panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'main' into release

Browse Source
This commit is contained in:
Faisal Memon
2023-05-12 11:20:47 -07:00
parent 7a67caca5c 8c5643b5f7
commit f7403f45cb
77 changed files with 1498 additions and 614 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/scripts/update-versions.sh
Executable
+24
View File
@@ -0,0 +1,24 @@
#!/usr/bin/env bash
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
CHARTJSON="${SCRIPTPATH}/../tests/charts.json"
jq -r ".[].name" "${CHARTJSON}" | while read -r CHART; do
ENTRYQUERY='.[] | select(.name == "'$CHART'")'
REPO_URL="$(jq -r "$ENTRYQUERY | .repo" "${CHARTJSON}")"
VERSION="$(jq -r "$ENTRYQUERY | .version" "${CHARTJSON}")"
echo Processing: "${CHART}"
echo " repo: ${REPO_URL}"
echo " current version: ${VERSION}"
helm repo add "${CHART}" "${REPO_URL}" > /dev/null
helm repo update "${CHART}" > /dev/null
LATEST_VERSION=$(helm search repo --regexp "${CHART}/${CHART}\v" -o json | jq -r '.[0].version')
echo " latest version: ${LATEST_VERSION}"
if [ "x${VERSION}" != "x${LATEST_VERSION}" ]; then
echo " New version found!"
jq "(${ENTRYQUERY}).version |= \"${LATEST_VERSION}\"" "${CHARTJSON}" > /tmp/$$
mv /tmp/$$ "${CHARTJSON}"
fi
done
.github/tests/charts.json
+27
View File
@@ -0,0 +1,27 @@
[
{
"name": "kube-prometheus-stack",
"repo": "https://prometheus-community.github.io/helm-charts",
"version": "45.26.0"
},
{
"name": "cert-manager",
"repo": "https://charts.jetstack.io",
"version": "v1.11.1"
},
{
"name": "ingress-nginx",
"repo": "https://kubernetes.github.io/ingress-nginx",
"version": "4.6.1"
},
{
"name": "mysql",
"repo": "https://charts.bitnami.com/bitnami",
"version": "9.7.2"
},
{
"name": "postgresql",
"repo": "https://charts.bitnami.com/bitnami",
"version": "12.2.2"
}
]
.github/tests/charts.sh
+6
View File
@@ -0,0 +1,6 @@
#!/usr/bin/env bash
REPOS=$(jq -r '.[] | "export " + ("HELM_REPO_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .repo' .github/tests/charts.json)
VERSIONS=$(jq -r '.[] | "export " + ("VERSION_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .version' .github/tests/charts.json)
eval "$REPOS"
eval "$VERSIONS"
.github/tests/common.sh
Executable
+69
View File
@@ -0,0 +1,69 @@
#!/usr/bin/env bash
get_namespace_details () {
cat <<EOF >>"$GITHUB_STEP_SUMMARY"
### Namespace $1
#### Events
\`\`\`shell
$(kubectl --request-timeout=30s get events --output wide --namespace "$1")
\`\`\`
#### Pods
\`\`\`shell
$(kubectl --request-timeout=30s describe pods --namespace "$1")
\`\`\`
#### Logs
\`\`\`shell
$(kubectl get pods -o name -n "$1" | while read -r line; do echo logs for "${line}"; kubectl logs -n "$1" "${line}" --all-containers=true --ignore-errors=true; done)
\`\`\`
EOF
}
k_wait () {
kubectl wait --for condition=available --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1
}
k_rollout_status () {
kubectl rollout status --watch --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1
}
get_spire_release_name () {
helm ls -A | grep '^spire' | awk '{print $1}'
}
print_spire_workload_status () {
local ns1
local ns2
ns1="$1"
ns2="${2:-$1}"
release_name="$(get_spire_release_name)"
cat <<EOF >>"$GITHUB_STEP_SUMMARY"
### Spire
| Namespace | Workload | Status |
| --------- | ---------------------------------------------- | ------ |
| ${ns1} | ${release_name}-server | <pre>$(k_rollout_status "${ns1}" statefulset "${release_name}-server")</pre> |
| ${ns2} | ${release_name}-spiffe-csi-driver | <pre>$(k_rollout_status "${ns2}" daemonset "${release_name}-spiffe-csi-driver")</pre> |
| ${ns2} | ${release_name}-agent | <pre>$(k_rollout_status "${ns2}" daemonset "${release_name}-agent")</pre> |
| ${ns1} | ${release_name}-spiffe-oidc-discovery-provider | <pre>$(k_rollout_status "${ns1}" deployments.apps "${release_name}-spiffe-oidc-discovery-provider")</pre> |
EOF
}
print_helm_releases () {
cat <<EOF >>"$GITHUB_STEP_SUMMARY"
### Releases
$(helm ls -A | sed 's/\t/ | /g' | sed 's/^/| /' | sed 's/$/ |/' | sed '/^| NAME.*/a| - | - | - | - | - | - | - |')
EOF
}
.github/tests/extras/post-install.sh
+17
View File
@@ -0,0 +1,17 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [[ "$1" -ne 0 ]]; then
get_namespace_details "${scenario}"
fi
.github/tests/federation-bundle-endpoint/post-install.sh
+17
View File
@@ -0,0 +1,17 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [[ "$1" -ne 0 ]]; then
get_namespace_details "${scenario}"
fi
.github/tests/namespace-override/post-install.sh
+11 -52
View File
@@ -2,59 +2,18 @@
set -x
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT")
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
k_wait () {
kubectl wait --for condition=available --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1
}
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
k_rollout_status () {
kubectl rollout status --watch --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1
}
print_helm_releases
print_spire_workload_status spire-server spire-system
RELEASE=$(helm ls --no-headers -n "${scenario}" | awk '{print $1}' | grep 'spire-[^-]*$')
if [[ "$1" -ne 0 ]]; then
get_namespace_details spire-server
get_namespace_details spire-systen
fi
cat <<EOF >>"$GITHUB_STEP_SUMMARY"
### release
| release |
| ------- |
| $RELEASE |
### spire
| workload | Status |
| -------- | ------ |
| spire-server | <pre>$(k_rollout_status spire-server statefulset "${RELEASE}-server")</pre> |
| spire-spiffe-csi-driver | <pre>$(k_rollout_status spire-system daemonset "${RELEASE}-spiffe-csi-driver")</pre> |
| spire-agent | <pre>$(k_rollout_status spire-system daemonset "${RELEASE}-agent")</pre> |
| spire-spiffe-oidc-discovery-provider | <pre>$(k_wait spire-server deployments.apps "${RELEASE}-spiffe-oidc-discovery-provider")</pre> |
EOF
if [ $1 -ne 0 ]; then
echo
echo '```'
echo '==> Events of namespace spire-server'
echo '........................................................................................................................'
echo '>>> kubectl --request-timeout=30s get events --output wide --namespace spire-server'
kubectl --request-timeout=30s get events --output wide --namespace spire-server
echo '........................................................................................................................'
echo '<== Events of namespace spire-server'
echo '........................................................................................................................'
echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-server'
kubectl --request-timeout=30s describe pods --namespace spire-server
echo '========================================================================================================================'
echo '==> Events of namespace spire-system'
echo '........................................................................................................................'
echo '>>> kubectl --request-timeout=30s get events --output wide --namespace spire-system'
kubectl --request-timeout=30s get events --output wide --namespace spire-system
echo '........................................................................................................................'
echo '<== Events of namespace spire-system'
echo '........................................................................................................................'
echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-system'
kubectl --request-timeout=30s describe pods --namespace spire-system
echo '========================================================================================================================'
kubectl get pods -o name -n spire-server | while read line; do echo logs for $line; kubectl logs -n spire-server $line --all-containers=true --ignore-errors=true; done
kubectl get pods -o name -n spire-system | while read line; do echo logs for $line; kubectl logs -n spire-system $line --all-containers=true --ignore-errors=true; done
echo '========================================================================================================================'
echo '```'
fi | cat >> "$GITHUB_STEP_SUMMARY"
.github/tests/namespace-override/pre-install.sh
+2 -1
View File
@@ -1,3 +1,4 @@
#!/bin/bash
#!/usr/bin/env bash
kubectl create namespace "spire-system"
kubectl create namespace "spire-server"
.github/tests/namespace-override/values.yaml
+1
View File
@@ -21,6 +21,7 @@ spire-agent:
enabled: true
namespaceOverride: spire-system
serviceAccount:
# -- The name of the service account to use.
name: spire-agent
server:
namespaceOverride: spire-server
.github/tests/no-spire-controller-manager/post-install.sh
+17
View File
@@ -0,0 +1,17 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [[ "$1" -ne 0 ]]; then
get_namespace_details "${scenario}"
fi
.github/tests/production-example/install.sh
+2 -2
View File
@@ -2,8 +2,8 @@
set -xe
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT")
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
helm install \
--namespace spire-server \
.github/tests/production-example/post-install.sh
+9 -42
View File
@@ -2,50 +2,17 @@
set -x
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT")
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
k_wait=(kubectl wait --for condition=available --timeout 30s --namespace)
k_rollout_status=(kubectl rollout status --watch --timeout 30s --namespace)
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
function get_namespace_details {
cat <<EOF >>"$GITHUB_STEP_SUMMARY"
### Namespace $1
print_helm_releases
print_spire_workload_status spire-server spire-system
#### Events
\`\`\`shell
$(kubectl --request-timeout=30s get events --output wide --namespace "$1")
\`\`\`
#### Pods
\`\`\`shell
$(kubectl --request-timeout=30s describe pods --namespace "$1")
\`\`\`
#### Logs
\`\`\`shell
$(kubectl get pods -o name -n "$1" | while read -r line; do echo logs for "${line}"; kubectl logs -n "$1" "${line}" --all-containers=true --ignore-errors=true; done)
\`\`\`
EOF
}
cat <<EOF >>"$GITHUB_STEP_SUMMARY"
### spire
| workload | Status |
| ------------------------------------ | ------ |
| spire-server | "$("${k_rollout_status[@]}" spire-server statefulset spire-server)" |
| spire-controller-manager | "$("${k_rollout_status[@]}" spire-server statefulset spire-controller-manager)" |
| spire-spiffe-oidc-discovery-provider | "$("${k_wait[@]}" spire-server deployments.apps spire-spiffe-oidc-discovery-provider)" |
| spire-spiffe-csi-driver | "$("${k_rollout_status[@]}" spire-system daemonset spire-spiffe-csi-driver)" |
| spire-agent | "$("${k_rollout_status[@]}" spire-system daemonset spire-agent)" |
EOF
if [ $1 -ne 0 ]; then
if [[ "$1" -ne 0 ]]; then
get_namespace_details spire-server
get_namespace_details spire-systen
get_namespace_details spire-system
fi
.github/tests/production-external-mysql/install.sh
Executable
+46
View File
@@ -0,0 +1,46 @@
#!/usr/bin/env bash
set -xe
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT")
DB=spire
DBUSER=spire
DBPW=$(uuidgen)
DBROOTPW=$(uuidgen)
# Generate random settings to make sure things come up with random settings.
cat <<EOF > /tmp/$$-db-values.yaml
auth:
database: ${DB}
username: ${DBUSER}
password: ${DBPW}
rootPassword: ${DBROOTPW}
EOF
cat <<EOF > /tmp/$$-spire-values.yaml
spire-server:
dataStore:
sql:
databaseType: mysql
databaseName: ${DB}
username: ${DBUSER}
password: ${DBPW}
host: mysql
port: 3306
options:
- parseTime: true
EOF
helm install mysql mysql --namespace "spire-server" --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \
--values "${SCRIPTPATH}/mysql-values.yaml" \
--values /tmp/$$-db-values.yaml --wait
helm install \
--namespace "spire-server" \
--values /tmp/$$-spire-values.yaml \
--values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
spire charts/spire --wait
helm test spire --namespace "spire-server"
.github/tests/production-external-mysql/mysql-values.yaml
+7
View File
@@ -0,0 +1,7 @@
primary:
containerSecurityContext:
allowPrivilegeEscalation: false
capabilities:
drop: [ALL]
seccompProfile:
type: RuntimeDefault
.github/tests/production-external-mysql/post-install.sh
Executable
+18
View File
@@ -0,0 +1,18 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status spire-server spire-system
if [[ "$1" -ne 0 ]]; then
get_namespace_details spire-server
get_namespace_details spire-system
fi
.github/tests/production-external-mysql/pre-install.sh
Executable
+6
View File
@@ -0,0 +1,6 @@
#!/usr/bin/env bash
kubectl create namespace spire-system
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
kubectl create namespace spire-server
kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted
.github/tests/production-external-postgresql/install.sh
Executable
+46
View File
@@ -0,0 +1,46 @@
#!/usr/bin/env bash
set -xe
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT")
DB=$(uuidgen)
DBUSER=$(uuidgen)
DBPW=$(uuidgen)
DBPGPW=$(uuidgen)
# Generate random settings to make sure things come up with random settings.
cat > /tmp/$$-db-values.yaml <<EOF
auth:
database: ${DB}
username: ${DBUSER}
password: ${DBPW}
postgresPassword: ${DBPGPW}
EOF
cat > /tmp/$$-spire-values.yaml <<EOF
spire-server:
dataStore:
sql:
databaseType: postgres
databaseName: ${DB}
username: ${DBUSER}
password: ${DBPW}
host: postgresql
port: 5432
options:
- sslmode: disable
EOF
helm install postgresql postgresql --namespace "spire-server" --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \
--values "${SCRIPTPATH}/postgresql-values.yaml" \
--values /tmp/$$-db-values.yaml --wait
helm install \
--namespace "spire-server" \
--values /tmp/$$-spire-values.yaml \
--values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
spire charts/spire --wait
helm test spire --namespace "spire-server"
.github/tests/production-external-postgresql/post-install.sh
Executable
+18
View File
@@ -0,0 +1,18 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status spire-server spire-system
if [[ "$1" -ne 0 ]]; then
get_namespace_details spire-server
get_namespace_details spire-system
fi
.github/tests/production-external-postgresql/postgresql-values.yaml
+8
View File
@@ -0,0 +1,8 @@
primary:
containerSecurityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop: [ALL]
seccompProfile:
type: RuntimeDefault
.github/tests/production-external-postgresql/pre-install.sh
Executable
+6
View File
@@ -0,0 +1,6 @@
#!/usr/bin/env bash
kubectl create namespace spire-system
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
kubectl create namespace spire-server
kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted
.github/tests/prometheus/post-install.sh
+17
View File
@@ -0,0 +1,17 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [[ "$1" -ne 0 ]]; then
get_namespace_details "${scenario}"
fi
.github/tests/prometheus/pre-install.sh
+9 -1
View File
@@ -1,3 +1,11 @@
#!/usr/bin/env bash
helm install kube-prometheus-stack kube-prometheus-stack --version 45.7.1 --repo https://prometheus-community.github.io/helm-charts -n "$scenario" --wait
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
helm install kube-prometheus-stack kube-prometheus-stack \
--version "${VERSION_KUBE_PROMETHEUS_STACK}" \
--repo "${HELM_REPO_KUBE_PROMETHEUS_STACK}" \
-n "${scenario}" \
--wait
.github/tests/spire-oidc-insecure/post-install.sh
+17
View File
@@ -0,0 +1,17 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [[ "$1" -ne 0 ]]; then
get_namespace_details "${scenario}"
fi
.github/tests/spire-oidc-insecure/pre-install.sh
+5 -1
View File
@@ -1,4 +1,8 @@
#!/usr/bin/env bash
helm install ingress-nginx ingress-nginx --version 4.5.2 --repo https://kubernetes.github.io/ingress-nginx -n "$scenario" --set controller.extraArgs.enable-ssl-passthrough=
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
helm install ingress-nginx ingress-nginx --version "${VERSION_INGRESS_NGINX}" --repo "${HELM_REPO_INGRESS_NGINX}" -n "$scenario" --set controller.extraArgs.enable-ssl-passthrough=
kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller -n "$scenario"
.github/tests/upstream-authority-cert-manager/post-install.sh
Executable
+17
View File
@@ -0,0 +1,17 @@
#!/usr/bin/env bash
set -x
SCRIPT=$(readlink -f "$0")
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [ "$1" != '0' ]; then
get_namespace_details "${scenario}"
fi
.github/tests/upstream-authority-cert-manager/pre-install.sh
+6 -2
View File
@@ -1,5 +1,9 @@
#!/usr/bin/env bash
helm install cert-manager cert-manager --namespace cert-manager --create-namespace --version v1.11.0 --set installCRDs=true --repo https://charts.jetstack.io --wait
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
helm install cert-manager cert-manager --namespace cert-manager --create-namespace --version "$VERSION_CERT_MANAGER" --set installCRDs=true --repo "$HELM_REPO_CERT_MANAGER" --wait
SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
kubectl apply -f $SCRIPT_DIR/cert-manager-ca.yaml -n "$scenario"
kubectl apply -f "${SCRIPT_DIR}/cert-manager-ca.yaml" -n "$scenario"
.github/tests/upstream-authority-disk/post-install.sh
Executable
+17
View File
@@ -0,0 +1,17 @@
#!/usr/bin/env bash
set -x
SCRIPT=$(readlink -f "$0")
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [ "$1" != '0' ]; then
get_namespace_details "${scenario}"
fi
.github/workflows/check-versions.yaml
+49
View File
@@ -0,0 +1,49 @@
name: Check versions
on:
schedule:
- cron: '0 8 * * 1'
# Allows you to run this workflow manually from the Actions tab
workflow_dispatch:
env:
HELM_VERSION: v3.11.1
jobs:
check-helm-chart-versions:
runs-on: ubuntu-22.04
permissions:
contents: write
pull-requests: write
steps:
- name: Checkout
uses: actions/[email protected]
- name: Set up Helm
uses: azure/[email protected]
with:
version: ${{ env.HELM_VERSION }}
- name: Update test chart versions
run: |
./.github/scripts/update-versions.sh
git diff
- name: Create Pull Request
id: cpr
uses: peter-evans/[email protected]
with:
title: Bump test chart dependencies
branch: bump-test-chart-deps
commit-message: Bump test chart dependencies
body: Bump the Helm charts used in test scenarios to latest available versions.
signoff: true
add-paths: |
.github/tests
- name: Check outputs
if: ${{ steps.cpr.outputs.pull-request-number }}
run: 'echo "::notice title=PR #${{ steps.cpr.outputs.pull-request-number }}::${{ steps.cpr.outputs.pull-request-url }}"'
.github/workflows/helm-chart-ci.yaml
+9 -6
View File
@@ -147,11 +147,12 @@ jobs:
# Kubernetes, but can go back farther as long as we don't need heroics
# to pull it off (i.e. kubectl version juggling).
k8s:
- v1.26.0
- v1.25.3
- v1.24.7
- v1.23.13
- v1.22.15
- v1.27.0
- v1.26.3
- v1.25.8
- v1.24.12
- v1.23.17
- v1.22.17
- v1.21.14
values:
- ${{ fromJson(needs.build-matrix.outputs.tests) }}
@@ -181,7 +182,7 @@ jobs:
uses: helm/[email protected]
# Only build a kind cluster if there are chart changes to test.
with:
version: v0.17.0
version: v0.18.0
node_image: kindest/node:${{ matrix.k8s }}
config: .github/kind/conf/kind-config.yaml
verbosity: 1
@@ -198,6 +199,8 @@ jobs:
export scenario="$(basename "${TEST_DIR}")"
export EXTRA_HELM_ARGS=""
source .github/tests/charts.sh
[ "${scenario}" != "default" ] && kubectl create namespace "${scenario}"
[ -x "${TEST_DIR}/pre-install.sh" ] && "${TEST_DIR}/pre-install.sh"
[ -f "${TEST_DIR}/.env" ] && source "${TEST_DIR}/.env"
.github/workflows/helm-release.yaml
+2 -2
View File
@@ -29,9 +29,9 @@ jobs:
git config user.email "[email protected]"
- name: Setup cosign
uses: sigstore/[email protected].2
uses: sigstore/[email protected].3
with:
cosign-release: v2.0.1
cosign-release: v2.0.2
- name: Set up Helm
uses: azure/[email protected]
.github/workflows/shellcheck.yaml
+30
View File
@@ -0,0 +1,30 @@
name: Shellcheck
on:
workflow_dispatch:
pull_request:
types: [synchronize, opened, reopened, edited]
paths:
- .github/workflows/shellcheck.yaml
- '**/*.sh'
concurrency:
group: ${{ github.ref }}-shellcheck
cancel-in-progress: true
env:
SHELLCHECK_VERSION: v0.9.0
jobs:
checks:
runs-on: ubuntu-22.04
steps:
- name: Checkout
uses: actions/[email protected]
- name: Run Shellcheck
uses: ludeeus/[email protected]
with:
format: gcc
version: ${{ env.SHELLCHECK_VERSION }}
CODEOWNERS
+1 -1
View File
@@ -2,6 +2,6 @@
# the repo. Unless a later match takes precedence,
# they will be requested for review when someone opens a
# pull request.
* @marcofranssen @Kfox1111 @developer-guy @dfeldman @faisal-memon @mrsabath
* @marcofranssen @Kfox1111 @developer-guy @dfeldman @faisal-memon @mrsabath @edwbuck
# See CODEOWNERS syntax here: https://help.github.com/articles/about-codeowners/#codeowners-syntax
charts/spire/Chart.yaml
+3 -1
View File
@@ -3,7 +3,7 @@ name: spire
description: >
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
type: application
version: 0.6.3
version: 0.7.0
appVersion: "1.6.3"
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
@@ -18,6 +18,8 @@ maintainers:
email: [email protected]
- name: faisal-memon
email: [email protected]
- name: edwbuck
email: [email protected]
kubeVersion: ">=1.21.0-0"
dependencies:
- name: spire-server
charts/spire/README.md
+240 -6
View File
@@ -2,7 +2,7 @@
<!-- This README.md is generated. Please edit README.md.gotmpl -->
![Version: 0.6.3](https://img.shields.io/badge/Version-0.6.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.3](https://img.shields.io/badge/AppVersion-1.6.3-informational?style=flat-square)
![Version: 0.7.0](https://img.shields.io/badge/Version-0.7.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.3](https://img.shields.io/badge/AppVersion-1.6.3-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
@@ -17,7 +17,7 @@ A Helm chart for deploying the complete Spire stack including: spire-server, spi
| Dependency | Supported Versions |
|:-----------|:-------------------|
| SPIRE | `1.5.3+`, `1.6.x` |
| SPIRE | `1.5.3+`, `1.6.3+` |
| Helm | `3.x` |
| Kubernetes | `1.21+` |
@@ -88,6 +88,7 @@ Now you can interact with the Spire agent socket from your own application. The
| marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
| kfox1111 | <Kevin.Fox@pnnl.gov> | |
| faisal-memon | <fymemon@yahoo.com> | |
| edwbuck | <edwbuck@gmail.com> | |
## Source Code
@@ -108,12 +109,11 @@ Kubernetes: `>=1.21.0-0`
| Key | Type | Default | Description |
|-----|------|---------|-------------|
| fullnameOverride | string | `""` | |
| global.k8s.clusterDomain | string | `"cluster.local"` | |
| global.spire.bundleConfigMap | string | `""` | Override all instances of bundleConfigMap |
| global.spire.clusterName | string | `"example-cluster"` | Set the name of the Kubernetes cluster |
| global.spire.trustDomain | string | `"example.org"` | Set the trust domain to use for the spiffe identifiers |
| nameOverride | string | `""` | |
| global.spire.clusterName | string | `"example-cluster"` | |
| global.spire.image.registry | string | `""` | Override all Spire image registries at once |
| global.spire.trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers |
| spiffe-csi-driver.enabled | bool | `true` | |
| spiffe-oidc-discovery-provider.enabled | bool | `false` | |
| spire-agent.enabled | bool | `true` | |
@@ -121,5 +121,239 @@ Kubernetes: `>=1.21.0-0`
| spire-server.controllerManager.enabled | bool | `true` | |
| spire-server.enabled | bool | `true` | |
| spire-server.nameOverride | string | `"server"` | |
| spiffe-csi-driver.agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent |
| spiffe-csi-driver.fullnameOverride | string | `""` | |
| spiffe-csi-driver.healthChecks.port | int | `9809` | |
| spiffe-csi-driver.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spiffe-csi-driver.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| spiffe-csi-driver.image.repository | string | `"spiffe/spiffe-csi-driver"` | The repository within the registry |
| spiffe-csi-driver.image.version | string | `""` | Overrides the image tag whose default is the chart appVersion |
| spiffe-csi-driver.imagePullSecrets | list | `[]` | |
| spiffe-csi-driver.kubeletPath | string | `"/var/lib/kubelet"` | |
| spiffe-csi-driver.nameOverride | string | `""` | |
| spiffe-csi-driver.namespaceOverride | string | `""` | |
| spiffe-csi-driver.nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spiffe-csi-driver.nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | The OCI registry to pull the image from |
| spiffe-csi-driver.nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | The repository within the registry |
| spiffe-csi-driver.nodeDriverRegistrar.image.version | string | `"v2.6.2"` | |
| spiffe-csi-driver.nodeDriverRegistrar.resources | object | `{}` | |
| spiffe-csi-driver.nodeSelector | object | `{}` | |
| spiffe-csi-driver.pluginName | string | `"csi.spiffe.io"` | Set the csi driver name deployed to Kubernetes. |
| spiffe-csi-driver.podAnnotations | object | `{}` | |
| spiffe-csi-driver.podSecurityContext | object | `{}` | |
| spiffe-csi-driver.priorityClassName | string | `""` | Priority class assigned to daemonset pods |
| spiffe-csi-driver.resources | object | `{}` | |
| spiffe-csi-driver.securityContext.privileged | bool | `true` | |
| spiffe-csi-driver.securityContext.readOnlyRootFilesystem | bool | `true` | |
| spiffe-csi-driver.serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
| spiffe-csi-driver.serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
| spiffe-csi-driver.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
| spiffe-oidc-discovery-provider.affinity | object | `{}` | |
| spiffe-oidc-discovery-provider.agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket |
| spiffe-oidc-discovery-provider.autoscaling.enabled | bool | `false` | |
| spiffe-oidc-discovery-provider.autoscaling.maxReplicas | int | `5` | |
| spiffe-oidc-discovery-provider.autoscaling.minReplicas | int | `1` | |
| spiffe-oidc-discovery-provider.autoscaling.targetCPUUtilizationPercentage | int | `80` | |
| spiffe-oidc-discovery-provider.autoscaling.targetMemoryUtilizationPercentage | int | `80` | |
| spiffe-oidc-discovery-provider.clusterDomain | string | `"cluster.local"` | |
| spiffe-oidc-discovery-provider.config.acme.cacheDir | string | `"/run/spire"` | |
| spiffe-oidc-discovery-provider.config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | |
| spiffe-oidc-discovery-provider.config.acme.emailAddress | string | `"[email protected]"` | |
| spiffe-oidc-discovery-provider.config.acme.tosAccepted | bool | `false` | |
| spiffe-oidc-discovery-provider.config.domains[0] | string | `"localhost"` | |
| spiffe-oidc-discovery-provider.config.domains[1] | string | `"oidc-discovery.example.org"` | |
| spiffe-oidc-discovery-provider.config.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
| spiffe-oidc-discovery-provider.configMap.annotations | object | `{}` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap |
| spiffe-oidc-discovery-provider.fullnameOverride | string | `""` | |
| spiffe-oidc-discovery-provider.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spiffe-oidc-discovery-provider.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| spiffe-oidc-discovery-provider.image.repository | string | `"spiffe/oidc-discovery-provider"` | The repository within the registry |
| spiffe-oidc-discovery-provider.image.version | string | `""` | Overrides the image tag whose default is the chart appVersion |
| spiffe-oidc-discovery-provider.imagePullSecrets | list | `[]` | |
| spiffe-oidc-discovery-provider.ingress.annotations | object | `{}` | |
| spiffe-oidc-discovery-provider.ingress.className | string | `""` | |
| spiffe-oidc-discovery-provider.ingress.enabled | bool | `false` | |
| spiffe-oidc-discovery-provider.ingress.hosts[0].host | string | `"oidc-discovery.example.org"` | |
| spiffe-oidc-discovery-provider.ingress.hosts[0].paths[0].path | string | `"/"` | |
| spiffe-oidc-discovery-provider.ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | |
| spiffe-oidc-discovery-provider.ingress.tls | list | `[]` | |
| spiffe-oidc-discovery-provider.insecureScheme.enabled | bool | `false` | |
| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.repository | string | `"nginxinc/nginx-unprivileged"` | The repository within the registry |
| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` | |
| spiffe-oidc-discovery-provider.insecureScheme.nginx.resources | object | `{}` | |
| spiffe-oidc-discovery-provider.nameOverride | string | `""` | |
| spiffe-oidc-discovery-provider.namespaceOverride | string | `""` | |
| spiffe-oidc-discovery-provider.nodeSelector | object | `{}` | |
| spiffe-oidc-discovery-provider.podAnnotations | object | `{}` | |
| spiffe-oidc-discovery-provider.podSecurityContext | object | `{}` | |
| spiffe-oidc-discovery-provider.replicaCount | int | `1` | |
| spiffe-oidc-discovery-provider.resources | object | `{}` | |
| spiffe-oidc-discovery-provider.securityContext | object | `{}` | |
| spiffe-oidc-discovery-provider.service.annotations | object | `{}` | |
| spiffe-oidc-discovery-provider.service.port | int | `80` | |
| spiffe-oidc-discovery-provider.service.type | string | `"ClusterIP"` | |
| spiffe-oidc-discovery-provider.serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
| spiffe-oidc-discovery-provider.serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
| spiffe-oidc-discovery-provider.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
| spiffe-oidc-discovery-provider.telemetry.prometheus.enabled | bool | `false` | |
| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` | The repository within the registry |
| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.version | string | `"0.11.0"` | |
| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.resources | object | `{}` | |
| spiffe-oidc-discovery-provider.telemetry.prometheus.podMonitor.enabled | bool | `false` | |
| spiffe-oidc-discovery-provider.telemetry.prometheus.podMonitor.labels | object | `{}` | |
| spiffe-oidc-discovery-provider.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider |
| spiffe-oidc-discovery-provider.telemetry.prometheus.port | int | `9988` | |
| spiffe-oidc-discovery-provider.tolerations | list | `[]` | |
| spiffe-oidc-discovery-provider.trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
| spire-agent.bundleConfigMap | string | `"spire-bundle"` | |
| spire-agent.clusterName | string | `"example-cluster"` | |
| spire-agent.configMap.annotations | object | `{}` | Annotations to add to the SPIRE Agent ConfigMap |
| spire-agent.extraContainers | list | `[]` | |
| spire-agent.extraVolumeMounts | list | `[]` | |
| spire-agent.extraVolumes | list | `[]` | |
| spire-agent.fullnameOverride | string | `""` | |
| spire-agent.healthChecks.port | int | `9980` | override the host port used for health checking |
| spire-agent.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spire-agent.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| spire-agent.image.repository | string | `"spiffe/spire-agent"` | The repository within the registry |
| spire-agent.image.version | string | `""` | |
| spire-agent.imagePullSecrets | list | `[]` | |
| spire-agent.initContainers | list | `[]` | |
| spire-agent.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
| spire-agent.nameOverride | string | `""` | |
| spire-agent.namespaceOverride | string | `""` | |
| spire-agent.nodeSelector | object | `{}` | |
| spire-agent.podAnnotations | object | `{}` | |
| spire-agent.podSecurityContext | object | `{}` | |
| spire-agent.priorityClassName | string | `""` | Priority class assigned to daemonset pods |
| spire-agent.resources | object | `{}` | |
| spire-agent.securityContext | object | `{}` | |
| spire-agent.server.address | string | `""` | |
| spire-agent.server.namespaceOverride | string | `""` | |
| spire-agent.server.port | int | `8081` | |
| spire-agent.serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
| spire-agent.serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
| spire-agent.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
| spire-agent.socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent |
| spire-agent.telemetry.prometheus.enabled | bool | `false` | |
| spire-agent.telemetry.prometheus.podMonitor.enabled | bool | `false` | |
| spire-agent.telemetry.prometheus.podMonitor.labels | object | `{}` | |
| spire-agent.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent |
| spire-agent.telemetry.prometheus.port | int | `9988` | |
| spire-agent.trustBundleFormat | string | `"pem"` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" |
| spire-agent.trustBundleURL | string | `""` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap |
| spire-agent.trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers |
| spire-agent.waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spire-agent.waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
| spire-agent.waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry |
| spire-agent.waitForIt.image.version | string | `"latest-20230113"` | |
| spire-agent.waitForIt.resources | object | `{}` | |
| spire-agent.workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped |
| spire-agent.workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor |
| spire-server.affinity | object | `{}` | |
| spire-server.autoscaling.enabled | bool | `false` | |
| spire-server.autoscaling.maxReplicas | int | `100` | |
| spire-server.autoscaling.minReplicas | int | `1` | |
| spire-server.autoscaling.targetCPUUtilizationPercentage | int | `80` | |
| spire-server.bundleConfigMap | string | `"spire-bundle"` | |
| spire-server.caKeyType | string | `"rsa-2048"` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) |
| spire-server.caTTL | string | `"24h"` | |
| spire-server.ca_subject.common_name | string | `"example.org"` | |
| spire-server.ca_subject.country | string | `"NL"` | |
| spire-server.ca_subject.organization | string | `"Example"` | |
| spire-server.clusterDomain | string | `"cluster.local"` | |
| spire-server.clusterName | string | `"example-cluster"` | |
| spire-server.configMap.annotations | object | `{}` | Annotations to add to the SPIRE Server ConfigMap |
| spire-server.controllerManager.configMap.annotations | object | `{}` | Annotations to add to the Controller Manager ConfigMap |
| spire-server.controllerManager.enabled | bool | `false` | |
| spire-server.controllerManager.identities.dnsNameTemplates | list | `[]` | |
| spire-server.controllerManager.identities.enabled | bool | `true` | |
| spire-server.controllerManager.identities.namespaceSelector | object | `{}` | |
| spire-server.controllerManager.identities.podSelector | object | `{}` | |
| spire-server.controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | |
| spire-server.controllerManager.ignoreNamespaces[0] | string | `"kube-system"` | |
| spire-server.controllerManager.ignoreNamespaces[1] | string | `"kube-public"` | |
| spire-server.controllerManager.ignoreNamespaces[2] | string | `"local-path-storage"` | |
| spire-server.controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spire-server.controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| spire-server.controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry |
| spire-server.controllerManager.image.version | string | `"0.2.2"` | |
| spire-server.controllerManager.resources | object | `{}` | |
| spire-server.controllerManager.securityContext | object | `{}` | |
| spire-server.controllerManager.service.annotations | object | `{}` | |
| spire-server.controllerManager.service.port | int | `443` | |
| spire-server.controllerManager.service.type | string | `"ClusterIP"` | |
| spire-server.controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"chainguard/kubectl"` | The repository within the registry |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `"latest"` | |
| spire-server.dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
| spire-server.dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
| spire-server.dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |
| spire-server.dataStore.sql.options | list | `[]` | Only used by "postgres" or "mysql" |
| spire-server.dataStore.sql.password | string | `""` | Only used by "postgres" or "mysql" |
| spire-server.dataStore.sql.plugin_data | object | `{}` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section |
| spire-server.dataStore.sql.port | int | `0` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. |
| spire-server.dataStore.sql.username | string | `"spire"` | Only used by "postgres" or "mysql" |
| spire-server.defaultJwtSvidTTL | string | `"1h"` | |
| spire-server.defaultX509SvidTTL | string | `"4h"` | |
| spire-server.extraContainers | list | `[]` | |
| spire-server.extraVolumeMounts | list | `[]` | |
| spire-server.extraVolumes | list | `[]` | |
| spire-server.federation.bundleEndpoint.address | string | `"0.0.0.0"` | |
| spire-server.federation.bundleEndpoint.port | int | `8443` | |
| spire-server.federation.enabled | bool | `false` | |
| spire-server.fullnameOverride | string | `""` | |
| spire-server.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spire-server.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| spire-server.image.repository | string | `"spiffe/spire-server"` | The repository within the registry |
| spire-server.image.version | string | `""` | |
| spire-server.imagePullSecrets | list | `[]` | |
| spire-server.initContainers | list | `[]` | |
| spire-server.jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain |
| spire-server.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
| spire-server.nameOverride | string | `""` | |
| spire-server.namespaceOverride | string | `""` | |
| spire-server.nodeAttestor.k8sPsat.enabled | bool | `true` | |
| spire-server.nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` | |
| spire-server.nodeSelector | object | `{}` | |
| spire-server.notifier.k8sbundle.namespace | string | `""` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace |
| spire-server.persistence.accessMode | string | `"ReadWriteOnce"` | |
| spire-server.persistence.size | string | `"1Gi"` | |
| spire-server.persistence.storageClass | string | `nil` | |
| spire-server.podAnnotations | object | `{}` | |
| spire-server.podSecurityContext | object | `{}` | |
| spire-server.replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. |
| spire-server.resources | object | `{}` | |
| spire-server.securityContext | object | `{}` | |
| spire-server.service.annotations | object | `{}` | |
| spire-server.service.port | int | `8081` | |
| spire-server.service.type | string | `"ClusterIP"` | |
| spire-server.serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
| spire-server.serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
| spire-server.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
| spire-server.telemetry.prometheus.enabled | bool | `false` | |
| spire-server.telemetry.prometheus.podMonitor.enabled | bool | `false` | |
| spire-server.telemetry.prometheus.podMonitor.labels | object | `{}` | |
| spire-server.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
| spire-server.tolerations | list | `[]` | |
| spire-server.topologySpreadConstraints | list | `[]` | |
| spire-server.trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
| spire-server.upstreamAuthority.certManager.enabled | bool | `false` | |
| spire-server.upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` | |
| spire-server.upstreamAuthority.certManager.issuer_kind | string | `"Issuer"` | |
| spire-server.upstreamAuthority.certManager.issuer_name | string | `"spire-ca"` | |
| spire-server.upstreamAuthority.certManager.kube_config_file | string | `""` | |
| spire-server.upstreamAuthority.certManager.namespace | string | `""` | Specify to use a namespace other then the one the chart is installed into |
| spire-server.upstreamAuthority.certManager.rbac.create | bool | `true` | |
| spire-server.upstreamAuthority.disk.enabled | bool | `false` | |
| spire-server.upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. |
| spire-server.upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info |
| spire-server.upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. |
----------------------------------------------
charts/spire/README.md.gotmpl
+1 -1
View File
@@ -19,7 +19,7 @@
| Dependency | Supported Versions |
|:-----------|:-------------------|
| SPIRE | `1.5.3+`, `1.6.x` |
| SPIRE | `1.5.3+`, `1.6.3+` |
| Helm | `3.x` |
| Kubernetes | `1.21+` |
charts/spire/charts/spiffe-csi-driver/README.md
+11 -11
View File
@@ -13,20 +13,20 @@ A Helm chart to install the SPIFFE CSI driver.
| Key | Type | Default | Description |
|-----|------|---------|-------------|
| agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | |
| agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent |
| fullnameOverride | string | `""` | |
| healthChecks.port | int | `9809` | |
| image.pullPolicy | string | `"IfNotPresent"` | |
| image.registry | string | `"ghcr.io"` | |
| image.repository | string | `"spiffe/spiffe-csi-driver"` | |
| image.version | string | `""` | |
| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| image.repository | string | `"spiffe/spiffe-csi-driver"` | The repository within the registry |
| image.version | string | `""` | Overrides the image tag whose default is the chart appVersion |
| imagePullSecrets | list | `[]` | |
| kubeletPath | string | `"/var/lib/kubelet"` | |
| nameOverride | string | `""` | |
| namespaceOverride | string | `""` | |
| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | |
| nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | |
| nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | |
| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | The OCI registry to pull the image from |
| nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | The repository within the registry |
| nodeDriverRegistrar.image.version | string | `"v2.6.2"` | |
| nodeDriverRegistrar.resources | object | `{}` | |
| nodeSelector | object | `{}` | |
@@ -37,8 +37,8 @@ A Helm chart to install the SPIFFE CSI driver.
| resources | object | `{}` | |
| securityContext.privileged | bool | `true` | |
| securityContext.readOnlyRootFilesystem | bool | `true` | |
| serviceAccount.annotations | object | `{}` | |
| serviceAccount.create | bool | `true` | |
| serviceAccount.name | string | `""` | |
| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
----------------------------------------------
charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl
-13
View File
@@ -72,19 +72,6 @@ Create the name of the service account to use
{{- end }}
{{- end }}
{{- define "spiffe-csi-driver.image" -}}
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
{{- else if .appVersion -}}
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
{{- else if .image.version -}}
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
{{- else -}}
{{- printf "%s/%s" .image.registry .image.repository -}}
{{- end -}}
{{- end }}
{{- define "spiffe-csi-driver.agent-socket-path" -}}
{{- print .Values.agentSocketPath }}
{{- end }}
charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
+2 -2
View File
@@ -31,7 +31,7 @@ spec:
containers:
# This is the container which runs the SPIFFE CSI driver.
- name: {{ .Chart.Name }}
image: {{ template "spiffe-csi-driver.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
args: [
"-workload-api-socket-dir", "/spire-agent-socket",
@@ -71,7 +71,7 @@ spec:
# of all the little details required to register a CSI driver with
# the kubelet.
- name: node-driver-registrar
image: {{ template "spiffe-csi-driver.image" .Values.nodeDriverRegistrar }}
image: {{ template "spire-lib.image" (dict "image" .Values.nodeDriverRegistrar.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }}
args: [
"-csi-address", "/spiffe-csi/csi.sock",
charts/spire/charts/spiffe-csi-driver/values.yaml
+11 -3
View File
@@ -2,9 +2,13 @@
pluginName: csi.spiffe.io
image:
# -- The OCI registry to pull the image from
registry: ghcr.io
# -- The repository within the registry
repository: spiffe/spiffe-csi-driver
# -- The image pull policy
pullPolicy: IfNotPresent
# -- Overrides the image tag whose default is the chart appVersion
version: ""
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
@@ -27,11 +31,11 @@ namespaceOverride: ""
fullnameOverride: ""
serviceAccount:
# Specifies whether a service account should be created
# -- Specifies whether a service account should be created
create: true
# Annotations to add to the service account
# -- Annotations to add to the service account
annotations: {}
# The name of the service account to use.
# -- The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
@@ -53,8 +57,11 @@ nodeSelector: {}
nodeDriverRegistrar:
image:
# -- The OCI registry to pull the image from
registry: registry.k8s.io
# -- The repository within the registry
repository: sig-storage/csi-node-driver-registrar
# -- The image pull policy
pullPolicy: IfNotPresent
version: v2.6.2
resources: {}
@@ -69,6 +76,7 @@ nodeDriverRegistrar:
# cpu: 100m
# memory: 64Mi
# -- The unix socket path to the spire-agent
agentSocketPath: /run/spire/agent-sockets/spire-agent.sock
kubeletPath: /var/lib/kubelet
charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+17 -16
View File
@@ -15,7 +15,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| Key | Type | Default | Description |
|-----|------|---------|-------------|
| affinity | object | `{}` | |
| agentSocketName | string | `"spire-agent.sock"` | |
| agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket |
| autoscaling.enabled | bool | `false` | |
| autoscaling.maxReplicas | int | `5` | |
| autoscaling.minReplicas | int | `1` | |
@@ -28,12 +28,13 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| config.acme.tosAccepted | bool | `false` | |
| config.domains[0] | string | `"localhost"` | |
| config.domains[1] | string | `"oidc-discovery.example.org"` | |
| config.logLevel | string | `"info"` | |
| config.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
| configMap.annotations | object | `{}` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap |
| fullnameOverride | string | `""` | |
| image.pullPolicy | string | `"IfNotPresent"` | |
| image.registry | string | `"ghcr.io"` | |
| image.repository | string | `"spiffe/oidc-discovery-provider"` | |
| image.version | string | `""` | |
| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| image.repository | string | `"spiffe/oidc-discovery-provider"` | The repository within the registry |
| image.version | string | `""` | Overrides the image tag whose default is the chart appVersion |
| imagePullSecrets | list | `[]` | |
| ingress.annotations | object | `{}` | |
| ingress.className | string | `""` | |
@@ -43,9 +44,9 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | |
| ingress.tls | list | `[]` | |
| insecureScheme.enabled | bool | `false` | |
| insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | |
| insecureScheme.nginx.image.registry | string | `"docker.io"` | |
| insecureScheme.nginx.image.repository | string | `"nginxinc/nginx-unprivileged"` | |
| insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| insecureScheme.nginx.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
| insecureScheme.nginx.image.repository | string | `"nginxinc/nginx-unprivileged"` | The repository within the registry |
| insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` | |
| insecureScheme.nginx.resources | object | `{}` | |
| nameOverride | string | `""` | |
@@ -59,13 +60,13 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| service.annotations | object | `{}` | |
| service.port | int | `80` | |
| service.type | string | `"ClusterIP"` | |
| serviceAccount.annotations | object | `{}` | |
| serviceAccount.create | bool | `true` | |
| serviceAccount.name | string | `""` | |
| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
| telemetry.prometheus.enabled | bool | `false` | |
| telemetry.prometheus.nginxExporter.image.pullPolicy | string | `"IfNotPresent"` | |
| telemetry.prometheus.nginxExporter.image.registry | string | `"docker.io"` | |
| telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` | |
| telemetry.prometheus.nginxExporter.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| telemetry.prometheus.nginxExporter.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
| telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` | The repository within the registry |
| telemetry.prometheus.nginxExporter.image.version | string | `"0.11.0"` | |
| telemetry.prometheus.nginxExporter.resources | object | `{}` | |
| telemetry.prometheus.podMonitor.enabled | bool | `false` | |
@@ -73,6 +74,6 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider |
| telemetry.prometheus.port | int | `9988` | |
| tolerations | list | `[]` | |
| trustDomain | string | `"example.org"` | |
| trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
----------------------------------------------
charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
-35
View File
@@ -82,42 +82,7 @@ Create the name of the service account to use
{{- end }}
{{- end }}
{{- define "spiffe-oidc-discovery-provider.image" -}}
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
{{- else if .appVersion -}}
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
{{- else if .image.version -}}
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
{{- else -}}
{{- printf "%s/%s" .image.registry .image.repository -}}
{{- end -}}
{{- end }}
{{- define "spiffe-oidc-discovery-provider.workload-api-socket-path" -}}
{{- printf "/spiffe-workload-api/%s" .Values.agentSocketName }}
{{- end }}
{{- define "spiffe-oidc-discovery-provider.cluster-name" }}
{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
{{- .Values.global.spire.clusterName }}
{{- else }}
{{- .Values.clusterName }}
{{- end }}
{{- end }}
{{- define "spiffe-oidc-discovery-provider.trust-domain" }}
{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
{{- .Values.global.spire.trustDomain }}
{{- else }}
{{- .Values.trustDomain }}
{{- end }}
{{- end }}
{{- define "spiffe-oidc-discovery-provider.cluster-domain" }}
{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
{{- .Values.global.k8s.clusterDomain }}
{{- else }}
{{- .Values.clusterDomain }}
{{- end }}
{{- end }}
charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml
+39 -33
View File
@@ -1,44 +1,50 @@
{{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }}
{{- define "spiffe-oidc-discovery-provider.yaml-config" -}}
{{- $oidcSocket := .oidcSocket }}
{{- with .root }}
log_level: {{ .Values.config.logLevel | quote }}
domains:
- "{{ include "spiffe-oidc-discovery-provider.fullname" . }}"
- "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}"
- "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}"
{{- if gt (len .Values.config.domains) 0 }}
{{- .Values.config.domains | toYaml | nindent 2 }}
{{- end }}
{{- if .Values.insecureScheme.enabled }}
allow_insecure_scheme: {{ .Values.insecureScheme.enabled }}
listen_socket_path: {{ $oidcSocket | quote }}
{{- else }}
acme:
directory_url: {{ .Values.config.acme.directoryUrl | quote }}
cache_dir: {{ .Values.config.acme.cacheDir | quote }}
tos_accepted: {{ .Values.config.acme.tosAccepted }}
email: {{ .Values.config.acme.emailAddress | quote }}
{{- end }}
workload_api:
socket_path: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | quote }}
trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
health_checks:
bind_port: "8008"
ready_path: "/ready"
live_path: "/live"
{{- end }}
{{- end }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
{{- with .Values.configMap.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
data:
oidc-discovery-provider.conf: |
log_level = "{{ .Values.config.logLevel }}"
domains = [
"{{ include "spiffe-oidc-discovery-provider.fullname" . }}",
"{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}",
"{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}",
{{- if gt (len .Values.config.domains) 0 }}
"{{- join "\",\n \"" .Values.config.domains }}"
{{- end }}
]
{{- if .Values.insecureScheme.enabled }}
allow_insecure_scheme = {{ .Values.insecureScheme.enabled }}
listen_socket_path = {{ $oidcSocket | quote }}
{{- else }}
acme {
directory_url = "{{ .Values.config.acme.directoryUrl }}"
cache_dir = "{{ .Values.config.acme.cacheDir }}"
tos_accepted = {{ .Values.config.acme.tosAccepted }}
email = "{{ .Values.config.acme.emailAddress }}"
}
{{- end }}
workload_api {
socket_path = {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | quote }}
trust_domain = {{ include "spiffe-oidc-discovery-provider.trust-domain" . | quote }}
}
health_checks {
bind_port = "8008"
ready_path = "/ready"
live_path = "/live"
}
{{- include "spiffe-oidc-discovery-provider.yaml-config" (dict "oidcSocket" $oidcSocket "root" .) | fromYaml | toPrettyJson | nindent 4 }}
{{- if .Values.insecureScheme.enabled }}
default.conf: |
upstream oidc {
charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml
+3 -3
View File
@@ -34,7 +34,7 @@ spec:
- name: {{ .Chart.Name }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: {{ template "spiffe-oidc-discovery-provider.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
args:
- -config
@@ -75,7 +75,7 @@ spec:
- name: nginx
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: {{ template "spiffe-oidc-discovery-provider.image" .Values.insecureScheme.nginx }}
image: {{ template "spire-lib.image" (dict "image" .Values.insecureScheme.nginx.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.insecureScheme.nginx.image.pullPolicy }}
ports:
- containerPort: 8080
@@ -97,7 +97,7 @@ spec:
- name: nginx-exporter
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: {{ template "spiffe-oidc-discovery-provider.image" .Values.telemetry.prometheus.nginxExporter }}
image: {{ template "spire-lib.image" (dict "image" .Values.telemetry.prometheus.nginxExporter.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.telemetry.prometheus.nginxExporter.image.pullPolicy }}
args:
- -nginx.scrape-uri=http://127.0.0.1:8080/stub_status
charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
+1 -1
View File
@@ -26,7 +26,7 @@ spec:
- name: curl-service-name-namespace-svc-cluster-local
image: cgr.dev/chainguard/bash:latest
command: ['curl']
args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
securityContext:
{{- toYaml .Values.securityContext | nindent 8 }}
{{- if .Values.ingress.enabled }}
charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+21 -6
View File
@@ -2,6 +2,7 @@
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
# -- The name of the spire-agent unix socket
agentSocketName: spire-agent.sock
replicaCount: 1
@@ -9,11 +10,13 @@ replicaCount: 1
namespaceOverride: ""
image:
# registry: gcr.io
# repository: spiffe-io/oidc-discovery-provider
# -- The OCI registry to pull the image from
registry: ghcr.io
# -- The repository within the registry
repository: spiffe/oidc-discovery-provider
# -- The image pull policy
pullPolicy: IfNotPresent
# -- Overrides the image tag whose default is the chart appVersion
version: ""
resources: {}
@@ -34,6 +37,10 @@ service:
annotations: {}
# external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org
configMap:
# -- Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap
annotations: {}
podSecurityContext: {}
# fsGroup: 2000
@@ -52,8 +59,11 @@ insecureScheme:
nginx:
image:
# -- The OCI registry to pull the image from
registry: docker.io
# -- The repository within the registry
repository: nginxinc/nginx-unprivileged
# -- The image pull policy
pullPolicy: IfNotPresent
version: 1.23.2-alpine
# chainguard image does not support the templates feature
@@ -75,6 +85,7 @@ insecureScheme:
# memory: 64Mi
config:
# -- The log level, valid values are "debug", "info", "warn", and "error"
logLevel: info
domains:
- localhost
@@ -91,11 +102,11 @@ nameOverride: ""
fullnameOverride: ""
serviceAccount:
# Specifies whether a service account should be created
# -- Specifies whether a service account should be created
create: true
# Annotations to add to the service account
# -- Annotations to add to the service account
annotations: {}
# The name of the service account to use.
# -- The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
@@ -112,8 +123,9 @@ tolerations: []
affinity: {}
# -- Set the trust domain to be used for the SPIFFE identifiers
trustDomain: example.org
# -- This is the value of your clusters `kubeadm init --service-dns-domain` flag
# -- The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)
clusterDomain: cluster.local
telemetry:
@@ -128,8 +140,11 @@ telemetry:
nginxExporter:
image:
# -- The OCI registry to pull the image from
registry: docker.io
# -- The repository within the registry
repository: nginx/nginx-prometheus-exporter
# -- The image pull policy
pullPolicy: IfNotPresent
version: "0.11.0"
charts/spire/charts/spire-agent/README.md
+16 -12
View File
@@ -16,18 +16,19 @@ A Helm chart to install the SPIRE agent.
|-----|------|---------|-------------|
| bundleConfigMap | string | `"spire-bundle"` | |
| clusterName | string | `"example-cluster"` | |
| configMap.annotations | object | `{}` | Annotations to add to the SPIRE Agent ConfigMap |
| extraContainers | list | `[]` | |
| extraVolumeMounts | list | `[]` | |
| extraVolumes | list | `[]` | |
| fullnameOverride | string | `""` | |
| healthChecks.port | int | `9980` | override the host port used for health checking |
| image.pullPolicy | string | `"IfNotPresent"` | |
| image.registry | string | `"ghcr.io"` | |
| image.repository | string | `"spiffe/spire-agent"` | |
| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| image.repository | string | `"spiffe/spire-agent"` | The repository within the registry |
| image.version | string | `""` | |
| imagePullSecrets | list | `[]` | |
| initContainers | list | `[]` | |
| logLevel | string | `"info"` | |
| logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
| nameOverride | string | `""` | |
| namespaceOverride | string | `""` | |
| nodeSelector | object | `{}` | |
@@ -39,21 +40,24 @@ A Helm chart to install the SPIRE agent.
| server.address | string | `""` | |
| server.namespaceOverride | string | `""` | |
| server.port | int | `8081` | |
| serviceAccount.annotations | object | `{}` | |
| serviceAccount.create | bool | `true` | |
| serviceAccount.name | string | `""` | |
| socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | |
| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
| socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent |
| telemetry.prometheus.enabled | bool | `false` | |
| telemetry.prometheus.podMonitor.enabled | bool | `false` | |
| telemetry.prometheus.podMonitor.labels | object | `{}` | |
| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent |
| telemetry.prometheus.port | int | `9988` | |
| trustDomain | string | `"example.org"` | |
| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | |
| waitForIt.image.registry | string | `"cgr.dev"` | |
| waitForIt.image.repository | string | `"chainguard/wait-for-it"` | |
| trustBundleFormat | string | `"pem"` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" |
| trustBundleURL | string | `""` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap |
| trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers |
| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
| waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry |
| waitForIt.image.version | string | `"latest-20230113"` | |
| waitForIt.resources | object | `{}` | |
| workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped |
| workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor |
----------------------------------------------
charts/spire/charts/spire-agent/templates/_helpers.tpl
-35
View File
@@ -90,18 +90,6 @@ Create the name of the service account to use
{{- end }}
{{- end }}
{{- define "spire-agent.image" -}}
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
{{- else if .appVersion -}}
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
{{- else if .image.version -}}
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
{{- else -}}
{{- printf "%s/%s" .image.registry .image.repository -}}
{{- end -}}
{{- end }}
{{- define "spire-agent.server-address" }}
{{- if .Values.server.address }}
{{- .Values.server.address }}
@@ -114,26 +102,3 @@ Create the name of the service account to use
{{- print .Values.socketPath }}
{{- end }}
{{- define "spire-agent.cluster-name" }}
{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
{{- .Values.global.spire.clusterName }}
{{- else }}
{{- .Values.clusterName }}
{{- end }}
{{- end }}
{{- define "spire-agent.trust-domain" }}
{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
{{- .Values.global.spire.trustDomain }}
{{- else }}
{{- .Values.trustDomain }}
{{- end }}
{{- end }}
{{- define "spire-agent.bundle-configmap" }}
{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
{{- .Values.global.spire.bundleConfigMap }}
{{- else }}
{{- .Values.bundleConfigMap }}
{{- end }}
{{- end }}
charts/spire/charts/spire-agent/templates/configmap.yaml
+57 -55
View File
@@ -1,62 +1,64 @@
{{- define "spire-agent.yaml-config" -}}
agent:
data_dir: "/run/spire"
log_level: {{ .Values.logLevel | quote }}
server_address: {{ include "spire-agent.server-address" . | trim | quote }}
server_port: {{ .Values.server.port | quote }}
socket_path: {{ include "spire-agent.socket-path" . | quote }}
{{- if ne (len .Values.trustBundleURL) 0 }}
trust_bundle_url: {{ .Values.trustBundleURL | quote }}
trust_bundle_format: {{ .Values.trustBundleFormat | quote }}
{{- else }}
trust_bundle_path: "/run/spire/bundle/bundle.crt"
{{- end }}
trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
plugins:
NodeAttestor:
- k8s_psat:
plugin_data:
cluster: {{ include "spire-lib.cluster-name" . | quote }}
KeyManager:
- memory:
plugin_data:
WorkloadAttestor:
- k8s:
plugin_data:
# Defaults to the secure kubelet port by default.
# Minikube does not have a cert in the cluster CA bundle that
# can authenticate the kubelet cert, so skip validation.
skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }}
{{- if .Values.workloadAttestors.unix.enabled }}
- unix:
plugin_data:
{{- end }}
health_checks:
listener_enabled: true
bind_address: "0.0.0.0"
bind_port: {{ .Values.healthChecks.port | quote }}
live_path: "/live"
ready_path: "/ready"
{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
telemetry:
- Prometheus:
- host: "0.0.0.0"
port: {{ .Values.telemetry.prometheus.port }}
{{- end }}
{{- end }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "spire-agent.fullname" . }}
namespace: {{ include "spire-agent.namespace" . }}
{{- with .Values.configMap.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
data:
agent.conf: |
agent {
data_dir = "/run/spire"
log_level = {{ .Values.logLevel | quote }}
server_address = {{ include "spire-agent.server-address" . | trim | quote }}
server_port = {{ .Values.server.port | quote }}
socket_path = {{ include "spire-agent.socket-path" . | quote }}
trust_bundle_path = "/run/spire/bundle/bundle.crt"
trust_domain = {{ include "spire-agent.trust-domain" . | quote }}
}
plugins {
NodeAttestor "k8s_psat" {
plugin_data {
cluster = {{ include "spire-agent.cluster-name" . | quote }}
}
}
KeyManager "memory" {
plugin_data {
}
}
WorkloadAttestor "k8s" {
plugin_data {
# Defaults to the secure kubelet port by default.
# Minikube does not have a cert in the cluster CA bundle that
# can authenticate the kubelet cert, so skip validation.
skip_kubelet_verification = true
}
}
{{- if .Values.workloadAttestors.unix.enabled }}
WorkloadAttestor "unix" {
plugin_data {
}
}
{{- end }}
}
health_checks {
listener_enabled = true
bind_address = "0.0.0.0"
bind_port = {{ .Values.healthChecks.port | quote }}
live_path = "/live"
ready_path = "/ready"
}
{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
telemetry {
Prometheus {
host = "0.0.0.0"
port = {{ .Values.telemetry.prometheus.port }}
}
}
{{- end }}
{{- include "spire-agent.yaml-config" . | fromYaml | toPrettyJson | nindent 4 }}
charts/spire/charts/spire-agent/templates/daemonset.yaml
+7 -3
View File
@@ -38,7 +38,7 @@ spec:
# This is a small image with wait-for-it, choose whatever image
# you prefer that waits for a service to be up. This image is built
# from https://github.com/vishnubob/wait-for-it
image: {{ template "spire-agent.image" .Values.waitForIt }}
image: {{ template "spire-lib.image" (dict "image" .Values.waitForIt.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
args: ["-t", "30", "-h", "{{ include "spire-agent.server-address" . | trim }}", "-p", {{ .Values.server.port | quote }}]
resources:
@@ -48,7 +48,7 @@ spec:
{{- end }}
containers:
- name: {{ .Chart.Name }}
image: {{ template "spire-agent.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
args: ["-config", "/run/spire/config/agent.conf"]
ports:
@@ -62,9 +62,11 @@ spec:
- name: spire-config
mountPath: /run/spire/config
readOnly: true
{{- if eq (len .Values.trustBundleURL) 0 }}
- name: spire-bundle
mountPath: /run/spire/bundle
readOnly: true
{{- end }}
- name: spire-agent-socket-dir
mountPath: {{ include "spire-agent.socket-path" . | dir }}
readOnly: false
@@ -98,9 +100,11 @@ spec:
- name: spire-config
configMap:
name: {{ include "spire-agent.fullname" . }}
{{- if eq (len .Values.trustBundleURL) 0 }}
- name: spire-bundle
configMap:
name: {{ include "spire-agent.bundle-configmap" . }}
name: {{ include "spire-lib.bundle-configmap" . }}
{{- end }}
- name: spire-token
projected:
sources:
charts/spire/charts/spire-agent/values.yaml
+24 -6
View File
@@ -3,10 +3,11 @@
# Declare variables to be passed into your templates.
image:
# registry: gcr.io
# repository: spiffe-io/spire-agent
# -- The OCI registry to pull the image from
registry: ghcr.io
# -- The repository within the registry
repository: spiffe/spire-agent
# -- The image pull policy
pullPolicy: IfNotPresent
# Overrides the image tag whose default is the chart appVersion.
version: ""
@@ -17,14 +18,18 @@ namespaceOverride: ""
fullnameOverride: ""
serviceAccount:
# Specifies whether a service account should be created
# -- Specifies whether a service account should be created
create: true
# Annotations to add to the service account
# -- Annotations to add to the service account
annotations: {}
# The name of the service account to use.
# -- The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
configMap:
# -- Annotations to add to the SPIRE Agent ConfigMap
annotations: {}
podAnnotations: {}
podSecurityContext: {}
@@ -52,10 +57,16 @@ resources: {}
nodeSelector: {}
# -- The log level, valid values are "debug", "info", "warn", and "error"
logLevel: info
# -- The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)
clusterName: example-cluster
# -- The trust domain to be used for the SPIFFE identifiers
trustDomain: example.org
# -- If set, obtain trust bundle from url instead of Kubernetes ConfigMap
trustBundleURL: ""
# -- If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe"
trustBundleFormat: pem
bundleConfigMap: spire-bundle
server:
@@ -69,8 +80,11 @@ healthChecks:
waitForIt:
image:
# -- The OCI registry to pull the image from
registry: cgr.dev
# -- The repository within the registry
repository: chainguard/wait-for-it
# -- The image pull policy
pullPolicy: IfNotPresent
version: latest-20230113
resources: {}
@@ -81,6 +95,9 @@ workloadAttestors:
unix:
# -- enables the Unix workload attestor
enabled: false
k8s:
# -- If true, kubelet certificate verification is skipped
skipKubeletVerification: true
telemetry:
prometheus:
@@ -92,6 +109,7 @@ telemetry:
namespace: ""
labels: {}
# -- The unix socket path to the spire-agent
socketPath: /run/spire/agent-sockets/spire-agent.sock
# -- Priority class assigned to daemonset pods
charts/spire/charts/spire-server/README.md
+28 -19
View File
@@ -30,6 +30,8 @@ A Helm chart to install the SPIRE server.
| ca_subject.organization | string | `"Example"` | |
| clusterDomain | string | `"cluster.local"` | |
| clusterName | string | `"example-cluster"` | |
| configMap.annotations | object | `{}` | Annotations to add to the SPIRE Server ConfigMap |
| controllerManager.configMap.annotations | object | `{}` | Annotations to add to the Controller Manager ConfigMap |
| controllerManager.enabled | bool | `false` | |
| controllerManager.identities.dnsNameTemplates | list | `[]` | |
| controllerManager.identities.enabled | bool | `true` | |
@@ -39,9 +41,9 @@ A Helm chart to install the SPIRE server.
| controllerManager.ignoreNamespaces[0] | string | `"kube-system"` | |
| controllerManager.ignoreNamespaces[1] | string | `"kube-public"` | |
| controllerManager.ignoreNamespaces[2] | string | `"local-path-storage"` | |
| controllerManager.image.pullPolicy | string | `"IfNotPresent"` | |
| controllerManager.image.registry | string | `"ghcr.io"` | |
| controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | |
| controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry |
| controllerManager.image.version | string | `"0.2.2"` | |
| controllerManager.resources | object | `{}` | |
| controllerManager.securityContext | object | `{}` | |
@@ -49,14 +51,18 @@ A Helm chart to install the SPIRE server.
| controllerManager.service.port | int | `443` | |
| controllerManager.service.type | string | `"ClusterIP"` | |
| controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` | |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"cgr.dev"` | |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"chainguard/kubectl"` | |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"chainguard/kubectl"` | The repository within the registry |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `"latest"` | |
| dataStorage.accessMode | string | `"ReadWriteOnce"` | |
| dataStorage.enabled | bool | `true` | |
| dataStorage.size | string | `"1Gi"` | |
| dataStorage.storageClass | string | `nil` | |
| dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
| dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
| dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |
| dataStore.sql.options | list | `[]` | Only used by "postgres" or "mysql" |
| dataStore.sql.password | string | `""` | Only used by "postgres" or "mysql" |
| dataStore.sql.plugin_data | object | `{}` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section |
| dataStore.sql.port | int | `0` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. |
| dataStore.sql.username | string | `"spire"` | Only used by "postgres" or "mysql" |
| defaultJwtSvidTTL | string | `"1h"` | |
| defaultX509SvidTTL | string | `"4h"` | |
| extraContainers | list | `[]` | |
@@ -66,20 +72,23 @@ A Helm chart to install the SPIRE server.
| federation.bundleEndpoint.port | int | `8443` | |
| federation.enabled | bool | `false` | |
| fullnameOverride | string | `""` | |
| image.pullPolicy | string | `"IfNotPresent"` | |
| image.registry | string | `"ghcr.io"` | |
| image.repository | string | `"spiffe/spire-server"` | |
| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| image.repository | string | `"spiffe/spire-server"` | The repository within the registry |
| image.version | string | `""` | |
| imagePullSecrets | list | `[]` | |
| initContainers | list | `[]` | |
| jwtIssuer | string | `"oidc-discovery.example.org"` | |
| logLevel | string | `"info"` | |
| jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain |
| logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
| nameOverride | string | `""` | |
| namespaceOverride | string | `""` | |
| nodeAttestor.k8sPsat.enabled | bool | `true` | |
| nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` | |
| nodeSelector | object | `{}` | |
| notifier.k8sbundle.namespace | string | `""` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace |
| persistence.accessMode | string | `"ReadWriteOnce"` | |
| persistence.size | string | `"1Gi"` | |
| persistence.storageClass | string | `nil` | |
| podAnnotations | object | `{}` | |
| podSecurityContext | object | `{}` | |
| replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. |
@@ -88,16 +97,16 @@ A Helm chart to install the SPIRE server.
| service.annotations | object | `{}` | |
| service.port | int | `8081` | |
| service.type | string | `"ClusterIP"` | |
| serviceAccount.annotations | object | `{}` | |
| serviceAccount.create | bool | `true` | |
| serviceAccount.name | string | `""` | |
| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
| telemetry.prometheus.enabled | bool | `false` | |
| telemetry.prometheus.podMonitor.enabled | bool | `false` | |
| telemetry.prometheus.podMonitor.labels | object | `{}` | |
| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
| tolerations | list | `[]` | |
| topologySpreadConstraints | list | `[]` | |
| trustDomain | string | `"example.org"` | |
| trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
| upstreamAuthority.certManager.enabled | bool | `false` | |
| upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` | |
| upstreamAuthority.certManager.issuer_kind | string | `"Issuer"` | |
charts/spire/charts/spire-server/templates/_helpers.tpl
+39 -34
View File
@@ -82,18 +82,6 @@ Create the name of the service account to use
{{- end }}
{{- end }}
{{- define "spire-server.image" -}}
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
{{- else if .appVersion -}}
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
{{- else if .image.version -}}
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
{{- else -}}
{{- printf "%s/%s" .image.registry .image.repository -}}
{{- end -}}
{{- end }}
{{- define "spire-server.upstream-ca-secret" -}}
{{- $root := . }}
{{- with .Values.upstreamAuthority.disk -}}
@@ -117,34 +105,51 @@ Create the name of the service account to use
{{- end }}
{{- end }}
{{- define "spire-server.cluster-name" }}
{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
{{- .Values.global.spire.clusterName }}
{{- else }}
{{- .Values.clusterName }}
{{- define "spire-server.config-mysql-query" }}
{{- $lst := list }}
{{- range . }}
{{- range $key, $value := . }}
{{- $eValue := toString $value }}
{{- $entry := printf "%s=%s" (urlquery $key) (urlquery $eValue) }}
{{- $lst = append $lst $entry }}
{{- end }}
{{- end }}
{{- if gt (len $lst) 0 }}
{{- printf "?%s" (join "&" $lst) }}
{{- end }}
{{- end }}
{{- define "spire-server.trust-domain" }}
{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
{{- .Values.global.spire.trustDomain }}
{{- else }}
{{- .Values.trustDomain }}
{{- define "spire-server.config-postgresql-options" }}
{{- $lst := list }}
{{- range . }}
{{- range $key, $value := . }}
{{- $eValue := toString $value }}
{{- $entry := printf "%s=%s" $key $eValue }}
{{- $lst = append $lst $entry }}
{{- end }}
{{- end }}
{{- if gt (len $lst) 0 }}
{{- printf " %s" (join " " $lst) }}
{{- end }}
{{- end }}
{{- define "spire-server.bundle-configmap" }}
{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
{{- .Values.global.spire.bundleConfigMap }}
{{- define "spire-server.datastore-config" }}
{{- $config := deepCopy .Values.dataStore.sql.plugin_data }}
{{- if eq .Values.dataStore.sql.databaseType "sqlite3" }}
{{- $_ := set $config "database_type" "sqlite3" }}
{{- $_ := set $config "connection_string" "/run/spire/data/datastore.sqlite3" }}
{{- else if eq .Values.dataStore.sql.databaseType "mysql" }}
{{- $_ := set $config "database_type" "mysql" }}
{{- $port := int .Values.dataStore.sql.port | default 3306 }}
{{- $query := include "spire-server.config-mysql-query" .Values.dataStore.sql.options }}
{{- $_ := set $config "connection_string" (printf "%s:${DBPW}@tcp(%s:%d)/%s%s" .Values.dataStore.sql.username .Values.dataStore.sql.host $port .Values.dataStore.sql.databaseName $query) }}
{{- else if eq .Values.dataStore.sql.databaseType "postgres" }}
{{- $_ := set $config "database_type" "postgres" }}
{{- $port := int .Values.dataStore.sql.port | default 5432 }}
{{- $options:= include "spire-server.config-postgresql-options" .Values.dataStore.sql.options }}
{{- $_ := set $config "connection_string" (printf "dbname=%s user=%s password=${DBPW} host=%s port=%d%s" .Values.dataStore.sql.databaseName .Values.dataStore.sql.username .Values.dataStore.sql.host $port $options) }}
{{- else }}
{{- .Values.bundleConfigMap }}
{{- end }}
{{- end }}
{{- define "spire-server.cluster-domain" -}}
{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
{{- .Values.global.k8s.clusterDomain }}
{{- else }}
{{- .Values.clusterDomain }}
{{- fail "Unsupported database type" }}
{{- end }}
{{- $config | toYaml }}
{{- end }}
charts/spire/charts/spire-server/templates/bundle-configmap.yaml
+1 -1
View File
@@ -2,5 +2,5 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "spire-server.bundle-configmap" . }}
name: {{ include "spire-lib.bundle-configmap" . }}
namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
charts/spire/charts/spire-server/templates/configmap.yaml
+105 -118
View File
@@ -1,126 +1,113 @@
{{- define "spire-server.yaml-config" -}}
{{- $root := . }}
{{- $namespace := include "spire-server.namespace" . }}
server:
bind_address: "0.0.0.0"
bind_port: "8081"
trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
data_dir: "/run/spire/data"
log_level: {{ .Values.logLevel | quote }}
jwt_issuer: {{ .Values.jwtIssuer | quote }}
ca_key_type: {{ .Values.caKeyType | quote }}
ca_ttl: {{ .Values.caTTL | quote }}
default_x509_svid_ttl: {{ .Values.defaultX509SvidTTL | quote }}
default_jwt_svid_ttl: {{ .Values.defaultJwtSvidTTL | quote }}
ca_subject:
{{- with .Values.ca_subject }}
- country: [{{ .country | quote }}]
organization: [{{ .organization | quote }}]
common_name: {{ .common_name | quote }}
{{- end }}
{{- with .Values.federation }}
{{- if eq (.enabled | toString) "true" }}
federation:
bundle_endpoint:
- {{ .bundleEndpoint | toYaml | nindent 8 }}
{{- end }}
{{- end }}
plugins:
DataStore:
- sql:
plugin_data:
{{ include "spire-server.datastore-config" . | nindent 10 }}
{{- with .Values.nodeAttestor.k8sPsat }}
{{- if eq (.enabled | toString) "true" }}
NodeAttestor:
- k8s_psat:
plugin_data:
clusters:
{{ include "spire-lib.cluster-name" $root }}:
service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
{{- end }}
{{- end }}
KeyManager:
- disk:
plugin_data:
keys_path: "/run/spire/data/keys.json"
Notifier:
- k8sbundle:
plugin_data:
namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }}
config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
{{- with .Values.upstreamAuthority.disk }}
{{- if eq (.enabled | toString) "true" }}
UpstreamAuthority:
- disk:
plugin_data:
cert_file_path: "/run/spire/upstream_ca/tls.crt"
key_file_path: "/run/spire/upstream_ca/tls.key"
{{- if ne .secret.data.bundle "" }}
bundle_file_path: "/run/spire/upstream_ca/bundle.crt"
{{- end }}
{{- end }}
{{- end }}
{{- with .Values.upstreamAuthority.certManager }}
{{- if eq (.enabled | toString) "true" }}
UpstreamAuthority:
- cert-manager:
plugin_data:
issuer_name: {{ .issuer_name | quote }}
issuer_kind: {{ .issuer_kind | quote }}
issuer_group: {{ .issuer_group | quote }}
namespace: {{ default $root.Release.Namespace .namespace | quote }}
{{- if ne .kube_config_file "" }}
kube_config_file: {{ .kube_config_file | quote }}
{{- end }}
{{- end }}
{{- end }}
health_checks:
listener_enabled: true
bind_address: "0.0.0.0"
bind_port: "8080"
live_path: "/live"
ready_path: "/ready"
{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
telemetry:
- Prometheus:
- host: "0.0.0.0"
port: 9988
{{- end }}
{{- end }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "spire-server.fullname" . }}
namespace: {{ include "spire-server.namespace" . }}
{{- with .Values.configMap.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
data:
server.conf: |
server {
bind_address = "0.0.0.0"
bind_port = "8081"
trust_domain = {{ include "spire-server.trust-domain" . | quote }}
data_dir = "/run/spire/data"
log_level = {{ .Values.logLevel | quote }}
jwt_issuer = {{ .Values.jwtIssuer | quote }}
ca_key_type = {{ .Values.caKeyType | quote }}
ca_ttl = {{ .Values.caTTL | quote }}
default_x509_svid_ttl = {{ .Values.defaultX509SvidTTL | quote }}
default_jwt_svid_ttl = {{ .Values.defaultJwtSvidTTL | quote }}
ca_subject = {
{{- with .Values.ca_subject }}
country = [{{ .country | quote }}],
organization = [{{ .organization | quote }}],
common_name = {{ .common_name | quote }},
{{- end }}
}
{{- with .Values.federation }}
{{- if eq (.enabled | toString) "true" }}
federation {
bundle_endpoint {
address = "{{ .bundleEndpoint.address }}"
port = {{ .bundleEndpoint.port }}
}
}
{{- end }}
{{- end }}
}
plugins {
DataStore "sql" {
plugin_data {
database_type = "sqlite3"
connection_string = "/run/spire/data/datastore.sqlite3"
}
}
{{- with .Values.nodeAttestor.k8sPsat }}
{{- if eq (.enabled | toString) "true" }}
NodeAttestor "k8s_psat" {
plugin_data {
clusters = {
{{ include "spire-server.cluster-name" $root | quote }} = {
service_account_allow_list = {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
}
}
}
}
{{- end }}
{{- end }}
KeyManager "disk" {
plugin_data {
keys_path = "/run/spire/data/keys.json"
}
}
Notifier "k8sbundle" {
plugin_data {
namespace = {{ .Values.notifier.k8sbundle.namespace | default $namespace | quote }}
config_map = {{ include "spire-server.bundle-configmap" . | quote }}
}
}
{{- with .Values.upstreamAuthority.disk }}
{{- if eq (.enabled | toString) "true" }}
UpstreamAuthority "disk" {
plugin_data {
cert_file_path = "/run/spire/upstream_ca/tls.crt"
key_file_path = "/run/spire/upstream_ca/tls.key"
{{- if ne .secret.data.bundle "" }}
bundle_file_path = "/run/spire/upstream_ca/bundle.crt"
{{- end }}
}
}
{{- end }}
{{- end }}
{{- with .Values.upstreamAuthority.certManager }}
{{- if eq (.enabled | toString) "true" }}
UpstreamAuthority "cert-manager" {
plugin_data {
issuer_name = {{ .issuer_name | quote }}
issuer_kind = {{ .issuer_kind | quote }}
issuer_group = {{ .issuer_group | quote }}
namespace = {{ default $root.Release.Namespace .namespace | quote }}
{{- if ne .kube_config_file "" }}
kube_config_file = {{ .kube_config_file | quote }}
{{- end }}
}
}
{{- end }}
{{- end }}
}
health_checks {
listener_enabled = true
bind_address = "0.0.0.0"
bind_port = "8080"
live_path = "/live"
ready_path = "/ready"
}
{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
telemetry {
Prometheus {
host = "0.0.0.0"
port = 9988
}
}
{{- end }}
{{- include "spire-server.yaml-config" . | fromYaml | toPrettyJson | nindent 4 }}
charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
+6 -2
View File
@@ -4,6 +4,10 @@ kind: ConfigMap
metadata:
name: {{ include "spire-controller-manager.fullname" . }}
namespace: {{ include "spire-server.namespace" . }}
{{- with .Values.controllerManager.configMap.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
data:
controller-manager-config.yaml: |
apiVersion: spire.spiffe.io/v1alpha1
@@ -22,8 +26,8 @@ data:
resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
resourceNamespace: {{ include "spire-server.namespace" . }}
validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook
clusterName: {{ include "spire-server.cluster-name" . }}
trustDomain: {{ include "spire-server.trust-domain" . }}
clusterName: {{ include "spire-lib.cluster-name" . }}
trustDomain: {{ include "spire-lib.trust-domain" . }}
ignoreNamespaces:
{{- with .Values.controllerManager.ignoreNamespaces }}
{{- toYaml . | nindent 6 }}
charts/spire/charts/spire-server/templates/hpa.yaml
+3
View File
@@ -12,6 +12,9 @@ spec:
kind: Deployment
name: {{ include "spire-server.fullname" . }}
minReplicas: {{ .Values.autoscaling.minReplicas }}
{{- if and (eq .Values.dataStore.sql.databaseType "sqlite3") .Values.autoscaling.enabled (gt (int .Values.autoscaling.maxReplicas) 1) }}
{{- fail "When running with sqlite3 database, you can't scale up to more then one instance. 'autoscaling.maxReplicas' MUST be 1" }}
{{- end }}
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
metrics:
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
charts/spire/charts/spire-server/templates/post-install-hook.yaml
+1 -1
View File
@@ -63,7 +63,7 @@ spec:
- name: post-install-job
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }}
command:
- /bin/sh
- -c
charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+1 -1
View File
@@ -63,7 +63,7 @@ spec:
- name: post-upgrade-job
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }}
command:
- /bin/sh
- -c
charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+1 -1
View File
@@ -63,7 +63,7 @@ spec:
- name: post-install-job
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }}
command:
- /bin/sh
- -c
charts/spire/charts/spire-server/templates/roles.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ metadata:
rules:
- apiGroups: [""]
resources: [configmaps]
resourceNames: [{{ include "spire-server.bundle-configmap" . }}]
resourceNames: [{{ include "spire-lib.bundle-configmap" . }}]
verbs:
- get
- patch
charts/spire/charts/spire-server/templates/secret.yaml
+9
View File
@@ -0,0 +1,9 @@
{{- if ne .Values.dataStore.sql.databaseType "sqlite3" }}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "spire-server.fullname" . }}-dbpw
namespace: {{ include "spire-server.namespace" . }}
data:
DBPW: {{ .Values.dataStore.sql.password | b64enc }}
{{- end }}
charts/spire/charts/spire-server/templates/service.yaml
+1 -1
View File
@@ -5,7 +5,7 @@ metadata:
namespace: {{ include "spire-server.namespace" . }}
{{- with .Values.service.annotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- toYaml . | nindent 4 }}
{{- end }}
labels:
{{- include "spire-server.labels" . | nindent 4 }}
charts/spire/charts/spire-server/templates/statefulset.yaml
+20 -11
View File
@@ -1,5 +1,6 @@
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
{{- $configSum2 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }}
{{- $configSum2 := (include (print $.Template.BasePath "/secret.yaml") . | sha256sum) }}
{{- $configSum3 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }}
{{- $fullname := include "spire-server.fullname" . }}
apiVersion: apps/v1
kind: StatefulSet
@@ -10,6 +11,9 @@ metadata:
{{- include "spire-server.labels" . | nindent 4 }}
spec:
{{- if not .Values.autoscaling.enabled }}
{{- if and (eq .Values.dataStore.sql.databaseType "sqlite3") (gt (int .Values.replicaCount) 1) }}
{{- fail "When running with sqlite3 database, you can't scale up to more then one instance. 'replicaCount' MUST be 1" }}
{{- end }}
replicas: {{ .Values.replicaCount }}
{{- end }}
serviceName: {{ include "spire-server.fullname" . }}
@@ -21,6 +25,7 @@ spec:
annotations:
checksum/config: {{ $configSum }}
checksum/config2: {{ $configSum2 }}
checksum/config3: {{ $configSum3 }}
{{- with .Values.podAnnotations }}
{{- toYaml . | nindent 8 }}
{{- end }}
@@ -43,14 +48,22 @@ spec:
- name: {{ .Chart.Name }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
args:
- -expandEnv
- -config
- /run/spire/config/server.conf
env:
- name: PATH
value: "/opt/spire/bin:/bin"
{{- if ne .Values.dataStore.sql.databaseType "sqlite3" }}
- name: DBPW
valueFrom:
secretKeyRef:
name: {{ $fullname }}-dbpw
key: DBPW
{{- end }}
ports:
- name: grpc
containerPort: 8081
@@ -91,11 +104,9 @@ spec:
- name: spire-config
mountPath: /run/spire/config
readOnly: true
{{- if eq (.Values.dataStorage.enabled | toString) "true" }}
- name: spire-data
mountPath: /run/spire/data
readOnly: false
{{- end }}
{{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
- name: upstream-ca
mountPath: /run/spire/upstream_ca
@@ -108,7 +119,7 @@ spec:
- name: spire-controller-manager
securityContext:
{{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image) }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }}
args:
- --config=controller-manager-config.yaml
@@ -185,16 +196,14 @@ spec:
{{- toYaml .Values.extraVolumes | nindent 8 }}
{{- end }}
volumeClaimTemplates:
{{- if eq (.Values.dataStorage.enabled | toString) "true" }}
- metadata:
name: spire-data
spec:
accessModes:
- {{ .Values.dataStorage.accessMode | default "ReadWriteOnce" }}
- {{ .Values.persistence.accessMode | default "ReadWriteOnce" }}
resources:
requests:
storage: {{ .Values.dataStorage.size }}
{{- if .Values.dataStorage.storageClass }}
storageClassName: {{ .Values.dataStorage.storageClass }}
storage: {{ .Values.persistence.size }}
{{- if .Values.persistence.storageClass }}
storageClassName: {{ .Values.persistence.storageClass }}
{{- end }}
{{ end }}
charts/spire/charts/spire-server/templates/tests/test-connection.yaml
+1 -1
View File
@@ -33,7 +33,7 @@ spec:
- name: curl-federation-bundle-endpoint
image: cgr.dev/chainguard/bash:latest
command: ['curl']
args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-server.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}']
args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}']
securityContext:
{{- toYaml .Values.securityContext | nindent 8 }}
{{- end }}
charts/spire/charts/spire-server/values.yaml
+45 -7
View File
@@ -6,10 +6,11 @@
replicaCount: 1
image:
# registry: gcr.io
# repository: spiffe-io/spire-server
# -- The OCI registry to pull the image from
registry: ghcr.io
# -- The repository within the registry
repository: spiffe/spire-server
# -- The image pull policy
pullPolicy: IfNotPresent
# Overrides the image tag whose default is the chart appVersion.
version: ""
@@ -20,11 +21,11 @@ namespaceOverride: ""
fullnameOverride: ""
serviceAccount:
# Specifies whether a service account should be created
# -- Specifies whether a service account should be created
create: true
# Annotations to add to the service account
# -- Annotations to add to the service account
annotations: {}
# The name of the service account to use.
# -- The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
@@ -46,6 +47,10 @@ service:
port: 8081
annotations: {}
configMap:
# -- Annotations to add to the SPIRE Server ConfigMap
annotations: {}
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
@@ -73,16 +78,39 @@ affinity: {}
topologySpreadConstraints: []
dataStorage:
enabled: true
persistence:
size: 1Gi
accessMode: ReadWriteOnce
storageClass: null
dataStore:
sql:
# -- Other supported databases are "postgres" and "mysql"
databaseType: sqlite3
# -- Only used by "postgres" or "mysql"
databaseName: spire
# -- Only used by "postgres" or "mysql"
host: ""
# -- If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases.
port: 0
# -- Only used by "postgres" or "mysql"
username: spire
# -- Only used by "postgres" or "mysql"
password: ""
# -- Only used by "postgres" or "mysql"
options: []
# -- Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section
plugin_data: {}
# -- The log level, valid values are "debug", "info", "warn", and "error"
logLevel: info
# -- The JWT issuer domain
jwtIssuer: oidc-discovery.example.org
# -- Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`)
clusterName: example-cluster
# -- Set the trust domain to be used for the SPIFFE identifiers
trustDomain: example.org
bundleConfigMap: spire-bundle
@@ -134,8 +162,11 @@ controllerManager:
enabled: false
image:
# -- The OCI registry to pull the image from
registry: ghcr.io
# -- The repository within the registry
repository: spiffe/spire-controller-manager
# -- The image pull policy
pullPolicy: IfNotPresent
# Overrides the image tag whose default is the chart appVersion.
version: "0.2.2"
@@ -165,6 +196,10 @@ controllerManager:
port: 443
annotations: {}
configMap:
# -- Annotations to add to the Controller Manager ConfigMap
annotations: {}
ignoreNamespaces:
- kube-system
- kube-public
@@ -187,8 +222,11 @@ controllerManager:
failurePolicy: Fail
upgradeHook:
image:
# -- The OCI registry to pull the image from
registry: cgr.dev
# -- The repository within the registry
repository: chainguard/kubectl
# -- The image pull policy
pullPolicy: IfNotPresent
version: latest
charts/spire/templates/_helpers.tpl
-35
View File
@@ -1,35 +0,0 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "spire.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "spire.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "spire.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- define "spire.server-socket-path" -}}
{{- print "/run/spire/server-sockets/spire-server.sock" }}
{{- end }}
charts/spire/templates/_spire-lib.tpl
+52
View File
@@ -0,0 +1,52 @@
{{- define "spire-lib.cluster-name" }}
{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
{{- .Values.global.spire.clusterName }}
{{- else }}
{{- .Values.clusterName }}
{{- end }}
{{- end }}
{{- define "spire-lib.trust-domain" }}
{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
{{- .Values.global.spire.trustDomain }}
{{- else }}
{{- .Values.trustDomain }}
{{- end }}
{{- end }}
{{- define "spire-lib.bundle-configmap" }}
{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
{{- .Values.global.spire.bundleConfigMap }}
{{- else }}
{{- .Values.bundleConfigMap }}
{{- end }}
{{- end }}
{{- define "spire-lib.cluster-domain" -}}
{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
{{- .Values.global.k8s.clusterDomain }}
{{- else }}
{{- .Values.clusterDomain }}
{{- end }}
{{- end }}
{{- define "spire-lib.registry" }}
{{- if ne (len (dig "spire" "image" "registry" "" .global)) 0 }}
{{- .global.spire.image.registry }}
{{- else }}
{{- .image.registry }}
{{- end }}
{{- end }}
{{- define "spire-lib.image" -}}
{{- $registry := include "spire-lib.registry" . }}
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
{{- printf "%s/%s@%s" $registry .image.repository .image.version -}}
{{- else if .appVersion -}}
{{- printf "%s/%s:%s" $registry .image.repository (default .appVersion .image.version) -}}
{{- else if .image.version -}}
{{- printf "%s/%s:%s" $registry .image.repository .image.version -}}
{{- else -}}
{{- printf "%s/%s" $registry .image.repository -}}
{{- end -}}
{{- end }}
charts/spire/values.yaml
+6 -5
View File
@@ -4,13 +4,17 @@ global:
# -- This is the value of your clusters `kubeadm init --service-dns-domain` flag
clusterDomain: cluster.local
spire:
# -- Set the name of the Kubernetes cluster
# -- The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)
clusterName: example-cluster
# -- Set the trust domain to use for the spiffe identifiers
# -- The trust domain to be used for the SPIFFE identifiers
trustDomain: example.org
# -- Override all instances of bundleConfigMap
bundleConfigMap: ""
image:
# -- Override all Spire image registries at once
registry: ""
# telemetry:
# prometheus:
# enabled: true
@@ -20,9 +24,6 @@ global:
# namespace: "kube-prometheus-system"
# labels: {}
nameOverride: ""
fullnameOverride: ""
# subcharts
spire-server:
enabled: true
examples/bin/readpw.sh
+3
View File
@@ -0,0 +1,3 @@
# shellcheck shell=bash disable=SC2034
read -s -r -p "Please enter your database password: " DBPW
echo
examples/external-mysql/README.md
+22
View File
@@ -0,0 +1,22 @@
# Example external mysql
We recommend you put your config into git, but never put a password directly into git. Generally the easiest way to do so is via
environment variable. Your CI/CD system of choice usually allows you to set those. Please refer to your systems documentation for
guidance.
If manually deploying for testing, you can safely put the password into an environment variable by running:
```bash
source ../bin/readpw.sh
```
Next, edit values.yaml with your settings. Check it into your git repo if using one.
Then, deploy the chart pointing at your mysql instance like so:
```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml --set "spire-server.dataStore.sql.password=${DBPW}"
```
See the [production example](../production) for production recommendations.
See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
examples/external-mysql/values.yaml
+10
View File
@@ -0,0 +1,10 @@
spire-server:
dataStore:
sql:
databaseType: mysql
databaseName: spire
host: mysql
port: 3306
username: spire
options:
- parseTime: true
examples/external-postgresql/README.md
+23
View File
@@ -0,0 +1,23 @@
# Example external postgresql
We recommend you put your config into git, but never put a password directly into git. Generally the easiest way to do so is via
environment variable. Your CI/CD system of choice usually allows you to set those. Please refer to your systems documentation for
guidance.
If manually deploying for testing, you can safely put the password into an environment variable by running:
```bash
source ../bin/readpw.sh
```
Next, edit values.yaml with your settings. Check it into your git repo if using one.
Then, deploy the chart pointing at your postgresql instance like so:
```shell
helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml --set "spire-server.dataStore.sql.password=${DBPW}"
```
See the [production example](../production) for production recommendations.
See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
examples/external-postgresql/values.yaml
+10
View File
@@ -0,0 +1,10 @@
spire-server:
dataStore:
sql:
databaseType: postgres
databaseName: spire
host: postgresql
port: 5432
username: spire
options:
- sslmode: disable
examples/production/README.md
+1 -1
View File
@@ -1,6 +1,6 @@
# Recommended production setup
Too install Spire with the least privileges possible we deploy spire accross 2 namespaces.
To install Spire with the least privileges possible we deploy spire across 2 namespaces.
```shell
kubectl create namespace "spire-system"
helm-docs.sh
+23 -23
View File
@@ -6,31 +6,31 @@ SCRIPTPATH=$(dirname "$0")
HELM_DOCS_VERSION="1.11.0"
case "$(uname -s)" in
Linux*)
machine=Linux
shasum=sha256sum
exe=helm-docs
;;
Darwin*)
machine=Darwin
shasum=shasum
exe=helm-docs
;;
MINGW64*)
machine=Windows
shasum=sha256sum
exe=helm-docs.exe
;;
Linux*)
machine=Linux
shasum=sha256sum
exe=helm-docs
;;
Darwin*)
machine=Darwin
shasum=shasum
exe=helm-docs
;;
MINGW64*)
machine=Windows
shasum=sha256sum
exe=helm-docs.exe
;;
esac
function install_helm_docs {
curl -LO https://github.com/norwoodj/helm-docs/releases/download/v"${HELM_DOCS_VERSION}"/helm-docs_"${HELM_DOCS_VERSION}"_${machine}_x86_64.tar.gz
curl -L --output /tmp/checksums_helm-docs.txt https://github.com/norwoodj/helm-docs/releases/download/v${HELM_DOCS_VERSION}/checksums.txt
grep helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz /tmp/checksums_helm-docs.txt | $shasum -c -
mkdir -p "$SCRIPTPATH/bin"
tar -xf helm-docs_"${HELM_DOCS_VERSION}"_${machine}_x86_64.tar.gz ${exe}
mv ${exe} "$SCRIPTPATH/bin/"
rm helm-docs_"${HELM_DOCS_VERSION}"_${machine}_x86_64.tar.gz
curl -LO "https://github.com/norwoodj/helm-docs/releases/download/v${HELM_DOCS_VERSION}/helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz"
curl -L --output /tmp/checksums_helm-docs.txt "https://github.com/norwoodj/helm-docs/releases/download/v${HELM_DOCS_VERSION}/checksums.txt"
grep "helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz" /tmp/checksums_helm-docs.txt | $shasum -c -
mkdir -p "$SCRIPTPATH/bin"
tar -xf "helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz" "${exe}"
mv "${exe}" "$SCRIPTPATH/bin/"
rm "helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz"
}
if [ ! -f "$SCRIPTPATH/bin/${exe}" ] ; then
@@ -42,5 +42,5 @@ else
fi
# validate docs
"$SCRIPTPATH/bin/${exe}"
"$SCRIPTPATH/bin/${exe}" --document-dependency-values
git diff --exit-code
project/glossary.md
+46
View File
@@ -0,0 +1,46 @@
<!-- vim: ft=markdown colorcolumn=72
-->
# Glossary
This glossary is a dictionary of terms defined as they are used by the
spire/helm-charts project. Writing the definitions of terms here helps
to keep other documents concise and precise. Documenting terminology
here helps prevent misundersandings, facilitating easy onboarding of new
team members.
**Deployment**
: A use of the Helm Charts to describe a single SPIRE cluster.
**Deployment Type**
: One of three supported deployments of the charts: Standalone,
Primary, or Secondary.
**Federation**
: When one cluster is configured to trust elements of another cluster
containing a different trust domain.
**Federated Deployment**
: A Primary Deployment or Standalone Deployment that is configured
to federate with one or more Deployments.
**Primary Deployment**
: A deployment of the Helm Charts where the cluster's purpose is to
provide certificates to Secondary Deployments.
**Secondary Deployment**
: A deployment of the Helm Charts where the cluster obtains an
intermediate CA from a Primary Deployment and uses it to service
Workload Identity requests.
**Standalone Deployment**
: A deployment of the Helm Charts where the cluster both manages the CA
and services Workload Identity requests in the same cluster.
**Tiered Deployment**
: Use of the Helm Charts two or more times, such that one chart is
configured as a Primary Deployment Type and the others are configured as
Secondary Deployment Types.
**Trust Domain**
: The host field of a SPIFFE ID, naming a minimum footprint of a trust
bundle's distribution.
project/overview.md
+51
View File
@@ -0,0 +1,51 @@
<!-- vim: ft=markdown colorcolumn=72
-->
# Project Overview
The spire/helm-chart effort intends to deliver a set of helm charts to
support SPIRE deployments in Kubernetes to the widest possible audience of
users.
## Mission and Scope
The mission of this effort is to provide a stable upstream repository
of Helm Charts sufficient for any organization or individual to use.
### What problem does this project address?
Prior to this effort, no single authoritative repository for SPIRE Helm
Charts existed, imposing an additional burden on SPIRE adoption as each
organization or individual had to develop their own Kubernetes
deployment packaging.
### What is the goal of this project?
The goal of this project is to be the primary means of deployment for
SPIRE into Kubernetes clusters, providing a flexible solution that can
be used in a wide number of different scenarios.
### What is the scope of this project?
The scope includes user documentation, chart creation, chart delivery,
chart testing, and chart maintenance of a set of Helm Charts sufficient
for deploying SPIRE in any SPIRE documented configuration, including
direction on how to extend the Charts to integrate non-SPIRE plugins.
### What development methodology is used?
An Open Source Development methodology is used, where issues are tracked
within the primary github repository.
## Status
The project is currently in a pre-release status. While the standalone
deployment is close to release quality, the tiered deployment is not.
## Project Navigation
Below are links to project documentation useful for the management and
maintenance of the spire/helm project.
### Coordination
- [glossary](glossary.md)