Merge branch 'main' into examples-doc
This commit is contained in:
Mariusz Sabath
@@ -71,4 +71,4 @@ jq -r '. | keys[]' "$IMAGEJSON" | while read -r CHART; do
|
||||
fi
|
||||
done
|
||||
done
|
||||
"${SCRIPTPATH}/../../helm-docs.sh"
|
||||
"${SCRIPTPATH}/../../helm-docs.sh" || true
|
||||
|
||||
@@ -2,26 +2,26 @@
|
||||
{
|
||||
"name": "kube-prometheus-stack",
|
||||
"repo": "https://prometheus-community.github.io/helm-charts",
|
||||
"version": "48.3.1"
|
||||
"version": "51.3.0"
|
||||
},
|
||||
{
|
||||
"name": "cert-manager",
|
||||
"repo": "https://charts.jetstack.io",
|
||||
"version": "v1.12.3"
|
||||
"version": "v1.13.1"
|
||||
},
|
||||
{
|
||||
"name": "ingress-nginx",
|
||||
"repo": "https://kubernetes.github.io/ingress-nginx",
|
||||
"version": "4.7.1"
|
||||
"version": "4.8.1"
|
||||
},
|
||||
{
|
||||
"name": "mysql",
|
||||
"repo": "https://charts.bitnami.com/bitnami",
|
||||
"version": "9.10.10"
|
||||
"version": "9.12.3"
|
||||
},
|
||||
{
|
||||
"name": "postgresql",
|
||||
"repo": "https://charts.bitnami.com/bitnami",
|
||||
"version": "12.8.2"
|
||||
"version": "13.1.0"
|
||||
}
|
||||
]
|
||||
|
||||
@@ -71,6 +71,7 @@ jobs:
|
||||
signoff: true
|
||||
add-paths: |
|
||||
.github/tests
|
||||
charts
|
||||
|
||||
- name: Check outputs
|
||||
if: ${{ steps.cpr.outputs.pull-request-number }}
|
||||
|
||||
@@ -1,9 +1,36 @@
|
||||
# Frequently Asked Questions
|
||||
|
||||
- [How does this repo relate to the helm-charts repo?](#how-does-this-repo-relate-to-the-helm-charts-repo)
|
||||
- [How do I migrate my changeset from the old helm-charts repo to this one?](#how-do-i-migrate-my-changeset-from-the-old-helm-charts-repo-to-this-one)
|
||||
- [How do I update my helm registry to point to this one?](#how-do-i-update-my-helm-registry-to-point-to-this-one)
|
||||
- [Pods are stuck terminating after uninstall. How do I fix it?](#pods-are-stuck-terminating-after-uninstall-how-do-i-fix-it)
|
||||
- [Uninstall is stuck. How do I fix it?](#uninstall-is-stuck-how-do-i-fix-it)
|
||||
- [The PSAT plugin is not working](#the-psat-plugin-is-not-working)
|
||||
|
||||
## How does this repo relate to the helm-charts repo?
|
||||
|
||||
The helm-charts repo has been archived. This repo has all the commit history and releases copied over from that repo and is continuing development to provide a SPIRE helm chart for the community to use and contribute to.
|
||||
|
||||
## How do I migrate my changeset from the old helm-charts repo to this one?
|
||||
|
||||
Run one of these commands to switch to the new repo:
|
||||
|
||||
- If working off a branch (maintainers with write access): `git remote set-url origin [email protected]:spiffe/helm-charts-hardened.git`
|
||||
- If working off a fork:
|
||||
1. Create a new fork of helm-charts-hardened
|
||||
1. In your local clone of your old fork of helm-charts: `git remote set-url origin https://github.com/<your new fork>/helm-charts-hardened.git`
|
||||
|
||||
Then just `git push` your branches. Git history has been migrated over so you can just push your existing branches without issues.
|
||||
|
||||
## How do I update my helm registry to point to this one?
|
||||
|
||||
Assuming you named the repo `spiffe`:
|
||||
|
||||
``` bash
|
||||
helm repo remove spiffe
|
||||
helm repo add spiffe https://spiffe.github.io/helm-charts-hardened
|
||||
```
|
||||
|
||||
## Pods are stuck terminating after uninstall. How do I fix it?
|
||||
|
||||
If you uninstall the SPIRE chart before all users of the CSI driver are removed, Pods will get stuck in a terminating state waiting for the driver, that no longer is installed, to unmount the volumes for the Pod. In order to fix this, reinstall the chart and remove all affected workloads that are not part of the SPIRE helm chart itself, before attempting to remove SPIRE again.
|
||||
|
||||
@@ -57,7 +57,7 @@ A Helm chart to install the SPIFFE CSI driver.
|
||||
| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` |
|
||||
| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeDriverRegistrar.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.8.0` |
|
||||
| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.0` |
|
||||
| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` |
|
||||
| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||
| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` |
|
||||
|
||||
@@ -104,7 +104,7 @@ nodeDriverRegistrar:
|
||||
repository: sig-storage/csi-node-driver-registrar
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: v2.8.0
|
||||
tag: v2.9.0
|
||||
## @param nodeDriverRegistrar.resources Resource requests and limits for CSI driver pods
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
|
||||
@@ -57,7 +57,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` |
|
||||
| `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.24.0-alpine` |
|
||||
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.2-alpine` |
|
||||
| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` |
|
||||
| `jwtIssuer` | Path to JWT issuer | `https://oidc-discovery.example.org` |
|
||||
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||
@@ -106,17 +106,17 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5c943903c3f9159c58c4fdf9809f404ab9cfc39b7bfed12bac44563ce0fe7875` |
|
||||
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` |
|
||||
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d717d0a2c88518f8e36d9cfe1571639a40617e8c4291e34876d46bdeefb1ab5a` |
|
||||
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5b7238ba3ae528a6a400f8cd27dd987924ade0913de2326c3ebc13561d99709e` |
|
||||
| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` |
|
||||
| `tests.busybox.image.repository` | The repository within the registry | `busybox` |
|
||||
| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.busybox.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `uclibc@sha256:3e516f71d8801b0ce6c3f8f8e4f11093ec04e168177a90f1da4498014ee06b6b` |
|
||||
| `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` |
|
||||
| `tests.agent.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `tests.agent.image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
||||
| `tests.agent.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
|
||||
@@ -111,7 +111,7 @@ insecureScheme:
|
||||
repository: nginxinc/nginx-unprivileged
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: 1.24.0-alpine
|
||||
tag: 1.25.2-alpine
|
||||
## @param insecureScheme.nginx.resources Resource requests and limits
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
@@ -280,7 +280,7 @@ tests:
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4
|
||||
tag: latest@sha256:5c943903c3f9159c58c4fdf9809f404ab9cfc39b7bfed12bac44563ce0fe7875
|
||||
|
||||
toolkit:
|
||||
## @param tests.toolkit.image.registry The OCI registry to pull the image from
|
||||
@@ -294,7 +294,7 @@ tests:
|
||||
repository: chainguard/slim-toolkit-debug
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: latest@sha256:d717d0a2c88518f8e36d9cfe1571639a40617e8c4291e34876d46bdeefb1ab5a
|
||||
tag: latest@sha256:5b7238ba3ae528a6a400f8cd27dd987924ade0913de2326c3ebc13561d99709e
|
||||
|
||||
busybox:
|
||||
## @param tests.busybox.image.registry The OCI registry to pull the image from
|
||||
@@ -308,7 +308,7 @@ tests:
|
||||
repository: busybox
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: uclibc@sha256:3e516f71d8801b0ce6c3f8f8e4f11093ec04e168177a90f1da4498014ee06b6b
|
||||
tag: 1.36.1-uclibc
|
||||
|
||||
agent:
|
||||
## @param tests.agent.image.registry The OCI registry to pull the image from
|
||||
|
||||
@@ -68,13 +68,13 @@ A Helm chart to install the SPIRE agent.
|
||||
| `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` |
|
||||
| `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `waitForIt.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:deeaccb164a67a4d7f585c4d416641b1f422c029911a29d72beae28221f823df` |
|
||||
| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c1822a2d9c88431e5f87af378c377d26e622eaeaf44e84f375d07e283c85e567` |
|
||||
| `waitForIt.resources` | Resource requests and limits | `{}` |
|
||||
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `fsGroupFix.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5c943903c3f9159c58c4fdf9809f404ab9cfc39b7bfed12bac44563ce0fe7875` |
|
||||
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
|
||||
| `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` |
|
||||
|
||||
@@ -134,7 +134,7 @@ waitForIt:
|
||||
repository: chainguard/wait-for-it
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: latest@sha256:deeaccb164a67a4d7f585c4d416641b1f422c029911a29d72beae28221f823df
|
||||
tag: latest@sha256:c1822a2d9c88431e5f87af378c377d26e622eaeaf44e84f375d07e283c85e567
|
||||
|
||||
## @param waitForIt.resources [object] Resource requests and limits
|
||||
resources: {}
|
||||
@@ -153,7 +153,7 @@ fsGroupFix:
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
version: ""
|
||||
tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4
|
||||
tag: latest@sha256:5c943903c3f9159c58c4fdf9809f404ab9cfc39b7bfed12bac44563ce0fe7875
|
||||
|
||||
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
||||
@@ -289,4 +289,4 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5c943903c3f9159c58c4fdf9809f404ab9cfc39b7bfed12bac44563ce0fe7875` |
|
||||
|
||||
@@ -309,7 +309,7 @@ upstreamAuthority:
|
||||
## @param upstreamAuthority.certManager.ca.create Creates a Cert-Manager CA
|
||||
create: false
|
||||
## @param upstreamAuthority.certManager.ca.duration Duration of the CA. Defaults to 10 years
|
||||
duration: 87600h
|
||||
duration: 87600h
|
||||
privateKey:
|
||||
## @param upstreamAuthority.certManager.ca.privateKey.algorithm Algorithm to generate private key for CA
|
||||
algorithm: ECDSA
|
||||
@@ -656,4 +656,4 @@ tests:
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4
|
||||
tag: latest@sha256:5c943903c3f9159c58c4fdf9809f404ab9cfc39b7bfed12bac44563ce0fe7875
|
||||
|
||||
@@ -92,4 +92,4 @@ port forwarding. See the chart NOTES output for more details.
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5c943903c3f9159c58c4fdf9809f404ab9cfc39b7bfed12bac44563ce0fe7875` |
|
||||
|
||||
@@ -126,4 +126,4 @@ tests:
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4
|
||||
tag: latest@sha256:5c943903c3f9159c58c4fdf9809f404ab9cfc39b7bfed12bac44563ce0fe7875
|
||||
|
||||
Reference in New Issue
Block a user