Merge branch 'main' into doc-ingress-patch
This commit is contained in:
kfox1111
+3
-3
@@ -1,8 +1,8 @@
|
|||||||
### Contributor Code of Conduct
|
# Contributor Code of Conduct
|
||||||
|
|
||||||
We follow the [CNCF Contributor Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md). Additionally, we commit to the following guidelines as detailed on the [Linkerd Code of Conduct](https://github.com/linkerd/linkerd/wiki/Linkerd-code-of-conduct):
|
We follow the [CNCF Contributor Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md). Additionally, we commit to the following guidelines as detailed on the [Linkerd Code of Conduct](https://github.com/linkerd/linkerd/wiki/Linkerd-code-of-conduct):
|
||||||
|
|
||||||
### Community Guidelines
|
## Community Guidelines
|
||||||
|
|
||||||
- Our goal is to foster an inclusive and diverse community of technology enthusiasts.
|
- Our goal is to foster an inclusive and diverse community of technology enthusiasts.
|
||||||
|
|
||||||
@@ -14,6 +14,6 @@ We follow the [CNCF Contributor Code of Conduct](https://github.com/cncf/foundat
|
|||||||
|
|
||||||
- We do our best to avoid [subtle-isms](https://www.recurse.com/manual#sub-sec-social-rules): small actions that make others feel uncomfortable. If you witness a subtle-ism, you may respectfully point it out to the person publicly or privately, or you may ask a moderator to say something. Accidentally saying something biased is common, expected, and readily forgiven. It is not in and of itself a bannable offense.
|
- We do our best to avoid [subtle-isms](https://www.recurse.com/manual#sub-sec-social-rules): small actions that make others feel uncomfortable. If you witness a subtle-ism, you may respectfully point it out to the person publicly or privately, or you may ask a moderator to say something. Accidentally saying something biased is common, expected, and readily forgiven. It is not in and of itself a bannable offense.
|
||||||
|
|
||||||
### Moderation
|
## Moderation
|
||||||
|
|
||||||
- If you feel any of SPIFFE's communication channels require moderation, please e-mail the [SPIFFE Steering Committee (SSC)](mailto:[email protected]).
|
- If you feel any of SPIFFE's communication channels require moderation, please e-mail the [SPIFFE Steering Committee (SSC)](mailto:[email protected]).
|
||||||
|
|||||||
+3
-2
@@ -38,7 +38,8 @@ git rebase main
|
|||||||
|
|
||||||
Our CI pipeline takes care of the majority of the testing of this Chart. Other ways for you to test are by running `make test` locally using:
|
Our CI pipeline takes care of the majority of the testing of this Chart. Other ways for you to test are by running `make test` locally using:
|
||||||
|
|
||||||
> **Warning**: Ensure to run the test on a dedicated k8s cluster that does not have Spire installed yet.
|
> [!Warning]
|
||||||
|
> Ensure to run the test on a dedicated k8s cluster that does not have Spire installed yet.
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
make test
|
make test
|
||||||
@@ -48,7 +49,7 @@ Another approach to testing the chart is by installing one of the examples in yo
|
|||||||
|
|
||||||
## Generating documentation
|
## Generating documentation
|
||||||
|
|
||||||
Any changes to Chart.yaml or values.yaml require an update of the README.md. This update can easily be generated using [readme-generator](https://github.com/bitnami-labs/readme-generator-for-helm).
|
Any changes to Chart.yaml or values.yaml require an update of the README.md. This update can easily be generated using [readme-generator][].
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
./helm-docs.sh
|
./helm-docs.sh
|
||||||
|
|||||||
@@ -36,7 +36,8 @@ helm repo add spiffe https://spiffe.github.io/helm-charts-hardened
|
|||||||
If you uninstall the SPIRE chart before all users of the CSI driver are removed, Pods will get stuck in a terminating state waiting for the driver, that no longer is installed, to unmount the volumes for the Pod. In order to fix this, reinstall the chart and remove all affected workloads that are not part of the SPIRE helm chart itself, before attempting to remove SPIRE again.
|
If you uninstall the SPIRE chart before all users of the CSI driver are removed, Pods will get stuck in a terminating state waiting for the driver, that no longer is installed, to unmount the volumes for the Pod. In order to fix this, reinstall the chart and remove all affected workloads that are not part of the SPIRE helm chart itself, before attempting to remove SPIRE again.
|
||||||
|
|
||||||
You can discover Pods that use the driver with the following command:
|
You can discover Pods that use the driver with the following command:
|
||||||
```
|
|
||||||
|
```shell
|
||||||
kubectl get pods --all-namespaces -o go-template='{{range .items}}{{$nn := printf "%s %s" .metadata.namespace .metadata.name}}{{range .spec.volumes}}{{if .csi.driver}}{{if eq .csi.driver "csi.spiffe.io"}}{{printf "%s\n" $nn}}{{end}}{{end}}{{end}}{{end}}'
|
kubectl get pods --all-namespaces -o go-template='{{range .items}}{{$nn := printf "%s %s" .metadata.namespace .metadata.name}}{{range .spec.volumes}}{{if .csi.driver}}{{if eq .csi.driver "csi.spiffe.io"}}{{printf "%s\n" $nn}}{{end}}{{end}}{{end}}{{end}}'
|
||||||
```
|
```
|
||||||
|
|
||||||
@@ -44,17 +45,20 @@ kubectl get pods --all-namespaces -o go-template='{{range .items}}{{$nn := print
|
|||||||
|
|
||||||
If you uninstall the SPIFFE CSI driver manually before removing the chart, Pods can still be using the driver and are unable to unmount the CSI volume.
|
If you uninstall the SPIFFE CSI driver manually before removing the chart, Pods can still be using the driver and are unable to unmount the CSI volume.
|
||||||
|
|
||||||
To resolve, reinstall the chart before trying to remove it again.
|
To resolve, reinstall the chart before trying to remove it again.
|
||||||
|
|
||||||
## The PSAT plugin is not working
|
## The PSAT plugin is not working
|
||||||
|
|
||||||
The chart requires `Projected Service Account Tokens` which has to be enabled on your Kubernetes API server. In most cases this is already done for you.
|
The chart requires `Projected Service Account Tokens` which has to be enabled on your Kubernetes API server. In most cases this is already done for you.
|
||||||
|
|
||||||
> **Note**: This is enabled by default with newer versions as shown by the existence of:
|
> [!Note]
|
||||||
|
> This is enabled by default with newer versions as shown by the existence of:
|
||||||
>
|
>
|
||||||
|
> ```yaml
|
||||||
> - --service-account-issuer
|
> - --service-account-issuer
|
||||||
> - --service-account-key-file
|
> - --service-account-key-file
|
||||||
> - --service-account-signing-key-file
|
> - --service-account-signing-key-file
|
||||||
|
> ```
|
||||||
|
|
||||||
See [Service Account Token Volume Projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) in the Kubernetes docs for more details.
|
See [Service Account Token Volume Projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) in the Kubernetes docs for more details.
|
||||||
|
|
||||||
@@ -64,7 +68,9 @@ command to SSH into the Docker Desktop K8s VM.
|
|||||||
```bash
|
```bash
|
||||||
docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh
|
docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh
|
||||||
```
|
```
|
||||||
|
|
||||||
Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml`
|
Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml`
|
||||||
|
|
||||||
```yaml
|
```yaml
|
||||||
spec:
|
spec:
|
||||||
containers:
|
containers:
|
||||||
|
|||||||
@@ -14,7 +14,7 @@ A suite of [Helm Charts](https://helm.sh/docs) for standardized installations of
|
|||||||
## How to install or upgrade
|
## How to install or upgrade
|
||||||
|
|
||||||
You most likely want to do an integrated setup based on the spire chart.
|
You most likely want to do an integrated setup based on the spire chart.
|
||||||
[Instructions](https://artifacthub.io/packages/helm/spiffe/spire)
|
See the [Instructions](https://artifacthub.io/packages/helm/spiffe/spire).
|
||||||
|
|
||||||
## Contributing
|
## Contributing
|
||||||
|
|
||||||
|
|||||||
@@ -7,6 +7,7 @@ A Helm chart to install the SPIRE CRDS.
|
|||||||
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||||
|
|
||||||
## Maintainers
|
## Maintainers
|
||||||
|
|
||||||
| Name | Email | Url |
|
| Name | Email | Url |
|
||||||
| ---- | ------ | --- |
|
| ---- | ------ | --- |
|
||||||
| marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
|
| marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
|
||||||
@@ -16,8 +17,8 @@ A Helm chart to install the SPIRE CRDS.
|
|||||||
|
|
||||||
## Source Code
|
## Source Code
|
||||||
|
|
||||||
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire-crds>
|
||||||
|
|
||||||
<!-- The Parameters section is generated using helm-docs.sh -->
|
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||||
|
|
||||||
## Parameters
|
## Parameters
|
||||||
|
|||||||
@@ -4,7 +4,7 @@ description: >
|
|||||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||||
type: application
|
type: application
|
||||||
version: 0.14.0
|
version: 0.14.0
|
||||||
appVersion: "1.8.2"
|
appVersion: "1.8.4"
|
||||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||||
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
||||||
sources:
|
sources:
|
||||||
|
|||||||
@@ -36,7 +36,7 @@ For production installs, please see [the production example](https://github.com/
|
|||||||
|
|
||||||
The spire-crds chart has been updated. Please ensure you have upgraded spire-crds before upgrading the spire chart.
|
The spire-crds chart has been updated. Please ensure you have upgraded spire-crds before upgrading the spire chart.
|
||||||
|
|
||||||
The chart now supports multiple parallel installs of spire-controller-manager. Each install will handle all custom resources with a matching `className` field. By default this is set to `Release.Namespace-Release.Name` and the controller manager will only pick up custom resources with this `className`.
|
The chart now supports multiple parallel installs of spire-controller-manager. Each install will handle all custom resources with a matching `className` field. By default this is set to `Release.Namespace-Release.Name` and the controller manager will only pick up custom resources with this `className`.
|
||||||
|
|
||||||
If you have not loaded any SPIRE custom resources yourself, the upgrade process will be transparent. If you have loaded your own SPIRE custom resources, set `spire-server.controllerManager.watchClassless=true` until you can update your SPIRE custom resources to have the `className` for the instance specified.
|
If you have not loaded any SPIRE custom resources yourself, the upgrade process will be transparent. If you have loaded your own SPIRE custom resources, set `spire-server.controllerManager.watchClassless=true` until you can update your SPIRE custom resources to have the `className` for the instance specified.
|
||||||
|
|
||||||
@@ -62,7 +62,8 @@ helm install -n spire-server spire-crds charts/spire-crds
|
|||||||
|
|
||||||
## Version support
|
## Version support
|
||||||
|
|
||||||
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
|
> [!Warning]
|
||||||
|
> This Chart is still in development and still subject to change the API (`values.yaml`).
|
||||||
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
|
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
|
||||||
> we do aim for as much stability as possible.
|
> we do aim for as much stability as possible.
|
||||||
|
|
||||||
@@ -71,9 +72,11 @@ helm install -n spire-server spire-crds charts/spire-crds
|
|||||||
| Helm | `3.x` |
|
| Helm | `3.x` |
|
||||||
| Kubernetes | `1.22+` |
|
| Kubernetes | `1.22+` |
|
||||||
|
|
||||||
> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden.
|
> [!Note]
|
||||||
|
> For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden.
|
||||||
|
|
||||||
## FAQ
|
## FAQ
|
||||||
|
|
||||||
For any issues see our [FAQ](../../FAQ.md)…
|
For any issues see our [FAQ](../../FAQ.md)…
|
||||||
|
|
||||||
## Usage
|
## Usage
|
||||||
|
|||||||
@@ -1,75 +0,0 @@
|
|||||||
{{ template "chart.header" . }}
|
|
||||||
|
|
||||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
|
||||||
|
|
||||||
{{ template "chart.deprecationWarning" . }}
|
|
||||||
|
|
||||||
{{ template "chart.badgesSection" . }}
|
|
||||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
|
||||||
|
|
||||||
{{ template "chart.description" . }}
|
|
||||||
|
|
||||||
{{ template "chart.homepageLine" . }}
|
|
||||||
|
|
||||||
## Version support
|
|
||||||
|
|
||||||
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
|
|
||||||
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
|
|
||||||
> we do aim for as much stability as possible.
|
|
||||||
|
|
||||||
| Dependency | Supported Versions |
|
|
||||||
|:-----------|:-------------------|
|
|
||||||
| SPIRE | `1.5.3+`, `1.6.3+` |
|
|
||||||
| Helm | `3.x` |
|
|
||||||
| Kubernetes | `1.22+` |
|
|
||||||
|
|
||||||
> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden.
|
|
||||||
|
|
||||||
## FAQ
|
|
||||||
For any issues see our [FAQ](../../FAQ.md)…
|
|
||||||
|
|
||||||
## Usage
|
|
||||||
|
|
||||||
To utilize Spire in your own workloads you should add the following to your workload:
|
|
||||||
|
|
||||||
```diff
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Pod
|
|
||||||
metadata:
|
|
||||||
name: my-app
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- name: my-app
|
|
||||||
image: "my-app:latest"
|
|
||||||
imagePullPolicy: Always
|
|
||||||
+ volumeMounts:
|
|
||||||
+ - name: spiffe-workload-api
|
|
||||||
+ mountPath: /spiffe-workload-api
|
|
||||||
+ readOnly: true
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
cpu: 200m
|
|
||||||
memory: 32Mi
|
|
||||||
limits:
|
|
||||||
cpu: 500m
|
|
||||||
memory: 64Mi
|
|
||||||
+ volumes:
|
|
||||||
+ - name: spiffe-workload-api
|
|
||||||
+ csi:
|
|
||||||
+ driver: "csi.spiffe.io"
|
|
||||||
+ readOnly: true
|
|
||||||
```
|
|
||||||
|
|
||||||
Now you can interact with the Spire agent socket from your own application. The socket is mounted on `/spiffe-workload-api/spire-agent.sock`.
|
|
||||||
|
|
||||||
{{ template "chart.maintainersSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.sourcesSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.requirementsHeader" . }}
|
|
||||||
|
|
||||||
{{ template "chart.requirementsTable" . }}
|
|
||||||
|
|
||||||
{{ template "chart.valuesSection" . }}
|
|
||||||
|
|
||||||
----------------------------------------------
|
|
||||||
@@ -1,14 +1,13 @@
|
|||||||
# spiffe-csi-driver
|
# spiffe-csi-driver
|
||||||
|
|
||||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
|
||||||
|
|
||||||
  
|
  
|
||||||
|
|
||||||
A Helm chart to install the SPIFFE CSI driver.
|
A Helm chart to install the SPIFFE CSI driver.
|
||||||
|
|
||||||
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||||
|
|
||||||
> **Note**: The recommended version is `0.2.3` to support arm64 nodes. If running with any
|
> [!Note]
|
||||||
|
> The recommended version is `0.2.3` to support arm64 nodes. If running with any
|
||||||
> prior version to `0.2.3` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
> prior version to `0.2.3` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
||||||
|
|
||||||
## Maintainers
|
## Maintainers
|
||||||
@@ -24,6 +23,8 @@ A Helm chart to install the SPIFFE CSI driver.
|
|||||||
|
|
||||||
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||||
|
|
||||||
|
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||||
|
|
||||||
## Parameters
|
## Parameters
|
||||||
|
|
||||||
### SPIFFE CSI Driver Chart parameters
|
### SPIFFE CSI Driver Chart parameters
|
||||||
|
|||||||
@@ -1,24 +0,0 @@
|
|||||||
{{ template "chart.header" . }}
|
|
||||||
|
|
||||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
|
||||||
|
|
||||||
{{ template "chart.deprecationWarning" . }}
|
|
||||||
|
|
||||||
{{ template "chart.badgesSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.description" . }}
|
|
||||||
|
|
||||||
{{ template "chart.homepageLine" . }}
|
|
||||||
|
|
||||||
> **Note**: The recommended version is `0.2.3` to support arm64 nodes. If running with any
|
|
||||||
> prior version to `0.2.3` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
|
||||||
|
|
||||||
{{ template "chart.maintainersSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.sourcesSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.requirementsSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.valuesSection" . }}
|
|
||||||
|
|
||||||
----------------------------------------------
|
|
||||||
@@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider
|
|||||||
description: A Helm chart to install the SPIFFE OIDC discovery provider.
|
description: A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||||
type: application
|
type: application
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
appVersion: "1.8.2"
|
appVersion: "1.8.4"
|
||||||
keywords: ["spiffe", "oidc"]
|
keywords: ["spiffe", "oidc"]
|
||||||
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
||||||
sources:
|
sources:
|
||||||
|
|||||||
@@ -1,14 +1,13 @@
|
|||||||
# spiffe-oidc-discovery-provider
|
# spiffe-oidc-discovery-provider
|
||||||
|
|
||||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
|
||||||
|
|
||||||
  
|
  
|
||||||
|
|
||||||
A Helm chart to install the SPIFFE OIDC discovery provider.
|
A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||||
|
|
||||||
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||||
|
|
||||||
> **Note**: Minimum Spire version is `1.5.3`.
|
> [!Note]
|
||||||
|
> Minimum Spire version is `1.5.3`.
|
||||||
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
||||||
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
||||||
|
|
||||||
@@ -25,6 +24,8 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
|||||||
|
|
||||||
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||||
|
|
||||||
|
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||||
|
|
||||||
## Parameters
|
## Parameters
|
||||||
|
|
||||||
### Chart parameters
|
### Chart parameters
|
||||||
|
|||||||
@@ -1,25 +0,0 @@
|
|||||||
{{ template "chart.header" . }}
|
|
||||||
|
|
||||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
|
||||||
|
|
||||||
{{ template "chart.deprecationWarning" . }}
|
|
||||||
|
|
||||||
{{ template "chart.badgesSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.description" . }}
|
|
||||||
|
|
||||||
{{ template "chart.homepageLine" . }}
|
|
||||||
|
|
||||||
> **Note**: Minimum Spire version is `1.5.3`.
|
|
||||||
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
|
||||||
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
|
||||||
|
|
||||||
{{ template "chart.maintainersSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.sourcesSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.requirementsSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.valuesSection" . }}
|
|
||||||
|
|
||||||
----------------------------------------------
|
|
||||||
@@ -9,10 +9,10 @@ global: {}
|
|||||||
## @param agentSocketName The name of the spire-agent unix socket
|
## @param agentSocketName The name of the spire-agent unix socket
|
||||||
agentSocketName: spire-agent.sock
|
agentSocketName: spire-agent.sock
|
||||||
|
|
||||||
## @param replicaCount Replica count
|
## @param replicaCount Replica count
|
||||||
replicaCount: 1
|
replicaCount: 1
|
||||||
|
|
||||||
## @param namespaceOverride Namespace override
|
## @param namespaceOverride Namespace override
|
||||||
namespaceOverride: ""
|
namespaceOverride: ""
|
||||||
|
|
||||||
## @param annotations [object] Annotations for the deployment
|
## @param annotations [object] Annotations for the deployment
|
||||||
@@ -250,7 +250,7 @@ ingress:
|
|||||||
# nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
# nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||||
# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||||
|
|
||||||
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||||
host: "oidc-discovery"
|
host: "oidc-discovery"
|
||||||
|
|
||||||
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ name: spire-agent
|
|||||||
description: A Helm chart to install the SPIRE agent.
|
description: A Helm chart to install the SPIRE agent.
|
||||||
type: application
|
type: application
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
appVersion: "1.8.2"
|
appVersion: "1.8.4"
|
||||||
keywords: ["spiffe", "spire-agent"]
|
keywords: ["spiffe", "spire-agent"]
|
||||||
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
||||||
sources:
|
sources:
|
||||||
|
|||||||
@@ -1,14 +1,13 @@
|
|||||||
# spire-agent
|
# spire-agent
|
||||||
|
|
||||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
|
||||||
|
|
||||||
  
|
  
|
||||||
|
|
||||||
A Helm chart to install the SPIRE agent.
|
A Helm chart to install the SPIRE agent.
|
||||||
|
|
||||||
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||||
|
|
||||||
> **Note**: Minimum Spire version is `1.5.3`.
|
> [!Note]
|
||||||
|
> Minimum Spire version is `1.5.3`.
|
||||||
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
||||||
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
||||||
|
|
||||||
@@ -25,6 +24,8 @@ A Helm chart to install the SPIRE agent.
|
|||||||
|
|
||||||
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||||
|
|
||||||
|
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||||
|
|
||||||
## Parameters
|
## Parameters
|
||||||
|
|
||||||
### Chart parameters
|
### Chart parameters
|
||||||
|
|||||||
@@ -1,25 +0,0 @@
|
|||||||
{{ template "chart.header" . }}
|
|
||||||
|
|
||||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
|
||||||
|
|
||||||
{{ template "chart.deprecationWarning" . }}
|
|
||||||
|
|
||||||
{{ template "chart.badgesSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.description" . }}
|
|
||||||
|
|
||||||
{{ template "chart.homepageLine" . }}
|
|
||||||
|
|
||||||
> **Note**: Minimum Spire version is `1.5.3`.
|
|
||||||
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
|
||||||
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
|
||||||
|
|
||||||
{{ template "chart.maintainersSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.sourcesSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.requirementsSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.valuesSection" . }}
|
|
||||||
|
|
||||||
----------------------------------------------
|
|
||||||
@@ -22,13 +22,13 @@ image:
|
|||||||
## @param imagePullSecrets [array] Pull secrets for images
|
## @param imagePullSecrets [array] Pull secrets for images
|
||||||
imagePullSecrets: []
|
imagePullSecrets: []
|
||||||
|
|
||||||
## @param nameOverride Name override
|
## @param nameOverride Name override
|
||||||
nameOverride: ""
|
nameOverride: ""
|
||||||
|
|
||||||
## @param namespaceOverride Namespace override
|
## @param namespaceOverride Namespace override
|
||||||
namespaceOverride: ""
|
namespaceOverride: ""
|
||||||
|
|
||||||
## @param fullnameOverride Fullname override
|
## @param fullnameOverride Fullname override
|
||||||
fullnameOverride: ""
|
fullnameOverride: ""
|
||||||
|
|
||||||
serviceAccount:
|
serviceAccount:
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ name: spire-server
|
|||||||
description: A Helm chart to install the SPIRE server.
|
description: A Helm chart to install the SPIRE server.
|
||||||
type: application
|
type: application
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
appVersion: "1.8.2"
|
appVersion: "1.8.4"
|
||||||
keywords: ["spiffe", "spire-server", "spire-controller-manager"]
|
keywords: ["spiffe", "spire-server", "spire-controller-manager"]
|
||||||
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
||||||
sources:
|
sources:
|
||||||
|
|||||||
@@ -1,14 +1,13 @@
|
|||||||
# spire-server
|
# spire-server
|
||||||
|
|
||||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
|
||||||
|
|
||||||
  
|
  
|
||||||
|
|
||||||
A Helm chart to install the SPIRE server.
|
A Helm chart to install the SPIRE server.
|
||||||
|
|
||||||
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||||
|
|
||||||
> **Note**: Minimum Spire version is `1.5.3`.
|
> [!Note]
|
||||||
|
> Minimum Spire version is `1.5.3`.
|
||||||
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
||||||
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
||||||
>
|
>
|
||||||
@@ -39,7 +38,8 @@ When Tornjak is enabled, it is exposed on both http and https (if TLS server cer
|
|||||||
|
|
||||||
In addition, you can configure a `client certificate authority`, this will make Tornjak backend verify Client certificates signed by this authority to enable mTLS authentication.
|
In addition, you can configure a `client certificate authority`, this will make Tornjak backend verify Client certificates signed by this authority to enable mTLS authentication.
|
||||||
|
|
||||||
**Warning**: For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access.
|
> [!Important]
|
||||||
|
> For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access.
|
||||||
|
|
||||||
### Tornjak with TLS Connection Type
|
### Tornjak with TLS Connection Type
|
||||||
|
|
||||||
@@ -47,13 +47,13 @@ TLS connection requires Tornjak to have access to TLS key and certificate.
|
|||||||
Complete instruction on creating your own TLS certificate can be found [here](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md).
|
Complete instruction on creating your own TLS certificate can be found [here](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md).
|
||||||
TLS Certificate and the private key must be provided to Tornjak via *TLS Secret*. Prior to deploying this Helm chart, create TLS Secret in the deployment namespace (e.g. `spire-server`)
|
TLS Certificate and the private key must be provided to Tornjak via *TLS Secret*. Prior to deploying this Helm chart, create TLS Secret in the deployment namespace (e.g. `spire-server`)
|
||||||
|
|
||||||
```console
|
```shell
|
||||||
kubectl -n spire-server create secret tls tornjak-tls-secret --cert=client.crt --key=client.key
|
kubectl -n spire-server create secret tls tornjak-tls-secret --cert=client.crt --key=client.key
|
||||||
```
|
```
|
||||||
|
|
||||||
Once the charts are deployed, you can test the TLS connection with the following command (assuming localhost):
|
Once the charts are deployed, you can test the TLS connection with the following command (assuming localhost):
|
||||||
|
|
||||||
```console
|
```shell
|
||||||
curl --cacert CA/rootCA.crt https://localhost:10443
|
curl --cacert CA/rootCA.crt https://localhost:10443
|
||||||
```
|
```
|
||||||
|
|
||||||
@@ -67,13 +67,13 @@ Follow the steps to [create user CA for mTLS](https://github.com/spiffe/tornjak/
|
|||||||
|
|
||||||
Here is an example using a *Secret* in `spire-server` namespace:
|
Here is an example using a *Secret* in `spire-server` namespace:
|
||||||
|
|
||||||
```console
|
```shell
|
||||||
kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt"
|
kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt"
|
||||||
```
|
```
|
||||||
|
|
||||||
Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost):
|
Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost):
|
||||||
|
|
||||||
```console
|
```shell
|
||||||
curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhost:10443
|
curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhost:10443
|
||||||
```
|
```
|
||||||
|
|
||||||
@@ -81,6 +81,8 @@ curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhos
|
|||||||
|
|
||||||
In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above.
|
In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above.
|
||||||
|
|
||||||
|
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||||
|
|
||||||
## Parameters
|
## Parameters
|
||||||
|
|
||||||
### Chart parameters
|
### Chart parameters
|
||||||
@@ -271,48 +273,53 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
|
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
|
||||||
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` |
|
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` |
|
||||||
| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` |
|
| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` |
|
||||||
| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` |
|
|
||||||
| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
### Tornjak
|
||||||
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
|
|
||||||
| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| Name | Description | Value |
|
||||||
| `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||||
| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.4.0` |
|
| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` |
|
||||||
| `tornjak.service.type` | Type of service resource | `ClusterIP` |
|
| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` |
|
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
|
||||||
| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` |
|
| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `tornjak.service.annotations` | Annotations for the service | `{}` |
|
| `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
| `tornjak.ingress.enabled` | Flag to enable ingress for Tornjak backend service | `false` |
|
| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.4.0` |
|
||||||
| `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` |
|
| `tornjak.service.type` | Type of service resource | `ClusterIP` |
|
||||||
| `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` |
|
||||||
| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` |
|
| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` |
|
||||||
| `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` |
|
| `tornjak.service.annotations` | Annotations for the service | `{}` |
|
||||||
| `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
| `tornjak.ingress.enabled` | Flag to enable ingress for Tornjak backend service | `false` |
|
||||||
| `tornjak.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
| `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` |
|
||||||
| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
| `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||||
| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` |
|
| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` |
|
||||||
| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` |
|
| `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` |
|
||||||
| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` |
|
| `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||||
| `tornjak.startupProbe.successThreshold` | Success threshold count | `1` |
|
| `tornjak.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||||
| `tornjak.startupProbe.timeoutSeconds` | Timeout in seconds | `5` |
|
| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||||
| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | |
|
| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` |
|
||||||
| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` |
|
| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` |
|
||||||
| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` |
|
| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` |
|
||||||
| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` |
|
| `tornjak.startupProbe.successThreshold` | Success threshold count | `1` |
|
||||||
| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` |
|
| `tornjak.startupProbe.timeoutSeconds` | Timeout in seconds | `5` |
|
||||||
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
|
| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | |
|
||||||
| `tornjak.resources` | Resource requests and limits | `{}` |
|
| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` |
|
||||||
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
|
| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` |
|
||||||
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
|
| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` |
|
||||||
| `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` |
|
| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` |
|
||||||
| `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` |
|
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
|
||||||
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
| `tornjak.resources` | Resource requests and limits | `{}` |
|
||||||
| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` |
|
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
|
||||||
| `experimental.featureFlags` | List of developer feature flags | `[]` |
|
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
|
||||||
| `tests.hostAliases` | List of host aliases for testing | `[]` |
|
| `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` |
|
||||||
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
|
| `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` |
|
||||||
| `tests.tls.customCA` | Custom CA value for tests | `""` |
|
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
||||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` |
|
||||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
| `experimental.featureFlags` | List of developer feature flags | `[]` |
|
||||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `tests.hostAliases` | List of host aliases for testing | `[]` |
|
||||||
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
|
||||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` |
|
| `tests.tls.customCA` | Custom CA value for tests | `""` |
|
||||||
|
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||||
|
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||||
|
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3d077aae77eb552abd85a015d087047a7a7353d974e5f7fc6a402180c1501214` |
|
||||||
|
|||||||
@@ -212,7 +212,7 @@ federation:
|
|||||||
# If Profile Type == https_spiffe:
|
# If Profile Type == https_spiffe:
|
||||||
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||||
|
|
||||||
## @param federation.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
## @param federation.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||||
host: "spire-server-federation"
|
host: "spire-server-federation"
|
||||||
|
|
||||||
## @param federation.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
## @param federation.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||||
@@ -523,7 +523,7 @@ ingress:
|
|||||||
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||||
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||||
|
|
||||||
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||||
host: "spire-server"
|
host: "spire-server"
|
||||||
|
|
||||||
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||||
@@ -570,7 +570,7 @@ nodeAttestor:
|
|||||||
## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor
|
## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor
|
||||||
serviceAccountAllowList: []
|
serviceAccountAllowList: []
|
||||||
|
|
||||||
# tornjak - Tornjak default values
|
## @section Tornjak
|
||||||
tornjak:
|
tornjak:
|
||||||
## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production)
|
## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production)
|
||||||
enabled: false
|
enabled: false
|
||||||
|
|||||||
@@ -1,7 +1,5 @@
|
|||||||
# tornjak-frontend
|
# tornjak-frontend
|
||||||
|
|
||||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
|
||||||
|
|
||||||
  
|
  
|
||||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||||
|
|
||||||
@@ -11,7 +9,8 @@ A Helm chart to deploy Tornjak frontend
|
|||||||
|
|
||||||
## Version support
|
## Version support
|
||||||
|
|
||||||
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
|
> [!Note]
|
||||||
|
> This Chart is still in development and still subject to change the API (`values.yaml`).
|
||||||
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
|
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
|
||||||
> we do aim for as much stability as possible.
|
> we do aim for as much stability as possible.
|
||||||
|
|
||||||
@@ -52,6 +51,8 @@ port forwarding. See the chart NOTES output for more details.
|
|||||||
|
|
||||||
* <https://github.com/spiffe/tornjak>
|
* <https://github.com/spiffe/tornjak>
|
||||||
|
|
||||||
|
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||||
|
|
||||||
## Parameters
|
## Parameters
|
||||||
|
|
||||||
### Chart parameters
|
### Chart parameters
|
||||||
|
|||||||
@@ -1,54 +0,0 @@
|
|||||||
{{ template "chart.header" . }}
|
|
||||||
|
|
||||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
|
||||||
|
|
||||||
{{ template "chart.deprecationWarning" . }}
|
|
||||||
|
|
||||||
{{ template "chart.badgesSection" . }}
|
|
||||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
|
||||||
|
|
||||||
{{ template "chart.description" . }}
|
|
||||||
|
|
||||||
{{ template "chart.homepageLine" . }}
|
|
||||||
|
|
||||||
## Version support
|
|
||||||
|
|
||||||
> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
|
|
||||||
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
|
|
||||||
> we do aim for as much stability as possible.
|
|
||||||
|
|
||||||
| Dependency | Supported Versions |
|
|
||||||
|:-----------|:-------------------|
|
|
||||||
| SPIRE | `1.5.3+`, `1.6.x` |
|
|
||||||
| Tornjak | `1.0.x` |
|
|
||||||
| Helm | `3.x` |
|
|
||||||
|
|
||||||
## Tornjak
|
|
||||||
|
|
||||||
Tornjak is the UI and Control Plane for SPIRE [https://github.com/spiffe/tornjak](https://github.com/spiffe/tornjak) and it is composed of two components:
|
|
||||||
|
|
||||||
* [Backend](../spire-server/README.md) - Tornjak APIs that extend SPIRE APIs with Control Plane functionality
|
|
||||||
* Frontend (this chart) - Tornjak UI
|
|
||||||
|
|
||||||
## Prerequisites
|
|
||||||
|
|
||||||
This chart requires access to Tornjak Backend (`tornjakFrontend.apiServerURL`).
|
|
||||||
This URL needs to be reachable from your web browser and can therefore not be a cluster internal URL.
|
|
||||||
|
|
||||||
Obtain the URL for Tornjak APIs. If deployed in the same cluster, locally,
|
|
||||||
Tornjak APIs are typically available at `http://localhost:10000`.
|
|
||||||
Review Tornjak documentation for more details.
|
|
||||||
|
|
||||||
## Usage
|
|
||||||
|
|
||||||
Since this is just a demo version, to access Tornjak APIs you can use
|
|
||||||
port forwarding. See the chart NOTES output for more details.
|
|
||||||
|
|
||||||
{{ template "chart.maintainersSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.sourcesSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.requirementsSection" . }}
|
|
||||||
|
|
||||||
{{ template "chart.valuesSection" . }}
|
|
||||||
----------------------------------------------
|
|
||||||
@@ -126,7 +126,7 @@ ingress:
|
|||||||
controllerType: ""
|
controllerType: ""
|
||||||
annotations: {}
|
annotations: {}
|
||||||
|
|
||||||
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||||
host: "tornjak-frontend"
|
host: "tornjak-frontend"
|
||||||
|
|
||||||
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||||
|
|||||||
@@ -1,6 +1,7 @@
|
|||||||
# Recommended setup for installing Spire on Openshift
|
# Recommended setup for installing Spire on Openshift
|
||||||
|
|
||||||
> **Note**: This functionality is under development. It works but has no automated testing and will have security tightened in the future.
|
> [!Note]
|
||||||
|
> This functionality is under development. It works but has no automated testing and will have security tightened in the future.
|
||||||
|
|
||||||
This deployment works only with Openshift version 4.13 or higher. Get the Openshift platform here: [try.openshift.com](try.openshift.com)
|
This deployment works only with Openshift version 4.13 or higher. Get the Openshift platform here: [try.openshift.com](try.openshift.com)
|
||||||
|
|
||||||
@@ -31,7 +32,8 @@ echo "$appdomain"
|
|||||||
|
|
||||||
Update the `example-your-values.yaml` file with your subdomain.
|
Update the `example-your-values.yaml` file with your subdomain.
|
||||||
|
|
||||||
_Note: The location of the apps subdomain may be different in certain environments_
|
> [!Note]
|
||||||
|
> The location of the apps subdomain may be different in certain environments_
|
||||||
|
|
||||||
## Standard Deployment
|
## Standard Deployment
|
||||||
|
|
||||||
@@ -62,7 +64,8 @@ helm upgrade --install --namespace spire-server spire charts/spire \
|
|||||||
Additional features such as tornjak can be enabled by including their example values files before --values examples/production/example-your-values.yaml
|
Additional features such as tornjak can be enabled by including their example values files before --values examples/production/example-your-values.yaml
|
||||||
|
|
||||||
For example:
|
For example:
|
||||||
```
|
|
||||||
|
```shell
|
||||||
--values examples/openshift/openshift-values.yaml \
|
--values examples/openshift/openshift-values.yaml \
|
||||||
--values examples/tornjak/values.yaml \
|
--values examples/tornjak/values.yaml \
|
||||||
--values examples/production/example-your-values.yaml \
|
--values examples/production/example-your-values.yaml \
|
||||||
@@ -71,6 +74,7 @@ For example:
|
|||||||
## Finish install
|
## Finish install
|
||||||
|
|
||||||
Once installed, the namespace security can be tightened back up.
|
Once installed, the namespace security can be tightened back up.
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted --overwrite
|
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted --overwrite
|
||||||
```
|
```
|
||||||
|
|||||||
@@ -28,21 +28,25 @@ If you want to expose your spire-server outside of Kubernetes and are using ingr
|
|||||||
```shell
|
```shell
|
||||||
-f values-expose-spire-server-ingress-nginx.yaml
|
-f values-expose-spire-server-ingress-nginx.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
For example:
|
For example:
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-spire-server-ingress-nginx.yaml
|
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-spire-server-ingress-nginx.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx
|
If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx
|
||||||
you have two options as described here:
|
you have two options as described here:
|
||||||
https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles
|
[github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles](https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles)
|
||||||
|
|
||||||
If you chose profile https_web, use:
|
If you chose profile https_web, use:
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
-f values-expose-federation-https-web-ingress-nginx.yaml
|
-f values-expose-federation-https-web-ingress-nginx.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
For example:
|
For example:
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-web-ingress-nginx.yaml
|
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-web-ingress-nginx.yaml
|
||||||
```
|
```
|
||||||
@@ -52,10 +56,11 @@ If you chose profile https_spiffe, use:
|
|||||||
```shell
|
```shell
|
||||||
-f values-expose-federation-https-spiffe-ingress-nginx.yaml
|
-f values-expose-federation-https-spiffe-ingress-nginx.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
For example:
|
For example:
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-spiffe-ingress-nginx.yaml
|
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-spiffe-ingress-nginx.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
|
See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
|
||||||
|
|
||||||
|
|||||||
@@ -1,6 +1,7 @@
|
|||||||
# Recommended setup to deploy Tornjak
|
# Recommended setup to deploy Tornjak
|
||||||
|
|
||||||
> **Warning**: The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production.
|
> [!Warning]
|
||||||
|
> The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production.
|
||||||
|
|
||||||
To install Spire with the least privileges possible we deploy spire across 2 namespaces.
|
To install Spire with the least privileges possible we deploy spire across 2 namespaces.
|
||||||
|
|
||||||
|
|||||||
+1
-1
@@ -3,7 +3,7 @@
|
|||||||
set -euo pipefail
|
set -euo pipefail
|
||||||
|
|
||||||
SCRIPTPATH=$(dirname "$0")
|
SCRIPTPATH=$(dirname "$0")
|
||||||
README_GENERATOR_VERSION="2.5.1"
|
README_GENERATOR_VERSION="2.6.0"
|
||||||
README_GENERATOR_EXE="readme-generator"
|
README_GENERATOR_EXE="readme-generator"
|
||||||
|
|
||||||
if ! hash "${README_GENERATOR_EXE}" 2>/dev/null; then
|
if ! hash "${README_GENERATOR_EXE}" 2>/dev/null; then
|
||||||
|
|||||||
+2
-1
@@ -117,7 +117,8 @@ git push -u origin --force-with-lease
|
|||||||
cat <<EOF | gh pr create --base main --body-file - "${dry_run}"
|
cat <<EOF | gh pr create --base main --body-file - "${dry_run}"
|
||||||
Please review the below changelog to ensure this matches up with the semantic version being applied.
|
Please review the below changelog to ensure this matches up with the semantic version being applied.
|
||||||
|
|
||||||
> **Note**: **Maintainers** ensure to run following after merging this PR to trigger the release workflow:
|
> [!Note]
|
||||||
|
> **Maintainers** ensure to run following after merging this PR to trigger the release workflow:
|
||||||
>
|
>
|
||||||
> \`\`\`shell
|
> \`\`\`shell
|
||||||
> git checkout main
|
> git checkout main
|
||||||
|
|||||||
Reference in New Issue
Block a user