# Tornjak supports 3 connection types: `http`, `tls`, and `mtls`.
|
||||||
@@ -438,16 +590,15 @@ tornjak:
|
|||||||
# When `tlsSecret` and `clientCA.tornjak-client-ca` are created in this chart namespace, the mTLS connection is started
|
# When `tlsSecret` and `clientCA.tornjak-client-ca` are created in this chart namespace, the mTLS connection is started
|
||||||
# When none of them are created, Tornjak starts with HTTP connection only
|
# When none of them are created, Tornjak starts with HTTP connection only
|
||||||
|
|
||||||
# -- Name of the secret containing server side key and certificate for TLS verification
|
## @param tornjak.config.tlsSecret Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType)
|
||||||
# (required for `tls` or `mtls` connectionType)
|
|
||||||
tlsSecret: tornjak-tls-secret
|
tlsSecret: tornjak-tls-secret
|
||||||
clientCA:
|
clientCA:
|
||||||
# -- Type of delivery for the user CA for mTLS client verification
|
## @param tornjak.config.clientCA.type Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType)
|
||||||
# options are `Secret` or `ConfigMap`
|
|
||||||
# (required for `mtls` connectionType)
|
|
||||||
type: Secret
|
type: Secret
|
||||||
|
## @param tornjak.config.clientCA.name Name of the resource secret or configMap with user CA for TLS
|
||||||
name: tornjak-client-ca
|
name: tornjak-client-ca
|
||||||
|
|
||||||
|
## @param tornjak.resources [object] Resource requests and limits
|
||||||
resources: {}
|
resources: {}
|
||||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
# choice for the user. This also increases chances charts run on environments with little
|
# choice for the user. This also increases chances charts run on environments with little
|
||||||
@@ -460,17 +611,41 @@ tornjak:
|
|||||||
# cpu: 100m
|
# cpu: 100m
|
||||||
# memory: 128Mi
|
# memory: 128Mi
|
||||||
|
|
||||||
# @ignored
|
# NOTE: This is unsupported and only to configure currently supported spire built in plugins but plugins unsupported by the chart.
|
||||||
|
# Upgrades wont be tested for anything under this config. If you need this, please let the chart developers know your needs so we
|
||||||
|
# can prioritize proper support.
|
||||||
|
## @skip unsupportedBuiltInPlugins
|
||||||
|
unsupportedBuiltInPlugins:
|
||||||
|
keyManager: {}
|
||||||
|
nodeAttestor: {}
|
||||||
|
upstreamAuthority: {}
|
||||||
|
notifier: {}
|
||||||
|
|
||||||
|
## @skip customPlugins
|
||||||
|
customPlugins:
|
||||||
|
keyManager: {}
|
||||||
|
nodeAttestor: {}
|
||||||
|
upstreamAuthority: {}
|
||||||
|
notifier: {}
|
||||||
|
|
||||||
tests:
|
tests:
|
||||||
|
## @param tests.hostAliases [array] List of host aliases for testing
|
||||||
|
hostAliases: []
|
||||||
|
tls:
|
||||||
|
## @param tests.tls.enabled Flag for enabling tls for tests
|
||||||
|
enabled: false
|
||||||
|
## @param tests.tls.customCA Custom CA value for tests
|
||||||
|
customCA: ""
|
||||||
bash:
|
bash:
|
||||||
|
## @param tests.bash.image.registry The OCI registry to pull the image from
|
||||||
|
## @param tests.bash.image.repository The repository within the registry
|
||||||
|
## @param tests.bash.image.pullPolicy The image pull policy
|
||||||
|
## @param tests.bash.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param tests.bash.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
image:
|
image:
|
||||||
# -- The OCI registry to pull the image from
|
|
||||||
registry: cgr.dev
|
registry: cgr.dev
|
||||||
# -- The repository within the registry
|
|
||||||
repository: chainguard/bash
|
repository: chainguard/bash
|
||||||
# -- The image pull policy
|
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
||||||
version: ""
|
version: ""
|
||||||
# -- Overrides the image tag
|
|
||||||
tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4
|
tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4
|
||||||
|
|||||||
@@ -52,38 +52,44 @@ port forwarding. See the chart NOTES output for more details.
|
|||||||
|
|
||||||
* <https://github.com/spiffe/tornjak>
|
* <https://github.com/spiffe/tornjak>
|
||||||
|
|
||||||
## Values
|
## Parameters
|
||||||
|
|
||||||
| Key | Type | Default | Description |
|
### Chart parameters
|
||||||
|-----|------|---------|-------------|
|
|
||||||
| affinity | object | `{}` | |
|
| Name | Description | Value |
|
||||||
| apiServerURL | string | `"http://localhost:10000/"` | URL of the Tornjak APIs (backend) Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. |
|
| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||||
| fullnameOverride | string | `""` | |
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| image.pullPolicy | string | `"IfNotPresent"` | |
|
| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` |
|
||||||
| image.registry | string | `"ghcr.io"` | |
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| image.repository | string | `"spiffe/tornjak-frontend"` | |
|
| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
| image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||||
| imagePullSecrets | list | `[]` | |
|
| `nameOverride` | Name override | `""` |
|
||||||
| labels | object | `{}` | |
|
| `namespaceOverride` | Namespace override | `""` |
|
||||||
| nameOverride | string | `""` | |
|
| `fullnameOverride` | Fullname override | `""` |
|
||||||
| namespaceOverride | string | `""` | |
|
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||||
| nodeSelector | object | `{"kubernetes.io/arch":"amd64"}` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) |
|
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||||
| podSecurityContext | object | `{}` | |
|
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
||||||
| securityContext | object | `{}` | |
|
| `labels` | Labels for tornjak frontend pods | `{}` |
|
||||||
| service.annotations | object | `{}` | |
|
| `podSecurityContext` | Pod security context | `{}` |
|
||||||
| service.port | int | `3000` | |
|
| `securityContext` | Security context | `{}` |
|
||||||
| service.type | string | `"ClusterIP"` | |
|
| `service.type` | Service type | `ClusterIP` |
|
||||||
| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
|
| `service.port` | Service port | `3000` |
|
||||||
| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
|
| `service.annotations` | Annotations for service resource | `{}` |
|
||||||
| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
|
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | |
|
||||||
| spireHealthCheck.enabled | bool | `true` | Enables the SPIRE Healthchecker indicator |
|
| `affinity` | Affinity rules | `{}` |
|
||||||
| startupProbe.enabled | bool | `true` | Enable startupProbe on Tornjak frontend container |
|
| `tolerations` | List of tolerations | `[]` |
|
||||||
| startupProbe.failureThreshold | int | `6` | Failure threshold count for startupProbe |
|
| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` |
|
||||||
| startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for startupProbe |
|
| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. | `http://localhost:10000/` |
|
||||||
| startupProbe.periodSeconds | int | `10` | Period seconds for startupProbe |
|
| `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` |
|
||||||
| startupProbe.successThreshold | int | `1` | Success threshold count for startupProbe |
|
| `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` |
|
||||||
| startupProbe.timeoutSeconds | int | `5` | Timeout seconds for startupProbe |
|
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` |
|
||||||
| tolerations | list | `[]` | |
|
| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
|
||||||
| topologySpreadConstraints | list | `[]` | |
|
| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
|
||||||
----------------------------------------------
|
| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` |
|
||||||
|
| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` |
|
||||||
|
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||||
|
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||||
|
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` |
|
||||||
|
|||||||
@@ -1,38 +1,53 @@
|
|||||||
# Default values for Tornjak UI (Frontend).
|
# Default configuration for Tornjak UI (Frontend)
|
||||||
# This is a YAML-formatted file.
|
# SPDX-License-Identifier: APACHE-2.0
|
||||||
# Declare variables to be passed into your templates.
|
|
||||||
|
|
||||||
# @ignored
|
## @skip global
|
||||||
global: {}
|
global: {}
|
||||||
|
|
||||||
|
## @section Chart parameters
|
||||||
|
##
|
||||||
|
## @param image.registry The OCI registry to pull the image from
|
||||||
|
## @param image.repository The repository within the registry
|
||||||
|
## @param image.pullPolicy The image pull policy
|
||||||
|
## @param image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
image:
|
image:
|
||||||
registry: ghcr.io
|
registry: ghcr.io
|
||||||
repository: spiffe/tornjak-frontend
|
repository: spiffe/tornjak-frontend
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
||||||
version: ""
|
version: ""
|
||||||
# -- Overrides the image tag whose default is the chart appVersion.
|
|
||||||
tag: ""
|
tag: ""
|
||||||
|
|
||||||
|
## @param imagePullSecrets [array] Pull secrets for images
|
||||||
imagePullSecrets: []
|
imagePullSecrets: []
|
||||||
|
|
||||||
|
## @param nameOverride Name override
|
||||||
nameOverride: ""
|
nameOverride: ""
|
||||||
|
|
||||||
|
## @param namespaceOverride Namespace override
|
||||||
namespaceOverride: ""
|
namespaceOverride: ""
|
||||||
|
|
||||||
|
## @param fullnameOverride Fullname override
|
||||||
fullnameOverride: ""
|
fullnameOverride: ""
|
||||||
|
|
||||||
|
## @param serviceAccount.create Specifies whether a service account should be created
|
||||||
|
## @param serviceAccount.annotations [object] Annotations to add to the service account
|
||||||
|
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
|
||||||
|
##
|
||||||
serviceAccount:
|
serviceAccount:
|
||||||
# -- Specifies whether a service account should be created
|
|
||||||
create: true
|
create: true
|
||||||
# -- Annotations to add to the service account
|
|
||||||
annotations: {}
|
annotations: {}
|
||||||
# -- The name of the service account to use.
|
|
||||||
# If not set and create is true, a name is generated using the fullname template
|
|
||||||
name: ""
|
name: ""
|
||||||
|
|
||||||
|
## @param labels [object] Labels for tornjak frontend pods
|
||||||
labels: {}
|
labels: {}
|
||||||
|
|
||||||
|
## @param podSecurityContext [object] Pod security context
|
||||||
podSecurityContext: {}
|
podSecurityContext: {}
|
||||||
# fsGroup: 2000
|
# fsGroup: 2000
|
||||||
|
|
||||||
|
## @param securityContext [object] Security context
|
||||||
securityContext: {}
|
securityContext: {}
|
||||||
# capabilities:
|
# capabilities:
|
||||||
# drop:
|
# drop:
|
||||||
@@ -41,22 +56,30 @@ securityContext: {}
|
|||||||
# runAsNonRoot: true
|
# runAsNonRoot: true
|
||||||
# runAsUser: 1000
|
# runAsUser: 1000
|
||||||
|
|
||||||
|
## @param service.type Service type
|
||||||
|
## @param service.port Service port
|
||||||
|
## @param service.annotations Annotations for service resource
|
||||||
|
##
|
||||||
service:
|
service:
|
||||||
type: ClusterIP
|
type: ClusterIP
|
||||||
port: 3000
|
port: 3000
|
||||||
annotations: {}
|
annotations: {}
|
||||||
|
|
||||||
# -- Select specific nodes to run on (currently only amd64 is supported by Tornjak)
|
## @extra nodeSelector Select specific nodes to run on (currently only amd64 is supported by Tornjak)
|
||||||
nodeSelector:
|
nodeSelector:
|
||||||
|
## @skip nodeSelector.kubernetes.io/arch
|
||||||
kubernetes.io/arch: amd64
|
kubernetes.io/arch: amd64
|
||||||
|
|
||||||
|
## @param affinity [object] Affinity rules
|
||||||
affinity: {}
|
affinity: {}
|
||||||
|
|
||||||
|
## @param tolerations [array] List of tolerations
|
||||||
tolerations: []
|
tolerations: []
|
||||||
|
|
||||||
|
## @param topologySpreadConstraints [array] List of topology spread constraints for resilience
|
||||||
topologySpreadConstraints: []
|
topologySpreadConstraints: []
|
||||||
|
|
||||||
# -- Provide minimal resources to prevent accidental crashes due to resource exhaustion
|
## Provide minimal resources to prevent accidental crashes due to resource exhaustion
|
||||||
# resources:
|
# resources:
|
||||||
# requests:
|
# requests:
|
||||||
# cpu: 50m
|
# cpu: 50m
|
||||||
@@ -65,44 +88,42 @@ topologySpreadConstraints: []
|
|||||||
# cpu: 100m
|
# cpu: 100m
|
||||||
# memory: 512Mi
|
# memory: 512Mi
|
||||||
|
|
||||||
# -- URL of the Tornjak APIs (backend)
|
## @param apiServerURL URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser.
|
||||||
# Since Tornjak Frontend runs in the browser, this URL must be accessible from
|
|
||||||
# the machine running a browser.
|
|
||||||
apiServerURL: "http://localhost:10000/" # 👈 Use it for minikube or kind
|
apiServerURL: "http://localhost:10000/" # 👈 Use it for minikube or kind
|
||||||
|
|
||||||
# SPIRE Healthchecker indicator
|
# SPIRE Healthchecker indicator
|
||||||
spireHealthCheck:
|
spireHealthCheck:
|
||||||
# -- Enables the SPIRE Healthchecker indicator
|
## @param spireHealthCheck.enabled Enables the SPIRE Healthchecker indicator
|
||||||
enabled: true
|
enabled: true
|
||||||
|
|
||||||
## Configure extra options for Tornjak frontend container's startup probe
|
## Configure extra options for Tornjak frontend container's startup probe
|
||||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes
|
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes
|
||||||
|
## @param startupProbe.enabled Enable startupProbe on Tornjak frontend container
|
||||||
|
## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe
|
||||||
|
## @param startupProbe.periodSeconds Period seconds for startupProbe
|
||||||
|
## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe
|
||||||
|
## @param startupProbe.failureThreshold Failure threshold count for startupProbe
|
||||||
|
## @param startupProbe.successThreshold Success threshold count for startupProbe
|
||||||
##
|
##
|
||||||
startupProbe:
|
startupProbe:
|
||||||
# -- Enable startupProbe on Tornjak frontend container
|
|
||||||
enabled: true
|
enabled: true
|
||||||
# -- Initial delay seconds for startupProbe
|
|
||||||
initialDelaySeconds: 5
|
initialDelaySeconds: 5
|
||||||
# -- Period seconds for startupProbe
|
|
||||||
periodSeconds: 10
|
periodSeconds: 10
|
||||||
# -- Timeout seconds for startupProbe
|
|
||||||
timeoutSeconds: 5
|
timeoutSeconds: 5
|
||||||
# -- Failure threshold count for startupProbe
|
|
||||||
failureThreshold: 6
|
failureThreshold: 6
|
||||||
# -- Success threshold count for startupProbe
|
|
||||||
successThreshold: 1
|
successThreshold: 1
|
||||||
|
|
||||||
# @ignored
|
|
||||||
tests:
|
tests:
|
||||||
bash:
|
bash:
|
||||||
|
## @param tests.bash.image.registry The OCI registry to pull the image from
|
||||||
|
## @param tests.bash.image.repository The repository within the registry
|
||||||
|
## @param tests.bash.image.pullPolicy The image pull policy
|
||||||
|
## @param tests.bash.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
|
## @param tests.bash.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
image:
|
image:
|
||||||
# -- The OCI registry to pull the image from
|
|
||||||
registry: cgr.dev
|
registry: cgr.dev
|
||||||
# -- The repository within the registry
|
|
||||||
repository: chainguard/bash
|
repository: chainguard/bash
|
||||||
# -- The image pull policy
|
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
||||||
version: ""
|
version: ""
|
||||||
# -- Overrides the image tag
|
|
||||||
tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4
|
tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4
|
||||||
|
|||||||
@@ -1 +1,8 @@
|
|||||||
Installed {{ .Chart.Name }}…
|
Installed {{ .Chart.Name }}…
|
||||||
|
{{- $up := (index .Values "spire-server").unsupportedBuiltInPlugins }}
|
||||||
|
{{- $s := add (len $up.keyManager) (len $up.nodeAttestor) (len $up.upstreamAuthority) (len $up.notifier) }}
|
||||||
|
{{- if gt $s 0 }}
|
||||||
|
|
||||||
|
Warning:
|
||||||
|
You are using an unsupported plugin. Functionality of this release and future upgrades are not guaranteed to work smoothly.
|
||||||
|
{{- end }}
|
||||||
|
|||||||
+65
-27
@@ -1,30 +1,34 @@
|
|||||||
# You can enable config/features that affect all services here.
|
# Default configuration for Spire chart
|
||||||
|
# SPDX-License-Identifier: APACHE-2.0
|
||||||
|
|
||||||
|
## @section Global parameters
|
||||||
|
## Note: the parameter values specified here will override the chart level values for these parameters.
|
||||||
|
##
|
||||||
global:
|
global:
|
||||||
k8s:
|
k8s:
|
||||||
# -- This is the value of your clusters `kubeadm init --service-dns-domain` flag
|
## @param global.k8s.clusterDomain Cluster domain name configured for Spire install
|
||||||
clusterDomain: cluster.local
|
clusterDomain: cluster.local
|
||||||
spire:
|
spire:
|
||||||
# -- The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)
|
## @param global.spire.bundleConfigMap A configmap containing the Spire bundle
|
||||||
clusterName: example-cluster
|
|
||||||
# -- The trust domain to be used for the SPIFFE identifiers
|
|
||||||
trustDomain: example.org
|
|
||||||
# -- Set the jwt issuer
|
|
||||||
jwtIssuer: https://oidc-discovery.example.org
|
|
||||||
# -- Override all instances of bundleConfigMap
|
|
||||||
bundleConfigMap: ""
|
bundleConfigMap: ""
|
||||||
|
## @param global.spire.clusterName The name of the k8s cluster for Spire install
|
||||||
# -- Set what address to use for the upstream server when using nested spire
|
clusterName: example-cluster
|
||||||
|
## @param global.spire.jwtIssuer The issuer for Spire JWT tokens
|
||||||
|
jwtIssuer: oidc-discovery.example.org
|
||||||
|
## @param global.spire.trustDomain The trust domain for Spire install
|
||||||
|
trustDomain: example.org
|
||||||
|
## @param global.spire.upstreamServerAddress Set what address to use for the upstream server when using nested spire
|
||||||
upstreamServerAddress: ""
|
upstreamServerAddress: ""
|
||||||
|
|
||||||
image:
|
image:
|
||||||
# -- Override all Spire image registries at once
|
## @param global.spire.image.registry Override all Spire image registries at once
|
||||||
registry: ""
|
registry: ""
|
||||||
|
|
||||||
installAndUpgradeHooks:
|
installAndUpgradeHooks:
|
||||||
# -- Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`)
|
## @param global.installAndUpgradeHooks.enabled Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`)
|
||||||
enabled: true
|
enabled: true
|
||||||
deleteHooks:
|
deleteHooks:
|
||||||
# -- Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`)
|
## @param global.deleteHooks.enabled Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`)
|
||||||
enabled: true
|
enabled: true
|
||||||
|
|
||||||
# telemetry:
|
# telemetry:
|
||||||
@@ -36,54 +40,88 @@ global:
|
|||||||
# namespace: "kube-prometheus-system"
|
# namespace: "kube-prometheus-system"
|
||||||
# labels: {}
|
# labels: {}
|
||||||
|
|
||||||
# subcharts
|
## subcharts
|
||||||
spire-server:
|
|
||||||
# -- Enables deployment of SPIRE Server
|
|
||||||
enabled: true
|
|
||||||
nameOverride: server
|
|
||||||
|
|
||||||
|
## @section Spire server parameters
|
||||||
|
## Parameter values for Spire server
|
||||||
|
##
|
||||||
|
spire-server:
|
||||||
|
## @param spire-server.enabled Flag to enable Spire server
|
||||||
|
enabled: true
|
||||||
|
## @param spire-server.nameOverride Overrides the name of Spire server pods
|
||||||
|
nameOverride: server
|
||||||
controllerManager:
|
controllerManager:
|
||||||
# -- Enables deployment of Controller Manager
|
## @param spire-server.controllerManager.enabled Enable controller manager and provision CRD's
|
||||||
enabled: true
|
enabled: true
|
||||||
|
|
||||||
|
## @section Spire agent parameters
|
||||||
|
## Parameter values for Spire agent
|
||||||
|
##
|
||||||
spire-agent:
|
spire-agent:
|
||||||
# -- Enables deployment of SPIRE Agent(s)
|
## @param spire-agent.enabled Flag to enable Spire agent
|
||||||
enabled: true
|
enabled: true
|
||||||
|
## @param spire-agent.nameOverride Overrides the name of Spire agent pods
|
||||||
nameOverride: agent
|
nameOverride: agent
|
||||||
|
|
||||||
|
## @section Upstream Spire agent and CSI driver configuration
|
||||||
|
## Parameter values enabling upstream spire agent and CSI driver
|
||||||
|
##
|
||||||
upstream:
|
upstream:
|
||||||
# -- enable upstream agent and driver for use with nested spire.
|
## @param upstream.enabled Enable upstream agent and driver for use with nested spire
|
||||||
enabled: false
|
enabled: false
|
||||||
|
|
||||||
|
## @section Upstream Spire agent parameters
|
||||||
|
## Parameter values for upstream Spire agent
|
||||||
|
##
|
||||||
upstream-spire-agent:
|
upstream-spire-agent:
|
||||||
# @ignored
|
## @param upstream-spire-agent.upstream Flag for enabling upstream Spire agent
|
||||||
upstream: true
|
upstream: true
|
||||||
|
## @param upstream-spire-agent.nameOverride Name override for upstream Spire agent
|
||||||
nameOverride: agent-upstream
|
nameOverride: agent-upstream
|
||||||
|
## @param upstream-spire-agent.bundleConfigMap The configmap name for upstream Spire agent bundle
|
||||||
bundleConfigMap: spire-bundle-upstream
|
bundleConfigMap: spire-bundle-upstream
|
||||||
|
## @param upstream-spire-agent.socketPath Socket path where Spire agent socket is mounted
|
||||||
socketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
|
socketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
|
||||||
serviceAccount:
|
serviceAccount:
|
||||||
|
## @param upstream-spire-agent.serviceAccount.name Service account name for upstream Spire agent
|
||||||
name: spire-agent-upstream
|
name: spire-agent-upstream
|
||||||
healthChecks:
|
healthChecks:
|
||||||
|
## @param upstream-spire-agent.healthChecks.port Health check port number for upstream Spire agent
|
||||||
port: 9981
|
port: 9981
|
||||||
telemetry:
|
telemetry:
|
||||||
prometheus:
|
prometheus:
|
||||||
|
## @param upstream-spire-agent.telemetry.prometheus.port The port where prometheus metrics are available
|
||||||
port: 9989
|
port: 9989
|
||||||
|
|
||||||
|
## @section SPIFFE CSI Driver parameters
|
||||||
|
## Parameter values for spiffe-csi-driver
|
||||||
|
##
|
||||||
spiffe-csi-driver:
|
spiffe-csi-driver:
|
||||||
# -- Enables deployment of CSI driver
|
## @param spiffe-csi-driver.enabled Flag to enable spiffe-csi-driver for the cluster
|
||||||
enabled: true
|
enabled: true
|
||||||
|
|
||||||
|
## @section Upstream SPIFFE CSI Driver parameters
|
||||||
|
## Parameter values for upstream spiffe-csi-driver
|
||||||
|
##
|
||||||
upstream-spiffe-csi-driver:
|
upstream-spiffe-csi-driver:
|
||||||
|
## @param upstream-spiffe-csi-driver.pluginName The plugin name for configuring upstream Spiffe CSI driver
|
||||||
pluginName: upstream.csi.spiffe.io
|
pluginName: upstream.csi.spiffe.io
|
||||||
|
## @param upstream-spiffe-csi-driver.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
|
||||||
agentSocketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
|
agentSocketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
|
||||||
healthChecks:
|
healthChecks:
|
||||||
|
## @param upstream-spiffe-csi-driver.healthChecks.port The port where Spiffe CSI driver health checks are exposed
|
||||||
port: 9810
|
port: 9810
|
||||||
|
|
||||||
|
## @section SPIFFE oidc discovery provider parameters
|
||||||
|
## Parameter values for spiffe-oidc-discovery-provider
|
||||||
|
##
|
||||||
spiffe-oidc-discovery-provider:
|
spiffe-oidc-discovery-provider:
|
||||||
# -- Enables deployment of OIDC discovery provider
|
## @param spiffe-oidc-discovery-provider.enabled Flag to enable spiffe-oidc-discovery-provider for the cluster
|
||||||
enabled: false
|
enabled: false
|
||||||
|
|
||||||
|
## @section Tornjak frontend parameters
|
||||||
|
## Parameter values for Tornjak frontend
|
||||||
|
##
|
||||||
tornjak-frontend:
|
tornjak-frontend:
|
||||||
# -- Enables deployment of Tornjak frontend/UI (Not for production)
|
## @param tornjak-frontend.enabled Enables deployment of Tornjak frontend/UI (Not for production)
|
||||||
enabled: false
|
enabled: false
|
||||||
|
|||||||
@@ -12,31 +12,35 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
|
|||||||
# shellcheck source=/dev/null
|
# shellcheck source=/dev/null
|
||||||
source "${TESTDIR}/common.sh"
|
source "${TESTDIR}/common.sh"
|
||||||
|
|
||||||
helm_install=(helm upgrade --install --create-namespace)
|
|
||||||
ns=spire-system
|
|
||||||
|
|
||||||
teardown() {
|
teardown() {
|
||||||
helm uninstall --namespace "${ns}" spire 2>/dev/null || true
|
helm uninstall --namespace "spire-server" spire 2>/dev/null || true
|
||||||
kubectl delete ns "${ns}" 2>/dev/null || true
|
|
||||||
|
|
||||||
helm uninstall --namespace mysql mysql 2>/dev/null || true
|
helm uninstall --namespace mysql mysql 2>/dev/null || true
|
||||||
kubectl delete ns mysql 2>/dev/null || true
|
kubectl delete ns spire-server 2>/dev/null || true
|
||||||
|
kubectl delete ns spire-system 2>/dev/null || true
|
||||||
}
|
}
|
||||||
|
|
||||||
trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
|
trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
|
||||||
|
|
||||||
"${helm_install[@]}" mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \
|
kubectl create namespace spire-system --dry-run=client -o yaml | kubectl apply -f -
|
||||||
--namespace mysql \
|
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true
|
||||||
|
kubectl create namespace spire-server --dry-run=client -o yaml | kubectl apply -f -
|
||||||
|
kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted || true
|
||||||
|
|
||||||
|
helm upgrade --install mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \
|
||||||
|
--namespace spire-server \
|
||||||
--values "${DEPS}/mysql.yaml" \
|
--values "${DEPS}/mysql.yaml" \
|
||||||
--wait
|
--wait
|
||||||
|
|
||||||
"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" \
|
helm upgrade --install --namespace "spire-server" \
|
||||||
|
--values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml" \
|
||||||
--set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire
|
--set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire
|
||||||
helm test --namespace "${ns}" spire
|
helm test --namespace "spire-server" spire
|
||||||
|
|
||||||
print_helm_releases
|
print_helm_releases
|
||||||
print_spire_workload_status "${ns}"
|
print_spire_workload_status spire-server
|
||||||
|
print_spire_workload_status spire-system
|
||||||
|
|
||||||
if [[ "$1" -ne 0 ]]; then
|
if [[ "$1" -ne 0 ]]; then
|
||||||
get_namespace_details "${ns}"
|
get_namespace_details spire-server
|
||||||
|
get_namespace_details spire-system
|
||||||
fi
|
fi
|
||||||
|
|||||||
@@ -1,9 +1,10 @@
|
|||||||
spire-server:
|
spire-server:
|
||||||
|
replicaCount: 2
|
||||||
dataStore:
|
dataStore:
|
||||||
sql:
|
sql:
|
||||||
databaseType: mysql
|
databaseType: mysql
|
||||||
databaseName: spire-server
|
databaseName: spire-server
|
||||||
host: mysql.mysql
|
host: mysql
|
||||||
port: 3306
|
port: 3306
|
||||||
username: spire
|
username: spire
|
||||||
# password: CHANGE_ME
|
# password: CHANGE_ME
|
||||||
|
|||||||
@@ -12,31 +12,35 @@ source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
|
|||||||
# shellcheck source=/dev/null
|
# shellcheck source=/dev/null
|
||||||
source "${TESTDIR}/common.sh"
|
source "${TESTDIR}/common.sh"
|
||||||
|
|
||||||
helm_install=(helm upgrade --install --create-namespace)
|
|
||||||
ns=spire-system
|
|
||||||
|
|
||||||
teardown() {
|
teardown() {
|
||||||
helm uninstall --namespace "${ns}" spire 2>/dev/null || true
|
helm uninstall --namespace "spire-server" spire 2>/dev/null || true
|
||||||
kubectl delete ns "${ns}" 2>/dev/null || true
|
helm uninstall --namespace "spire-server" postgresql 2>/dev/null || true
|
||||||
|
kubectl delete ns spire-server 2>/dev/null || true
|
||||||
helm uninstall --namespace postgresql postgresql 2>/dev/null || true
|
kubectl delete ns spire-system 2>/dev/null || true
|
||||||
kubectl delete ns postgresql 2>/dev/null || true
|
|
||||||
}
|
}
|
||||||
|
|
||||||
trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
|
trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
|
||||||
|
|
||||||
"${helm_install[@]}" postgresql postgresql --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \
|
kubectl create namespace spire-system --dry-run=client -o yaml | kubectl apply -f -
|
||||||
--namespace postgresql \
|
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true
|
||||||
--values "${DEPS}/postgresql.yaml" \
|
kubectl create namespace spire-server --dry-run=client -o yaml | kubectl apply -f -
|
||||||
|
kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted || true
|
||||||
|
|
||||||
|
helm upgrade --install postgresql postgresql --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \
|
||||||
|
--namespace spire-server \
|
||||||
|
--values "${DEPS}/postgresql.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml" \
|
||||||
--wait
|
--wait
|
||||||
|
|
||||||
"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" \
|
helm upgrade --install --namespace "spire-server" \
|
||||||
|
--values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml" \
|
||||||
--set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire
|
--set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire
|
||||||
helm test --namespace "${ns}" spire
|
helm test --namespace "spire-server" spire
|
||||||
|
|
||||||
print_helm_releases
|
print_helm_releases
|
||||||
print_spire_workload_status "${ns}"
|
print_spire_workload_status spire-server
|
||||||
|
print_spire_workload_status spire-system
|
||||||
|
|
||||||
if [[ "$1" -ne 0 ]]; then
|
if [[ "$1" -ne 0 ]]; then
|
||||||
get_namespace_details "${ns}"
|
get_namespace_details spire-server
|
||||||
|
get_namespace_details spire-system
|
||||||
fi
|
fi
|
||||||
|
|||||||
@@ -1,9 +1,10 @@
|
|||||||
spire-server:
|
spire-server:
|
||||||
|
replicaCount: 2
|
||||||
dataStore:
|
dataStore:
|
||||||
sql:
|
sql:
|
||||||
databaseType: postgres
|
databaseType: postgres
|
||||||
databaseName: spire-server
|
databaseName: spire-server
|
||||||
host: postgresql.postgresql
|
host: postgresql
|
||||||
port: 5432
|
port: 5432
|
||||||
username: spire
|
username: spire
|
||||||
# password: CHANGE_ME
|
# password: CHANGE_ME
|
||||||
|
|||||||
@@ -8,16 +8,26 @@ kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privil
|
|||||||
kubectl create namespace "spire-server"
|
kubectl create namespace "spire-server"
|
||||||
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
|
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
|
||||||
|
|
||||||
|
```shell
|
||||||
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml
|
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
|
If your using ingress-nginx and want to expose the spiffe oidc discovery provider outside the
|
||||||
|
cluster, add the following to the end of the helm upgrade example:
|
||||||
|
|
||||||
|
```shell
|
||||||
|
-f values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml
|
||||||
|
```
|
||||||
|
|
||||||
If you want to expose your spire-server outside of Kubernetes and are using ingress-nginx, add following values file when running `helm template/install/upgrade`.
|
If you want to expose your spire-server outside of Kubernetes and are using ingress-nginx, add following values file when running `helm template/install/upgrade`.
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
-f values-expose-spire-server-ingress-nginx.yaml
|
-f values-expose-spire-server-ingress-nginx.yaml
|
||||||
```
|
```
|
||||||
|
For example:
|
||||||
|
```shell
|
||||||
|
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-spire-server-ingress-nginx.yaml
|
||||||
|
```
|
||||||
|
|
||||||
If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx
|
If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx
|
||||||
you have two options as described here:
|
you have two options as described here:
|
||||||
@@ -28,9 +38,20 @@ If you chose profile https_web, use:
|
|||||||
```shell
|
```shell
|
||||||
-f values-expose-federation-https-web-ingress-nginx.yaml
|
-f values-expose-federation-https-web-ingress-nginx.yaml
|
||||||
```
|
```
|
||||||
|
For example:
|
||||||
|
```shell
|
||||||
|
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-web-ingress-nginx.yaml
|
||||||
|
```
|
||||||
|
|
||||||
If you chose profile https_spiffe, use:
|
If you chose profile https_spiffe, use:
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
-f values-expose-federation-https-spiffe-ingress-nginx.yaml
|
-f values-expose-federation-https-spiffe-ingress-nginx.yaml
|
||||||
```
|
```
|
||||||
|
For example:
|
||||||
|
```shell
|
||||||
|
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-spiffe-ingress-nginx.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
|
||||||
|
|
||||||
|
|||||||
@@ -5,7 +5,10 @@ set -xe
|
|||||||
SCRIPT="$(readlink -f "$0")"
|
SCRIPT="$(readlink -f "$0")"
|
||||||
SCRIPTPATH="$(dirname "${SCRIPT}")"
|
SCRIPTPATH="$(dirname "${SCRIPT}")"
|
||||||
TESTDIR="${SCRIPTPATH}/../../.github/tests"
|
TESTDIR="${SCRIPTPATH}/../../.github/tests"
|
||||||
|
DEPS="${TESTDIR}/dependencies"
|
||||||
|
|
||||||
|
# shellcheck source=/dev/null
|
||||||
|
source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
|
||||||
# shellcheck source=/dev/null
|
# shellcheck source=/dev/null
|
||||||
source "${TESTDIR}/common.sh"
|
source "${TESTDIR}/common.sh"
|
||||||
|
|
||||||
@@ -16,6 +19,10 @@ teardown() {
|
|||||||
helm uninstall --namespace "${ns}" spire 2>/dev/null || true
|
helm uninstall --namespace "${ns}" spire 2>/dev/null || true
|
||||||
kubectl delete ns "${ns}" 2>/dev/null || true
|
kubectl delete ns "${ns}" 2>/dev/null || true
|
||||||
kubectl delete ns spire-system 2>/dev/null || true
|
kubectl delete ns spire-system 2>/dev/null || true
|
||||||
|
helm uninstall --namespace cert-manager cert-manager 2>/dev/null || true
|
||||||
|
kubectl delete ns cert-manager 2>/dev/null || true
|
||||||
|
helm uninstall --namespace ingress-nginx 2>/dev/null || true
|
||||||
|
kubectl delete ns ingress-nginx 2>/dev/null || true
|
||||||
}
|
}
|
||||||
|
|
||||||
trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
|
trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
|
||||||
@@ -25,7 +32,61 @@ kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileg
|
|||||||
kubectl create namespace "${ns}" 2>/dev/null || true
|
kubectl create namespace "${ns}" 2>/dev/null || true
|
||||||
kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true
|
kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true
|
||||||
|
|
||||||
"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" --wait spire charts/spire
|
"${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \
|
||||||
|
--namespace cert-manager \
|
||||||
|
--create-namespace \
|
||||||
|
--set installCRDs=true \
|
||||||
|
--wait
|
||||||
|
|
||||||
|
kubectl apply -f "${DEPS}/testcert.yaml" -n spire-server
|
||||||
|
|
||||||
|
"${helm_install[@]}" ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \
|
||||||
|
--namespace ingress-nginx \
|
||||||
|
--create-namespace \
|
||||||
|
--set controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP \
|
||||||
|
--set controller.ingressClassResource.default=true \
|
||||||
|
--wait
|
||||||
|
|
||||||
|
ip=$(kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ .spec.clusterIP }}')
|
||||||
|
echo "$ip" oidc-discovery.example.org
|
||||||
|
|
||||||
|
cat > /tmp/dummydns <<EOF
|
||||||
|
spiffe-oidc-discovery-provider:
|
||||||
|
tests:
|
||||||
|
hostAliases:
|
||||||
|
- ip: "$ip"
|
||||||
|
hostnames:
|
||||||
|
- "oidc-discovery.example.org"
|
||||||
|
spire-agent:
|
||||||
|
hostAliases:
|
||||||
|
- ip: "$ip"
|
||||||
|
hostnames:
|
||||||
|
- "spire-server.example.org"
|
||||||
|
spire-server:
|
||||||
|
tests:
|
||||||
|
hostAliases:
|
||||||
|
- ip: "$ip"
|
||||||
|
hostnames:
|
||||||
|
- "spire-server-federation.example.org"
|
||||||
|
federation:
|
||||||
|
ingress:
|
||||||
|
tls:
|
||||||
|
- hosts:
|
||||||
|
- spire-server-federation.example.org
|
||||||
|
secretName: tls-cert
|
||||||
|
EOF
|
||||||
|
|
||||||
|
"${helm_install[@]}" spire charts/spire \
|
||||||
|
--namespace "${ns}" \
|
||||||
|
--values "${SCRIPTPATH}/values.yaml" \
|
||||||
|
--values "${SCRIPTPATH}/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml" \
|
||||||
|
--values "${SCRIPTPATH}/values-export-spire-server-ingress-nginx.yaml" \
|
||||||
|
--values "${SCRIPTPATH}/values-export-federation-https-web-ingress-nginx.yaml" \
|
||||||
|
--values /tmp/dummydns \
|
||||||
|
--set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \
|
||||||
|
--set spire-agent.server.address=spire-server.example.org,spire-agent.server.port=443 \
|
||||||
|
--wait
|
||||||
|
|
||||||
helm test --namespace "${ns}" spire
|
helm test --namespace "${ns}" spire
|
||||||
|
|
||||||
print_helm_releases
|
print_helm_releases
|
||||||
|
|||||||
@@ -1,4 +1,7 @@
|
|||||||
spire-server:
|
spire-server:
|
||||||
|
tests:
|
||||||
|
tls:
|
||||||
|
enabled: true
|
||||||
federation:
|
federation:
|
||||||
enabled: true
|
enabled: true
|
||||||
ingress:
|
ingress:
|
||||||
|
|||||||
@@ -0,0 +1,27 @@
|
|||||||
|
spiffe-oidc-discovery-provider:
|
||||||
|
tests:
|
||||||
|
tls:
|
||||||
|
enabled: true
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
annotations:
|
||||||
|
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||||
|
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||||
|
|
||||||
|
# Optional settings you may put in your own values.
|
||||||
|
# kubernetes.io/ingress.class: nginx
|
||||||
|
# kubernetes.io/tls-acme: "true"
|
||||||
|
|
||||||
|
# className: nginx
|
||||||
|
|
||||||
|
# You must override these in your own values file with the appropriate hostname
|
||||||
|
# and secret or it wont start.
|
||||||
|
hosts:
|
||||||
|
- host: oidc-discovery.example.org
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
tls:
|
||||||
|
- secretName: tls-cert
|
||||||
|
hosts:
|
||||||
|
- oidc-discovery.example.org
|
||||||
@@ -0,0 +1,11 @@
|
|||||||
|
spire-server:
|
||||||
|
affinity:
|
||||||
|
podAntiAffinity:
|
||||||
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- labelSelector:
|
||||||
|
matchExpressions:
|
||||||
|
- key: app.kubernetes.io/component
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
- server
|
||||||
|
topologyKey: kubernetes.io/hostname
|
||||||
@@ -23,6 +23,7 @@ spire-server:
|
|||||||
drop: [ALL]
|
drop: [ALL]
|
||||||
seccompProfile:
|
seccompProfile:
|
||||||
type: RuntimeDefault
|
type: RuntimeDefault
|
||||||
|
priorityClassName: system-cluster-critical
|
||||||
|
|
||||||
logLevel: info
|
logLevel: info
|
||||||
|
|
||||||
|
|||||||
@@ -0,0 +1,9 @@
|
|||||||
|
FROM alpine
|
||||||
|
RUN \
|
||||||
|
cd /tmp && \
|
||||||
|
wget -O plugin.tar.gz https://github.com/boxboat/spire-tpm-plugin/releases/download/v1.3.3/spire_tpm_plugin_tpm_attestor_agent_linux_amd64_v1.3.3.tar.gz && \
|
||||||
|
tar -zxvf plugin.tar.gz && \
|
||||||
|
mv tpm_attestor_agent /
|
||||||
|
|
||||||
|
FROM ghcr.io/spiffe/spire-server:1.5.4
|
||||||
|
COPY --from=0 /tpm_attestor_agent /bin/tpm_attestor_agent
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
FROM alpine
|
||||||
|
RUN \
|
||||||
|
cd /tmp && \
|
||||||
|
wget -O plugin.tar.gz https://github.com/boxboat/spire-tpm-plugin/releases/download/v1.3.3/spire_tpm_plugin_tpm_attestor_server_linux_amd64_v1.3.3.tar.gz && \
|
||||||
|
tar -zxvf plugin.tar.gz && \
|
||||||
|
mv tpm_attestor_server /
|
||||||
|
|
||||||
|
FROM ghcr.io/spiffe/spire-server:1.5.4
|
||||||
|
COPY --from=0 /tpm_attestor_server /bin/tpm_attestor_server
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
spire-server:
|
||||||
|
initContainers:
|
||||||
|
- name: tpm-init
|
||||||
|
image: busybox
|
||||||
|
command:
|
||||||
|
- sh
|
||||||
|
- -c
|
||||||
|
- |
|
||||||
|
mkdir -p /run/spire/data/certs
|
||||||
|
mkdir -p /run/spire/data/hashes
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /run/spire/data
|
||||||
|
name: spire-data
|
||||||
|
image:
|
||||||
|
registry: docker.io
|
||||||
|
repository: kfox1111/misc
|
||||||
|
version: tpm-server-test
|
||||||
|
customPlugins:
|
||||||
|
nodeAttestor:
|
||||||
|
tpm:
|
||||||
|
plugin_cmd: /bin/tpm_attestor_server
|
||||||
|
plugin_checksum: 97442358ae946e3fb8f2464432b8c23efdc0b5d44ec1eea27babe59ef646cc2f
|
||||||
|
plugin_data:
|
||||||
|
- ca_path: /run/spire/data/certs
|
||||||
|
hash_path: /run/spire/data/hashes
|
||||||
+14
-37
@@ -3,44 +3,21 @@
|
|||||||
set -euo pipefail
|
set -euo pipefail
|
||||||
|
|
||||||
SCRIPTPATH=$(dirname "$0")
|
SCRIPTPATH=$(dirname "$0")
|
||||||
HELM_DOCS_VERSION="1.11.0"
|
README_GENERATOR_VERSION="2.5.1"
|
||||||
|
README_GENERATOR_EXE="readme-generator"
|
||||||
|
|
||||||
case "$(uname -s)" in
|
if ! hash "${README_GENERATOR_EXE}" 2>/dev/null; then
|
||||||
Linux*)
|
echo >&2 "readme-generator not installed. Installing..."
|
||||||
machine=Linux
|
hash npm 2>/dev/null || { echo >&2 "npm is required to install ${README_GENERATOR_EXE}. Please install npm and rerun the script. Aborting."; exit 1; }
|
||||||
shasum=sha256sum
|
# platform agnostic npm install, also adds into the path
|
||||||
exe=helm-docs
|
npm install -g "@bitnami/readme-generator-for-helm@${README_GENERATOR_VERSION}"
|
||||||
;;
|
|
||||||
Darwin*)
|
|
||||||
machine=Darwin
|
|
||||||
shasum=shasum
|
|
||||||
exe=helm-docs
|
|
||||||
;;
|
|
||||||
MINGW64*)
|
|
||||||
machine=Windows
|
|
||||||
shasum=sha256sum
|
|
||||||
exe=helm-docs.exe
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
function install_helm_docs {
|
|
||||||
curl -LO "https://github.com/norwoodj/helm-docs/releases/download/v${HELM_DOCS_VERSION}/helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz"
|
|
||||||
curl -L --output /tmp/checksums_helm-docs.txt "https://github.com/norwoodj/helm-docs/releases/download/v${HELM_DOCS_VERSION}/checksums.txt"
|
|
||||||
grep "helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz" /tmp/checksums_helm-docs.txt | $shasum -c -
|
|
||||||
mkdir -p "$SCRIPTPATH/bin"
|
|
||||||
tar -xf "helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz" "${exe}"
|
|
||||||
mv "${exe}" "$SCRIPTPATH/bin/"
|
|
||||||
rm "helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz"
|
|
||||||
}
|
|
||||||
|
|
||||||
if [ ! -f "$SCRIPTPATH/bin/${exe}" ] ; then
|
|
||||||
install_helm_docs
|
|
||||||
elif [[ ! "$("$SCRIPTPATH/bin/${exe}" --version)" =~ .*"$HELM_DOCS_VERSION".* ]] ; then
|
|
||||||
install_helm_docs
|
|
||||||
else
|
|
||||||
echo "Using '$("$SCRIPTPATH/bin/${exe}" --version)'"
|
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# validate docs
|
# generate docs and show the diff
|
||||||
"$SCRIPTPATH/bin/${exe}" --document-dependency-values
|
mapfile -t chart_paths < <(find "$SCRIPTPATH/charts" -type f -iname "Chart.yaml" -exec dirname {} +)
|
||||||
|
for cpath in "${chart_paths[@]}"
|
||||||
|
do
|
||||||
|
echo >&2 "Generating Chart documentation for ${cpath}…"
|
||||||
|
readme-generator --values="${cpath}/values.yaml" --readme="${cpath}/README.md"
|
||||||
|
done
|
||||||
git diff --exit-code
|
git diff --exit-code
|
||||||
|
|||||||
+1
-1
@@ -107,7 +107,7 @@ git pull
|
|||||||
git checkout --track -B "${branch_name}" main
|
git checkout --track -B "${branch_name}" main
|
||||||
commits_since_previous_release="$(git log "${chart}-${current_version}..HEAD" --pretty=format:'* %h %s')"
|
commits_since_previous_release="$(git log "${chart}-${current_version}..HEAD" --pretty=format:'* %h %s')"
|
||||||
"${SED}" -i "s/version: ${current_version}/version: ${new_version}/" "charts/${chart}/Chart.yaml"
|
"${SED}" -i "s/version: ${current_version}/version: ${new_version}/" "charts/${chart}/Chart.yaml"
|
||||||
./helm-docs.sh
|
"${SED}" -i "s/${current_version}/${new_version}/" "charts/${chart}/README.md"
|
||||||
git add "charts/${chart}/"{Chart.yaml,README.md}
|
git add "charts/${chart}/"{Chart.yaml,README.md}
|
||||||
git commit -m "Bump ${chart} Helm Chart version from ${current_version} to ${new_version}" \
|
git commit -m "Bump ${chart} Helm Chart version from ${current_version} to ${new_version}" \
|
||||||
-m "${commits_since_previous_release}" \
|
-m "${commits_since_previous_release}" \
|
||||||
|
|||||||
+21
-21
@@ -3,23 +3,23 @@ module github.com/spiffe/helm-charts/tests
|
|||||||
go 1.20
|
go 1.20
|
||||||
|
|
||||||
require (
|
require (
|
||||||
github.com/onsi/ginkgo/v2 v2.11.0
|
github.com/onsi/ginkgo/v2 v2.12.0
|
||||||
github.com/onsi/gomega v1.27.10
|
github.com/onsi/gomega v1.27.10
|
||||||
helm.sh/helm/v3 v3.11.3
|
helm.sh/helm/v3 v3.12.3
|
||||||
)
|
)
|
||||||
|
|
||||||
require (
|
require (
|
||||||
github.com/BurntSushi/toml v1.2.1 // indirect
|
github.com/BurntSushi/toml v1.2.1 // indirect
|
||||||
github.com/Masterminds/goutils v1.1.1 // indirect
|
github.com/Masterminds/goutils v1.1.1 // indirect
|
||||||
github.com/Masterminds/semver/v3 v3.2.0 // indirect
|
github.com/Masterminds/semver/v3 v3.2.1 // indirect
|
||||||
github.com/Masterminds/sprig/v3 v3.2.3 // indirect
|
github.com/Masterminds/sprig/v3 v3.2.3 // indirect
|
||||||
github.com/cyphar/filepath-securejoin v0.2.3 // indirect
|
github.com/cyphar/filepath-securejoin v0.2.3 // indirect
|
||||||
github.com/davecgh/go-spew v1.1.1 // indirect
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
||||||
github.com/emicklei/go-restful/v3 v3.10.1 // indirect
|
github.com/emicklei/go-restful/v3 v3.10.1 // indirect
|
||||||
github.com/go-logr/logr v1.2.4 // indirect
|
github.com/go-logr/logr v1.2.4 // indirect
|
||||||
github.com/go-openapi/jsonpointer v0.19.5 // indirect
|
github.com/go-openapi/jsonpointer v0.19.6 // indirect
|
||||||
github.com/go-openapi/jsonreference v0.20.0 // indirect
|
github.com/go-openapi/jsonreference v0.20.1 // indirect
|
||||||
github.com/go-openapi/swag v0.19.14 // indirect
|
github.com/go-openapi/swag v0.22.3 // indirect
|
||||||
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
|
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
|
||||||
github.com/gobwas/glob v0.2.3 // indirect
|
github.com/gobwas/glob v0.2.3 // indirect
|
||||||
github.com/gogo/protobuf v1.3.2 // indirect
|
github.com/gogo/protobuf v1.3.2 // indirect
|
||||||
@@ -27,13 +27,13 @@ require (
|
|||||||
github.com/google/gnostic v0.5.7-v3refs // indirect
|
github.com/google/gnostic v0.5.7-v3refs // indirect
|
||||||
github.com/google/go-cmp v0.5.9 // indirect
|
github.com/google/go-cmp v0.5.9 // indirect
|
||||||
github.com/google/gofuzz v1.2.0 // indirect
|
github.com/google/gofuzz v1.2.0 // indirect
|
||||||
github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 // indirect
|
github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect
|
||||||
github.com/google/uuid v1.3.0 // indirect
|
github.com/google/uuid v1.3.0 // indirect
|
||||||
github.com/huandu/xstrings v1.4.0 // indirect
|
github.com/huandu/xstrings v1.4.0 // indirect
|
||||||
github.com/imdario/mergo v0.3.13 // indirect
|
github.com/imdario/mergo v0.3.13 // indirect
|
||||||
github.com/josharian/intern v1.0.0 // indirect
|
github.com/josharian/intern v1.0.0 // indirect
|
||||||
github.com/json-iterator/go v1.1.12 // indirect
|
github.com/json-iterator/go v1.1.12 // indirect
|
||||||
github.com/mailru/easyjson v0.7.6 // indirect
|
github.com/mailru/easyjson v0.7.7 // indirect
|
||||||
github.com/mitchellh/copystructure v1.2.0 // indirect
|
github.com/mitchellh/copystructure v1.2.0 // indirect
|
||||||
github.com/mitchellh/reflectwalk v1.0.2 // indirect
|
github.com/mitchellh/reflectwalk v1.0.2 // indirect
|
||||||
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
||||||
@@ -45,27 +45,27 @@ require (
|
|||||||
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
|
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
|
||||||
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
|
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
|
||||||
github.com/xeipuuv/gojsonschema v1.2.0 // indirect
|
github.com/xeipuuv/gojsonschema v1.2.0 // indirect
|
||||||
golang.org/x/crypto v0.11.0 // indirect
|
golang.org/x/crypto v0.12.0 // indirect
|
||||||
golang.org/x/net v0.12.0 // indirect
|
golang.org/x/net v0.14.0 // indirect
|
||||||
golang.org/x/oauth2 v0.4.0 // indirect
|
golang.org/x/oauth2 v0.4.0 // indirect
|
||||||
golang.org/x/sys v0.10.0 // indirect
|
golang.org/x/sys v0.11.0 // indirect
|
||||||
golang.org/x/term v0.10.0 // indirect
|
golang.org/x/term v0.11.0 // indirect
|
||||||
golang.org/x/text v0.11.0 // indirect
|
golang.org/x/text v0.12.0 // indirect
|
||||||
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
|
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
|
||||||
golang.org/x/tools v0.9.3 // indirect
|
golang.org/x/tools v0.12.0 // indirect
|
||||||
google.golang.org/appengine v1.6.7 // indirect
|
google.golang.org/appengine v1.6.7 // indirect
|
||||||
google.golang.org/protobuf v1.28.1 // indirect
|
google.golang.org/protobuf v1.28.1 // indirect
|
||||||
gopkg.in/inf.v0 v0.9.1 // indirect
|
gopkg.in/inf.v0 v0.9.1 // indirect
|
||||||
gopkg.in/yaml.v2 v2.4.0 // indirect
|
gopkg.in/yaml.v2 v2.4.0 // indirect
|
||||||
gopkg.in/yaml.v3 v3.0.1 // indirect
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
||||||
k8s.io/api v0.26.2 // indirect
|
k8s.io/api v0.27.3 // indirect
|
||||||
k8s.io/apiextensions-apiserver v0.26.0 // indirect
|
k8s.io/apiextensions-apiserver v0.27.3 // indirect
|
||||||
k8s.io/apimachinery v0.26.2 // indirect
|
k8s.io/apimachinery v0.27.3 // indirect
|
||||||
k8s.io/client-go v0.26.2 // indirect
|
k8s.io/client-go v0.27.3 // indirect
|
||||||
k8s.io/klog/v2 v2.90.1 // indirect
|
k8s.io/klog/v2 v2.100.1 // indirect
|
||||||
k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 // indirect
|
k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // indirect
|
||||||
k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5 // indirect
|
k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5 // indirect
|
||||||
sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect
|
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
|
||||||
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
|
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
|
||||||
sigs.k8s.io/yaml v1.3.0 // indirect
|
sigs.k8s.io/yaml v1.3.0 // indirect
|
||||||
)
|
)
|
||||||
|
|||||||
+52
-53
@@ -4,8 +4,9 @@ github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak
|
|||||||
github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
|
github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
|
||||||
github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
|
github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
|
||||||
github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
|
github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
|
||||||
github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
|
|
||||||
github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
|
github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
|
||||||
|
github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
|
||||||
|
github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
|
||||||
github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
|
github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
|
||||||
github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
|
github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
|
||||||
github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
|
github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
|
||||||
@@ -28,14 +29,12 @@ github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3
|
|||||||
github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
||||||
github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
|
github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
|
||||||
github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
||||||
github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
|
github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
|
||||||
github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
|
github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
|
||||||
github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
|
github.com/go-openapi/jsonreference v0.20.1 h1:FBLnyygC4/IZZr893oiomc9XaghoveYTrLC1F86HID8=
|
||||||
github.com/go-openapi/jsonreference v0.20.0 h1:MYlu0sBgChmCfJxxUKZ8g1cPWFOB37YSZqewK7OKeyA=
|
github.com/go-openapi/jsonreference v0.20.1/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
|
||||||
github.com/go-openapi/jsonreference v0.20.0/go.mod h1:Ag74Ico3lPc+zR+qjn4XBUmXymS4zJbYVCZmcgkasdo=
|
github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g=
|
||||||
github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
|
github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
|
||||||
github.com/go-openapi/swag v0.19.14 h1:gm3vOOXfiuw5i9p5N9xJvfjvuofpyvLA9Wr6QfK5Fng=
|
|
||||||
github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
|
|
||||||
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
|
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
|
||||||
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
|
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
|
||||||
github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
|
github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
|
||||||
@@ -69,8 +68,8 @@ github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
|
|||||||
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||||
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
|
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
|
||||||
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||||
github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 h1:yAJXTCF9TqKcTiHJAE8dj7HMvPfh66eeA2JYW7eFpSE=
|
github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec=
|
||||||
github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
||||||
github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||||
github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
|
github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
|
||||||
github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||||
@@ -87,17 +86,15 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr
|
|||||||
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
|
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
|
||||||
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
|
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
|
||||||
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
|
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
|
||||||
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
|
|
||||||
github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
|
github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
|
||||||
|
github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
|
||||||
github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
|
github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
|
||||||
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
|
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
|
||||||
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
|
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
|
||||||
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
|
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
|
||||||
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
|
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
|
||||||
github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
|
github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
|
||||||
github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
|
github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
|
||||||
github.com/mailru/easyjson v0.7.6 h1:8yTIVnZgCoiM1TgqoeTl+LfU5Jg6/xL3QhGQnimLYnA=
|
|
||||||
github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
|
|
||||||
github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
|
github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
|
||||||
github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
|
github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
|
||||||
github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
|
github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
|
||||||
@@ -111,10 +108,8 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
|
|||||||
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
|
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
|
||||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
|
||||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
|
||||||
github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
|
github.com/onsi/ginkgo/v2 v2.12.0 h1:UIVDowFPwpg6yMUpPjGkYvf06K3RAiJXUhCxEwQVHRI=
|
||||||
github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
|
github.com/onsi/ginkgo/v2 v2.12.0/go.mod h1:ZNEzXISYlqpb8S36iN71ifqLi3vVD1rVJGvWRCJOUpQ=
|
||||||
github.com/onsi/ginkgo/v2 v2.11.0 h1:WgqUCUt/lT6yXoQ8Wef0fsNn5cAuMK7+KT9UFRz2tcU=
|
|
||||||
github.com/onsi/ginkgo/v2 v2.11.0/go.mod h1:ZhrRA5XmEE3x3rhlzamx/JJvujdZoJ2uvgI7kR0iZvM=
|
|
||||||
github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI=
|
github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI=
|
||||||
github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M=
|
github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M=
|
||||||
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
|
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
|
||||||
@@ -122,7 +117,7 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
|
|||||||
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
||||||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||||
github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
|
github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
|
||||||
github.com/rogpeppe/go-internal v1.6.1 h1:/FiVV8dS/e+YqF2JvO3yXRFbBLTIuSDkuC7aBOAvL+k=
|
github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
|
||||||
github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
|
github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
|
||||||
github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
|
github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
|
||||||
github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
|
github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
|
||||||
@@ -132,10 +127,15 @@ github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155
|
|||||||
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
|
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
|
||||||
github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
|
github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
|
||||||
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||||
|
github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
|
||||||
|
github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
|
||||||
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
|
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
|
||||||
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
|
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
|
||||||
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
|
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
|
||||||
github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||||
|
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||||
|
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
|
||||||
|
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
|
||||||
github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
|
github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
|
||||||
github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
|
github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
|
||||||
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
|
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
|
||||||
@@ -152,8 +152,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
|
|||||||
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||||
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
|
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
|
||||||
golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
|
golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
|
||||||
golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA=
|
golang.org/x/crypto v0.12.0 h1:tFM/ta59kqch6LlvYnPa0yx5a83cL2nHflFhYKvv9Yk=
|
||||||
golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
|
golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
|
||||||
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||||
golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
|
golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
|
||||||
golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
|
golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
|
||||||
@@ -161,7 +161,7 @@ golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHl
|
|||||||
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||||
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||||
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
|
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
|
||||||
golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
|
golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
|
||||||
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||||
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||||
golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||||
@@ -174,8 +174,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY
|
|||||||
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
|
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
|
||||||
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
|
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
|
||||||
golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
|
golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
|
||||||
golang.org/x/net v0.12.0 h1:cfawfvKITfUsFCeJIHJrbSxpeu/E81khclypR0GVT50=
|
golang.org/x/net v0.14.0 h1:BONx9s002vGdD9umnlX1Po8vOZmrgH34qlHcD1MfK14=
|
||||||
golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
|
golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
|
||||||
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||||
golang.org/x/oauth2 v0.4.0 h1:NF0gk8LVPg1Ml7SSbGyySuoxdsXitj7TvgvuRxIMc/M=
|
golang.org/x/oauth2 v0.4.0 h1:NF0gk8LVPg1Ml7SSbGyySuoxdsXitj7TvgvuRxIMc/M=
|
||||||
golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec=
|
golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec=
|
||||||
@@ -195,20 +195,20 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
|
|||||||
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA=
|
golang.org/x/sys v0.11.0 h1:eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM=
|
||||||
golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||||
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
|
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
|
||||||
golang.org/x/term v0.10.0 h1:3R7pNqamzBraeqj/Tj8qt1aQ2HpmlC+Cx/qL/7hn4/c=
|
golang.org/x/term v0.11.0 h1:F9tnn/DA/Im8nCwm+fX+1/eBwi4qFjRT++MhtVC4ZX0=
|
||||||
golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o=
|
golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
|
||||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||||
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
|
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
|
||||||
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||||
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
|
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
|
||||||
golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
|
golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
|
||||||
golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4=
|
golang.org/x/text v0.12.0 h1:k+n5B8goJNdU7hSvEtMUz3d1Q6D/XW4COJSJR6fN0mc=
|
||||||
golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
|
golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
|
||||||
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 h1:vVKdlvoWBphwdxWKrFZEuM0kGgGLxUOYcY4U/2Vjg44=
|
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 h1:vVKdlvoWBphwdxWKrFZEuM0kGgGLxUOYcY4U/2Vjg44=
|
||||||
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||||
@@ -220,8 +220,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
|
|||||||
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
||||||
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
|
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
|
||||||
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
|
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
|
||||||
golang.org/x/tools v0.9.3 h1:Gn1I8+64MsuTb/HpH+LmQtNas23LhUVr3rYZ0eKuaMM=
|
golang.org/x/tools v0.12.0 h1:YW6HUoUmYBpwSgyaGaZq1fHjrBjX1rlpZ54T6mu2kss=
|
||||||
golang.org/x/tools v0.9.3/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc=
|
golang.org/x/tools v0.12.0/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM=
|
||||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||||
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||||
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||||
@@ -250,10 +250,9 @@ google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQ
|
|||||||
google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
|
google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
|
||||||
google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
|
google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
|
||||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||||
gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
|
||||||
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||||
gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
|
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
|
||||||
gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
|
||||||
gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
|
gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
|
||||||
gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
|
gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
|
||||||
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||||
@@ -266,26 +265,26 @@ gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C
|
|||||||
gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||||
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||||
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||||
helm.sh/helm/v3 v3.11.3 h1:n1X5yaQTP5DYywlBOZMl2gX398Gp6YwFp/IAVj6+5D4=
|
helm.sh/helm/v3 v3.12.3 h1:5y1+Sbty12t48T/t/CGNYUIME5BJ0WKfmW/sobYqkFg=
|
||||||
helm.sh/helm/v3 v3.11.3/go.mod h1:S+sOdQc3BLvt09a9rSlKKVs9x0N/yx+No0y3qFw+FQ8=
|
helm.sh/helm/v3 v3.12.3/go.mod h1:KPKQiX9IP5HX7o5YnnhViMnNuKiL/lJBVQ47GHe1R0k=
|
||||||
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||||
honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||||
k8s.io/api v0.26.2 h1:dM3cinp3PGB6asOySalOZxEG4CZ0IAdJsrYZXE/ovGQ=
|
k8s.io/api v0.27.3 h1:yR6oQXXnUEBWEWcvPWS0jQL575KoAboQPfJAuKNrw5Y=
|
||||||
k8s.io/api v0.26.2/go.mod h1:1kjMQsFE+QHPfskEcVNgL3+Hp88B80uj0QtSOlj8itU=
|
k8s.io/api v0.27.3/go.mod h1:C4BNvZnQOF7JA/0Xed2S+aUyJSfTGkGFxLXz9MnpIpg=
|
||||||
k8s.io/apiextensions-apiserver v0.26.0 h1:Gy93Xo1eg2ZIkNX/8vy5xviVSxwQulsnUdQ00nEdpDo=
|
k8s.io/apiextensions-apiserver v0.27.3 h1:xAwC1iYabi+TDfpRhxh4Eapl14Hs2OftM2DN5MpgKX4=
|
||||||
k8s.io/apiextensions-apiserver v0.26.0/go.mod h1:7ez0LTiyW5nq3vADtK6C3kMESxadD51Bh6uz3JOlqWQ=
|
k8s.io/apiextensions-apiserver v0.27.3/go.mod h1:BH3wJ5NsB9XE1w+R6SSVpKmYNyIiyIz9xAmBl8Mb+84=
|
||||||
k8s.io/apimachinery v0.26.2 h1:da1u3D5wfR5u2RpLhE/ZtZS2P7QvDgLZTi9wrNZl/tQ=
|
k8s.io/apimachinery v0.27.3 h1:Ubye8oBufD04l9QnNtW05idcOe9Z3GQN8+7PqmuVcUM=
|
||||||
k8s.io/apimachinery v0.26.2/go.mod h1:ats7nN1LExKHvJ9TmwootT00Yz05MuYqPXEXaVeOy5I=
|
k8s.io/apimachinery v0.27.3/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E=
|
||||||
k8s.io/client-go v0.26.2 h1:s1WkVujHX3kTp4Zn4yGNFK+dlDXy1bAAkIl+cFAiuYI=
|
k8s.io/client-go v0.27.3 h1:7dnEGHZEJld3lYwxvLl7WoehK6lAq7GvgjxpA3nv1E8=
|
||||||
k8s.io/client-go v0.26.2/go.mod h1:u5EjOuSyBa09yqqyY7m3abZeovO/7D/WehVVlZ2qcqU=
|
k8s.io/client-go v0.27.3/go.mod h1:2MBEKuTo6V1lbKy3z1euEGnhPfGZLKTS9tiJ2xodM48=
|
||||||
k8s.io/klog/v2 v2.90.1 h1:m4bYOKall2MmOiRaR1J+We67Do7vm9KiQVlT96lnHUw=
|
k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg=
|
||||||
k8s.io/klog/v2 v2.90.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
|
k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
|
||||||
k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+OGxg8HsuBr/5f6tVAjDu6E=
|
k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f h1:2kWPakN3i/k81b0gvD5C5FJ2kxm1WrQFanWchyKuqGg=
|
||||||
k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4=
|
k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f/go.mod h1:byini6yhqGC14c3ebc/QwanvYwhuMWF6yz2F8uwW8eg=
|
||||||
k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5 h1:kmDqav+P+/5e1i9tFfHq1qcF3sOrDp+YEkVDAHu7Jwk=
|
k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5 h1:kmDqav+P+/5e1i9tFfHq1qcF3sOrDp+YEkVDAHu7Jwk=
|
||||||
k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
|
k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
|
||||||
sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 h1:iXTIw73aPyC+oRdyqqvVJuloN1p0AC/kzH07hu3NE+k=
|
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
|
||||||
sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
|
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
|
||||||
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=
|
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=
|
||||||
sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
|
sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
|
||||||
sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
|
sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
|
||||||
|
|||||||
@@ -41,4 +41,34 @@ spire-server:
|
|||||||
Expect(notes).Should(ContainSubstring("abc123"))
|
Expect(notes).Should(ContainSubstring("abc123"))
|
||||||
})
|
})
|
||||||
})
|
})
|
||||||
|
Describe("spire-server.customPlugin.tpm", func() {
|
||||||
|
It("plugin set ok", func() {
|
||||||
|
objs, err := ValueStringRender(chart, `
|
||||||
|
spire-server:
|
||||||
|
customPlugins:
|
||||||
|
nodeAttestor:
|
||||||
|
tpm:
|
||||||
|
plugin_cmd: /bin/tpm_attestor_server
|
||||||
|
plugin_checksum: 97442358ae946e3fb8f2464432b8c23efdc0b5d44ec1eea27babe59ef646cc2f
|
||||||
|
plugin_data: {}
|
||||||
|
`)
|
||||||
|
Expect(err).Should(Succeed())
|
||||||
|
notes := objs["spire/charts/spire-server/templates/configmap.yaml"]
|
||||||
|
Expect(notes).Should(ContainSubstring("tpm"))
|
||||||
|
})
|
||||||
|
})
|
||||||
|
Describe("spire-server.unsupportedBuiltInPlugins", func() {
|
||||||
|
It("plugin set ok", func() {
|
||||||
|
objs, err := ValueStringRender(chart, `
|
||||||
|
spire-server:
|
||||||
|
unsupportedBuiltInPlugins:
|
||||||
|
nodeAttestor:
|
||||||
|
join_token:
|
||||||
|
plugin_data: {}
|
||||||
|
`)
|
||||||
|
Expect(err).Should(Succeed())
|
||||||
|
notes := objs["spire/charts/spire-server/templates/configmap.yaml"]
|
||||||
|
Expect(notes).Should(ContainSubstring("join_token"))
|
||||||
|
})
|
||||||
|
})
|
||||||
})
|
})
|
||||||
|
|||||||
Reference in New Issue
Block a user