Merge branch 'main' into release
This commit is contained in:
Faisal Memon
@@ -71,4 +71,4 @@ jq -r '. | keys[]' "$IMAGEJSON" | while read -r CHART; do
|
||||
fi
|
||||
done
|
||||
done
|
||||
"${SCRIPTPATH}/../../helm-docs.sh"
|
||||
"${SCRIPTPATH}/../../helm-docs.sh" || true
|
||||
|
||||
@@ -2,26 +2,26 @@
|
||||
{
|
||||
"name": "kube-prometheus-stack",
|
||||
"repo": "https://prometheus-community.github.io/helm-charts",
|
||||
"version": "48.3.1"
|
||||
"version": "51.8.0"
|
||||
},
|
||||
{
|
||||
"name": "cert-manager",
|
||||
"repo": "https://charts.jetstack.io",
|
||||
"version": "v1.12.3"
|
||||
"version": "v1.13.1"
|
||||
},
|
||||
{
|
||||
"name": "ingress-nginx",
|
||||
"repo": "https://kubernetes.github.io/ingress-nginx",
|
||||
"version": "4.7.1"
|
||||
"version": "4.8.2"
|
||||
},
|
||||
{
|
||||
"name": "mysql",
|
||||
"repo": "https://charts.bitnami.com/bitnami",
|
||||
"version": "9.10.10"
|
||||
"version": "9.12.5"
|
||||
},
|
||||
{
|
||||
"name": "postgresql",
|
||||
"repo": "https://charts.bitnami.com/bitnami",
|
||||
"version": "12.8.2"
|
||||
"version": "13.1.5"
|
||||
}
|
||||
]
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
global:
|
||||
spire:
|
||||
clusterName: production
|
||||
trustDomain: production.other
|
||||
jwtIssuer: oidc-discovery.production.other
|
||||
|
||||
spire-server:
|
||||
controllerManager:
|
||||
enabled: false
|
||||
|
||||
@@ -43,8 +43,8 @@ metadata:
|
||||
name: oidc
|
||||
spec:
|
||||
dnsNames:
|
||||
- oidc-discovery.example.org
|
||||
- spire-server-federation.example.org
|
||||
- oidc-discovery.production.other
|
||||
- spire-server-federation.production.other
|
||||
secretName: tls-cert
|
||||
issuerRef:
|
||||
name: demo-ca
|
||||
|
||||
@@ -20,7 +20,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4.0.0
|
||||
uses: actions/checkout@v4.1.0
|
||||
|
||||
- name: Set up Helm
|
||||
uses: azure/[email protected]
|
||||
@@ -36,6 +36,7 @@ jobs:
|
||||
uses: actions/[email protected]
|
||||
with:
|
||||
go-version: '1.21'
|
||||
cache: false
|
||||
|
||||
- name: Setup crane
|
||||
uses: imjasonh/[email protected]
|
||||
@@ -70,6 +71,7 @@ jobs:
|
||||
signoff: true
|
||||
add-paths: |
|
||||
.github/tests
|
||||
charts
|
||||
|
||||
- name: Check outputs
|
||||
if: ${{ steps.cpr.outputs.pull-request-number }}
|
||||
|
||||
@@ -43,7 +43,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4.0.0
|
||||
uses: actions/checkout@v4.1.0
|
||||
|
||||
- id: set-matrix
|
||||
name: Collect all examples
|
||||
|
||||
@@ -32,7 +32,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4.0.0
|
||||
uses: actions/checkout@v4.1.0
|
||||
|
||||
- name: Verify Docs updated
|
||||
run: ./helm-docs.sh
|
||||
@@ -94,7 +94,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4.0.0
|
||||
uses: actions/checkout@v4.1.0
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
@@ -136,7 +136,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4.0.0
|
||||
uses: actions/checkout@v4.1.0
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
@@ -170,7 +170,8 @@ jobs:
|
||||
|
||||
- name: Run chart-testing (install)
|
||||
run: |
|
||||
ct install --config ct.yaml \
|
||||
helm install -n spire-server spire-crds charts/spire-crds
|
||||
ct install --config ct.yaml --excluded-charts spire-crds \
|
||||
--target-branch ${{ github.base_ref }}
|
||||
|
||||
- name: Test summary
|
||||
@@ -184,7 +185,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4.0.0
|
||||
uses: actions/checkout@v4.1.0
|
||||
|
||||
- id: set-matrix
|
||||
name: Collect all examples
|
||||
@@ -216,7 +217,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4.0.0
|
||||
uses: actions/checkout@v4.1.0
|
||||
|
||||
- name: Set up Helm
|
||||
uses: azure/[email protected]
|
||||
@@ -238,4 +239,48 @@ jobs:
|
||||
verbosity: 1
|
||||
|
||||
- name: Install and test example
|
||||
run: ${{ matrix.example }}/run-tests.sh
|
||||
run: |
|
||||
kubectl create namespace spire-server
|
||||
helm install -n spire-server spire-crds charts/spire-crds
|
||||
${{ matrix.example }}/run-tests.sh
|
||||
|
||||
upgrade-test:
|
||||
runs-on: ubuntu-22.04
|
||||
|
||||
needs:
|
||||
- lint-chart
|
||||
- build-matrix
|
||||
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
k8s:
|
||||
- v1.27.2
|
||||
- v1.26.4
|
||||
- v1.25.9
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/[email protected]
|
||||
|
||||
- name: Set up Helm
|
||||
uses: azure/[email protected]
|
||||
with:
|
||||
version: ${{ env.HELM_VERSION }}
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@v4
|
||||
with:
|
||||
python-version: ${{ env.PYTHON_VERSION }}
|
||||
|
||||
- name: Create kind cluster
|
||||
uses: helm/[email protected]
|
||||
# Only build a kind cluster if there are chart changes to test.
|
||||
with:
|
||||
version: ${{ env.KIND_VERSION }}
|
||||
node_image: kindest/node:v1.26.4
|
||||
config: .github/kind/conf/kind-config.yaml
|
||||
verbosity: 1
|
||||
|
||||
- name: Install and test example
|
||||
run: examples/production/run-tests.sh -u
|
||||
|
||||
@@ -19,7 +19,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4.0.0
|
||||
uses: actions/checkout@v4.1.0
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4.0.0
|
||||
uses: actions/checkout@v4.1.0
|
||||
|
||||
- name: Run Shellcheck
|
||||
uses: ludeeus/[email protected]
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### Contributor Code of Conduct
|
||||
|
||||
We follow the [CNCF Contributor Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md). Additionally, we commit to the following guidelines as detailed on the [Linkerd Code of Conduct](https://github.com/linkerd/linkerd/wiki/Linkerd-code-of-conduct):
|
||||
|
||||
### Community Guidelines
|
||||
|
||||
- Our goal is to foster an inclusive and diverse community of technology enthusiasts.
|
||||
|
||||
- Try to be your best self. Treat your fellow community members with kindness and empathy. We welcome disagreements when they are conducted respectfully and without personal attacks.
|
||||
|
||||
- We ask that you keep unstructured critique to a minimum. Disparaging remarks about the project are unnecessary and a drain on community morale. Feedback should be constructive and relevant. Having passionately held opinions on what should improve is encouraged! We hope you will use that enthusiasm to roll up your sleeves and get involved by submitting pull requests. We have additional guidelines on [how to ask constructive questions](https://github.com/linkerd/linkerd/wiki/How-To-Ask-Questions-in-Slack).
|
||||
|
||||
- We don't tolerate insults, spamming, trolling, flaming, baiting, or harassment. We don't tolerate sexual language, imagery, or unwanted advances. Private harassment is also unacceptable.
|
||||
|
||||
- We do our best to avoid [subtle-isms](https://www.recurse.com/manual#sub-sec-social-rules): small actions that make others feel uncomfortable. If you witness a subtle-ism, you may respectfully point it out to the person publicly or privately, or you may ask a moderator to say something. Accidentally saying something biased is common, expected, and readily forgiven. It is not in and of itself a bannable offense.
|
||||
|
||||
### Moderation
|
||||
|
||||
- If you feel any of SPIFFE's communication channels require moderation, please e-mail the [SPIFFE Steering Committee (SSC)](mailto:[email protected]).
|
||||
+2
-2
@@ -1,7 +1,7 @@
|
||||
# These owners will be the default owners for everything in
|
||||
# the repo. Unless a later match takes precedence,
|
||||
# they will be requested for review when someone opens a
|
||||
# they will be requested for review when someone opens a
|
||||
# pull request.
|
||||
* @marcofranssen @Kfox1111 @developer-guy @dfeldman @faisal-memon @mrsabath @edwbuck
|
||||
* @marcofranssen @Kfox1111 @dfeldman @faisal-memon @mrsabath @edwbuck
|
||||
|
||||
# See CODEOWNERS syntax here: https://help.github.com/articles/about-codeowners/#codeowners-syntax
|
||||
|
||||
@@ -1,9 +1,36 @@
|
||||
# Frequently Asked Questions
|
||||
|
||||
- [How does this repo relate to the helm-charts repo?](#how-does-this-repo-relate-to-the-helm-charts-repo)
|
||||
- [How do I migrate my changeset from the old helm-charts repo to this one?](#how-do-i-migrate-my-changeset-from-the-old-helm-charts-repo-to-this-one)
|
||||
- [How do I update my helm registry to point to this one?](#how-do-i-update-my-helm-registry-to-point-to-this-one)
|
||||
- [Pods are stuck terminating after uninstall. How do I fix it?](#pods-are-stuck-terminating-after-uninstall-how-do-i-fix-it)
|
||||
- [Uninstall is stuck. How do I fix it?](#uninstall-is-stuck-how-do-i-fix-it)
|
||||
- [The PSAT plugin is not working](#the-psat-plugin-is-not-working)
|
||||
|
||||
## How does this repo relate to the helm-charts repo?
|
||||
|
||||
The helm-charts repo has been archived. This repo has all the commit history and releases copied over from that repo and is continuing development to provide a SPIRE helm chart for the community to use and contribute to.
|
||||
|
||||
## How do I migrate my changeset from the old helm-charts repo to this one?
|
||||
|
||||
Run one of these commands to switch to the new repo:
|
||||
|
||||
- If working off a branch (maintainers with write access): `git remote set-url origin [email protected]:spiffe/helm-charts-hardened.git`
|
||||
- If working off a fork:
|
||||
1. Create a new fork of helm-charts-hardened
|
||||
1. In your local clone of your old fork of helm-charts: `git remote set-url origin https://github.com/<your new fork>/helm-charts-hardened.git`
|
||||
|
||||
Then just `git push` your branches. Git history has been migrated over so you can just push your existing branches without issues.
|
||||
|
||||
## How do I update my helm registry to point to this one?
|
||||
|
||||
Assuming you named the repo `spiffe`:
|
||||
|
||||
``` bash
|
||||
helm repo remove spiffe
|
||||
helm repo add spiffe https://spiffe.github.io/helm-charts-hardened
|
||||
```
|
||||
|
||||
## Pods are stuck terminating after uninstall. How do I fix it?
|
||||
|
||||
If you uninstall the SPIRE chart before all users of the CSI driver are removed, Pods will get stuck in a terminating state waiting for the driver, that no longer is installed, to unmount the volumes for the Pod. In order to fix this, reinstall the chart and remove all affected workloads that are not part of the SPIRE helm chart itself, before attempting to remove SPIRE again.
|
||||
|
||||
@@ -21,7 +21,7 @@ Unless otherwise noted in an application chart README, the following dependencie
|
||||
|
||||
| Dependency | Supported Versions |
|
||||
|:-----------|:-------------------|
|
||||
| SPIRE | `1.6.x`, `1.7.x` |
|
||||
| SPIRE | `1.8.2` |
|
||||
| Helm | `3.x` |
|
||||
| Kubernetes | `1.22+` |
|
||||
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: v2
|
||||
name: spire-crds
|
||||
description: >
|
||||
A Helm chart for deploying the Spire CRDS
|
||||
type: application
|
||||
version: 0.0.1
|
||||
appVersion: "0.0.1"
|
||||
keywords: ["spire-crds"]
|
||||
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
||||
sources:
|
||||
- https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
||||
icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
|
||||
maintainers:
|
||||
- name: marcofranssen
|
||||
email: [email protected]
|
||||
url: https://marcofranssen.nl
|
||||
- name: kfox1111
|
||||
email: [email protected]
|
||||
- name: faisal-memon
|
||||
email: [email protected]
|
||||
- name: edwbuck
|
||||
email: [email protected]
|
||||
@@ -0,0 +1,23 @@
|
||||
# spire-crds
|
||||
|
||||
  
|
||||
|
||||
A Helm chart to install the SPIRE CRDS.
|
||||
|
||||
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
## Maintainers
|
||||
| Name | Email | Url |
|
||||
| ---- | ------ | --- |
|
||||
| marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
|
||||
| kfox1111 | <Kevin.Fox@pnnl.gov> | |
|
||||
| faisal-memon | <fymemon@yahoo.com> | |
|
||||
| edwbuck | <edwbuck@gmail.com> | |
|
||||
|
||||
## Source Code
|
||||
|
||||
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
||||
|
||||
<!-- The Parameters section is generated using helm-docs.sh -->
|
||||
|
||||
## Parameters
|
||||
+2
-7
@@ -3,7 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.8.0
|
||||
controller-gen.kubebuilder.io/version: v0.11.1
|
||||
{{- .Values.annotations | toYaml | nindent 4 }}
|
||||
creationTimestamp: null
|
||||
name: clusterfederatedtrustdomains.spire.spiffe.io
|
||||
spec:
|
||||
@@ -88,9 +89,3 @@ spec:
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
+16
-11
@@ -3,7 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.8.0
|
||||
controller-gen.kubebuilder.io/version: v0.11.1
|
||||
{{- .Values.annotations | toYaml | nindent 4 }}
|
||||
creationTimestamp: null
|
||||
name: clusterspiffeids.spire.spiffe.io
|
||||
spec:
|
||||
@@ -48,14 +49,22 @@ spec:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
downstream:
|
||||
description: Downstream indicates that the entry describes a downstream
|
||||
SPIRE server.
|
||||
type: boolean
|
||||
federatesWith:
|
||||
description: FederatesWith is a list of trust domain names that workloads
|
||||
that obtain this SPIFFE ID will federate with.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
jwtTtl:
|
||||
description: JWTTTL indicates an upper-bound time-to-live for JWT
|
||||
SVIDs minted for this ClusterSPIFFEID.
|
||||
type: string
|
||||
namespaceSelector:
|
||||
description: NamespaceSelector selects the namespaces that are targetted
|
||||
description: NamespaceSelector selects the namespaces that are targeted
|
||||
by this CRD.
|
||||
properties:
|
||||
matchExpressions:
|
||||
@@ -99,8 +108,9 @@ spec:
|
||||
are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
podSelector:
|
||||
description: PodSelector selects the pods that are targetted by this
|
||||
description: PodSelector selects the pods that are targeted by this
|
||||
CRD.
|
||||
properties:
|
||||
matchExpressions:
|
||||
@@ -144,14 +154,15 @@ spec:
|
||||
are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
spiffeIDTemplate:
|
||||
description: SPIFFEID is the SPIFFE ID template. The node and pod
|
||||
spec are made available to the template under .NodeSpec, .PodSpec
|
||||
respectively.
|
||||
type: string
|
||||
ttl:
|
||||
description: TTL indicates an upper-bound time-to-live for SVIDs minted
|
||||
for this ClusterSPIFFEID. If unset, a default will be chosen.
|
||||
description: TTL indicates an upper-bound time-to-live for X509 SVIDs
|
||||
minted for this ClusterSPIFFEID. If unset, a default will be chosen.
|
||||
type: string
|
||||
workloadSelectorTemplates:
|
||||
description: WorkloadSelectorTemplates are templates to produce arbitrary
|
||||
@@ -213,9 +224,3 @@ spec:
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
@@ -0,0 +1,92 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.11.1
|
||||
{{- .Values.annotations | toYaml | nindent 4 }}
|
||||
creationTimestamp: null
|
||||
name: clusterstaticentries.spire.spiffe.io
|
||||
spec:
|
||||
group: spire.spiffe.io
|
||||
names:
|
||||
kind: ClusterStaticEntry
|
||||
listKind: ClusterStaticEntryList
|
||||
plural: clusterstaticentries
|
||||
singular: clusterstaticentry
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ClusterStaticEntry is the Schema for the clusterstaticentries
|
||||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ClusterStaticEntrySpec defines the desired state of ClusterStaticEntry
|
||||
properties:
|
||||
admin:
|
||||
type: boolean
|
||||
dnsNames:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
downstream:
|
||||
type: boolean
|
||||
federatesWith:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
hint:
|
||||
type: string
|
||||
jwtSVIDTTL:
|
||||
type: string
|
||||
parentID:
|
||||
type: string
|
||||
selectors:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
spiffeID:
|
||||
type: string
|
||||
x509SVIDTTL:
|
||||
type: string
|
||||
required:
|
||||
- parentID
|
||||
- selectors
|
||||
- spiffeID
|
||||
type: object
|
||||
status:
|
||||
description: ClusterStaticEntryStatus defines the observed state of ClusterStaticEntry
|
||||
properties:
|
||||
masked:
|
||||
description: If the static entry was masked by another entry.
|
||||
type: boolean
|
||||
rendered:
|
||||
description: If the static entry rendered properly.
|
||||
type: boolean
|
||||
set:
|
||||
description: If the static entry was successfully created/updated.
|
||||
type: boolean
|
||||
required:
|
||||
- masked
|
||||
- rendered
|
||||
- set
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
+1
@@ -4,6 +4,7 @@ kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.8.0
|
||||
{{- .Values.annotations | toYaml | nindent 4 }}
|
||||
creationTimestamp: null
|
||||
name: controllermanagerconfigs.spire.spiffe.io
|
||||
spec:
|
||||
@@ -0,0 +1,3 @@
|
||||
annotations:
|
||||
## @param annotations.helm.sh/resource-policy keep the crds after chart deletion
|
||||
helm.sh/resource-policy: keep
|
||||
@@ -3,8 +3,8 @@ name: spire
|
||||
description: >
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
type: application
|
||||
version: 0.13.2
|
||||
appVersion: "1.7.4"
|
||||
version: 0.14.0
|
||||
appVersion: "1.8.2"
|
||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
+35
-1
@@ -1,6 +1,6 @@
|
||||
# spire
|
||||
|
||||
  
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
@@ -83,6 +83,39 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| file://./charts/spire-server | spire-server | 0.1.0 |
|
||||
| file://./charts/tornjak-frontend | tornjak-frontend | 0.1.0 |
|
||||
|
||||
## Install notes
|
||||
|
||||
To do a quick non production install:
|
||||
|
||||
```shell
|
||||
kubectl create namespace spire-system
|
||||
helm install -n spire-system spire-crds charts/spire-crds
|
||||
helm install -n spire-system spire charts/spire
|
||||
|
||||
For production installs, please see [the production example](examples/production/).
|
||||
|
||||
## Upgrade notes
|
||||
|
||||
0.14.X:
|
||||
|
||||
If coming from a chart version before 0.14.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart
|
||||
run the following:
|
||||
|
||||
```shell
|
||||
# Replace the spire-server namespace in the commands below with the namespace you want to install the spire-crds chart in.
|
||||
|
||||
kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
helm install -n spire-server spire-crds charts/spire-crds
|
||||
```
|
||||
|
||||
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||
|
||||
## Parameters
|
||||
@@ -98,6 +131,7 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` |
|
||||
| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` |
|
||||
| `global.spire.image.registry` | Override all Spire image registries at once | `""` |
|
||||
| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` |
|
||||
| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||
| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||
|
||||
|
||||
@@ -57,7 +57,7 @@ A Helm chart to install the SPIFFE CSI driver.
|
||||
| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` |
|
||||
| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeDriverRegistrar.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.8.0` |
|
||||
| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.0` |
|
||||
| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` |
|
||||
| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||
| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` |
|
||||
|
||||
@@ -104,7 +104,7 @@ nodeDriverRegistrar:
|
||||
repository: sig-storage/csi-node-driver-registrar
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: v2.8.0
|
||||
tag: v2.9.0
|
||||
## @param nodeDriverRegistrar.resources Resource requests and limits for CSI driver pods
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider
|
||||
description: A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.7.4"
|
||||
appVersion: "1.8.2"
|
||||
keywords: ["spiffe", "oidc"]
|
||||
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -57,7 +57,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` |
|
||||
| `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.24.0-alpine` |
|
||||
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.2-alpine` |
|
||||
| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` |
|
||||
| `jwtIssuer` | Path to JWT issuer | `https://oidc-discovery.example.org` |
|
||||
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||
@@ -106,17 +106,17 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` |
|
||||
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` |
|
||||
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d717d0a2c88518f8e36d9cfe1571639a40617e8c4291e34876d46bdeefb1ab5a` |
|
||||
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:57151ad9f998c9394c9ba8b66c83f70cbfe3d4b733c166c9856e0d8fb273bfd0` |
|
||||
| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` |
|
||||
| `tests.busybox.image.repository` | The repository within the registry | `busybox` |
|
||||
| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.busybox.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `uclibc@sha256:3e516f71d8801b0ce6c3f8f8e4f11093ec04e168177a90f1da4498014ee06b6b` |
|
||||
| `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` |
|
||||
| `tests.agent.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `tests.agent.image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
||||
| `tests.agent.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
|
||||
@@ -1,3 +1,5 @@
|
||||
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
|
||||
{{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}}
|
||||
{{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }}
|
||||
{{- define "spiffe-oidc-discovery-provider.yaml-config" -}}
|
||||
{{- $oidcSocket := .oidcSocket }}
|
||||
|
||||
@@ -111,7 +111,7 @@ insecureScheme:
|
||||
repository: nginxinc/nginx-unprivileged
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: 1.24.0-alpine
|
||||
tag: 1.25.2-alpine
|
||||
## @param insecureScheme.nginx.resources Resource requests and limits
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
@@ -280,7 +280,7 @@ tests:
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4
|
||||
tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c
|
||||
|
||||
toolkit:
|
||||
## @param tests.toolkit.image.registry The OCI registry to pull the image from
|
||||
@@ -294,7 +294,7 @@ tests:
|
||||
repository: chainguard/slim-toolkit-debug
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: latest@sha256:d717d0a2c88518f8e36d9cfe1571639a40617e8c4291e34876d46bdeefb1ab5a
|
||||
tag: latest@sha256:57151ad9f998c9394c9ba8b66c83f70cbfe3d4b733c166c9856e0d8fb273bfd0
|
||||
|
||||
busybox:
|
||||
## @param tests.busybox.image.registry The OCI registry to pull the image from
|
||||
@@ -308,7 +308,7 @@ tests:
|
||||
repository: busybox
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: uclibc@sha256:3e516f71d8801b0ce6c3f8f8e4f11093ec04e168177a90f1da4498014ee06b6b
|
||||
tag: 1.36.1-uclibc
|
||||
|
||||
agent:
|
||||
## @param tests.agent.image.registry The OCI registry to pull the image from
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire-agent
|
||||
description: A Helm chart to install the SPIRE agent.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.7.4"
|
||||
appVersion: "1.8.2"
|
||||
keywords: ["spiffe", "spire-agent"]
|
||||
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -68,15 +68,16 @@ A Helm chart to install the SPIRE agent.
|
||||
| `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` |
|
||||
| `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `waitForIt.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:deeaccb164a67a4d7f585c4d416641b1f422c029911a29d72beae28221f823df` |
|
||||
| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5b836d1a4c652ec1c56bdd4a05a43349e2eeff50cf7fdb45a356f0ddc578573b` |
|
||||
| `waitForIt.resources` | Resource requests and limits | `{}` |
|
||||
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `fsGroupFix.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` |
|
||||
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
|
||||
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
|
||||
| `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` |
|
||||
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
|
||||
| `sds.enabled` | Enables Envoy SDS configuration | `false` |
|
||||
@@ -96,3 +97,10 @@ A Helm chart to install the SPIRE agent.
|
||||
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
|
||||
| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` |
|
||||
| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` |
|
||||
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
|
||||
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
|
||||
| `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` |
|
||||
| `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` |
|
||||
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
||||
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
|
||||
| `experimental.featureFlags` | List of developer feature flags | `[]` |
|
||||
|
||||
@@ -1,3 +1,23 @@
|
||||
{{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}}
|
||||
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
|
||||
{{- range $type, $tvals := .Values.customPlugins }}
|
||||
{{- if not (has $type (list "keyManager" "nodeAttestor" "svidStore" "workloadAttestor")) }}
|
||||
{{- fail (printf "Unknown plugin type specified: %s" $type) }}
|
||||
{{- end }}
|
||||
{{- range $name, $nval := $tvals }}
|
||||
{{- if not (hasKey $nval "plugin_cmd") }}
|
||||
{{- fail (printf "plugin_cmd is a required field. %s" $name) }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey $nval "plugin_checksum") }}
|
||||
{{- fail (printf "plugin_checksum is a required field.") }}
|
||||
{{- end }}
|
||||
{{- range $sname, $svals := $nval }}
|
||||
{{- if not (has $sname (list "plugin_cmd" "plugin_checksum" "plugin_data")) }}
|
||||
{{- fail (printf "Unknown plugin setting specified: %s" $sname) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- define "spire-agent.yaml-config" -}}
|
||||
agent:
|
||||
data_dir: "/run/spire"
|
||||
@@ -20,28 +40,43 @@ agent:
|
||||
disable_spiffe_cert_validation: {{ .Values.sds.disableSpiffeCertValidation }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.experimental }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
experimental:
|
||||
sync_interval: {{ .syncInterval | quote }}
|
||||
{{- if gt (len .featureFlags) 0 }}
|
||||
feature_flags:
|
||||
{{- range .featureFlags }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
plugins:
|
||||
NodeAttestor:
|
||||
- k8s_psat:
|
||||
plugin_data:
|
||||
cluster: {{ include "spire-lib.cluster-name" . | quote }}
|
||||
k8s_psat:
|
||||
plugin_data:
|
||||
cluster: {{ include "spire-lib.cluster-name" . | quote }}
|
||||
|
||||
KeyManager:
|
||||
- memory:
|
||||
plugin_data:
|
||||
memory:
|
||||
plugin_data:
|
||||
|
||||
WorkloadAttestor:
|
||||
- k8s:
|
||||
plugin_data:
|
||||
# Defaults to the secure kubelet port by default.
|
||||
# Minikube does not have a cert in the cluster CA bundle that
|
||||
# can authenticate the kubelet cert, so skip validation.
|
||||
skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }}
|
||||
disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }}
|
||||
{{- if .Values.workloadAttestors.k8s.enabled }}
|
||||
k8s:
|
||||
plugin_data:
|
||||
# Defaults to the secure kubelet port by default.
|
||||
# Minikube does not have a cert in the cluster CA bundle that
|
||||
# can authenticate the kubelet cert, so skip validation.
|
||||
skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }}
|
||||
disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.workloadAttestors.unix.enabled }}
|
||||
- unix:
|
||||
plugin_data:
|
||||
unix:
|
||||
plugin_data:
|
||||
{{- end }}
|
||||
|
||||
health_checks:
|
||||
@@ -69,4 +104,4 @@ metadata:
|
||||
{{- end }}
|
||||
data:
|
||||
agent.conf: |
|
||||
{{- include "spire-agent.yaml-config" . | fromYaml | toPrettyJson | nindent 4 }}
|
||||
{{- include "spire-lib.reformat-and-yaml2json" (dict "config" (include "spire-agent.yaml-config" .) "root" .) | nindent 4 }}
|
||||
|
||||
@@ -134,7 +134,7 @@ waitForIt:
|
||||
repository: chainguard/wait-for-it
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: latest@sha256:deeaccb164a67a4d7f585c4d416641b1f422c029911a29d72beae28221f823df
|
||||
tag: latest@sha256:5b836d1a4c652ec1c56bdd4a05a43349e2eeff50cf7fdb45a356f0ddc578573b
|
||||
|
||||
## @param waitForIt.resources [object] Resource requests and limits
|
||||
resources: {}
|
||||
@@ -153,7 +153,7 @@ fsGroupFix:
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
version: ""
|
||||
tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4
|
||||
tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c
|
||||
|
||||
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
@@ -165,6 +165,8 @@ workloadAttestors:
|
||||
## @param workloadAttestors.unix.enabled Enables the Unix workload attestor
|
||||
enabled: false
|
||||
k8s:
|
||||
## @param workloadAttestors.k8s.enabled Enables the Kubernetes workload attestor
|
||||
enabled: true
|
||||
## @param workloadAttestors.k8s.skipKubeletVerification If true, kubelet certificate verification is skipped
|
||||
skipKubeletVerification: true
|
||||
## @param workloadAttestors.k8s.disableContainerSelectors Set to true if using holdApplicationUntilProxyStarts in Istio
|
||||
@@ -215,3 +217,31 @@ extraContainers: []
|
||||
initContainers: []
|
||||
## @param hostAliases [array] Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/
|
||||
hostAliases: []
|
||||
|
||||
# NOTE: This is unsupported and only to configure currently supported spire built in plugins but plugins unsupported by the chart.
|
||||
# Upgrades wont be tested for anything under this config. If you need this, please let the chart developers know your needs so we
|
||||
# can prioritize proper support.
|
||||
## @skip unsupportedBuiltInPlugins
|
||||
unsupportedBuiltInPlugins:
|
||||
keyManager: {}
|
||||
nodeAttestor: {}
|
||||
svidStore: {}
|
||||
workloadAttestor: {}
|
||||
|
||||
## @param customPlugins.keyManager Custom plugins of type KeyManager are configured here
|
||||
## @param customPlugins.nodeAttestor Custom plugins of type NodeAttestor are configured here
|
||||
## @param customPlugins.svidStore Custom plugins of type SVIDStore are configured here
|
||||
## @param customPlugins.workloadAttestor Custom plugins of type WorkloadAttestor are configured here
|
||||
customPlugins:
|
||||
keyManager: {}
|
||||
nodeAttestor: {}
|
||||
svidStore: {}
|
||||
workloadAttestor: {}
|
||||
|
||||
experimental:
|
||||
## @param experimental.enabled Allow configuration of experimental features
|
||||
enabled: false
|
||||
## @param experimental.syncInterval Sync interval with SPIRE server with exponential backoff
|
||||
syncInterval: 5s
|
||||
## @param experimental.featureFlags [array] List of developer feature flags
|
||||
featureFlags: []
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire-server
|
||||
description: A Helm chart to install the SPIRE server.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.7.4"
|
||||
appVersion: "1.8.2"
|
||||
keywords: ["spiffe", "spire-server", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -153,7 +153,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||
| `federation.ingress.hosts` | Host paths for ingress object | `[]` |
|
||||
| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
|
||||
| `ca_subject.country` | Country for Spire server CA | `NL` |
|
||||
| `ca_subject.country` | Country for Spire server CA | `ARPA` |
|
||||
| `ca_subject.organization` | Organization for Spire server CA | `Example` |
|
||||
| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` |
|
||||
| `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` |
|
||||
@@ -218,7 +218,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
||||
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.2.3` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.3.0` |
|
||||
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
||||
| `controllerManager.securityContext` | Security context | `{}` |
|
||||
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
||||
@@ -262,11 +262,16 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
|
||||
| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.2.2` |
|
||||
| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.4.0` |
|
||||
| `tornjak.service.type` | Type of service resource | `ClusterIP` |
|
||||
| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` |
|
||||
| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` |
|
||||
| `tornjak.service.annotations` | Annotations for the service | `{}` |
|
||||
| `tornjak.ingress.enabled` | Flag to enable ingress for Tornjak backend service | `false` |
|
||||
| `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` |
|
||||
| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` |
|
||||
| `tornjak.ingress.hosts` | Host paths for ingress Tornjak backend service | `[]` |
|
||||
| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress | `[]` |
|
||||
| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` |
|
||||
| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` |
|
||||
| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` |
|
||||
@@ -279,6 +284,13 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` |
|
||||
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
|
||||
| `tornjak.resources` | Resource requests and limits | `{}` |
|
||||
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
|
||||
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
|
||||
| `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` |
|
||||
| `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` |
|
||||
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
||||
| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` |
|
||||
| `experimental.featureFlags` | List of developer feature flags | `[]` |
|
||||
| `tests.hostAliases` | List of host aliases for testing | `[]` |
|
||||
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
|
||||
| `tests.tls.customCA` | Custom CA value for tests | `""` |
|
||||
@@ -286,4 +298,4 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` |
|
||||
|
||||
@@ -217,52 +217,3 @@ The code below determines what connection type should be used.
|
||||
{{- end }}
|
||||
{{ $args | toYaml }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Take a copy of the config and merge in .Values.customPlugins and .Values.unsupportedBuiltInPlugins passed through as root.
|
||||
*/}}
|
||||
{{- define "spire-server.config_merge" }}
|
||||
{{- $pluginsToMerge := dict "plugins" dict }}
|
||||
{{- range $type, $val := .root.Values.customPlugins }}
|
||||
{{- if . }}
|
||||
{{- $nt := printf "%s%s" (substr 0 1 $type | upper) (substr 1 -1 $type) }}
|
||||
{{- $_ := set $pluginsToMerge.plugins $nt (deepCopy $val) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $type, $val := .root.Values.unsupportedBuiltInPlugins }}
|
||||
{{- if . }}
|
||||
{{- $nt := printf "%s%s" (substr 0 1 $type | upper) (substr 1 -1 $type) }}
|
||||
{{- $_ := set $pluginsToMerge.plugins $nt (deepCopy $val) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- $newConfig := .config | fromYaml | mustMerge $pluginsToMerge }}
|
||||
{{- $newConfig | toYaml }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Take a copy of the plugin section and return a yaml string based version
|
||||
reformatted from a dict of dicts to a dict of lists of dicts
|
||||
*/}}
|
||||
{{- define "spire-server.plugins_reformat" }}
|
||||
{{- range $type, $v := . }}
|
||||
{{ $type }}:
|
||||
{{- range $name, $v2 := $v }}
|
||||
- {{ $name }}: {{ $v2 | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Take a copy of the config as a yaml config and root var.
|
||||
Merge in .root.Values.customPlugins and .Values.unsupportedBuiltInPlugins into config,
|
||||
Reformat the plugin section from a dict of dicts to a dict of lists of dicts,
|
||||
and export it back as as json string.
|
||||
This makes it much easier for users to merge in plugin configs, as dicts are easier
|
||||
to merge in values, but spire needs arrays.
|
||||
*/}}
|
||||
{{- define "spire-server.reformat-and-yaml2json" -}}
|
||||
{{- $config := include "spire-server.config_merge" . | fromYaml }}
|
||||
{{- $plugins := include "spire-server.plugins_reformat" $config.plugins | fromYaml }}
|
||||
{{- $_ := set $config "plugins" $plugins }}
|
||||
{{- $config | toPrettyJson }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
{{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}}
|
||||
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
|
||||
{{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}}
|
||||
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.county must be set" (eq .Values.ca_subject.country "ARPA"))}}
|
||||
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.organization must be set" (eq .Values.ca_subject.organization "Example"))}}
|
||||
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.common_name must be set" (eq .Values.ca_subject.common_name "example.org"))}}
|
||||
{{- range $type, $tvals := .Values.customPlugins }}
|
||||
{{- if not (has $type (list "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }}
|
||||
{{- fail (printf "Unknown plugin type specified: %s" $type) }}
|
||||
@@ -49,6 +55,19 @@ server:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.experimental }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
experimental:
|
||||
cache_reload_interval: {{ .cacheReloadInterval | quote }}
|
||||
{{- if gt (len .featureFlags) 0 }}
|
||||
feature_flags:
|
||||
{{- range .featureFlags }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
plugins:
|
||||
DataStore:
|
||||
sql:
|
||||
@@ -241,4 +260,4 @@ metadata:
|
||||
{{- end }}
|
||||
data:
|
||||
server.conf: |
|
||||
{{- include "spire-server.reformat-and-yaml2json" (dict "config" (include "spire-server.yaml-config" .) "root" .) | nindent 4 }}
|
||||
{{- include "spire-lib.reformat-and-yaml2json" (dict "config" (include "spire-server.yaml-config" .) "root" .) | nindent 4 }}
|
||||
|
||||
@@ -64,6 +64,15 @@ rules:
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterspiffeids/status"]
|
||||
verbs: ["get", "patch", "update"]
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterstaticentries"]
|
||||
verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterstaticentries/finalizers"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterstaticentries/status"]
|
||||
verbs: ["get", "patch", "update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
{{- if .Values.tornjak.ingress.enabled -}}
|
||||
{{- $fullName := include "spire-tornjak.fullname" . -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
namespace: {{ include "spire-server.namespace" . }}
|
||||
labels:
|
||||
{{ include "spire-server.labels" . | nindent 4}}
|
||||
{{- with .Values.tornjak.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if eq (include "spire-tornjak.connectionType" .) "http" }}
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-http") | nindent 2 }}
|
||||
{{- else -}}
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-https") | nindent 2 }}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
@@ -225,7 +225,7 @@ federation:
|
||||
|
||||
ca_subject:
|
||||
## @param ca_subject.country Country for Spire server CA
|
||||
country: NL
|
||||
country: ARPA
|
||||
## @param ca_subject.organization Organization for Spire server CA
|
||||
organization: Example
|
||||
## @param ca_subject.common_name Common Name for Spire server CA
|
||||
@@ -309,7 +309,7 @@ upstreamAuthority:
|
||||
## @param upstreamAuthority.certManager.ca.create Creates a Cert-Manager CA
|
||||
create: false
|
||||
## @param upstreamAuthority.certManager.ca.duration Duration of the CA. Defaults to 10 years
|
||||
duration: 87600h
|
||||
duration: 87600h
|
||||
privateKey:
|
||||
## @param upstreamAuthority.certManager.ca.privateKey.algorithm Algorithm to generate private key for CA
|
||||
algorithm: ECDSA
|
||||
@@ -386,7 +386,7 @@ controllerManager:
|
||||
repository: spiffe/spire-controller-manager
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: "0.2.3"
|
||||
tag: "0.3.0"
|
||||
|
||||
## @param controllerManager.resources [object] Resource requests and limits for controller manager
|
||||
resources: {}
|
||||
@@ -549,7 +549,7 @@ tornjak:
|
||||
repository: spiffe/tornjak-backend
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: "v1.2.2"
|
||||
tag: "v1.4.0"
|
||||
|
||||
service:
|
||||
## @param tornjak.service.type Type of service resource
|
||||
@@ -562,6 +562,25 @@ tornjak:
|
||||
## @param tornjak.service.annotations [object] Annotations for the service
|
||||
annotations: {}
|
||||
|
||||
## @param tornjak.ingress.enabled Flag to enable ingress for Tornjak backend service
|
||||
## @param tornjak.ingress.className Ingress class name for Tornjak backend service
|
||||
## @param tornjak.ingress.annotations [object] Annotations for Tornjak backend service
|
||||
## @param tornjak.ingress.hosts [array] Host paths for ingress Tornjak backend service
|
||||
ingress:
|
||||
enabled: false
|
||||
className: ""
|
||||
annotations: {}
|
||||
hosts:
|
||||
- host: tornjak-backend.example.org
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
## @param tornjak.ingress.tls [array] Secrets containing TLS certs to enable https on ingress
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
# - tornjak-backend.example.org
|
||||
|
||||
## @param tornjak.startupProbe.failureThreshold Failure threshold count
|
||||
## @param tornjak.startupProbe.initialDelaySeconds Initial delay seconds
|
||||
## @param tornjak.startupProbe.periodSeconds Period seconds
|
||||
@@ -621,13 +640,24 @@ unsupportedBuiltInPlugins:
|
||||
upstreamAuthority: {}
|
||||
notifier: {}
|
||||
|
||||
## @skip customPlugins
|
||||
## @param customPlugins.keyManager Custom plugins of type KeyManager are configured here
|
||||
## @param customPlugins.nodeAttestor Custom plugins of type NodeAttestor are configured here
|
||||
## @param customPlugins.upstreamAuthority Custom plugins of type upstreamAuthority are configured here
|
||||
## @param customPlugins.notifier Custom plugins of type notifier are configured here
|
||||
customPlugins:
|
||||
keyManager: {}
|
||||
nodeAttestor: {}
|
||||
upstreamAuthority: {}
|
||||
notifier: {}
|
||||
|
||||
experimental:
|
||||
## @param experimental.enabled Allow configuration of experimental features
|
||||
enabled: false
|
||||
## @param experimental.cacheReloadInterval The amount of time between two reloads of the in-memory entry cache.
|
||||
cacheReloadInterval: 5s
|
||||
## @param experimental.featureFlags [array] List of developer feature flags
|
||||
featureFlags: []
|
||||
|
||||
tests:
|
||||
## @param tests.hostAliases [array] List of host aliases for testing
|
||||
hostAliases: []
|
||||
@@ -648,4 +678,4 @@ tests:
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4
|
||||
tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c
|
||||
|
||||
@@ -3,7 +3,7 @@ name: tornjak-frontend
|
||||
description: A Helm chart to deploy Tornjak frontend
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "v1.2.2"
|
||||
appVersion: "v1.4.0"
|
||||
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
|
||||
sources:
|
||||
- https://github.com/spiffe/tornjak
|
||||
|
||||
@@ -88,8 +88,13 @@ port forwarding. See the chart NOTES output for more details.
|
||||
| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
|
||||
| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` |
|
||||
| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` |
|
||||
| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` |
|
||||
| `ingress.className` | Ingress class name for Tornjak frontend service | `""` |
|
||||
| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` |
|
||||
| `ingress.hosts` | Host paths for ingress Tornjak frontend service | `[]` |
|
||||
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress | `[]` |
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c` |
|
||||
|
||||
@@ -0,0 +1,16 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $fullName := include "tornjak-frontend.fullname" . -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
namespace: {{ include "tornjak-frontend.namespace" . }}
|
||||
labels:
|
||||
{{ include "tornjak-frontend.labels" . | nindent 4}}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -22,13 +22,13 @@ image:
|
||||
## @param imagePullSecrets [array] Pull secrets for images
|
||||
imagePullSecrets: []
|
||||
|
||||
## @param nameOverride Name override
|
||||
## @param nameOverride Name override
|
||||
nameOverride: ""
|
||||
|
||||
## @param namespaceOverride Namespace override
|
||||
## @param namespaceOverride Namespace override
|
||||
namespaceOverride: ""
|
||||
|
||||
## @param fullnameOverride Fullname override
|
||||
## @param fullnameOverride Fullname override
|
||||
fullnameOverride: ""
|
||||
|
||||
## @param serviceAccount.create Specifies whether a service account should be created
|
||||
@@ -113,6 +113,25 @@ startupProbe:
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
|
||||
## @param ingress.enabled Flag to enable ingress for Tornjak frontend service
|
||||
## @param ingress.className Ingress class name for Tornjak frontend service
|
||||
## @param ingress.annotations [object] Annotations for Tornjak frontend service
|
||||
## @param ingress.hosts [array] Host paths for ingress Tornjak frontend service
|
||||
ingress:
|
||||
enabled: false
|
||||
className: ""
|
||||
annotations: {}
|
||||
hosts:
|
||||
- host: tornjak-frontend.example.org
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
# - tornjak-frontend.example.org
|
||||
|
||||
tests:
|
||||
bash:
|
||||
## @param tests.bash.image.registry The OCI registry to pull the image from
|
||||
@@ -126,4 +145,4 @@ tests:
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4
|
||||
tag: latest@sha256:cdf09d9d48e2b78e4a31dbbeba03e34b9462a35fa55defe67d73c440dbacca2c
|
||||
|
||||
@@ -1,8 +1,23 @@
|
||||
Installed {{ .Chart.Name }}…
|
||||
{{- $up := (index .Values "spire-server").unsupportedBuiltInPlugins }}
|
||||
{{- $s := add (len $up.keyManager) (len $up.nodeAttestor) (len $up.upstreamAuthority) (len $up.notifier) }}
|
||||
{{- $s := 0 }}
|
||||
{{- if (index .Values "spire-server").enabled }}
|
||||
{{- $up := (index .Values "spire-server").unsupportedBuiltInPlugins }}
|
||||
{{- $s = add (len $up.keyManager) (len $up.nodeAttestor) (len $up.upstreamAuthority) (len $up.notifier) $s }}
|
||||
{{- end }}
|
||||
{{- if (index .Values "spire-agent").enabled }}
|
||||
{{- $up := (index .Values "spire-agent").unsupportedBuiltInPlugins }}
|
||||
{{- $s = add (len $up.keyManager) (len $up.nodeAttestor) (len $up.svidStore) (len $up.workloadAttestor) $s }}
|
||||
{{- end }}
|
||||
{{- if (index .Values "upstream-spire-agent").enabled }}
|
||||
{{- $up := (index .Values "upstream-spire-agent").unsupportedBuiltInPlugins }}
|
||||
{{- $s = add (len $up.keyManager) (len $up.nodeAttestor) (len $up.svidStore) (len $up.workloadAttestor) $s }}
|
||||
{{- end }}
|
||||
{{- if gt $s 0 }}
|
||||
|
||||
Warning:
|
||||
You are using an unsupported plugin. Functionality of this release and future upgrades are not guaranteed to work smoothly.
|
||||
Warning: You're using an unsupported plugin. Functionality of this release and future upgrades aren't guaranteed to work smoothly.
|
||||
{{- end }}
|
||||
|
||||
{{- if or (eq (((index .Values "spire-server").experimental).enabled | toString) "true") (eq (((index .Values "spire-agent").experimental).enabled | toString) "true") }}
|
||||
|
||||
Warning: You're using an experimental config. Functionality of this release and future upgrades aren't guaranteed to work smoothly.
|
||||
{{- end }}
|
||||
|
||||
@@ -107,3 +107,75 @@ rules:
|
||||
{{- end }}
|
||||
{{- include "spire-lib.image" $root }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Take in an array of, '.', a failure string to display, and boolean to to display it,
|
||||
if strictMode is enabled and the boolean is true
|
||||
*/}}
|
||||
{{- define "spire-lib.check-strict-mode" }}
|
||||
{{ $root := index . 0 }}
|
||||
{{ $message := index . 1 }}
|
||||
{{ $condition := index . 2 }}
|
||||
{{- if (dig "spire" "strictMode" false $root.Values.global) }}
|
||||
{{- if $condition }}
|
||||
{{- fail $message }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Take a copy of the config and merge in .Values.customPlugins and .Values.unsupportedBuiltInPlugins passed through as root.
|
||||
*/}}
|
||||
{{- define "spire-lib.config_merge" }}
|
||||
{{- $pluginsToMerge := dict "plugins" dict }}
|
||||
{{- range $type, $val := .root.Values.customPlugins }}
|
||||
{{- if . }}
|
||||
{{- if eq $type "svidstore" }}
|
||||
{{- $_ := set $pluginsToMerge.plugins "SVIDStore" (deepCopy $val) }}
|
||||
{{- else }}
|
||||
{{- $nt := printf "%s%s" (substr 0 1 $type | upper) (substr 1 -1 $type) }}
|
||||
{{- $_ := set $pluginsToMerge.plugins $nt (deepCopy $val) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $type, $val := .root.Values.unsupportedBuiltInPlugins }}
|
||||
{{- if . }}
|
||||
{{- if eq $type "svidstore" }}
|
||||
{{- $_ := set $pluginsToMerge.plugins "SVIDStore" (deepCopy $val) }}
|
||||
{{- else }}
|
||||
{{- $nt := printf "%s%s" (substr 0 1 $type | upper) (substr 1 -1 $type) }}
|
||||
{{- $_ := set $pluginsToMerge.plugins $nt (deepCopy $val) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- $newConfig := .config | fromYaml | mustMerge $pluginsToMerge }}
|
||||
{{- $newConfig | toYaml }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Take a copy of the plugin section and return a yaml string based version
|
||||
reformatted from a dict of dicts to a dict of lists of dicts
|
||||
*/}}
|
||||
{{- define "spire-lib.plugins_reformat" }}
|
||||
{{- range $type, $v := . }}
|
||||
{{ $type }}:
|
||||
{{- range $name, $v2 := $v }}
|
||||
- {{ $name }}: {{ $v2 | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Take a copy of the config as a yaml config and root var.
|
||||
Merge in .root.Values.customPlugins and .Values.unsupportedBuiltInPlugins into config,
|
||||
Reformat the plugin section from a dict of dicts to a dict of lists of dicts,
|
||||
and export it back as as json string.
|
||||
This makes it much easier for users to merge in plugin configs, as dicts are easier
|
||||
to merge in values, but spire needs arrays.
|
||||
*/}}
|
||||
{{- define "spire-lib.reformat-and-yaml2json" -}}
|
||||
{{- $config := include "spire-lib.config_merge" . | fromYaml }}
|
||||
{{- $plugins := include "spire-lib.plugins_reformat" $config.plugins | fromYaml }}
|
||||
{{- $_ := set $config "plugins" $plugins }}
|
||||
{{- $config | toPrettyJson }}
|
||||
{{- end }}
|
||||
|
||||
@@ -24,6 +24,9 @@ global:
|
||||
## @param global.spire.image.registry Override all Spire image registries at once
|
||||
registry: ""
|
||||
|
||||
## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
|
||||
strictMode: false
|
||||
|
||||
installAndUpgradeHooks:
|
||||
## @param global.installAndUpgradeHooks.enabled Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`)
|
||||
enabled: true
|
||||
|
||||
@@ -32,7 +32,7 @@ helm upgrade --install mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO
|
||||
--wait
|
||||
|
||||
helm upgrade --install --namespace "spire-server" \
|
||||
--values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml" \
|
||||
--values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \
|
||||
--set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire
|
||||
helm test --namespace "spire-server" spire
|
||||
|
||||
|
||||
@@ -32,7 +32,7 @@ helm upgrade --install postgresql postgresql --version "$VERSION_POSTGRESQL" --r
|
||||
--wait
|
||||
|
||||
helm upgrade --install --namespace "spire-server" \
|
||||
--values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml" \
|
||||
--values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \
|
||||
--set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire
|
||||
helm test --namespace "spire-server" spire
|
||||
|
||||
|
||||
@@ -34,10 +34,10 @@ helm upgrade --install --create-namespace spire charts/spire \
|
||||
--wait
|
||||
|
||||
kubectl get nodes -o go-template='{{range .items}}{{printf "%s\n" .metadata.uid}}{{end}}' | while read -r line; do
|
||||
kubectl exec -t spire-server-0 -n "spire-root-server" -- spire-server entry create -spiffeID spiffe://example.org/example-cluster/nested-spire -parentID "spiffe://example.org/spire/agent/k8s_psat/example-cluster/$line" -selector k8s:pod-label:app.kubernetes.io/name:server -downstream
|
||||
kubectl exec -t spire-server-0 -n "spire-root-server" -- spire-server entry create -spiffeID spiffe://production.other/production/nested-spire -parentID "spiffe://production.other/spire/agent/k8s_psat/production/$line" -selector k8s:pod-label:app.kubernetes.io/name:server -downstream
|
||||
done
|
||||
|
||||
helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml" \
|
||||
helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \
|
||||
--wait spire charts/spire
|
||||
helm test --namespace spire-server spire
|
||||
|
||||
|
||||
@@ -7,9 +7,13 @@ kubectl create namespace "spire-system"
|
||||
kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
|
||||
kubectl create namespace "spire-server"
|
||||
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
|
||||
```
|
||||
|
||||
Update the `example-your-values.yaml` file with your values, then:
|
||||
|
||||
```shell
|
||||
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml
|
||||
helm upgrade --install --namespace spire-server spire ../../charts/spire \
|
||||
-f values.yaml -f example-your-values.yaml --render-subchart-notes
|
||||
```
|
||||
|
||||
If your using ingress-nginx and want to expose the spiffe oidc discovery provider outside the
|
||||
|
||||
@@ -0,0 +1,45 @@
|
||||
global:
|
||||
spire:
|
||||
clusterName: production
|
||||
trustDomain: production.other
|
||||
jwtIssuer: oidc-discovery.production.other
|
||||
|
||||
spire-server:
|
||||
ca_subject:
|
||||
country: US
|
||||
organization: Production
|
||||
common_name: production.other
|
||||
|
||||
ingress:
|
||||
hosts:
|
||||
- host: spire-server.production.other
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- spire-server.production.other
|
||||
federation:
|
||||
ingress:
|
||||
hosts:
|
||||
- host: spire-server-federation.production.other
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- spire-server-federation.production.other
|
||||
secretName: tls-cert
|
||||
|
||||
spiffe-oidc-discovery-provider:
|
||||
ingress:
|
||||
hosts:
|
||||
- host: oidc-discovery.production.other
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- secretName: tls-cert
|
||||
hosts:
|
||||
- oidc-discovery.production.other
|
||||
|
||||
@@ -2,6 +2,9 @@
|
||||
|
||||
set -xe
|
||||
|
||||
UPGRADE_VERSION=v0.13.0
|
||||
UPGRADE_REPO=https://spiffe.github.io/helm-charts-hardened
|
||||
|
||||
SCRIPT="$(readlink -f "$0")"
|
||||
SCRIPTPATH="$(dirname "${SCRIPT}")"
|
||||
TESTDIR="${SCRIPTPATH}/../../.github/tests"
|
||||
@@ -15,14 +18,32 @@ source "${TESTDIR}/common.sh"
|
||||
helm_install=(helm upgrade --install --create-namespace)
|
||||
ns=spire-server
|
||||
|
||||
UPGRADE_ARGS=""
|
||||
CLEANUP=1
|
||||
|
||||
for i in "$@"; do
|
||||
case $i in
|
||||
-u)
|
||||
UPGRADE_ARGS="--repo $UPGRADE_REPO --version $UPGRADE_VERSION"
|
||||
shift # past argument=value
|
||||
;;
|
||||
-c)
|
||||
CLEANUP=0
|
||||
shift # past argument=value
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
teardown() {
|
||||
helm uninstall --namespace "${ns}" spire 2>/dev/null || true
|
||||
kubectl delete ns "${ns}" 2>/dev/null || true
|
||||
kubectl delete ns spire-system 2>/dev/null || true
|
||||
helm uninstall --namespace cert-manager cert-manager 2>/dev/null || true
|
||||
kubectl delete ns cert-manager 2>/dev/null || true
|
||||
helm uninstall --namespace ingress-nginx 2>/dev/null || true
|
||||
kubectl delete ns ingress-nginx 2>/dev/null || true
|
||||
if [ "${CLEANUP}" -eq 1 ]; then
|
||||
helm uninstall --namespace "${ns}" spire 2>/dev/null || true
|
||||
kubectl delete ns "${ns}" 2>/dev/null || true
|
||||
kubectl delete ns spire-system 2>/dev/null || true
|
||||
helm uninstall --namespace cert-manager cert-manager 2>/dev/null || true
|
||||
kubectl delete ns cert-manager 2>/dev/null || true
|
||||
helm uninstall --namespace ingress-nginx 2>/dev/null || true
|
||||
kubectl delete ns ingress-nginx 2>/dev/null || true
|
||||
fi
|
||||
}
|
||||
|
||||
trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
|
||||
@@ -48,7 +69,7 @@ kubectl apply -f "${DEPS}/testcert.yaml" -n spire-server
|
||||
--wait
|
||||
|
||||
ip=$(kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ .spec.clusterIP }}')
|
||||
echo "$ip" oidc-discovery.example.org
|
||||
echo "$ip" oidc-discovery.production.other
|
||||
|
||||
cat > /tmp/dummydns <<EOF
|
||||
spiffe-oidc-discovery-provider:
|
||||
@@ -56,38 +77,62 @@ spiffe-oidc-discovery-provider:
|
||||
hostAliases:
|
||||
- ip: "$ip"
|
||||
hostnames:
|
||||
- "oidc-discovery.example.org"
|
||||
- "oidc-discovery.production.other"
|
||||
spire-agent:
|
||||
hostAliases:
|
||||
- ip: "$ip"
|
||||
hostnames:
|
||||
- "spire-server.example.org"
|
||||
- "spire-server.production.other"
|
||||
spire-server:
|
||||
tests:
|
||||
hostAliases:
|
||||
- ip: "$ip"
|
||||
hostnames:
|
||||
- "spire-server-federation.example.org"
|
||||
federation:
|
||||
ingress:
|
||||
tls:
|
||||
- hosts:
|
||||
- spire-server-federation.example.org
|
||||
secretName: tls-cert
|
||||
- "spire-server-federation.production.other"
|
||||
EOF
|
||||
|
||||
"${helm_install[@]}" spire charts/spire \
|
||||
--namespace "${ns}" \
|
||||
--values "${SCRIPTPATH}/values.yaml" \
|
||||
--values "${SCRIPTPATH}/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml" \
|
||||
--values "${SCRIPTPATH}/values-export-spire-server-ingress-nginx.yaml" \
|
||||
--values "${SCRIPTPATH}/values-export-federation-https-web-ingress-nginx.yaml" \
|
||||
--values /tmp/dummydns \
|
||||
--set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \
|
||||
--set spire-agent.server.address=spire-server.example.org,spire-agent.server.port=443 \
|
||||
--wait
|
||||
install_and_test() {
|
||||
# Can't pass an array to a function. We completely control the string so its safe.
|
||||
# shellcheck disable=SC2086
|
||||
"${helm_install[@]}" spire "$1" \
|
||||
--namespace "${ns}" \
|
||||
--values "${SCRIPTPATH}/values.yaml" \
|
||||
--values "${SCRIPTPATH}/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml" \
|
||||
--values "${SCRIPTPATH}/values-export-spire-server-ingress-nginx.yaml" \
|
||||
--values "${SCRIPTPATH}/values-export-federation-https-web-ingress-nginx.yaml" \
|
||||
--values /tmp/dummydns \
|
||||
--set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \
|
||||
--set spire-agent.server.address=spire-server.production.other,spire-agent.server.port=443 \
|
||||
--values "${SCRIPTPATH}/example-your-values.yaml" \
|
||||
$2 \
|
||||
--wait
|
||||
|
||||
helm test --namespace "${ns}" spire
|
||||
helm test --namespace "${ns}" spire
|
||||
}
|
||||
|
||||
if [[ -n "$UPGRADE_ARGS" ]]; then
|
||||
install_and_test spire "$UPGRADE_ARGS"
|
||||
|
||||
# Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.)
|
||||
kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
|
||||
helm upgrade --install -n spire-server spire-crds charts/spire-crds
|
||||
fi
|
||||
|
||||
install_and_test charts/spire ""
|
||||
|
||||
if helm get manifest -n spire-server spire | grep -i example; then
|
||||
echo Global settings did not work. Please fix.
|
||||
exit 1
|
||||
fi
|
||||
|
||||
print_helm_releases
|
||||
print_spire_workload_status "${ns}"
|
||||
|
||||
@@ -2,6 +2,8 @@ global:
|
||||
telemetry:
|
||||
prometheus:
|
||||
enabled: true
|
||||
spire:
|
||||
strictMode: true
|
||||
|
||||
spire-server:
|
||||
nodeAttestor:
|
||||
|
||||
@@ -13,8 +13,8 @@ spire-server:
|
||||
name: spire-data
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: kfox1111/misc
|
||||
version: tpm-server-test
|
||||
repository: <your repo here>
|
||||
tag: <your tag here>
|
||||
customPlugins:
|
||||
nodeAttestor:
|
||||
tpm:
|
||||
@@ -23,3 +23,15 @@ spire-server:
|
||||
plugin_data:
|
||||
- ca_path: /run/spire/data/certs
|
||||
hash_path: /run/spire/data/hashes
|
||||
|
||||
spire-agent:
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: <your repo here>
|
||||
tag: <your tag here>
|
||||
customPlugins:
|
||||
nodeAttestor:
|
||||
tpm:
|
||||
plugin_cmd: /bin/tpm_attestor_agent
|
||||
plugin_checksum: bb7be714c27452231a6c7764b65912ce0cdeb66ff2a2c688d3e88bd0bd17d138
|
||||
plugin_data: {}
|
||||
|
||||
+20
-20
@@ -3,28 +3,28 @@ module github.com/spiffe/helm-charts/tests
|
||||
go 1.20
|
||||
|
||||
require (
|
||||
github.com/onsi/ginkgo/v2 v2.12.0
|
||||
github.com/onsi/gomega v1.27.10
|
||||
helm.sh/helm/v3 v3.12.3
|
||||
github.com/onsi/ginkgo/v2 v2.13.0
|
||||
github.com/onsi/gomega v1.28.0
|
||||
helm.sh/helm/v3 v3.13.1
|
||||
)
|
||||
|
||||
require (
|
||||
github.com/BurntSushi/toml v1.2.1 // indirect
|
||||
github.com/BurntSushi/toml v1.3.2 // indirect
|
||||
github.com/Masterminds/goutils v1.1.1 // indirect
|
||||
github.com/Masterminds/semver/v3 v3.2.1 // indirect
|
||||
github.com/Masterminds/sprig/v3 v3.2.3 // indirect
|
||||
github.com/cyphar/filepath-securejoin v0.2.3 // indirect
|
||||
github.com/cyphar/filepath-securejoin v0.2.4 // indirect
|
||||
github.com/davecgh/go-spew v1.1.1 // indirect
|
||||
github.com/emicklei/go-restful/v3 v3.10.1 // indirect
|
||||
github.com/go-logr/logr v1.2.4 // indirect
|
||||
github.com/go-openapi/jsonpointer v0.19.6 // indirect
|
||||
github.com/go-openapi/jsonreference v0.20.1 // indirect
|
||||
github.com/go-openapi/jsonreference v0.20.2 // indirect
|
||||
github.com/go-openapi/swag v0.22.3 // indirect
|
||||
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
|
||||
github.com/gobwas/glob v0.2.3 // indirect
|
||||
github.com/gogo/protobuf v1.3.2 // indirect
|
||||
github.com/golang/protobuf v1.5.3 // indirect
|
||||
github.com/google/gnostic v0.5.7-v3refs // indirect
|
||||
github.com/google/gnostic-models v0.6.8 // indirect
|
||||
github.com/google/go-cmp v0.5.9 // indirect
|
||||
github.com/google/gofuzz v1.2.0 // indirect
|
||||
github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect
|
||||
@@ -45,26 +45,26 @@ require (
|
||||
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
|
||||
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
|
||||
github.com/xeipuuv/gojsonschema v1.2.0 // indirect
|
||||
golang.org/x/crypto v0.12.0 // indirect
|
||||
golang.org/x/crypto v0.13.0 // indirect
|
||||
golang.org/x/net v0.14.0 // indirect
|
||||
golang.org/x/oauth2 v0.4.0 // indirect
|
||||
golang.org/x/sys v0.11.0 // indirect
|
||||
golang.org/x/term v0.11.0 // indirect
|
||||
golang.org/x/text v0.12.0 // indirect
|
||||
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
|
||||
golang.org/x/oauth2 v0.8.0 // indirect
|
||||
golang.org/x/sys v0.12.0 // indirect
|
||||
golang.org/x/term v0.12.0 // indirect
|
||||
golang.org/x/text v0.13.0 // indirect
|
||||
golang.org/x/time v0.3.0 // indirect
|
||||
golang.org/x/tools v0.12.0 // indirect
|
||||
google.golang.org/appengine v1.6.7 // indirect
|
||||
google.golang.org/protobuf v1.28.1 // indirect
|
||||
google.golang.org/protobuf v1.30.0 // indirect
|
||||
gopkg.in/inf.v0 v0.9.1 // indirect
|
||||
gopkg.in/yaml.v2 v2.4.0 // indirect
|
||||
gopkg.in/yaml.v3 v3.0.1 // indirect
|
||||
k8s.io/api v0.27.3 // indirect
|
||||
k8s.io/apiextensions-apiserver v0.27.3 // indirect
|
||||
k8s.io/apimachinery v0.27.3 // indirect
|
||||
k8s.io/client-go v0.27.3 // indirect
|
||||
k8s.io/api v0.28.2 // indirect
|
||||
k8s.io/apiextensions-apiserver v0.28.2 // indirect
|
||||
k8s.io/apimachinery v0.28.2 // indirect
|
||||
k8s.io/client-go v0.28.2 // indirect
|
||||
k8s.io/klog/v2 v2.100.1 // indirect
|
||||
k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // indirect
|
||||
k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5 // indirect
|
||||
k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 // indirect
|
||||
k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 // indirect
|
||||
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
|
||||
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
|
||||
sigs.k8s.io/yaml v1.3.0 // indirect
|
||||
|
||||
+42
-104
@@ -1,7 +1,5 @@
|
||||
cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
|
||||
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
|
||||
github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak=
|
||||
github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
|
||||
github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=
|
||||
github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
|
||||
github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
|
||||
github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
|
||||
github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
|
||||
@@ -9,30 +7,25 @@ github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0
|
||||
github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
|
||||
github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
|
||||
github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
|
||||
github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
|
||||
github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
|
||||
github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
|
||||
github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
|
||||
github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
|
||||
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
|
||||
github.com/cyphar/filepath-securejoin v0.2.3 h1:YX6ebbZCZP7VkM3scTTokDgBL2TY741X51MTk3ycuNI=
|
||||
github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
|
||||
github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
|
||||
github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
|
||||
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
||||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
|
||||
github.com/emicklei/go-restful/v3 v3.10.1 h1:rc42Y5YTp7Am7CS630D7JmhRjq4UlEUuEKfrDac4bSQ=
|
||||
github.com/emicklei/go-restful/v3 v3.10.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
|
||||
github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
|
||||
github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
|
||||
github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE=
|
||||
github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
||||
github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
|
||||
github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
||||
github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
|
||||
github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
|
||||
github.com/go-openapi/jsonreference v0.20.1 h1:FBLnyygC4/IZZr893oiomc9XaghoveYTrLC1F86HID8=
|
||||
github.com/go-openapi/jsonreference v0.20.1/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
|
||||
github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
|
||||
github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
|
||||
github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g=
|
||||
github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
|
||||
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
|
||||
@@ -41,27 +34,12 @@ github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
|
||||
github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
|
||||
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
|
||||
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
|
||||
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
|
||||
github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
|
||||
github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
|
||||
github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
|
||||
github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
|
||||
github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
|
||||
github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
|
||||
github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
|
||||
github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
|
||||
github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
|
||||
github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
|
||||
github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
|
||||
github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
|
||||
github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
|
||||
github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
|
||||
github.com/google/gnostic v0.5.7-v3refs h1:FhTMOKj2VhjpouxvWJAV1TL304uMlb9zcDqkl6cEI54=
|
||||
github.com/google/gnostic v0.5.7-v3refs/go.mod h1:73MKFl6jIHelAJNaBGFzt3SPtZULs9dYrGFt8OiIsHQ=
|
||||
github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
|
||||
github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
|
||||
github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
|
||||
github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
|
||||
github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
|
||||
github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
|
||||
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
|
||||
github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
|
||||
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
|
||||
@@ -86,9 +64,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr
|
||||
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
|
||||
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
|
||||
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
|
||||
github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
|
||||
github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
|
||||
github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
|
||||
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
|
||||
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
|
||||
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
|
||||
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
|
||||
@@ -108,15 +85,14 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
|
||||
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
|
||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
|
||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
|
||||
github.com/onsi/ginkgo/v2 v2.12.0 h1:UIVDowFPwpg6yMUpPjGkYvf06K3RAiJXUhCxEwQVHRI=
|
||||
github.com/onsi/ginkgo/v2 v2.12.0/go.mod h1:ZNEzXISYlqpb8S36iN71ifqLi3vVD1rVJGvWRCJOUpQ=
|
||||
github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI=
|
||||
github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M=
|
||||
github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4=
|
||||
github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o=
|
||||
github.com/onsi/gomega v1.28.0 h1:i2rg/p9n/UqIDAMFUJ6qIUUMcsqOuUHgbpbu235Vr1c=
|
||||
github.com/onsi/gomega v1.28.0/go.mod h1:A1H2JE76sI14WIP57LMKj7FVfCHx3g3BcZVjJG8bjX8=
|
||||
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
|
||||
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
||||
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
||||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
|
||||
github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
|
||||
github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
|
||||
github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
|
||||
@@ -125,7 +101,6 @@ github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkU
|
||||
github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
|
||||
github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
|
||||
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
|
||||
github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
|
||||
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||
github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
|
||||
github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
|
||||
@@ -136,7 +111,7 @@ github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
|
||||
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
|
||||
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
|
||||
github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
|
||||
github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
|
||||
github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
|
||||
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
|
||||
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
|
||||
@@ -152,20 +127,12 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
|
||||
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
|
||||
golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
|
||||
golang.org/x/crypto v0.12.0 h1:tFM/ta59kqch6LlvYnPa0yx5a83cL2nHflFhYKvv9Yk=
|
||||
golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
|
||||
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||
golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
|
||||
golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
|
||||
golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
|
||||
golang.org/x/crypto v0.13.0 h1:mvySKfSWJ+UKUii46M40LOvyWfN0s2U+46/jDd0e6Ck=
|
||||
golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
|
||||
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
|
||||
golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
|
||||
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||
golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
|
||||
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
@@ -176,16 +143,12 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
|
||||
golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
|
||||
golang.org/x/net v0.14.0 h1:BONx9s002vGdD9umnlX1Po8vOZmrgH34qlHcD1MfK14=
|
||||
golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
|
||||
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||
golang.org/x/oauth2 v0.4.0 h1:NF0gk8LVPg1Ml7SSbGyySuoxdsXitj7TvgvuRxIMc/M=
|
||||
golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec=
|
||||
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/oauth2 v0.8.0 h1:6dkIjl3j3LtZ/O3sTgZTMsLKSftL/B8Zgq4huOIIUu8=
|
||||
golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
|
||||
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
@@ -195,27 +158,23 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
|
||||
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.11.0 h1:eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM=
|
||||
golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
|
||||
golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
|
||||
golang.org/x/term v0.11.0 h1:F9tnn/DA/Im8nCwm+fX+1/eBwi4qFjRT++MhtVC4ZX0=
|
||||
golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
|
||||
golang.org/x/term v0.12.0 h1:/ZfYdc3zq+q02Rv9vGqTeSItdzZTSNDmfTi0mBAuidU=
|
||||
golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
|
||||
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
|
||||
golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
|
||||
golang.org/x/text v0.12.0 h1:k+n5B8goJNdU7hSvEtMUz3d1Q6D/XW4COJSJR6fN0mc=
|
||||
golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
|
||||
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 h1:vVKdlvoWBphwdxWKrFZEuM0kGgGLxUOYcY4U/2Vjg44=
|
||||
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
|
||||
golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
|
||||
golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
|
||||
golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
|
||||
golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
|
||||
golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
|
||||
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
||||
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
|
||||
@@ -226,31 +185,13 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
|
||||
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
|
||||
google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
|
||||
google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
|
||||
google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
|
||||
google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
|
||||
google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
|
||||
google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
|
||||
google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
|
||||
google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
|
||||
google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
|
||||
google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
|
||||
google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
|
||||
google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
|
||||
google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
|
||||
google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
|
||||
google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
|
||||
google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
|
||||
google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
|
||||
google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
|
||||
google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
|
||||
google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
|
||||
google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
|
||||
google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
|
||||
google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
|
||||
google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
|
||||
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
|
||||
gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
|
||||
@@ -261,28 +202,25 @@ gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||
gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
|
||||
gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
|
||||
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
helm.sh/helm/v3 v3.12.3 h1:5y1+Sbty12t48T/t/CGNYUIME5BJ0WKfmW/sobYqkFg=
|
||||
helm.sh/helm/v3 v3.12.3/go.mod h1:KPKQiX9IP5HX7o5YnnhViMnNuKiL/lJBVQ47GHe1R0k=
|
||||
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||
honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||
k8s.io/api v0.27.3 h1:yR6oQXXnUEBWEWcvPWS0jQL575KoAboQPfJAuKNrw5Y=
|
||||
k8s.io/api v0.27.3/go.mod h1:C4BNvZnQOF7JA/0Xed2S+aUyJSfTGkGFxLXz9MnpIpg=
|
||||
k8s.io/apiextensions-apiserver v0.27.3 h1:xAwC1iYabi+TDfpRhxh4Eapl14Hs2OftM2DN5MpgKX4=
|
||||
k8s.io/apiextensions-apiserver v0.27.3/go.mod h1:BH3wJ5NsB9XE1w+R6SSVpKmYNyIiyIz9xAmBl8Mb+84=
|
||||
k8s.io/apimachinery v0.27.3 h1:Ubye8oBufD04l9QnNtW05idcOe9Z3GQN8+7PqmuVcUM=
|
||||
k8s.io/apimachinery v0.27.3/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E=
|
||||
k8s.io/client-go v0.27.3 h1:7dnEGHZEJld3lYwxvLl7WoehK6lAq7GvgjxpA3nv1E8=
|
||||
k8s.io/client-go v0.27.3/go.mod h1:2MBEKuTo6V1lbKy3z1euEGnhPfGZLKTS9tiJ2xodM48=
|
||||
helm.sh/helm/v3 v3.13.1 h1:DG+XLGzBJeZvMLlMbm6bPDLV1dGaVW9eZsDoUd1/LM0=
|
||||
helm.sh/helm/v3 v3.13.1/go.mod h1:TdQRMiq46CSWcc68Hb0uVhvAWusaN90YwAV54cz6JzU=
|
||||
k8s.io/api v0.28.2 h1:9mpl5mOb6vXZvqbQmankOfPIGiudghwCoLl1EYfUZbw=
|
||||
k8s.io/api v0.28.2/go.mod h1:RVnJBsjU8tcMq7C3iaRSGMeaKt2TWEUXcpIt/90fjEg=
|
||||
k8s.io/apiextensions-apiserver v0.28.2 h1:J6/QRWIKV2/HwBhHRVITMLYoypCoPY1ftigDM0Kn+QU=
|
||||
k8s.io/apiextensions-apiserver v0.28.2/go.mod h1:5tnkxLGa9nefefYzWuAlWZ7RZYuN/765Au8cWLA6SRg=
|
||||
k8s.io/apimachinery v0.28.2 h1:KCOJLrc6gu+wV1BYgwik4AF4vXOlVJPdiqn0yAWWwXQ=
|
||||
k8s.io/apimachinery v0.28.2/go.mod h1:RdzF87y/ngqk9H4z3EL2Rppv5jj95vGS/HaFXrLDApU=
|
||||
k8s.io/client-go v0.28.2 h1:DNoYI1vGq0slMBN/SWKMZMw0Rq+0EQW6/AK4v9+3VeY=
|
||||
k8s.io/client-go v0.28.2/go.mod h1:sMkApowspLuc7omj1FOSUxSoqjr+d5Q0Yc0LOFnYFJY=
|
||||
k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg=
|
||||
k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
|
||||
k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f h1:2kWPakN3i/k81b0gvD5C5FJ2kxm1WrQFanWchyKuqGg=
|
||||
k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f/go.mod h1:byini6yhqGC14c3ebc/QwanvYwhuMWF6yz2F8uwW8eg=
|
||||
k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5 h1:kmDqav+P+/5e1i9tFfHq1qcF3sOrDp+YEkVDAHu7Jwk=
|
||||
k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
|
||||
k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 h1:LyMgNKD2P8Wn1iAwQU5OhxCKlKJy0sHc+PcDwFB24dQ=
|
||||
k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9/go.mod h1:wZK2AVp1uHCp4VamDVgBP2COHZjqD1T68Rf0CM3YjSM=
|
||||
k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 h1:qY1Ad8PODbnymg2pRbkyMT/ylpTrCM8P2RJ0yroCyIk=
|
||||
k8s.io/utils v0.0.0-20230406110748-d93618cff8a2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
|
||||
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
|
||||
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
|
||||
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=
|
||||
|
||||
@@ -103,4 +103,34 @@ spire-server:
|
||||
Expect(notes).Should(ContainSubstring("\"aws_pca\": {"))
|
||||
})
|
||||
})
|
||||
Describe("spire-agent.customPlugin.tpm", func() {
|
||||
It("plugin set ok", func() {
|
||||
objs, err := ValueStringRender(chart, `
|
||||
spire-agent:
|
||||
customPlugins:
|
||||
nodeAttestor:
|
||||
tpm:
|
||||
plugin_cmd: /bin/tpm_attestor_agent
|
||||
plugin_checksum: bb7be714c27452231a6c7764b65912ce0cdeb66ff2a2c688d3e88bd0bd17d138
|
||||
plugin_data: {}
|
||||
`)
|
||||
Expect(err).Should(Succeed())
|
||||
notes := objs["spire/charts/spire-agent/templates/configmap.yaml"]
|
||||
Expect(notes).Should(ContainSubstring("tpm"))
|
||||
})
|
||||
})
|
||||
Describe("spire-server.unsupportedBuiltInPlugins", func() {
|
||||
It("plugin set ok", func() {
|
||||
objs, err := ValueStringRender(chart, `
|
||||
spire-agent:
|
||||
unsupportedBuiltInPlugins:
|
||||
nodeAttestor:
|
||||
join_token:
|
||||
plugin_data: {}
|
||||
`)
|
||||
Expect(err).Should(Succeed())
|
||||
notes := objs["spire/charts/spire-agent/templates/configmap.yaml"]
|
||||
Expect(notes).Should(ContainSubstring("join_token"))
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
Reference in New Issue
Block a user