Add a test and example for federation support (#169)
* SPIFFE OIDC Discovery Provider Rework Fixes: https://github.com/spiffe/helm-charts-hardened/issues/151 Signed-off-by: Kevin Fox <[email protected]> * Enhance clusterspiffeid's so the discovery provider is independently configurable Signed-off-by: Kevin Fox <[email protected]> * Fix tests Signed-off-by: Kevin Fox <[email protected]> * More fix tests Signed-off-by: Kevin Fox <[email protected]> * More fix tests Signed-off-by: Kevin Fox <[email protected]> * Undo Signed-off-by: Kevin Fox <[email protected]> * Fix logging Signed-off-by: Kevin Fox <[email protected]> * Try to get output Signed-off-by: Kevin Fox <[email protected]> * Try and get error code Signed-off-by: Kevin Fox <[email protected]> * Fix more logging. Switch port used. Signed-off-by: Kevin Fox <[email protected]> * Fix logging Signed-off-by: Kevin Fox <[email protected]> * Fix port Signed-off-by: Kevin Fox <[email protected]> * Fix up logs for nested test and fix values Signed-off-by: Kevin Fox <[email protected]> * Make consistent Signed-off-by: Kevin Fox <[email protected]> * Fix nested test Signed-off-by: Kevin Fox <[email protected]> * Fix insecure mode and test. Signed-off-by: Kevin Fox <[email protected]> * Fix test. Signed-off-by: Kevin Fox <[email protected]> * Fix var scoping issue Signed-off-by: Kevin Fox <[email protected]> * Set the right flags for ingress Signed-off-by: Kevin Fox <[email protected]> * Update dns template Signed-off-by: Kevin Fox <[email protected]> * Use more standard port Signed-off-by: Kevin Fox <[email protected]> * Fix test logging Signed-off-by: Kevin Fox <[email protected]> * Allow reencrypt. Signed-off-by: Kevin Fox <[email protected]> * Remove testing changes Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Add LetsEncrypt/ACME/cert-manager support. Remove broken ACME support. Signed-off-by: Kevin Fox <[email protected]> * Use spiffe-helper as a sidecar. Significant space savings and read only cert dir Signed-off-by: Kevin Fox <[email protected]> * Fix the nested test Signed-off-by: Kevin Fox <[email protected]> * Fix merge issue Signed-off-by: Kevin Fox <[email protected]> * Remove 1.29.0 until deps catch up. Related issue: https://github.com/rancher/kubectl/pull/94 Signed-off-by: Kevin Fox <[email protected]> * Add more error checking Signed-off-by: Kevin Fox <[email protected]> * Remove testing code Signed-off-by: Kevin Fox <[email protected]> * Simplify the ids. Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix logic Signed-off-by: Kevin Fox <[email protected]> * Fix var Signed-off-by: Kevin Fox <[email protected]> * Make cert-manager bits more readable Signed-off-by: Kevin Fox <[email protected]> * Fix template Signed-off-by: Kevin Fox <[email protected]> * Fix openshift ingress Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> * Add resource spec Signed-off-by: Kevin Fox <[email protected]> * Remove parts that cant merge yet Signed-off-by: Kevin Fox <[email protected]> * Fix tests Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Add missing configurable for the discovery providers csi driver Signed-off-by: Kevin Fox <[email protected]> * Add a test and example for federation support Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix ingress annotations for federation bundle endpoint Signed-off-by: Kevin Fox <[email protected]> * Add cert-manager support to the federation bundle endpoint and fix up bundle endpoint ingress annotations Signed-off-by: Kevin Fox <[email protected]> * Add external secret too Signed-off-by: Kevin Fox <[email protected]> * Add forgotten files Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -0,0 +1,50 @@
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: server
|
||||
labels:
|
||||
app.kubernetes.io/name: server
|
||||
spec:
|
||||
containers:
|
||||
- name: nginx
|
||||
image: nginx
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
cat > /etc/nginx/conf.d/default.conf <<EOF
|
||||
server {
|
||||
listen 127.0.0.1:8080;
|
||||
server_name localhost;
|
||||
location / {
|
||||
root /usr/share/nginx/html;
|
||||
index index.html index.htm;
|
||||
}
|
||||
}
|
||||
EOF
|
||||
echo Hi there > /usr/share/nginx/html/index.html
|
||||
exec nginx -g "daemon off;"
|
||||
- name: ghostunnel
|
||||
image: ghostunnel/ghostunnel:v1.7.2
|
||||
command:
|
||||
- ghostunnel
|
||||
- server
|
||||
- --use-workload-api-addr
|
||||
- unix:/spire-workload-api/spire-agent.sock
|
||||
- --listen
|
||||
- 0.0.0.0:8443
|
||||
- --target
|
||||
- localhost:8080
|
||||
- --allow-uri
|
||||
- spiffe://a-org.local/ns/default/sa/default
|
||||
volumeMounts:
|
||||
- name: agent
|
||||
mountPath: /spire-workload-api
|
||||
readOnly: true
|
||||
ports:
|
||||
- containerPort: 8443
|
||||
volumes:
|
||||
- name: agent
|
||||
csi:
|
||||
driver: b.csi.spiffe.io
|
||||
readOnly: true
|
||||
Reference in New Issue
Block a user