Merge branch 'main' into release
This commit is contained in:
Faisal Memon
@@ -2,7 +2,7 @@
|
||||
{
|
||||
"name": "kube-prometheus-stack",
|
||||
"repo": "https://prometheus-community.github.io/helm-charts",
|
||||
"version": "56.0.1"
|
||||
"version": "56.2.1"
|
||||
},
|
||||
{
|
||||
"name": "cert-manager",
|
||||
@@ -12,7 +12,7 @@
|
||||
{
|
||||
"name": "ingress-nginx",
|
||||
"repo": "https://kubernetes.github.io/ingress-nginx",
|
||||
"version": "4.9.0"
|
||||
"version": "4.9.1"
|
||||
},
|
||||
{
|
||||
"name": "mysql",
|
||||
@@ -22,6 +22,6 @@
|
||||
{
|
||||
"name": "postgresql",
|
||||
"repo": "https://charts.bitnami.com/bitnami",
|
||||
"version": "13.3.1"
|
||||
"version": "13.4.3"
|
||||
}
|
||||
]
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire
|
||||
description: >
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
type: application
|
||||
version: 0.17.0
|
||||
version: 0.17.1
|
||||
appVersion: "1.8.7"
|
||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
|
||||
+11
-2
@@ -1,6 +1,6 @@
|
||||
# spire
|
||||
|
||||
  
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
@@ -64,14 +64,23 @@ helm upgrade --install -n spire-mgmt spire-crds spire-crds --repo https://spiffe
|
||||
helm upgrade --install -n spire-mgmt spire spire --repo https://spiffe.github.io/helm-charts-hardened/ -f your-values.yaml
|
||||
```
|
||||
|
||||
## Clean up
|
||||
|
||||
```shell
|
||||
helm -n spire-mgmt uninstall spire-crds
|
||||
helm -n spire-mgmt uninstall spire
|
||||
kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeids.spire.spiffe.io clusterstaticentries.spire.spiffe.io
|
||||
```
|
||||
|
||||
## Upgrade notes
|
||||
|
||||
We only support upgrading one major version at a time. Version skipping isn't supported.
|
||||
|
||||
### 0.17.X
|
||||
|
||||
- If you set spire-server.replicaCount > 1, update it to 1 before upgrading and after upgrade you can set it back to its previous value.
|
||||
- The SPIFFE OIDC Discovery Provider now has many new TLS options and defaults to using SPIRE to issue its certificate.
|
||||
- The `spiffe-oidc-discovery-provider.insecureScheme.enabled` flag was removed. If you previously set that flag, remove the setting from your values.yaml and see if the new default of using a SPIRE issued certificate is suitable for your deployment. If it isn't, please consider one of the other options under `spiffe-oidc-discovery-provider.tls`. If all other options are still unsuitable, you can still enable the previous mode by disabling TLS. (`spiffe-oidc-discovery-provider.spire.enabled=false`)
|
||||
- The `spiffe-oidc-discovery-provider.insecureScheme.enabled` flag was removed. If you previously set that flag, remove the setting from your values.yaml and see if the new default of using a SPIRE issued certificate is suitable for your deployment. If it isn't, please consider one of the other options under `spiffe-oidc-discovery-provider.tls`. If all other options are still unsuitable, you can still enable the previous mode by disabling TLS. (`spiffe-oidc-discovery-provider.tls.spire.enabled=false`)
|
||||
|
||||
- The SPIFFE OIDC Discovery Provider is now enabled by default. If you previously chose to have it off, you can disable it explicitly with `spiffe-oidc-discovery-provider.enabled=false`.
|
||||
|
||||
|
||||
@@ -115,11 +115,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:099e4b9adb13a94e6f25d6bb9bfe69fd5ba734a615e62bb0e1efba6650c6b23d` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f` |
|
||||
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` |
|
||||
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:55cbdb5d87d89ab2c02efcb3bbc06f88bc70828e09294fb8a39be0cbc5c0a3b6` |
|
||||
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:41c7d1fcb755339b883b0cf2998c52e77ba2e4fab9347665a54c6ef3e4d97838` |
|
||||
| `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` |
|
||||
| `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
|
||||
@@ -328,7 +328,7 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:099e4b9adb13a94e6f25d6bb9bfe69fd5ba734a615e62bb0e1efba6650c6b23d
|
||||
tag: latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f
|
||||
|
||||
toolkit:
|
||||
## @param tests.toolkit.image.registry The OCI registry to pull the image from
|
||||
@@ -340,7 +340,7 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/slim-toolkit-debug
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:55cbdb5d87d89ab2c02efcb3bbc06f88bc70828e09294fb8a39be0cbc5c0a3b6
|
||||
tag: latest@sha256:41c7d1fcb755339b883b0cf2998c52e77ba2e4fab9347665a54c6ef3e4d97838
|
||||
|
||||
step:
|
||||
## @param tests.step.image.registry The OCI registry to pull the image from
|
||||
|
||||
@@ -58,18 +58,20 @@ A Helm chart to install the SPIRE agent.
|
||||
| `healthChecks.port` | override the host port used for health checking | `9982` |
|
||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
|
||||
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
|
||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
|
||||
| `readinessProbe.periodSeconds` | Period seconds for probe | `60` |
|
||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` |
|
||||
| `readinessProbe.periodSeconds` | Period seconds for probe | `30` |
|
||||
| `waitForIt.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` |
|
||||
| `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:84be7f9205d88f368097c3712a867c5d35d1d024633de4b5675b3f17f63f27cf` |
|
||||
| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e5f04633c3885d2a3a6fce512da4e03fcb064411f62642e7d2793bfafed10d59` |
|
||||
| `waitForIt.resources` | Resource requests and limits | `{}` |
|
||||
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:099e4b9adb13a94e6f25d6bb9bfe69fd5ba734a615e62bb0e1efba6650c6b23d` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f` |
|
||||
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
|
||||
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` |
|
||||
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
|
||||
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
|
||||
| `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` |
|
||||
|
||||
@@ -56,15 +56,29 @@ agent:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- $nodeAttestorUsed := add (len .Values.customPlugins.nodeAttestor) (len .Values.unsupportedBuiltInPlugins.nodeAttestor) }}
|
||||
{{- $keyManagerUsed := add (len .Values.customPlugins.keyManager) (len .Values.unsupportedBuiltInPlugins.keyManager) }}
|
||||
plugins:
|
||||
NodeAttestor:
|
||||
{{- if .Values.nodeAttestor.k8sPsat.enabled }}
|
||||
k8s_psat:
|
||||
plugin_data:
|
||||
cluster: {{ include "spire-lib.cluster-name" . | quote }}
|
||||
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
||||
{{- end }}
|
||||
{{- if ne $nodeAttestorUsed 1 }}
|
||||
{{- fail (printf "You have to enable exactly one Node Attestor. There are %d enabled." $nodeAttestorUsed) }}
|
||||
{{- end }}
|
||||
|
||||
KeyManager:
|
||||
{{- if .Values.keyManager.memory.enabled }}
|
||||
memory:
|
||||
plugin_data:
|
||||
{{- $keyManagerUsed = add1 $keyManagerUsed }}
|
||||
{{- end }}
|
||||
{{- if ne $keyManagerUsed 1 }}
|
||||
{{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }}
|
||||
{{- end }}
|
||||
|
||||
WorkloadAttestor:
|
||||
{{- if .Values.workloadAttestors.k8s.enabled }}
|
||||
|
||||
@@ -15,6 +15,7 @@ spec:
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
kubectl.kubernetes.io/default-container: spire-agent
|
||||
checksum/config: {{ $configSum }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -47,6 +48,8 @@ spec:
|
||||
args: ["-t", "30", "-h", "{{ include "spire-agent.server-address" . | trim }}", "-p", {{ .Values.server.port | quote }}]
|
||||
resources:
|
||||
{{- toYaml .Values.waitForIt.resources | nindent 12 }}
|
||||
securityContext:
|
||||
{{ toYaml .Values.securityContext | nindent 12 }}
|
||||
{{- if gt (int (dig "fsGroup" 0 $podSecurityContext)) 0 }}
|
||||
- name: fsgroupfix
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.fsGroupFix.image "global" .Values.global) }}
|
||||
@@ -71,6 +74,8 @@ spec:
|
||||
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args: ["-config", "/run/spire/config/agent.conf"]
|
||||
securityContext:
|
||||
{{ toYaml .Values.securityContext | nindent 12 }}
|
||||
env:
|
||||
- name: PATH
|
||||
value: "/opt/spire/bin:/bin"
|
||||
|
||||
@@ -119,8 +119,8 @@ livenessProbe:
|
||||
## @param readinessProbe.periodSeconds Period seconds for probe
|
||||
##
|
||||
readinessProbe:
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 60
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
|
||||
waitForIt:
|
||||
## @param waitForIt.image.registry The OCI registry to pull the image from
|
||||
@@ -132,7 +132,7 @@ waitForIt:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/wait-for-it
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:84be7f9205d88f368097c3712a867c5d35d1d024633de4b5675b3f17f63f27cf
|
||||
tag: latest@sha256:e5f04633c3885d2a3a6fce512da4e03fcb064411f62642e7d2793bfafed10d59
|
||||
|
||||
## @param waitForIt.resources [object] Resource requests and limits
|
||||
resources: {}
|
||||
@@ -149,11 +149,21 @@ fsGroupFix:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
tag: latest@sha256:099e4b9adb13a94e6f25d6bb9bfe69fd5ba734a615e62bb0e1efba6650c6b23d
|
||||
tag: latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f
|
||||
|
||||
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
||||
keyManager:
|
||||
memory:
|
||||
## @param keyManager.memory.enabled Enable the memory based Key Manager
|
||||
enabled: true
|
||||
|
||||
nodeAttestor:
|
||||
k8sPsat:
|
||||
## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s Node Attestor
|
||||
enabled: true
|
||||
|
||||
# workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
|
||||
workloadAttestors:
|
||||
# unix is a workload attestor which generates unix-based selectors like 'uid' and 'gid'.
|
||||
|
||||
@@ -223,6 +223,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
||||
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
||||
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
||||
| `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
|
||||
| `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` |
|
||||
| `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` |
|
||||
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||
@@ -230,7 +231,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
||||
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.1` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.2` |
|
||||
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
||||
| `controllerManager.securityContext` | Security context | `{}` |
|
||||
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
||||
@@ -258,6 +259,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.type` | The type of rule this is. | `test-keys` |
|
||||
| `controllerManager.identities.clusterStaticEntries` | Specify ClusterStaticEntry objects. | `{}` |
|
||||
| `controllerManager.identities.clusterFederatedTrustDomains` | Specify ClusterFederatedTrustDomain objects. | `{}` |
|
||||
| `controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another chart instance on the k8s cluster with webhooks enabled. | `true` |
|
||||
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
|
||||
| `controllerManager.cacheNamespaces` | If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. | `{}` |
|
||||
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
@@ -338,4 +340,4 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:099e4b9adb13a94e6f25d6bb9bfe69fd5ba734a615e62bb0e1efba6650c6b23d` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f` |
|
||||
|
||||
@@ -29,7 +29,9 @@ data:
|
||||
cacheNamespaces:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
clusterName: {{ include "spire-lib.cluster-name" . }}
|
||||
trustDomain: {{ include "spire-lib.trust-domain" . }}
|
||||
ignoreNamespaces:
|
||||
@@ -39,4 +41,5 @@ data:
|
||||
spireServerSocketPath: "/tmp/spire-server/private/api.sock"
|
||||
className: {{ include "spire-server.controller-manager-class-name" . | quote}}
|
||||
watchClassless: {{ .Values.controllerManager.watchClassless | toYaml }}
|
||||
parentIDTemplate: {{ .Values.controllerManager.parentIDTemplate | quote }}
|
||||
{{- end }}
|
||||
|
||||
@@ -37,9 +37,11 @@ rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["namespaces"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
{{- if .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "patch", "watch"]
|
||||
{{- end }}
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
|
||||
@@ -202,8 +202,10 @@ spec:
|
||||
{{- if .Values.controllerManager.expandEnv }}
|
||||
- --expand-env
|
||||
{{- end }}
|
||||
{{- if gt (len .Values.controllerManager.extraEnv) 0 }}
|
||||
env:
|
||||
- name: ENABLE_WEBHOOKS
|
||||
value: {{ .Values.controllerManager.validatingWebhookConfiguration.enabled | toString | quote }}
|
||||
{{- if gt (len .Values.controllerManager.extraEnv) 0 }}
|
||||
{{- .Values.controllerManager.extraEnv | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
|
||||
@@ -423,6 +423,9 @@ controllerManager:
|
||||
## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.
|
||||
watchClassless: false
|
||||
|
||||
## @param controllerManager.parentIDTemplate The template that is used to register workloads.
|
||||
parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"
|
||||
|
||||
## @param controllerManager.expandEnv Set to true to enable environment variable substitution of config file options
|
||||
expandEnv: false
|
||||
|
||||
@@ -445,7 +448,7 @@ controllerManager:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-controller-manager
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "0.4.1"
|
||||
tag: "0.4.2"
|
||||
|
||||
## @param controllerManager.resources [object] Resource requests and limits for controller manager
|
||||
resources: {}
|
||||
@@ -570,6 +573,8 @@ controllerManager:
|
||||
# trustDomain: example.com
|
||||
|
||||
validatingWebhookConfiguration:
|
||||
## @param controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another chart instance on the k8s cluster with webhooks enabled.
|
||||
enabled: true
|
||||
## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued
|
||||
failurePolicy: Fail
|
||||
|
||||
@@ -838,4 +843,4 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:099e4b9adb13a94e6f25d6bb9bfe69fd5ba734a615e62bb0e1efba6650c6b23d
|
||||
tag: latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f
|
||||
|
||||
@@ -98,4 +98,4 @@ port forwarding. See the chart NOTES output for more details.
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:099e4b9adb13a94e6f25d6bb9bfe69fd5ba734a615e62bb0e1efba6650c6b23d` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f` |
|
||||
|
||||
@@ -154,4 +154,4 @@ tests:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:099e4b9adb13a94e6f25d6bb9bfe69fd5ba734a615e62bb0e1efba6650c6b23d
|
||||
tag: latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f
|
||||
|
||||
@@ -273,7 +273,7 @@ fsGroupChangePolicy: OnRootMismatch
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-lib.securitycontext" }}
|
||||
{{ include "spire-lib.securitycontext-extended" (dict "root" . "securityContext" .Values.securityContext) }}
|
||||
{{- include "spire-lib.securitycontext-extended" (dict "root" . "securityContext" .Values.securityContext) }}
|
||||
{{- end }}
|
||||
|
||||
{{/* Same as securitycontext but takes in:
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
set -xe
|
||||
|
||||
UPGRADE_VERSION=v0.15.1
|
||||
UPGRADE_VERSION=$(git ls-remote --tags origin -l 'spire-0.*' | awk -F. '{print $2}' | sort -n | tail -n 1 | sed 's/^/v0./; s/$/.0/')
|
||||
UPGRADE_REPO=https://spiffe.github.io/helm-charts-hardened
|
||||
|
||||
SCRIPT="$(readlink -f "$0")"
|
||||
@@ -24,6 +24,10 @@ CLEANUP=1
|
||||
for i in "$@"; do
|
||||
case $i in
|
||||
-u)
|
||||
if [[ -z "$UPGRADE_VERSION" ]]; then
|
||||
echo "Failed to detect previous version."
|
||||
exit 1
|
||||
fi
|
||||
UPGRADE_ARGS="--repo $UPGRADE_REPO --version $UPGRADE_VERSION"
|
||||
shift # past argument=value
|
||||
;;
|
||||
|
||||
@@ -107,6 +107,9 @@ spire-server:
|
||||
It("plugin set ok", func() {
|
||||
objs, err := ValueStringRender(chart, `
|
||||
spire-agent:
|
||||
nodeAttestor:
|
||||
k8sPsat:
|
||||
enabled: false
|
||||
customPlugins:
|
||||
nodeAttestor:
|
||||
tpm:
|
||||
@@ -123,6 +126,9 @@ spire-agent:
|
||||
It("plugin set ok", func() {
|
||||
objs, err := ValueStringRender(chart, `
|
||||
spire-agent:
|
||||
nodeAttestor:
|
||||
k8sPsat:
|
||||
enabled: false
|
||||
unsupportedBuiltInPlugins:
|
||||
nodeAttestor:
|
||||
join_token:
|
||||
|
||||
Reference in New Issue
Block a user