Merge branch 'main' into release
This commit is contained in:
Faisal Memon
@@ -2,7 +2,7 @@
|
||||
{
|
||||
"name": "kube-prometheus-stack",
|
||||
"repo": "https://prometheus-community.github.io/helm-charts",
|
||||
"version": "65.5.0"
|
||||
"version": "66.1.0"
|
||||
},
|
||||
{
|
||||
"name": "cert-manager",
|
||||
@@ -17,11 +17,11 @@
|
||||
{
|
||||
"name": "mysql",
|
||||
"repo": "https://charts.bitnami.com/bitnami",
|
||||
"version": "11.1.19"
|
||||
"version": "11.1.20"
|
||||
},
|
||||
{
|
||||
"name": "postgresql",
|
||||
"repo": "https://charts.bitnami.com/bitnami",
|
||||
"version": "16.0.6"
|
||||
"version": "16.1.2"
|
||||
}
|
||||
]
|
||||
|
||||
@@ -82,6 +82,16 @@ while true; do
|
||||
done
|
||||
)
|
||||
|
||||
common_test_file_exists () (
|
||||
count=20
|
||||
while true; do
|
||||
if [ -f "$1" ]; then exit 0; fi
|
||||
sleep 2
|
||||
count=$((count-1))
|
||||
[ $count -le 0 ] && exit 1
|
||||
done
|
||||
)
|
||||
|
||||
# Used just for testing. You should provide your own values as described in the install instructions.
|
||||
common_test_your_values () {
|
||||
cat > /tmp/$$.example-your-values.yaml <<EOF
|
||||
|
||||
@@ -171,7 +171,7 @@ jobs:
|
||||
- name: Run chart-testing (install)
|
||||
run: |
|
||||
helm install -n spire-server spire-crds charts/spire-crds
|
||||
ct install --config ct.yaml --excluded-charts spire-crds \
|
||||
ct install --config ct.yaml --excluded-charts spire-crds,spiffe-step-ssh \
|
||||
--target-branch ${{ github.base_ref }}
|
||||
|
||||
- name: Test summary
|
||||
|
||||
@@ -0,0 +1,42 @@
|
||||
apiVersion: v2
|
||||
name: spiffe-step-ssh
|
||||
description: sshd signed host certificates using SPIFFE for trust and step CA
|
||||
|
||||
# A chart can be either an 'application' or a 'library' chart.
|
||||
#
|
||||
# Application charts are a collection of templates that can be packaged into versioned archives
|
||||
# to be deployed.
|
||||
#
|
||||
# Library charts provide useful utilities or functions for the chart developer. They're included as
|
||||
# a dependency of application charts to inject those utilities and functions into the rendering
|
||||
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
|
||||
type: application
|
||||
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 0.1.0
|
||||
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application. Versions are not expected to
|
||||
# follow Semantic Versioning. They should reflect the version the application is using.
|
||||
# It is recommended to use it with quotes.
|
||||
appVersion: "1.16.0"
|
||||
|
||||
keywords: ["spiffe", "step", "step-ca", "ssh"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spiffe-step-ssh
|
||||
sources:
|
||||
- https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spiffe-step-ssh
|
||||
icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
|
||||
maintainers:
|
||||
- name: kfox1111
|
||||
email: [email protected]
|
||||
|
||||
dependencies:
|
||||
- name: spire-lib
|
||||
repository: file://../spire/charts/spire-lib
|
||||
version: 0.1.0
|
||||
- name: step-certificates
|
||||
alias: step
|
||||
repository: https://smallstep.github.io/helm-charts/
|
||||
version: 1.27.4
|
||||
@@ -0,0 +1,65 @@
|
||||
spire-values.yaml
|
||||
```
|
||||
spire-server:
|
||||
nodeAttestor:
|
||||
httpChallenge:
|
||||
enabled: true
|
||||
controllerManager:
|
||||
identities:
|
||||
clusterSPIFFEIDs:
|
||||
spiffe-step-ssh-config:
|
||||
type: raw
|
||||
namespaceSelector:
|
||||
matchLabels:
|
||||
"kubernetes.io/metadata.name": default
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: spiffe-step-ssh
|
||||
component: config
|
||||
spiffe-step-ssh-fetchca:
|
||||
type: raw
|
||||
namespaceSelector:
|
||||
matchLabels:
|
||||
"kubernetes.io/metadata.name": default
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: spiffe-step-ssh
|
||||
component: fetchca
|
||||
dnsNameTemplates:
|
||||
- "spiffe-step-ssh-fetchca.{{ .TrustDomain }}"
|
||||
```
|
||||
|
||||
```shell
|
||||
helm upgrade --install -n spire-server spire-crds spire-crds --repo https://spiffe.github.io/helm-charts-hardened/ --create-namespace
|
||||
helm upgrade --install -n spire-server spire spire --repo https://spiffe.github.io/helm-charts-hardened/ -f spire-values.yaml --set global.spire.ingressControllerType=ingress-nginx,spire-server.ingress.enabled=true
|
||||
```
|
||||
|
||||
```shell
|
||||
helm upgrade --install ingress-nginx ingress-nginx -n ingress-nginx --create-namespace --repo https://kubernetes.github.io/ingress-nginx --set controller.service.type=ClusterIP,controller.service.externalIPs[0]=$(minikube ip) --set controller.watchIngressWithoutClass=true --set controller.extraArgs.enable-ssl-passthrough=
|
||||
```
|
||||
|
||||
```shell
|
||||
PASSWORD=$(openssl rand -base64 48)
|
||||
echo "$PASSWORD" > spiffe-step-ssh-password.txt
|
||||
step ca init --helm --deployment-type=Standalone --name='My CA' --dns spiffe-step-ssh.example.org --ssh --address :8443 --provisioner default --password-file spiffe-step-ssh-password.txt > spiffe-step-ssh-values.yaml
|
||||
```
|
||||
|
||||
ingress-values.yaml
|
||||
```yaml
|
||||
global:
|
||||
spiffe:
|
||||
ingressControllerType: ingress-nginx
|
||||
stepIngress:
|
||||
enabled: true
|
||||
fetchCA:
|
||||
ingress:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
```shell
|
||||
helm upgrade --install spiffe-step-ssh . --set caPassword=`cat spiffe-step-ssh-password.txt` -f spiffe-step-ssh-values.yaml -f ingress-values.yaml --set trustDomain=example.org
|
||||
```
|
||||
|
||||
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||
|
||||
## Parameters
|
||||
@@ -0,0 +1 @@
|
||||
trustDomain: example.org
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if eq (len .AuthorizationCrt.URIs) 1 }}
|
||||
{{- $san := printf "%s" (index .AuthorizationCrt.URIs 0) }}
|
||||
{{- if hasPrefix "spiffe://@TRUST_DOMAIN@/@PREFIX@/" $san }}
|
||||
{{- $name := trimPrefix "spiffe://@TRUST_DOMAIN@/@PREFIX@/" $san }}
|
||||
{
|
||||
"type": {{ toJson .Type }},
|
||||
"keyId": {{ toJson $name }},
|
||||
"principals": [{{ toJson $name }}],
|
||||
"extensions": {{ toJson .Extensions }},
|
||||
"criticalOptions": {{ toJson .CriticalOptions }}
|
||||
}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,5 @@
|
||||
Installed {{ .Chart.Name }}…
|
||||
|
||||
Configure your ssh clients with known_hosts file with:
|
||||
|
||||
@cert-authority *.{{ .Values.trustDomain }} {{ .Values.inject.certificates.ssh_host_ca }}
|
||||
@@ -0,0 +1,83 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.labels" -}}
|
||||
helm.sh/chart: {{ include "spiffe-step-ssh.chart" . }}
|
||||
{{ include "spiffe-step-ssh.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "spiffe-step-ssh.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "spiffe-step-ssh.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* Takes in a dictionary with keys:
|
||||
* global - the standard global object
|
||||
* ingress - a standard format ingress config object
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.ingress-controller-type" }}
|
||||
{{- $type := "" }}
|
||||
{{- if ne (len (dig "spiffe" "ingressControllerType" "" .global)) 0 }}
|
||||
{{- $type = .global.spiffe.ingressControllerType }}
|
||||
{{- else if ne .ingress.controllerType "" }}
|
||||
{{- $type = .ingress.controllerType }}
|
||||
{{- else if (dig "openshift" false .global) }}
|
||||
{{- $type = "openshift" }}
|
||||
{{- else }}
|
||||
{{- $type = "other" }}
|
||||
{{- end }}
|
||||
{{- if not (has $type (list "ingress-nginx" "openshift" "other")) }}
|
||||
{{- fail "Unsupported ingress controller type specified. Must be one of [ingress-nginx, openshift, other]" }}
|
||||
{{- end }}
|
||||
{{- $type }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,25 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-config-deployment
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
spiffe-helper.conf: |
|
||||
agent_address = "/spiffe-workload-api/spire-agent.sock"
|
||||
cmd = "sh"
|
||||
cmd_args = "/config-deployment/update.sh"
|
||||
cert_dir = "/certs"
|
||||
svid_file_name = "tls.crt"
|
||||
svid_key_file_name = "tls.key"
|
||||
svid_bundle_file_name = "ca.pem"
|
||||
add_intermediates_to_bundle = false
|
||||
update.sh: |
|
||||
#!/bin/sh
|
||||
export ROOTS=$(base64 /certs/ca.pem | tr '\n' ' ' | sed 's/ //g')
|
||||
echo Updating Roots to "$ROOTS"
|
||||
cat /config/ca.json > /work/ca.json
|
||||
yq e -i -ojson '.authority.provisioners |= map(select(.name == "x5c@spiffe").roots = env(ROOTS))' /work/ca.json
|
||||
/helper/kubectl create configmap {{ include "spiffe-step-ssh.fullname" . }}-config -n "{{ .Release.Namespace }}" --from-file=/work/ca.json --from-file=/config/defaults.json --from-file=/config/ssh_x5c.tpl --dry-run=client -o yaml | /helper/kubectl apply -f -
|
||||
/helper/kubectl rollout restart statefulset {{ include "spiffe-step-ssh.fullname" . }} -n "{{ .Release.Namespace }}"
|
||||
echo $?
|
||||
@@ -0,0 +1,143 @@
|
||||
{{- $configSum := (include (print $.Template.BasePath "/config-configmap.yaml") . | sha256sum) }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-config
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
app: spiffe-step-ssh
|
||||
component: config
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spiffe-step-ssh.selectorLabels" . | nindent 6 }}
|
||||
app: spiffe-step-ssh
|
||||
component: config
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ $configSum }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 8 }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
app: spiffe-step-ssh
|
||||
component: config
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "spiffe-step-ssh.serviceAccountName" . }}-svc-config
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
initContainers:
|
||||
- name: setup-volume-p1
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.busybox.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.busybox.image.pullPolicy }}
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- 'cp -a /bin/busybox /helper'
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spiffe-helper
|
||||
mountPath: /helper
|
||||
resources:
|
||||
{{- toYaml .Values.config.resources | nindent 12 }}
|
||||
- name: setup-volume-p2
|
||||
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
|
||||
imagePullPolicy: {{ .Values.kubectl.image.pullPolicy }}
|
||||
command:
|
||||
- /helper/busybox
|
||||
- sh
|
||||
- -c
|
||||
- '/helper/busybox cp -a /bin/kubectl /helper'
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spiffe-helper
|
||||
mountPath: /helper
|
||||
resources:
|
||||
{{- toYaml .Values.config.resources | nindent 12 }}
|
||||
- name: setup-volume-p3
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.spiffeHelper.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.spiffeHelper.image.pullPolicy }}
|
||||
command:
|
||||
- /helper/busybox
|
||||
- sh
|
||||
- -c
|
||||
- '/helper/busybox cp -a /spiffe-helper /helper && /helper/busybox rm -f /helper/busybox'
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spiffe-helper
|
||||
mountPath: /helper
|
||||
resources:
|
||||
{{- toYaml .Values.config.resources | nindent 12 }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.yq.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.yq.image.pullPolicy }}
|
||||
command:
|
||||
- /helper/spiffe-helper
|
||||
- -config
|
||||
- /config-deployment/spiffe-helper.conf
|
||||
resources:
|
||||
{{- toYaml .Values.config.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spiffe-helper
|
||||
mountPath: /helper
|
||||
readOnly: true
|
||||
- name: config
|
||||
mountPath: /config
|
||||
readOnly: true
|
||||
- name: config-deployment
|
||||
mountPath: /config-deployment
|
||||
readOnly: true
|
||||
- name: certdir
|
||||
mountPath: /certs
|
||||
- name: spiffe-workload-api
|
||||
mountPath: /spiffe-workload-api
|
||||
readOnly: true
|
||||
- name: workdir
|
||||
mountPath: /work
|
||||
volumes:
|
||||
- name: spiffe-workload-api
|
||||
csi:
|
||||
driver: {{ .Values.csiDriver | quote }}
|
||||
readOnly: true
|
||||
- name: config-deployment
|
||||
configMap:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-config-deployment
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-config-raw
|
||||
- name: certdir
|
||||
emptyDir: {}
|
||||
- name: spiffe-helper-config
|
||||
emptyDir: {}
|
||||
- name: spiffe-helper
|
||||
emptyDir: {}
|
||||
- name: workdir
|
||||
emptyDir: {}
|
||||
{{- with .Values.config.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.config.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.config.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,41 @@
|
||||
kind: Role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-svc-config
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: [configmaps]
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups: [""]
|
||||
resources: [configmaps]
|
||||
resourceNames: [{{ include "spiffe-step-ssh.fullname" . }}-config]
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- patch
|
||||
- apiGroups: ["apps"]
|
||||
resources: [statefulsets]
|
||||
resourceNames: [{{ include "spiffe-step-ssh.fullname" . }}]
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- apiGroups: ["apps"]
|
||||
resources: [deployments]
|
||||
resourceNames: [{{ include "spiffe-step-ssh.fullname" . }}-fetchca]
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
---
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-svc-config
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-svc-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-svc-config
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.serviceAccountName" . }}-svc-config
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
component: config
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,28 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-fetchca
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
spiffe-helper-init.conf: |
|
||||
agent_address = "/spiffe-workload-api/spire-agent.sock"
|
||||
cmd = ""
|
||||
cmd_args = ""
|
||||
cert_dir = "/certs"
|
||||
svid_file_name = "tls.crt"
|
||||
svid_key_file_name = "tls.key"
|
||||
svid_bundle_file_name = "ca.pem"
|
||||
add_intermediates_to_bundle = false
|
||||
spiffe-helper-sidecar.conf: |
|
||||
agent_address = "/spiffe-workload-api/spire-agent.sock"
|
||||
cmd = "/busybox/busybox"
|
||||
cmd_args = "sh /update.sh"
|
||||
cert_dir = "/certs"
|
||||
svid_file_name = "tls.crt"
|
||||
svid_key_file_name = "tls.key"
|
||||
svid_bundle_file_name = "ca.pem"
|
||||
add_intermediates_to_bundle = false
|
||||
update.sh: |
|
||||
#!/bin/sh
|
||||
/busybox/busybox kill -HUP `/busybox/busybox busybox cat /pid/pid`
|
||||
@@ -0,0 +1,182 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-fetchca
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
app: spiffe-step-ssh
|
||||
component: fetchca
|
||||
spec:
|
||||
{{- if not .Values.fetchCA.autoscaling.enabled }}
|
||||
replicas: {{ .Values.fetchCA.replicaCount }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spiffe-step-ssh.selectorLabels" . | nindent 6 }}
|
||||
app: spiffe-step-ssh
|
||||
component: fetchca
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 8 }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
app: spiffe-step-ssh
|
||||
component: fetchca
|
||||
spec:
|
||||
shareProcessNamespace: true
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "spiffe-step-ssh.serviceAccountName" . }}-fetchca
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
initContainers:
|
||||
- name: busybox-volume
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.busybox.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.busybox.image.pullPolicy }}
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- 'cp -a /bin/busybox /busybox'
|
||||
volumeMounts:
|
||||
- name: busybox
|
||||
mountPath: /busybox
|
||||
resources:
|
||||
{{- toYaml .Values.fetchCA.spiffeHelper.resources | nindent 12 }}
|
||||
- name: init-tls
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.spiffeHelper.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.spiffeHelper.image.pullPolicy }}
|
||||
command:
|
||||
- /spiffe-helper
|
||||
- -config
|
||||
- /etc/spiffe-helper.conf
|
||||
- -daemon-mode=false
|
||||
volumeMounts:
|
||||
- name: spiffe-workload-api
|
||||
mountPath: /spiffe-workload-api
|
||||
readOnly: true
|
||||
- name: config
|
||||
mountPath: /etc/spiffe-helper.conf
|
||||
subPath: spiffe-helper-init.conf
|
||||
readOnly: true
|
||||
- name: certs
|
||||
mountPath: /certs
|
||||
resources:
|
||||
{{- toYaml .Values.fetchCA.spiffeHelper.resources | nindent 12 }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}-fetchca
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.nginx.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.nginx.image.pullPolicy }}
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
echo $$$$ > /pid/pid
|
||||
cat > /etc/nginx/conf.d/ssl.conf <<EOF
|
||||
server {
|
||||
listen 8443 ssl;
|
||||
server_name localhost;
|
||||
ssl_certificate /certs/tls.crt;
|
||||
ssl_certificate_key /certs/tls.key;
|
||||
location / {
|
||||
root /usr/share/nginx/html;
|
||||
index root_ca.crt index.html index.htm;
|
||||
}
|
||||
error_page 500 502 503 504 /50x.html;
|
||||
location = /50x.html {
|
||||
root /usr/share/nginx/html;
|
||||
}
|
||||
}
|
||||
EOF
|
||||
exec nginx -g "daemon off;"
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8443
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTPS
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTPS
|
||||
resources:
|
||||
{{- toYaml .Values.fetchCA.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: certs
|
||||
mountPath: /certs
|
||||
readOnly: true
|
||||
- name: pid
|
||||
mountPath: /pid
|
||||
- name: share
|
||||
mountPath: /usr/share/nginx/html
|
||||
- name: update-tls
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.spiffeHelper.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.spiffeHelper.image.pullPolicy }}
|
||||
command:
|
||||
- /spiffe-helper
|
||||
- -config
|
||||
- /etc/spiffe-helper.conf
|
||||
volumeMounts:
|
||||
- name: certs
|
||||
mountPath: /certs
|
||||
- name: spiffe-workload-api
|
||||
mountPath: /spiffe-workload-api
|
||||
readOnly: true
|
||||
- name: config
|
||||
mountPath: /etc/spiffe-helper.conf
|
||||
subPath: spiffe-helper-sidecar.conf
|
||||
readOnly: true
|
||||
- name: config
|
||||
mountPath: /update.sh
|
||||
subPath: update.sh
|
||||
readOnly: true
|
||||
- name: pid
|
||||
mountPath: /pid
|
||||
readOnly: true
|
||||
- name: busybox
|
||||
mountPath: /busybox
|
||||
readOnly: true
|
||||
resources:
|
||||
{{- toYaml .Values.fetchCA.spiffeHelper.resources | nindent 12 }}
|
||||
volumes:
|
||||
- name: certs
|
||||
emptyDir: {}
|
||||
- name: pid
|
||||
emptyDir: {}
|
||||
- name: busybox
|
||||
emptyDir: {}
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-fetchca
|
||||
- name: spiffe-workload-api
|
||||
csi:
|
||||
driver: {{ .Values.csiDriver | quote }}
|
||||
readOnly: true
|
||||
- name: share
|
||||
configMap:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-certs
|
||||
{{- with .Values.fetchCA.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.fetchCA.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.fetchCA.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,32 @@
|
||||
{{- if .Values.fetchCA.autoscaling.enabled }}
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-fetchCA
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-fetchca
|
||||
minReplicas: {{ .Values.fetchCA.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.fetchCA.autoscaling.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.fetchCA.autoscaling.targetCPUUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.fetchCA.autoscaling.targetCPUUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- if .Values.fetchCA.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.fetchCA.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,31 @@
|
||||
{{- if .Values.fetchCA.ingress.enabled -}}
|
||||
{{- $ingressControllerType := include "spiffe-step-ssh.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.fetchCA.ingress) }}
|
||||
{{- $fullName := printf "%s-fetchca" (include "spiffe-step-ssh.fullname" .) -}}
|
||||
{{- $path := "/" }}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.fetchCA.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
labels:
|
||||
{{ include "spiffe-step-ssh.labels" . | nindent 4}}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.fetchCA.ingress "svcName" $fullName "port" .Values.fetchCA.service.port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-fetchca
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
app: spiffe-step-ssh
|
||||
component: fetchca
|
||||
spec:
|
||||
type: {{ .Values.fetchCA.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.fetchCA.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
selector:
|
||||
{{- include "spiffe-step-ssh.selectorLabels" . | nindent 4 }}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.serviceAccountName" . }}-fetchca
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-certificate-issuer-password
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
password: {{ .Values.caPassword | b64enc }}
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-ca-password
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
password: {{ .Values.caPassword | b64enc }}
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-certs
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
"root_ca.crt": |
|
||||
{{- .Values.inject.certificates.root_ca | nindent 4}}
|
||||
"intermediate_ca.crt": |
|
||||
{{ .Values.inject.certificates.intermediate_ca | nindent 4}}
|
||||
"ssh_host_ca_key.pub": |
|
||||
{{ .Values.inject.certificates.ssh_host_ca | nindent 4 }}
|
||||
"ssh_user_ca_key.pub": |
|
||||
{{ .Values.inject.certificates.ssh_user_ca | nindent 4 }}
|
||||
@@ -0,0 +1,32 @@
|
||||
{{- define "spiffe-step-ssh.config-provisioners" }}
|
||||
type: X5C
|
||||
name: "x5c@spiffe"
|
||||
roots: ""
|
||||
claims:
|
||||
maxTLSCertDuration: {{ .Values.maxTLSCertDuration | quote }}
|
||||
defaultTLSCertDuration: {{ .Values.defaultTLSCertDuration | quote }}
|
||||
disableRenewal: true
|
||||
enableSSHCA: true
|
||||
disableCustomSANs: true
|
||||
options:
|
||||
ssh:
|
||||
templateFile: /home/step/config/ssh_x5c.tpl
|
||||
{{- end }}
|
||||
{{ $ca := deepCopy (index .Values.inject.config.files "ca.json") }}
|
||||
{{ $_ := set $ca.authority "provisioners" (list (include "spiffe-step-ssh.config-provisioners" . | fromYaml )) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-config-raw
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
"ca.json": |
|
||||
{{- $ca | toPrettyJson | nindent 4 }}
|
||||
"defaults.json": |
|
||||
{{- index .Values.inject.config.files "defaults.json" | toPrettyJson | nindent 4 }}
|
||||
{{- if eq .Values.trustDomain "" }}
|
||||
{{- fail "You must set trustDomain" }}
|
||||
{{- end }}
|
||||
"ssh_x5c.tpl": |
|
||||
{{- .Files.Get "files/ssh_x5c.tpl" | replace "@TRUST_DOMAIN@" .Values.trustDomain | replace "@PREFIX@" .Values.prefix | nindent 4}}
|
||||
@@ -0,0 +1,31 @@
|
||||
{{- if .Values.stepIngress.enabled -}}
|
||||
{{- $ingressControllerType := include "spiffe-step-ssh.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.stepIngress) }}
|
||||
{{- $fullName := printf "%s" (include "spiffe-step-ssh.fullname" .) -}}
|
||||
{{- $path := "/" }}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.stepIngress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
labels:
|
||||
{{ include "spiffe-step-ssh.labels" . | nindent 4}}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.stepIngress "svcName" $fullName "port" .Values.step.service.port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-secrets
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
root_ca_key: {{ .Values.inject.secrets.x509.root_ca_key | b64enc }}
|
||||
intermediate_ca_key: {{ .Values.inject.secrets.x509.intermediate_ca_key | b64enc }}
|
||||
ssh_host_ca_key: {{ .Values.inject.secrets.ssh.host_ca_key | b64enc }}
|
||||
ssh_user_ca_key: {{ .Values.inject.secrets.ssh.user_ca_key | b64enc }}
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-ssh-host-ca-password
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
password: {{ .Values.caPassword | b64enc }}
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-ssh-user-ca-password
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
password: {{ .Values.caPassword | b64enc }}
|
||||
@@ -0,0 +1,292 @@
|
||||
# Default values for spiffe-step-ssh.
|
||||
# SPDX-License-Identifier: APACHE-2.0
|
||||
|
||||
global:
|
||||
spiffe:
|
||||
## @param global.spiffe.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
ingressControllerType: ""
|
||||
|
||||
## @param trustDomain The trust domain for SPIRE
|
||||
trustDomain: ""
|
||||
## @param caPassword Password securing the SSH CA
|
||||
caPassword: ""
|
||||
## @param maxTLSCertDuration The maximum duration the X5C traded cert is valid for.
|
||||
maxTLSCertDuration: 24h
|
||||
## @param defaultTLSCertDuration The default duration the X5C traded cert is valid for.
|
||||
defaultTLSCertDuration: 1h
|
||||
## @param prefix Prefix where hosts show up that are allowed to get ssh host certs
|
||||
prefix: sshd
|
||||
## @param csiDriver The csi driver to use
|
||||
csiDriver: csi.spiffe.io
|
||||
|
||||
## @skip inject
|
||||
## These will be generated by the step-ca tool
|
||||
inject:
|
||||
secrets:
|
||||
x509:
|
||||
root_ca_key: ""
|
||||
intermediate_ca_key: ""
|
||||
ssh:
|
||||
host_ca_key: ""
|
||||
user_ca_key: ""
|
||||
config:
|
||||
files:
|
||||
ca.json:
|
||||
authority: {}
|
||||
certificates:
|
||||
root_ca: ""
|
||||
intermediate_ca: ""
|
||||
ssh_host_ca: ""
|
||||
ssh_user_ca: ""
|
||||
|
||||
stepIngress:
|
||||
## @param stepIngress.enabled Flag to enable ingress
|
||||
enabled: false
|
||||
## @param stepIngress.className Ingress class name
|
||||
className: ""
|
||||
## @param stepIngress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
controllerType: ""
|
||||
## @param stepIngress.annotations [object] Annotations for the ingress object
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
# If Profile Type == https_spiffe:
|
||||
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||
|
||||
## @param stepIngress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
host: "spiffe-step-ssh"
|
||||
|
||||
## @param stepIngress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
|
||||
## @param stepIngress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
|
||||
hosts: []
|
||||
# - host: spiffe-step-ssh.example.org
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
|
||||
## @param stepIngress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
# - hosts:
|
||||
# - spiffe-step-ssh.example.org
|
||||
|
||||
## @skip step
|
||||
step:
|
||||
service:
|
||||
port: 443
|
||||
targetPort: 8443
|
||||
inject:
|
||||
enabled: false
|
||||
bootstrap:
|
||||
enabled: false
|
||||
configmaps: false
|
||||
secrets: false
|
||||
existingSecrets:
|
||||
enabled: true
|
||||
ca: true
|
||||
issuer: true
|
||||
certsAsSecret: false
|
||||
configAsSecret: false
|
||||
sshHostCa: true
|
||||
sshUserCa: true
|
||||
|
||||
spiffeHelper:
|
||||
## @param spiffeHelper.image.registry The OCI registry to pull the image from
|
||||
## @param spiffeHelper.image.repository The repository within the registry
|
||||
## @param spiffeHelper.image.pullPolicy The image pull policy
|
||||
## @param spiffeHelper.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spiffe-helper
|
||||
pullPolicy: IfNotPresent
|
||||
tag: 0.8.0
|
||||
|
||||
nginx:
|
||||
## @param nginx.image.registry The OCI registry to pull the image from
|
||||
## @param nginx.image.repository The repository within the registry
|
||||
## @param nginx.image.pullPolicy The image pull policy
|
||||
## @param nginx.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: nginxinc/nginx-unprivileged
|
||||
pullPolicy: IfNotPresent
|
||||
tag: 1.25.3-alpine
|
||||
|
||||
kubectl:
|
||||
## @param kubectl.image.registry The OCI registry to pull the image from
|
||||
## @param kubectl.image.repository The repository within the registry
|
||||
## @param kubectl.image.pullPolicy The image pull policy
|
||||
## @param kubectl.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: rancher/kubectl
|
||||
pullPolicy: IfNotPresent
|
||||
tag: ""
|
||||
|
||||
yq:
|
||||
## @param yq.image.registry The OCI registry to pull the image from
|
||||
## @param yq.image.repository The repository within the registry
|
||||
## @param yq.image.pullPolicy The image pull policy
|
||||
## @param yq.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: mikefarah/yq
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "4.40.5"
|
||||
|
||||
busybox:
|
||||
## @param busybox.image.registry The OCI registry to pull the image from
|
||||
## @param busybox.image.repository The repository within the registry
|
||||
## @param busybox.image.pullPolicy The image pull policy
|
||||
## @param busybox.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: busybox
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "1.36.1-uclibc"
|
||||
|
||||
## @param imagePullSecrets [array] Pull secrets for images
|
||||
imagePullSecrets: []
|
||||
|
||||
## @param nameOverride Name override
|
||||
nameOverride: ""
|
||||
|
||||
## @param fullnameOverride Fullname override
|
||||
fullnameOverride: ""
|
||||
|
||||
## @param serviceAccount.create Specifies whether a service account should be created
|
||||
## @param serviceAccount.annotations [object] Annotations to add to the service account
|
||||
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
|
||||
##
|
||||
serviceAccount:
|
||||
create: true
|
||||
annotations: {}
|
||||
name: ""
|
||||
|
||||
## @param podAnnotations [object] Additional pod annotations to add
|
||||
podAnnotations: {}
|
||||
## @param podLabels [object] Additional pod labels to add
|
||||
podLabels: {}
|
||||
|
||||
## @param podSecurityContext [object} Specify pod security context settings
|
||||
podSecurityContext: {}
|
||||
# fsGroup: 2000
|
||||
|
||||
## @param securityContext [object] Specify container security context settings
|
||||
securityContext:
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
# FIXME
|
||||
runAsUser: 0
|
||||
|
||||
fetchCA:
|
||||
## @param fetchCA.replicaCount Number of replicas to launch
|
||||
replicaCount: 1
|
||||
|
||||
## @param fetchCA.service.type The type of service to deploy
|
||||
## @param fetchCA.service.port The port number of the service port
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 443
|
||||
|
||||
ingress:
|
||||
## @param fetchCA.ingress.enabled Flag to enable ingress
|
||||
enabled: false
|
||||
## @param fetchCA.ingress.className Ingress class name
|
||||
className: ""
|
||||
## @param fetchCA.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
controllerType: ""
|
||||
## @param fetchCA.ingress.annotations [object] Annotations for the ingress object
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
# If Profile Type == https_spiffe:
|
||||
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||
|
||||
## @param fetchCA.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
host: "spiffe-step-ssh-fetchca"
|
||||
|
||||
## @param fetchCA.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
|
||||
## @param fetchCA.ingress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
|
||||
hosts: []
|
||||
# - host: spiffe-step-ssh-fetchca.example.org
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
|
||||
## @param fetchCA.ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
# - hosts:
|
||||
# - spiffe-step-ssh-fetchca.example.org
|
||||
|
||||
## @param fetchCA.autoscaling.enabled Enable autoscaling
|
||||
## @param fetchCA.autoscaling.minReplicas Minimum number of replicas to deploy
|
||||
## @param fetchCA.autoscaling.maxReplicas Maximum number of replicas to deploy
|
||||
## @param fetchCA.autoscaling.targetCPUUtilizationPercentage Target CPU utilization to use for autoscaling
|
||||
autoscaling:
|
||||
enabled: false
|
||||
minReplicas: 1
|
||||
maxReplicas: 100
|
||||
targetCPUUtilizationPercentage: 80
|
||||
# targetMemoryUtilizationPercentage: 80
|
||||
|
||||
## @param fetchCA.resources [object] Specify resources
|
||||
resources: {}
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
spiffeHelper:
|
||||
## @param fetchCA.spiffeHelper.resources [object] Specify resources for the SPIFFE helper
|
||||
resources: {}
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
## @param fetchCA.nodeSelector [object] Specify node selector
|
||||
nodeSelector: {}
|
||||
|
||||
## @param fetchCA.tolerations [array] Specify tolerations
|
||||
tolerations: []
|
||||
|
||||
## @param fetchCA.affinity [object] Specify affinity
|
||||
affinity: {}
|
||||
|
||||
config:
|
||||
## @param config.resources [object] Specify resources
|
||||
resources: {}
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
## @param config.nodeSelector [object] Specify node selector
|
||||
nodeSelector: {}
|
||||
|
||||
## @param config.tolerations [array] Specify tolerations
|
||||
tolerations: []
|
||||
|
||||
## @param config.affinity [object] Specify affinity
|
||||
affinity: {}
|
||||
@@ -3,7 +3,7 @@ name: spire-nested
|
||||
description: >
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
type: application
|
||||
version: 0.24.0
|
||||
version: 0.24.1
|
||||
appVersion: "1.11.0"
|
||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# spire
|
||||
|
||||
  
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire
|
||||
description: >
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
type: application
|
||||
version: 0.24.0
|
||||
version: 0.24.1
|
||||
appVersion: "1.11.0"
|
||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# spire
|
||||
|
||||
  
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
|
||||
@@ -33,6 +33,7 @@ A Helm chart to install the SPIFFE CSI driver.
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `resources` | Resource requests and limits for spiffe-csi-driver | `{}` |
|
||||
| `extraEnvVars` | Extra environment variables to be added to the spiffe-csi-driver container | `[]` |
|
||||
| `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` |
|
||||
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
|
||||
| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` |
|
||||
@@ -61,6 +62,7 @@ A Helm chart to install the SPIFFE CSI driver.
|
||||
| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.4` |
|
||||
| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` |
|
||||
| `nodeDriverRegistrar.extraEnvVars` | Extra environment variables to be added to the nodeDriverRegistrar container | `[]` |
|
||||
| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||
| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` |
|
||||
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||
|
||||
@@ -90,6 +90,9 @@ spec:
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
{{- with .Values.extraEnvVars }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
# The volume containing the SPIRE agent socket. The SPIFFE CSI
|
||||
# driver will mount this directory into containers.
|
||||
@@ -123,6 +126,10 @@ spec:
|
||||
"-kubelet-registration-path", "{{ .Values.kubeletPath }}/plugins/{{ .Values.pluginName }}/csi.sock",
|
||||
"-health-port", "{{ .Values.healthChecks.port }}"
|
||||
]
|
||||
env:
|
||||
{{- with .Values.nodeDriverRegistrar.extraEnvVars }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
# The registrar needs access to the SPIFFE CSI driver socket
|
||||
- mountPath: /spiffe-csi
|
||||
|
||||
@@ -33,6 +33,9 @@ resources: {}
|
||||
# cpu: 100m
|
||||
# memory: 64Mi
|
||||
|
||||
## @param extraEnvVars [array] Extra environment variables to be added to the spiffe-csi-driver container
|
||||
extraEnvVars: []
|
||||
|
||||
healthChecks:
|
||||
## @param healthChecks.port The healthcheck port for spiffe-csi-driver
|
||||
port: 9809
|
||||
@@ -136,6 +139,8 @@ nodeDriverRegistrar:
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 64Mi
|
||||
## @param nodeDriverRegistrar.extraEnvVars [array] Extra environment variables to be added to the nodeDriverRegistrar container
|
||||
extraEnvVars: []
|
||||
|
||||
## @param agentSocketPath The unix socket path to the spire-agent
|
||||
agentSocketPath: /run/spire/agent-sockets/spire-agent.sock
|
||||
|
||||
@@ -117,15 +117,15 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:71acae435de0d6a363ed159b38bee618e8ef37320a078caaba0792c8fd76fa99` |
|
||||
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
|
||||
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:424ac4637dac08a4594643b548d9af10144dcd6360b4b319a4c143841bf0bfee` |
|
||||
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:8699d1707c16f2e05e321d19904652c16090b5819d657a91efd051d437f1b7dd` |
|
||||
| `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` |
|
||||
| `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.step.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.27.5` |
|
||||
| `tests.step.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.28.0` |
|
||||
| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` |
|
||||
| `tests.busybox.image.repository` | The repository within the registry | `busybox` |
|
||||
| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
|
||||
@@ -332,7 +332,7 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2
|
||||
tag: latest@sha256:71acae435de0d6a363ed159b38bee618e8ef37320a078caaba0792c8fd76fa99
|
||||
|
||||
toolkit:
|
||||
## @param tests.toolkit.image.registry The OCI registry to pull the image from
|
||||
@@ -344,7 +344,7 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/min-toolkit-debug
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:424ac4637dac08a4594643b548d9af10144dcd6360b4b319a4c143841bf0bfee
|
||||
tag: latest@sha256:8699d1707c16f2e05e321d19904652c16090b5819d657a91efd051d437f1b7dd
|
||||
|
||||
step:
|
||||
## @param tests.step.image.registry The OCI registry to pull the image from
|
||||
@@ -356,7 +356,7 @@ tests:
|
||||
registry: "docker.io"
|
||||
repository: smallstep/step-cli
|
||||
pullPolicy: IfNotPresent
|
||||
tag: 0.27.5
|
||||
tag: 0.28.0
|
||||
|
||||
busybox:
|
||||
## @param tests.busybox.image.registry The OCI registry to pull the image from
|
||||
|
||||
@@ -70,7 +70,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:71acae435de0d6a363ed159b38bee618e8ef37320a078caaba0792c8fd76fa99` |
|
||||
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
|
||||
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` |
|
||||
@@ -114,12 +114,12 @@ A Helm chart to install the SPIRE agent.
|
||||
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2` |
|
||||
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:71acae435de0d6a363ed159b38bee618e8ef37320a078caaba0792c8fd76fa99` |
|
||||
| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
|
||||
| `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:424ac4637dac08a4594643b548d9af10144dcd6360b4b319a4c143841bf0bfee` |
|
||||
| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:8699d1707c16f2e05e321d19904652c16090b5819d657a91efd051d437f1b7dd` |
|
||||
| `hostCert.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
|
||||
|
||||
@@ -153,7 +153,7 @@ fsGroupFix:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
tag: latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2
|
||||
tag: latest@sha256:71acae435de0d6a363ed159b38bee618e8ef37320a078caaba0792c8fd76fa99
|
||||
|
||||
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
@@ -280,7 +280,7 @@ socketAlternate:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
tag: latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2
|
||||
tag: latest@sha256:71acae435de0d6a363ed159b38bee618e8ef37320a078caaba0792c8fd76fa99
|
||||
|
||||
## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
@@ -295,7 +295,7 @@ hostCert:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/min-toolkit-debug
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:424ac4637dac08a4594643b548d9af10144dcd6360b4b319a4c143841bf0bfee
|
||||
tag: latest@sha256:8699d1707c16f2e05e321d19904652c16090b5819d657a91efd051d437f1b7dd
|
||||
|
||||
## @param hostCert.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
||||
@@ -434,7 +434,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `chown.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `chown.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `chown.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2` |
|
||||
| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:71acae435de0d6a363ed159b38bee618e8ef37320a078caaba0792c8fd76fa99` |
|
||||
| `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
||||
| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` |
|
||||
@@ -447,5 +447,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:71acae435de0d6a363ed159b38bee618e8ef37320a078caaba0792c8fd76fa99` |
|
||||
| `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` |
|
||||
|
||||
@@ -307,7 +307,7 @@ plugins:
|
||||
plugin_data:
|
||||
bucket_name: {{ .Values.bundlePublisher.gcpCloudStorage.bucketName | quote }}
|
||||
object_name: {{ .Values.bundlePublisher.gcpCloudStorage.objectName | quote }}
|
||||
format: {{ .Values.bundlePublisher.awsS3.format | quote }}
|
||||
format: {{ .Values.bundlePublisher.gcpCloudStorage.format | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
@@ -1098,7 +1098,7 @@ chown:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
tag: latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2
|
||||
tag: latest@sha256:71acae435de0d6a363ed159b38bee618e8ef37320a078caaba0792c8fd76fa99
|
||||
|
||||
## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
@@ -1133,7 +1133,7 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2
|
||||
tag: latest@sha256:71acae435de0d6a363ed159b38bee618e8ef37320a078caaba0792c8fd76fa99
|
||||
|
||||
## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters
|
||||
kubeConfigs: {}
|
||||
|
||||
@@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details.
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:71acae435de0d6a363ed159b38bee618e8ef37320a078caaba0792c8fd76fa99` |
|
||||
|
||||
@@ -162,4 +162,4 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:a5cd47a3caf0668c48c6ad4bb66436cab40aa335634f3b5740ffd2a0c39770b2
|
||||
tag: latest@sha256:71acae435de0d6a363ed159b38bee618e8ef37320a078caaba0792c8fd76fa99
|
||||
|
||||
+12
-12
@@ -4,9 +4,9 @@ go 1.21
|
||||
toolchain go1.22.5
|
||||
|
||||
require (
|
||||
github.com/onsi/ginkgo/v2 v2.20.2
|
||||
github.com/onsi/gomega v1.34.2
|
||||
helm.sh/helm/v3 v3.16.2
|
||||
github.com/onsi/ginkgo/v2 v2.21.0
|
||||
github.com/onsi/gomega v1.35.1
|
||||
helm.sh/helm/v3 v3.16.3
|
||||
)
|
||||
|
||||
require (
|
||||
@@ -15,7 +15,7 @@ require (
|
||||
github.com/Masterminds/goutils v1.1.1 // indirect
|
||||
github.com/Masterminds/semver/v3 v3.3.0 // indirect
|
||||
github.com/Masterminds/sprig/v3 v3.3.0 // indirect
|
||||
github.com/cyphar/filepath-securejoin v0.3.1 // indirect
|
||||
github.com/cyphar/filepath-securejoin v0.3.4 // indirect
|
||||
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
||||
github.com/emicklei/go-restful/v3 v3.11.0 // indirect
|
||||
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
|
||||
@@ -30,7 +30,7 @@ require (
|
||||
github.com/google/gnostic-models v0.6.8 // indirect
|
||||
github.com/google/go-cmp v0.6.0 // indirect
|
||||
github.com/google/gofuzz v1.2.0 // indirect
|
||||
github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5 // indirect
|
||||
github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db // indirect
|
||||
github.com/google/uuid v1.6.0 // indirect
|
||||
github.com/huandu/xstrings v1.5.0 // indirect
|
||||
github.com/josharian/intern v1.0.0 // indirect
|
||||
@@ -48,15 +48,15 @@ require (
|
||||
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
|
||||
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
|
||||
github.com/xeipuuv/gojsonschema v1.2.0 // indirect
|
||||
golang.org/x/crypto v0.27.0 // indirect
|
||||
golang.org/x/net v0.28.0 // indirect
|
||||
golang.org/x/crypto v0.28.0 // indirect
|
||||
golang.org/x/net v0.30.0 // indirect
|
||||
golang.org/x/oauth2 v0.21.0 // indirect
|
||||
golang.org/x/sys v0.25.0 // indirect
|
||||
golang.org/x/term v0.24.0 // indirect
|
||||
golang.org/x/text v0.18.0 // indirect
|
||||
golang.org/x/sys v0.26.0 // indirect
|
||||
golang.org/x/term v0.25.0 // indirect
|
||||
golang.org/x/text v0.19.0 // indirect
|
||||
golang.org/x/time v0.3.0 // indirect
|
||||
golang.org/x/tools v0.24.0 // indirect
|
||||
google.golang.org/protobuf v1.34.2 // indirect
|
||||
golang.org/x/tools v0.26.0 // indirect
|
||||
google.golang.org/protobuf v1.35.1 // indirect
|
||||
gopkg.in/inf.v0 v0.9.1 // indirect
|
||||
gopkg.in/yaml.v2 v2.4.0 // indirect
|
||||
gopkg.in/yaml.v3 v3.0.1 // indirect
|
||||
|
||||
+24
-24
@@ -9,8 +9,8 @@ github.com/Masterminds/semver/v3 v3.3.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lpr
|
||||
github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
|
||||
github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
|
||||
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
|
||||
github.com/cyphar/filepath-securejoin v0.3.1 h1:1V7cHiaW+C+39wEfpH6XlLBQo3j/PciWFrgfCLS8XrE=
|
||||
github.com/cyphar/filepath-securejoin v0.3.1/go.mod h1:F7i41x/9cBF7lzCrVsYs9fuzwRZm4NQsGTBdpp6mETc=
|
||||
github.com/cyphar/filepath-securejoin v0.3.4 h1:VBWugsJh2ZxJmLFSM06/0qzQyiQX2Qs0ViKrUAcqdZ8=
|
||||
github.com/cyphar/filepath-securejoin v0.3.4/go.mod h1:8s/MCNJREmFK0H02MF6Ihv1nakJe4L/w3WZLHNkvlYM=
|
||||
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
|
||||
@@ -46,8 +46,8 @@ github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
|
||||
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
|
||||
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||
github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5 h1:5iH8iuqE5apketRbSFBy+X1V0o+l+8NF1avt4HWl7cA=
|
||||
github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
|
||||
github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
|
||||
github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
|
||||
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
|
||||
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
|
||||
@@ -78,10 +78,10 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
|
||||
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
|
||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
|
||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
|
||||
github.com/onsi/ginkgo/v2 v2.20.2 h1:7NVCeyIWROIAheY21RLS+3j2bb52W0W82tkberYytp4=
|
||||
github.com/onsi/ginkgo/v2 v2.20.2/go.mod h1:K9gyxPIlb+aIvnZ8bd9Ak+YP18w3APlR+5coaZoE2ag=
|
||||
github.com/onsi/gomega v1.34.2 h1:pNCwDkzrsv7MS9kpaQvVb1aVLahQXyJ/Tv5oAZMI3i8=
|
||||
github.com/onsi/gomega v1.34.2/go.mod h1:v1xfxRgk0KIsG+QOdm7p8UosrOzPYRo60fd3B/1Dukc=
|
||||
github.com/onsi/ginkgo/v2 v2.21.0 h1:7rg/4f3rB88pb5obDgNZrNHrQ4e6WpjonchcpuBRnZM=
|
||||
github.com/onsi/ginkgo/v2 v2.21.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
|
||||
github.com/onsi/gomega v1.35.1 h1:Cwbd75ZBPxFSuZ6T+rN/WCb/gOc6YgFBXLlZLhC7Ds4=
|
||||
github.com/onsi/gomega v1.35.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
|
||||
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
|
||||
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
||||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
@@ -118,16 +118,16 @@ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9dec
|
||||
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
|
||||
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
|
||||
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||
golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
|
||||
golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
|
||||
golang.org/x/crypto v0.28.0 h1:GBDwsMXVQi34v5CCYUm2jkJvu4cbtru2U4TN2PSyQnw=
|
||||
golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7U=
|
||||
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
|
||||
golang.org/x/net v0.28.0 h1:a9JDOJc5GMUJ0+UDqmLT86WiEy7iWyIhz8gz8E4e5hE=
|
||||
golang.org/x/net v0.28.0/go.mod h1:yqtgsTWOOnlGLG9GFRrK3++bGOUEkNBoHZc8MEDWPNg=
|
||||
golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
|
||||
golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
|
||||
golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs=
|
||||
golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
|
||||
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
@@ -136,28 +136,28 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
|
||||
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
|
||||
golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/term v0.24.0 h1:Mh5cbb+Zk2hqqXNO7S1iTjEphVL+jb8ZWaqh/g+JWkM=
|
||||
golang.org/x/term v0.24.0/go.mod h1:lOBK/LVxemqiMij05LGJ0tzNr8xlmwBRJ81PX6wVLH8=
|
||||
golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
|
||||
golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/term v0.25.0 h1:WtHI/ltw4NvSUig5KARz9h521QvRC8RmF/cuYqifU24=
|
||||
golang.org/x/term v0.25.0/go.mod h1:RPyXicDX+6vLxogjjRxjgD2TKtmAO6NZBsBRfrOLu7M=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
|
||||
golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
|
||||
golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
|
||||
golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
|
||||
golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
|
||||
golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
||||
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
|
||||
golang.org/x/tools v0.24.0 h1:J1shsA93PJUEVaUSaay7UXAyE8aimq3GW0pjlolpa24=
|
||||
golang.org/x/tools v0.24.0/go.mod h1:YhNqVBIfWHdzvTLs0d8LCuMhkKUgSUKldakyV7W/WDQ=
|
||||
golang.org/x/tools v0.26.0 h1:v/60pFQmzmT9ExmjDv2gGIfi3OqfKoEP6I5+umXlbnQ=
|
||||
golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
|
||||
google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
|
||||
google.golang.org/protobuf v1.35.1 h1:m3LfL6/Ca+fqnjnlqQXNpFPABW1UD7mjh8KO2mKFytA=
|
||||
google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
|
||||
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
|
||||
@@ -171,8 +171,8 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
|
||||
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
helm.sh/helm/v3 v3.16.2 h1:Y9v7ry+ubQmi+cb5zw1Llx8OKHU9Hk9NQ/+P+LGBe2o=
|
||||
helm.sh/helm/v3 v3.16.2/go.mod h1:SyTXgKBjNqi2NPsHCW5dDAsHqvGIu0kdNYNH9gQaw70=
|
||||
helm.sh/helm/v3 v3.16.3 h1:kb8bSxMeRJ+knsK/ovvlaVPfdis0X3/ZhYCSFRP+YmY=
|
||||
helm.sh/helm/v3 v3.16.3/go.mod h1:zeVWGDR4JJgiRbT3AnNsjYaX8OTJlIE9zC+Q7F7iUSU=
|
||||
k8s.io/api v0.31.1 h1:Xe1hX/fPW3PXYYv8BlozYqw63ytA92snr96zMW9gWTU=
|
||||
k8s.io/api v0.31.1/go.mod h1:sbN1g6eY6XVLeqNsZGLnI5FwVseTrZX7Fv3O26rhAaI=
|
||||
k8s.io/apiextensions-apiserver v0.31.1 h1:L+hwULvXx+nvTYX/MKM3kKMZyei+UiSXQWciX/N6E40=
|
||||
|
||||
@@ -0,0 +1,8 @@
|
||||
global:
|
||||
spiffe:
|
||||
ingressControllerType: ingress-nginx
|
||||
stepIngress:
|
||||
enabled: true
|
||||
fetchCA:
|
||||
ingress:
|
||||
enabled: true
|
||||
@@ -0,0 +1,45 @@
|
||||
tags:
|
||||
nestedRoot: true
|
||||
|
||||
spiffe-oidc-discovery-provider:
|
||||
ingress:
|
||||
enabled: true
|
||||
|
||||
internal-spire-server:
|
||||
controllerManager:
|
||||
identities:
|
||||
clusterSPIFFEIDs:
|
||||
default:
|
||||
enabled: false
|
||||
spiffe-step-ssh-config:
|
||||
type: raw
|
||||
namespaceSelector:
|
||||
matchLabels:
|
||||
#FIXME move these
|
||||
"kubernetes.io/metadata.name": default
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: spiffe-step-ssh
|
||||
component: config
|
||||
spiffe-step-ssh-fetchca:
|
||||
type: raw
|
||||
namespaceSelector:
|
||||
matchLabels:
|
||||
"kubernetes.io/metadata.name": default
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: spiffe-step-ssh
|
||||
component: fetchca
|
||||
dnsNameTemplates:
|
||||
- "spiffe-step-ssh-fetchca.{{ .TrustDomain }}"
|
||||
|
||||
external-spire-server:
|
||||
ingress:
|
||||
enabled: true
|
||||
nodeAttestor:
|
||||
httpChallenge:
|
||||
enabled: true
|
||||
allowedDNSPatterns:
|
||||
- ".*\\.production\\.other"
|
||||
allowNonRootPorts: false
|
||||
tofu: false
|
||||
+170
@@ -0,0 +1,170 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -xe
|
||||
|
||||
SCRIPT="$(readlink -f "$0")"
|
||||
SCRIPTPATH="$(dirname "${SCRIPT}")"
|
||||
TESTDIR="${SCRIPTPATH}/../../../.github/tests"
|
||||
#DEPS="${TESTDIR}/dependencies"
|
||||
|
||||
# shellcheck source=/dev/null
|
||||
source "${SCRIPTPATH}/../../../.github/scripts/parse-versions.sh"
|
||||
# shellcheck source=/dev/null
|
||||
source "${TESTDIR}/common.sh"
|
||||
|
||||
CLEANUP=1
|
||||
|
||||
for i in "$@"; do
|
||||
case $i in
|
||||
-c)
|
||||
CLEANUP=0
|
||||
shift # past argument=value
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
teardown() {
|
||||
set +e
|
||||
ls -l /var/run/spiffe/step-ssh/main
|
||||
ls -l /etc/ssh/sshd_config.d
|
||||
openssl s_client -servername spiffe-step-ssh-fetchca.production.other -connect spiffe-step-ssh-fetchca.production.other:443 2>/dev/null </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'
|
||||
echo spire-agent logs:S
|
||||
journalctl -u spire-agent@main
|
||||
echo spiffe-step-ssh logs:
|
||||
journalctl -u spiffe-step-ssh@main
|
||||
echo step pod:
|
||||
kubectl logs statefulset/spiffe-step-ssh
|
||||
echo fetchca pod:
|
||||
kubectl logs deploy/spiffe-step-ssh-fetchca
|
||||
echo config pod:
|
||||
kubectl logs deploy/spiffe-step-ssh-config
|
||||
echo ingress
|
||||
kubectl get ingress
|
||||
echo describe pods:
|
||||
kubectl describe pods
|
||||
print_helm_releases
|
||||
print_spire_workload_status spire-root-server
|
||||
print_spire_workload_status spire-server spire-system
|
||||
|
||||
if [[ "$1" -ne 0 ]]; then
|
||||
get_namespace_details spire-root-server
|
||||
get_namespace_details spire-server spire-system
|
||||
fi
|
||||
|
||||
if [ "${CLEANUP}" -eq 1 ]; then
|
||||
helm uninstall --namespace spire-server spire 2>/dev/null || true
|
||||
kubectl delete ns spire-server 2>/dev/null || true
|
||||
kubectl delete ns spire-system 2>/dev/null || true
|
||||
|
||||
helm uninstall --namespace mysql spire-root-server 2>/dev/null || true
|
||||
kubectl delete ns spire-root-server 2>/dev/null || true
|
||||
fi
|
||||
}
|
||||
|
||||
trap 'EC=$? && trap - SIGTERM && teardown $EC' SIGINT SIGTERM EXIT
|
||||
|
||||
echo Network interfaces:
|
||||
ip a
|
||||
|
||||
HIP="$(ip -4 addr show docker0 | grep -oP '(?<=inet\s)\d+(\.\d+){3}')"
|
||||
|
||||
echo "Picked IP ${HIP}"
|
||||
|
||||
echo "${HIP} test.production.other" | sudo bash -c 'cat >> /etc/hosts'
|
||||
|
||||
sudo adduser spiffe-test
|
||||
sudo -u spiffe-test mkdir -p /home/spiffe-test/.ssh
|
||||
sudo chown spiffe-test --recursive /home/spiffe-test
|
||||
sudo -u spiffe-test ssh-keygen -t ed25519 -f /home/spiffe-test/.ssh/id_ed25519 -q -N ""
|
||||
sudo -u spiffe-test chmod 600 /home/spiffe-test/.ssh/id_ed25519
|
||||
sudo -u spiffe-test cp /home/spiffe-test/.ssh/id_ed25519.pub /home/spiffe-test/.ssh/authorized_keys
|
||||
sudo -u spiffe-test ssh -T -n -i /home/spiffe-test/.ssh/id_ed25519 [email protected] hostname || echo Expected fail here
|
||||
|
||||
# Update deps
|
||||
helm dep up charts/spire-nested
|
||||
|
||||
# List nodes
|
||||
kubectl get nodes
|
||||
|
||||
# Deploy an ingress controller
|
||||
IP=$(kubectl get nodes chart-testing-control-plane -o go-template='{{ range .status.addresses }}{{ if eq .type "InternalIP" }}{{ .address }}{{ end }}{{ end }}')
|
||||
helm upgrade --install ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \
|
||||
--namespace ingress-nginx \
|
||||
--create-namespace \
|
||||
--set "controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP,controller.service.externalIPs[0]=$IP" \
|
||||
--set controller.ingressClassResource.default=true \
|
||||
--wait
|
||||
|
||||
# Test the ingress controller. Should 404 as there is no services yet.
|
||||
common_test_url "$IP"
|
||||
|
||||
kubectl get configmap -n kube-system coredns -o yaml | grep hosts || kubectl get configmap -n kube-system coredns -o yaml | sed "/ready/a\ hosts {\n fallthrough\n }" | kubectl apply -f -
|
||||
kubectl get configmap -n kube-system coredns -o yaml | grep test.production.other || kubectl get configmap -n kube-system coredns -o yaml | sed "/hosts/a\ $IP oidc-discovery.production.other\n $IP spire-server.production.other\n $HIP test.production.other\n" | kubectl apply -f -
|
||||
kubectl rollout restart -n kube-system deployment/coredns
|
||||
kubectl rollout status -n kube-system -w --timeout=1m deploy/coredns
|
||||
|
||||
helm upgrade --install --create-namespace --namespace spire-mgmt --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/root-values.yaml" \
|
||||
--wait spire charts/spire-nested \
|
||||
--set "global.spire.namespaces.create=true" \
|
||||
--set "global.spire.ingressControllerType=ingress-nginx"
|
||||
|
||||
kubectl get pods -n spire-server
|
||||
kubectl exec -it -n spire-server spire-external-server-0 -- spire-server entry create -parentID spiffe://production.other/spire/agent/http_challenge/test.production.other -spiffeID spiffe://production.other/sshd/test.production.other -selector systemd:id:[email protected]
|
||||
|
||||
ENTRIES="$(kubectl exec -i -n spire-server spire-external-server-0 -- spire-server entry show)"
|
||||
|
||||
if [[ "${ENTRIES}" == "Found 0 entries" ]]; then
|
||||
echo "${ENTRIES}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
kubectl get ingress -n spire-server
|
||||
|
||||
echo "${IP} spire-server.production.other spiffe-step-ssh.production.other spiffe-step-ssh-fetchca.production.other" | sudo bash -c 'cat >> /etc/hosts'
|
||||
echo Hosts:
|
||||
cat /etc/hosts
|
||||
|
||||
curl -L https://raw.githubusercontent.com/kfox1111/spire-examples/refs/heads/spiffe-step-ssh/examples/spiffe-step-ssh/scripts/demo.sh | sudo bash
|
||||
|
||||
sudo mkdir -p /usr/libexec/spiffe-step-ssh
|
||||
sudo mkdir -p /etc/systemd/system/sshd.service.d
|
||||
sudo curl -L -o /usr/libexec/spiffe-step-ssh/update.sh https://raw.githubusercontent.com/kfox1111/spire-examples/refs/heads/spiffe-step-ssh/examples/spiffe-step-ssh/scripts/update.sh
|
||||
sudo curl -L -o /etc/systemd/system/[email protected] https://raw.githubusercontent.com/kfox1111/spire-examples/refs/heads/spiffe-step-ssh/examples/spiffe-step-ssh/systemd/[email protected]
|
||||
sudo curl -L -o /etc/systemd/system/spiffe-step-ssh-cleanup.service https://raw.githubusercontent.com/kfox1111/spire-examples/refs/heads/spiffe-step-ssh/examples/spiffe-step-ssh/systemd/spiffe-step-ssh-cleanup.service
|
||||
sudo curl -L -o /etc/systemd/system/sshd.service.d/10-spiffe-step-ssh.conf https://raw.githubusercontent.com/kfox1111/spire-examples/refs/heads/spiffe-step-ssh/examples/spiffe-step-ssh/conf/10-spiffe-step-ssh.conf
|
||||
|
||||
sudo mkdir -p /etc/spire/agent
|
||||
sudo cp "${SCRIPTPATH}/spire-agent.conf" /etc/spire/agent/main.conf
|
||||
|
||||
PASSWORD=$(openssl rand -base64 48)
|
||||
echo "$PASSWORD" > spiffe-step-ssh-password.txt
|
||||
step ca init --helm --deployment-type=Standalone --name='My CA' --dns spiffe-step-ssh.production.other --ssh --address :8443 --provisioner default --password-file spiffe-step-ssh-password.txt > spiffe-step-ssh-values.yaml
|
||||
|
||||
# Start things up
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl enable spire-agent@main
|
||||
sudo systemctl start spire-agent@main
|
||||
|
||||
pushd charts/spiffe-step-ssh
|
||||
helm dep up
|
||||
popd
|
||||
|
||||
helm upgrade --install spiffe-step-ssh charts/spiffe-step-ssh --set caPassword="$(cat spiffe-step-ssh-password.txt)" -f spiffe-step-ssh-values.yaml -f "${SCRIPTPATH}/ingress-values.yaml" --set trustDomain=production.other --wait --timeout 10m
|
||||
|
||||
# Is fetchca responding.
|
||||
kubectl get configmap -n spire-system spire-bundle-downstream -o go-template='{{ index .data "bundle.crt" }}' > /tmp/ca.pem
|
||||
cat /tmp/ca.pem
|
||||
curl https://spiffe-step-ssh-fetchca.production.other -s --cacert /tmp/ca.pem
|
||||
|
||||
sudo systemctl start spiffe-step-ssh@main
|
||||
|
||||
# This is bad, but only for testing. Don't do this at home
|
||||
sudo chmod 777 "/var/run/spiffe/"
|
||||
sudo chmod 777 "/var/run/spiffe/step-ssh/"
|
||||
sudo chmod 777 "/var/run/spiffe/step-ssh/main/"
|
||||
common_test_file_exists "/var/run/spiffe/step-ssh/main/ssh_host_rsa_key-cert.pub"
|
||||
|
||||
kubectl get configmap spiffe-step-ssh-certs -o 'go-template={{ index .data "ssh_host_ca_key.pub" }}' | sed '/^$/d; s/^/@cert-authority *.production.other /' | sudo -u spiffe-test dd of=/home/spiffe-test/.ssh/known_hosts
|
||||
sudo -u spiffe-test cat /home/spiffe-test/.ssh/known_hosts
|
||||
|
||||
sudo -u spiffe-test ssh -T -n -i /home/spiffe-test/.ssh/id_ed25519 [email protected] hostname
|
||||
@@ -0,0 +1,25 @@
|
||||
agent {
|
||||
log_level = "DEBUG"
|
||||
trust_domain = "production.other"
|
||||
server_address = "spire-server.production.other"
|
||||
server_port = 443
|
||||
# Insecure bootstrap is NOT appropriate for production use but is ok for
|
||||
# simple testing/evaluation purposes.
|
||||
insecure_bootstrap = true
|
||||
}
|
||||
plugins {
|
||||
KeyManager "disk" {
|
||||
plugin_data {
|
||||
directory = "./"
|
||||
}
|
||||
}
|
||||
NodeAttestor "http_challenge" {
|
||||
plugin_data {
|
||||
hostname = "test.production.other"
|
||||
port = 81
|
||||
}
|
||||
}
|
||||
WorkloadAttestor "systemd" {
|
||||
plugin_data {}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user