panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'main' into release

Browse Source
This commit is contained in:
Faisal Memon
2024-02-05 13:08:35 -08:00
parent f2f56fa055 7ad1ae7355
commit bea59729fb
27 changed files with 392 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/tests/charts.json
+4 -4
View File
@@ -2,12 +2,12 @@
{ {
"name": "kube-prometheus-stack", "name": "kube-prometheus-stack",
"repo": "https://prometheus-community.github.io/helm-charts", "repo": "https://prometheus-community.github.io/helm-charts",
"version": "56.2.1" "version": "56.6.2"
}, },
{ {
"name": "cert-manager", "name": "cert-manager",
"repo": "https://charts.jetstack.io", "repo": "https://charts.jetstack.io",
"version": "v1.13.3" "version": "v1.14.1"
}, },
{ {
"name": "ingress-nginx", "name": "ingress-nginx",
@@ -17,11 +17,11 @@
{ {
"name": "mysql", "name": "mysql",
"repo": "https://charts.bitnami.com/bitnami", "repo": "https://charts.bitnami.com/bitnami",
"version": "9.18.0" "version": "9.19.1"
}, },
{ {
"name": "postgresql", "name": "postgresql",
"repo": "https://charts.bitnami.com/bitnami", "repo": "https://charts.bitnami.com/bitnami",
"version": "13.4.3" "version": "14.0.1"
} }
] ]
.github/tests/images.json
+5
View File
@@ -12,6 +12,11 @@
"filter": "LATESTSHA", "filter": "LATESTSHA",
"sort-flags": [] "sort-flags": []
}, },
{
"query": "socketAlternate.image",
"filter": "LATESTSHA",
"sort-flags": []
},
{ {
"query": "fsGroupFix.image", "query": "fsGroupFix.image",
"filter": "LATESTSHA", "filter": "LATESTSHA",
.github/workflows/check-versions.yaml
+1 -1
View File
@@ -61,7 +61,7 @@ jobs:
- name: Create Pull Request - name: Create Pull Request
id: cpr id: cpr
uses: peter-evans/create-pull-request@v5.0.2 uses: peter-evans/create-pull-request@v6.0.0
with: with:
token: ${{ secrets.GITHUB_TOKEN }} token: ${{ secrets.GITHUB_TOKEN }}
title: Bump test chart dependencies title: Bump test chart dependencies
.github/workflows/helm-chart-ci-ignore.yaml
+16
View File
@@ -73,3 +73,19 @@ jobs:
steps: steps:
- run: 'echo "Skipping example-test"' - run: 'echo "Skipping example-test"'
upgrade-test:
runs-on: ubuntu-22.04
needs:
- build-matrix
strategy:
matrix:
k8s:
- v1.28.0
- v1.27.3
- v1.26.6
steps:
- run: 'echo "Skipping upgrade-test"'
.github/workflows/helm-release.yaml
+2 -2
View File
@@ -29,9 +29,9 @@ jobs:
git config user.email "[email protected]" git config user.email "[email protected]"
- name: Setup cosign - name: Setup cosign
uses: sigstore/cosign-installer@v3.3.0 uses: sigstore/cosign-installer@v3.4.0
with: with:
cosign-release: v2.2.2 cosign-release: v2.2.3
- name: Set up Helm - name: Set up Helm
uses: azure/[email protected] uses: azure/[email protected]
.github/workflows/update-devcontainer-image.yaml
+2 -2
View File
@@ -25,9 +25,9 @@ jobs:
- name: Checkout - name: Checkout
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- name: Install cosign - name: Install cosign
uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0 uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
with: with:
cosign-release: v2.2.2 cosign-release: v2.2.3
- name: Install regctl - name: Install regctl
uses: regclient/actions/regctl-installer@b6614f5f56245066b533343a85f4109bdc38c8cc # main uses: regclient/actions/regctl-installer@b6614f5f56245066b533343a85f4109bdc38c8cc # main
- name: Log in to GHCR - name: Log in to GHCR
charts/spire/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spire
description: > description: >
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
type: application type: application
version: 0.17.1 version: 0.17.2
appVersion: "1.8.7" appVersion: "1.8.7"
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
charts/spire/README.md
+2 -1
View File
@@ -1,6 +1,6 @@
# spire # spire
![Version: 0.17.1](https://img.shields.io/badge/Version-0.17.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.8.7](https://img.shields.io/badge/AppVersion-1.8.7-informational?style=flat-square) ![Version: 0.17.2](https://img.shields.io/badge/Version-0.17.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.8.7](https://img.shields.io/badge/AppVersion-1.8.7-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
@@ -69,6 +69,7 @@ helm upgrade --install -n spire-mgmt spire spire --repo https://spiffe.github.io
```shell ```shell
helm -n spire-mgmt uninstall spire-crds helm -n spire-mgmt uninstall spire-crds
helm -n spire-mgmt uninstall spire helm -n spire-mgmt uninstall spire
kubectl -n spire-server delete pvc -l app.kubernetes.io/instance=spire
kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeids.spire.spiffe.io clusterstaticentries.spire.spiffe.io kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeids.spire.spiffe.io clusterstaticentries.spire.spiffe.io
``` ```
charts/spire/charts/spiffe-csi-driver/README.md
+1
View File
@@ -51,6 +51,7 @@ A Helm chart to install the SPIFFE CSI driver.
| `securityContext.privileged` | Flag for specifying privileged mode | `true` | | `securityContext.privileged` | Flag for specifying privileged mode | `true` |
| `nodeSelector` | Node selector for CSI driver pods | `{}` | | `nodeSelector` | Node selector for CSI driver pods | `{}` |
| `tolerations` | Tolerations for CSI driver pods | `[]` | | `tolerations` | Tolerations for CSI driver pods | `[]` |
| `affinity` | Node affinity | `{}` |
| `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | | `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` | | `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` |
| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` |
charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
+4
View File
@@ -29,6 +29,10 @@ spec:
nodeSelector: nodeSelector:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
{{- with .Values.affinity }}
affinity:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.tolerations }} {{- with .Values.tolerations }}
tolerations: tolerations:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
charts/spire/charts/spiffe-csi-driver/values.yaml
+3
View File
@@ -96,6 +96,9 @@ nodeSelector: {}
## @param tolerations [array] Tolerations for CSI driver pods ## @param tolerations [array] Tolerations for CSI driver pods
tolerations: [] tolerations: []
## @param affinity [object] Node affinity
affinity: {}
nodeDriverRegistrar: nodeDriverRegistrar:
## @param nodeDriverRegistrar.image.registry The OCI registry to pull the image from ## @param nodeDriverRegistrar.image.registry The OCI registry to pull the image from
## @param nodeDriverRegistrar.image.repository The repository within the registry ## @param nodeDriverRegistrar.image.repository The repository within the registry
charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+2 -2
View File
@@ -115,11 +115,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:1b4e8389d2582d0b013fad55d7ad799a67bbdcbfbae0a053258ae24c8b03a19f` |
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` |
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:41c7d1fcb755339b883b0cf2998c52e77ba2e4fab9347665a54c6ef3e4d97838` | | `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9198d9e7e83ab4078df6f53dfa3e8e1e8f60d5718cc21fefa2ccb6604283e049` |
| `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` |
| `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` |
charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+2 -2
View File
@@ -328,7 +328,7 @@ tests:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f tag: latest@sha256:1b4e8389d2582d0b013fad55d7ad799a67bbdcbfbae0a053258ae24c8b03a19f
toolkit: toolkit:
## @param tests.toolkit.image.registry The OCI registry to pull the image from ## @param tests.toolkit.image.registry The OCI registry to pull the image from
@@ -340,7 +340,7 @@ tests:
registry: cgr.dev registry: cgr.dev
repository: chainguard/slim-toolkit-debug repository: chainguard/slim-toolkit-debug
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:41c7d1fcb755339b883b0cf2998c52e77ba2e4fab9347665a54c6ef3e4d97838 tag: latest@sha256:9198d9e7e83ab4078df6f53dfa3e8e1e8f60d5718cc21fefa2ccb6604283e049
step: step:
## @param tests.step.image.registry The OCI registry to pull the image from ## @param tests.step.image.registry The OCI registry to pull the image from
charts/spire/charts/spire-agent/README.md
+9 -2
View File
@@ -45,6 +45,7 @@ A Helm chart to install the SPIRE agent.
| `resources` | Resource requests and limits | `{}` | | `resources` | Resource requests and limits | `{}` |
| `nodeSelector` | Node selector | `{}` | | `nodeSelector` | Node selector | `{}` |
| `tolerations` | List of tolerations | `[]` | | `tolerations` | List of tolerations | `[]` |
| `affinity` | Node affinity | `{}` |
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | | `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
| `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` | | `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` |
| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` | | `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` |
@@ -63,12 +64,12 @@ A Helm chart to install the SPIRE agent.
| `waitForIt.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `waitForIt.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` | | `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` |
| `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e5f04633c3885d2a3a6fce512da4e03fcb064411f62642e7d2793bfafed10d59` | | `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:64ba1b49313924643dec6a03e15a1c6cfc24046cff96b0b3c0003cabbad2f60d` |
| `waitForIt.resources` | Resource requests and limits | `{}` | | `waitForIt.resources` | Resource requests and limits | `{}` |
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f` | | `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:1b4e8389d2582d0b013fad55d7ad799a67bbdcbfbae0a053258ae24c8b03a19f` |
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` | | `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` |
@@ -88,6 +89,12 @@ A Helm chart to install the SPIRE agent.
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | | `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
| `kubeletConnectByHostname` | If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` | | `kubeletConnectByHostname` | If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | | `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` |
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` |
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:07d2662ef699e9ceafab3f39624083193dfcb7b768ee86860dbdd5cb4473dcea` |
| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
charts/spire/charts/spire-agent/templates/_helpers.tpl
+8
View File
@@ -125,3 +125,11 @@ Create the name of the service account to use
{{- printf "false" }} {{- printf "false" }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- define "spire-agent.socket-alternate-names" -}}
{{- $sockName := .Values.socketPath | base }}
{{- $l := deepCopy .Values.socketAlternate.names }}
{{- $l = without $l $sockName }}
names:
{{ $l | toYaml }}
{{- end }}
charts/spire/charts/spire-agent/templates/configmap.yaml
+1 -1
View File
@@ -24,7 +24,7 @@ agent:
log_level: {{ .Values.logLevel | quote }} log_level: {{ .Values.logLevel | quote }}
server_address: {{ include "spire-agent.server-address" . | trim | quote }} server_address: {{ include "spire-agent.server-address" . | trim | quote }}
server_port: {{ .Values.server.port | quote }} server_port: {{ .Values.server.port | quote }}
socket_path: {{ include "spire-agent.socket-path" . | quote }} socket_path: /tmp/spire-agent/public/{{ include "spire-agent.socket-path" . | base }}
{{- if ne (len .Values.trustBundleURL) 0 }} {{- if ne (len .Values.trustBundleURL) 0 }}
trust_bundle_url: {{ .Values.trustBundleURL | quote }} trust_bundle_url: {{ .Values.trustBundleURL | quote }}
trust_bundle_format: {{ .Values.trustBundleFormat | quote }} trust_bundle_format: {{ .Values.trustBundleFormat | quote }}
charts/spire/charts/spire-agent/templates/daemonset.yaml
+37 -6
View File
@@ -1,6 +1,8 @@
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }} {{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
{{- $podSecurityContext := fromYaml (include "spire-lib.podsecuritycontext" .) }} {{- $podSecurityContext := fromYaml (include "spire-lib.podsecuritycontext" .) }}
{{- $cbh := eq (include "spire-agent.connect-by-hostname" .) "true" }} {{- $cbh := eq (include "spire-agent.connect-by-hostname" .) "true" }}
{{- $socketAlternateNames := index (include "spire-agent.socket-alternate-names" . | fromYaml) "names" }}
{{- $socketPath := include "spire-agent.socket-path" . }}
apiVersion: apps/v1 apiVersion: apps/v1
kind: DaemonSet kind: DaemonSet
metadata: metadata:
@@ -50,18 +52,43 @@ spec:
{{- toYaml .Values.waitForIt.resources | nindent 12 }} {{- toYaml .Values.waitForIt.resources | nindent 12 }}
securityContext: securityContext:
{{ toYaml .Values.securityContext | nindent 12 }} {{ toYaml .Values.securityContext | nindent 12 }}
{{- if gt (len $socketAlternateNames) 0 }}
- name: ensure-alternate-names
image: {{ template "spire-lib.image" (dict "image" .Values.socketAlternate.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.socketAlternate.image.pullPolicy }}
command: ["bash", "-xc"]
{{/* 1. Look for symlinks pointing at the wrong place and remove them. 2. Make symlinks that don't exist. 3. If new socket is pointing at an existing symlink, remove old symlink. */}}
args:
- |
cd {{ $socketPath | dir }}
{{- range $socketAlternateNames }}
L=`readlink {{ . }}`
[ "x$L" != "x{{ $socketPath | base}}" ] && rm -f {{ . }}
[ ! -L {{ . }} ] && ln -s {{ $socketPath | base }} {{ . }}
{{- end }}
[ -L {{ $socketPath | base }} ] && rm -f {{ $socketPath | base }}
exit 0
resources:
{{- toYaml .Values.socketAlternate.resources | nindent 12 }}
volumeMounts:
- name: spire-agent-socket-dir
mountPath: {{ $socketPath | dir }}
securityContext:
runAsUser: 0
runAsGroup: 0
{{- end }}
{{- if gt (int (dig "fsGroup" 0 $podSecurityContext)) 0 }} {{- if gt (int (dig "fsGroup" 0 $podSecurityContext)) 0 }}
- name: fsgroupfix - name: fsgroupfix
image: {{ template "spire-lib.image" (dict "image" .Values.fsGroupFix.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.fsGroupFix.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy }} imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy }}
command: ["bash", "-c"] command: ["bash", "-c"]
args: args:
- "chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ include "spire-agent.socket-path" . | dir }}" - "chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ $socketPath | dir }}"
resources: resources:
{{- toYaml .Values.fsGroupFix.resources | nindent 12 }} {{- toYaml .Values.fsGroupFix.resources | nindent 12 }}
volumeMounts: volumeMounts:
- name: spire-agent-socket-dir - name: spire-agent-socket-dir
mountPath: {{ include "spire-agent.socket-path" . | dir }} mountPath: {{ $socketPath | dir }}
securityContext: securityContext:
runAsUser: 0 runAsUser: 0
runAsGroup: 0 runAsGroup: 0
@@ -73,7 +100,7 @@ spec:
- name: {{ .Chart.Name }} - name: {{ .Chart.Name }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.image.pullPolicy }} imagePullPolicy: {{ .Values.image.pullPolicy }}
args: ["-config", "/run/spire/config/agent.conf"] args: ["-config", "/opt/spire/conf/agent/agent.conf"]
securityContext: securityContext:
{{ toYaml .Values.securityContext | nindent 12 }} {{ toYaml .Values.securityContext | nindent 12 }}
env: env:
@@ -97,7 +124,7 @@ spec:
{{- end }} {{- end }}
volumeMounts: volumeMounts:
- name: spire-config - name: spire-config
mountPath: /run/spire/config mountPath: /opt/spire/conf/agent
readOnly: true readOnly: true
{{- if eq (len .Values.trustBundleURL) 0 }} {{- if eq (len .Values.trustBundleURL) 0 }}
- name: spire-bundle - name: spire-bundle
@@ -105,7 +132,7 @@ spec:
readOnly: true readOnly: true
{{- end }} {{- end }}
- name: spire-agent-socket-dir - name: spire-agent-socket-dir
mountPath: {{ include "spire-agent.socket-path" . | dir }} mountPath: /tmp/spire-agent/public
readOnly: false readOnly: false
- name: spire-token - name: spire-token
mountPath: /var/run/secrets/tokens mountPath: /var/run/secrets/tokens
@@ -131,6 +158,10 @@ spec:
nodeSelector: nodeSelector:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
{{- with .Values.affinity }}
affinity:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.tolerations }} {{- with .Values.tolerations }}
tolerations: tolerations:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
@@ -153,7 +184,7 @@ spec:
audience: spire-server audience: spire-server
- name: spire-agent-socket-dir - name: spire-agent-socket-dir
hostPath: hostPath:
path: {{ include "spire-agent.socket-path" . | dir }} path: {{ $socketPath | dir }}
type: DirectoryOrCreate type: DirectoryOrCreate
{{- if gt (len .Values.extraVolumes) 0 }} {{- if gt (len .Values.extraVolumes) 0 }}
{{- toYaml .Values.extraVolumes | nindent 8 }} {{- toYaml .Values.extraVolumes | nindent 8 }}
charts/spire/charts/spire-agent/values.yaml
+26 -2
View File
@@ -77,6 +77,9 @@ nodeSelector: {}
## @param tolerations [array] List of tolerations ## @param tolerations [array] List of tolerations
tolerations: [] tolerations: []
## @param affinity [object] Node affinity
affinity: {}
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error" ## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
logLevel: info logLevel: info
## @param clusterName The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) ## @param clusterName The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)
@@ -132,7 +135,7 @@ waitForIt:
registry: cgr.dev registry: cgr.dev
repository: chainguard/wait-for-it repository: chainguard/wait-for-it
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:e5f04633c3885d2a3a6fce512da4e03fcb064411f62642e7d2793bfafed10d59 tag: latest@sha256:64ba1b49313924643dec6a03e15a1c6cfc24046cff96b0b3c0003cabbad2f60d
## @param waitForIt.resources [object] Resource requests and limits ## @param waitForIt.resources [object] Resource requests and limits
resources: {} resources: {}
@@ -149,7 +152,7 @@ fsGroupFix:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: Always pullPolicy: Always
tag: latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f tag: latest@sha256:1b4e8389d2582d0b013fad55d7ad799a67bbdcbfbae0a053258ae24c8b03a19f
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {} resources: {}
@@ -210,6 +213,27 @@ kubeletConnectByHostname: ""
## @param socketPath The unix socket path to the spire-agent ## @param socketPath The unix socket path to the spire-agent
socketPath: /run/spire/agent-sockets/spire-agent.sock socketPath: /run/spire/agent-sockets/spire-agent.sock
socketAlternate:
## @param socketAlternate.names List of alternate names for the socket that workloads might expect to be able to access in the driver mount.
names:
- socket
- spire-agent.sock
- api.sock
## @param socketAlternate.image.registry The OCI registry to pull the image from
## @param socketAlternate.image.repository The repository within the registry
## @param socketAlternate.image.pullPolicy The image pull policy
## @param socketAlternate.image.tag Overrides the image tag whose default is the chart appVersion
##
image:
registry: cgr.dev
repository: chainguard/bash
pullPolicy: Always
tag: latest@sha256:07d2662ef699e9ceafab3f39624083193dfcb7b768ee86860dbdd5cb4473dcea
## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {}
## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.
priorityClassName: "" priorityClassName: ""
charts/spire/charts/spire-server/README.md
+1 -1
View File
@@ -340,4 +340,4 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:1b4e8389d2582d0b013fad55d7ad799a67bbdcbfbae0a053258ae24c8b03a19f` |
charts/spire/charts/spire-server/values.yaml
+1 -1
View File
@@ -843,4 +843,4 @@ tests:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f tag: latest@sha256:1b4e8389d2582d0b013fad55d7ad799a67bbdcbfbae0a053258ae24c8b03a19f
charts/spire/charts/tornjak-frontend/README.md
+1 -1
View File
@@ -98,4 +98,4 @@ port forwarding. See the chart NOTES output for more details.
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:1b4e8389d2582d0b013fad55d7ad799a67bbdcbfbae0a053258ae24c8b03a19f` |
charts/spire/charts/tornjak-frontend/values.yaml
+1 -1
View File
@@ -154,4 +154,4 @@ tests:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f tag: latest@sha256:1b4e8389d2582d0b013fad55d7ad799a67bbdcbfbae0a053258ae24c8b03a19f
examples/mysql-using-spire/README.md
+21
View File
@@ -0,0 +1,21 @@
```
helm upgrade --install -n spire-server spire-crds spire-crds --repo https://spiffe.github.io/helm-charts-hardened/ --create-namespace --version 0.3.0
helm upgrade --install -n spire-server spire spire --repo https://spiffe.github.io/helm-charts-hardened/ --version 0.17.1 -f spire-values.yaml
kubectl apply -f mysqlclient-configmap.yaml
kubectl apply -f mysqlclient-statefulset.yaml
kubectl wait pod mysqlclient-0 --for=condition=ready --timeout=60s
# Run, and get the x500UniqueIdentifier value:
kubectl exec -it mysqlclient-0 -c main -- bash -c 'openssl x509 -in /certs/tls.crt -noout -text | grep Subject:'
# Edit mysql-values.yaml and update the x509UniqueIdentifer
vim mysql-values.yaml
helm upgrade --install -f mysql-values.yaml mysql mysql --version 9.15.0 --repo https://charts.bitnami.com/bitnami
kubectl wait pod mysql-0 --for=condition=ready --timeout=60s
kubectl exec -it mysqlclient-0 -- bash -c 'mysql -u mysqlclient --protocol tcp --ssl-key /certs/tls.key --ssl-cert /certs/tls.crt --ssl-ca /certs/ca.pem -h mysql.default.svc.cluster.local'
```
examples/mysql-using-spire/mysql-values.yaml
+122
View File
@@ -0,0 +1,122 @@
initdbScripts:
usertls.sql: |
CREATE USER 'mysqlclient'@'%' REQUIRE SUBJECT '/C=US/O=SPIRE/CN=mysqlclient.default.svc.cluster.local/x500UniqueIdentifier=a753b06724b81d4a2f14f615d40550ed';
GRANT ALL PRIVILEGES ON *.* TO 'mysqlclient'@'%' WITH GRANT OPTION;
primary:
extraFlags: "--ssl-ca=/certs/ca.pem --ssl-cert=/certs/tls.crt --ssl-key=/certs/tls.key --require-secure-transport=ON"
initContainers: |
- name: setup-helper-volume-p1
image: busybox:1.36.1-uclibc
imagePullPolicy: IfNotPresent
command:
- sh
- -c
- 'cp -a /bin/busybox /helper'
securityContext: {{- omit .Values.primary.containerSecurityContext "enabled" | toYaml | nindent 8 }}
volumeMounts:
- name: spiffe-helper
mountPath: /helper
- name: setup-helper-volume-p2
image: ghcr.io/spiffe/spiffe-helper:nightly@sha256:8cee346ffdcee5c996d394f1c3bb761c2c06834a0e779a78db6dc6a46fd13ae6
imagePullPolicy: IfNotPresent
command:
- /helper/busybox
- sh
- -c
- '/helper/busybox cp -a /spiffe-helper /helper && /helper/busybox rm -f /helper/busybox'
securityContext: {{- omit .Values.primary.containerSecurityContext "enabled" | toYaml | nindent 8 }}
volumeMounts:
- name: spiffe-helper
mountPath: /helper
- name: init-tls
image: ghcr.io/spiffe/spiffe-helper:nightly@sha256:8cee346ffdcee5c996d394f1c3bb761c2c06834a0e779a78db6dc6a46fd13ae6
imagePullPolicy: Always
command:
- /spiffe-helper
- -config
- /etc/spiffe-helper.conf
- -exitWhenReady
securityContext: {{- omit .Values.primary.containerSecurityContext "enabled" | toYaml | nindent 8 }}
volumeMounts:
- name: spiffe-workload-api
mountPath: /spiffe-workload-api
readOnly: true
- name: spiffe-helper-configmap
mountPath: /etc/spiffe-helper.conf
subPath: spiffe-helper.conf
readOnly: true
- name: certdir
mountPath: /certs
sidecars: |
- name: refresh-tls
image: {{ include "mysql.image" . }}
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
command:
- /helper/spiffe-helper
- -config
- /etc/spiffe-helper.conf
env:
- name: MYSQL_PWD
valueFrom:
secretKeyRef:
name: {{ template "mysql.secretName" . }}
key: mysql-root-password
securityContext: {{- omit .Values.primary.containerSecurityContext "enabled" | toYaml | nindent 8 }}
volumeMounts:
- name: spiffe-workload-api
mountPath: /spiffe-workload-api
readOnly: true
- name: spiffe-helper-configmap
mountPath: /etc/spiffe-helper.conf
subPath: spiffe-helper.conf
readOnly: true
- name: certdir
mountPath: /certs
- name: spiffe-helper
mountPath: /helper
- name: mysql-sockdir
mountPath: /opt/bitnami/mysql/tmp
extraVolumeMounts:
- name: certdir
mountPath: /certs
- name: mysql-sockdir
mountPath: /opt/bitnami/mysql/tmp
extraVolumes: |
- name: certdir
emptyDir: {}
- name: spiffe-helper
emptyDir: {}
- name: mysql-sockdir
emptyDir: {}
- name: spiffe-helper-configmap
configMap:
name: {{ include "mysql.primary.fullname" . }}-spiffe-helper
- name: spiffe-workload-api
csi:
driver: "csi.spiffe.io"
readOnly: true
extraDeploy:
- |
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "mysql.primary.fullname" . }}-spiffe-helper
namespace: {{ include "common.names.namespace" . | quote }}
data:
spiffe-helper.conf: |
agent_address = "/spiffe-workload-api/spire-agent.sock"
cmd = "/opt/bitnami/mysql/bin/mysql"
cmd_args = "-uroot -e \"ALTER INSTANCE RELOAD TLS;\""
renew_signal = ""
cert_dir = "/certs"
renew_signal = ""
svid_file_name = "tls.crt"
svid_key_file_name = "tls.key"
svid_bundle_file_name = "ca.pem"
add_intermediates_to_bundle = true
examples/mysql-using-spire/mysqlclient-configmap.yaml
+15
View File
@@ -0,0 +1,15 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: mysqlclient
data:
spiffe-helper.conf: |
agent_address = "/spiffe-workload-api/spire-agent.sock"
cmd = ""
cmd_args = ""
cert_dir = "/certs"
renew_signal = ""
svid_file_name = "tls.crt"
svid_key_file_name = "tls.key"
svid_bundle_file_name = "ca.pem"
add_intermediates_to_bundle = true
examples/mysql-using-spire/mysqlclient-statefulset.yaml
+78
View File
@@ -0,0 +1,78 @@
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: mysqlclient
spec:
replicas: 1
#serviceName: mysqlclient
selector:
matchLabels:
app.kubernetes.io/instance: mysqlclient
template:
metadata:
labels:
app.kubernetes.io/instance: mysqlclient
spec:
terminationGracePeriodSeconds: 0
initContainers:
- name: init-tls
image: ghcr.io/spiffe/spiffe-helper:nightly@sha256:8cee346ffdcee5c996d394f1c3bb761c2c06834a0e779a78db6dc6a46fd13ae6
imagePullPolicy: Always
command:
- /spiffe-helper
- -config
- /etc/spiffe-helper.conf
- -exitWhenReady
securityContext:
runAsUser: 1001
runAsGroup: 1001
volumeMounts:
- name: spiffe-workload-api
mountPath: /spiffe-workload-api
readOnly: true
- name: spiffe-helper-configmap
mountPath: /etc/spiffe-helper.conf
subPath: spiffe-helper.conf
readOnly: true
- name: certdir
mountPath: /certs
containers:
- name: main
image: docker.io/bitnami/mysql:8.0.35-debian-11-r0
command: [sleep, inf]
securityContext:
runAsUser: 1001
runAsGroup: 1001
volumeMounts:
- name: certdir
mountPath: /certs
- name: refresh-tls
image: ghcr.io/spiffe/spiffe-helper:nightly@sha256:8cee346ffdcee5c996d394f1c3bb761c2c06834a0e779a78db6dc6a46fd13ae6
imagePullPolicy: Always
command:
- /spiffe-helper
- -config
- /etc/spiffe-helper.conf
securityContext:
runAsUser: 1001
runAsGroup: 1001
volumeMounts:
- name: spiffe-workload-api
mountPath: /spiffe-workload-api
readOnly: true
- name: spiffe-helper-configmap
mountPath: /etc/spiffe-helper.conf
subPath: spiffe-helper.conf
readOnly: true
- name: certdir
mountPath: /certs
volumes:
- name: certdir
emptyDir: {}
- name: spiffe-helper-configmap
configMap:
name: mysqlclient
- name: spiffe-workload-api
csi:
driver: "csi.spiffe.io"
readOnly: true
examples/mysql-using-spire/spire-values.yaml
+26
View File
@@ -0,0 +1,26 @@
spire-server:
controllerManager:
identities:
clusterSPIFFEIDs:
default:
enabled: false
mysql:
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: default
podSelector:
matchLabels:
app.kubernetes.io/instance: mysql
dnsNameTemplates:
- mysql.default.svc.cluster.local
mysqlclient:
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: default
podSelector:
matchLabels:
app.kubernetes.io/instance: mysqlclient
dnsNameTemplates:
- mysqlclient.default.svc.cluster.local