Update to SPIRE 1.10.0 (#393)
* Update to SPIRE 1.10.0 Remove the options that were removed in 1.10, and update. Signed-off-by: Kevin Fox <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> * Fix uid mismatch issue on 1.10.0+ Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -4,7 +4,7 @@ description: >
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
type: application
|
||||
version: 0.21.0
|
||||
appVersion: "1.9.6"
|
||||
appVersion: "1.10.0"
|
||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# spire
|
||||
|
||||
  
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
|
||||
@@ -4,7 +4,7 @@ description: >
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
type: application
|
||||
version: 0.21.0
|
||||
appVersion: "1.9.6"
|
||||
appVersion: "1.10.0"
|
||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# spire
|
||||
|
||||
  
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider
|
||||
description: A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.9.6"
|
||||
appVersion: "1.10.0"
|
||||
keywords: ["spiffe", "oidc"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -99,3 +99,17 @@ Create the name of the service account to use
|
||||
{{- false }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spiffe-oidc-discovery-provider.podSecurityContext" -}}
|
||||
{{- $podSecurityContext := include "spire-lib.podsecuritycontext" . | fromYaml }}
|
||||
{{- $openshift := ((.Values).global).openshift | default false }}
|
||||
{{- if and .Values.tls.spire.enabled (not $openshift) }}
|
||||
{{- if not (hasKey $podSecurityContext "runAsUser") }}
|
||||
{{- $_ := set $podSecurityContext "runAsUser" 1000 }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey $podSecurityContext "runAsGroup") }}
|
||||
{{- $_ := set $podSecurityContext "runAsGroup" 1000 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- toYaml $podSecurityContext }}
|
||||
{{- end }}
|
||||
|
||||
@@ -37,7 +37,7 @@ spec:
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}
|
||||
securityContext:
|
||||
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
|
||||
{{- include "spiffe-oidc-discovery-provider.podSecurityContext" . | nindent 8 }}
|
||||
initContainers:
|
||||
{{- if .Values.tls.spire.enabled }}
|
||||
- name: init
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire-agent
|
||||
description: A Helm chart to install the SPIRE agent.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.9.6"
|
||||
appVersion: "1.10.0"
|
||||
keywords: ["spiffe", "spire-agent"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -55,7 +55,6 @@ A Helm chart to install the SPIRE agent.
|
||||
| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `pem` |
|
||||
| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` |
|
||||
| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` |
|
||||
| `disableReattestToRenew` | Deprecated: Allow agent to renew certificate when it expires rather than reattest | `false` |
|
||||
| `server.address` | Address for Spire server | `""` |
|
||||
| `server.port` | Port number for Spire server | `443` |
|
||||
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
||||
|
||||
@@ -25,9 +25,6 @@
|
||||
{{- end }}
|
||||
{{- define "spire-agent.yaml-config" -}}
|
||||
agent:
|
||||
{{- if .Values.disableReattestToRenew }}
|
||||
disable_reattest_to_renew: true
|
||||
{{- end }}
|
||||
{{- if .Values.sockets.admin.enabled }}
|
||||
admin_socket_dir: /tmp/spire-agent/private/admin.sock
|
||||
{{- end }}
|
||||
|
||||
@@ -100,9 +100,6 @@ bundleConfigMap: spire-bundle
|
||||
## @param availabilityTarget The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h.
|
||||
availabilityTarget: ""
|
||||
|
||||
## @param disableReattestToRenew Deprecated: Allow agent to renew certificate when it expires rather than reattest
|
||||
disableReattestToRenew: false
|
||||
|
||||
## @skip upstream
|
||||
upstream: false
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire-server
|
||||
description: A Helm chart to install the SPIRE server.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.9.6"
|
||||
appVersion: "1.10.0"
|
||||
keywords: ["spiffe", "spire-server", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -200,8 +200,6 @@ plugins:
|
||||
key_identifier_file: "/run/spire/data/aws-kms-key-identifier"
|
||||
{{- else if eq (.keyIdentifierValue.enabled | toString) "true" }}
|
||||
key_identifier_value: {{ .keyIdentifierValue.identifier | quote }}
|
||||
{{- else }}
|
||||
key_metadata_file: "/run/spire/data/aws-kms-key-metadata"
|
||||
{{- end }}
|
||||
{{- if ne .accessKeyID "" }}
|
||||
access_key_id: "${AWS_KMS_ACCESS_KEY_ID}"
|
||||
|
||||
Reference in New Issue
Block a user