Render Gateway spec.infrastructure (labels/annotations) so Gateway API
controllers propagate the metadata onto the provisioned Service/Deployment,
e.g. AWS internal NLB annotations. Purely additive: guarded by `with`, so
the default {} renders no change.
- spire-lib: toYaml passthrough in the shared Gateway helper
- spire, spire-nested: add the values param; regenerate READMEs
- tests/unit: cover the positive passthrough case
Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
The PodMonitor targeted the port name prom-cm, but controller-manager
containers expose pm-cm (and auto-suffixed/overridable names for external
managers), so their metrics were never scraped. Resolve port names through
a shared helper and enumerate every controller-manager in the PodMonitor.
Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
* README.md version match check
Signed-off-by: Kevin Fox <[email protected]>
* Fix existing version issues
Signed-off-by: Kevin Fox <[email protected]>
* Fix existing version issues
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
* fix(spire-server): support postgres TLS client-certificate (passwordless) auth
The postgres datastore always injected a password into the connection
string, always created the -dbpw Secret, and always set the DBPW env var,
with no way to use TLS client-certificate (or IAM) authentication. This
forced a dummy password (e.g. "unused") when authenticating with certs.
- Map dataStore.sql.rootCAPath / clientCertPath / clientKeyPath to the
postgres connection-string options sslrootcert / sslcert / sslkey
(previously these were mysql-only and rejected for postgres). MySQL keeps
using the root_ca_path / client_cert_path / client_key_path plugin fields,
now correctly gated to mysql/aws_mysql only.
- For postgres/aws_postgres, when dataStore.sql.password is empty, omit
"password=${DBPW}" from the connection string and skip creating the -dbpw
Secret and the DBPW/RODBPW env vars (mirrors the existing gcp_mysql_sa_iam
passwordless behavior).
- Add a guard: for postgres, dataStore.sql.password and clientCertPath are
mutually exclusive.
- Fix a stray tab in the mysql client_key_path config field.
- Update value docs and regenerate the README.
Existing configurations with a password set are unaffected.
Signed-off-by: Michael Munch <[email protected]>
* 🐛 fix(spire-server): keep postgres password when external secret is used
The postgres passwordless path keyed only on an empty password, so
enabling dataStore.sql.externalSecret (or readOnly.externalSecret) with
an empty password dropped the password token from the connection string
and skipped the DBPW/RODBPW env vars, breaking external-secret auth.
- Add shared passwordless predicates that also require external secrets
to be disabled, evaluated independently for read-write and read-only.
- Use the predicates in datastore-config, secret.yaml, and
server-resource.yaml so the gating cannot drift.
- Add unit tests for postgres with read-write and read-only external
secrets plus the cert-auth passwordless case.
Signed-off-by: Michael Munch <[email protected]>
* 🔁 ci: re-trigger checks
Re-run CI; the previous spiffe-step-ssh integration job failed on an
unrelated flaky SSH host-key verification on k8s v1.35.1 (passed on
v1.33.7 and v1.34.3).
Signed-off-by: Michael Munch <[email protected]>
---------
Signed-off-by: Michael Munch <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
* fix(spiffe-oidc-discovery-provider): run under restricted PSA/SCC on OpenShift
The OIDC discovery provider does not require any elevated privileges: it
runs fine under OpenShift's built-in restricted-v2 SCC (non-root, no
privilege escalation, all capabilities dropped, RuntimeDefault seccomp,
read-only root filesystem) and mounts only restricted-compatible volumes
(csi, configMap, emptyDir, secret, projected, downwardAPI).
Despite this, on OpenShift the chart:
- downgraded the spire-server namespace from restricted to privileged PSA
whenever the OIDC provider was enabled, and
- created a fully privileged SecurityContextConstraints (host network/IPC/
PID, privileged container, hostPath, arbitrary seccomp, RunAsAny) bound
to the provider's ServiceAccount.
Both contradict the chart's own Namespaces documentation, which specifies
restricted PSA for spire-server, and violate least privilege for an
internet-facing OIDC endpoint.
Remove the privileged PSA override for the OIDC provider (spire-server
stays restricted; the scc.podSecurityLabelSync=false label is retained)
and drop the privileged SCC so the provider falls through to restricted-v2.
With spire-server enforcing restricted PSA, the inline-CSI PodSecurity
check reads the cluster-scoped CSIDriver's
security.openshift.io/csi-ephemeral-volume-profile label. If the CSIDriver
is not committed before the spire-server StatefulSet (which mounts the
inline upstream.csi.spiffe.io volume) is admitted, the profile defaults to
privileged and admission is denied. Under ArgoCD the CSIDriver and the
server StatefulSet can land in the same sync wave, racing admission.
Annotate the CSIDriver with argocd.argoproj.io/sync-wave: "-1" (OpenShift
only) so it is applied before the default-wave server workloads; the
annotation is inert for plain helm installs.
Signed-off-by: Michael Munch <[email protected]>
* ✨ make CSIDriver sync-wave ordering configurable
Add syncWave and csiDriverAnnotations values to the spiffe-csi-driver
chart so the OpenShift argocd.argoproj.io/sync-wave annotation number
can be overridden (e.g. when the chart is nested) and arbitrary
annotations can be applied to the CSIDriver.
Signed-off-by: Michael Munch <[email protected]>
---------
Signed-off-by: Michael Munch <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
Add optional topologySpreadConstraints to the spiffe-oidc-discovery-provider
Deployment, matching the pattern used by spire-server and the spike-* charts.
Signed-off-by: Michael Munch <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
The gcp_cas built-in plugin was not wired into the spire-server chart.
This adds values, configmap rendering, and generated docs to support
GCP Certificate Authority Service as an upstream authority, matching
the existing awsPCA pattern.
Signed-off-by: saumil Macwan <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
* Allow sqlite3 in memory when kind is deployment
Signed-off-by: Daniel Schlatter <[email protected]>
* Warn on unsafe in-memory datastore combinations
Signed-off-by: Daniel Schlatter <[email protected]>
---------
Signed-off-by: Daniel Schlatter <[email protected]>
The spire-config volume (agent.conf) hardcodes
{{ include "spire-agent.fullname" . }} with no $nameSuffix, unlike
every other per-profile resource this chart renders (the ConfigMap
itself, the trust-bundle volume, the DaemonSet name). Any additional
agents.<name> profile's DaemonSet therefore silently mounts the
default profile's agent.conf, regardless of what's configured under
that profile -- workloadAttestors, customPlugins, anything.
Confirmed via a real cluster: an agents.gvisor profile's
disableContainerSelectors never took effect because its DaemonSet was
mounting the default spire-agent ConfigMap the whole time, not
spire-agent-gvisor (which rendered correctly, just was never read).
Verified via `helm template`: additional profiles now get their own
correctly-suffixed ConfigMap reference, matching the DaemonSet's own
name and the trust-bundle volume's existing (correct) behavior.
Signed-off-by: dmorris <[email protected]>
Co-authored-by: dmorris <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
Add jwtSVIDExec as a fourth exactly-one kubeConfigs source: the chart
generates an exec-credential kubeconfig that authenticates to an external
cluster with short-lived SPIFFE JWT-SVIDs instead of a static credential.
Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
* Add PodDisruptionBudget support to spire-server
Signed-off-by: David Mosyan <[email protected]>
* Revert spire-ha-agent changes and set default pdb value for spire-server
Signed-off-by: David Mosyan <[email protected]>
---------
Signed-off-by: David Mosyan <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
* feat(spire-server): support x509pop externalPKI ca bundle
Add externalPKI mode support to the x509pop node attestor configuration.
Allows operators to configure CA bundles for external PKI-based node
attestation via two approaches:
- Inline PEM content (chart creates and manages ConfigMap)
- Reference to existing ConfigMap with ca-bundle.pem key
Includes volume/volumeMount definitions for CA bundle mounting at
/run/spire/data/x509pop-ca-bundle.pem and unit tests for both modes.
Signed-off-by: Savitha Ganapathi <[email protected]>
* refactor: simplify x509pop externalPKI template guard logic
Remove nested conditional guard for ca_bundle_path rendering. When
externalPKI mode is enabled, ca_bundle_path is always rendered; if no
CA bundle is provided, SPIRE will fail at startup with a clear error.
Drop unit tests pending fix to the unit test framework (which currently
has issues loading values from chart, forcing overly-defensive template
guards for test compatibility). Tests can be re-added once framework is
fixed.
Signed-off-by: Savitha Ganapathi <[email protected]>
* refactor: simplify x509pop volume/volumeMount guard logic
Remove nested caBundle existence checks from volume and volumeMount
guard conditions. When externalPKI mode is enabled, volume/volumeMount
are created; if no CA bundle is provided, SPIRE fails at startup with
clear error (missing mount).
Signed-off-by: Savitha Ganapathi <[email protected]>
* refactor: reorder if/with clauses for clarity
Move if condition checks to outer scope before entering with blocks.
This is more idiomatic Helm pattern and avoids unnecessary context
switching if condition fails.
Signed-off-by: Savitha Ganapathi <[email protected]>
* refactor: simplify conditionals to match chart patterns
Replace complex toString/eq comparisons with simpler boolean checks that
match existing patterns in the chart (e.g., federation.tls.certManager.enabled).
Changes:
- .enabled checks: remove toString wrapping, use simple boolean test
- .mode checks: remove toString, use simple eq comparison
- .caBundle checks: simplify from 'ne (... | default "") ""' to simple boolean test
This aligns with chart conventions and avoids tripping broken unit test
framework that struggles with complex conditionals.
Signed-off-by: Savitha Ganapathi <[email protected]>
* test: resurrect x509POP unit tests with simplified conditionals
Re-add unit tests for externalPKI mode now that template conditionals
have been simplified to match chart patterns. Simplified conditionals
should be less fragile with unit test framework.
Tests cover:
- externalPKI with chart-managed CA bundle (inline)
- externalPKI with existing ConfigMap reference
Signed-off-by: Savitha Ganapathi <[email protected]>
* docs: regenerate spire-server README for x509pop caBundle params
Updated parameter documentation for nodeAttestor.x509POP section to
include new caBundle configuration options (inline bundle and existing
ConfigMap reference).
Auto-generated documentation based on @param comments in values.yaml.
Signed-off-by: Savitha Ganapathi <[email protected]>
---------
Signed-off-by: Savitha Ganapathi <[email protected]>
Co-authored-by: Savitha Ganapathi <[email protected]>
* Expose filterByClassName setting to restrict the controller manager's ClusterSPIFFEID cache by class name, defaulting to false for backward compatibility.
Signed-off-by: Joel Goh <[email protected]>
* Shorten filterByClassName param descriptions and regenerate README.
Signed-off-by: Joel Goh <[email protected]>
---------
Signed-off-by: Joel Goh <[email protected]>
Co-authored-by: Joel Goh <[email protected]>
Replace the hardcoded `User: spire-root` subject with an `externalServerSubject`
block (`kind`/`name`/`namespace`) so the downstream RBAC can bind to a User,
Group, or ServiceAccount. Defaults preserve the previous behavior.
Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
* Gateway api support
Signed-off-by: Kevin Fox <[email protected]>
* Update readme
Signed-off-by: Kevin Fox <[email protected]>
* Fix gateway name. a gateway doesnt need to be named gateway
Signed-off-by: Kevin Fox <[email protected]>
* Fix naming issue
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
* Adds a changed-charts script to detect charts needing release
Shows charts where a release needs to be made, and in what order.
Example:
$ ./scripts/changed-charts.py
spire-lib
spire-identity-exchange
spire
spire-nested
Signed-off-by: Kevin Fox <[email protected]>
* Add deps that will change
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Allow each kubeConfigs entry to reference an externally-managed Secret
(externalSecret{name,key}) instead of embedding the kubeconfig in values.
Entries may reference different Secrets and mix inline with external ones.
The kubeconfigs volume becomes a projected volume; consumer mount paths are
unchanged. Each entry must set exactly one of kubeConfig, kubeConfigBase64,
or externalSecret.
Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
panxiao81
Kevin Fox