From 1d72b57260b5d73a04f9ca5a43bb4f28c2c37650 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Sat, 11 Mar 2023 10:28:22 +0100 Subject: [PATCH 01/32] Change spire-server configmap to yaml format Signed-off-by: Marco Franssen --- .../spire-server/templates/configmap.yaml | 220 ++++++++---------- 1 file changed, 102 insertions(+), 118 deletions(-) diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index d1143f5..11e8a66 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -1,5 +1,105 @@ +{{- define "spire-server.yaml-config" -}} {{- $root := . }} -{{- $namespace := include "spire-server.namespace" . }} +server: + bind_address: "0.0.0.0" + bind_port: "8081" + trust_domain: {{ include "spire-server.trust-domain" . | quote }} + data_dir: "/run/spire/data" + log_level: {{ .Values.logLevel | quote }} + jwt_issuer: {{ .Values.jwtIssuer | quote }} + + ca_key_type: {{ .Values.caKeyType | quote }} + ca_ttl: {{ .Values.caTTL | quote }} + + default_x509_svid_ttl: {{ .Values.defaultX509SvidTTL | quote }} + default_jwt_svid_ttl: {{ .Values.defaultJwtSvidTTL | quote }} + + ca_subject: + {{- with .Values.ca_subject }} + - country: [{{ .country | quote }}] + organization: [{{ .organization | quote }}] + common_name: {{ .common_name | quote }} + {{- end }} + + {{- with .Values.federation }} + {{- if eq (.enabled | toString) "true" }} + federation: + bundle_endpoint: + - {{ .bundleEndpoint | toYaml | nindent 8 }} + {{- end }} + {{- end }} + +plugins: + DataStore: + - sql: + plugin_data: + database_type: "sqlite3" + connection_string: "/run/spire/data/datastore.sqlite3" + + {{- with .Values.nodeAttestor.k8sPsat }} + {{- if eq (.enabled | toString) "true" }} + NodeAttestor: + - k8s_psat: + plugin_data: + clusters: + {{ include "spire-server.cluster-name" $root }}: + service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }} + {{- end }} + {{- end }} + + KeyManager: + - disk: + plugin_data: + keys_path: "/run/spire/data/keys.json" + + Notifier: + - k8sbundle: + plugin_data: + namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }} + config_map: {{ include "spire-server.bundle-configmap" . | quote }} + + {{- with .Values.upstreamAuthority.disk }} + {{- if eq (.enabled | toString) "true" }} + UpstreamAuthority: + - disk: + plugin_data: + cert_file_path: "/run/spire/upstream_ca/tls.crt" + key_file_path: "/run/spire/upstream_ca/tls.key" + {{- if ne .secret.data.bundle "" }} + bundle_file_path: "/run/spire/upstream_ca/bundle.crt" + {{- end }} + {{- end }} + {{- end }} + + {{- with .Values.upstreamAuthority.certManager }} + {{- if eq (.enabled | toString) "true" }} + UpstreamAuthority: + - cert-manager: + plugin_data: + issuer_name: {{ .issuer_name | quote }} + issuer_kind: {{ .issuer_kind | quote }} + issuer_group: {{ .issuer_group | quote }} + namespace: {{ default $root.Release.Namespace .namespace | quote }} + {{- if ne .kube_config_file "" }} + kube_config_file: {{ .kube_config_file | quote }} + {{- end }} + {{- end }} + {{- end }} + +health_checks: + listener_enabled: true + bind_address: "0.0.0.0" + bind_port: "8080" + live_path: "/live" + ready_path: "/ready" + +{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }} +telemetry: + - Prometheus: + - host: "0.0.0.0" + port: 9988 +{{- end }} +{{- end }} apiVersion: v1 kind: ConfigMap metadata: @@ -7,120 +107,4 @@ metadata: namespace: {{ include "spire-server.namespace" . }} data: server.conf: | - server { - bind_address = "0.0.0.0" - bind_port = "8081" - trust_domain = {{ include "spire-server.trust-domain" . | quote }} - data_dir = "/run/spire/data" - log_level = {{ .Values.logLevel | quote }} - - jwt_issuer = {{ .Values.jwtIssuer | quote }} - - ca_key_type = {{ .Values.caKeyType | quote }} - ca_ttl = {{ .Values.caTTL | quote }} - - default_x509_svid_ttl = {{ .Values.defaultX509SvidTTL | quote }} - default_jwt_svid_ttl = {{ .Values.defaultJwtSvidTTL | quote }} - - ca_subject = { - {{- with .Values.ca_subject }} - country = [{{ .country | quote }}], - organization = [{{ .organization | quote }}], - common_name = {{ .common_name | quote }}, - {{- end }} - } - - {{- with .Values.federation }} - {{- if eq (.enabled | toString) "true" }} - federation { - bundle_endpoint { - address = "{{ .bundleEndpoint.address }}" - port = {{ .bundleEndpoint.port }} - } - } - {{- end }} - {{- end }} - } - - plugins { - DataStore "sql" { - plugin_data { - database_type = "sqlite3" - connection_string = "/run/spire/data/datastore.sqlite3" - } - } - - {{- with .Values.nodeAttestor.k8sPsat }} - {{- if eq (.enabled | toString) "true" }} - NodeAttestor "k8s_psat" { - plugin_data { - clusters = { - {{ include "spire-server.cluster-name" $root | quote }} = { - service_account_allow_list = {{ include "spire-server.serviceAccountAllowedList" $root | trim }} - } - } - } - } - {{- end }} - {{- end }} - - KeyManager "disk" { - plugin_data { - keys_path = "/run/spire/data/keys.json" - } - } - - Notifier "k8sbundle" { - plugin_data { - namespace = {{ .Values.notifier.k8sbundle.namespace | default $namespace | quote }} - config_map = {{ include "spire-server.bundle-configmap" . | quote }} - } - } - - {{- with .Values.upstreamAuthority.disk }} - {{- if eq (.enabled | toString) "true" }} - UpstreamAuthority "disk" { - plugin_data { - cert_file_path = "/run/spire/upstream_ca/tls.crt" - key_file_path = "/run/spire/upstream_ca/tls.key" - {{- if ne .secret.data.bundle "" }} - bundle_file_path = "/run/spire/upstream_ca/bundle.crt" - {{- end }} - } - } - {{- end }} - {{- end }} - - {{- with .Values.upstreamAuthority.certManager }} - {{- if eq (.enabled | toString) "true" }} - UpstreamAuthority "cert-manager" { - plugin_data { - issuer_name = {{ .issuer_name | quote }} - issuer_kind = {{ .issuer_kind | quote }} - issuer_group = {{ .issuer_group | quote }} - namespace = {{ default $root.Release.Namespace .namespace | quote }} - {{- if ne .kube_config_file "" }} - kube_config_file = {{ .kube_config_file | quote }} - {{- end }} - } - } - {{- end }} - {{- end }} - } - - health_checks { - listener_enabled = true - bind_address = "0.0.0.0" - bind_port = "8080" - live_path = "/live" - ready_path = "/ready" - } - - {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }} - telemetry { - Prometheus { - host = "0.0.0.0" - port = 9988 - } - } - {{- end }} + {{- include "spire-server.yaml-config" . | fromYaml | toPrettyJson | nindent 4 }} From 861108c0abd0121a611acb06c8e8ff6c34e65a3d Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Sun, 12 Mar 2023 10:28:41 +0100 Subject: [PATCH 02/32] Change spire-agent configmap to yaml format Signed-off-by: Marco Franssen --- .../spire-agent/templates/configmap.yaml | 103 ++++++++---------- 1 file changed, 48 insertions(+), 55 deletions(-) diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 900f526..15cbd3b 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -1,3 +1,50 @@ +{{- define "spire-agent.yaml-config" -}} +agent: + data_dir: "/run/spire" + log_level: {{ .Values.logLevel | quote }} + server_address: {{ include "spire-agent.server-address" . | trim | quote }} + server_port: {{ .Values.server.port | quote }} + socket_path: {{ include "spire-agent.socket-path" . | quote }} + trust_bundle_path: "/run/spire/bundle/bundle.crt" + trust_domain: {{ include "spire-agent.trust-domain" . | quote }} + +plugins: + NodeAttestor: + - k8s_psat: + plugin_data: + cluster: {{ include "spire-agent.cluster-name" . | quote }} + + KeyManager: + - memory: + plugin_data: + + WorkloadAttestor: + - k8s: + plugin_data: + # Defaults to the secure kubelet port by default. + # Minikube does not have a cert in the cluster CA bundle that + # can authenticate the kubelet cert, so skip validation. + skip_kubelet_verification: true + + {{- if .Values.workloadAttestors.unix.enabled }} + - unix: + plugin_data: + {{- end }} + +health_checks: + listener_enabled: true + bind_address: "0.0.0.0" + bind_port: {{ .Values.healthChecks.port | quote }} + live_path: "/live" + ready_path: "/ready" + +{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }} +telemetry: + - Prometheus: + - host: "0.0.0.0" + port: {{ .Values.telemetry.prometheus.port }} +{{- end }} +{{- end }} apiVersion: v1 kind: ConfigMap metadata: @@ -5,58 +52,4 @@ metadata: namespace: {{ include "spire-agent.namespace" . }} data: agent.conf: | - agent { - data_dir = "/run/spire" - log_level = {{ .Values.logLevel | quote }} - server_address = {{ include "spire-agent.server-address" . | trim | quote }} - server_port = {{ .Values.server.port | quote }} - socket_path = {{ include "spire-agent.socket-path" . | quote }} - trust_bundle_path = "/run/spire/bundle/bundle.crt" - trust_domain = {{ include "spire-agent.trust-domain" . | quote }} - } - - plugins { - NodeAttestor "k8s_psat" { - plugin_data { - cluster = {{ include "spire-agent.cluster-name" . | quote }} - } - } - - KeyManager "memory" { - plugin_data { - } - } - - WorkloadAttestor "k8s" { - plugin_data { - # Defaults to the secure kubelet port by default. - # Minikube does not have a cert in the cluster CA bundle that - # can authenticate the kubelet cert, so skip validation. - skip_kubelet_verification = true - } - } - - {{- if .Values.workloadAttestors.unix.enabled }} - WorkloadAttestor "unix" { - plugin_data { - } - } - {{- end }} - } - - health_checks { - listener_enabled = true - bind_address = "0.0.0.0" - bind_port = {{ .Values.healthChecks.port | quote }} - live_path = "/live" - ready_path = "/ready" - } - - {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }} - telemetry { - Prometheus { - host = "0.0.0.0" - port = {{ .Values.telemetry.prometheus.port }} - } - } - {{- end }} + {{- include "spire-agent.yaml-config" . | fromYaml | toPrettyJson | nindent 4 }} From d7dcfeb66c2f7a59d45bf5e4d3a69b4773128811 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Sun, 12 Mar 2023 10:29:01 +0100 Subject: [PATCH 03/32] Change spiffe-oidc-provider-config configmap to yaml format Signed-off-by: Marco Franssen --- .../templates/configmap.yaml | 68 ++++++++++--------- 1 file changed, 35 insertions(+), 33 deletions(-) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml index 1078b33..6e03daf 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml @@ -1,4 +1,38 @@ {{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }} +{{- define "spiffe-oidc-discovery-provider.yaml-config" -}} +{{- $oidcSocket := .oidcSocket }} +{{- with .root }} +log_level: {{ .Values.config.logLevel | quote }} + +domains: + - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}" + - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}" + - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}" + {{- if gt (len .Values.config.domains) 0 }} + {{- .Values.config.domains | toYaml | nindent 2 }} + {{- end }} + +{{- if .Values.insecureScheme.enabled }} +allow_insecure_scheme: {{ .Values.insecureScheme.enabled }} +listen_socket_path: {{ $oidcSocket | quote }} +{{- else }} +acme: + directory_url: {{ .Values.config.acme.directoryUrl | quote }} + cache_dir: {{ .Values.config.acme.cacheDir | quote }} + tos_accepted: {{ .Values.config.acme.tosAccepted }} + email: {{ .Values.config.acme.emailAddress | quote }} +{{- end }} + +workload_api: + socket_path: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | quote }} + trust_domain: {{ include "spiffe-oidc-discovery-provider.trust-domain" . | quote }} + +health_checks: + bind_port: "8008" + ready_path: "/ready" + live_path: "/live" +{{- end }} +{{- end }} apiVersion: v1 kind: ConfigMap metadata: @@ -6,39 +40,7 @@ metadata: namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }} data: oidc-discovery-provider.conf: | - log_level = "{{ .Values.config.logLevel }}" - - domains = [ - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}", - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}", - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}", - {{- if gt (len .Values.config.domains) 0 }} - "{{- join "\",\n \"" .Values.config.domains }}" - {{- end }} - ] - - {{- if .Values.insecureScheme.enabled }} - allow_insecure_scheme = {{ .Values.insecureScheme.enabled }} - listen_socket_path = {{ $oidcSocket | quote }} - {{- else }} - acme { - directory_url = "{{ .Values.config.acme.directoryUrl }}" - cache_dir = "{{ .Values.config.acme.cacheDir }}" - tos_accepted = {{ .Values.config.acme.tosAccepted }} - email = "{{ .Values.config.acme.emailAddress }}" - } - {{- end }} - - workload_api { - socket_path = {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | quote }} - trust_domain = {{ include "spiffe-oidc-discovery-provider.trust-domain" . | quote }} - } - - health_checks { - bind_port = "8008" - ready_path = "/ready" - live_path = "/live" - } + {{- include "spiffe-oidc-discovery-provider.yaml-config" (dict "oidcSocket" $oidcSocket "root" .) | fromYaml | toPrettyJson | nindent 4 }} {{- if .Values.insecureScheme.enabled }} default.conf: | upstream oidc { From e3b0d00bd7c0d5e16eb51534e0dc064bb4a63639 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 17 Apr 2023 11:47:10 +0200 Subject: [PATCH 04/32] Bump min required spire 1.6.x version for this chart Signed-off-by: Marco Franssen --- charts/spire/README.md | 2 +- charts/spire/README.md.gotmpl | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index b842370..ea60ab5 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -17,7 +17,7 @@ A Helm chart for deploying the complete Spire stack including: spire-server, spi | Dependency | Supported Versions | |:-----------|:-------------------| -| SPIRE | `1.5.3+`, `1.6.x` | +| SPIRE | `1.5.3+`, `1.6.3+` | | Helm | `3.x` | | Kubernetes | `1.21+` | diff --git a/charts/spire/README.md.gotmpl b/charts/spire/README.md.gotmpl index 70823d0..f2dd15d 100644 --- a/charts/spire/README.md.gotmpl +++ b/charts/spire/README.md.gotmpl @@ -19,7 +19,7 @@ | Dependency | Supported Versions | |:-----------|:-------------------| -| SPIRE | `1.5.3+`, `1.6.x` | +| SPIRE | `1.5.3+`, `1.6.3+` | | Helm | `3.x` | | Kubernetes | `1.21+` | From 210ed02c582172a94cacc421f608b7a002259678 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Mon, 17 Apr 2023 03:18:18 -0700 Subject: [PATCH 05/32] Remove dead code (#217) --- charts/spire/README.md | 2 -- charts/spire/templates/_helpers.tpl | 35 ----------------------------- charts/spire/values.yaml | 3 --- 3 files changed, 40 deletions(-) delete mode 100644 charts/spire/templates/_helpers.tpl diff --git a/charts/spire/README.md b/charts/spire/README.md index b842370..2369ede 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -108,12 +108,10 @@ Kubernetes: `>=1.21.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| -| fullnameOverride | string | `""` | | | global.k8s.clusterDomain | string | `"cluster.local"` | | | global.spire.bundleConfigMap | string | `""` | Override all instances of bundleConfigMap | | global.spire.clusterName | string | `"example-cluster"` | Set the name of the Kubernetes cluster | | global.spire.trustDomain | string | `"example.org"` | Set the trust domain to use for the spiffe identifiers | -| nameOverride | string | `""` | | | spiffe-csi-driver.enabled | bool | `true` | | | spiffe-oidc-discovery-provider.enabled | bool | `false` | | | spire-agent.enabled | bool | `true` | | diff --git a/charts/spire/templates/_helpers.tpl b/charts/spire/templates/_helpers.tpl deleted file mode 100644 index 50fe6eb..0000000 --- a/charts/spire/templates/_helpers.tpl +++ /dev/null @@ -1,35 +0,0 @@ -{{/* -Expand the name of the chart. -*/}} -{{- define "spire.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "spire.fullname" -}} -{{- if .Values.fullnameOverride }} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- $name := default .Chart.Name .Values.nameOverride }} -{{- if contains $name .Release.Name }} -{{- .Release.Name | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} -{{- end }} -{{- end }} -{{- end }} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "spire.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{- define "spire.server-socket-path" -}} -{{- print "/run/spire/server-sockets/spire-server.sock" }} -{{- end }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 316741b..7c028d7 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -20,9 +20,6 @@ global: # namespace: "kube-prometheus-system" # labels: {} -nameOverride: "" -fullnameOverride: "" - # subcharts spire-server: enabled: true From 3fc81780d9f35d3082480387d1f1e1c2f3ff51d1 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 18 Apr 2023 08:28:28 +0200 Subject: [PATCH 06/32] Add k8s 1.27 to CI + bump other versions to latest patches (#219) - Add k8s 1.27 to test workflow - Bump other k8s versions to latest patch release --------- Signed-off-by: Marco Franssen --- .github/workflows/helm-chart-ci.yaml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index 179df3a..cffb15c 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -147,11 +147,12 @@ jobs: # Kubernetes, but can go back farther as long as we don't need heroics # to pull it off (i.e. kubectl version juggling). k8s: - - v1.26.0 - - v1.25.3 - - v1.24.7 - - v1.23.13 - - v1.22.15 + - v1.27.0 + - v1.26.3 + - v1.25.8 + - v1.24.12 + - v1.23.17 + - v1.22.17 - v1.21.14 values: - ${{ fromJson(needs.build-matrix.outputs.tests) }} @@ -181,7 +182,7 @@ jobs: uses: helm/kind-action@v1.5.0 # Only build a kind cluster if there are chart changes to test. with: - version: v0.17.0 + version: v0.18.0 node_image: kindest/node:${{ matrix.k8s }} config: .github/kind/conf/kind-config.yaml verbosity: 1 From 3cc8955429f491747a744b2950962a5356405524 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Mon, 17 Apr 2023 23:54:46 -0700 Subject: [PATCH 07/32] Move reusable macros to root chart (#218) This patch adds the start of a library to help reduce code duplication. It will be split out to its own library chart at the same time the other charts are split out. --------- Signed-off-by: Kevin Fox --- .../spiffe-csi-driver/templates/_helpers.tpl | 13 ------ .../templates/daemonset.yaml | 4 +- .../templates/_helpers.tpl | 35 --------------- .../templates/configmap.yaml | 4 +- .../templates/deployment.yaml | 6 +-- .../templates/tests/test-connection.yaml | 2 +- .../charts/spire-agent/templates/_helpers.tpl | 35 --------------- .../spire-agent/templates/configmap.yaml | 4 +- .../spire-agent/templates/daemonset.yaml | 6 +-- .../spire-server/templates/_helpers.tpl | 43 ------------------- .../templates/bundle-configmap.yaml | 2 +- .../spire-server/templates/configmap.yaml | 6 +-- .../controller-manager-configmap.yaml | 4 +- .../templates/post-install-hook.yaml | 2 +- .../templates/post-upgrade-hook.yaml | 2 +- .../templates/pre-upgrade-hook.yaml | 2 +- .../charts/spire-server/templates/roles.yaml | 2 +- .../spire-server/templates/statefulset.yaml | 4 +- .../templates/tests/test-connection.yaml | 2 +- charts/spire/templates/_spire-lib.tpl | 43 +++++++++++++++++++ 20 files changed, 69 insertions(+), 152 deletions(-) create mode 100644 charts/spire/templates/_spire-lib.tpl diff --git a/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl b/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl index 0680b9e..3df9f55 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl +++ b/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl @@ -72,19 +72,6 @@ Create the name of the service account to use {{- end }} {{- end }} - -{{- define "spiffe-csi-driver.image" -}} -{{- if eq (substr 0 7 .image.version) "sha256:" -}} -{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} -{{- else if .appVersion -}} -{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} -{{- else if .image.version -}} -{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} -{{- else -}} -{{- printf "%s/%s" .image.registry .image.repository -}} -{{- end -}} -{{- end }} - {{- define "spiffe-csi-driver.agent-socket-path" -}} {{- print .Values.agentSocketPath }} {{- end }} diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml index 59d1239..caa219f 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -31,7 +31,7 @@ spec: containers: # This is the container which runs the SPIFFE CSI driver. - name: {{ .Chart.Name }} - image: {{ template "spiffe-csi-driver.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: [ "-workload-api-socket-dir", "/spire-agent-socket", @@ -71,7 +71,7 @@ spec: # of all the little details required to register a CSI driver with # the kubelet. - name: node-driver-registrar - image: {{ template "spiffe-csi-driver.image" .Values.nodeDriverRegistrar }} + image: {{ template "spire-lib.image" .Values.nodeDriverRegistrar }} imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }} args: [ "-csi-address", "/spiffe-csi/csi.sock", diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl index 139e151..72b9077 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl @@ -82,42 +82,7 @@ Create the name of the service account to use {{- end }} {{- end }} -{{- define "spiffe-oidc-discovery-provider.image" -}} -{{- if eq (substr 0 7 .image.version) "sha256:" -}} -{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} -{{- else if .appVersion -}} -{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} -{{- else if .image.version -}} -{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} -{{- else -}} -{{- printf "%s/%s" .image.registry .image.repository -}} -{{- end -}} -{{- end }} - {{- define "spiffe-oidc-discovery-provider.workload-api-socket-path" -}} {{- printf "/spiffe-workload-api/%s" .Values.agentSocketName }} {{- end }} -{{- define "spiffe-oidc-discovery-provider.cluster-name" }} -{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }} -{{- .Values.global.spire.clusterName }} -{{- else }} -{{- .Values.clusterName }} -{{- end }} -{{- end }} - -{{- define "spiffe-oidc-discovery-provider.trust-domain" }} -{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }} -{{- .Values.global.spire.trustDomain }} -{{- else }} -{{- .Values.trustDomain }} -{{- end }} -{{- end }} - -{{- define "spiffe-oidc-discovery-provider.cluster-domain" }} -{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }} -{{- .Values.global.k8s.clusterDomain }} -{{- else }} -{{- .Values.clusterDomain }} -{{- end }} -{{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml index 6e03daf..e4df285 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml @@ -7,7 +7,7 @@ log_level: {{ .Values.config.logLevel | quote }} domains: - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}" - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}" - - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}" + - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}" {{- if gt (len .Values.config.domains) 0 }} {{- .Values.config.domains | toYaml | nindent 2 }} {{- end }} @@ -25,7 +25,7 @@ acme: workload_api: socket_path: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | quote }} - trust_domain: {{ include "spiffe-oidc-discovery-provider.trust-domain" . | quote }} + trust_domain: {{ include "spire-lib.trust-domain" . | quote }} health_checks: bind_port: "8008" diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml index 7516df6..f1af485 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -34,7 +34,7 @@ spec: - name: {{ .Chart.Name }} securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: {{ template "spiffe-oidc-discovery-provider.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: - -config @@ -75,7 +75,7 @@ spec: - name: nginx securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: {{ template "spiffe-oidc-discovery-provider.image" .Values.insecureScheme.nginx }} + image: {{ template "spire-lib.image" .Values.insecureScheme.nginx }} imagePullPolicy: {{ .Values.insecureScheme.nginx.image.pullPolicy }} ports: - containerPort: 8080 @@ -97,7 +97,7 @@ spec: - name: nginx-exporter securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: {{ template "spiffe-oidc-discovery-provider.image" .Values.telemetry.prometheus.nginxExporter }} + image: {{ template "spire-lib.image" .Values.telemetry.prometheus.nginxExporter }} imagePullPolicy: {{ .Values.telemetry.prometheus.nginxExporter.image.pullPolicy }} args: - -nginx.scrape-uri=http://127.0.0.1:8080/stub_status diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml index e687868..3f11d11 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml @@ -26,7 +26,7 @@ spec: - name: curl-service-name-namespace-svc-cluster-local image: cgr.dev/chainguard/bash:latest command: ['curl'] - args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration'] + args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration'] securityContext: {{- toYaml .Values.securityContext | nindent 8 }} {{- if .Values.ingress.enabled }} diff --git a/charts/spire/charts/spire-agent/templates/_helpers.tpl b/charts/spire/charts/spire-agent/templates/_helpers.tpl index ff43724..4fa7ee7 100644 --- a/charts/spire/charts/spire-agent/templates/_helpers.tpl +++ b/charts/spire/charts/spire-agent/templates/_helpers.tpl @@ -90,18 +90,6 @@ Create the name of the service account to use {{- end }} {{- end }} -{{- define "spire-agent.image" -}} -{{- if eq (substr 0 7 .image.version) "sha256:" -}} -{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} -{{- else if .appVersion -}} -{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} -{{- else if .image.version -}} -{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} -{{- else -}} -{{- printf "%s/%s" .image.registry .image.repository -}} -{{- end -}} -{{- end }} - {{- define "spire-agent.server-address" }} {{- if .Values.server.address }} {{- .Values.server.address }} @@ -114,26 +102,3 @@ Create the name of the service account to use {{- print .Values.socketPath }} {{- end }} -{{- define "spire-agent.cluster-name" }} -{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }} -{{- .Values.global.spire.clusterName }} -{{- else }} -{{- .Values.clusterName }} -{{- end }} -{{- end }} - -{{- define "spire-agent.trust-domain" }} -{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }} -{{- .Values.global.spire.trustDomain }} -{{- else }} -{{- .Values.trustDomain }} -{{- end }} -{{- end }} - -{{- define "spire-agent.bundle-configmap" }} -{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }} -{{- .Values.global.spire.bundleConfigMap }} -{{- else }} -{{- .Values.bundleConfigMap }} -{{- end }} -{{- end }} diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 15cbd3b..9f8d70d 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -6,13 +6,13 @@ agent: server_port: {{ .Values.server.port | quote }} socket_path: {{ include "spire-agent.socket-path" . | quote }} trust_bundle_path: "/run/spire/bundle/bundle.crt" - trust_domain: {{ include "spire-agent.trust-domain" . | quote }} + trust_domain: {{ include "spire-lib.trust-domain" . | quote }} plugins: NodeAttestor: - k8s_psat: plugin_data: - cluster: {{ include "spire-agent.cluster-name" . | quote }} + cluster: {{ include "spire-lib.cluster-name" . | quote }} KeyManager: - memory: diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 10c2603..5f76bee 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -38,7 +38,7 @@ spec: # This is a small image with wait-for-it, choose whatever image # you prefer that waits for a service to be up. This image is built # from https://github.com/vishnubob/wait-for-it - image: {{ template "spire-agent.image" .Values.waitForIt }} + image: {{ template "spire-lib.image" .Values.waitForIt }} imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }} args: ["-t", "30", "-h", "{{ include "spire-agent.server-address" . | trim }}", "-p", {{ .Values.server.port | quote }}] resources: @@ -48,7 +48,7 @@ spec: {{- end }} containers: - name: {{ .Chart.Name }} - image: {{ template "spire-agent.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: ["-config", "/run/spire/config/agent.conf"] ports: @@ -100,7 +100,7 @@ spec: name: {{ include "spire-agent.fullname" . }} - name: spire-bundle configMap: - name: {{ include "spire-agent.bundle-configmap" . }} + name: {{ include "spire-lib.bundle-configmap" . }} - name: spire-token projected: sources: diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index 809aeb3..952d606 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -82,18 +82,6 @@ Create the name of the service account to use {{- end }} {{- end }} -{{- define "spire-server.image" -}} -{{- if eq (substr 0 7 .image.version) "sha256:" -}} -{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} -{{- else if .appVersion -}} -{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} -{{- else if .image.version -}} -{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} -{{- else -}} -{{- printf "%s/%s" .image.registry .image.repository -}} -{{- end -}} -{{- end }} - {{- define "spire-server.upstream-ca-secret" -}} {{- $root := . }} {{- with .Values.upstreamAuthority.disk -}} @@ -117,34 +105,3 @@ Create the name of the service account to use {{- end }} {{- end }} -{{- define "spire-server.cluster-name" }} -{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }} -{{- .Values.global.spire.clusterName }} -{{- else }} -{{- .Values.clusterName }} -{{- end }} -{{- end }} - -{{- define "spire-server.trust-domain" }} -{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }} -{{- .Values.global.spire.trustDomain }} -{{- else }} -{{- .Values.trustDomain }} -{{- end }} -{{- end }} - -{{- define "spire-server.bundle-configmap" }} -{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }} -{{- .Values.global.spire.bundleConfigMap }} -{{- else }} -{{- .Values.bundleConfigMap }} -{{- end }} -{{- end }} - -{{- define "spire-server.cluster-domain" -}} -{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }} -{{- .Values.global.k8s.clusterDomain }} -{{- else }} -{{- .Values.clusterDomain }} -{{- end }} -{{- end }} diff --git a/charts/spire/charts/spire-server/templates/bundle-configmap.yaml b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml index bbc2fb5..ea4224e 100644 --- a/charts/spire/charts/spire-server/templates/bundle-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml @@ -2,5 +2,5 @@ apiVersion: v1 kind: ConfigMap metadata: - name: {{ include "spire-server.bundle-configmap" . }} + name: {{ include "spire-lib.bundle-configmap" . }} namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }} diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 11e8a66..11dc84e 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -3,7 +3,7 @@ server: bind_address: "0.0.0.0" bind_port: "8081" - trust_domain: {{ include "spire-server.trust-domain" . | quote }} + trust_domain: {{ include "spire-lib.trust-domain" . | quote }} data_dir: "/run/spire/data" log_level: {{ .Values.logLevel | quote }} jwt_issuer: {{ .Values.jwtIssuer | quote }} @@ -42,7 +42,7 @@ plugins: - k8s_psat: plugin_data: clusters: - {{ include "spire-server.cluster-name" $root }}: + {{ include "spire-lib.cluster-name" $root }}: service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }} {{- end }} {{- end }} @@ -56,7 +56,7 @@ plugins: - k8sbundle: plugin_data: namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }} - config_map: {{ include "spire-server.bundle-configmap" . | quote }} + config_map: {{ include "spire-lib.bundle-configmap" . | quote }} {{- with .Values.upstreamAuthority.disk }} {{- if eq (.enabled | toString) "true" }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml index 0509a56..333a070 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -22,8 +22,8 @@ data: resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io resourceNamespace: {{ include "spire-server.namespace" . }} validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook - clusterName: {{ include "spire-server.cluster-name" . }} - trustDomain: {{ include "spire-server.trust-domain" . }} + clusterName: {{ include "spire-lib.cluster-name" . }} + trustDomain: {{ include "spire-lib.trust-domain" . }} ignoreNamespaces: {{- with .Values.controllerManager.ignoreNamespaces }} {{- toYaml . | nindent 6 }} diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml index 1279198..53d2e3f 100644 --- a/charts/spire/charts/spire-server/templates/post-install-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml @@ -63,7 +63,7 @@ spec: - name: post-install-job securityContext: {{- toYaml .Values.securityContext | nindent 10 }} - image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }} command: - /bin/sh - -c diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml index db0129a..b28bdc2 100644 --- a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml @@ -63,7 +63,7 @@ spec: - name: post-upgrade-job securityContext: {{- toYaml .Values.securityContext | nindent 10 }} - image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }} command: - /bin/sh - -c diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml index e07f9d9..2639632 100644 --- a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml @@ -63,7 +63,7 @@ spec: - name: post-install-job securityContext: {{- toYaml .Values.securityContext | nindent 10 }} - image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }} command: - /bin/sh - -c diff --git a/charts/spire/charts/spire-server/templates/roles.yaml b/charts/spire/charts/spire-server/templates/roles.yaml index 7bd8b1c..f1bf0fa 100644 --- a/charts/spire/charts/spire-server/templates/roles.yaml +++ b/charts/spire/charts/spire-server/templates/roles.yaml @@ -8,7 +8,7 @@ metadata: rules: - apiGroups: [""] resources: [configmaps] - resourceNames: [{{ include "spire-server.bundle-configmap" . }}] + resourceNames: [{{ include "spire-lib.bundle-configmap" . }}] verbs: - get - patch diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 2773bf6..114307c 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -43,7 +43,7 @@ spec: - name: {{ .Chart.Name }} securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: - -config @@ -108,7 +108,7 @@ spec: - name: spire-controller-manager securityContext: {{- toYaml .Values.controllerManager.securityContext | nindent 12 }} - image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image) }} imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }} args: - --config=controller-manager-config.yaml diff --git a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml index ce49605..7674197 100644 --- a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml @@ -33,7 +33,7 @@ spec: - name: curl-federation-bundle-endpoint image: cgr.dev/chainguard/bash:latest command: ['curl'] - args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-server.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}'] + args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}'] securityContext: {{- toYaml .Values.securityContext | nindent 8 }} {{- end }} diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/templates/_spire-lib.tpl new file mode 100644 index 0000000..379aed5 --- /dev/null +++ b/charts/spire/templates/_spire-lib.tpl @@ -0,0 +1,43 @@ +{{- define "spire-lib.cluster-name" }} +{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }} +{{- .Values.global.spire.clusterName }} +{{- else }} +{{- .Values.clusterName }} +{{- end }} +{{- end }} + +{{- define "spire-lib.trust-domain" }} +{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }} +{{- .Values.global.spire.trustDomain }} +{{- else }} +{{- .Values.trustDomain }} +{{- end }} +{{- end }} + +{{- define "spire-lib.bundle-configmap" }} +{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }} +{{- .Values.global.spire.bundleConfigMap }} +{{- else }} +{{- .Values.bundleConfigMap }} +{{- end }} +{{- end }} + +{{- define "spire-lib.cluster-domain" -}} +{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }} +{{- .Values.global.k8s.clusterDomain }} +{{- else }} +{{- .Values.clusterDomain }} +{{- end }} +{{- end }} + +{{- define "spire-lib.image" -}} +{{- if eq (substr 0 7 .image.version) "sha256:" -}} +{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} +{{- else if .appVersion -}} +{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} +{{- else if .image.version -}} +{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} +{{- else -}} +{{- printf "%s/%s" .image.registry .image.repository -}} +{{- end -}} +{{- end }} From 2c360a50fd6641633dd7ced7f9f20d97b9482d05 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 20 Apr 2023 11:08:14 -0700 Subject: [PATCH 08/32] Add global for image registry (#201) This patch enables a user to override all image registry settings all at once to point to their own registry to enable easy custom mirrors. partially implements: https://github.com/spiffe/helm-charts/issues/139 --------- Signed-off-by: Kevin Fox Co-authored-by: Marco Franssen --- charts/spire/README.md | 1 + .../spiffe-csi-driver/templates/daemonset.yaml | 4 ++-- .../templates/deployment.yaml | 6 +++--- .../charts/spire-agent/templates/daemonset.yaml | 4 ++-- .../templates/post-install-hook.yaml | 2 +- .../templates/post-upgrade-hook.yaml | 2 +- .../templates/pre-upgrade-hook.yaml | 2 +- .../spire-server/templates/statefulset.yaml | 4 ++-- charts/spire/templates/_spire-lib.tpl | 17 +++++++++++++---- charts/spire/values.yaml | 4 ++++ 10 files changed, 30 insertions(+), 16 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index c8c24ca..8c7cddf 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -111,6 +111,7 @@ Kubernetes: `>=1.21.0-0` | global.k8s.clusterDomain | string | `"cluster.local"` | | | global.spire.bundleConfigMap | string | `""` | Override all instances of bundleConfigMap | | global.spire.clusterName | string | `"example-cluster"` | Set the name of the Kubernetes cluster | +| global.spire.image.registry | string | `""` | Override all Spire image registries at once | | global.spire.trustDomain | string | `"example.org"` | Set the trust domain to use for the spiffe identifiers | | spiffe-csi-driver.enabled | bool | `true` | | | spiffe-oidc-discovery-provider.enabled | bool | `false` | | diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml index caa219f..c926a0e 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -31,7 +31,7 @@ spec: containers: # This is the container which runs the SPIFFE CSI driver. - name: {{ .Chart.Name }} - image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: [ "-workload-api-socket-dir", "/spire-agent-socket", @@ -71,7 +71,7 @@ spec: # of all the little details required to register a CSI driver with # the kubelet. - name: node-driver-registrar - image: {{ template "spire-lib.image" .Values.nodeDriverRegistrar }} + image: {{ template "spire-lib.image" (dict "image" .Values.nodeDriverRegistrar.image "global" .Values.global) }} imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }} args: [ "-csi-address", "/spiffe-csi/csi.sock", diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml index f1af485..d180466 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -34,7 +34,7 @@ spec: - name: {{ .Chart.Name }} securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: - -config @@ -75,7 +75,7 @@ spec: - name: nginx securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: {{ template "spire-lib.image" .Values.insecureScheme.nginx }} + image: {{ template "spire-lib.image" (dict "image" .Values.insecureScheme.nginx.image "global" .Values.global) }} imagePullPolicy: {{ .Values.insecureScheme.nginx.image.pullPolicy }} ports: - containerPort: 8080 @@ -97,7 +97,7 @@ spec: - name: nginx-exporter securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: {{ template "spire-lib.image" .Values.telemetry.prometheus.nginxExporter }} + image: {{ template "spire-lib.image" (dict "image" .Values.telemetry.prometheus.nginxExporter.image "global" .Values.global) }} imagePullPolicy: {{ .Values.telemetry.prometheus.nginxExporter.image.pullPolicy }} args: - -nginx.scrape-uri=http://127.0.0.1:8080/stub_status diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 5f76bee..19e9437 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -38,7 +38,7 @@ spec: # This is a small image with wait-for-it, choose whatever image # you prefer that waits for a service to be up. This image is built # from https://github.com/vishnubob/wait-for-it - image: {{ template "spire-lib.image" .Values.waitForIt }} + image: {{ template "spire-lib.image" (dict "image" .Values.waitForIt.image "global" .Values.global) }} imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }} args: ["-t", "30", "-h", "{{ include "spire-agent.server-address" . | trim }}", "-p", {{ .Values.server.port | quote }}] resources: @@ -48,7 +48,7 @@ spec: {{- end }} containers: - name: {{ .Chart.Name }} - image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: ["-config", "/run/spire/config/agent.conf"] ports: diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml index 53d2e3f..37fd2a8 100644 --- a/charts/spire/charts/spire-server/templates/post-install-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml @@ -63,7 +63,7 @@ spec: - name: post-install-job securityContext: {{- toYaml .Values.securityContext | nindent 10 }} - image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }} command: - /bin/sh - -c diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml index b28bdc2..f73e9f2 100644 --- a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml @@ -63,7 +63,7 @@ spec: - name: post-upgrade-job securityContext: {{- toYaml .Values.securityContext | nindent 10 }} - image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }} command: - /bin/sh - -c diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml index 2639632..d2445bc 100644 --- a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml @@ -63,7 +63,7 @@ spec: - name: post-install-job securityContext: {{- toYaml .Values.securityContext | nindent 10 }} - image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }} command: - /bin/sh - -c diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 114307c..2ca1676 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -43,7 +43,7 @@ spec: - name: {{ .Chart.Name }} securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: - -config @@ -108,7 +108,7 @@ spec: - name: spire-controller-manager securityContext: {{- toYaml .Values.controllerManager.securityContext | nindent 12 }} - image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image "global" .Values.global) }} imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }} args: - --config=controller-manager-config.yaml diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/templates/_spire-lib.tpl index 379aed5..4c0c492 100644 --- a/charts/spire/templates/_spire-lib.tpl +++ b/charts/spire/templates/_spire-lib.tpl @@ -30,14 +30,23 @@ {{- end }} {{- end }} +{{- define "spire-lib.registry" }} +{{- if ne (len (dig "spire" "image" "registry" "" .global)) 0 }} +{{- .global.spire.image.registry }} +{{- else }} +{{- .image.registry }} +{{- end }} +{{- end }} + {{- define "spire-lib.image" -}} +{{- $registry := include "spire-lib.registry" . }} {{- if eq (substr 0 7 .image.version) "sha256:" -}} -{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} +{{- printf "%s/%s@%s" $registry .image.repository .image.version -}} {{- else if .appVersion -}} -{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} +{{- printf "%s/%s:%s" $registry .image.repository (default .appVersion .image.version) -}} {{- else if .image.version -}} -{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} +{{- printf "%s/%s:%s" $registry .image.repository .image.version -}} {{- else -}} -{{- printf "%s/%s" .image.registry .image.repository -}} +{{- printf "%s/%s" $registry .image.repository -}} {{- end -}} {{- end }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 7c028d7..d1978d0 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -11,6 +11,10 @@ global: # -- Override all instances of bundleConfigMap bundleConfigMap: "" + image: + # -- Override all Spire image registries at once + registry: "" + # telemetry: # prometheus: # enabled: true From 17d62f1246130ae8c811916c98d44ab65c526ae0 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Tue, 25 Apr 2023 01:04:38 -0700 Subject: [PATCH 09/32] Add an action to find new versions of helm charts (#184) Co-authored-by: Marco Franssen --- .github/tests/charts.json | 17 +++++++ .github/tests/charts.sh | 6 +++ .github/tests/prometheus/pre-install.sh | 2 +- .../tests/spire-oidc-insecure/pre-install.sh | 2 +- .../pre-install.sh | 2 +- .github/workflows/check-versions.yaml | 49 +++++++++++++++++++ .github/workflows/helm-chart-ci.yaml | 2 + .github/workflows/scripts/update-versions.sh | 24 +++++++++ 8 files changed, 101 insertions(+), 3 deletions(-) create mode 100644 .github/tests/charts.json create mode 100644 .github/tests/charts.sh create mode 100644 .github/workflows/check-versions.yaml create mode 100755 .github/workflows/scripts/update-versions.sh diff --git a/.github/tests/charts.json b/.github/tests/charts.json new file mode 100644 index 0000000..b9341a3 --- /dev/null +++ b/.github/tests/charts.json @@ -0,0 +1,17 @@ +[ + { + "name": "kube-prometheus-stack", + "repo": "https://prometheus-community.github.io/helm-charts", + "version": "45.10.1" + }, + { + "name": "cert-manager", + "repo": "https://charts.jetstack.io", + "version": "v1.11.1" + }, + { + "name": "ingress-nginx", + "repo": "https://kubernetes.github.io/ingress-nginx", + "version": "4.6.0" + } +] diff --git a/.github/tests/charts.sh b/.github/tests/charts.sh new file mode 100644 index 0000000..d83af09 --- /dev/null +++ b/.github/tests/charts.sh @@ -0,0 +1,6 @@ +#!/usr/bin/env bash + +REPOS=$(jq -r '.[] | "export " + ("HELM_REPO_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .repo' .github/tests/charts.json) +VERSIONS=$(jq -r '.[] | "export " + ("VERSION_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .version' .github/tests/charts.json) +eval "$REPOS" +eval "$VERSIONS" diff --git a/.github/tests/prometheus/pre-install.sh b/.github/tests/prometheus/pre-install.sh index 5959a16..de23418 100755 --- a/.github/tests/prometheus/pre-install.sh +++ b/.github/tests/prometheus/pre-install.sh @@ -1,3 +1,3 @@ #!/usr/bin/env bash -helm install kube-prometheus-stack kube-prometheus-stack --version 45.7.1 --repo https://prometheus-community.github.io/helm-charts -n "$scenario" --wait +helm install kube-prometheus-stack kube-prometheus-stack --version $VERSION_KUBE_PROMETHEUS_STACK --repo $HELM_REPO_KUBE_PROMETHEUS_STACK -n "$scenario" --wait diff --git a/.github/tests/spire-oidc-insecure/pre-install.sh b/.github/tests/spire-oidc-insecure/pre-install.sh index 939b1d8..6d39ad2 100755 --- a/.github/tests/spire-oidc-insecure/pre-install.sh +++ b/.github/tests/spire-oidc-insecure/pre-install.sh @@ -1,4 +1,4 @@ #!/usr/bin/env bash -helm install ingress-nginx ingress-nginx --version 4.5.2 --repo https://kubernetes.github.io/ingress-nginx -n "$scenario" --set controller.extraArgs.enable-ssl-passthrough= +helm install ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" -n "$scenario" --set controller.extraArgs.enable-ssl-passthrough= kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller -n "$scenario" diff --git a/.github/tests/upstream-authority-cert-manager/pre-install.sh b/.github/tests/upstream-authority-cert-manager/pre-install.sh index 8b5733f..9cf3ea5 100755 --- a/.github/tests/upstream-authority-cert-manager/pre-install.sh +++ b/.github/tests/upstream-authority-cert-manager/pre-install.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -helm install cert-manager cert-manager --namespace cert-manager --create-namespace --version v1.11.0 --set installCRDs=true --repo https://charts.jetstack.io --wait +helm install cert-manager cert-manager --namespace cert-manager --create-namespace --version "$VERSION_CERT_MANAGER" --set installCRDs=true --repo "$HELM_REPO_CERT_MANAGER" --wait SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) kubectl apply -f $SCRIPT_DIR/cert-manager-ca.yaml -n "$scenario" diff --git a/.github/workflows/check-versions.yaml b/.github/workflows/check-versions.yaml new file mode 100644 index 0000000..85cd437 --- /dev/null +++ b/.github/workflows/check-versions.yaml @@ -0,0 +1,49 @@ +name: Check versions + +on: + schedule: + - cron: '0 8 * * 1' + + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + +env: + HELM_VERSION: v3.11.1 + +jobs: + check-helm-chart-versions: + runs-on: ubuntu-22.04 + + permissions: + contents: write + pull-requests: write + + steps: + - name: Checkout + uses: actions/checkout@v3.5.0 + + - name: Set up Helm + uses: azure/setup-helm@v3.5 + with: + version: ${{ env.HELM_VERSION }} + + - name: Update test chart versions + run: | + ./.github/workflows/scripts/update-versions.sh + git diff + + - name: Create Pull Request + id: cpr + uses: peter-evans/create-pull-request@v5.0.0 + with: + title: Bump test chart dependencies + branch: bump-test-chart-deps + commit-message: Bump test chart dependencies + body: Bump the Helm charts used in test scenarios to latest available versions. + signoff: true + add-paths: | + .github/tests + + - name: Check outputs + if: ${{ steps.cpr.outputs.pull-request-number }} + run: 'echo "::notice title=PR #${{ steps.cpr.outputs.pull-request-number }}::${{ steps.cpr.outputs.pull-request-url }}"' diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index cffb15c..4ac7bb0 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -199,6 +199,8 @@ jobs: export scenario="$(basename "${TEST_DIR}")" export EXTRA_HELM_ARGS="" + source .github/tests/charts.sh + [ "${scenario}" != "default" ] && kubectl create namespace "${scenario}" [ -x "${TEST_DIR}/pre-install.sh" ] && "${TEST_DIR}/pre-install.sh" [ -f "${TEST_DIR}/.env" ] && source "${TEST_DIR}/.env" diff --git a/.github/workflows/scripts/update-versions.sh b/.github/workflows/scripts/update-versions.sh new file mode 100755 index 0000000..46b438e --- /dev/null +++ b/.github/workflows/scripts/update-versions.sh @@ -0,0 +1,24 @@ +#!/usr/bin/env bash + +SCRIPT=$(readlink -f "$0") +SCRIPTPATH=$(dirname "$SCRIPT") + +CHARTJSON=$SCRIPTPATH/../../tests/charts.json + +jq -r ".[].name" "${CHARTJSON}" | while read -r CHART; do + ENTRYQUERY='.[] | select(.name == "'$CHART'")' + REPO_URL="$(jq -r "$ENTRYQUERY | .repo" "${CHARTJSON}")" + VERSION="$(jq -r "$ENTRYQUERY | .version" "${CHARTJSON}")" + echo Processing: ${CHART} + echo " repo: $REPO_URL" + echo " current version: $VERSION" + helm repo add "$CHART" "$REPO_URL" > /dev/null + helm repo update "$CHART" > /dev/null + LATEST_VERSION=$(helm search repo --regexp "$CHART/$CHART\v" -o json | jq -r '.[0].version') + echo " latest version: $LATEST_VERSION" + if [ "x$VERSION" != "x$LATEST_VERSION" ]; then + echo " New version found!" + jq "( $ENTRYQUERY ).version |= "'"${LATEST_VERSION}"' "${CHARTJSON}" > /tmp/$$ + mv /tmp/$$ "${CHARTJSON}" + fi +done From 247e3e5d315ae277e67d434361c68bf1690dd674 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 26 Apr 2023 01:03:32 +0000 Subject: [PATCH 10/32] Bump sigstore/cosign-installer from 3.0.2 to 3.0.3 Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.0.2 to 3.0.3. - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](https://github.com/sigstore/cosign-installer/compare/v3.0.2...v3.0.3) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/helm-release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml index 5f0300c..594e68e 100644 --- a/.github/workflows/helm-release.yaml +++ b/.github/workflows/helm-release.yaml @@ -29,7 +29,7 @@ jobs: git config user.email "$GITHUB_ACTOR@users.noreply.github.com" - name: Setup cosign - uses: sigstore/cosign-installer@v3.0.2 + uses: sigstore/cosign-installer@v3.0.3 with: cosign-release: v2.0.1 From 252f1f5a1938f888103f42a464ecd3f3d581eb47 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Wed, 26 Apr 2023 10:20:20 +0200 Subject: [PATCH 11/32] Bump cosign to v2.0.2 Signed-off-by: Marco Franssen --- .github/workflows/helm-release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml index 594e68e..357d965 100644 --- a/.github/workflows/helm-release.yaml +++ b/.github/workflows/helm-release.yaml @@ -31,7 +31,7 @@ jobs: - name: Setup cosign uses: sigstore/cosign-installer@v3.0.3 with: - cosign-release: v2.0.1 + cosign-release: v2.0.2 - name: Set up Helm uses: azure/setup-helm@v3.5 From d0a1e12825a25c2db49873ea79a072def2b20f71 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Wed, 26 Apr 2023 11:41:12 +0200 Subject: [PATCH 12/32] Add workflow with shellcheck Signed-off-by: Marco Franssen --- .github/workflows/shellcheck.yaml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 .github/workflows/shellcheck.yaml diff --git a/.github/workflows/shellcheck.yaml b/.github/workflows/shellcheck.yaml new file mode 100644 index 0000000..1bed14c --- /dev/null +++ b/.github/workflows/shellcheck.yaml @@ -0,0 +1,30 @@ +name: Shellcheck + +on: + workflow_dispatch: + pull_request: + types: [synchronize, opened, reopened, edited] + paths: + - .github/workflows/shellcheck.yaml + - '**/*.sh' + +concurrency: + group: ${{ github.ref }}-shellcheck + cancel-in-progress: true + +env: + SHELLCHECK_VERSION: v0.9.0 + +jobs: + checks: + runs-on: ubuntu-22.04 + + steps: + - name: Checkout + uses: actions/checkout@v3.5.2 + + - name: Run Shellcheck + uses: ludeeus/action-shellcheck@2.0.0 + with: + format: gcc + version: ${{ env.SHELLCHECK_VERSION }} From 99af475f1c62aa35168a3d04ef7ed287875169df Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Wed, 26 Apr 2023 11:51:31 +0200 Subject: [PATCH 13/32] Resolve shellcheck issues Signed-off-by: Marco Franssen --- .../tests/namespace-override/post-install.sh | 9 ++-- .../tests/namespace-override/pre-install.sh | 3 +- .../tests/production-example/post-install.sh | 24 ++++++---- .github/tests/prometheus/pre-install.sh | 6 ++- .../tests/spire-oidc-insecure/pre-install.sh | 6 ++- .../pre-install.sh | 6 ++- .github/workflows/scripts/update-versions.sh | 22 +++++----- helm-docs.sh | 44 +++++++++---------- 8 files changed, 70 insertions(+), 50 deletions(-) diff --git a/.github/tests/namespace-override/post-install.sh b/.github/tests/namespace-override/post-install.sh index c565da6..09feb6b 100755 --- a/.github/tests/namespace-override/post-install.sh +++ b/.github/tests/namespace-override/post-install.sh @@ -3,7 +3,8 @@ set -x SCRIPT=$(readlink -f "$0") -SCRIPTPATH=$(dirname "$SCRIPT") +SCRIPTPATH=$(dirname "${SCRIPT}") +scenario="${scenario:-$(basename "${SCRIPTPATH}")}" k_wait () { kubectl wait --for condition=available --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1 @@ -30,7 +31,7 @@ cat <>"$GITHUB_STEP_SUMMARY" | spire-spiffe-oidc-discovery-provider | 
$(k_wait spire-server deployments.apps "${RELEASE}-spiffe-oidc-discovery-provider")
| EOF -if [ $1 -ne 0 ]; then +if [[ "$1" -ne 0 ]]; then echo echo '```' echo '==> Events of namespace spire-server' @@ -53,8 +54,8 @@ if [ $1 -ne 0 ]; then echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-system' kubectl --request-timeout=30s describe pods --namespace spire-system echo '========================================================================================================================' - kubectl get pods -o name -n spire-server | while read line; do echo logs for $line; kubectl logs -n spire-server $line --all-containers=true --ignore-errors=true; done - kubectl get pods -o name -n spire-system | while read line; do echo logs for $line; kubectl logs -n spire-system $line --all-containers=true --ignore-errors=true; done + kubectl get pods -o name -n spire-server | while read -r line; do echo logs for "${line}"; kubectl logs -n spire-server "${line}"--all-containers=true --ignore-errors=true; done + kubectl get pods -o name -n spire-system | while read -r line; do echo logs for "${line}"; kubectl logs -n spire-system "${line}" --all-containers=true --ignore-errors=true; done echo '========================================================================================================================' echo '```' fi | cat >> "$GITHUB_STEP_SUMMARY" diff --git a/.github/tests/namespace-override/pre-install.sh b/.github/tests/namespace-override/pre-install.sh index 91bd6f0..3d778a6 100755 --- a/.github/tests/namespace-override/pre-install.sh +++ b/.github/tests/namespace-override/pre-install.sh @@ -1,3 +1,4 @@ -#!/bin/bash +#!/usr/bin/env bash + kubectl create namespace "spire-system" kubectl create namespace "spire-server" diff --git a/.github/tests/production-example/post-install.sh b/.github/tests/production-example/post-install.sh index ee0963e..1f78c43 100755 --- a/.github/tests/production-example/post-install.sh +++ b/.github/tests/production-example/post-install.sh @@ -3,10 +3,16 @@ set -x SCRIPT=$(readlink -f "$0") -SCRIPTPATH=$(dirname "$SCRIPT") +SCRIPTPATH=$(dirname "${SCRIPT}") +scenario="${scenario:-$(basename "${SCRIPTPATH}")}" -k_wait=(kubectl wait --for condition=available --timeout 30s --namespace) -k_rollout_status=(kubectl rollout status --watch --timeout 30s --namespace) +k_wait () { + kubectl wait --for condition=available --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1 +} + +k_rollout_status () { + kubectl rollout status --watch --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1 +} function get_namespace_details { cat <>"$GITHUB_STEP_SUMMARY" @@ -38,14 +44,14 @@ cat <>"$GITHUB_STEP_SUMMARY" | workload | Status | | ------------------------------------ | ------ | -| spire-server | "$("${k_rollout_status[@]}" spire-server statefulset spire-server)" | -| spire-controller-manager | "$("${k_rollout_status[@]}" spire-server statefulset spire-controller-manager)" | -| spire-spiffe-oidc-discovery-provider | "$("${k_wait[@]}" spire-server deployments.apps spire-spiffe-oidc-discovery-provider)" | -| spire-spiffe-csi-driver | "$("${k_rollout_status[@]}" spire-system daemonset spire-spiffe-csi-driver)" | -| spire-agent | "$("${k_rollout_status[@]}" spire-system daemonset spire-agent)" | +| spire-server | "$(k_rollout_status spire-server statefulset spire-server)" | +| spire-controller-manager | "$(k_rollout_status spire-server statefulset spire-controller-manager)" | +| spire-spiffe-oidc-discovery-provider | "$(k_wait spire-server deployments.apps spire-spiffe-oidc-discovery-provider)" | +| spire-spiffe-csi-driver | "$(k_rollout_status spire-system daemonset spire-spiffe-csi-driver)" | +| spire-agent | "$(k_rollout_status spire-system daemonset spire-agent)" | EOF -if [ $1 -ne 0 ]; then +if [[ "$1" -ne 0 ]]; then get_namespace_details spire-server get_namespace_details spire-systen fi diff --git a/.github/tests/prometheus/pre-install.sh b/.github/tests/prometheus/pre-install.sh index de23418..9057040 100755 --- a/.github/tests/prometheus/pre-install.sh +++ b/.github/tests/prometheus/pre-install.sh @@ -1,3 +1,7 @@ #!/usr/bin/env bash -helm install kube-prometheus-stack kube-prometheus-stack --version $VERSION_KUBE_PROMETHEUS_STACK --repo $HELM_REPO_KUBE_PROMETHEUS_STACK -n "$scenario" --wait +SCRIPT=$(readlink -f "$0") +SCRIPTPATH=$(dirname "${SCRIPT}") +scenario="${scenario:-$(basename "${SCRIPTPATH}")}" + +helm install kube-prometheus-stack kube-prometheus-stack --version "${VERSION_KUBE_PROMETHEUS_STACK}" --repo "${HELM_REPO_KUBE_PROMETHEUS_STACK}" -n "${scenario}" --wait diff --git a/.github/tests/spire-oidc-insecure/pre-install.sh b/.github/tests/spire-oidc-insecure/pre-install.sh index 6d39ad2..2433e0e 100755 --- a/.github/tests/spire-oidc-insecure/pre-install.sh +++ b/.github/tests/spire-oidc-insecure/pre-install.sh @@ -1,4 +1,8 @@ #!/usr/bin/env bash -helm install ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" -n "$scenario" --set controller.extraArgs.enable-ssl-passthrough= +SCRIPT=$(readlink -f "$0") +SCRIPTPATH=$(dirname "${SCRIPT}") +scenario="${scenario:-$(basename "${SCRIPTPATH}")}" + +helm install ingress-nginx ingress-nginx --version "${VERSION_INGRESS_NGINX}" --repo "${HELM_REPO_INGRESS_NGINX}" -n "$scenario" --set controller.extraArgs.enable-ssl-passthrough= kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller -n "$scenario" diff --git a/.github/tests/upstream-authority-cert-manager/pre-install.sh b/.github/tests/upstream-authority-cert-manager/pre-install.sh index 9cf3ea5..1e1f8b2 100755 --- a/.github/tests/upstream-authority-cert-manager/pre-install.sh +++ b/.github/tests/upstream-authority-cert-manager/pre-install.sh @@ -1,5 +1,9 @@ #!/usr/bin/env bash +SCRIPT=$(readlink -f "$0") +SCRIPTPATH=$(dirname "${SCRIPT}") +scenario="${scenario:-$(basename "${SCRIPTPATH}")}" + helm install cert-manager cert-manager --namespace cert-manager --create-namespace --version "$VERSION_CERT_MANAGER" --set installCRDs=true --repo "$HELM_REPO_CERT_MANAGER" --wait SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) -kubectl apply -f $SCRIPT_DIR/cert-manager-ca.yaml -n "$scenario" +kubectl apply -f "${SCRIPT_DIR}/cert-manager-ca.yaml" -n "$scenario" diff --git a/.github/workflows/scripts/update-versions.sh b/.github/workflows/scripts/update-versions.sh index 46b438e..71a2fb0 100755 --- a/.github/workflows/scripts/update-versions.sh +++ b/.github/workflows/scripts/update-versions.sh @@ -1,24 +1,24 @@ #!/usr/bin/env bash SCRIPT=$(readlink -f "$0") -SCRIPTPATH=$(dirname "$SCRIPT") +SCRIPTPATH=$(dirname "${SCRIPT}") -CHARTJSON=$SCRIPTPATH/../../tests/charts.json +CHARTJSON="${SCRIPTPATH}/../../tests/charts.json" jq -r ".[].name" "${CHARTJSON}" | while read -r CHART; do ENTRYQUERY='.[] | select(.name == "'$CHART'")' REPO_URL="$(jq -r "$ENTRYQUERY | .repo" "${CHARTJSON}")" VERSION="$(jq -r "$ENTRYQUERY | .version" "${CHARTJSON}")" - echo Processing: ${CHART} - echo " repo: $REPO_URL" - echo " current version: $VERSION" - helm repo add "$CHART" "$REPO_URL" > /dev/null - helm repo update "$CHART" > /dev/null - LATEST_VERSION=$(helm search repo --regexp "$CHART/$CHART\v" -o json | jq -r '.[0].version') - echo " latest version: $LATEST_VERSION" - if [ "x$VERSION" != "x$LATEST_VERSION" ]; then + echo Processing: "${CHART}" + echo " repo: ${REPO_URL}" + echo " current version: ${VERSION}" + helm repo add "${CHART}" "${REPO_URL}" > /dev/null + helm repo update "${CHART}" > /dev/null + LATEST_VERSION=$(helm search repo --regexp "${CHART}/${CHART}\v" -o json | jq -r '.[0].version') + echo " latest version: ${LATEST_VERSION}" + if [ "x${VERSION}" != "x${LATEST_VERSION}" ]; then echo " New version found!" - jq "( $ENTRYQUERY ).version |= "'"${LATEST_VERSION}"' "${CHARTJSON}" > /tmp/$$ + jq "(${ENTRYQUERY}).version |= "'"${LATEST_VERSION}"' "${CHARTJSON}" > /tmp/$$ mv /tmp/$$ "${CHARTJSON}" fi done diff --git a/helm-docs.sh b/helm-docs.sh index d77d15c..a41b43f 100755 --- a/helm-docs.sh +++ b/helm-docs.sh @@ -6,31 +6,31 @@ SCRIPTPATH=$(dirname "$0") HELM_DOCS_VERSION="1.11.0" case "$(uname -s)" in - Linux*) - machine=Linux - shasum=sha256sum - exe=helm-docs - ;; - Darwin*) - machine=Darwin - shasum=shasum - exe=helm-docs - ;; - MINGW64*) - machine=Windows - shasum=sha256sum - exe=helm-docs.exe - ;; + Linux*) + machine=Linux + shasum=sha256sum + exe=helm-docs + ;; + Darwin*) + machine=Darwin + shasum=shasum + exe=helm-docs + ;; + MINGW64*) + machine=Windows + shasum=sha256sum + exe=helm-docs.exe + ;; esac function install_helm_docs { - curl -LO https://github.com/norwoodj/helm-docs/releases/download/v"${HELM_DOCS_VERSION}"/helm-docs_"${HELM_DOCS_VERSION}"_${machine}_x86_64.tar.gz - curl -L --output /tmp/checksums_helm-docs.txt https://github.com/norwoodj/helm-docs/releases/download/v${HELM_DOCS_VERSION}/checksums.txt - grep helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz /tmp/checksums_helm-docs.txt | $shasum -c - - mkdir -p "$SCRIPTPATH/bin" - tar -xf helm-docs_"${HELM_DOCS_VERSION}"_${machine}_x86_64.tar.gz ${exe} - mv ${exe} "$SCRIPTPATH/bin/" - rm helm-docs_"${HELM_DOCS_VERSION}"_${machine}_x86_64.tar.gz + curl -LO "https://github.com/norwoodj/helm-docs/releases/download/v${HELM_DOCS_VERSION}/helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz" + curl -L --output /tmp/checksums_helm-docs.txt "https://github.com/norwoodj/helm-docs/releases/download/v${HELM_DOCS_VERSION}/checksums.txt" + grep "helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz" /tmp/checksums_helm-docs.txt | $shasum -c - + mkdir -p "$SCRIPTPATH/bin" + tar -xf "helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz" "${exe}" + mv "${exe}" "$SCRIPTPATH/bin/" + rm "helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz" } if [ ! -f "$SCRIPTPATH/bin/${exe}" ] ; then From 91083a6b4ea61571281b2917524f1cc5fc05db35 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Wed, 26 Apr 2023 16:17:29 +0200 Subject: [PATCH 14/32] Add post-install scripts to all tests to capture failure details in GitHub workflow summary (#88) --- .github/tests/common.sh | 69 +++++++++++++++++++ .github/tests/extras/post-install.sh | 17 +++++ .../post-install.sh | 17 +++++ .../tests/namespace-override/post-install.sh | 62 +++-------------- .../post-install.sh | 17 +++++ .github/tests/production-example/install.sh | 4 +- .../tests/production-example/post-install.sh | 53 ++------------ .github/tests/prometheus/post-install.sh | 17 +++++ .github/tests/prometheus/pre-install.sh | 10 ++- .../tests/spire-oidc-insecure/post-install.sh | 17 +++++ .../tests/spire-oidc-insecure/pre-install.sh | 4 +- .../post-install.sh | 17 +++++ .../pre-install.sh | 4 +- .../upstream-authority-disk/post-install.sh | 17 +++++ .github/workflows/scripts/update-versions.sh | 4 +- 15 files changed, 220 insertions(+), 109 deletions(-) create mode 100755 .github/tests/common.sh create mode 100644 .github/tests/extras/post-install.sh create mode 100644 .github/tests/federation-bundle-endpoint/post-install.sh create mode 100644 .github/tests/no-spire-controller-manager/post-install.sh create mode 100644 .github/tests/prometheus/post-install.sh create mode 100644 .github/tests/spire-oidc-insecure/post-install.sh create mode 100755 .github/tests/upstream-authority-cert-manager/post-install.sh create mode 100755 .github/tests/upstream-authority-disk/post-install.sh diff --git a/.github/tests/common.sh b/.github/tests/common.sh new file mode 100755 index 0000000..c550721 --- /dev/null +++ b/.github/tests/common.sh @@ -0,0 +1,69 @@ +#!/usr/bin/env bash + +get_namespace_details () { +cat <>"$GITHUB_STEP_SUMMARY" +### Namespace $1 + +#### Events + +\`\`\`shell +$(kubectl --request-timeout=30s get events --output wide --namespace "$1") +\`\`\` + +#### Pods + +\`\`\`shell +$(kubectl --request-timeout=30s describe pods --namespace "$1") +\`\`\` + +#### Logs + +\`\`\`shell +$(kubectl get pods -o name -n "$1" | while read -r line; do echo logs for "${line}"; kubectl logs -n "$1" "${line}" --all-containers=true --ignore-errors=true; done) +\`\`\` + +EOF +} + +k_wait () { + kubectl wait --for condition=available --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1 +} + +k_rollout_status () { + kubectl rollout status --watch --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1 +} + +get_spire_release_name () { + helm ls -A | grep '^spire' | awk '{print $1}' +} + +print_spire_workload_status () { + local ns1 + local ns2 + + ns1="$1" + ns2="${2:-$1}" + + release_name="$(get_spire_release_name)" + + cat <>"$GITHUB_STEP_SUMMARY" +### Spire + +| Namespace | Workload | Status | +| --------- | ---------------------------------------------- | ------ | +| ${ns1} | ${release_name}-server | 
$(k_rollout_status "${ns1}" statefulset "${release_name}-server")
| +| ${ns2} | ${release_name}-spiffe-csi-driver | 
$(k_rollout_status "${ns2}" daemonset "${release_name}-spiffe-csi-driver")
| +| ${ns2} | ${release_name}-agent | 
$(k_rollout_status "${ns2}" daemonset "${release_name}-agent")
| +| ${ns1} | ${release_name}-spiffe-oidc-discovery-provider | 
$(k_rollout_status "${ns1}" deployments.apps "${release_name}-spiffe-oidc-discovery-provider")
| + +EOF +} + +print_helm_releases () { + cat <>"$GITHUB_STEP_SUMMARY" +### Releases + +$(helm ls -A | sed 's/\t/ | /g' | sed 's/^/| /' | sed 's/$/ |/' | sed '/^| NAME.*/a| - | - | - | - | - | - | - |') + +EOF +} diff --git a/.github/tests/extras/post-install.sh b/.github/tests/extras/post-install.sh new file mode 100644 index 0000000..1278f29 --- /dev/null +++ b/.github/tests/extras/post-install.sh @@ -0,0 +1,17 @@ +#!/usr/bin/env bash + +set -x + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +scenario="${scenario:-$(basename "${SCRIPTPATH}")}" + +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../common.sh" + +print_helm_releases +print_spire_workload_status "${scenario}" + +if [[ "$1" -ne 0 ]]; then + get_namespace_details "${scenario}" +fi diff --git a/.github/tests/federation-bundle-endpoint/post-install.sh b/.github/tests/federation-bundle-endpoint/post-install.sh new file mode 100644 index 0000000..1278f29 --- /dev/null +++ b/.github/tests/federation-bundle-endpoint/post-install.sh @@ -0,0 +1,17 @@ +#!/usr/bin/env bash + +set -x + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +scenario="${scenario:-$(basename "${SCRIPTPATH}")}" + +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../common.sh" + +print_helm_releases +print_spire_workload_status "${scenario}" + +if [[ "$1" -ne 0 ]]; then + get_namespace_details "${scenario}" +fi diff --git a/.github/tests/namespace-override/post-install.sh b/.github/tests/namespace-override/post-install.sh index 09feb6b..7fbaf11 100755 --- a/.github/tests/namespace-override/post-install.sh +++ b/.github/tests/namespace-override/post-install.sh @@ -2,60 +2,18 @@ set -x -SCRIPT=$(readlink -f "$0") -SCRIPTPATH=$(dirname "${SCRIPT}") +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" scenario="${scenario:-$(basename "${SCRIPTPATH}")}" -k_wait () { - kubectl wait --for condition=available --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1 -} +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../common.sh" -k_rollout_status () { - kubectl rollout status --watch --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1 -} - -RELEASE=$(helm ls --no-headers -n "${scenario}" | awk '{print $1}' | grep 'spire-[^-]*$') - -cat <>"$GITHUB_STEP_SUMMARY" -### release -| release | -| ------- | -| $RELEASE | - -### spire -| workload | Status | -| -------- | ------ | -| spire-server | 
$(k_rollout_status spire-server statefulset "${RELEASE}-server")
| -| spire-spiffe-csi-driver | 
$(k_rollout_status spire-system daemonset "${RELEASE}-spiffe-csi-driver")
| -| spire-agent | 
$(k_rollout_status spire-system daemonset "${RELEASE}-agent")
| -| spire-spiffe-oidc-discovery-provider | 
$(k_wait spire-server deployments.apps "${RELEASE}-spiffe-oidc-discovery-provider")
| -EOF +print_helm_releases +print_spire_workload_status spire-server spire-system if [[ "$1" -ne 0 ]]; then - echo - echo '```' - echo '==> Events of namespace spire-server' - echo '........................................................................................................................' - echo '>>> kubectl --request-timeout=30s get events --output wide --namespace spire-server' - kubectl --request-timeout=30s get events --output wide --namespace spire-server - echo '........................................................................................................................' - echo '<== Events of namespace spire-server' - echo '........................................................................................................................' - echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-server' - kubectl --request-timeout=30s describe pods --namespace spire-server - echo '========================================================================================================================' - echo '==> Events of namespace spire-system' - echo '........................................................................................................................' - echo '>>> kubectl --request-timeout=30s get events --output wide --namespace spire-system' - kubectl --request-timeout=30s get events --output wide --namespace spire-system - echo '........................................................................................................................' - echo '<== Events of namespace spire-system' - echo '........................................................................................................................' - echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-system' - kubectl --request-timeout=30s describe pods --namespace spire-system - echo '========================================================================================================================' - kubectl get pods -o name -n spire-server | while read -r line; do echo logs for "${line}"; kubectl logs -n spire-server "${line}"--all-containers=true --ignore-errors=true; done - kubectl get pods -o name -n spire-system | while read -r line; do echo logs for "${line}"; kubectl logs -n spire-system "${line}" --all-containers=true --ignore-errors=true; done - echo '========================================================================================================================' - echo '```' -fi | cat >> "$GITHUB_STEP_SUMMARY" + get_namespace_details spire-server + get_namespace_details spire-systen +fi + diff --git a/.github/tests/no-spire-controller-manager/post-install.sh b/.github/tests/no-spire-controller-manager/post-install.sh new file mode 100644 index 0000000..1278f29 --- /dev/null +++ b/.github/tests/no-spire-controller-manager/post-install.sh @@ -0,0 +1,17 @@ +#!/usr/bin/env bash + +set -x + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +scenario="${scenario:-$(basename "${SCRIPTPATH}")}" + +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../common.sh" + +print_helm_releases +print_spire_workload_status "${scenario}" + +if [[ "$1" -ne 0 ]]; then + get_namespace_details "${scenario}" +fi diff --git a/.github/tests/production-example/install.sh b/.github/tests/production-example/install.sh index 442a97b..c2b5cfe 100755 --- a/.github/tests/production-example/install.sh +++ b/.github/tests/production-example/install.sh @@ -2,8 +2,8 @@ set -xe -SCRIPT=$(readlink -f "$0") -SCRIPTPATH=$(dirname "$SCRIPT") +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" helm install \ --namespace spire-server \ diff --git a/.github/tests/production-example/post-install.sh b/.github/tests/production-example/post-install.sh index 1f78c43..29335e6 100755 --- a/.github/tests/production-example/post-install.sh +++ b/.github/tests/production-example/post-install.sh @@ -2,56 +2,17 @@ set -x -SCRIPT=$(readlink -f "$0") -SCRIPTPATH=$(dirname "${SCRIPT}") +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" scenario="${scenario:-$(basename "${SCRIPTPATH}")}" -k_wait () { - kubectl wait --for condition=available --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1 -} +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../common.sh" -k_rollout_status () { - kubectl rollout status --watch --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1 -} - -function get_namespace_details { -cat <>"$GITHUB_STEP_SUMMARY" -### Namespace $1 - -#### Events - -\`\`\`shell -$(kubectl --request-timeout=30s get events --output wide --namespace "$1") -\`\`\` - -#### Pods - -\`\`\`shell -$(kubectl --request-timeout=30s describe pods --namespace "$1") -\`\`\` - -#### Logs - -\`\`\`shell -$(kubectl get pods -o name -n "$1" | while read -r line; do echo logs for "${line}"; kubectl logs -n "$1" "${line}" --all-containers=true --ignore-errors=true; done) -\`\`\` - -EOF -} - -cat <>"$GITHUB_STEP_SUMMARY" -### spire - -| workload | Status | -| ------------------------------------ | ------ | -| spire-server | "$(k_rollout_status spire-server statefulset spire-server)" | -| spire-controller-manager | "$(k_rollout_status spire-server statefulset spire-controller-manager)" | -| spire-spiffe-oidc-discovery-provider | "$(k_wait spire-server deployments.apps spire-spiffe-oidc-discovery-provider)" | -| spire-spiffe-csi-driver | "$(k_rollout_status spire-system daemonset spire-spiffe-csi-driver)" | -| spire-agent | "$(k_rollout_status spire-system daemonset spire-agent)" | -EOF +print_helm_releases +print_spire_workload_status spire-server spire-system if [[ "$1" -ne 0 ]]; then get_namespace_details spire-server - get_namespace_details spire-systen + get_namespace_details spire-system fi diff --git a/.github/tests/prometheus/post-install.sh b/.github/tests/prometheus/post-install.sh new file mode 100644 index 0000000..1278f29 --- /dev/null +++ b/.github/tests/prometheus/post-install.sh @@ -0,0 +1,17 @@ +#!/usr/bin/env bash + +set -x + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +scenario="${scenario:-$(basename "${SCRIPTPATH}")}" + +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../common.sh" + +print_helm_releases +print_spire_workload_status "${scenario}" + +if [[ "$1" -ne 0 ]]; then + get_namespace_details "${scenario}" +fi diff --git a/.github/tests/prometheus/pre-install.sh b/.github/tests/prometheus/pre-install.sh index 9057040..e63cb46 100755 --- a/.github/tests/prometheus/pre-install.sh +++ b/.github/tests/prometheus/pre-install.sh @@ -1,7 +1,11 @@ #!/usr/bin/env bash -SCRIPT=$(readlink -f "$0") -SCRIPTPATH=$(dirname "${SCRIPT}") +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" scenario="${scenario:-$(basename "${SCRIPTPATH}")}" -helm install kube-prometheus-stack kube-prometheus-stack --version "${VERSION_KUBE_PROMETHEUS_STACK}" --repo "${HELM_REPO_KUBE_PROMETHEUS_STACK}" -n "${scenario}" --wait +helm install kube-prometheus-stack kube-prometheus-stack \ + --version "${VERSION_KUBE_PROMETHEUS_STACK}" \ + --repo "${HELM_REPO_KUBE_PROMETHEUS_STACK}" \ + -n "${scenario}" \ + --wait diff --git a/.github/tests/spire-oidc-insecure/post-install.sh b/.github/tests/spire-oidc-insecure/post-install.sh new file mode 100644 index 0000000..1278f29 --- /dev/null +++ b/.github/tests/spire-oidc-insecure/post-install.sh @@ -0,0 +1,17 @@ +#!/usr/bin/env bash + +set -x + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +scenario="${scenario:-$(basename "${SCRIPTPATH}")}" + +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../common.sh" + +print_helm_releases +print_spire_workload_status "${scenario}" + +if [[ "$1" -ne 0 ]]; then + get_namespace_details "${scenario}" +fi diff --git a/.github/tests/spire-oidc-insecure/pre-install.sh b/.github/tests/spire-oidc-insecure/pre-install.sh index 2433e0e..d27cc96 100755 --- a/.github/tests/spire-oidc-insecure/pre-install.sh +++ b/.github/tests/spire-oidc-insecure/pre-install.sh @@ -1,7 +1,7 @@ #!/usr/bin/env bash -SCRIPT=$(readlink -f "$0") -SCRIPTPATH=$(dirname "${SCRIPT}") +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" scenario="${scenario:-$(basename "${SCRIPTPATH}")}" helm install ingress-nginx ingress-nginx --version "${VERSION_INGRESS_NGINX}" --repo "${HELM_REPO_INGRESS_NGINX}" -n "$scenario" --set controller.extraArgs.enable-ssl-passthrough= diff --git a/.github/tests/upstream-authority-cert-manager/post-install.sh b/.github/tests/upstream-authority-cert-manager/post-install.sh new file mode 100755 index 0000000..9ef78ac --- /dev/null +++ b/.github/tests/upstream-authority-cert-manager/post-install.sh @@ -0,0 +1,17 @@ +#!/usr/bin/env bash + +set -x + +SCRIPT=$(readlink -f "$0") +SCRIPTPATH="$(dirname "${SCRIPT}")" +scenario="${scenario:-$(basename "${SCRIPTPATH}")}" + +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../common.sh" + +print_helm_releases +print_spire_workload_status "${scenario}" + +if [ "$1" != '0' ]; then + get_namespace_details "${scenario}" +fi diff --git a/.github/tests/upstream-authority-cert-manager/pre-install.sh b/.github/tests/upstream-authority-cert-manager/pre-install.sh index 1e1f8b2..9508f5d 100755 --- a/.github/tests/upstream-authority-cert-manager/pre-install.sh +++ b/.github/tests/upstream-authority-cert-manager/pre-install.sh @@ -1,7 +1,7 @@ #!/usr/bin/env bash -SCRIPT=$(readlink -f "$0") -SCRIPTPATH=$(dirname "${SCRIPT}") +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" scenario="${scenario:-$(basename "${SCRIPTPATH}")}" helm install cert-manager cert-manager --namespace cert-manager --create-namespace --version "$VERSION_CERT_MANAGER" --set installCRDs=true --repo "$HELM_REPO_CERT_MANAGER" --wait diff --git a/.github/tests/upstream-authority-disk/post-install.sh b/.github/tests/upstream-authority-disk/post-install.sh new file mode 100755 index 0000000..9ef78ac --- /dev/null +++ b/.github/tests/upstream-authority-disk/post-install.sh @@ -0,0 +1,17 @@ +#!/usr/bin/env bash + +set -x + +SCRIPT=$(readlink -f "$0") +SCRIPTPATH="$(dirname "${SCRIPT}")" +scenario="${scenario:-$(basename "${SCRIPTPATH}")}" + +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../common.sh" + +print_helm_releases +print_spire_workload_status "${scenario}" + +if [ "$1" != '0' ]; then + get_namespace_details "${scenario}" +fi diff --git a/.github/workflows/scripts/update-versions.sh b/.github/workflows/scripts/update-versions.sh index 71a2fb0..b2be7d4 100755 --- a/.github/workflows/scripts/update-versions.sh +++ b/.github/workflows/scripts/update-versions.sh @@ -1,7 +1,7 @@ #!/usr/bin/env bash -SCRIPT=$(readlink -f "$0") -SCRIPTPATH=$(dirname "${SCRIPT}") +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" CHARTJSON="${SCRIPTPATH}/../../tests/charts.json" From 6a894e8c38857f24f118f9ee37448625af199aa2 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Wed, 26 Apr 2023 10:23:32 +0200 Subject: [PATCH 15/32] Move update-versions.sh script Signed-off-by: Marco Franssen --- .github/{workflows => }/scripts/update-versions.sh | 2 +- .github/workflows/check-versions.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) rename .github/{workflows => }/scripts/update-versions.sh (94%) diff --git a/.github/workflows/scripts/update-versions.sh b/.github/scripts/update-versions.sh similarity index 94% rename from .github/workflows/scripts/update-versions.sh rename to .github/scripts/update-versions.sh index b2be7d4..bf34574 100755 --- a/.github/workflows/scripts/update-versions.sh +++ b/.github/scripts/update-versions.sh @@ -3,7 +3,7 @@ SCRIPT="$(readlink -f "$0")" SCRIPTPATH="$(dirname "${SCRIPT}")" -CHARTJSON="${SCRIPTPATH}/../../tests/charts.json" +CHARTJSON="${SCRIPTPATH}/../tests/charts.json" jq -r ".[].name" "${CHARTJSON}" | while read -r CHART; do ENTRYQUERY='.[] | select(.name == "'$CHART'")' diff --git a/.github/workflows/check-versions.yaml b/.github/workflows/check-versions.yaml index 85cd437..eee248e 100644 --- a/.github/workflows/check-versions.yaml +++ b/.github/workflows/check-versions.yaml @@ -29,7 +29,7 @@ jobs: - name: Update test chart versions run: | - ./.github/workflows/scripts/update-versions.sh + ./.github/scripts/update-versions.sh git diff - name: Create Pull Request From 3889d22e3473696d0585c6a70f2b8eb456eb66fc Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Wed, 26 Apr 2023 10:29:52 +0200 Subject: [PATCH 16/32] Fix quotation bug in update-version.sh Signed-off-by: Marco Franssen --- .github/scripts/update-versions.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/scripts/update-versions.sh b/.github/scripts/update-versions.sh index bf34574..2be760e 100755 --- a/.github/scripts/update-versions.sh +++ b/.github/scripts/update-versions.sh @@ -18,7 +18,7 @@ jq -r ".[].name" "${CHARTJSON}" | while read -r CHART; do echo " latest version: ${LATEST_VERSION}" if [ "x${VERSION}" != "x${LATEST_VERSION}" ]; then echo " New version found!" - jq "(${ENTRYQUERY}).version |= "'"${LATEST_VERSION}"' "${CHARTJSON}" > /tmp/$$ + jq "(${ENTRYQUERY}).version |= \"${LATEST_VERSION}\"" "${CHARTJSON}" > /tmp/$$ mv /tmp/$$ "${CHARTJSON}" fi done From 3d81928ff8e04be29a07454c05852c159be4be25 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Wed, 26 Apr 2023 12:38:14 -0700 Subject: [PATCH 17/32] Add skipKubeletVerification configurable (#243) --- charts/spire/charts/spire-agent/README.md | 1 + charts/spire/charts/spire-agent/templates/configmap.yaml | 2 +- charts/spire/charts/spire-agent/values.yaml | 3 +++ 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 744e311..66b052e 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -54,6 +54,7 @@ A Helm chart to install the SPIRE agent. | waitForIt.image.repository | string | `"chainguard/wait-for-it"` | | | waitForIt.image.version | string | `"latest-20230113"` | | | waitForIt.resources | object | `{}` | | +| workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped | | workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor | ---------------------------------------------- diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 9f8d70d..b04cb88 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -24,7 +24,7 @@ plugins: # Defaults to the secure kubelet port by default. # Minikube does not have a cert in the cluster CA bundle that # can authenticate the kubelet cert, so skip validation. - skip_kubelet_verification: true + skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }} {{- if .Values.workloadAttestors.unix.enabled }} - unix: diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index e5bca41..68e6b8a 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -81,6 +81,9 @@ workloadAttestors: unix: # -- enables the Unix workload attestor enabled: false + k8s: + # -- If true, kubelet certificate verification is skipped + skipKubeletVerification: true telemetry: prometheus: From 61e338df5510438a0e1f77904c113c790f39e965 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 27 Apr 2023 14:02:48 -0700 Subject: [PATCH 18/32] Fix example production typos (#244) Signed-off-by: kfox1111 --- examples/production/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/production/README.md b/examples/production/README.md index 4cf892c..0514ca4 100644 --- a/examples/production/README.md +++ b/examples/production/README.md @@ -1,6 +1,6 @@ # Recommended production setup -Too install Spire with the least privileges possible we deploy spire accross 2 namespaces. +To install Spire with the least privileges possible we deploy spire across 2 namespaces. ```shell kubectl create namespace "spire-system" From 6760cd22cdffa4f52b9dca53844583e49dbd242d Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 1 May 2023 09:16:43 -0700 Subject: [PATCH 19/32] Bump test chart dependencies (#252) Bump the Helm charts used in test scenarios to latest available versions. --------- Signed-off-by: GitHub Co-authored-by: Kevin Fox --- .github/tests/charts.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index b9341a3..e8fc19b 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "45.10.1" + "version": "45.23.0" }, { "name": "cert-manager", From 1e09ea54a1b85d03bc773d9b404c59d81df17ae7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 3 May 2023 09:13:42 -0700 Subject: [PATCH 20/32] Bump peter-evans/create-pull-request from 5.0.0 to 5.0.1 (#253) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 5.0.0 to 5.0.1.
Release notes

Sourced from peter-evans/create-pull-request's releases.

Create Pull Request v5.0.1

What's Changed

Full Changelog: https://github.com/peter-evans/create-pull-request/compare/v5.0.0...v5.0.1

Commits
  • 284f54f fix: truncate body if exceeds max length (#1915)
  • 9e5b234 build(deps-dev): bump eslint from 8.38.0 to 8.39.0 (#1888)
  • 2d8e7db build(deps-dev): bump @​types/node from 18.15.11 to 18.16.0 (#1887)
  • 041b6ab build(deps-dev): bump prettier from 2.8.7 to 2.8.8 (#1886)
  • 31de0fd build(deps-dev): bump @​types/jest from 29.5.0 to 29.5.1 (#1885)
  • 28295f6 build(deps-dev): bump @​typescript-eslint/parser from 5.59.0 to 5.59.1 (#1884)
  • 8dcaf38 build(deps-dev): bump @​typescript-eslint/parser from 5.58.0 to 5.59.0 (#1876)
  • 2827897 docs: add note about push-to-fork with remote repos
  • c4f19d3 build(deps-dev): bump eslint-import-resolver-typescript (#1844)
  • 4603586 build(deps-dev): bump eslint from 8.37.0 to 8.38.0 (#1842)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=peter-evans/create-pull-request&package-manager=github_actions&previous-version=5.0.0&new-version=5.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/check-versions.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check-versions.yaml b/.github/workflows/check-versions.yaml index eee248e..e129967 100644 --- a/.github/workflows/check-versions.yaml +++ b/.github/workflows/check-versions.yaml @@ -34,7 +34,7 @@ jobs: - name: Create Pull Request id: cpr - uses: peter-evans/create-pull-request@v5.0.0 + uses: peter-evans/create-pull-request@v5.0.1 with: title: Bump test chart dependencies branch: bump-test-chart-deps From 8e7e6ebc765e93d2f7bbde1f75cdfbb4aefca4f7 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 4 May 2023 13:15:17 -0700 Subject: [PATCH 21/32] Allow trust bundle url to be set along with format (#256) This patch enables the spire-agent to retrieve the trust bundle via url. fixes: https://github.com/spiffe/helm-charts/issues/254 --------- Signed-off-by: Kevin Fox Co-authored-by: Faisal Memon --- charts/spire/charts/spire-agent/README.md | 2 ++ charts/spire/charts/spire-agent/templates/configmap.yaml | 5 +++++ charts/spire/charts/spire-agent/templates/daemonset.yaml | 4 ++++ charts/spire/charts/spire-agent/values.yaml | 5 ++++- 4 files changed, 15 insertions(+), 1 deletion(-) diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 66b052e..0fe91b3 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -48,6 +48,8 @@ A Helm chart to install the SPIRE agent. | telemetry.prometheus.podMonitor.labels | object | `{}` | | | telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | | telemetry.prometheus.port | int | `9988` | | +| trustBundleFormat | string | `"pem"` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | +| trustBundleURL | string | `""` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | | trustDomain | string | `"example.org"` | | | waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | | waitForIt.image.registry | string | `"cgr.dev"` | | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index b04cb88..414dd85 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -5,7 +5,12 @@ agent: server_address: {{ include "spire-agent.server-address" . | trim | quote }} server_port: {{ .Values.server.port | quote }} socket_path: {{ include "spire-agent.socket-path" . | quote }} + {{- if ne (len .Values.trustBundleURL) 0 }} + trust_bundle_url: {{ .Values.trustBundleURL | quote }} + trust_bundle_format: {{ .Values.trustBundleFormat | quote }} + {{- else }} trust_bundle_path: "/run/spire/bundle/bundle.crt" + {{- end }} trust_domain: {{ include "spire-lib.trust-domain" . | quote }} plugins: diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 19e9437..eafbad1 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -62,9 +62,11 @@ spec: - name: spire-config mountPath: /run/spire/config readOnly: true + {{- if eq (len .Values.trustBundleURL) 0 }} - name: spire-bundle mountPath: /run/spire/bundle readOnly: true + {{- end }} - name: spire-agent-socket-dir mountPath: {{ include "spire-agent.socket-path" . | dir }} readOnly: false @@ -98,9 +100,11 @@ spec: - name: spire-config configMap: name: {{ include "spire-agent.fullname" . }} + {{- if eq (len .Values.trustBundleURL) 0 }} - name: spire-bundle configMap: name: {{ include "spire-lib.bundle-configmap" . }} + {{- end }} - name: spire-token projected: sources: diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 68e6b8a..77a0114 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -55,7 +55,10 @@ nodeSelector: {} logLevel: info clusterName: example-cluster trustDomain: example.org - +# -- If set, obtain trust bundle from url instead of Kubernetes ConfigMap +trustBundleURL: "" +# -- If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" +trustBundleFormat: pem bundleConfigMap: spire-bundle server: From aa6b40c0f89e16891232c1215f8ea95c90aad031 Mon Sep 17 00:00:00 2001 From: Edwin Buck Date: Fri, 5 May 2023 13:55:42 -0500 Subject: [PATCH 22/32] Add project overview. (#258) --- project/overview.md | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 project/overview.md diff --git a/project/overview.md b/project/overview.md new file mode 100644 index 0000000..3eee052 --- /dev/null +++ b/project/overview.md @@ -0,0 +1,43 @@ + +# Project Overview + +The spire/helm-chart effort intends to deliver a set of helm charts to +support SPIRE deployments in Kubernetes to the widest possible audience of +users. + +## Mission and Scope + +The mission of this effort is to provide a stable upstream repository +of Helm Charts sufficient for any organization or individual to use. + +### What problem does this project address? + +Prior to this effort, no single authoritative repository for SPIRE Helm +Charts existed, imposing an additional burden on SPIRE adoption as each +organization or individual had to develop their own Kubernetes +deployment packaging. + +### What is the goal of this project? + +The goal of this project is to be the primary means of deployment for +SPIRE into Kubernetes clusters, providing a flexible solution that can +be used in a wide number of different scenarios. + +### What is the scope of this project? + +The scope includes user documentation, chart creation, chart delivery, +chart testing, and chart maintenance of a set of Helm Charts sufficient +for deploying SPIRE in any SPIRE documented configuration, including +direction on how to extend the Charts to integrate non-SPIRE plugins. + +### What development methodology is used? + +An Open Source Development methodology is used, where issues are tracked +within the primary github repository. + +## Status + +The project is currently in a pre-release status. While the standalone +deployment is close to release quality, the tiered deployment is not. + From 1f09d7b38676b53a65e11b17acf56588169d2c3a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 8 May 2023 06:38:29 -0700 Subject: [PATCH 23/32] Bump test chart dependencies (#264) Bump the Helm charts used in test scenarios to latest available versions. --------- Signed-off-by: GitHub Signed-off-by: Kevin Fox Co-authored-by: marcofranssen Co-authored-by: Kevin Fox --- .github/tests/charts.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/tests/charts.json b/.github/tests/charts.json index e8fc19b..1b8006f 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -2,7 +2,7 @@ { "name": "kube-prometheus-stack", "repo": "https://prometheus-community.github.io/helm-charts", - "version": "45.23.0" + "version": "45.26.0" }, { "name": "cert-manager", @@ -12,6 +12,6 @@ { "name": "ingress-nginx", "repo": "https://kubernetes.github.io/ingress-nginx", - "version": "4.6.0" + "version": "4.6.1" } ] From ce78bea1214092c33eaddb0d6ed051d32e0b3dc5 Mon Sep 17 00:00:00 2001 From: Edwin Buck Date: Tue, 9 May 2023 10:00:02 -0500 Subject: [PATCH 24/32] Add Edwin Buck as a maintainer. (#267) --- CODEOWNERS | 2 +- charts/spire/Chart.yaml | 2 ++ charts/spire/README.md | 1 + 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/CODEOWNERS b/CODEOWNERS index 97468c2..54b1269 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -2,6 +2,6 @@ # the repo. Unless a later match takes precedence, # they will be requested for review when someone opens a # pull request. -* @marcofranssen @Kfox1111 @developer-guy @dfeldman @faisal-memon @mrsabath +* @marcofranssen @Kfox1111 @developer-guy @dfeldman @faisal-memon @mrsabath @edwbuck # See CODEOWNERS syntax here: https://help.github.com/articles/about-codeowners/#codeowners-syntax diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 2c37c3f..419d2a8 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -18,6 +18,8 @@ maintainers: email: Kevin.Fox@pnnl.gov - name: faisal-memon email: fymemon@yahoo.com + - name: edwbuck + email: edwbuck@gmail.com kubeVersion: ">=1.21.0-0" dependencies: - name: spire-server diff --git a/charts/spire/README.md b/charts/spire/README.md index 8c7cddf..78b75f7 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -88,6 +88,7 @@ Now you can interact with the Spire agent socket from your own application. The | marcofranssen | | | | kfox1111 | | | | faisal-memon | | | +| edwbuck | | | ## Source Code From d3da3eed553d4b7790783e31f64bde3d4c85931a Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Wed, 10 May 2023 05:04:34 -0700 Subject: [PATCH 25/32] External database configuration (#225) This patch makes all the database settings configurable. fixes: https://github.com/spiffe/helm-charts/issues/37 --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon Co-authored-by: Marco Franssen --- .github/tests/charts.json | 10 ++++ .../production-external-mysql/install.sh | 46 ++++++++++++++++++ .../mysql-values.yaml | 7 +++ .../production-external-mysql/post-install.sh | 18 +++++++ .../production-external-mysql/pre-install.sh | 6 +++ .../production-external-postgresql/install.sh | 46 ++++++++++++++++++ .../post-install.sh | 18 +++++++ .../postgresql-values.yaml | 8 ++++ .../pre-install.sh | 6 +++ charts/spire/charts/spire-server/README.md | 16 +++++-- .../spire-server/templates/_helpers.tpl | 48 +++++++++++++++++++ .../spire-server/templates/configmap.yaml | 3 +- .../charts/spire-server/templates/secret.yaml | 9 ++++ .../spire-server/templates/statefulset.yaml | 24 +++++++--- charts/spire/charts/spire-server/values.yaml | 23 ++++++++- examples/bin/readpw.sh | 3 ++ examples/external-mysql/README.md | 22 +++++++++ examples/external-mysql/values.yaml | 10 ++++ examples/external-postgresql/README.md | 23 +++++++++ examples/external-postgresql/values.yaml | 10 ++++ 20 files changed, 342 insertions(+), 14 deletions(-) create mode 100755 .github/tests/production-external-mysql/install.sh create mode 100644 .github/tests/production-external-mysql/mysql-values.yaml create mode 100755 .github/tests/production-external-mysql/post-install.sh create mode 100755 .github/tests/production-external-mysql/pre-install.sh create mode 100755 .github/tests/production-external-postgresql/install.sh create mode 100755 .github/tests/production-external-postgresql/post-install.sh create mode 100644 .github/tests/production-external-postgresql/postgresql-values.yaml create mode 100755 .github/tests/production-external-postgresql/pre-install.sh create mode 100644 charts/spire/charts/spire-server/templates/secret.yaml create mode 100644 examples/bin/readpw.sh create mode 100644 examples/external-mysql/README.md create mode 100644 examples/external-mysql/values.yaml create mode 100644 examples/external-postgresql/README.md create mode 100644 examples/external-postgresql/values.yaml diff --git a/.github/tests/charts.json b/.github/tests/charts.json index 1b8006f..eb72d77 100644 --- a/.github/tests/charts.json +++ b/.github/tests/charts.json @@ -13,5 +13,15 @@ "name": "ingress-nginx", "repo": "https://kubernetes.github.io/ingress-nginx", "version": "4.6.1" + }, + { + "name": "mysql", + "repo": "https://charts.bitnami.com/bitnami", + "version": "9.7.2" + }, + { + "name": "postgresql", + "repo": "https://charts.bitnami.com/bitnami", + "version": "12.2.2" } ] diff --git a/.github/tests/production-external-mysql/install.sh b/.github/tests/production-external-mysql/install.sh new file mode 100755 index 0000000..fc979cd --- /dev/null +++ b/.github/tests/production-external-mysql/install.sh @@ -0,0 +1,46 @@ +#!/usr/bin/env bash + +set -xe + +SCRIPT=$(readlink -f "$0") +SCRIPTPATH=$(dirname "$SCRIPT") + +DB=spire +DBUSER=spire +DBPW=$(uuidgen) +DBROOTPW=$(uuidgen) + +# Generate random settings to make sure things come up with random settings. +cat < /tmp/$$-db-values.yaml +auth: + database: ${DB} + username: ${DBUSER} + password: ${DBPW} + rootPassword: ${DBROOTPW} +EOF + +cat < /tmp/$$-spire-values.yaml +spire-server: + dataStore: + sql: + databaseType: mysql + databaseName: ${DB} + username: ${DBUSER} + password: ${DBPW} + host: mysql + port: 3306 + options: + - parseTime: true +EOF + +helm install mysql mysql --namespace "spire-server" --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \ + --values "${SCRIPTPATH}/mysql-values.yaml" \ + --values /tmp/$$-db-values.yaml --wait + +helm install \ + --namespace "spire-server" \ + --values /tmp/$$-spire-values.yaml \ + --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \ + spire charts/spire --wait + +helm test spire --namespace "spire-server" diff --git a/.github/tests/production-external-mysql/mysql-values.yaml b/.github/tests/production-external-mysql/mysql-values.yaml new file mode 100644 index 0000000..62f27e2 --- /dev/null +++ b/.github/tests/production-external-mysql/mysql-values.yaml @@ -0,0 +1,7 @@ +primary: + containerSecurityContext: + allowPrivilegeEscalation: false + capabilities: + drop: [ALL] + seccompProfile: + type: RuntimeDefault diff --git a/.github/tests/production-external-mysql/post-install.sh b/.github/tests/production-external-mysql/post-install.sh new file mode 100755 index 0000000..29335e6 --- /dev/null +++ b/.github/tests/production-external-mysql/post-install.sh @@ -0,0 +1,18 @@ +#!/usr/bin/env bash + +set -x + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +scenario="${scenario:-$(basename "${SCRIPTPATH}")}" + +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../common.sh" + +print_helm_releases +print_spire_workload_status spire-server spire-system + +if [[ "$1" -ne 0 ]]; then + get_namespace_details spire-server + get_namespace_details spire-system +fi diff --git a/.github/tests/production-external-mysql/pre-install.sh b/.github/tests/production-external-mysql/pre-install.sh new file mode 100755 index 0000000..b33d1ed --- /dev/null +++ b/.github/tests/production-external-mysql/pre-install.sh @@ -0,0 +1,6 @@ +#!/usr/bin/env bash + +kubectl create namespace spire-system +kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged +kubectl create namespace spire-server +kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted diff --git a/.github/tests/production-external-postgresql/install.sh b/.github/tests/production-external-postgresql/install.sh new file mode 100755 index 0000000..38b56c4 --- /dev/null +++ b/.github/tests/production-external-postgresql/install.sh @@ -0,0 +1,46 @@ +#!/usr/bin/env bash + +set -xe + +SCRIPT=$(readlink -f "$0") +SCRIPTPATH=$(dirname "$SCRIPT") + +DB=$(uuidgen) +DBUSER=$(uuidgen) +DBPW=$(uuidgen) +DBPGPW=$(uuidgen) + +# Generate random settings to make sure things come up with random settings. +cat > /tmp/$$-db-values.yaml < /tmp/$$-spire-values.yaml < Date: Wed, 10 May 2023 07:30:05 -0700 Subject: [PATCH 26/32] Replicas > 1 is not allowed with sqlite driver (#269) Co-authored-by: Faisal Memon Co-authored-by: Marco Franssen --- charts/spire/charts/spire-server/templates/hpa.yaml | 3 +++ charts/spire/charts/spire-server/templates/statefulset.yaml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/charts/spire/charts/spire-server/templates/hpa.yaml b/charts/spire/charts/spire-server/templates/hpa.yaml index b68f878..921abf6 100644 --- a/charts/spire/charts/spire-server/templates/hpa.yaml +++ b/charts/spire/charts/spire-server/templates/hpa.yaml @@ -12,6 +12,9 @@ spec: kind: Deployment name: {{ include "spire-server.fullname" . }} minReplicas: {{ .Values.autoscaling.minReplicas }} + {{- if and (eq .Values.dataStore.sql.databaseType "sqlite3") .Values.autoscaling.enabled (gt (int .Values.autoscaling.maxReplicas) 1) }} + {{- fail "When running with sqlite3 database, you can't scale up to more then one instance. 'autoscaling.maxReplicas' MUST be 1" }} + {{- end }} maxReplicas: {{ .Values.autoscaling.maxReplicas }} metrics: {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index ab49400..c44a3d3 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -11,6 +11,9 @@ metadata: {{- include "spire-server.labels" . | nindent 4 }} spec: {{- if not .Values.autoscaling.enabled }} + {{- if and (eq .Values.dataStore.sql.databaseType "sqlite3") (gt (int .Values.replicaCount) 1) }} + {{- fail "When running with sqlite3 database, you can't scale up to more then one instance. 'replicaCount' MUST be 1" }} + {{- end }} replicas: {{ .Values.replicaCount }} {{- end }} serviceName: {{ include "spire-server.fullname" . }} From 73435be9a1f948b2c7549841b482d4d477da8e31 Mon Sep 17 00:00:00 2001 From: Edwin Buck Date: Wed, 10 May 2023 14:53:17 -0500 Subject: [PATCH 27/32] Add project glossary. (#262) This glossary is not meant to be complete, as no glossary can be. It does mean to cover the basic different deployments. To keep things clear, federation was also added to clarify that federation is not a deployment but a different "thing". Closes #261 --------- Signed-off-by: Edwin Buck Co-authored-by: Marco Franssen Co-authored-by: kfox1111 --- project/glossary.md | 46 +++++++++++++++++++++++++++++++++++++++++++++ project/overview.md | 8 ++++++++ 2 files changed, 54 insertions(+) create mode 100644 project/glossary.md diff --git a/project/glossary.md b/project/glossary.md new file mode 100644 index 0000000..5f54f47 --- /dev/null +++ b/project/glossary.md @@ -0,0 +1,46 @@ + +# Glossary + +This glossary is a dictionary of terms defined as they are used by the +spire/helm-charts project. Writing the definitions of terms here helps +to keep other documents concise and precise. Documenting terminology +here helps prevent misundersandings, facilitating easy onboarding of new +team members. + +**Deployment** +: A use of the Helm Charts to describe a single SPIRE cluster. + +**Deployment Type** +: One of three supported deployments of the charts: Standalone, +Primary, or Secondary. + +**Federation** +: When one cluster is configured to trust elements of another cluster +containing a different trust domain. + +**Federated Deployment** +: A Primary Deployment or Standalone Deployment that is configured +to federate with one or more Deployments. + +**Primary Deployment** +: A deployment of the Helm Charts where the cluster's purpose is to +provide certificates to Secondary Deployments. + +**Secondary Deployment** +: A deployment of the Helm Charts where the cluster obtains an +intermediate CA from a Primary Deployment and uses it to service +Workload Identity requests. + +**Standalone Deployment** +: A deployment of the Helm Charts where the cluster both manages the CA +and services Workload Identity requests in the same cluster. + +**Tiered Deployment** +: Use of the Helm Charts two or more times, such that one chart is +configured as a Primary Deployment Type and the others are configured as +Secondary Deployment Types. + +**Trust Domain** +: The host field of a SPIFFE ID, naming a minimum footprint of a trust +bundle's distribution. diff --git a/project/overview.md b/project/overview.md index 3eee052..8e0e176 100644 --- a/project/overview.md +++ b/project/overview.md @@ -41,3 +41,11 @@ within the primary github repository. The project is currently in a pre-release status. While the standalone deployment is close to release quality, the tiered deployment is not. +## Project Navigation + +Below are links to project documentation useful for the management and +maintenance of the spire/helm project. + +### Coordination + +- [glossary](glossary.md) From 013eb617a9e718c505883cb46a2609699d5008a6 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Wed, 10 May 2023 18:22:07 -0700 Subject: [PATCH 28/32] Fix spacing for spire server service annotation (#273) Spacing off by 4. Signed-off-by: Faisal Memon --- charts/spire/charts/spire-server/templates/service.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/spire/charts/spire-server/templates/service.yaml b/charts/spire/charts/spire-server/templates/service.yaml index 5cdaf50..1e57a07 100644 --- a/charts/spire/charts/spire-server/templates/service.yaml +++ b/charts/spire/charts/spire-server/templates/service.yaml @@ -5,7 +5,7 @@ metadata: namespace: {{ include "spire-server.namespace" . }} {{- with .Values.service.annotations }} annotations: - {{- toYaml . | nindent 8 }} + {{- toYaml . | nindent 4 }} {{- end }} labels: {{- include "spire-server.labels" . | nindent 4 }} From b3153242441494da46fcade00b08a0884db0ffb0 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Thu, 11 May 2023 10:49:06 -0700 Subject: [PATCH 29/32] Allow for ConfigMaps to be annotated (#272) Without an annotation, spinnaker will rename the configmap. --------- Signed-off-by: Faisal Memon Co-authored-by: kfox1111 --- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 1 + .../templates/configmap.yaml | 4 ++++ .../charts/spiffe-oidc-discovery-provider/values.yaml | 4 ++++ charts/spire/charts/spire-agent/README.md | 1 + charts/spire/charts/spire-agent/templates/configmap.yaml | 4 ++++ charts/spire/charts/spire-agent/values.yaml | 4 ++++ charts/spire/charts/spire-server/README.md | 2 ++ charts/spire/charts/spire-server/templates/configmap.yaml | 4 ++++ .../templates/controller-manager-configmap.yaml | 4 ++++ charts/spire/charts/spire-server/values.yaml | 8 ++++++++ 10 files changed, 36 insertions(+) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 14aacab..3e926ce 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -29,6 +29,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | config.domains[0] | string | `"localhost"` | | | config.domains[1] | string | `"oidc-discovery.example.org"` | | | config.logLevel | string | `"info"` | | +| configMap.annotations | object | `{}` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | | fullnameOverride | string | `""` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.registry | string | `"ghcr.io"` | | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml index e4df285..eb39513 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml @@ -38,6 +38,10 @@ kind: ConfigMap metadata: name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }} + {{- with .Values.configMap.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} data: oidc-discovery-provider.conf: | {{- include "spiffe-oidc-discovery-provider.yaml-config" (dict "oidcSocket" $oidcSocket "root" .) | fromYaml | toPrettyJson | nindent 4 }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 1424301..8909056 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -34,6 +34,10 @@ service: annotations: {} # external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org +configMap: + # -- Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap + annotations: {} + podSecurityContext: {} # fsGroup: 2000 diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 0fe91b3..ae168fd 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -16,6 +16,7 @@ A Helm chart to install the SPIRE agent. |-----|------|---------|-------------| | bundleConfigMap | string | `"spire-bundle"` | | | clusterName | string | `"example-cluster"` | | +| configMap.annotations | object | `{}` | Annotations to add to the SPIRE Agent ConfigMap | | extraContainers | list | `[]` | | | extraVolumeMounts | list | `[]` | | | extraVolumes | list | `[]` | | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 414dd85..aa545fc 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -55,6 +55,10 @@ kind: ConfigMap metadata: name: {{ include "spire-agent.fullname" . }} namespace: {{ include "spire-agent.namespace" . }} + {{- with .Values.configMap.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} data: agent.conf: | {{- include "spire-agent.yaml-config" . | fromYaml | toPrettyJson | nindent 4 }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 77a0114..77fb9f4 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -25,6 +25,10 @@ serviceAccount: # If not set and create is true, a name is generated using the fullname template name: "" +configMap: + # -- Annotations to add to the SPIRE Agent ConfigMap + annotations: {} + podAnnotations: {} podSecurityContext: {} diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 4b2d03b..aa6b806 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -30,6 +30,8 @@ A Helm chart to install the SPIRE server. | ca_subject.organization | string | `"Example"` | | | clusterDomain | string | `"cluster.local"` | | | clusterName | string | `"example-cluster"` | | +| configMap.annotations | object | `{}` | Annotations to add to the SPIRE Server ConfigMap | +| controllerManager.configMap.annotations | object | `{}` | Annotations to add to the Controller Manager ConfigMap | | controllerManager.enabled | bool | `false` | | | controllerManager.identities.dnsNameTemplates | list | `[]` | | | controllerManager.identities.enabled | bool | `true` | | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 5cb97b4..6b2ff71 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -104,6 +104,10 @@ kind: ConfigMap metadata: name: {{ include "spire-server.fullname" . }} namespace: {{ include "spire-server.namespace" . }} + {{- with .Values.configMap.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} data: server.conf: | {{- include "spire-server.yaml-config" . | fromYaml | toPrettyJson | nindent 4 }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml index 333a070..7184ff0 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -4,6 +4,10 @@ kind: ConfigMap metadata: name: {{ include "spire-controller-manager.fullname" . }} namespace: {{ include "spire-server.namespace" . }} + {{- with .Values.controllerManager.configMap.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} data: controller-manager-config.yaml: | apiVersion: spire.spiffe.io/v1alpha1 diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 2b84dde..41cdfd4 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -46,6 +46,10 @@ service: port: 8081 annotations: {} +configMap: + # -- Annotations to add to the SPIRE Server ConfigMap + annotations: {} + resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little @@ -186,6 +190,10 @@ controllerManager: port: 443 annotations: {} + configMap: + # -- Annotations to add to the Controller Manager ConfigMap + annotations: {} + ignoreNamespaces: - kube-system - kube-public From 5489212bb546aa35e96879fa7b655d59347c3ef6 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Fri, 12 May 2023 07:19:50 -0700 Subject: [PATCH 30/32] Remove persistence.enabled flag (#274) --- charts/spire/charts/spire-server/README.md | 1 - charts/spire/charts/spire-server/templates/statefulset.yaml | 4 ---- charts/spire/charts/spire-server/values.yaml | 2 -- 3 files changed, 7 deletions(-) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index aa6b806..ae28a4f 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -87,7 +87,6 @@ A Helm chart to install the SPIRE server. | nodeSelector | object | `{}` | | | notifier.k8sbundle.namespace | string | `""` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | | persistence.accessMode | string | `"ReadWriteOnce"` | | -| persistence.enabled | bool | `true` | Enable persistence used by sqlite3 for spire-server, by the disk KeyStore, and/or by Tornjak. | | persistence.size | string | `"1Gi"` | | | persistence.storageClass | string | `nil` | | | podAnnotations | object | `{}` | | diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index c44a3d3..f9e6262 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -104,11 +104,9 @@ spec: - name: spire-config mountPath: /run/spire/config readOnly: true - {{- if eq (.Values.persistence.enabled | toString) "true" }} - name: spire-data mountPath: /run/spire/data readOnly: false - {{- end }} {{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }} - name: upstream-ca mountPath: /run/spire/upstream_ca @@ -198,7 +196,6 @@ spec: {{- toYaml .Values.extraVolumes | nindent 8 }} {{- end }} volumeClaimTemplates: - {{- if eq (.Values.persistence.enabled | toString) "true" }} - metadata: name: spire-data spec: @@ -210,4 +207,3 @@ spec: {{- if .Values.persistence.storageClass }} storageClassName: {{ .Values.persistence.storageClass }} {{- end }} - {{ end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 41cdfd4..bbf2e0d 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -78,8 +78,6 @@ affinity: {} topologySpreadConstraints: [] persistence: - # -- Enable persistence used by sqlite3 for spire-server, by the disk KeyStore, and/or by Tornjak. - enabled: true size: 1Gi accessMode: ReadWriteOnce storageClass: null From 65312f8525aee17c6387dc7d402db2f117eda5f5 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 12 May 2023 20:12:23 +0200 Subject: [PATCH 31/32] Include dependency values in documentation (#275) I have added a flag to the helm-docs script to include the documentation for dependencies. This will add more complete documentation to https://artifacthub.io/packages/helm/spiffe/spire#values so it is easier for our users to get started and having a complete overview. --------- Signed-off-by: Marco Franssen Co-authored-by: Faisal Memon --- .github/tests/namespace-override/values.yaml | 1 + charts/spire/README.md | 238 +++++++++++++++++- .../spire/charts/spiffe-csi-driver/README.md | 22 +- .../charts/spiffe-csi-driver/values.yaml | 14 +- .../spiffe-oidc-discovery-provider/README.md | 32 +-- .../values.yaml | 23 +- charts/spire/charts/spire-agent/README.md | 24 +- charts/spire/charts/spire-agent/values.yaml | 18 +- charts/spire/charts/spire-server/README.md | 30 +-- charts/spire/charts/spire-server/values.yaml | 21 +- charts/spire/values.yaml | 4 +- helm-docs.sh | 2 +- 12 files changed, 351 insertions(+), 78 deletions(-) diff --git a/.github/tests/namespace-override/values.yaml b/.github/tests/namespace-override/values.yaml index 36a4336..fdff671 100644 --- a/.github/tests/namespace-override/values.yaml +++ b/.github/tests/namespace-override/values.yaml @@ -21,6 +21,7 @@ spire-agent: enabled: true namespaceOverride: spire-system serviceAccount: + # -- The name of the service account to use. name: spire-agent server: namespaceOverride: spire-server diff --git a/charts/spire/README.md b/charts/spire/README.md index 78b75f7..8670d07 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -111,9 +111,9 @@ Kubernetes: `>=1.21.0-0` |-----|------|---------|-------------| | global.k8s.clusterDomain | string | `"cluster.local"` | | | global.spire.bundleConfigMap | string | `""` | Override all instances of bundleConfigMap | -| global.spire.clusterName | string | `"example-cluster"` | Set the name of the Kubernetes cluster | +| global.spire.clusterName | string | `"example-cluster"` | | | global.spire.image.registry | string | `""` | Override all Spire image registries at once | -| global.spire.trustDomain | string | `"example.org"` | Set the trust domain to use for the spiffe identifiers | +| global.spire.trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers | | spiffe-csi-driver.enabled | bool | `true` | | | spiffe-oidc-discovery-provider.enabled | bool | `false` | | | spire-agent.enabled | bool | `true` | | @@ -121,5 +121,239 @@ Kubernetes: `>=1.21.0-0` | spire-server.controllerManager.enabled | bool | `true` | | | spire-server.enabled | bool | `true` | | | spire-server.nameOverride | string | `"server"` | | +| spiffe-csi-driver.agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent | +| spiffe-csi-driver.fullnameOverride | string | `""` | | +| spiffe-csi-driver.healthChecks.port | int | `9809` | | +| spiffe-csi-driver.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| spiffe-csi-driver.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | +| spiffe-csi-driver.image.repository | string | `"spiffe/spiffe-csi-driver"` | The repository within the registry | +| spiffe-csi-driver.image.version | string | `""` | Overrides the image tag whose default is the chart appVersion | +| spiffe-csi-driver.imagePullSecrets | list | `[]` | | +| spiffe-csi-driver.kubeletPath | string | `"/var/lib/kubelet"` | | +| spiffe-csi-driver.nameOverride | string | `""` | | +| spiffe-csi-driver.namespaceOverride | string | `""` | | +| spiffe-csi-driver.nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| spiffe-csi-driver.nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | The OCI registry to pull the image from | +| spiffe-csi-driver.nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | The repository within the registry | +| spiffe-csi-driver.nodeDriverRegistrar.image.version | string | `"v2.6.2"` | | +| spiffe-csi-driver.nodeDriverRegistrar.resources | object | `{}` | | +| spiffe-csi-driver.nodeSelector | object | `{}` | | +| spiffe-csi-driver.pluginName | string | `"csi.spiffe.io"` | Set the csi driver name deployed to Kubernetes. | +| spiffe-csi-driver.podAnnotations | object | `{}` | | +| spiffe-csi-driver.podSecurityContext | object | `{}` | | +| spiffe-csi-driver.priorityClassName | string | `""` | Priority class assigned to daemonset pods | +| spiffe-csi-driver.resources | object | `{}` | | +| spiffe-csi-driver.securityContext.privileged | bool | `true` | | +| spiffe-csi-driver.securityContext.readOnlyRootFilesystem | bool | `true` | | +| spiffe-csi-driver.serviceAccount.annotations | object | `{}` | Annotations to add to the service account | +| spiffe-csi-driver.serviceAccount.create | bool | `true` | Specifies whether a service account should be created | +| spiffe-csi-driver.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | +| spiffe-oidc-discovery-provider.affinity | object | `{}` | | +| spiffe-oidc-discovery-provider.agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket | +| spiffe-oidc-discovery-provider.autoscaling.enabled | bool | `false` | | +| spiffe-oidc-discovery-provider.autoscaling.maxReplicas | int | `5` | | +| spiffe-oidc-discovery-provider.autoscaling.minReplicas | int | `1` | | +| spiffe-oidc-discovery-provider.autoscaling.targetCPUUtilizationPercentage | int | `80` | | +| spiffe-oidc-discovery-provider.autoscaling.targetMemoryUtilizationPercentage | int | `80` | | +| spiffe-oidc-discovery-provider.clusterDomain | string | `"cluster.local"` | | +| spiffe-oidc-discovery-provider.config.acme.cacheDir | string | `"/run/spire"` | | +| spiffe-oidc-discovery-provider.config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | +| spiffe-oidc-discovery-provider.config.acme.emailAddress | string | `"letsencrypt@example.org"` | | +| spiffe-oidc-discovery-provider.config.acme.tosAccepted | bool | `false` | | +| spiffe-oidc-discovery-provider.config.domains[0] | string | `"localhost"` | | +| spiffe-oidc-discovery-provider.config.domains[1] | string | `"oidc-discovery.example.org"` | | +| spiffe-oidc-discovery-provider.config.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" | +| spiffe-oidc-discovery-provider.configMap.annotations | object | `{}` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | +| spiffe-oidc-discovery-provider.fullnameOverride | string | `""` | | +| spiffe-oidc-discovery-provider.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| spiffe-oidc-discovery-provider.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | +| spiffe-oidc-discovery-provider.image.repository | string | `"spiffe/oidc-discovery-provider"` | The repository within the registry | +| spiffe-oidc-discovery-provider.image.version | string | `""` | Overrides the image tag whose default is the chart appVersion | +| spiffe-oidc-discovery-provider.imagePullSecrets | list | `[]` | | +| spiffe-oidc-discovery-provider.ingress.annotations | object | `{}` | | +| spiffe-oidc-discovery-provider.ingress.className | string | `""` | | +| spiffe-oidc-discovery-provider.ingress.enabled | bool | `false` | | +| spiffe-oidc-discovery-provider.ingress.hosts[0].host | string | `"oidc-discovery.example.org"` | | +| spiffe-oidc-discovery-provider.ingress.hosts[0].paths[0].path | string | `"/"` | | +| spiffe-oidc-discovery-provider.ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | | +| spiffe-oidc-discovery-provider.ingress.tls | list | `[]` | | +| spiffe-oidc-discovery-provider.insecureScheme.enabled | bool | `false` | | +| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.registry | string | `"docker.io"` | The OCI registry to pull the image from | +| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.repository | string | `"nginxinc/nginx-unprivileged"` | The repository within the registry | +| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` | | +| spiffe-oidc-discovery-provider.insecureScheme.nginx.resources | object | `{}` | | +| spiffe-oidc-discovery-provider.nameOverride | string | `""` | | +| spiffe-oidc-discovery-provider.namespaceOverride | string | `""` | | +| spiffe-oidc-discovery-provider.nodeSelector | object | `{}` | | +| spiffe-oidc-discovery-provider.podAnnotations | object | `{}` | | +| spiffe-oidc-discovery-provider.podSecurityContext | object | `{}` | | +| spiffe-oidc-discovery-provider.replicaCount | int | `1` | | +| spiffe-oidc-discovery-provider.resources | object | `{}` | | +| spiffe-oidc-discovery-provider.securityContext | object | `{}` | | +| spiffe-oidc-discovery-provider.service.annotations | object | `{}` | | +| spiffe-oidc-discovery-provider.service.port | int | `80` | | +| spiffe-oidc-discovery-provider.service.type | string | `"ClusterIP"` | | +| spiffe-oidc-discovery-provider.serviceAccount.annotations | object | `{}` | Annotations to add to the service account | +| spiffe-oidc-discovery-provider.serviceAccount.create | bool | `true` | Specifies whether a service account should be created | +| spiffe-oidc-discovery-provider.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | +| spiffe-oidc-discovery-provider.telemetry.prometheus.enabled | bool | `false` | | +| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.registry | string | `"docker.io"` | The OCI registry to pull the image from | +| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` | The repository within the registry | +| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.version | string | `"0.11.0"` | | +| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.resources | object | `{}` | | +| spiffe-oidc-discovery-provider.telemetry.prometheus.podMonitor.enabled | bool | `false` | | +| spiffe-oidc-discovery-provider.telemetry.prometheus.podMonitor.labels | object | `{}` | | +| spiffe-oidc-discovery-provider.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider | +| spiffe-oidc-discovery-provider.telemetry.prometheus.port | int | `9988` | | +| spiffe-oidc-discovery-provider.tolerations | list | `[]` | | +| spiffe-oidc-discovery-provider.trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers | +| spire-agent.bundleConfigMap | string | `"spire-bundle"` | | +| spire-agent.clusterName | string | `"example-cluster"` | | +| spire-agent.configMap.annotations | object | `{}` | Annotations to add to the SPIRE Agent ConfigMap | +| spire-agent.extraContainers | list | `[]` | | +| spire-agent.extraVolumeMounts | list | `[]` | | +| spire-agent.extraVolumes | list | `[]` | | +| spire-agent.fullnameOverride | string | `""` | | +| spire-agent.healthChecks.port | int | `9980` | override the host port used for health checking | +| spire-agent.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| spire-agent.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | +| spire-agent.image.repository | string | `"spiffe/spire-agent"` | The repository within the registry | +| spire-agent.image.version | string | `""` | | +| spire-agent.imagePullSecrets | list | `[]` | | +| spire-agent.initContainers | list | `[]` | | +| spire-agent.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" | +| spire-agent.nameOverride | string | `""` | | +| spire-agent.namespaceOverride | string | `""` | | +| spire-agent.nodeSelector | object | `{}` | | +| spire-agent.podAnnotations | object | `{}` | | +| spire-agent.podSecurityContext | object | `{}` | | +| spire-agent.priorityClassName | string | `""` | Priority class assigned to daemonset pods | +| spire-agent.resources | object | `{}` | | +| spire-agent.securityContext | object | `{}` | | +| spire-agent.server.address | string | `""` | | +| spire-agent.server.namespaceOverride | string | `""` | | +| spire-agent.server.port | int | `8081` | | +| spire-agent.serviceAccount.annotations | object | `{}` | Annotations to add to the service account | +| spire-agent.serviceAccount.create | bool | `true` | Specifies whether a service account should be created | +| spire-agent.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | +| spire-agent.socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent | +| spire-agent.telemetry.prometheus.enabled | bool | `false` | | +| spire-agent.telemetry.prometheus.podMonitor.enabled | bool | `false` | | +| spire-agent.telemetry.prometheus.podMonitor.labels | object | `{}` | | +| spire-agent.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | +| spire-agent.telemetry.prometheus.port | int | `9988` | | +| spire-agent.trustBundleFormat | string | `"pem"` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | +| spire-agent.trustBundleURL | string | `""` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | +| spire-agent.trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers | +| spire-agent.waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| spire-agent.waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from | +| spire-agent.waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry | +| spire-agent.waitForIt.image.version | string | `"latest-20230113"` | | +| spire-agent.waitForIt.resources | object | `{}` | | +| spire-agent.workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped | +| spire-agent.workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor | +| spire-server.affinity | object | `{}` | | +| spire-server.autoscaling.enabled | bool | `false` | | +| spire-server.autoscaling.maxReplicas | int | `100` | | +| spire-server.autoscaling.minReplicas | int | `1` | | +| spire-server.autoscaling.targetCPUUtilizationPercentage | int | `80` | | +| spire-server.bundleConfigMap | string | `"spire-bundle"` | | +| spire-server.caKeyType | string | `"rsa-2048"` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) | +| spire-server.caTTL | string | `"24h"` | | +| spire-server.ca_subject.common_name | string | `"example.org"` | | +| spire-server.ca_subject.country | string | `"NL"` | | +| spire-server.ca_subject.organization | string | `"Example"` | | +| spire-server.clusterDomain | string | `"cluster.local"` | | +| spire-server.clusterName | string | `"example-cluster"` | | +| spire-server.configMap.annotations | object | `{}` | Annotations to add to the SPIRE Server ConfigMap | +| spire-server.controllerManager.configMap.annotations | object | `{}` | Annotations to add to the Controller Manager ConfigMap | +| spire-server.controllerManager.enabled | bool | `false` | | +| spire-server.controllerManager.identities.dnsNameTemplates | list | `[]` | | +| spire-server.controllerManager.identities.enabled | bool | `true` | | +| spire-server.controllerManager.identities.namespaceSelector | object | `{}` | | +| spire-server.controllerManager.identities.podSelector | object | `{}` | | +| spire-server.controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | | +| spire-server.controllerManager.ignoreNamespaces[0] | string | `"kube-system"` | | +| spire-server.controllerManager.ignoreNamespaces[1] | string | `"kube-public"` | | +| spire-server.controllerManager.ignoreNamespaces[2] | string | `"local-path-storage"` | | +| spire-server.controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| spire-server.controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | +| spire-server.controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry | +| spire-server.controllerManager.image.version | string | `"0.2.2"` | | +| spire-server.controllerManager.resources | object | `{}` | | +| spire-server.controllerManager.securityContext | object | `{}` | | +| spire-server.controllerManager.service.annotations | object | `{}` | | +| spire-server.controllerManager.service.port | int | `443` | | +| spire-server.controllerManager.service.type | string | `"ClusterIP"` | | +| spire-server.controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | | +| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from | +| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"chainguard/kubectl"` | The repository within the registry | +| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `"latest"` | | +| spire-server.dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" | +| spire-server.dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" | +| spire-server.dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" | +| spire-server.dataStore.sql.options | list | `[]` | Only used by "postgres" or "mysql" | +| spire-server.dataStore.sql.password | string | `""` | Only used by "postgres" or "mysql" | +| spire-server.dataStore.sql.plugin_data | object | `{}` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section | +| spire-server.dataStore.sql.port | int | `0` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | +| spire-server.dataStore.sql.username | string | `"spire"` | Only used by "postgres" or "mysql" | +| spire-server.defaultJwtSvidTTL | string | `"1h"` | | +| spire-server.defaultX509SvidTTL | string | `"4h"` | | +| spire-server.extraContainers | list | `[]` | | +| spire-server.extraVolumeMounts | list | `[]` | | +| spire-server.extraVolumes | list | `[]` | | +| spire-server.federation.bundleEndpoint.address | string | `"0.0.0.0"` | | +| spire-server.federation.bundleEndpoint.port | int | `8443` | | +| spire-server.federation.enabled | bool | `false` | | +| spire-server.fullnameOverride | string | `""` | | +| spire-server.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| spire-server.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | +| spire-server.image.repository | string | `"spiffe/spire-server"` | The repository within the registry | +| spire-server.image.version | string | `""` | | +| spire-server.imagePullSecrets | list | `[]` | | +| spire-server.initContainers | list | `[]` | | +| spire-server.jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain | +| spire-server.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" | +| spire-server.nameOverride | string | `""` | | +| spire-server.namespaceOverride | string | `""` | | +| spire-server.nodeAttestor.k8sPsat.enabled | bool | `true` | | +| spire-server.nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` | | +| spire-server.nodeSelector | object | `{}` | | +| spire-server.notifier.k8sbundle.namespace | string | `""` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | +| spire-server.persistence.accessMode | string | `"ReadWriteOnce"` | | +| spire-server.persistence.size | string | `"1Gi"` | | +| spire-server.persistence.storageClass | string | `nil` | | +| spire-server.podAnnotations | object | `{}` | | +| spire-server.podSecurityContext | object | `{}` | | +| spire-server.replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | +| spire-server.resources | object | `{}` | | +| spire-server.securityContext | object | `{}` | | +| spire-server.service.annotations | object | `{}` | | +| spire-server.service.port | int | `8081` | | +| spire-server.service.type | string | `"ClusterIP"` | | +| spire-server.serviceAccount.annotations | object | `{}` | Annotations to add to the service account | +| spire-server.serviceAccount.create | bool | `true` | Specifies whether a service account should be created | +| spire-server.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | +| spire-server.telemetry.prometheus.enabled | bool | `false` | | +| spire-server.telemetry.prometheus.podMonitor.enabled | bool | `false` | | +| spire-server.telemetry.prometheus.podMonitor.labels | object | `{}` | | +| spire-server.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server | +| spire-server.tolerations | list | `[]` | | +| spire-server.topologySpreadConstraints | list | `[]` | | +| spire-server.trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers | +| spire-server.upstreamAuthority.certManager.enabled | bool | `false` | | +| spire-server.upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` | | +| spire-server.upstreamAuthority.certManager.issuer_kind | string | `"Issuer"` | | +| spire-server.upstreamAuthority.certManager.issuer_name | string | `"spire-ca"` | | +| spire-server.upstreamAuthority.certManager.kube_config_file | string | `""` | | +| spire-server.upstreamAuthority.certManager.namespace | string | `""` | Specify to use a namespace other then the one the chart is installed into | +| spire-server.upstreamAuthority.certManager.rbac.create | bool | `true` | | +| spire-server.upstreamAuthority.disk.enabled | bool | `false` | | +| spire-server.upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | +| spire-server.upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info | +| spire-server.upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. | ---------------------------------------------- diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index ee8e044..0eb23d9 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -13,20 +13,20 @@ A Helm chart to install the SPIFFE CSI driver. | Key | Type | Default | Description | |-----|------|---------|-------------| -| agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | +| agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent | | fullnameOverride | string | `""` | | | healthChecks.port | int | `9809` | | -| image.pullPolicy | string | `"IfNotPresent"` | | -| image.registry | string | `"ghcr.io"` | | -| image.repository | string | `"spiffe/spiffe-csi-driver"` | | -| image.version | string | `""` | | +| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | +| image.repository | string | `"spiffe/spiffe-csi-driver"` | The repository within the registry | +| image.version | string | `""` | Overrides the image tag whose default is the chart appVersion | | imagePullSecrets | list | `[]` | | | kubeletPath | string | `"/var/lib/kubelet"` | | | nameOverride | string | `""` | | | namespaceOverride | string | `""` | | -| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | -| nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | | -| nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | | +| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | The OCI registry to pull the image from | +| nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | The repository within the registry | | nodeDriverRegistrar.image.version | string | `"v2.6.2"` | | | nodeDriverRegistrar.resources | object | `{}` | | | nodeSelector | object | `{}` | | @@ -37,8 +37,8 @@ A Helm chart to install the SPIFFE CSI driver. | resources | object | `{}` | | | securityContext.privileged | bool | `true` | | | securityContext.readOnlyRootFilesystem | bool | `true` | | -| serviceAccount.annotations | object | `{}` | | -| serviceAccount.create | bool | `true` | | -| serviceAccount.name | string | `""` | | +| serviceAccount.annotations | object | `{}` | Annotations to add to the service account | +| serviceAccount.create | bool | `true` | Specifies whether a service account should be created | +| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | ---------------------------------------------- diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index b1e9d93..5169312 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -2,9 +2,13 @@ pluginName: csi.spiffe.io image: + # -- The OCI registry to pull the image from registry: ghcr.io + # -- The repository within the registry repository: spiffe/spiffe-csi-driver + # -- The image pull policy pullPolicy: IfNotPresent + # -- Overrides the image tag whose default is the chart appVersion version: "" resources: {} # We usually recommend not to specify default resources and to leave this as a conscious @@ -27,11 +31,11 @@ namespaceOverride: "" fullnameOverride: "" serviceAccount: - # Specifies whether a service account should be created + # -- Specifies whether a service account should be created create: true - # Annotations to add to the service account + # -- Annotations to add to the service account annotations: {} - # The name of the service account to use. + # -- The name of the service account to use. # If not set and create is true, a name is generated using the fullname template name: "" @@ -53,8 +57,11 @@ nodeSelector: {} nodeDriverRegistrar: image: + # -- The OCI registry to pull the image from registry: registry.k8s.io + # -- The repository within the registry repository: sig-storage/csi-node-driver-registrar + # -- The image pull policy pullPolicy: IfNotPresent version: v2.6.2 resources: {} @@ -69,6 +76,7 @@ nodeDriverRegistrar: # cpu: 100m # memory: 64Mi +# -- The unix socket path to the spire-agent agentSocketPath: /run/spire/agent-sockets/spire-agent.sock kubeletPath: /var/lib/kubelet diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 3e926ce..ea7627d 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -15,7 +15,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | Key | Type | Default | Description | |-----|------|---------|-------------| | affinity | object | `{}` | | -| agentSocketName | string | `"spire-agent.sock"` | | +| agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket | | autoscaling.enabled | bool | `false` | | | autoscaling.maxReplicas | int | `5` | | | autoscaling.minReplicas | int | `1` | | @@ -28,13 +28,13 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | config.acme.tosAccepted | bool | `false` | | | config.domains[0] | string | `"localhost"` | | | config.domains[1] | string | `"oidc-discovery.example.org"` | | -| config.logLevel | string | `"info"` | | +| config.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" | | configMap.annotations | object | `{}` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | | fullnameOverride | string | `""` | | -| image.pullPolicy | string | `"IfNotPresent"` | | -| image.registry | string | `"ghcr.io"` | | -| image.repository | string | `"spiffe/oidc-discovery-provider"` | | -| image.version | string | `""` | | +| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | +| image.repository | string | `"spiffe/oidc-discovery-provider"` | The repository within the registry | +| image.version | string | `""` | Overrides the image tag whose default is the chart appVersion | | imagePullSecrets | list | `[]` | | | ingress.annotations | object | `{}` | | | ingress.className | string | `""` | | @@ -44,9 +44,9 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | | | ingress.tls | list | `[]` | | | insecureScheme.enabled | bool | `false` | | -| insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | | -| insecureScheme.nginx.image.registry | string | `"docker.io"` | | -| insecureScheme.nginx.image.repository | string | `"nginxinc/nginx-unprivileged"` | | +| insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| insecureScheme.nginx.image.registry | string | `"docker.io"` | The OCI registry to pull the image from | +| insecureScheme.nginx.image.repository | string | `"nginxinc/nginx-unprivileged"` | The repository within the registry | | insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` | | | insecureScheme.nginx.resources | object | `{}` | | | nameOverride | string | `""` | | @@ -60,13 +60,13 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | service.annotations | object | `{}` | | | service.port | int | `80` | | | service.type | string | `"ClusterIP"` | | -| serviceAccount.annotations | object | `{}` | | -| serviceAccount.create | bool | `true` | | -| serviceAccount.name | string | `""` | | +| serviceAccount.annotations | object | `{}` | Annotations to add to the service account | +| serviceAccount.create | bool | `true` | Specifies whether a service account should be created | +| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | | telemetry.prometheus.enabled | bool | `false` | | -| telemetry.prometheus.nginxExporter.image.pullPolicy | string | `"IfNotPresent"` | | -| telemetry.prometheus.nginxExporter.image.registry | string | `"docker.io"` | | -| telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` | | +| telemetry.prometheus.nginxExporter.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| telemetry.prometheus.nginxExporter.image.registry | string | `"docker.io"` | The OCI registry to pull the image from | +| telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` | The repository within the registry | | telemetry.prometheus.nginxExporter.image.version | string | `"0.11.0"` | | | telemetry.prometheus.nginxExporter.resources | object | `{}` | | | telemetry.prometheus.podMonitor.enabled | bool | `false` | | @@ -74,6 +74,6 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider | | telemetry.prometheus.port | int | `9988` | | | tolerations | list | `[]` | | -| trustDomain | string | `"example.org"` | | +| trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers | ---------------------------------------------- diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 8909056..bf829bc 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -2,6 +2,7 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. +# -- The name of the spire-agent unix socket agentSocketName: spire-agent.sock replicaCount: 1 @@ -9,11 +10,13 @@ replicaCount: 1 namespaceOverride: "" image: - # registry: gcr.io - # repository: spiffe-io/oidc-discovery-provider + # -- The OCI registry to pull the image from registry: ghcr.io + # -- The repository within the registry repository: spiffe/oidc-discovery-provider + # -- The image pull policy pullPolicy: IfNotPresent + # -- Overrides the image tag whose default is the chart appVersion version: "" resources: {} @@ -56,8 +59,11 @@ insecureScheme: nginx: image: + # -- The OCI registry to pull the image from registry: docker.io + # -- The repository within the registry repository: nginxinc/nginx-unprivileged + # -- The image pull policy pullPolicy: IfNotPresent version: 1.23.2-alpine # chainguard image does not support the templates feature @@ -79,6 +85,7 @@ insecureScheme: # memory: 64Mi config: + # -- The log level, valid values are "debug", "info", "warn", and "error" logLevel: info domains: - localhost @@ -95,11 +102,11 @@ nameOverride: "" fullnameOverride: "" serviceAccount: - # Specifies whether a service account should be created + # -- Specifies whether a service account should be created create: true - # Annotations to add to the service account + # -- Annotations to add to the service account annotations: {} - # The name of the service account to use. + # -- The name of the service account to use. # If not set and create is true, a name is generated using the fullname template name: "" @@ -116,8 +123,9 @@ tolerations: [] affinity: {} +# -- Set the trust domain to be used for the SPIFFE identifiers trustDomain: example.org -# -- This is the value of your clusters `kubeadm init --service-dns-domain` flag +# -- The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) clusterDomain: cluster.local telemetry: @@ -132,8 +140,11 @@ telemetry: nginxExporter: image: + # -- The OCI registry to pull the image from registry: docker.io + # -- The repository within the registry repository: nginx/nginx-prometheus-exporter + # -- The image pull policy pullPolicy: IfNotPresent version: "0.11.0" diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index ae168fd..a0a5b4d 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -22,13 +22,13 @@ A Helm chart to install the SPIRE agent. | extraVolumes | list | `[]` | | | fullnameOverride | string | `""` | | | healthChecks.port | int | `9980` | override the host port used for health checking | -| image.pullPolicy | string | `"IfNotPresent"` | | -| image.registry | string | `"ghcr.io"` | | -| image.repository | string | `"spiffe/spire-agent"` | | +| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | +| image.repository | string | `"spiffe/spire-agent"` | The repository within the registry | | image.version | string | `""` | | | imagePullSecrets | list | `[]` | | | initContainers | list | `[]` | | -| logLevel | string | `"info"` | | +| logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" | | nameOverride | string | `""` | | | namespaceOverride | string | `""` | | | nodeSelector | object | `{}` | | @@ -40,10 +40,10 @@ A Helm chart to install the SPIRE agent. | server.address | string | `""` | | | server.namespaceOverride | string | `""` | | | server.port | int | `8081` | | -| serviceAccount.annotations | object | `{}` | | -| serviceAccount.create | bool | `true` | | -| serviceAccount.name | string | `""` | | -| socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | +| serviceAccount.annotations | object | `{}` | Annotations to add to the service account | +| serviceAccount.create | bool | `true` | Specifies whether a service account should be created | +| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | +| socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent | | telemetry.prometheus.enabled | bool | `false` | | | telemetry.prometheus.podMonitor.enabled | bool | `false` | | | telemetry.prometheus.podMonitor.labels | object | `{}` | | @@ -51,10 +51,10 @@ A Helm chart to install the SPIRE agent. | telemetry.prometheus.port | int | `9988` | | | trustBundleFormat | string | `"pem"` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | | trustBundleURL | string | `""` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | -| trustDomain | string | `"example.org"` | | -| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | -| waitForIt.image.registry | string | `"cgr.dev"` | | -| waitForIt.image.repository | string | `"chainguard/wait-for-it"` | | +| trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers | +| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from | +| waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry | | waitForIt.image.version | string | `"latest-20230113"` | | | waitForIt.resources | object | `{}` | | | workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped | diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 77fb9f4..2a1f9d1 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -3,10 +3,11 @@ # Declare variables to be passed into your templates. image: - # registry: gcr.io - # repository: spiffe-io/spire-agent + # -- The OCI registry to pull the image from registry: ghcr.io + # -- The repository within the registry repository: spiffe/spire-agent + # -- The image pull policy pullPolicy: IfNotPresent # Overrides the image tag whose default is the chart appVersion. version: "" @@ -17,11 +18,11 @@ namespaceOverride: "" fullnameOverride: "" serviceAccount: - # Specifies whether a service account should be created + # -- Specifies whether a service account should be created create: true - # Annotations to add to the service account + # -- Annotations to add to the service account annotations: {} - # The name of the service account to use. + # -- The name of the service account to use. # If not set and create is true, a name is generated using the fullname template name: "" @@ -56,8 +57,11 @@ resources: {} nodeSelector: {} +# -- The log level, valid values are "debug", "info", "warn", and "error" logLevel: info +# -- The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) clusterName: example-cluster +# -- The trust domain to be used for the SPIFFE identifiers trustDomain: example.org # -- If set, obtain trust bundle from url instead of Kubernetes ConfigMap trustBundleURL: "" @@ -76,8 +80,11 @@ healthChecks: waitForIt: image: + # -- The OCI registry to pull the image from registry: cgr.dev + # -- The repository within the registry repository: chainguard/wait-for-it + # -- The image pull policy pullPolicy: IfNotPresent version: latest-20230113 resources: {} @@ -102,6 +109,7 @@ telemetry: namespace: "" labels: {} +# -- The unix socket path to the spire-agent socketPath: /run/spire/agent-sockets/spire-agent.sock # -- Priority class assigned to daemonset pods diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index ae28a4f..efc2ba5 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -41,9 +41,9 @@ A Helm chart to install the SPIRE server. | controllerManager.ignoreNamespaces[0] | string | `"kube-system"` | | | controllerManager.ignoreNamespaces[1] | string | `"kube-public"` | | | controllerManager.ignoreNamespaces[2] | string | `"local-path-storage"` | | -| controllerManager.image.pullPolicy | string | `"IfNotPresent"` | | -| controllerManager.image.registry | string | `"ghcr.io"` | | -| controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | | +| controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | +| controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry | | controllerManager.image.version | string | `"0.2.2"` | | | controllerManager.resources | object | `{}` | | | controllerManager.securityContext | object | `{}` | | @@ -51,9 +51,9 @@ A Helm chart to install the SPIRE server. | controllerManager.service.port | int | `443` | | | controllerManager.service.type | string | `"ClusterIP"` | | | controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | | -| controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` | | -| controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"cgr.dev"` | | -| controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"chainguard/kubectl"` | | +| controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from | +| controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"chainguard/kubectl"` | The repository within the registry | | controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `"latest"` | | | dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" | | dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" | @@ -72,14 +72,14 @@ A Helm chart to install the SPIRE server. | federation.bundleEndpoint.port | int | `8443` | | | federation.enabled | bool | `false` | | | fullnameOverride | string | `""` | | -| image.pullPolicy | string | `"IfNotPresent"` | | -| image.registry | string | `"ghcr.io"` | | -| image.repository | string | `"spiffe/spire-server"` | | +| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | +| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | +| image.repository | string | `"spiffe/spire-server"` | The repository within the registry | | image.version | string | `""` | | | imagePullSecrets | list | `[]` | | | initContainers | list | `[]` | | -| jwtIssuer | string | `"oidc-discovery.example.org"` | | -| logLevel | string | `"info"` | | +| jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain | +| logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" | | nameOverride | string | `""` | | | namespaceOverride | string | `""` | | | nodeAttestor.k8sPsat.enabled | bool | `true` | | @@ -97,16 +97,16 @@ A Helm chart to install the SPIRE server. | service.annotations | object | `{}` | | | service.port | int | `8081` | | | service.type | string | `"ClusterIP"` | | -| serviceAccount.annotations | object | `{}` | | -| serviceAccount.create | bool | `true` | | -| serviceAccount.name | string | `""` | | +| serviceAccount.annotations | object | `{}` | Annotations to add to the service account | +| serviceAccount.create | bool | `true` | Specifies whether a service account should be created | +| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | | telemetry.prometheus.enabled | bool | `false` | | | telemetry.prometheus.podMonitor.enabled | bool | `false` | | | telemetry.prometheus.podMonitor.labels | object | `{}` | | | telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server | | tolerations | list | `[]` | | | topologySpreadConstraints | list | `[]` | | -| trustDomain | string | `"example.org"` | | +| trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers | | upstreamAuthority.certManager.enabled | bool | `false` | | | upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` | | | upstreamAuthority.certManager.issuer_kind | string | `"Issuer"` | | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index bbf2e0d..2d31c5c 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -6,10 +6,11 @@ replicaCount: 1 image: - # registry: gcr.io - # repository: spiffe-io/spire-server + # -- The OCI registry to pull the image from registry: ghcr.io + # -- The repository within the registry repository: spiffe/spire-server + # -- The image pull policy pullPolicy: IfNotPresent # Overrides the image tag whose default is the chart appVersion. version: "" @@ -20,11 +21,11 @@ namespaceOverride: "" fullnameOverride: "" serviceAccount: - # Specifies whether a service account should be created + # -- Specifies whether a service account should be created create: true - # Annotations to add to the service account + # -- Annotations to add to the service account annotations: {} - # The name of the service account to use. + # -- The name of the service account to use. # If not set and create is true, a name is generated using the fullname template name: "" @@ -102,10 +103,14 @@ dataStore: # -- Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section plugin_data: {} +# -- The log level, valid values are "debug", "info", "warn", and "error" logLevel: info +# -- The JWT issuer domain jwtIssuer: oidc-discovery.example.org +# -- Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) clusterName: example-cluster +# -- Set the trust domain to be used for the SPIFFE identifiers trustDomain: example.org bundleConfigMap: spire-bundle @@ -157,8 +162,11 @@ controllerManager: enabled: false image: + # -- The OCI registry to pull the image from registry: ghcr.io + # -- The repository within the registry repository: spiffe/spire-controller-manager + # -- The image pull policy pullPolicy: IfNotPresent # Overrides the image tag whose default is the chart appVersion. version: "0.2.2" @@ -214,8 +222,11 @@ controllerManager: failurePolicy: Fail upgradeHook: image: + # -- The OCI registry to pull the image from registry: cgr.dev + # -- The repository within the registry repository: chainguard/kubectl + # -- The image pull policy pullPolicy: IfNotPresent version: latest diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index d1978d0..76ca445 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -4,9 +4,9 @@ global: # -- This is the value of your clusters `kubeadm init --service-dns-domain` flag clusterDomain: cluster.local spire: - # -- Set the name of the Kubernetes cluster + # -- The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) clusterName: example-cluster - # -- Set the trust domain to use for the spiffe identifiers + # -- The trust domain to be used for the SPIFFE identifiers trustDomain: example.org # -- Override all instances of bundleConfigMap bundleConfigMap: "" diff --git a/helm-docs.sh b/helm-docs.sh index a41b43f..6c264d7 100755 --- a/helm-docs.sh +++ b/helm-docs.sh @@ -42,5 +42,5 @@ else fi # validate docs -"$SCRIPTPATH/bin/${exe}" +"$SCRIPTPATH/bin/${exe}" --document-dependency-values git diff --exit-code From 8c5643b5f757da4371cfacdf715df7dd134bf8c4 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 12 May 2023 20:19:28 +0200 Subject: [PATCH 32/32] Bump spire Helm Chart version from 0.6.3 to 0.7.0 (#278) Please review the below changelog to ensure this matches up with the semantic version being applied. > **Note**: **Maintainers** ensure to run following after merging this PR to trigger the release workflow: > > ```shell > git checkout main > git pull > git checkout release > git pull > git merge main > git push > ``` **Changes in this release** * 65312f85 Include dependency values in documentation (#275) * 5489212b Remove persistence.enabled flag (#274) * b3153242 Allow for ConfigMaps to be annotated (#272) * 013eb617 Fix spacing for spire server service annotation (#273) * 73435be9 Add project glossary. (#262) * c4656a74 Replicas > 1 is not allowed with sqlite driver (#269) * d3da3eed External database configuration (#225) * ce78bea1 Add Edwin Buck as a maintainer. (#267) * 1f09d7b3 Bump test chart dependencies (#264) * aa6b40c0 Add project overview. (#258) * 8e7e6ebc Allow trust bundle url to be set along with format (#256) * 1e09ea54 Bump peter-evans/create-pull-request from 5.0.0 to 5.0.1 (#253) * 6760cd22 Bump test chart dependencies (#252) * 61e338df Fix example production typos (#244) * 3d81928f Add skipKubeletVerification configurable (#243) * 46f10e1d Merge pull request #237 from spiffe/fix-check-versions * 3889d22e Fix quotation bug in update-version.sh * 6a894e8c Move update-versions.sh script * 91083a6b Add post-install scripts to all tests to capture failure details in GitHub workflow summary (#88) * 9afb6f80 Merge pull request #242 from spiffe/shellcheck * 99af475f Resolve shellcheck issues * d0a1e128 Add workflow with shellcheck * 8abd75ef Merge pull request #241 from spiffe/dependabot/github_actions/sigstore/cosign-installer-3.0.3 * 252f1f5a Bump cosign to v2.0.2 * 247e3e5d Bump sigstore/cosign-installer from 3.0.2 to 3.0.3 * 17d62f12 Add an action to find new versions of helm charts (#184) * 2c360a50 Add global for image registry (#201) * 3cc89554 Move reusable macros to root chart (#218) * 3fc81780 Add k8s 1.27 to CI + bump other versions to latest patches (#219) * 6b617440 Merge pull request #113 from spiffe/spire-config-as-yaml-converted-json * 9e03f297 Merge branch 'main' into spire-config-as-yaml-converted-json * 210ed02c Remove dead code (#217) * e3b0d00b Bump min required spire 1.6.x version for this chart * d7dcfeb6 Change spiffe-oidc-provider-config configmap to yaml format * 861108c0 Change spire-agent configmap to yaml format * 1d72b572 Change spire-server configmap to yaml format Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 419d2a8..62af05f 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -3,7 +3,7 @@ name: spire description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.6.3 +version: 0.7.0 appVersion: "1.6.3" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire diff --git a/charts/spire/README.md b/charts/spire/README.md index 8670d07..e77bf5c 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -2,7 +2,7 @@ -![Version: 0.6.3](https://img.shields.io/badge/Version-0.6.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.3](https://img.shields.io/badge/AppVersion-1.6.3-informational?style=flat-square) +![Version: 0.7.0](https://img.shields.io/badge/Version-0.7.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.3](https://img.shields.io/badge/AppVersion-1.6.3-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.