panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial spike support (#591)

Browse Source 
* Initial spike support

Signed-off-by: Kevin Fox <[email protected]>

* Fix lint and docs

Signed-off-by: Kevin Fox <[email protected]>

* Update spike to 0.4.1

Signed-off-by: Kevin Fox <[email protected]>

* Update for multiarch

Signed-off-by: Kevin Fox <[email protected]>

* Update

Signed-off-by: Kevin Fox <[email protected]>

* Fix values and docs

Signed-off-by: Kevin Fox <[email protected]>

* Pull in changes from Volkan

Signed-off-by: Kevin Fox <[email protected]>

* Fix service

Signed-off-by: Kevin Fox <[email protected]>

* Typo fix

Signed-off-by: Volkan Özçelik <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: Volkan Özçelik <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Volkan Özçelik <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
2025-06-23 23:07:40 -07:00
committed by GitHub
co-authored by Faisal Memon Volkan Özçelik
parent 38314ed6de
commit e78400ebcd
32 changed files with 1523 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+9
View File
@@ -311,6 +311,15 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.dnsNameTemplates` | DNS name template for issued identities | `[]` |
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable this identity for controller manager | `true` |
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.type` | The type of rule this is. | `test-keys` |
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.enabled` | Enable this identity for controller manager | `true` |
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type` | The type of rule this is. | `spike-keeper` |
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/keeper` |
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.enabled` | Enable this identity for controller manager | `true` |
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type` | The type of rule this is. | `spike-nexus` |
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/nexus` |
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.enabled` | Enable this identity for controller manager | `true` |
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.type` | The type of rule this is. | `spike-pilot` |
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/pilot/role/superuser` |
| `controllerManager.identities.clusterStaticEntries` | Specify ClusterStaticEntry objects. | `{}` |
| `controllerManager.identities.clusterFederatedTrustDomains` | Specify ClusterFederatedTrustDomain objects. | `{}` |
| `controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another chart instance on the k8s cluster with webhooks enabled. | `true` |
charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml
+17 -2
View File
@@ -17,6 +17,21 @@ matchLabels:
release: {{ .Release.Name }}
release-namespace: {{ .Release.Namespace }}
component: oidc-discovery-provider
{{- else if eq .type "spike-keeper" }}
matchLabels:
release: {{ .Release.Name }}
release-namespace: {{ .Release.Namespace }}
component: spike-keeper
{{- else if eq .type "spike-nexus" }}
matchLabels:
release: {{ .Release.Name }}
release-namespace: {{ .Release.Namespace }}
component: spike-nexus
{{- else if eq .type "spike-pilot" }}
matchLabels:
release: {{ .Release.Name }}
release-namespace: {{ .Release.Namespace }}
component: spike-pilot
{{- else if eq .type "test-keys" }}
matchLabels:
release: {{ .Release.Name }}
@@ -38,8 +53,8 @@ matchLabels:
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
{{- $type := dig "type" "base" $value }}
{{- if not (has $type (list "base" "raw" "child-servers" "oidc-discovery-provider" "test-keys")) }}
{{- fail (printf "Type given: %s, must be one of [base, raw, child-servers, oidc-discovery-provider, test-keys]" $type) }}
{{- if not (has $type (list "base" "raw" "child-servers" "oidc-discovery-provider" "spike-keeper" "spike-nexus" "spike-pilot" "test-keys")) }}
{{- fail (printf "Type given: %s, must be one of [base, raw, child-servers, oidc-discovery-provider, spike-keeper, spike-nexus, spike-pilot, test-keys]" $type) }}
{{- end }}
{{- $namespaceSelector := deepCopy (dig "namespaceSelector" (dict) $value) }}
{{- if ne $type "raw" }}
charts/spire/charts/spire-server/values.yaml
+22
View File
@@ -695,6 +695,28 @@ controllerManager:
## @param controllerManager.identities.clusterSPIFFEIDs.test-keys.type The type of rule this is.
type: test-keys
spike-keeper:
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.enabled Enable this identity for controller manager
enabled: true
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type The type of rule this is.
type: spike-keeper
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate The template to use for this rule.
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/keeper
spike-nexus:
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.enabled Enable this identity for controller manager
enabled: true
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type The type of rule this is.
type: spike-nexus
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate The template to use for this rule.
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/nexus
spike-pilot:
## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.enabled Enable this identity for controller manager
enabled: true
## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.type The type of rule this is.
type: spike-pilot
## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.spiffeIDTemplate The template to use for this rule.
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/pilot/role/superuser
# You can specify additional ClusterSPIFFEIDs following this example:
# foo:
# labels: