Merge branch 'main' into release
This commit is contained in:
Faisal Memon
@@ -2,17 +2,17 @@
|
||||
{
|
||||
"name": "kube-prometheus-stack",
|
||||
"repo": "https://prometheus-community.github.io/helm-charts",
|
||||
"version": "61.8.0"
|
||||
"version": "62.3.1"
|
||||
},
|
||||
{
|
||||
"name": "cert-manager",
|
||||
"repo": "https://charts.jetstack.io",
|
||||
"version": "v1.15.2"
|
||||
"version": "v1.15.3"
|
||||
},
|
||||
{
|
||||
"name": "ingress-nginx",
|
||||
"repo": "https://kubernetes.github.io/ingress-nginx",
|
||||
"version": "4.11.1"
|
||||
"version": "4.11.2"
|
||||
},
|
||||
{
|
||||
"name": "mysql",
|
||||
@@ -22,6 +22,6 @@
|
||||
{
|
||||
"name": "postgresql",
|
||||
"repo": "https://charts.bitnami.com/bitnami",
|
||||
"version": "15.5.21"
|
||||
"version": "15.5.27"
|
||||
}
|
||||
]
|
||||
|
||||
@@ -72,6 +72,16 @@ $(helm ls -A | sed 's/\t/ | /g' | sed 's/^/| /' | sed 's/$/ |/' | sed '/^| NAME.
|
||||
EOF
|
||||
}
|
||||
|
||||
common_test_url () (
|
||||
count=10
|
||||
while true; do
|
||||
if curl "$1"; then exit 0; fi
|
||||
sleep 2
|
||||
count=$((count-1))
|
||||
[ $count -le 0 ] && exit 1
|
||||
done
|
||||
)
|
||||
|
||||
# Used just for testing. You should provide your own values as described in the install instructions.
|
||||
common_test_your_values () {
|
||||
cat > /tmp/$$.example-your-values.yaml <<EOF
|
||||
|
||||
@@ -17,6 +17,11 @@
|
||||
"filter": "LATESTSHA",
|
||||
"sort-flags": []
|
||||
},
|
||||
{
|
||||
"query": "hostCert.image",
|
||||
"filter": "LATESTSHA",
|
||||
"sort-flags": []
|
||||
},
|
||||
{
|
||||
"query": "fsGroupFix.image",
|
||||
"filter": "LATESTSHA",
|
||||
|
||||
@@ -3,8 +3,8 @@ name: spire-nested
|
||||
description: >
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
type: application
|
||||
version: 0.22.0
|
||||
appVersion: "1.10.1"
|
||||
version: 0.23.0
|
||||
appVersion: "1.10.3"
|
||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# spire
|
||||
|
||||
  
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
@@ -236,32 +236,35 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
|
||||
### Spire agent parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------- | ------------------------------------------------------------- | ------------------------- |
|
||||
| `downstream-spire-agent-full.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` |
|
||||
| `downstream-spire-agent-full.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
|
||||
| `downstream-spire-agent-full.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-bundle-downstream` |
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------------- | -------------------------------------------------------------- | ------------------------------------- |
|
||||
| `downstream-spire-agent-full.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` |
|
||||
| `downstream-spire-agent-full.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
|
||||
| `downstream-spire-agent-full.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-bundle-downstream` |
|
||||
| `downstream-spire-agent-full.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/downstream-agent` |
|
||||
|
||||
### Spire agent parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------------------------------------- | ------------------------------------------------------------- | ----------------------- |
|
||||
| `downstream-spire-agent-security.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` |
|
||||
| `downstream-spire-agent-security.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-bundle-upstream` |
|
||||
| `downstream-spire-agent-security.serviceAccount.name` | The name of the service account to use | `spire-agent-upstream` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------ | -------------------------------------------------------------- | ------------------------------------- |
|
||||
| `downstream-spire-agent-security.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` |
|
||||
| `downstream-spire-agent-security.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-bundle-upstream` |
|
||||
| `downstream-spire-agent-security.serviceAccount.name` | The name of the service account to use | `spire-agent-upstream` |
|
||||
| `downstream-spire-agent-security.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/downstream-agent` |
|
||||
|
||||
### Upstream Spire agent parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------ | -------------------------------------------------- | ---------------------------------------------------- |
|
||||
| `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` |
|
||||
| `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` |
|
||||
| `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` |
|
||||
| `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` |
|
||||
| `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` |
|
||||
| `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` |
|
||||
| `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` |
|
||||
| `upstream-spire-agent.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------ | -------------------------------------------------------------- | ---------------------------------------------------- |
|
||||
| `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` |
|
||||
| `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` |
|
||||
| `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` |
|
||||
| `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` |
|
||||
| `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` |
|
||||
| `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` |
|
||||
| `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` |
|
||||
| `upstream-spire-agent.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` |
|
||||
| `upstream-spire-agent.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/upstream-agent` |
|
||||
|
||||
### SPIFFE CSI Driver parameters
|
||||
|
||||
|
||||
@@ -117,6 +117,9 @@ downstream-spire-agent-full:
|
||||
nameOverride: internal-server
|
||||
## @param downstream-spire-agent-full.bundleConfigMap The name of the configmap that contains the downstream bundle
|
||||
bundleConfigMap: spire-bundle-downstream
|
||||
## @param downstream-spire-agent-full.persistence.hostPath Which path to use on the host when persistence.type = hostPath
|
||||
persistence:
|
||||
hostPath: /var/lib/spire/k8s/downstream-agent
|
||||
|
||||
## @section Spire agent parameters
|
||||
## Parameter values for Spire agent
|
||||
@@ -131,6 +134,9 @@ downstream-spire-agent-security:
|
||||
serviceAccount:
|
||||
## @param downstream-spire-agent-security.serviceAccount.name The name of the service account to use
|
||||
name: spire-agent-upstream
|
||||
## @param downstream-spire-agent-security.persistence.hostPath Which path to use on the host when persistence.type = hostPath
|
||||
persistence:
|
||||
hostPath: /var/lib/spire/k8s/downstream-agent
|
||||
|
||||
## @section Upstream Spire agent parameters
|
||||
## Parameter values for upstream Spire agent
|
||||
@@ -159,6 +165,9 @@ upstream-spire-agent:
|
||||
server:
|
||||
## @param upstream-spire-agent.server.nameOverride The name override setting of the root SPIRE server
|
||||
nameOverride: root-server
|
||||
## @param upstream-spire-agent.persistence.hostPath Which path to use on the host when persistence.type = hostPath
|
||||
persistence:
|
||||
hostPath: /var/lib/spire/k8s/upstream-agent
|
||||
|
||||
## @section SPIFFE CSI Driver parameters
|
||||
## Parameter values for spiffe-csi-driver
|
||||
|
||||
@@ -3,8 +3,8 @@ name: spire
|
||||
description: >
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
type: application
|
||||
version: 0.22.0
|
||||
appVersion: "1.10.1"
|
||||
version: 0.23.0
|
||||
appVersion: "1.10.3"
|
||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
+17
-10
@@ -1,6 +1,6 @@
|
||||
# spire
|
||||
|
||||
  
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
@@ -88,6 +88,12 @@ kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeid
|
||||
|
||||
We only support upgrading one major/minor version at a time. Version skipping isn't supported. Please see <https://spiffe.io/docs/latest/spire-helm-charts-hardened-about/upgrading/> for details.
|
||||
|
||||
### 0.23.X
|
||||
|
||||
In previous versions, the setting spire-agent.workloadAttestors.k8s.skipKubeletVerification was set to true by default. Starting in 0.23.x, we removed that setting and replaced it with
|
||||
spire-agent.workloadAttestors.k8s.verification.type. It defaults to "skip" which will have the same behavior as before. In a future version, it will be set to "auto". Please try
|
||||
setting it to this with your deployment and let us know if you run into any problems so we can fix it before we change the default for everyone.
|
||||
|
||||
### 0.21.X
|
||||
|
||||
- In previous versions, spire-server.upstreamAuthority.certManager.issuer_name would incorrectly have '-ca' appended. Starting with this version, that is no longer the case. If you previously set this
|
||||
@@ -300,15 +306,16 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
|
||||
### Upstream Spire agent parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------ | -------------------------------------------------- | ---------------------------------------------------- |
|
||||
| `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` |
|
||||
| `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` |
|
||||
| `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` |
|
||||
| `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` |
|
||||
| `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` |
|
||||
| `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` |
|
||||
| `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------ | -------------------------------------------------------------- | ---------------------------------------------------- |
|
||||
| `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` |
|
||||
| `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` |
|
||||
| `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` |
|
||||
| `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` |
|
||||
| `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` |
|
||||
| `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` |
|
||||
| `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` |
|
||||
| `upstream-spire-agent.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/upstream-agent` |
|
||||
|
||||
### SPIFFE CSI Driver parameters
|
||||
|
||||
|
||||
@@ -16,6 +16,7 @@ volumes:
|
||||
- configmap
|
||||
- hostPath
|
||||
- secret
|
||||
allowedCapabilities: null
|
||||
allowHostDirVolumePlugin: true
|
||||
allowHostIPC: false
|
||||
allowHostNetwork: false
|
||||
@@ -23,8 +24,11 @@ allowHostPID: false
|
||||
allowHostPorts: false
|
||||
allowPrivilegeEscalation: true
|
||||
allowPrivilegedContainer: true
|
||||
defaultAddCapabilities: null
|
||||
fsGroup:
|
||||
type: RunAsAny
|
||||
groups: []
|
||||
priority: null
|
||||
requiredDropCapabilities: null
|
||||
|
||||
{{ end }}
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider
|
||||
description: A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.10.1"
|
||||
appVersion: "1.10.3"
|
||||
keywords: ["spiffe", "oidc"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -69,7 +69,8 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from. Only used when TLS is disabled. | `docker.io` |
|
||||
| `insecureScheme.nginx.image.repository` | The repository within the registry. Only used when TLS is disabled. | `nginxinc/nginx-unprivileged` |
|
||||
| `insecureScheme.nginx.image.pullPolicy` | The image pull policy. Only used when TLS is disabled. | `IfNotPresent` |
|
||||
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.27.0-alpine` |
|
||||
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.27.1-alpine` |
|
||||
| `insecureScheme.nginx.ipMode` | IP modes supported by the cluster. Must be one of [ipv4, ipv6, both] | `both` |
|
||||
| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` |
|
||||
| `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` |
|
||||
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||
@@ -115,11 +116,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a` |
|
||||
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
|
||||
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:eb1c3f94b5a2303d74a804c1bfd5adc9c98e55e344bbe1adcd6522d6e80d5733` |
|
||||
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5420e15d91112458fc573755954c9174dbf4db8d802c4de3aac18145f5a78a17` |
|
||||
| `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` |
|
||||
| `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
|
||||
@@ -93,7 +93,7 @@ Create the name of the service account to use
|
||||
{{- end }}
|
||||
|
||||
{{- define "spiffe-oidc-discovery-provider.tls-enabled" -}}
|
||||
{{- if and .Values.enabled (or .Values.tls.spire.enabled .Values.tls.externalSecret.enabled .Values.tls.certManager.enabled) }}
|
||||
{{- if or .Values.tls.spire.enabled .Values.tls.externalSecret.enabled .Values.tls.certManager.enabled }}
|
||||
{{- true }}
|
||||
{{- else }}
|
||||
{{- false }}
|
||||
|
||||
@@ -66,8 +66,12 @@ data:
|
||||
}
|
||||
|
||||
server {
|
||||
{{- if or (eq .Values.insecureScheme.nginx.ipMode "ipv4") (eq .Values.insecureScheme.nginx.ipMode "both") }}
|
||||
listen 8080;
|
||||
{{- end }}
|
||||
{{- if or (eq .Values.insecureScheme.nginx.ipMode "ipv6") (eq .Values.insecureScheme.nginx.ipMode "both") }}
|
||||
listen [::]:8080;
|
||||
{{- end }}
|
||||
|
||||
location / {
|
||||
proxy_pass http://oidc;
|
||||
|
||||
+4
@@ -22,6 +22,7 @@ volumes:
|
||||
- hostPath
|
||||
- projected
|
||||
- secret
|
||||
allowedCapabilities: null
|
||||
allowHostDirVolumePlugin: true
|
||||
allowHostIPC: true
|
||||
allowHostNetwork: true
|
||||
@@ -29,9 +30,12 @@ allowHostPID: true
|
||||
allowHostPorts: true
|
||||
allowPrivilegeEscalation: true
|
||||
allowPrivilegedContainer: true
|
||||
defaultAddCapabilities: null
|
||||
fsGroup:
|
||||
type: RunAsAny
|
||||
groups: []
|
||||
priority: null
|
||||
requiredDropCapabilities: null
|
||||
seccompProfiles:
|
||||
- '*'
|
||||
|
||||
|
||||
@@ -164,7 +164,9 @@ insecureScheme:
|
||||
registry: docker.io
|
||||
repository: nginxinc/nginx-unprivileged
|
||||
pullPolicy: IfNotPresent
|
||||
tag: 1.27.0-alpine
|
||||
tag: 1.27.1-alpine
|
||||
## @param insecureScheme.nginx.ipMode IP modes supported by the cluster. Must be one of [ipv4, ipv6, both]
|
||||
ipMode: both
|
||||
## @param insecureScheme.nginx.resources Resource requests and limits
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
@@ -328,7 +330,7 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776
|
||||
tag: latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a
|
||||
|
||||
toolkit:
|
||||
## @param tests.toolkit.image.registry The OCI registry to pull the image from
|
||||
@@ -340,7 +342,7 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/min-toolkit-debug
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:eb1c3f94b5a2303d74a804c1bfd5adc9c98e55e344bbe1adcd6522d6e80d5733
|
||||
tag: latest@sha256:5420e15d91112458fc573755954c9174dbf4db8d802c4de3aac18145f5a78a17
|
||||
|
||||
step:
|
||||
## @param tests.step.image.registry The OCI registry to pull the image from
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire-agent
|
||||
description: A Helm chart to install the SPIRE agent.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.10.1"
|
||||
appVersion: "1.10.3"
|
||||
keywords: ["spiffe", "spire-agent"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -25,111 +25,122 @@ A Helm chart to install the SPIRE agent.
|
||||
|
||||
### Chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||
| `nameOverride` | Name override | `""` |
|
||||
| `namespaceOverride` | Namespace override | `""` |
|
||||
| `fullnameOverride` | Fullname override | `""` |
|
||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||
| `serviceAccount.name` | The name of the service account to use. | `""` |
|
||||
| `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` |
|
||||
| `podAnnotations` | Annotations to add to pods | `{}` |
|
||||
| `podLabels` | Labels to add to pods | `{}` |
|
||||
| `podSecurityContext` | Pod security context | `{}` |
|
||||
| `securityContext` | Security context | `{}` |
|
||||
| `resources` | Resource requests and limits | `{}` |
|
||||
| `nodeSelector` | Node selector | `{}` |
|
||||
| `tolerations` | List of tolerations | `[]` |
|
||||
| `affinity` | Node affinity | `{}` |
|
||||
| `authorizedDelegates` | A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information. | `[]` |
|
||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||
| `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` |
|
||||
| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||
| `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` |
|
||||
| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `pem` |
|
||||
| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` |
|
||||
| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` |
|
||||
| `server.address` | Address for Spire server | `""` |
|
||||
| `server.port` | Port number for Spire server | `443` |
|
||||
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
||||
| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
||||
| `healthChecks.port` | override the host port used for health checking | `9982` |
|
||||
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
|
||||
| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` |
|
||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
|
||||
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
|
||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` |
|
||||
| `readinessProbe.periodSeconds` | Period seconds for probe | `30` |
|
||||
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776` |
|
||||
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
|
||||
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` |
|
||||
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-agent` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.8.7` |
|
||||
| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `1d7c73ccac948ee86cbd78ddde2d30128a1838b403f7bb2100d38d916a252244` |
|
||||
| `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.enabled` | Enable Psat k8s nodeattestor | `true` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-get-tpm-pubhash` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.8.7` |
|
||||
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
|
||||
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
|
||||
| `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` |
|
||||
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
|
||||
| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false | `false` |
|
||||
| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` |
|
||||
| `sds.enabled` | Enables Envoy SDS configuration | `false` |
|
||||
| `sds.defaultSvidName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` |
|
||||
| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` |
|
||||
| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` |
|
||||
| `sds.disableSpiffeCertValidation` | Disable Envoy SDS custom validation | `false` |
|
||||
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
||||
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
|
||||
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
||||
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
|
||||
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||
| `kubeletConnectByHostname` | If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
|
||||
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` |
|
||||
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776` |
|
||||
| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
|
||||
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
|
||||
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` |
|
||||
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
|
||||
| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` |
|
||||
| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` |
|
||||
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
|
||||
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
|
||||
| `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` |
|
||||
| `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` |
|
||||
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
||||
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
|
||||
| `experimental.featureFlags` | List of developer feature flags | `[]` |
|
||||
| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` |
|
||||
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
|
||||
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` |
|
||||
| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` |
|
||||
| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` |
|
||||
| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` |
|
||||
| `persistence.hostPath` | Which path to use on the host when type = hostPath | `/var/lib/spire/k8s/agent` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||
| `nameOverride` | Name override | `""` |
|
||||
| `namespaceOverride` | Namespace override | `""` |
|
||||
| `fullnameOverride` | Fullname override | `""` |
|
||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||
| `serviceAccount.name` | The name of the service account to use. | `""` |
|
||||
| `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` |
|
||||
| `podAnnotations` | Annotations to add to pods | `{}` |
|
||||
| `podLabels` | Labels to add to pods | `{}` |
|
||||
| `podSecurityContext` | Pod security context | `{}` |
|
||||
| `securityContext` | Security context | `{}` |
|
||||
| `resources` | Resource requests and limits | `{}` |
|
||||
| `nodeSelector` | Node selector | `{}` |
|
||||
| `tolerations` | List of tolerations | `[]` |
|
||||
| `affinity` | Node affinity | `{}` |
|
||||
| `authorizedDelegates` | A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information. | `[]` |
|
||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||
| `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` |
|
||||
| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||
| `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` |
|
||||
| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `pem` |
|
||||
| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` |
|
||||
| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` |
|
||||
| `server.address` | Address for Spire server | `""` |
|
||||
| `server.port` | Port number for Spire server | `443` |
|
||||
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
||||
| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
||||
| `healthChecks.port` | override the host port used for health checking | `9982` |
|
||||
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
|
||||
| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` |
|
||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
|
||||
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
|
||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` |
|
||||
| `readinessProbe.periodSeconds` | Period seconds for probe | `30` |
|
||||
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a` |
|
||||
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
|
||||
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` |
|
||||
| `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` |
|
||||
| `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` |
|
||||
| `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` |
|
||||
| `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` |
|
||||
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-agent` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.8.7` |
|
||||
| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `1d7c73ccac948ee86cbd78ddde2d30128a1838b403f7bb2100d38d916a252244` |
|
||||
| `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.enabled` | Enable Psat k8s nodeattestor | `true` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-get-tpm-pubhash` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.8.7` |
|
||||
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
|
||||
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
|
||||
| `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` |
|
||||
| `workloadAttestors.k8s.verification.hostCert.basePath` | Path where kubelet places its certificates | `/var/lib/kubelet/pki` |
|
||||
| `workloadAttestors.k8s.verification.hostCert.fileName` | File name where kubelet places its certificates. If blank, it will be auto detected. | `""` |
|
||||
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
|
||||
| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false | `false` |
|
||||
| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` |
|
||||
| `sds.enabled` | Enables Envoy SDS configuration | `false` |
|
||||
| `sds.defaultSvidName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` |
|
||||
| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` |
|
||||
| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` |
|
||||
| `sds.disableSpiffeCertValidation` | Disable Envoy SDS custom validation | `false` |
|
||||
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
||||
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
|
||||
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
||||
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
|
||||
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||
| `kubeletConnectByHostname` | If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
|
||||
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` |
|
||||
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a` |
|
||||
| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
|
||||
| `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5420e15d91112458fc573755954c9174dbf4db8d802c4de3aac18145f5a78a17` |
|
||||
| `hostCert.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
|
||||
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
|
||||
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` |
|
||||
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
|
||||
| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` |
|
||||
| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` |
|
||||
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
|
||||
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
|
||||
| `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` |
|
||||
| `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` |
|
||||
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
||||
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
|
||||
| `experimental.featureFlags` | List of developer feature flags | `[]` |
|
||||
| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` |
|
||||
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
|
||||
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` |
|
||||
| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` |
|
||||
| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` |
|
||||
| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` |
|
||||
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` |
|
||||
|
||||
@@ -32,7 +32,7 @@ agent:
|
||||
authorized_delegates:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
data_dir: "/run/spire"
|
||||
data_dir: "/var/lib/spire"
|
||||
log_level: {{ .Values.logLevel | quote }}
|
||||
retry_bootstrap: true
|
||||
server_address: {{ include "spire-agent.server-address" . | trim | quote }}
|
||||
@@ -79,6 +79,20 @@ plugins:
|
||||
cluster: {{ include "spire-lib.cluster-name" . | quote }}
|
||||
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.httpChallenge }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
http_challenge:
|
||||
plugin_data:
|
||||
agentname: {{ .agentname | quote }}
|
||||
{{- if ne (int .port) 0 }}
|
||||
port: {{ .port }}
|
||||
{{- end }}
|
||||
{{- if ne (int .advertisedPort) 0 }}
|
||||
advertisedPort: {{ .advertisedPort }}
|
||||
{{- end }}
|
||||
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.tpmDirect }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
tpm:
|
||||
@@ -106,10 +120,12 @@ plugins:
|
||||
{{- if .Values.workloadAttestors.k8s.enabled }}
|
||||
k8s:
|
||||
plugin_data:
|
||||
# Defaults to the secure kubelet port by default.
|
||||
# Minikube does not have a cert in the cluster CA bundle that
|
||||
# can authenticate the kubelet cert, so skip validation.
|
||||
skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }}
|
||||
{{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }}
|
||||
kubelet_ca_path: /hostCert/kubelet.crt
|
||||
{{- else if eq .Values.workloadAttestors.k8s.verification.type "apiServerCA" }}
|
||||
kubelet_ca_path: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
{{- end }}
|
||||
skip_kubelet_verification: {{ eq .Values.workloadAttestors.k8s.verification.type "skip" }}
|
||||
disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }}
|
||||
use_new_container_locator: {{ .Values.workloadAttestors.k8s.useNewContainerLocator }}
|
||||
verbose_container_locator_logs: {{ .Values.workloadAttestors.k8s.verboseContainerLocatorLogs }}
|
||||
|
||||
@@ -74,6 +74,58 @@ spec:
|
||||
{{- toYaml .Values.hostAliases | nindent 8 }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }}
|
||||
- name: gather-host-cert
|
||||
securityContext:
|
||||
{{- $mainSecurityContext | toYaml | nindent 12 }}
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.hostCert.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.hostCert.image.pullPolicy }}
|
||||
command: ["bash", "-xc"]
|
||||
args:
|
||||
- |
|
||||
{{- if ne .Values.workloadAttestors.k8s.verification.hostCert.fileName "" }}
|
||||
openssl x509 -in "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/{{ .Values.workloadAttestors.k8s.verification.hostCert.fileName }}" -out /hostCert/kubelet.crt
|
||||
{{- else }}
|
||||
if [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet-server-current.pem" ]; then
|
||||
openssl x509 -in "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet-server-current.pem" -out /hostCert/kubelet.crt
|
||||
elif [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" ]; then
|
||||
openssl x509 -in "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" -out /hostCert/kubelet.crt
|
||||
else
|
||||
{{- if eq .Values.workloadAttestors.k8s.verification.type "auto" }}
|
||||
{{- if $cbh }}
|
||||
URL="https://$NODE_NAME:10250/spec/"
|
||||
{{- else }}
|
||||
URL="https://localhost:10250/spec/"
|
||||
{{- end }}
|
||||
curl --caPath /var/run/secrets/kubernetes.io/serviceaccount/ca.crt "$URL"
|
||||
if [ $? -eq 0 ]; then
|
||||
echo Mode detected as apiServerCA.
|
||||
ln -s /var/run/secrets/kubernetes.io/serviceaccount/ca.crt /hostCert/kubelet.crt
|
||||
exit 0
|
||||
fi
|
||||
{{- end }}
|
||||
echo Could not find certificate.
|
||||
exit 1
|
||||
fi
|
||||
{{- end }}
|
||||
{{- if eq .Values.workloadAttestors.k8s.verification.type "auto" }}
|
||||
echo Mode detected as hostCert.
|
||||
{{- end }}
|
||||
chmod 644 /hostCert/kubelet.crt
|
||||
env:
|
||||
{{- if $cbh }}
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: host-cert-isolated
|
||||
mountPath: /hostCert
|
||||
- name: host-cert
|
||||
mountPath: {{ .Values.workloadAttestors.k8s.verification.hostCert.basePath | quote }}
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if .Values.nodeAttestor.tpmDirect.enabled }}
|
||||
{{- if .Values.nodeAttestor.tpmDirect.pubHash.enabled }}
|
||||
- name: fingerprint-tpm
|
||||
@@ -220,6 +272,11 @@ spec:
|
||||
readOnly: false
|
||||
- name: spire-token
|
||||
mountPath: /var/run/secrets/tokens
|
||||
{{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }}
|
||||
- name: host-cert-isolated
|
||||
mountPath: /hostCert
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if gt (len .Values.extraVolumeMounts) 0 }}
|
||||
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
|
||||
{{- end }}
|
||||
@@ -302,6 +359,13 @@ spec:
|
||||
path: /dev/kmsg
|
||||
type: CharDevice
|
||||
{{- end }}
|
||||
{{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }}
|
||||
- name: host-cert-isolated
|
||||
emptyDir: {}
|
||||
- name: host-cert
|
||||
hostPath:
|
||||
path: {{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}
|
||||
{{- end }}
|
||||
{{- if gt (len .Values.extraVolumes) 0 }}
|
||||
{{- toYaml .Values.extraVolumes | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -18,6 +18,7 @@ volumes:
|
||||
- projected
|
||||
- secret
|
||||
- emptyDir
|
||||
allowedCapabilities: null
|
||||
allowHostDirVolumePlugin: true
|
||||
allowHostIPC: true
|
||||
allowHostNetwork: true
|
||||
@@ -25,8 +26,11 @@ allowHostPID: true
|
||||
allowHostPorts: true
|
||||
allowPrivilegeEscalation: true
|
||||
allowPrivilegedContainer: true
|
||||
defaultAddCapabilities: null
|
||||
fsGroup:
|
||||
type: RunAsAny
|
||||
groups: []
|
||||
priority: null
|
||||
requiredDropCapabilities: null
|
||||
|
||||
{{ end }}
|
||||
|
||||
@@ -151,7 +151,7 @@ fsGroupFix:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
tag: latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776
|
||||
tag: latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a
|
||||
|
||||
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
@@ -165,6 +165,15 @@ nodeAttestor:
|
||||
k8sPsat:
|
||||
## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s Node Attestor
|
||||
enabled: true
|
||||
httpChallenge:
|
||||
## @param nodeAttestor.httpChallenge.enabled Enable the http challenge Node Attestor
|
||||
enabled: false
|
||||
## @param nodeAttestor.httpChallenge.agentname Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port.
|
||||
agentname: default
|
||||
## @param nodeAttestor.httpChallenge.port The port to listen on. If 0, a random value will be used.
|
||||
port: 0
|
||||
## @param nodeAttestor.httpChallenge.advertisedPort The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting.
|
||||
advertisedPort: 0
|
||||
tpmDirect:
|
||||
## @param nodeAttestor.tpmDirect.enabled Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental.
|
||||
enabled: false
|
||||
@@ -206,8 +215,14 @@ workloadAttestors:
|
||||
k8s:
|
||||
## @param workloadAttestors.k8s.enabled Enables the Kubernetes workload attestor
|
||||
enabled: true
|
||||
## @param workloadAttestors.k8s.skipKubeletVerification If true, kubelet certificate verification is skipped
|
||||
skipKubeletVerification: true
|
||||
verification:
|
||||
## @param workloadAttestors.k8s.verification.type What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip]
|
||||
type: skip
|
||||
hostCert:
|
||||
## @param workloadAttestors.k8s.verification.hostCert.basePath Path where kubelet places its certificates
|
||||
basePath: /var/lib/kubelet/pki
|
||||
## @param workloadAttestors.k8s.verification.hostCert.fileName File name where kubelet places its certificates. If blank, it will be auto detected.
|
||||
fileName: ""
|
||||
## @param workloadAttestors.k8s.disableContainerSelectors Set to true if using holdApplicationUntilProxyStarts in Istio
|
||||
disableContainerSelectors: false
|
||||
## @param workloadAttestors.k8s.useNewContainerLocator If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false
|
||||
@@ -263,11 +278,26 @@ socketAlternate:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
tag: latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776
|
||||
tag: latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a
|
||||
|
||||
## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
||||
hostCert:
|
||||
## @param hostCert.image.registry The OCI registry to pull the image from
|
||||
## @param hostCert.image.repository The repository within the registry
|
||||
## @param hostCert.image.pullPolicy The image pull policy
|
||||
## @param hostCert.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/min-toolkit-debug
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:5420e15d91112458fc573755954c9174dbf4db8d802c4de3aac18145f5a78a17
|
||||
|
||||
## @param hostCert.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
||||
## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.
|
||||
priorityClassName: ""
|
||||
|
||||
@@ -353,7 +383,7 @@ sockets:
|
||||
mountOnHost: false
|
||||
|
||||
## @param persistence.type What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors)
|
||||
## @param persistence.hostPath Which path to use on the host when type = hostPath
|
||||
## @param persistence.hostPath Which path to use on the host when persistence.type = hostPath
|
||||
##
|
||||
persistence:
|
||||
type: emptyDir
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire-server
|
||||
description: A Helm chart to install the SPIRE server.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.10.1"
|
||||
appVersion: "1.10.3"
|
||||
keywords: ["spiffe", "spire-server", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -124,7 +124,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `persistence.size` | What size volume to use for persistence | `1Gi` |
|
||||
| `persistence.accessMode` | What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) | `ReadWriteOnce` |
|
||||
| `persistence.storageClass` | What storage class to use for persistence | `nil` |
|
||||
| `persistence.hostPath` | Which path to use on the host when type = hostPath | `""` |
|
||||
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `""` |
|
||||
| `dataStore.sql.databaseType` | Other supported databases are "postgres" and "mysql" | `sqlite3` |
|
||||
| `dataStore.sql.databaseName` | Only used by "postgres" or "mysql" | `spire` |
|
||||
| `dataStore.sql.host` | Only used by "postgres" or "mysql" | `""` |
|
||||
@@ -339,6 +339,11 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `nodeAttestor.externalK8sPsat.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.externalK8sPsat.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
||||
| `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` |
|
||||
| `nodeAttestor.httpChallenge.enabled` | Enable the http_challenge nodeattesto | `false` |
|
||||
| `nodeAttestor.httpChallenge.allowedDNSPatterns` | A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed. | `[]` |
|
||||
| `nodeAttestor.httpChallenge.requiredPort` | Set to a port number to require clients to listen only on that port. If 0, all port numbers are allowed | `0` |
|
||||
| `nodeAttestor.httpChallenge.allowNonRootPorts` | Allow using ports >= 1024 from clients for attestation | `true` |
|
||||
| `nodeAttestor.httpChallenge.tofu` | Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024 | `true` |
|
||||
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
|
||||
| `nodeAttestor.tpmDirect.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `nodeAttestor.tpmDirect.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-server` |
|
||||
@@ -348,6 +353,18 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` |
|
||||
| `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` |
|
||||
| `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` |
|
||||
| `bundlePublisher.awsRolesAnywhereTrustAnchor.enabled` | Enable the AWS S3 bundle publisher | `false` |
|
||||
| `bundlePublisher.awsRolesAnywhereTrustAnchor.region` | AWS region to store the trust bundle | `""` |
|
||||
| `bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID` | AWS trust anchor ID to publish to | `""` |
|
||||
| `bundlePublisher.awsS3.enabled` | Enable the AWS S3 bundle publisher | `false` |
|
||||
| `bundlePublisher.awsS3.region` | AWS region to store the trust bundle | `""` |
|
||||
| `bundlePublisher.awsS3.bucket` | AWS S3 bucket name to which the trust bundle is uploaded | `""` |
|
||||
| `bundlePublisher.awsS3.objectKey` | AWS S3 object key inside the bucket | `""` |
|
||||
| `bundlePublisher.awsS3.format` | Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] | `""` |
|
||||
| `bundlePublisher.gcpCloudStorage.enabled` | Enable the Google Cloud Storage bundle publisher | `false` |
|
||||
| `bundlePublisher.gcpCloudStorage.bucketName` | Google Cloud Storage bucket name to which the trust bundle is uploaded | `""` |
|
||||
| `bundlePublisher.gcpCloudStorage.objectName` | Google Cloud Storage object name | `""` |
|
||||
| `bundlePublisher.gcpCloudStorage.format` | Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] | `""` |
|
||||
|
||||
### Tornjak
|
||||
|
||||
@@ -387,6 +404,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
|
||||
| `tornjak.resources` | Resource requests and limits | `{}` |
|
||||
| `tornjak.securityContext` | Security Context to use | `{}` |
|
||||
| `secrets.aws.accessKeyID` | AWS Access Key ID | `""` |
|
||||
| `secrets.aws.secretAccessKey` | AWS Secret Access Key | `""` |
|
||||
| `secrets.gcp.applicationCredentials` | Google Application Credentials | `""` |
|
||||
| `customPlugins.bundlePublisher` | Custom plugins of type BundlePublisher are configured here | `{}` |
|
||||
| `customPlugins.credentialComposer` | Custom plugins of type CredentialComposer are configured here | `{}` |
|
||||
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
|
||||
@@ -396,7 +416,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `chown.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `chown.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `chown.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776` |
|
||||
| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a` |
|
||||
| `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
||||
| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` |
|
||||
@@ -409,5 +429,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a` |
|
||||
| `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` |
|
||||
|
||||
@@ -1,17 +0,0 @@
|
||||
{{- $root := . }}
|
||||
{{- with .Values.keyManager.awsKMS }}
|
||||
{{- if or (ne .accessKeyID "") (ne .secretAccessKey "") }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spire-server.fullname" $root }}-aws-kms
|
||||
namespace: {{ include "spire-server.namespace" $root }}
|
||||
data:
|
||||
{{- if ne .accessKeyID "" }}
|
||||
AWS_KMS_ACCESS_KEY_ID: {{ .accessKeyID | b64enc }}
|
||||
{{- end }}
|
||||
{{- if ne .secretAccessKey "" }}
|
||||
AWS_KMS_SECRET_ACCESS_KEY: {{ .secretAccessKey | b64enc }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,24 @@
|
||||
{{- $root := . }}
|
||||
{{- if or (ne .Values.keyManager.awsKMS.accessKeyID "") (ne .Values.keyManager.awsKMS.secretAccessKey "") (ne .Values.secrets.aws.accessKeyID "") (ne .Values.secrets.aws.secretAccessKey "") (ne .Values.secrets.gcp.applicationCredentials "") }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spire-server.fullname" $root }}-cloud
|
||||
namespace: {{ include "spire-server.namespace" $root }}
|
||||
data:
|
||||
{{- if ne .Values.keyManager.awsKMS.accessKeyID "" }}
|
||||
AWS_KMS_ACCESS_KEY_ID: {{ .Values.keyManager.awsKMS.accessKeyID | b64enc }}
|
||||
{{- end }}
|
||||
{{- if ne .Values.keyManager.awsKMS.secretAccessKey "" }}
|
||||
AWS_KMS_SECRET_ACCESS_KEY: {{ .Values.keyManager.awsKMS.secretAccessKey | b64enc }}
|
||||
{{- end }}
|
||||
{{- if ne .Values.secrets.aws.accessKeyID "" }}
|
||||
AWS_ACCESS_KEY_ID: {{ .Values.secrets.aws.accessKeyID | b64enc }}
|
||||
{{- end }}
|
||||
{{- if ne .Values.secrets.aws.secretAccessKey "" }}
|
||||
AWS_SECRET_ACCESS_KEY: {{ .Values.secrets.aws.secretAccessKey | b64enc }}
|
||||
{{- end }}
|
||||
{{- if ne .Values.secrets.gcp.applicationCredentials "" }}
|
||||
GOOGLE_APPLICATION_CREDENTIALS: {{ .Values.secrets.gcp.applicationCredentials | b64enc }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -103,7 +103,7 @@ plugins:
|
||||
plugin_data:
|
||||
{{ include "spire-server.datastore-config" . | nindent 10 }}
|
||||
|
||||
{{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.externalK8sPsat.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.tpmDirect.enabled }}
|
||||
{{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.externalK8sPsat.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }}
|
||||
NodeAttestor:
|
||||
{{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPsat.clusters }}
|
||||
{{- if or (eq (.Values.nodeAttestor.k8sPsat.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPsat.enabled | toString) "true") (gt (len $clusters) 0)) }}
|
||||
@@ -150,6 +150,21 @@ plugins:
|
||||
plugin_data: {}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.httpChallenge }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
http_challenge:
|
||||
plugin_data:
|
||||
{{- with .allowedDNSPatterns }}
|
||||
allowed_dns_patterns:
|
||||
{{ toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if ne (int .requiredPort) 0 }}
|
||||
required_port: {{ .requiredPort }}
|
||||
{{- end }}
|
||||
allow_non_root_ports: {{ .allowNonRootPorts }}
|
||||
tofu: {{ .tofu }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.tpmDirect }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
tpm:
|
||||
@@ -247,6 +262,31 @@ plugins:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if or .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled .Values.bundlePublisher.awsS3.enabled .Values.bundlePublisher.gcpCloudStorage.enabled }}
|
||||
BundlePublisher:
|
||||
{{- if .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled }}
|
||||
aws_rolesanywhere_trustanchor:
|
||||
plugin_data:
|
||||
region: {{ .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.region | quote }}
|
||||
trust_anchor_id: {{ .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.bundlePublisher.awsS3.enabled }}
|
||||
aws_s3:
|
||||
plugin_data:
|
||||
region: {{ .Values.bundlePublisher.awsS3.region | quote }}
|
||||
bucket: {{ .Values.bundlePublisher.awsS3.bucket | quote }}
|
||||
object_key: {{ .Values.bundlePublisher.awsS3.objectKey | quote }}
|
||||
format: {{ .Values.bundlePublisher.awsS3.format | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.bundlePublisher.gcpCloudStorage.enabled }}
|
||||
gcp_cloudstorage:
|
||||
plugin_data:
|
||||
bucket_name: {{ .Values.bundlePublisher.gcpCloudStorage.bucketName | quote }}
|
||||
object_name: {{ .Values.bundlePublisher.gcpCloudStorage.objectName | quote }}
|
||||
format: {{ .Values.bundlePublisher.awsS3.format | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.upstreamAuthority.disk }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
||||
|
||||
@@ -174,16 +174,37 @@ spec:
|
||||
- name: AWS_KMS_ACCESS_KEY_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $fullname }}-aws-kms
|
||||
name: {{ $fullname }}-cloud
|
||||
key: AWS_KMS_ACCESS_KEY_ID
|
||||
{{- end }}
|
||||
{{- if ne .Values.keyManager.awsKMS.secretAccessKey "" }}
|
||||
- name: AWS_KMS_SECRET_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $fullname }}-aws-kms
|
||||
name: {{ $fullname }}-cloud
|
||||
key: AWS_KMS_SECRET_ACCESS_KEY
|
||||
{{- end }}
|
||||
{{- if ne .Values.secrets.aws.accessKeyID "" }}
|
||||
- name: AWS_ACCESS_KEY_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $fullname }}-cloud
|
||||
key: AWS_ACCESS_KEY_ID
|
||||
{{- end }}
|
||||
{{- if ne .Values.secrets.aws.secretAccessKey "" }}
|
||||
- name: AWS_SECRET_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $fullname }}-cloud
|
||||
key: AWS_SECRET_ACCESS_KEY
|
||||
{{- end }}
|
||||
{{- if ne .Values.secrets.gcp.applicationCredentials "" }}
|
||||
- name: GOOGLE_APPLICATION_CREDENTIALS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $fullname }}-cloud
|
||||
key: GOOGLE_APPLICATION_CREDENTIALS
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: grpc
|
||||
containerPort: 8081
|
||||
|
||||
@@ -144,7 +144,7 @@ readinessProbe:
|
||||
## @param persistence.size What size volume to use for persistence
|
||||
## @param persistence.accessMode What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended)
|
||||
## @param persistence.storageClass What storage class to use for persistence
|
||||
## @param persistence.hostPath Which path to use on the host when type = hostPath
|
||||
## @param persistence.hostPath Which path to use on the host when persistence.type = hostPath
|
||||
##
|
||||
persistence:
|
||||
type: pvc
|
||||
@@ -827,6 +827,17 @@ nodeAttestor:
|
||||
joinToken:
|
||||
## @param nodeAttestor.joinToken.enabled Enable the join_token nodeattestor
|
||||
enabled: false
|
||||
httpChallenge:
|
||||
## @param nodeAttestor.httpChallenge.enabled Enable the http_challenge nodeattesto
|
||||
enabled: false
|
||||
## @param nodeAttestor.httpChallenge.allowedDNSPatterns A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed.
|
||||
allowedDNSPatterns: []
|
||||
## @param nodeAttestor.httpChallenge.requiredPort Set to a port number to require clients to listen only on that port. If 0, all port numbers are allowed
|
||||
requiredPort: 0
|
||||
## @param nodeAttestor.httpChallenge.allowNonRootPorts Allow using ports >= 1024 from clients for attestation
|
||||
allowNonRootPorts: true
|
||||
## @param nodeAttestor.httpChallenge.tofu Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024
|
||||
tofu: true
|
||||
tpmDirect:
|
||||
## @param nodeAttestor.tpmDirect.enabled Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental.
|
||||
enabled: false
|
||||
@@ -849,6 +860,36 @@ nodeAttestor:
|
||||
## @param nodeAttestor.tpmDirect.hashes A list of TPM hashes that are allowed to connect.
|
||||
hashes: []
|
||||
|
||||
# The secrets needed for this plugin are configured in the secrets: section
|
||||
bundlePublisher:
|
||||
awsRolesAnywhereTrustAnchor:
|
||||
## @param bundlePublisher.awsRolesAnywhereTrustAnchor.enabled Enable the AWS S3 bundle publisher
|
||||
enabled: false
|
||||
## @param bundlePublisher.awsRolesAnywhereTrustAnchor.region AWS region to store the trust bundle
|
||||
region: ""
|
||||
## @param bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID AWS trust anchor ID to publish to
|
||||
trustAnchorID: ""
|
||||
awsS3:
|
||||
## @param bundlePublisher.awsS3.enabled Enable the AWS S3 bundle publisher
|
||||
enabled: false
|
||||
## @param bundlePublisher.awsS3.region AWS region to store the trust bundle
|
||||
region: ""
|
||||
## @param bundlePublisher.awsS3.bucket AWS S3 bucket name to which the trust bundle is uploaded
|
||||
bucket: ""
|
||||
## @param bundlePublisher.awsS3.objectKey AWS S3 object key inside the bucket
|
||||
objectKey: ""
|
||||
## @param bundlePublisher.awsS3.format Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem]
|
||||
format: ""
|
||||
gcpCloudStorage:
|
||||
## @param bundlePublisher.gcpCloudStorage.enabled Enable the Google Cloud Storage bundle publisher
|
||||
enabled: false
|
||||
## @param bundlePublisher.gcpCloudStorage.bucketName Google Cloud Storage bucket name to which the trust bundle is uploaded
|
||||
bucketName: ""
|
||||
## @param bundlePublisher.gcpCloudStorage.objectName Google Cloud Storage object name
|
||||
objectName: ""
|
||||
## @param bundlePublisher.gcpCloudStorage.format Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem]
|
||||
format: ""
|
||||
|
||||
## @section Tornjak
|
||||
tornjak:
|
||||
## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production)
|
||||
@@ -964,6 +1005,16 @@ tornjak:
|
||||
## @param tornjak.securityContext [object] Security Context to use
|
||||
securityContext: {}
|
||||
|
||||
secrets:
|
||||
aws:
|
||||
## @param secrets.aws.accessKeyID AWS Access Key ID
|
||||
accessKeyID: ""
|
||||
## @param secrets.aws.secretAccessKey AWS Secret Access Key
|
||||
secretAccessKey: ""
|
||||
gcp:
|
||||
## @param secrets.gcp.applicationCredentials Google Application Credentials
|
||||
applicationCredentials: ""
|
||||
|
||||
# NOTE: This is unsupported and only to configure currently supported spire built in plugins but plugins unsupported by the chart.
|
||||
# Upgrades wont be tested for anything under this config. If you need this, please let the chart developers know your needs so we
|
||||
# can prioritize proper support.
|
||||
@@ -1001,7 +1052,7 @@ chown:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
tag: latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776
|
||||
tag: latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a
|
||||
|
||||
## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
@@ -1036,7 +1087,7 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776
|
||||
tag: latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a
|
||||
|
||||
## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters
|
||||
kubeConfigs: {}
|
||||
|
||||
@@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details.
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a` |
|
||||
|
||||
@@ -162,4 +162,4 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776
|
||||
tag: latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a
|
||||
|
||||
@@ -183,6 +183,9 @@ upstream-spire-agent:
|
||||
prometheus:
|
||||
## @param upstream-spire-agent.telemetry.prometheus.port The port where prometheus metrics are available
|
||||
port: 9989
|
||||
## @param upstream-spire-agent.persistence.hostPath Which path to use on the host when persistence.type = hostPath
|
||||
persistence:
|
||||
hostPath: /var/lib/spire/k8s/upstream-agent
|
||||
|
||||
## @section SPIFFE CSI Driver parameters
|
||||
## Parameter values for spiffe-csi-driver
|
||||
|
||||
@@ -61,7 +61,7 @@ helm upgrade --install ingress-nginx ingress-nginx --version "$VERSION_INGRESS_N
|
||||
--wait
|
||||
|
||||
# Test the ingress controller. Should 404 as there is no services yet.
|
||||
curl "$IP"
|
||||
common_test_url "$IP"
|
||||
|
||||
kubectl get configmap -n kube-system coredns -o yaml | grep hosts || kubectl get configmap -n kube-system coredns -o yaml | sed "/ready/a\ hosts {\n fallthrough\n }" | kubectl apply -f -
|
||||
kubectl get configmap -n kube-system coredns -o yaml | grep production.other || kubectl get configmap -n kube-system coredns -o yaml | sed "/hosts/a\ $IP oidc-discovery.production.other\n $IP spire-server.production.other\n" | kubectl apply -f -
|
||||
|
||||
@@ -61,7 +61,7 @@ helm upgrade --install ingress-nginx ingress-nginx --version "$VERSION_INGRESS_N
|
||||
--wait
|
||||
|
||||
# Test the ingress controller. Should 404 as there is no services yet.
|
||||
curl "$IP"
|
||||
common_test_url "$IP"
|
||||
|
||||
kubectl get configmap -n kube-system coredns -o yaml | grep hosts || kubectl get configmap -n kube-system coredns -o yaml | sed "/ready/a\ hosts {\n fallthrough\n }" | kubectl apply -f -
|
||||
kubectl get configmap -n kube-system coredns -o yaml | grep production.other || kubectl get configmap -n kube-system coredns -o yaml | sed "/hosts/a\ $IP oidc-discovery.production.other\n $IP spire-server.production.other\n" | kubectl apply -f -
|
||||
|
||||
+4
-5
@@ -4,8 +4,8 @@ go 1.21
|
||||
toolchain go1.22.5
|
||||
|
||||
require (
|
||||
github.com/onsi/ginkgo/v2 v2.20.0
|
||||
github.com/onsi/gomega v1.34.1
|
||||
github.com/onsi/ginkgo/v2 v2.20.2
|
||||
github.com/onsi/gomega v1.34.2
|
||||
helm.sh/helm/v3 v3.15.4
|
||||
)
|
||||
|
||||
@@ -28,7 +28,7 @@ require (
|
||||
github.com/google/gnostic-models v0.6.8 // indirect
|
||||
github.com/google/go-cmp v0.6.0 // indirect
|
||||
github.com/google/gofuzz v1.2.0 // indirect
|
||||
github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 // indirect
|
||||
github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5 // indirect
|
||||
github.com/google/uuid v1.3.0 // indirect
|
||||
github.com/huandu/xstrings v1.4.0 // indirect
|
||||
github.com/imdario/mergo v0.3.13 // indirect
|
||||
@@ -47,10 +47,9 @@ require (
|
||||
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
|
||||
github.com/xeipuuv/gojsonschema v1.2.0 // indirect
|
||||
golang.org/x/crypto v0.26.0 // indirect
|
||||
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
|
||||
golang.org/x/net v0.28.0 // indirect
|
||||
golang.org/x/oauth2 v0.10.0 // indirect
|
||||
golang.org/x/sys v0.23.0 // indirect
|
||||
golang.org/x/sys v0.24.0 // indirect
|
||||
golang.org/x/term v0.23.0 // indirect
|
||||
golang.org/x/text v0.17.0 // indirect
|
||||
golang.org/x/time v0.3.0 // indirect
|
||||
|
||||
+8
-10
@@ -44,8 +44,8 @@ github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
|
||||
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
|
||||
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||
github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 h1:FKHo8hFI3A+7w0aUQuYXQ+6EN5stWmeY/AZqtM8xk9k=
|
||||
github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
|
||||
github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5 h1:5iH8iuqE5apketRbSFBy+X1V0o+l+8NF1avt4HWl7cA=
|
||||
github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
|
||||
github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
|
||||
github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
@@ -83,10 +83,10 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
|
||||
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
|
||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
|
||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
|
||||
github.com/onsi/ginkgo/v2 v2.20.0 h1:PE84V2mHqoT1sglvHc8ZdQtPcwmvvt29WLEEO3xmdZw=
|
||||
github.com/onsi/ginkgo/v2 v2.20.0/go.mod h1:lG9ey2Z29hR41WMVthyJBGUBcBhGOtoPF2VFMvBXFCI=
|
||||
github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
|
||||
github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
|
||||
github.com/onsi/ginkgo/v2 v2.20.2 h1:7NVCeyIWROIAheY21RLS+3j2bb52W0W82tkberYytp4=
|
||||
github.com/onsi/ginkgo/v2 v2.20.2/go.mod h1:K9gyxPIlb+aIvnZ8bd9Ak+YP18w3APlR+5coaZoE2ag=
|
||||
github.com/onsi/gomega v1.34.2 h1:pNCwDkzrsv7MS9kpaQvVb1aVLahQXyJ/Tv5oAZMI3i8=
|
||||
github.com/onsi/gomega v1.34.2/go.mod h1:v1xfxRgk0KIsG+QOdm7p8UosrOzPYRo60fd3B/1Dukc=
|
||||
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
|
||||
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
||||
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
||||
@@ -129,8 +129,6 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
|
||||
golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
|
||||
golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw=
|
||||
golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
|
||||
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
|
||||
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
|
||||
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
|
||||
@@ -158,8 +156,8 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
|
||||
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM=
|
||||
golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg=
|
||||
golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
|
||||
|
||||
Reference in New Issue
Block a user