From 25558d3410e5d4c40c4e13e593c978b3dde9ec40 Mon Sep 17 00:00:00 2001 From: cccsss01 <56396984+cccsss01@users.noreply.github.com> Date: Wed, 24 Jan 2024 07:02:04 -0600 Subject: [PATCH 01/11] Update daemonset.yaml (#204) Doubt there is a need to provide this as an option. Signed-off-by: cccsss01 <56396984+cccsss01@users.noreply.github.com> Co-authored-by: kfox1111 --- charts/spire/charts/spire-agent/templates/daemonset.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 0ac2ad8..952914f 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -15,6 +15,7 @@ spec: template: metadata: annotations: + kubectl.kubernetes.io/default-container: spire-agent checksum/config: {{ $configSum }} {{- with .Values.podAnnotations }} {{- toYaml . | nindent 8 }} From 3e1c5199b7388053a0f8b599daa95ebdfce273ba Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Wed, 24 Jan 2024 08:02:31 -0800 Subject: [PATCH 02/11] Always upgrade test from the previous major release (#207) --- examples/production/run-tests.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/examples/production/run-tests.sh b/examples/production/run-tests.sh index 595b96b..bd67728 100755 --- a/examples/production/run-tests.sh +++ b/examples/production/run-tests.sh @@ -2,7 +2,7 @@ set -xe -UPGRADE_VERSION=v0.15.1 +UPGRADE_VERSION=$(git ls-remote --tags origin -l 'spire-0.*' | awk -F. '{print $2}' | sort -n | tail -n 1 | sed 's/^/v0./; s/$/.0/') UPGRADE_REPO=https://spiffe.github.io/helm-charts-hardened SCRIPT="$(readlink -f "$0")" @@ -24,6 +24,10 @@ CLEANUP=1 for i in "$@"; do case $i in -u) + if [[ -z "$UPGRADE_VERSION" ]]; then + echo "Failed to detect previous version." + exit 1 + fi UPGRADE_ARGS="--repo $UPGRADE_REPO --version $UPGRADE_VERSION" shift # past argument=value ;; From e8d527cd9a1a4d228a3ff299830ad545cc0eed69 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 25 Jan 2024 03:07:10 -0800 Subject: [PATCH 03/11] Update to spire-controller-manager 0.4.2 (#195) --- charts/spire/charts/spire-server/README.md | 4 +++- .../templates/controller-manager-configmap.yaml | 3 +++ .../spire-server/templates/controller-manager-roles.yaml | 2 ++ .../spire-server/templates/controller-manager-webhook.yaml | 2 +- .../charts/spire-server/templates/post-install-hook.yaml | 2 +- .../charts/spire-server/templates/post-upgrade-hook.yaml | 2 +- .../charts/spire-server/templates/pre-upgrade-hook.yaml | 2 +- .../spire/charts/spire-server/templates/statefulset.yaml | 4 +++- charts/spire/charts/spire-server/values.yaml | 7 ++++++- 9 files changed, 21 insertions(+), 7 deletions(-) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 1f8f7e9..ad38490 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -223,6 +223,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.enabled` | Flag to enable controller manager | `false` | | `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` | | `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` | +| `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` | | `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` | | `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` | | `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | @@ -230,7 +231,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.1` | +| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.2` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | @@ -258,6 +259,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.identities.clusterSPIFFEIDs.test-keys.type` | The type of rule this is. | `test-keys` | | `controllerManager.identities.clusterStaticEntries` | Specify ClusterStaticEntry objects. | `{}` | | `controllerManager.identities.clusterFederatedTrustDomains` | Specify ClusterFederatedTrustDomain objects. | `{}` | +| `controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another chart instance on the k8s cluster with webhooks enabled. | `true` | | `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` | | `controllerManager.cacheNamespaces` | If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. | `{}` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml index f11982f..6cba49c 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -29,7 +29,9 @@ data: cacheNamespaces: {{- toYaml . | nindent 6 }} {{- end }} + {{- if .Values.controllerManager.validatingWebhookConfiguration.enabled }} validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook + {{- end }} clusterName: {{ include "spire-lib.cluster-name" . }} trustDomain: {{ include "spire-lib.trust-domain" . }} ignoreNamespaces: @@ -39,4 +41,5 @@ data: spireServerSocketPath: "/tmp/spire-server/private/api.sock" className: {{ include "spire-server.controller-manager-class-name" . | quote}} watchClassless: {{ .Values.controllerManager.watchClassless | toYaml }} + parentIDTemplate: {{ .Values.controllerManager.parentIDTemplate | quote }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml index 551b680..d2f9e9b 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml @@ -37,9 +37,11 @@ rules: - apiGroups: [""] resources: ["namespaces"] verbs: ["get", "list", "watch"] +{{- if .Values.controllerManager.validatingWebhookConfiguration.enabled }} - apiGroups: ["admissionregistration.k8s.io"] resources: ["validatingwebhookconfigurations"] verbs: ["get", "list", "patch", "watch"] +{{- end }} - apiGroups: [""] resources: ["nodes"] verbs: ["get", "list", "watch"] diff --git a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml index 40e9493..7f91f10 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml @@ -1,4 +1,4 @@ -{{- if eq (.Values.controllerManager.enabled | toString) "true" }} +{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }} apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml index 457f46b..6b4568e 100644 --- a/charts/spire/charts/spire-server/templates/post-install-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml @@ -1,5 +1,5 @@ {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} -{{- if eq (.Values.controllerManager.enabled | toString) "true" }} +{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} apiVersion: v1 kind: ServiceAccount diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml index 4d4d517..45f9525 100644 --- a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml @@ -1,5 +1,5 @@ {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} -{{- if eq (.Values.controllerManager.enabled | toString) "true" }} +{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} apiVersion: v1 kind: ServiceAccount diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml index 1d462bc..b3f8525 100644 --- a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml @@ -1,5 +1,5 @@ {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} -{{- if eq (.Values.controllerManager.enabled | toString) "true" }} +{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} apiVersion: v1 kind: ServiceAccount diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 45fe21d..a792e82 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -202,8 +202,10 @@ spec: {{- if .Values.controllerManager.expandEnv }} - --expand-env {{- end }} - {{- if gt (len .Values.controllerManager.extraEnv) 0 }} env: + - name: ENABLE_WEBHOOKS + value: {{ .Values.controllerManager.validatingWebhookConfiguration.enabled | toString | quote }} + {{- if gt (len .Values.controllerManager.extraEnv) 0 }} {{- .Values.controllerManager.extraEnv | toYaml | nindent 12 }} {{- end }} ports: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index e89b097..1b77f13 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -423,6 +423,9 @@ controllerManager: ## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. watchClassless: false + ## @param controllerManager.parentIDTemplate The template that is used to register workloads. + parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}" + ## @param controllerManager.expandEnv Set to true to enable environment variable substitution of config file options expandEnv: false @@ -445,7 +448,7 @@ controllerManager: registry: ghcr.io repository: spiffe/spire-controller-manager pullPolicy: IfNotPresent - tag: "0.4.1" + tag: "0.4.2" ## @param controllerManager.resources [object] Resource requests and limits for controller manager resources: {} @@ -570,6 +573,8 @@ controllerManager: # trustDomain: example.com validatingWebhookConfiguration: + ## @param controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another chart instance on the k8s cluster with webhooks enabled. + enabled: true ## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued failurePolicy: Fail From 573beaf2b02b2600b7a7af0b03397c9685a795de Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 25 Jan 2024 10:35:03 +0100 Subject: [PATCH 04/11] More quickly detect a daemonset is up and running Overall I see the daemonsets on my nodes be ready in approx 5 to 7 seconds. Reducing the initial delay allows them to be marked as ready within 10 seconds. In cases it takes longer the next probe will be in 30 seconds so max initial waiting time is 40 seconds to be marked as ready compared to 75 seconds at this point of time. Furhtermore the 30 seconds probes also allow more quick detection of failures Signed-off-by: Marco Franssen --- charts/spire/charts/spire-agent/README.md | 4 ++-- charts/spire/charts/spire-agent/values.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index d883505..e290d48 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -58,8 +58,8 @@ A Helm chart to install the SPIRE agent. | `healthChecks.port` | override the host port used for health checking | `9982` | | `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | | `livenessProbe.periodSeconds` | Period seconds for probe | `60` | -| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | -| `readinessProbe.periodSeconds` | Period seconds for probe | `60` | +| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` | +| `readinessProbe.periodSeconds` | Period seconds for probe | `30` | | `waitForIt.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` | | `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index a8b4dc8..7fef99c 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -119,8 +119,8 @@ livenessProbe: ## @param readinessProbe.periodSeconds Period seconds for probe ## readinessProbe: - initialDelaySeconds: 15 - periodSeconds: 60 + initialDelaySeconds: 10 + periodSeconds: 30 waitForIt: ## @param waitForIt.image.registry The OCI registry to pull the image from From 0fbc51223ca353f6df6ba0d20566c852327f4a70 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 26 Jan 2024 10:05:35 +0100 Subject: [PATCH 05/11] Remove the white line from securityContext rendering Prevents the following diff introduced since the 0.17.0 release. ```diff containers: - name: post-install-job securityContext: + allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true seccompProfile: type: RuntimeDefault ``` Signed-off-by: Marco Franssen --- charts/spire/templates/_spire-lib.tpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/templates/_spire-lib.tpl index 99a2e07..5ecde0a 100644 --- a/charts/spire/templates/_spire-lib.tpl +++ b/charts/spire/templates/_spire-lib.tpl @@ -273,7 +273,7 @@ fsGroupChangePolicy: OnRootMismatch {{- end }} {{- define "spire-lib.securitycontext" }} -{{ include "spire-lib.securitycontext-extended" (dict "root" . "securityContext" .Values.securityContext) }} +{{- include "spire-lib.securitycontext-extended" (dict "root" . "securityContext" .Values.securityContext) }} {{- end }} {{/* Same as securitycontext but takes in: From 01e031f71c70a7fa3fa5176befb63b5ad4e3e82b Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Fri, 26 Jan 2024 17:47:57 -0800 Subject: [PATCH 06/11] Add another upgrade note and fix value name (#215) * Add another upgrade note --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 --- charts/spire/README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 6b0b795..7f207bf 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -70,8 +70,9 @@ We only support upgrading one major version at a time. Version skipping isn't su ### 0.17.X +- If you set spire-server.replicaCount > 1, update it to 1 before upgrading and after upgrade you can set it back to its previous value. - The SPIFFE OIDC Discovery Provider now has many new TLS options and defaults to using SPIRE to issue its certificate. -- The `spiffe-oidc-discovery-provider.insecureScheme.enabled` flag was removed. If you previously set that flag, remove the setting from your values.yaml and see if the new default of using a SPIRE issued certificate is suitable for your deployment. If it isn't, please consider one of the other options under `spiffe-oidc-discovery-provider.tls`. If all other options are still unsuitable, you can still enable the previous mode by disabling TLS. (`spiffe-oidc-discovery-provider.spire.enabled=false`) +- The `spiffe-oidc-discovery-provider.insecureScheme.enabled` flag was removed. If you previously set that flag, remove the setting from your values.yaml and see if the new default of using a SPIRE issued certificate is suitable for your deployment. If it isn't, please consider one of the other options under `spiffe-oidc-discovery-provider.tls`. If all other options are still unsuitable, you can still enable the previous mode by disabling TLS. (`spiffe-oidc-discovery-provider.tls.spire.enabled=false`) - The SPIFFE OIDC Discovery Provider is now enabled by default. If you previously chose to have it off, you can disable it explicitly with `spiffe-oidc-discovery-provider.enabled=false`. From 7542052b65fd77a670fef294796b727dd468fd62 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 29 Jan 2024 09:24:31 +0000 Subject: [PATCH 07/11] Bump test chart dependencies (#219) Co-authored-by: marcofranssen --- .github/tests/charts.json | 6 +++--- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 4 ++-- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++-- charts/spire/charts/spire-agent/README.md | 4 ++-- charts/spire/charts/spire-agent/values.yaml | 4 ++-- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/charts/tornjak-frontend/README.md | 2 +- charts/spire/charts/tornjak-frontend/values.yaml | 2 +- 9 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 0497334..707c677 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "56.0.1" + "version": "56.2.1" }, { "name": "cert-manager", @@ -12,7 +12,7 @@ { "name": "ingress-nginx", "repo": "https://kubernetes.github.io/ingress-nginx", - "version": "4.9.0" + "version": "4.9.1" }, { "name": "mysql", @@ -22,6 +22,6 @@ { "name": "postgresql", "repo": "https://charts.bitnami.com/bitnami", - "version": "13.3.1" + "version": "13.4.3" } ] diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 91a89bc..942d1ef 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -115,11 +115,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:099e4b9adb13a94e6f25d6bb9bfe69fd5ba734a615e62bb0e1efba6650c6b23d` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:55cbdb5d87d89ab2c02efcb3bbc06f88bc70828e09294fb8a39be0cbc5c0a3b6` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:41c7d1fcb755339b883b0cf2998c52e77ba2e4fab9347665a54c6ef3e4d97838` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 27fa7bd..bb39601 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -328,7 +328,7 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:099e4b9adb13a94e6f25d6bb9bfe69fd5ba734a615e62bb0e1efba6650c6b23d + tag: latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f toolkit: ## @param tests.toolkit.image.registry The OCI registry to pull the image from @@ -340,7 +340,7 @@ tests: registry: cgr.dev repository: chainguard/slim-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:55cbdb5d87d89ab2c02efcb3bbc06f88bc70828e09294fb8a39be0cbc5c0a3b6 + tag: latest@sha256:41c7d1fcb755339b883b0cf2998c52e77ba2e4fab9347665a54c6ef3e4d97838 step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index e290d48..a54b664 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -63,12 +63,12 @@ A Helm chart to install the SPIRE agent. | `waitForIt.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` | | `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:84be7f9205d88f368097c3712a867c5d35d1d024633de4b5675b3f17f63f27cf` | +| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:e5f04633c3885d2a3a6fce512da4e03fcb064411f62642e7d2793bfafed10d59` | | `waitForIt.resources` | Resource requests and limits | `{}` | | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | -| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:099e4b9adb13a94e6f25d6bb9bfe69fd5ba734a615e62bb0e1efba6650c6b23d` | +| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 7fef99c..7eb8aae 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -132,7 +132,7 @@ waitForIt: registry: cgr.dev repository: chainguard/wait-for-it pullPolicy: IfNotPresent - tag: latest@sha256:84be7f9205d88f368097c3712a867c5d35d1d024633de4b5675b3f17f63f27cf + tag: latest@sha256:e5f04633c3885d2a3a6fce512da4e03fcb064411f62642e7d2793bfafed10d59 ## @param waitForIt.resources [object] Resource requests and limits resources: {} @@ -149,7 +149,7 @@ fsGroupFix: registry: cgr.dev repository: chainguard/bash pullPolicy: Always - tag: latest@sha256:099e4b9adb13a94e6f25d6bb9bfe69fd5ba734a615e62bb0e1efba6650c6b23d + tag: latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index ad38490..f714dd0 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -340,4 +340,4 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:099e4b9adb13a94e6f25d6bb9bfe69fd5ba734a615e62bb0e1efba6650c6b23d` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 1b77f13..df858d5 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -843,4 +843,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:099e4b9adb13a94e6f25d6bb9bfe69fd5ba734a615e62bb0e1efba6650c6b23d + tag: latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 6431c85..c456218 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -98,4 +98,4 @@ port forwarding. See the chart NOTES output for more details. | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:099e4b9adb13a94e6f25d6bb9bfe69fd5ba734a615e62bb0e1efba6650c6b23d` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f` | diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 07d5447..642ac27 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -154,4 +154,4 @@ tests: registry: cgr.dev repository: chainguard/bash pullPolicy: IfNotPresent - tag: latest@sha256:099e4b9adb13a94e6f25d6bb9bfe69fd5ba734a615e62bb0e1efba6650c6b23d + tag: latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f From f4c92ed3ca5ed51486896cadd665283f243d2188 Mon Sep 17 00:00:00 2001 From: cccsss01 <56396984+cccsss01@users.noreply.github.com> Date: Tue, 30 Jan 2024 12:55:10 -0600 Subject: [PATCH 08/11] Update README.md put cleanup seperately (#223) * Update README.md put cleanup seperately Signed-off-by: cccsss01 <56396984+cccsss01@users.noreply.github.com> * Update README.md Signed-off-by: cccsss01 <56396984+cccsss01@users.noreply.github.com> * Update charts/spire/README.md Co-authored-by: kfox1111 Signed-off-by: cccsss01 <56396984+cccsss01@users.noreply.github.com> --------- Signed-off-by: cccsss01 <56396984+cccsss01@users.noreply.github.com> Co-authored-by: kfox1111 --- charts/spire/README.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/charts/spire/README.md b/charts/spire/README.md index 7f207bf..25b25c6 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -64,6 +64,14 @@ helm upgrade --install -n spire-mgmt spire-crds spire-crds --repo https://spiffe helm upgrade --install -n spire-mgmt spire spire --repo https://spiffe.github.io/helm-charts-hardened/ -f your-values.yaml ``` +## Clean up + +```shell +helm -n spire-mgmt uninstall spire-crds +helm -n spire-mgmt uninstall spire +kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeids.spire.spiffe.io clusterstaticentries.spire.spiffe.io +``` + ## Upgrade notes We only support upgrading one major version at a time. Version skipping isn't supported. From 6b03d5a0bdc3270687cd4bcff0ada929322fe595 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Tue, 30 Jan 2024 11:33:32 -0800 Subject: [PATCH 09/11] Fix hardcoded nodeAttestor and keyManager in spire-agent (#221) * Fix hardcoded nodeAttestor and keyManager in spire-agent --------- Signed-off-by: Kevin Fox --- charts/spire/charts/spire-agent/README.md | 2 ++ .../charts/spire-agent/templates/configmap.yaml | 14 ++++++++++++++ charts/spire/charts/spire-agent/values.yaml | 10 ++++++++++ tests/unit/spire_test.go | 6 ++++++ 4 files changed, 32 insertions(+) diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index a54b664..b7ccf43 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -70,6 +70,8 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | | `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | +| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | +| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | | `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 347ffca..34a0d7e 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -56,15 +56,29 @@ agent: {{- end }} {{- end }} +{{- $nodeAttestorUsed := add (len .Values.customPlugins.nodeAttestor) (len .Values.unsupportedBuiltInPlugins.nodeAttestor) }} +{{- $keyManagerUsed := add (len .Values.customPlugins.keyManager) (len .Values.unsupportedBuiltInPlugins.keyManager) }} plugins: NodeAttestor: + {{- if .Values.nodeAttestor.k8sPsat.enabled }} k8s_psat: plugin_data: cluster: {{ include "spire-lib.cluster-name" . | quote }} + {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} + {{- end }} +{{- if ne $nodeAttestorUsed 1 }} +{{- fail (printf "You have to enable exactly one Node Attestor. There are %d enabled." $nodeAttestorUsed) }} +{{- end }} KeyManager: + {{- if .Values.keyManager.memory.enabled }} memory: plugin_data: + {{- $keyManagerUsed = add1 $keyManagerUsed }} + {{- end }} +{{- if ne $keyManagerUsed 1 }} +{{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }} +{{- end }} WorkloadAttestor: {{- if .Values.workloadAttestors.k8s.enabled }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 7eb8aae..8bcb698 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -154,6 +154,16 @@ fsGroupFix: ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} +keyManager: + memory: + ## @param keyManager.memory.enabled Enable the memory based Key Manager + enabled: true + +nodeAttestor: + k8sPsat: + ## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s Node Attestor + enabled: true + # workloadAttestors determine a workload's properties and then generate a set of selectors associated with it. workloadAttestors: # unix is a workload attestor which generates unix-based selectors like 'uid' and 'gid'. diff --git a/tests/unit/spire_test.go b/tests/unit/spire_test.go index 0c849ca..f356636 100644 --- a/tests/unit/spire_test.go +++ b/tests/unit/spire_test.go @@ -107,6 +107,9 @@ spire-server: It("plugin set ok", func() { objs, err := ValueStringRender(chart, ` spire-agent: + nodeAttestor: + k8sPsat: + enabled: false customPlugins: nodeAttestor: tpm: @@ -123,6 +126,9 @@ spire-agent: It("plugin set ok", func() { objs, err := ValueStringRender(chart, ` spire-agent: + nodeAttestor: + k8sPsat: + enabled: false unsupportedBuiltInPlugins: nodeAttestor: join_token: From d5475328b48b9276d99ae9e07def64f1d0f5dbf1 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Tue, 30 Jan 2024 11:55:12 -0800 Subject: [PATCH 10/11] Pass the agent's securityContext on to Kubernetes (#225) Currently its ignored. Signed-off-by: Kevin Fox --- charts/spire/charts/spire-agent/templates/daemonset.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 952914f..4d6c7c5 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -48,6 +48,8 @@ spec: args: ["-t", "30", "-h", "{{ include "spire-agent.server-address" . | trim }}", "-p", {{ .Values.server.port | quote }}] resources: {{- toYaml .Values.waitForIt.resources | nindent 12 }} + securityContext: + {{ toYaml .Values.securityContext | nindent 12 }} {{- if gt (int (dig "fsGroup" 0 $podSecurityContext)) 0 }} - name: fsgroupfix image: {{ template "spire-lib.image" (dict "image" .Values.fsGroupFix.image "global" .Values.global) }} @@ -72,6 +74,8 @@ spec: image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: ["-config", "/run/spire/config/agent.conf"] + securityContext: + {{ toYaml .Values.securityContext | nindent 12 }} env: - name: PATH value: "/opt/spire/bin:/bin" From 16ecfe9bb9f562b9873d86633b0ff9ec82233591 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Tue, 30 Jan 2024 13:53:41 -0800 Subject: [PATCH 11/11] Bump spire Helm Chart version from 0.17.0 to 0.17.1 (#226) * d547532 Pass the agent's securityContext on to Kubernetes (#225) * 6b03d5a Fix hardcoded nodeAttestor and keyManager in spire-agent (#221) * f4c92ed Update README.md put cleanup seperately (#223) * 7542052 Bump test chart dependencies (#219) * 01e031f Add another upgrade note and fix value name (#215) * 0fbc512 Remove the white line from securityContext rendering * 573beaf More quickly detect a daemonset is up and running * e8d527c Update to spire-controller-manager 0.4.2 (#195) * 25558d3 Update daemonset.yaml (#204) Signed-off-by: Faisal Memon --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 8de5383..2eca37e 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -3,7 +3,7 @@ name: spire description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.17.0 +version: 0.17.1 appVersion: "1.8.7" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire diff --git a/charts/spire/README.md b/charts/spire/README.md index 25b25c6..8978771 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.17.0](https://img.shields.io/badge/Version-0.17.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.8.7](https://img.shields.io/badge/AppVersion-1.8.7-informational?style=flat-square) +![Version: 0.17.1](https://img.shields.io/badge/Version-0.17.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.8.7](https://img.shields.io/badge/AppVersion-1.8.7-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.