From b813807f165adcc7aca05df0cf227d11db96b494 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 26 Oct 2023 15:13:54 -0700 Subject: [PATCH] Update docs to simplify, clarify, and prioritize ease of install/upgrade (#62) * Update docs to simplify, clarify, and prioritize ease of install/upgrade Signed-off-by: Kevin Fox * Apply suggestions from code review Co-authored-by: Marco Franssen Signed-off-by: kfox1111 * Incorperate feedback Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Marco Franssen --- README.md | 25 ++++--------- charts/spire/README.md | 80 ++++++++++++++++++++++++------------------ 2 files changed, 52 insertions(+), 53 deletions(-) diff --git a/README.md b/README.md index 5e81039..48077bd 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,7 @@ -> **Note**: All the helm charts in this repo are beta. We encourage you to try them out and contribute. The API may change as we move towards a production ready release. +> [!Note] +> Things to consider: +> 1. We do not support running out of the git main branch. This is where development happens. Please use released versions via the published repo or git tags. +> 2. All the helm charts in this repo are beta. We encourage you to try them out and contribute. The API may change as we move towards a production ready release. # SPIFFE Helm Charts @@ -8,24 +11,10 @@ A suite of [Helm Charts](https://helm.sh/docs) for standardized installations of SPIRE components in Kubernetes environments. -## Add Helm repository +## How to install or upgrade -```bash -helm repo add spiffe https://spiffe.github.io/helm-charts-hardened/ -helm repo update -``` - -## Dependencies and Version Compatibility - -Unless otherwise noted in an application chart README, the following dependencies will follow these prescribed version compatibility rules. - -| Dependency | Supported Versions | -|:-----------|:-------------------| -| SPIRE | `1.8.2` | -| Helm | `3.x` | -| Kubernetes | `1.22+` | - -> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. *The first version we tested this chart with is `1.22`.* +You most likely want to do an integrated setup based on the spire chart. +[Instructions](https://artifacthub.io/packages/helm/spiffe/spire) ## Contributing diff --git a/charts/spire/README.md b/charts/spire/README.md index e54be82..80d54f7 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -7,6 +7,51 @@ A Helm chart for deploying the complete Spire stack including: spire-server, spi **Homepage:** +## Install notes + +To do a quick non production install suitable for quick testing in something like minikube: + +```shell +helm install -n spire-server spire-crds --repo https://spiffe.github.io/helm-charts-hardened/ --create-namespace +helm install -n spire-server spire --repo https://spiffe.github.io/helm-charts-hardened/ +``` + +To customize, start with a base values file and edit as needed: + +```shell +curl -o your-values.yaml https://raw.githubusercontent.com/spiffe/helm-charts-hardened/main/examples/production/example-your-values.yaml +``` + +Then: + +```shell +helm install -n spire-server spire --repo https://spiffe.github.io/helm-charts-hardened/ -f your-values.yaml +``` + +For production installs, please see [the production example](https://github.com/spiffe/helm-charts-hardened/tree/main/examples/production). + +## Upgrade notes + +### 0.14.X + +If coming from a chart version before 0.14.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart +run the following: + +Replace the spire-server namespace in the commands below with the namespace you want to install the spire-crds chart in. + +```shell +kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" +kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" +kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" +kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" +kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" +kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" +kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" +kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" +kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" +helm install -n spire-server spire-crds charts/spire-crds +``` + ## Version support > **Note**: This Chart is still in development and still subject to change the API (`values.yaml`). @@ -15,7 +60,6 @@ A Helm chart for deploying the complete Spire stack including: spire-server, spi | Dependency | Supported Versions | |:-----------|:-------------------| -| SPIRE | `1.5.3+`, `1.6.3+` | | Helm | `3.x` | | Kubernetes | `1.22+` | @@ -83,40 +127,6 @@ Now you can interact with the Spire agent socket from your own application. The | file://./charts/spire-server | spire-server | 0.1.0 | | file://./charts/tornjak-frontend | tornjak-frontend | 0.1.0 | -## Install notes - -To do a quick non production install: - -```shell -kubectl create namespace spire-system -helm install -n spire-system spire-crds charts/spire-crds -helm install -n spire-system spire charts/spire -``` - -For production installs, please see [the production example](examples/production/). - -## Upgrade notes - -0.14.X: - -If coming from a chart version before 0.14.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart -run the following: - -```shell -# Replace the spire-server namespace in the commands below with the namespace you want to install the spire-crds chart in. - -kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" -kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" -kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" -kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" -kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" -kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" -kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" -kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" -kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" -helm install -n spire-server spire-crds charts/spire-crds -``` - ## Parameters