Update to SPIRE 1.9.2, use retry_bootstrap, remove wait for it (#301)
* Update to SPIRE 1.9.2, use retry_bootstrap, remove wait for it Signed-off-by: Faisal Memon <[email protected]> * Remove waitfor it in values.yaml Signed-off-by: Faisal Memon <[email protected]> * Update docs Signed-off-by: Faisal Memon <[email protected]> * Remove wait for it from images.json Signed-off-by: Faisal Memon <[email protected]> --------- Signed-off-by: Faisal Memon <[email protected]>
This commit is contained in:
Faisal Memon
@@ -7,11 +7,6 @@
|
||||
}
|
||||
],
|
||||
"spire-agent/values.yaml": [
|
||||
{
|
||||
"query": "waitForIt.image",
|
||||
"filter": "LATESTSHA",
|
||||
"sort-flags": []
|
||||
},
|
||||
{
|
||||
"query": "socketAlternate.image",
|
||||
"filter": "LATESTSHA",
|
||||
|
||||
@@ -4,7 +4,7 @@ description: >
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
type: application
|
||||
version: 0.19.0
|
||||
appVersion: "1.9.1"
|
||||
appVersion: "1.9.2"
|
||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# spire
|
||||
|
||||
  
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire-agent
|
||||
description: A Helm chart to install the SPIRE agent.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.9.1"
|
||||
appVersion: "1.9.2"
|
||||
keywords: ["spiffe", "spire-agent"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -66,11 +66,6 @@ A Helm chart to install the SPIRE agent.
|
||||
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
|
||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` |
|
||||
| `readinessProbe.periodSeconds` | Period seconds for probe | `30` |
|
||||
| `waitForIt.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` |
|
||||
| `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:69602d705d17142dd4524da6929e80a8e33c61709ce9e7e8e4e0b1fcd14a1467` |
|
||||
| `waitForIt.resources` | Resource requests and limits | `{}` |
|
||||
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
|
||||
|
||||
@@ -37,6 +37,7 @@ agent:
|
||||
{{- end }}
|
||||
data_dir: "/run/spire"
|
||||
log_level: {{ .Values.logLevel | quote }}
|
||||
retry_bootstrap: true
|
||||
server_address: {{ include "spire-agent.server-address" . | trim | quote }}
|
||||
server_port: {{ .Values.server.port | quote }}
|
||||
socket_path: /tmp/spire-agent/public/{{ include "spire-agent.socket-path" . | base }}
|
||||
|
||||
@@ -115,17 +115,6 @@ spec:
|
||||
mountPath: /tpm
|
||||
imagePullPolicy: {{ .Values.nodeAttestor.tpmDirect.plugin.image.pullPolicy }}
|
||||
{{- end }}
|
||||
- name: init
|
||||
# This is a small image with wait-for-it, choose whatever image
|
||||
# you prefer that waits for a service to be up. This image is built
|
||||
# from https://github.com/vishnubob/wait-for-it
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.waitForIt.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
|
||||
args: ["-t", "30", "-h", "{{ include "spire-agent.server-address" . | trim }}", "-p", {{ .Values.server.port | quote }}]
|
||||
resources:
|
||||
{{- toYaml .Values.waitForIt.resources | nindent 12 }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
{{- if gt (len $socketAlternateNames) 0 }}
|
||||
- name: ensure-alternate-names
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.socketAlternate.image "global" .Values.global) }}
|
||||
|
||||
@@ -140,21 +140,6 @@ readinessProbe:
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
|
||||
waitForIt:
|
||||
## @param waitForIt.image.registry The OCI registry to pull the image from
|
||||
## @param waitForIt.image.repository The repository within the registry
|
||||
## @param waitForIt.image.pullPolicy The image pull policy
|
||||
## @param waitForIt.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/wait-for-it
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:69602d705d17142dd4524da6929e80a8e33c61709ce9e7e8e4e0b1fcd14a1467
|
||||
|
||||
## @param waitForIt.resources [object] Resource requests and limits
|
||||
resources: {}
|
||||
|
||||
# When running as non root, needed to ensure the socket path has the correct permissions.
|
||||
# Set runAsUser to a non-zero value in podSecurityContext to run as non-root user.
|
||||
fsGroupFix:
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire-server
|
||||
description: A Helm chart to install the SPIRE server.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.9.1"
|
||||
appVersion: "1.9.2"
|
||||
keywords: ["spiffe", "spire-server", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
Reference in New Issue
Block a user