panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'main' into release

Browse Source
This commit is contained in:
Faisal Memon
2024-09-04 14:04:14 -07:00
parent e5138372f7 01b1114e26
commit e6d7d5784b
35 changed files with 525 additions and 212 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/tests/charts.json
+4 -4
View File
@@ -2,17 +2,17 @@
{ {
"name": "kube-prometheus-stack", "name": "kube-prometheus-stack",
"repo": "https://prometheus-community.github.io/helm-charts", "repo": "https://prometheus-community.github.io/helm-charts",
"version": "61.8.0" "version": "62.3.1"
}, },
{ {
"name": "cert-manager", "name": "cert-manager",
"repo": "https://charts.jetstack.io", "repo": "https://charts.jetstack.io",
"version": "v1.15.2" "version": "v1.15.3"
}, },
{ {
"name": "ingress-nginx", "name": "ingress-nginx",
"repo": "https://kubernetes.github.io/ingress-nginx", "repo": "https://kubernetes.github.io/ingress-nginx",
"version": "4.11.1" "version": "4.11.2"
}, },
{ {
"name": "mysql", "name": "mysql",
@@ -22,6 +22,6 @@
{ {
"name": "postgresql", "name": "postgresql",
"repo": "https://charts.bitnami.com/bitnami", "repo": "https://charts.bitnami.com/bitnami",
"version": "15.5.21" "version": "15.5.27"
} }
] ]
.github/tests/common.sh
+10
View File
@@ -72,6 +72,16 @@ $(helm ls -A | sed 's/\t/ | /g' | sed 's/^/| /' | sed 's/$/ |/' | sed '/^| NAME.
EOF EOF
} }
common_test_url () (
count=10
while true; do
if curl "$1"; then exit 0; fi
sleep 2
count=$((count-1))
[ $count -le 0 ] && exit 1
done
)
# Used just for testing. You should provide your own values as described in the install instructions. # Used just for testing. You should provide your own values as described in the install instructions.
common_test_your_values () { common_test_your_values () {
cat > /tmp/$$.example-your-values.yaml <<EOF cat > /tmp/$$.example-your-values.yaml <<EOF
.github/tests/images.json
+5
View File
@@ -17,6 +17,11 @@
"filter": "LATESTSHA", "filter": "LATESTSHA",
"sort-flags": [] "sort-flags": []
}, },
{
"query": "hostCert.image",
"filter": "LATESTSHA",
"sort-flags": []
},
{ {
"query": "fsGroupFix.image", "query": "fsGroupFix.image",
"filter": "LATESTSHA", "filter": "LATESTSHA",
charts/spire-nested/Chart.yaml
+2 -2
View File
@@ -3,8 +3,8 @@ name: spire-nested
description: > description: >
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
type: application type: application
version: 0.22.0 version: 0.23.0
appVersion: "1.10.1" appVersion: "1.10.3"
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
charts/spire-nested/README.md
+24 -21
View File
@@ -1,6 +1,6 @@
# spire # spire
![Version: 0.22.0](https://img.shields.io/badge/Version-0.22.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.10.1](https://img.shields.io/badge/AppVersion-1.10.1-informational?style=flat-square) ![Version: 0.23.0](https://img.shields.io/badge/Version-0.23.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.10.3](https://img.shields.io/badge/AppVersion-1.10.3-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
@@ -236,32 +236,35 @@ Now you can interact with the Spire agent socket from your own application. The
### Spire agent parameters ### Spire agent parameters
| Name | Description | Value | | Name | Description | Value |
| ------------------------------------------------- | ------------------------------------------------------------- | ------------------------- | | -------------------------------------------------- | -------------------------------------------------------------- | ------------------------------------- |
| `downstream-spire-agent-full.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` | | `downstream-spire-agent-full.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` |
| `downstream-spire-agent-full.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` | | `downstream-spire-agent-full.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
| `downstream-spire-agent-full.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-bundle-downstream` | | `downstream-spire-agent-full.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-bundle-downstream` |
| `downstream-spire-agent-full.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/downstream-agent` |
### Spire agent parameters ### Spire agent parameters
| Name | Description | Value | | Name | Description | Value |
| ----------------------------------------------------- | ------------------------------------------------------------- | ----------------------- | | ------------------------------------------------------ | -------------------------------------------------------------- | ------------------------------------- |
| `downstream-spire-agent-security.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` | | `downstream-spire-agent-security.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` |
| `downstream-spire-agent-security.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-bundle-upstream` | | `downstream-spire-agent-security.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-bundle-upstream` |
| `downstream-spire-agent-security.serviceAccount.name` | The name of the service account to use | `spire-agent-upstream` | | `downstream-spire-agent-security.serviceAccount.name` | The name of the service account to use | `spire-agent-upstream` |
| `downstream-spire-agent-security.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/downstream-agent` |
### Upstream Spire agent parameters ### Upstream Spire agent parameters
| Name | Description | Value | | Name | Description | Value |
| ------------------------------------------------ | -------------------------------------------------- | ---------------------------------------------------- | | ------------------------------------------------ | -------------------------------------------------------------- | ---------------------------------------------------- |
| `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` | | `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` |
| `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` | | `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` |
| `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` | | `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` |
| `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` | | `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` |
| `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` | | `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` |
| `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` | | `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` |
| `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` | | `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` |
| `upstream-spire-agent.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` | | `upstream-spire-agent.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` |
| `upstream-spire-agent.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/upstream-agent` |
### SPIFFE CSI Driver parameters ### SPIFFE CSI Driver parameters
charts/spire-nested/values.yaml
+9
View File
@@ -117,6 +117,9 @@ downstream-spire-agent-full:
nameOverride: internal-server nameOverride: internal-server
## @param downstream-spire-agent-full.bundleConfigMap The name of the configmap that contains the downstream bundle ## @param downstream-spire-agent-full.bundleConfigMap The name of the configmap that contains the downstream bundle
bundleConfigMap: spire-bundle-downstream bundleConfigMap: spire-bundle-downstream
## @param downstream-spire-agent-full.persistence.hostPath Which path to use on the host when persistence.type = hostPath
persistence:
hostPath: /var/lib/spire/k8s/downstream-agent
## @section Spire agent parameters ## @section Spire agent parameters
## Parameter values for Spire agent ## Parameter values for Spire agent
@@ -131,6 +134,9 @@ downstream-spire-agent-security:
serviceAccount: serviceAccount:
## @param downstream-spire-agent-security.serviceAccount.name The name of the service account to use ## @param downstream-spire-agent-security.serviceAccount.name The name of the service account to use
name: spire-agent-upstream name: spire-agent-upstream
## @param downstream-spire-agent-security.persistence.hostPath Which path to use on the host when persistence.type = hostPath
persistence:
hostPath: /var/lib/spire/k8s/downstream-agent
## @section Upstream Spire agent parameters ## @section Upstream Spire agent parameters
## Parameter values for upstream Spire agent ## Parameter values for upstream Spire agent
@@ -159,6 +165,9 @@ upstream-spire-agent:
server: server:
## @param upstream-spire-agent.server.nameOverride The name override setting of the root SPIRE server ## @param upstream-spire-agent.server.nameOverride The name override setting of the root SPIRE server
nameOverride: root-server nameOverride: root-server
## @param upstream-spire-agent.persistence.hostPath Which path to use on the host when persistence.type = hostPath
persistence:
hostPath: /var/lib/spire/k8s/upstream-agent
## @section SPIFFE CSI Driver parameters ## @section SPIFFE CSI Driver parameters
## Parameter values for spiffe-csi-driver ## Parameter values for spiffe-csi-driver
charts/spire/Chart.yaml
+2 -2
View File
@@ -3,8 +3,8 @@ name: spire
description: > description: >
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
type: application type: application
version: 0.22.0 version: 0.23.0
appVersion: "1.10.1" appVersion: "1.10.3"
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
charts/spire/README.md
+17 -10
View File
@@ -1,6 +1,6 @@
# spire # spire
![Version: 0.22.0](https://img.shields.io/badge/Version-0.22.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.10.1](https://img.shields.io/badge/AppVersion-1.10.1-informational?style=flat-square) ![Version: 0.23.0](https://img.shields.io/badge/Version-0.23.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.10.3](https://img.shields.io/badge/AppVersion-1.10.3-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
@@ -88,6 +88,12 @@ kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeid
We only support upgrading one major/minor version at a time. Version skipping isn't supported. Please see <https://spiffe.io/docs/latest/spire-helm-charts-hardened-about/upgrading/> for details. We only support upgrading one major/minor version at a time. Version skipping isn't supported. Please see <https://spiffe.io/docs/latest/spire-helm-charts-hardened-about/upgrading/> for details.
### 0.23.X
In previous versions, the setting spire-agent.workloadAttestors.k8s.skipKubeletVerification was set to true by default. Starting in 0.23.x, we removed that setting and replaced it with
spire-agent.workloadAttestors.k8s.verification.type. It defaults to "skip" which will have the same behavior as before. In a future version, it will be set to "auto". Please try
setting it to this with your deployment and let us know if you run into any problems so we can fix it before we change the default for everyone.
### 0.21.X ### 0.21.X
- In previous versions, spire-server.upstreamAuthority.certManager.issuer_name would incorrectly have '-ca' appended. Starting with this version, that is no longer the case. If you previously set this - In previous versions, spire-server.upstreamAuthority.certManager.issuer_name would incorrectly have '-ca' appended. Starting with this version, that is no longer the case. If you previously set this
@@ -300,15 +306,16 @@ Now you can interact with the Spire agent socket from your own application. The
### Upstream Spire agent parameters ### Upstream Spire agent parameters
| Name | Description | Value | | Name | Description | Value |
| ------------------------------------------------ | -------------------------------------------------- | ---------------------------------------------------- | | ------------------------------------------------ | -------------------------------------------------------------- | ---------------------------------------------------- |
| `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` | | `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` |
| `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` | | `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` |
| `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` | | `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` |
| `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` | | `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` |
| `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` | | `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` |
| `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` | | `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` |
| `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` | | `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` |
| `upstream-spire-agent.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/upstream-agent` |
### SPIFFE CSI Driver parameters ### SPIFFE CSI Driver parameters
charts/spire/charts/spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml
+4
View File
@@ -16,6 +16,7 @@ volumes:
- configmap - configmap
- hostPath - hostPath
- secret - secret
allowedCapabilities: null
allowHostDirVolumePlugin: true allowHostDirVolumePlugin: true
allowHostIPC: false allowHostIPC: false
allowHostNetwork: false allowHostNetwork: false
@@ -23,8 +24,11 @@ allowHostPID: false
allowHostPorts: false allowHostPorts: false
allowPrivilegeEscalation: true allowPrivilegeEscalation: true
allowPrivilegedContainer: true allowPrivilegedContainer: true
defaultAddCapabilities: null
fsGroup: fsGroup:
type: RunAsAny type: RunAsAny
groups: [] groups: []
priority: null
requiredDropCapabilities: null
{{ end }} {{ end }}
charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider
description: A Helm chart to install the SPIFFE OIDC discovery provider. description: A Helm chart to install the SPIFFE OIDC discovery provider.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.10.1" appVersion: "1.10.3"
keywords: ["spiffe", "oidc"] keywords: ["spiffe", "oidc"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+4 -3
View File
@@ -69,7 +69,8 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from. Only used when TLS is disabled. | `docker.io` | | `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from. Only used when TLS is disabled. | `docker.io` |
| `insecureScheme.nginx.image.repository` | The repository within the registry. Only used when TLS is disabled. | `nginxinc/nginx-unprivileged` | | `insecureScheme.nginx.image.repository` | The repository within the registry. Only used when TLS is disabled. | `nginxinc/nginx-unprivileged` |
| `insecureScheme.nginx.image.pullPolicy` | The image pull policy. Only used when TLS is disabled. | `IfNotPresent` | | `insecureScheme.nginx.image.pullPolicy` | The image pull policy. Only used when TLS is disabled. | `IfNotPresent` |
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.27.0-alpine` | | `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.27.1-alpine` |
| `insecureScheme.nginx.ipMode` | IP modes supported by the cluster. Must be one of [ipv4, ipv6, both] | `both` |
| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | | `insecureScheme.nginx.resources` | Resource requests and limits | `{}` |
| `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` | | `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` |
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | | `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
@@ -115,11 +116,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a` |
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:eb1c3f94b5a2303d74a804c1bfd5adc9c98e55e344bbe1adcd6522d6e80d5733` | | `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5420e15d91112458fc573755954c9174dbf4db8d802c4de3aac18145f5a78a17` |
| `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` |
| `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` |
charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
+1 -1
View File
@@ -93,7 +93,7 @@ Create the name of the service account to use
{{- end }} {{- end }}
{{- define "spiffe-oidc-discovery-provider.tls-enabled" -}} {{- define "spiffe-oidc-discovery-provider.tls-enabled" -}}
{{- if and .Values.enabled (or .Values.tls.spire.enabled .Values.tls.externalSecret.enabled .Values.tls.certManager.enabled) }} {{- if or .Values.tls.spire.enabled .Values.tls.externalSecret.enabled .Values.tls.certManager.enabled }}
{{- true }} {{- true }}
{{- else }} {{- else }}
{{- false }} {{- false }}
charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml
+4
View File
@@ -66,8 +66,12 @@ data:
} }
server { server {
{{- if or (eq .Values.insecureScheme.nginx.ipMode "ipv4") (eq .Values.insecureScheme.nginx.ipMode "both") }}
listen 8080; listen 8080;
{{- end }}
{{- if or (eq .Values.insecureScheme.nginx.ipMode "ipv6") (eq .Values.insecureScheme.nginx.ipMode "both") }}
listen [::]:8080; listen [::]:8080;
{{- end }}
location / { location / {
proxy_pass http://oidc; proxy_pass http://oidc;
charts/spire/charts/spiffe-oidc-discovery-provider/templates/scc-spire-oidc-discovery-provider.yaml
+4
View File
@@ -22,6 +22,7 @@ volumes:
- hostPath - hostPath
- projected - projected
- secret - secret
allowedCapabilities: null
allowHostDirVolumePlugin: true allowHostDirVolumePlugin: true
allowHostIPC: true allowHostIPC: true
allowHostNetwork: true allowHostNetwork: true
@@ -29,9 +30,12 @@ allowHostPID: true
allowHostPorts: true allowHostPorts: true
allowPrivilegeEscalation: true allowPrivilegeEscalation: true
allowPrivilegedContainer: true allowPrivilegedContainer: true
defaultAddCapabilities: null
fsGroup: fsGroup:
type: RunAsAny type: RunAsAny
groups: [] groups: []
priority: null
requiredDropCapabilities: null
seccompProfiles: seccompProfiles:
- '*' - '*'
charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+5 -3
View File
@@ -164,7 +164,9 @@ insecureScheme:
registry: docker.io registry: docker.io
repository: nginxinc/nginx-unprivileged repository: nginxinc/nginx-unprivileged
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: 1.27.0-alpine tag: 1.27.1-alpine
## @param insecureScheme.nginx.ipMode IP modes supported by the cluster. Must be one of [ipv4, ipv6, both]
ipMode: both
## @param insecureScheme.nginx.resources Resource requests and limits ## @param insecureScheme.nginx.resources Resource requests and limits
resources: {} resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious # We usually recommend not to specify default resources and to leave this as a conscious
@@ -328,7 +330,7 @@ tests:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776 tag: latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a
toolkit: toolkit:
## @param tests.toolkit.image.registry The OCI registry to pull the image from ## @param tests.toolkit.image.registry The OCI registry to pull the image from
@@ -340,7 +342,7 @@ tests:
registry: cgr.dev registry: cgr.dev
repository: chainguard/min-toolkit-debug repository: chainguard/min-toolkit-debug
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:eb1c3f94b5a2303d74a804c1bfd5adc9c98e55e344bbe1adcd6522d6e80d5733 tag: latest@sha256:5420e15d91112458fc573755954c9174dbf4db8d802c4de3aac18145f5a78a17
step: step:
## @param tests.step.image.registry The OCI registry to pull the image from ## @param tests.step.image.registry The OCI registry to pull the image from
charts/spire/charts/spire-agent/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spire-agent
description: A Helm chart to install the SPIRE agent. description: A Helm chart to install the SPIRE agent.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.10.1" appVersion: "1.10.3"
keywords: ["spiffe", "spire-agent"] keywords: ["spiffe", "spire-agent"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
charts/spire/charts/spire-agent/README.md
+119 -108
View File
@@ -25,111 +25,122 @@ A Helm chart to install the SPIRE agent.
### Chart parameters ### Chart parameters
| Name | Description | Value | | Name | Description | Value |
| --------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | | ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `image.repository` | The repository within the registry | `spiffe/spire-agent` | | `image.repository` | The repository within the registry | `spiffe/spire-agent` |
| `image.pullPolicy` | The image pull policy | `IfNotPresent` | | `image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `imagePullSecrets` | Pull secrets for images | `[]` | | `imagePullSecrets` | Pull secrets for images | `[]` |
| `nameOverride` | Name override | `""` | | `nameOverride` | Name override | `""` |
| `namespaceOverride` | Namespace override | `""` | | `namespaceOverride` | Namespace override | `""` |
| `fullnameOverride` | Fullname override | `""` | | `fullnameOverride` | Fullname override | `""` |
| `serviceAccount.create` | Specifies whether a service account should be created | `true` | | `serviceAccount.create` | Specifies whether a service account should be created | `true` |
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | | `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
| `serviceAccount.name` | The name of the service account to use. | `""` | | `serviceAccount.name` | The name of the service account to use. | `""` |
| `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` | | `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` |
| `podAnnotations` | Annotations to add to pods | `{}` | | `podAnnotations` | Annotations to add to pods | `{}` |
| `podLabels` | Labels to add to pods | `{}` | | `podLabels` | Labels to add to pods | `{}` |
| `podSecurityContext` | Pod security context | `{}` | | `podSecurityContext` | Pod security context | `{}` |
| `securityContext` | Security context | `{}` | | `securityContext` | Security context | `{}` |
| `resources` | Resource requests and limits | `{}` | | `resources` | Resource requests and limits | `{}` |
| `nodeSelector` | Node selector | `{}` | | `nodeSelector` | Node selector | `{}` |
| `tolerations` | List of tolerations | `[]` | | `tolerations` | List of tolerations | `[]` |
| `affinity` | Node affinity | `{}` | | `affinity` | Node affinity | `{}` |
| `authorizedDelegates` | A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information. | `[]` | | `authorizedDelegates` | A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information. | `[]` |
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | | `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
| `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` | | `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` |
| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` | | `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` |
| `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` | | `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` |
| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `pem` | | `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `pem` |
| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` | | `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` |
| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` | | `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` |
| `server.address` | Address for Spire server | `""` | | `server.address` | Address for Spire server | `""` |
| `server.port` | Port number for Spire server | `443` | | `server.port` | Port number for Spire server | `443` |
| `server.namespaceOverride` | Override the namespace for Spire server | `""` | | `server.namespaceOverride` | Override the namespace for Spire server | `""` |
| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` | | `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
| `healthChecks.port` | override the host port used for health checking | `9982` | | `healthChecks.port` | override the host port used for health checking | `9982` |
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` | | `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` | | `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` |
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | | `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` | | `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` | | `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` |
| `readinessProbe.periodSeconds` | Period seconds for probe | `30` | | `readinessProbe.periodSeconds` | Period seconds for probe | `30` |
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776` | | `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a` |
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` | | `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` |
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` | | `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` |
| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `docker.io` | | `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` |
| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-agent` | | `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` |
| `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` |
| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.8.7` | | `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `1d7c73ccac948ee86cbd78ddde2d30128a1838b403f7bb2100d38d916a252244` | | `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` | | `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-agent` |
| `nodeAttestor.tpmDirect.pubHash.enabled` | Enable Psat k8s nodeattestor | `true` | | `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `docker.io` | | `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.8.7` |
| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-get-tpm-pubhash` | | `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `1d7c73ccac948ee86cbd78ddde2d30128a1838b403f7bb2100d38d916a252244` |
| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` |
| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.8.7` | | `nodeAttestor.tpmDirect.pubHash.enabled` | Enable Psat k8s nodeattestor | `true` |
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | | `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-get-tpm-pubhash` |
| `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` | | `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` | | `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.8.7` |
| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false | `false` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
| `sds.enabled` | Enables Envoy SDS configuration | `false` | | `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` |
| `sds.defaultSvidName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` | | `workloadAttestors.k8s.verification.hostCert.basePath` | Path where kubelet places its certificates | `/var/lib/kubelet/pki` |
| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` | | `workloadAttestors.k8s.verification.hostCert.fileName` | File name where kubelet places its certificates. If blank, it will be auto detected. | `""` |
| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` | | `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
| `sds.disableSpiffeCertValidation` | Disable Envoy SDS custom validation | `false` | | `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false | `false` |
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | | `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` |
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | | `sds.enabled` | Enables Envoy SDS configuration | `false` |
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | | `sds.defaultSvidName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` |
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` | | `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` |
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | | `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` |
| `kubeletConnectByHostname` | If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` | | `sds.disableSpiffeCertValidation` | Disable Envoy SDS custom validation | `false` |
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | | `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` | | `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` | | `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776` | | `kubeletConnectByHostname` | If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` |
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` | | `socketAlternate.image.pullPolicy` | The image pull policy | `Always` |
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` | | `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a` |
| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` | | `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` | | `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5420e15d91112458fc573755954c9174dbf4db8d802c4de3aac18145f5a78a17` |
| `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` | | `hostCert.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `experimental.enabled` | Allow configuration of experimental features | `false` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
| `experimental.featureFlags` | List of developer feature flags | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` | | `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | | `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | | `initContainers` | Additional init containers to create with Spire Agent pods | `[]` |
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` |
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
| `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` | | `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` | | `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` |
| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` | | `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` |
| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` | | `experimental.enabled` | Allow configuration of experimental features | `false` |
| `persistence.hostPath` | Which path to use on the host when type = hostPath | `/var/lib/spire/k8s/agent` | | `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
| `experimental.featureFlags` | List of developer feature flags | `[]` |
| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` |
| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` |
| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` |
| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` |
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` |
charts/spire/charts/spire-agent/templates/configmap.yaml
+21 -5
View File
@@ -32,7 +32,7 @@ agent:
authorized_delegates: authorized_delegates:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
data_dir: "/run/spire" data_dir: "/var/lib/spire"
log_level: {{ .Values.logLevel | quote }} log_level: {{ .Values.logLevel | quote }}
retry_bootstrap: true retry_bootstrap: true
server_address: {{ include "spire-agent.server-address" . | trim | quote }} server_address: {{ include "spire-agent.server-address" . | trim | quote }}
@@ -79,6 +79,20 @@ plugins:
cluster: {{ include "spire-lib.cluster-name" . | quote }} cluster: {{ include "spire-lib.cluster-name" . | quote }}
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
{{- end }} {{- end }}
{{- with .Values.nodeAttestor.httpChallenge }}
{{- if eq (.enabled | toString) "true" }}
http_challenge:
plugin_data:
agentname: {{ .agentname | quote }}
{{- if ne (int .port) 0 }}
port: {{ .port }}
{{- end }}
{{- if ne (int .advertisedPort) 0 }}
advertisedPort: {{ .advertisedPort }}
{{- end }}
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
{{- end }}
{{- end }}
{{- with .Values.nodeAttestor.tpmDirect }} {{- with .Values.nodeAttestor.tpmDirect }}
{{- if eq (.enabled | toString) "true" }} {{- if eq (.enabled | toString) "true" }}
tpm: tpm:
@@ -106,10 +120,12 @@ plugins:
{{- if .Values.workloadAttestors.k8s.enabled }} {{- if .Values.workloadAttestors.k8s.enabled }}
k8s: k8s:
plugin_data: plugin_data:
# Defaults to the secure kubelet port by default. {{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }}
# Minikube does not have a cert in the cluster CA bundle that kubelet_ca_path: /hostCert/kubelet.crt
# can authenticate the kubelet cert, so skip validation. {{- else if eq .Values.workloadAttestors.k8s.verification.type "apiServerCA" }}
skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }} kubelet_ca_path: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
{{- end }}
skip_kubelet_verification: {{ eq .Values.workloadAttestors.k8s.verification.type "skip" }}
disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }} disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }}
use_new_container_locator: {{ .Values.workloadAttestors.k8s.useNewContainerLocator }} use_new_container_locator: {{ .Values.workloadAttestors.k8s.useNewContainerLocator }}
verbose_container_locator_logs: {{ .Values.workloadAttestors.k8s.verboseContainerLocatorLogs }} verbose_container_locator_logs: {{ .Values.workloadAttestors.k8s.verboseContainerLocatorLogs }}
charts/spire/charts/spire-agent/templates/daemonset.yaml
+64
View File
@@ -74,6 +74,58 @@ spec:
{{- toYaml .Values.hostAliases | nindent 8 }} {{- toYaml .Values.hostAliases | nindent 8 }}
{{- end }} {{- end }}
initContainers: initContainers:
{{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }}
- name: gather-host-cert
securityContext:
{{- $mainSecurityContext | toYaml | nindent 12 }}
image: {{ template "spire-lib.image" (dict "image" .Values.hostCert.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.hostCert.image.pullPolicy }}
command: ["bash", "-xc"]
args:
- |
{{- if ne .Values.workloadAttestors.k8s.verification.hostCert.fileName "" }}
openssl x509 -in "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/{{ .Values.workloadAttestors.k8s.verification.hostCert.fileName }}" -out /hostCert/kubelet.crt
{{- else }}
if [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet-server-current.pem" ]; then
openssl x509 -in "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet-server-current.pem" -out /hostCert/kubelet.crt
elif [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" ]; then
openssl x509 -in "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" -out /hostCert/kubelet.crt
else
{{- if eq .Values.workloadAttestors.k8s.verification.type "auto" }}
{{- if $cbh }}
URL="https://$NODE_NAME:10250/spec/"
{{- else }}
URL="https://localhost:10250/spec/"
{{- end }}
curl --caPath /var/run/secrets/kubernetes.io/serviceaccount/ca.crt "$URL"
if [ $? -eq 0 ]; then
echo Mode detected as apiServerCA.
ln -s /var/run/secrets/kubernetes.io/serviceaccount/ca.crt /hostCert/kubelet.crt
exit 0
fi
{{- end }}
echo Could not find certificate.
exit 1
fi
{{- end }}
{{- if eq .Values.workloadAttestors.k8s.verification.type "auto" }}
echo Mode detected as hostCert.
{{- end }}
chmod 644 /hostCert/kubelet.crt
env:
{{- if $cbh }}
- name: NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
{{- end }}
volumeMounts:
- name: host-cert-isolated
mountPath: /hostCert
- name: host-cert
mountPath: {{ .Values.workloadAttestors.k8s.verification.hostCert.basePath | quote }}
readOnly: true
{{- end }}
{{- if .Values.nodeAttestor.tpmDirect.enabled }} {{- if .Values.nodeAttestor.tpmDirect.enabled }}
{{- if .Values.nodeAttestor.tpmDirect.pubHash.enabled }} {{- if .Values.nodeAttestor.tpmDirect.pubHash.enabled }}
- name: fingerprint-tpm - name: fingerprint-tpm
@@ -220,6 +272,11 @@ spec:
readOnly: false readOnly: false
- name: spire-token - name: spire-token
mountPath: /var/run/secrets/tokens mountPath: /var/run/secrets/tokens
{{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }}
- name: host-cert-isolated
mountPath: /hostCert
readOnly: true
{{- end }}
{{- if gt (len .Values.extraVolumeMounts) 0 }} {{- if gt (len .Values.extraVolumeMounts) 0 }}
{{- toYaml .Values.extraVolumeMounts | nindent 12 }} {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
{{- end }} {{- end }}
@@ -302,6 +359,13 @@ spec:
path: /dev/kmsg path: /dev/kmsg
type: CharDevice type: CharDevice
{{- end }} {{- end }}
{{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }}
- name: host-cert-isolated
emptyDir: {}
- name: host-cert
hostPath:
path: {{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}
{{- end }}
{{- if gt (len .Values.extraVolumes) 0 }} {{- if gt (len .Values.extraVolumes) 0 }}
{{- toYaml .Values.extraVolumes | nindent 8 }} {{- toYaml .Values.extraVolumes | nindent 8 }}
{{- end }} {{- end }}
charts/spire/charts/spire-agent/templates/scc-spire-agent.yaml
+4
View File
@@ -18,6 +18,7 @@ volumes:
- projected - projected
- secret - secret
- emptyDir - emptyDir
allowedCapabilities: null
allowHostDirVolumePlugin: true allowHostDirVolumePlugin: true
allowHostIPC: true allowHostIPC: true
allowHostNetwork: true allowHostNetwork: true
@@ -25,8 +26,11 @@ allowHostPID: true
allowHostPorts: true allowHostPorts: true
allowPrivilegeEscalation: true allowPrivilegeEscalation: true
allowPrivilegedContainer: true allowPrivilegedContainer: true
defaultAddCapabilities: null
fsGroup: fsGroup:
type: RunAsAny type: RunAsAny
groups: [] groups: []
priority: null
requiredDropCapabilities: null
{{ end }} {{ end }}
charts/spire/charts/spire-agent/values.yaml
+35 -5
View File
@@ -151,7 +151,7 @@ fsGroupFix:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: Always pullPolicy: Always
tag: latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776 tag: latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {} resources: {}
@@ -165,6 +165,15 @@ nodeAttestor:
k8sPsat: k8sPsat:
## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s Node Attestor ## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s Node Attestor
enabled: true enabled: true
httpChallenge:
## @param nodeAttestor.httpChallenge.enabled Enable the http challenge Node Attestor
enabled: false
## @param nodeAttestor.httpChallenge.agentname Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port.
agentname: default
## @param nodeAttestor.httpChallenge.port The port to listen on. If 0, a random value will be used.
port: 0
## @param nodeAttestor.httpChallenge.advertisedPort The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting.
advertisedPort: 0
tpmDirect: tpmDirect:
## @param nodeAttestor.tpmDirect.enabled Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. ## @param nodeAttestor.tpmDirect.enabled Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental.
enabled: false enabled: false
@@ -206,8 +215,14 @@ workloadAttestors:
k8s: k8s:
## @param workloadAttestors.k8s.enabled Enables the Kubernetes workload attestor ## @param workloadAttestors.k8s.enabled Enables the Kubernetes workload attestor
enabled: true enabled: true
## @param workloadAttestors.k8s.skipKubeletVerification If true, kubelet certificate verification is skipped verification:
skipKubeletVerification: true ## @param workloadAttestors.k8s.verification.type What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip]
type: skip
hostCert:
## @param workloadAttestors.k8s.verification.hostCert.basePath Path where kubelet places its certificates
basePath: /var/lib/kubelet/pki
## @param workloadAttestors.k8s.verification.hostCert.fileName File name where kubelet places its certificates. If blank, it will be auto detected.
fileName: ""
## @param workloadAttestors.k8s.disableContainerSelectors Set to true if using holdApplicationUntilProxyStarts in Istio ## @param workloadAttestors.k8s.disableContainerSelectors Set to true if using holdApplicationUntilProxyStarts in Istio
disableContainerSelectors: false disableContainerSelectors: false
## @param workloadAttestors.k8s.useNewContainerLocator If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false ## @param workloadAttestors.k8s.useNewContainerLocator If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false
@@ -263,11 +278,26 @@ socketAlternate:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: Always pullPolicy: Always
tag: latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776 tag: latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a
## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {} resources: {}
hostCert:
## @param hostCert.image.registry The OCI registry to pull the image from
## @param hostCert.image.repository The repository within the registry
## @param hostCert.image.pullPolicy The image pull policy
## @param hostCert.image.tag Overrides the image tag whose default is the chart appVersion
##
image:
registry: cgr.dev
repository: chainguard/min-toolkit-debug
pullPolicy: IfNotPresent
tag: latest@sha256:5420e15d91112458fc573755954c9174dbf4db8d802c4de3aac18145f5a78a17
## @param hostCert.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {}
## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.
priorityClassName: "" priorityClassName: ""
@@ -353,7 +383,7 @@ sockets:
mountOnHost: false mountOnHost: false
## @param persistence.type What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) ## @param persistence.type What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors)
## @param persistence.hostPath Which path to use on the host when type = hostPath ## @param persistence.hostPath Which path to use on the host when persistence.type = hostPath
## ##
persistence: persistence:
type: emptyDir type: emptyDir
charts/spire/charts/spire-server/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spire-server
description: A Helm chart to install the SPIRE server. description: A Helm chart to install the SPIRE server.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.10.1" appVersion: "1.10.3"
keywords: ["spiffe", "spire-server", "spire-controller-manager"] keywords: ["spiffe", "spire-server", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
charts/spire/charts/spire-server/README.md
+23 -3
View File
@@ -124,7 +124,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `persistence.size` | What size volume to use for persistence | `1Gi` | | `persistence.size` | What size volume to use for persistence | `1Gi` |
| `persistence.accessMode` | What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) | `ReadWriteOnce` | | `persistence.accessMode` | What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) | `ReadWriteOnce` |
| `persistence.storageClass` | What storage class to use for persistence | `nil` | | `persistence.storageClass` | What storage class to use for persistence | `nil` |
| `persistence.hostPath` | Which path to use on the host when type = hostPath | `""` | | `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `""` |
| `dataStore.sql.databaseType` | Other supported databases are "postgres" and "mysql" | `sqlite3` | | `dataStore.sql.databaseType` | Other supported databases are "postgres" and "mysql" | `sqlite3` |
| `dataStore.sql.databaseName` | Only used by "postgres" or "mysql" | `spire` | | `dataStore.sql.databaseName` | Only used by "postgres" or "mysql" | `spire` |
| `dataStore.sql.host` | Only used by "postgres" or "mysql" | `""` | | `dataStore.sql.host` | Only used by "postgres" or "mysql" | `""` |
@@ -339,6 +339,11 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `nodeAttestor.externalK8sPsat.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` | | `nodeAttestor.externalK8sPsat.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` |
| `nodeAttestor.externalK8sPsat.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` | | `nodeAttestor.externalK8sPsat.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
| `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` | | `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` |
| `nodeAttestor.httpChallenge.enabled` | Enable the http_challenge nodeattesto | `false` |
| `nodeAttestor.httpChallenge.allowedDNSPatterns` | A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed. | `[]` |
| `nodeAttestor.httpChallenge.requiredPort` | Set to a port number to require clients to listen only on that port. If 0, all port numbers are allowed | `0` |
| `nodeAttestor.httpChallenge.allowNonRootPorts` | Allow using ports >= 1024 from clients for attestation | `true` |
| `nodeAttestor.httpChallenge.tofu` | Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024 | `true` |
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` | | `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
| `nodeAttestor.tpmDirect.image.registry` | The OCI registry to pull the image from | `docker.io` | | `nodeAttestor.tpmDirect.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `nodeAttestor.tpmDirect.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-server` | | `nodeAttestor.tpmDirect.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-server` |
@@ -348,6 +353,18 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` | | `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` |
| `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` | | `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` |
| `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` | | `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` |
| `bundlePublisher.awsRolesAnywhereTrustAnchor.enabled` | Enable the AWS S3 bundle publisher | `false` |
| `bundlePublisher.awsRolesAnywhereTrustAnchor.region` | AWS region to store the trust bundle | `""` |
| `bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID` | AWS trust anchor ID to publish to | `""` |
| `bundlePublisher.awsS3.enabled` | Enable the AWS S3 bundle publisher | `false` |
| `bundlePublisher.awsS3.region` | AWS region to store the trust bundle | `""` |
| `bundlePublisher.awsS3.bucket` | AWS S3 bucket name to which the trust bundle is uploaded | `""` |
| `bundlePublisher.awsS3.objectKey` | AWS S3 object key inside the bucket | `""` |
| `bundlePublisher.awsS3.format` | Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] | `""` |
| `bundlePublisher.gcpCloudStorage.enabled` | Enable the Google Cloud Storage bundle publisher | `false` |
| `bundlePublisher.gcpCloudStorage.bucketName` | Google Cloud Storage bucket name to which the trust bundle is uploaded | `""` |
| `bundlePublisher.gcpCloudStorage.objectName` | Google Cloud Storage object name | `""` |
| `bundlePublisher.gcpCloudStorage.format` | Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] | `""` |
### Tornjak ### Tornjak
@@ -387,6 +404,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` | | `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
| `tornjak.resources` | Resource requests and limits | `{}` | | `tornjak.resources` | Resource requests and limits | `{}` |
| `tornjak.securityContext` | Security Context to use | `{}` | | `tornjak.securityContext` | Security Context to use | `{}` |
| `secrets.aws.accessKeyID` | AWS Access Key ID | `""` |
| `secrets.aws.secretAccessKey` | AWS Secret Access Key | `""` |
| `secrets.gcp.applicationCredentials` | Google Application Credentials | `""` |
| `customPlugins.bundlePublisher` | Custom plugins of type BundlePublisher are configured here | `{}` | | `customPlugins.bundlePublisher` | Custom plugins of type BundlePublisher are configured here | `{}` |
| `customPlugins.credentialComposer` | Custom plugins of type CredentialComposer are configured here | `{}` | | `customPlugins.credentialComposer` | Custom plugins of type CredentialComposer are configured here | `{}` |
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` | | `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
@@ -396,7 +416,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `chown.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `chown.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `chown.image.repository` | The repository within the registry | `chainguard/bash` | | `chown.image.repository` | The repository within the registry | `chainguard/bash` |
| `chown.image.pullPolicy` | The image pull policy | `Always` | | `chown.image.pullPolicy` | The image pull policy | `Always` |
| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776` | | `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a` |
| `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `experimental.enabled` | Allow configuration of experimental features | `false` | | `experimental.enabled` | Allow configuration of experimental features | `false` |
| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | | `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` |
@@ -409,5 +429,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a` |
| `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | | `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` |
charts/spire/charts/spire-server/templates/aws-kms-secret.yaml
-17
View File
@@ -1,17 +0,0 @@
{{- $root := . }}
{{- with .Values.keyManager.awsKMS }}
{{- if or (ne .accessKeyID "") (ne .secretAccessKey "") }}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "spire-server.fullname" $root }}-aws-kms
namespace: {{ include "spire-server.namespace" $root }}
data:
{{- if ne .accessKeyID "" }}
AWS_KMS_ACCESS_KEY_ID: {{ .accessKeyID | b64enc }}
{{- end }}
{{- if ne .secretAccessKey "" }}
AWS_KMS_SECRET_ACCESS_KEY: {{ .secretAccessKey | b64enc }}
{{- end }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/cloud-secret.yaml
+24
View File
@@ -0,0 +1,24 @@
{{- $root := . }}
{{- if or (ne .Values.keyManager.awsKMS.accessKeyID "") (ne .Values.keyManager.awsKMS.secretAccessKey "") (ne .Values.secrets.aws.accessKeyID "") (ne .Values.secrets.aws.secretAccessKey "") (ne .Values.secrets.gcp.applicationCredentials "") }}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "spire-server.fullname" $root }}-cloud
namespace: {{ include "spire-server.namespace" $root }}
data:
{{- if ne .Values.keyManager.awsKMS.accessKeyID "" }}
AWS_KMS_ACCESS_KEY_ID: {{ .Values.keyManager.awsKMS.accessKeyID | b64enc }}
{{- end }}
{{- if ne .Values.keyManager.awsKMS.secretAccessKey "" }}
AWS_KMS_SECRET_ACCESS_KEY: {{ .Values.keyManager.awsKMS.secretAccessKey | b64enc }}
{{- end }}
{{- if ne .Values.secrets.aws.accessKeyID "" }}
AWS_ACCESS_KEY_ID: {{ .Values.secrets.aws.accessKeyID | b64enc }}
{{- end }}
{{- if ne .Values.secrets.aws.secretAccessKey "" }}
AWS_SECRET_ACCESS_KEY: {{ .Values.secrets.aws.secretAccessKey | b64enc }}
{{- end }}
{{- if ne .Values.secrets.gcp.applicationCredentials "" }}
GOOGLE_APPLICATION_CREDENTIALS: {{ .Values.secrets.gcp.applicationCredentials | b64enc }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/configmap.yaml
+41 -1
View File
@@ -103,7 +103,7 @@ plugins:
plugin_data: plugin_data:
{{ include "spire-server.datastore-config" . | nindent 10 }} {{ include "spire-server.datastore-config" . | nindent 10 }}
{{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.externalK8sPsat.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.tpmDirect.enabled }} {{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.externalK8sPsat.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }}
NodeAttestor: NodeAttestor:
{{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPsat.clusters }} {{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPsat.clusters }}
{{- if or (eq (.Values.nodeAttestor.k8sPsat.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPsat.enabled | toString) "true") (gt (len $clusters) 0)) }} {{- if or (eq (.Values.nodeAttestor.k8sPsat.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPsat.enabled | toString) "true") (gt (len $clusters) 0)) }}
@@ -150,6 +150,21 @@ plugins:
plugin_data: {} plugin_data: {}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- with .Values.nodeAttestor.httpChallenge }}
{{- if eq (.enabled | toString) "true" }}
http_challenge:
plugin_data:
{{- with .allowedDNSPatterns }}
allowed_dns_patterns:
{{ toYaml . | nindent 10 }}
{{- end }}
{{- if ne (int .requiredPort) 0 }}
required_port: {{ .requiredPort }}
{{- end }}
allow_non_root_ports: {{ .allowNonRootPorts }}
tofu: {{ .tofu }}
{{- end }}
{{- end }}
{{- with .Values.nodeAttestor.tpmDirect }} {{- with .Values.nodeAttestor.tpmDirect }}
{{- if eq (.enabled | toString) "true" }} {{- if eq (.enabled | toString) "true" }}
tpm: tpm:
@@ -247,6 +262,31 @@ plugins:
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- if or .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled .Values.bundlePublisher.awsS3.enabled .Values.bundlePublisher.gcpCloudStorage.enabled }}
BundlePublisher:
{{- if .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled }}
aws_rolesanywhere_trustanchor:
plugin_data:
region: {{ .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.region | quote }}
trust_anchor_id: {{ .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID | quote }}
{{- end }}
{{- if .Values.bundlePublisher.awsS3.enabled }}
aws_s3:
plugin_data:
region: {{ .Values.bundlePublisher.awsS3.region | quote }}
bucket: {{ .Values.bundlePublisher.awsS3.bucket | quote }}
object_key: {{ .Values.bundlePublisher.awsS3.objectKey | quote }}
format: {{ .Values.bundlePublisher.awsS3.format | quote }}
{{- end }}
{{- if .Values.bundlePublisher.gcpCloudStorage.enabled }}
gcp_cloudstorage:
plugin_data:
bucket_name: {{ .Values.bundlePublisher.gcpCloudStorage.bucketName | quote }}
object_name: {{ .Values.bundlePublisher.gcpCloudStorage.objectName | quote }}
format: {{ .Values.bundlePublisher.awsS3.format | quote }}
{{- end }}
{{- end }}
{{- with .Values.upstreamAuthority.disk }} {{- with .Values.upstreamAuthority.disk }}
{{- if eq (.enabled | toString) "true" }} {{- if eq (.enabled | toString) "true" }}
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }} {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
charts/spire/charts/spire-server/templates/server-resource.yaml
+23 -2
View File
@@ -174,16 +174,37 @@ spec:
- name: AWS_KMS_ACCESS_KEY_ID - name: AWS_KMS_ACCESS_KEY_ID
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: {{ $fullname }}-aws-kms name: {{ $fullname }}-cloud
key: AWS_KMS_ACCESS_KEY_ID key: AWS_KMS_ACCESS_KEY_ID
{{- end }} {{- end }}
{{- if ne .Values.keyManager.awsKMS.secretAccessKey "" }} {{- if ne .Values.keyManager.awsKMS.secretAccessKey "" }}
- name: AWS_KMS_SECRET_ACCESS_KEY - name: AWS_KMS_SECRET_ACCESS_KEY
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: {{ $fullname }}-aws-kms name: {{ $fullname }}-cloud
key: AWS_KMS_SECRET_ACCESS_KEY key: AWS_KMS_SECRET_ACCESS_KEY
{{- end }} {{- end }}
{{- if ne .Values.secrets.aws.accessKeyID "" }}
- name: AWS_ACCESS_KEY_ID
valueFrom:
secretKeyRef:
name: {{ $fullname }}-cloud
key: AWS_ACCESS_KEY_ID
{{- end }}
{{- if ne .Values.secrets.aws.secretAccessKey "" }}
- name: AWS_SECRET_ACCESS_KEY
valueFrom:
secretKeyRef:
name: {{ $fullname }}-cloud
key: AWS_SECRET_ACCESS_KEY
{{- end }}
{{- if ne .Values.secrets.gcp.applicationCredentials "" }}
- name: GOOGLE_APPLICATION_CREDENTIALS
valueFrom:
secretKeyRef:
name: {{ $fullname }}-cloud
key: GOOGLE_APPLICATION_CREDENTIALS
{{- end }}
ports: ports:
- name: grpc - name: grpc
containerPort: 8081 containerPort: 8081
charts/spire/charts/spire-server/values.yaml
+54 -3
View File
@@ -144,7 +144,7 @@ readinessProbe:
## @param persistence.size What size volume to use for persistence ## @param persistence.size What size volume to use for persistence
## @param persistence.accessMode What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) ## @param persistence.accessMode What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended)
## @param persistence.storageClass What storage class to use for persistence ## @param persistence.storageClass What storage class to use for persistence
## @param persistence.hostPath Which path to use on the host when type = hostPath ## @param persistence.hostPath Which path to use on the host when persistence.type = hostPath
## ##
persistence: persistence:
type: pvc type: pvc
@@ -827,6 +827,17 @@ nodeAttestor:
joinToken: joinToken:
## @param nodeAttestor.joinToken.enabled Enable the join_token nodeattestor ## @param nodeAttestor.joinToken.enabled Enable the join_token nodeattestor
enabled: false enabled: false
httpChallenge:
## @param nodeAttestor.httpChallenge.enabled Enable the http_challenge nodeattesto
enabled: false
## @param nodeAttestor.httpChallenge.allowedDNSPatterns A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed.
allowedDNSPatterns: []
## @param nodeAttestor.httpChallenge.requiredPort Set to a port number to require clients to listen only on that port. If 0, all port numbers are allowed
requiredPort: 0
## @param nodeAttestor.httpChallenge.allowNonRootPorts Allow using ports >= 1024 from clients for attestation
allowNonRootPorts: true
## @param nodeAttestor.httpChallenge.tofu Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024
tofu: true
tpmDirect: tpmDirect:
## @param nodeAttestor.tpmDirect.enabled Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. ## @param nodeAttestor.tpmDirect.enabled Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental.
enabled: false enabled: false
@@ -849,6 +860,36 @@ nodeAttestor:
## @param nodeAttestor.tpmDirect.hashes A list of TPM hashes that are allowed to connect. ## @param nodeAttestor.tpmDirect.hashes A list of TPM hashes that are allowed to connect.
hashes: [] hashes: []
# The secrets needed for this plugin are configured in the secrets: section
bundlePublisher:
awsRolesAnywhereTrustAnchor:
## @param bundlePublisher.awsRolesAnywhereTrustAnchor.enabled Enable the AWS S3 bundle publisher
enabled: false
## @param bundlePublisher.awsRolesAnywhereTrustAnchor.region AWS region to store the trust bundle
region: ""
## @param bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID AWS trust anchor ID to publish to
trustAnchorID: ""
awsS3:
## @param bundlePublisher.awsS3.enabled Enable the AWS S3 bundle publisher
enabled: false
## @param bundlePublisher.awsS3.region AWS region to store the trust bundle
region: ""
## @param bundlePublisher.awsS3.bucket AWS S3 bucket name to which the trust bundle is uploaded
bucket: ""
## @param bundlePublisher.awsS3.objectKey AWS S3 object key inside the bucket
objectKey: ""
## @param bundlePublisher.awsS3.format Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem]
format: ""
gcpCloudStorage:
## @param bundlePublisher.gcpCloudStorage.enabled Enable the Google Cloud Storage bundle publisher
enabled: false
## @param bundlePublisher.gcpCloudStorage.bucketName Google Cloud Storage bucket name to which the trust bundle is uploaded
bucketName: ""
## @param bundlePublisher.gcpCloudStorage.objectName Google Cloud Storage object name
objectName: ""
## @param bundlePublisher.gcpCloudStorage.format Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem]
format: ""
## @section Tornjak ## @section Tornjak
tornjak: tornjak:
## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production) ## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production)
@@ -964,6 +1005,16 @@ tornjak:
## @param tornjak.securityContext [object] Security Context to use ## @param tornjak.securityContext [object] Security Context to use
securityContext: {} securityContext: {}
secrets:
aws:
## @param secrets.aws.accessKeyID AWS Access Key ID
accessKeyID: ""
## @param secrets.aws.secretAccessKey AWS Secret Access Key
secretAccessKey: ""
gcp:
## @param secrets.gcp.applicationCredentials Google Application Credentials
applicationCredentials: ""
# NOTE: This is unsupported and only to configure currently supported spire built in plugins but plugins unsupported by the chart. # NOTE: This is unsupported and only to configure currently supported spire built in plugins but plugins unsupported by the chart.
# Upgrades wont be tested for anything under this config. If you need this, please let the chart developers know your needs so we # Upgrades wont be tested for anything under this config. If you need this, please let the chart developers know your needs so we
# can prioritize proper support. # can prioritize proper support.
@@ -1001,7 +1052,7 @@ chown:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: Always pullPolicy: Always
tag: latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776 tag: latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a
## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ ## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {} resources: {}
@@ -1036,7 +1087,7 @@ tests:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776 tag: latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a
## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters ## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters
kubeConfigs: {} kubeConfigs: {}
charts/spire/charts/tornjak-frontend/README.md
+1 -1
View File
@@ -101,4 +101,4 @@ port forwarding. See the chart NOTES output for more details.
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a` |
charts/spire/charts/tornjak-frontend/values.yaml
+1 -1
View File
@@ -162,4 +162,4 @@ tests:
registry: cgr.dev registry: cgr.dev
repository: chainguard/bash repository: chainguard/bash
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776 tag: latest@sha256:f5c85affd2aa0f55fc1ead7dc07952577ad82741bbbba742ead0fd9dde2de14a
charts/spire/values.yaml
+3
View File
@@ -183,6 +183,9 @@ upstream-spire-agent:
prometheus: prometheus:
## @param upstream-spire-agent.telemetry.prometheus.port The port where prometheus metrics are available ## @param upstream-spire-agent.telemetry.prometheus.port The port where prometheus metrics are available
port: 9989 port: 9989
## @param upstream-spire-agent.persistence.hostPath Which path to use on the host when persistence.type = hostPath
persistence:
hostPath: /var/lib/spire/k8s/upstream-agent
## @section SPIFFE CSI Driver parameters ## @section SPIFFE CSI Driver parameters
## Parameter values for spiffe-csi-driver ## Parameter values for spiffe-csi-driver
examples/nested-full/run-tests.sh
+1 -1
View File
@@ -61,7 +61,7 @@ helm upgrade --install ingress-nginx ingress-nginx --version "$VERSION_INGRESS_N
--wait --wait
# Test the ingress controller. Should 404 as there is no services yet. # Test the ingress controller. Should 404 as there is no services yet.
curl "$IP" common_test_url "$IP"
kubectl get configmap -n kube-system coredns -o yaml | grep hosts || kubectl get configmap -n kube-system coredns -o yaml | sed "/ready/a\ hosts {\n fallthrough\n }" | kubectl apply -f - kubectl get configmap -n kube-system coredns -o yaml | grep hosts || kubectl get configmap -n kube-system coredns -o yaml | sed "/ready/a\ hosts {\n fallthrough\n }" | kubectl apply -f -
kubectl get configmap -n kube-system coredns -o yaml | grep production.other || kubectl get configmap -n kube-system coredns -o yaml | sed "/hosts/a\ $IP oidc-discovery.production.other\n $IP spire-server.production.other\n" | kubectl apply -f - kubectl get configmap -n kube-system coredns -o yaml | grep production.other || kubectl get configmap -n kube-system coredns -o yaml | sed "/hosts/a\ $IP oidc-discovery.production.other\n $IP spire-server.production.other\n" | kubectl apply -f -
examples/nested-security/run-tests.sh
+1 -1
View File
@@ -61,7 +61,7 @@ helm upgrade --install ingress-nginx ingress-nginx --version "$VERSION_INGRESS_N
--wait --wait
# Test the ingress controller. Should 404 as there is no services yet. # Test the ingress controller. Should 404 as there is no services yet.
curl "$IP" common_test_url "$IP"
kubectl get configmap -n kube-system coredns -o yaml | grep hosts || kubectl get configmap -n kube-system coredns -o yaml | sed "/ready/a\ hosts {\n fallthrough\n }" | kubectl apply -f - kubectl get configmap -n kube-system coredns -o yaml | grep hosts || kubectl get configmap -n kube-system coredns -o yaml | sed "/ready/a\ hosts {\n fallthrough\n }" | kubectl apply -f -
kubectl get configmap -n kube-system coredns -o yaml | grep production.other || kubectl get configmap -n kube-system coredns -o yaml | sed "/hosts/a\ $IP oidc-discovery.production.other\n $IP spire-server.production.other\n" | kubectl apply -f - kubectl get configmap -n kube-system coredns -o yaml | grep production.other || kubectl get configmap -n kube-system coredns -o yaml | sed "/hosts/a\ $IP oidc-discovery.production.other\n $IP spire-server.production.other\n" | kubectl apply -f -
tests/go.mod
+4 -5
View File
@@ -4,8 +4,8 @@ go 1.21
toolchain go1.22.5 toolchain go1.22.5
require ( require (
github.com/onsi/ginkgo/v2 v2.20.0 github.com/onsi/ginkgo/v2 v2.20.2
github.com/onsi/gomega v1.34.1 github.com/onsi/gomega v1.34.2
helm.sh/helm/v3 v3.15.4 helm.sh/helm/v3 v3.15.4
) )
@@ -28,7 +28,7 @@ require (
github.com/google/gnostic-models v0.6.8 // indirect github.com/google/gnostic-models v0.6.8 // indirect
github.com/google/go-cmp v0.6.0 // indirect github.com/google/go-cmp v0.6.0 // indirect
github.com/google/gofuzz v1.2.0 // indirect github.com/google/gofuzz v1.2.0 // indirect
github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 // indirect github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5 // indirect
github.com/google/uuid v1.3.0 // indirect github.com/google/uuid v1.3.0 // indirect
github.com/huandu/xstrings v1.4.0 // indirect github.com/huandu/xstrings v1.4.0 // indirect
github.com/imdario/mergo v0.3.13 // indirect github.com/imdario/mergo v0.3.13 // indirect
@@ -47,10 +47,9 @@ require (
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
github.com/xeipuuv/gojsonschema v1.2.0 // indirect github.com/xeipuuv/gojsonschema v1.2.0 // indirect
golang.org/x/crypto v0.26.0 // indirect golang.org/x/crypto v0.26.0 // indirect
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
golang.org/x/net v0.28.0 // indirect golang.org/x/net v0.28.0 // indirect
golang.org/x/oauth2 v0.10.0 // indirect golang.org/x/oauth2 v0.10.0 // indirect
golang.org/x/sys v0.23.0 // indirect golang.org/x/sys v0.24.0 // indirect
golang.org/x/term v0.23.0 // indirect golang.org/x/term v0.23.0 // indirect
golang.org/x/text v0.17.0 // indirect golang.org/x/text v0.17.0 // indirect
golang.org/x/time v0.3.0 // indirect golang.org/x/time v0.3.0 // indirect
tests/go.sum
+8 -10
View File
@@ -44,8 +44,8 @@ github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0= github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 h1:FKHo8hFI3A+7w0aUQuYXQ+6EN5stWmeY/AZqtM8xk9k= github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5 h1:5iH8iuqE5apketRbSFBy+X1V0o+l+8NF1avt4HWl7cA=
github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo= github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I= github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -83,10 +83,10 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
github.com/onsi/ginkgo/v2 v2.20.0 h1:PE84V2mHqoT1sglvHc8ZdQtPcwmvvt29WLEEO3xmdZw= github.com/onsi/ginkgo/v2 v2.20.2 h1:7NVCeyIWROIAheY21RLS+3j2bb52W0W82tkberYytp4=
github.com/onsi/ginkgo/v2 v2.20.0/go.mod h1:lG9ey2Z29hR41WMVthyJBGUBcBhGOtoPF2VFMvBXFCI= github.com/onsi/ginkgo/v2 v2.20.2/go.mod h1:K9gyxPIlb+aIvnZ8bd9Ak+YP18w3APlR+5coaZoE2ag=
github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k= github.com/onsi/gomega v1.34.2 h1:pNCwDkzrsv7MS9kpaQvVb1aVLahQXyJ/Tv5oAZMI3i8=
github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY= github.com/onsi/gomega v1.34.2/go.mod h1:v1xfxRgk0KIsG+QOdm7p8UosrOzPYRo60fd3B/1Dukc=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -129,8 +129,6 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4= golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw= golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw=
golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54= golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
@@ -158,8 +156,8 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM= golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg=
golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc= golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=