Add optional topologySpreadConstraints to the spiffe-oidc-discovery-provider
Deployment, matching the pattern used by spire-server and the spike-* charts.
Signed-off-by: Michael Munch <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
The gcp_cas built-in plugin was not wired into the spire-server chart.
This adds values, configmap rendering, and generated docs to support
GCP Certificate Authority Service as an upstream authority, matching
the existing awsPCA pattern.
Signed-off-by: saumil Macwan <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
* Allow sqlite3 in memory when kind is deployment
Signed-off-by: Daniel Schlatter <[email protected]>
* Warn on unsafe in-memory datastore combinations
Signed-off-by: Daniel Schlatter <[email protected]>
---------
Signed-off-by: Daniel Schlatter <[email protected]>
The spire-config volume (agent.conf) hardcodes
{{ include "spire-agent.fullname" . }} with no $nameSuffix, unlike
every other per-profile resource this chart renders (the ConfigMap
itself, the trust-bundle volume, the DaemonSet name). Any additional
agents.<name> profile's DaemonSet therefore silently mounts the
default profile's agent.conf, regardless of what's configured under
that profile -- workloadAttestors, customPlugins, anything.
Confirmed via a real cluster: an agents.gvisor profile's
disableContainerSelectors never took effect because its DaemonSet was
mounting the default spire-agent ConfigMap the whole time, not
spire-agent-gvisor (which rendered correctly, just was never read).
Verified via `helm template`: additional profiles now get their own
correctly-suffixed ConfigMap reference, matching the DaemonSet's own
name and the trust-bundle volume's existing (correct) behavior.
Signed-off-by: dmorris <[email protected]>
Co-authored-by: dmorris <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
Add jwtSVIDExec as a fourth exactly-one kubeConfigs source: the chart
generates an exec-credential kubeconfig that authenticates to an external
cluster with short-lived SPIFFE JWT-SVIDs instead of a static credential.
Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
* Add PodDisruptionBudget support to spire-server
Signed-off-by: David Mosyan <[email protected]>
* Revert spire-ha-agent changes and set default pdb value for spire-server
Signed-off-by: David Mosyan <[email protected]>
---------
Signed-off-by: David Mosyan <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
* feat(spire-server): support x509pop externalPKI ca bundle
Add externalPKI mode support to the x509pop node attestor configuration.
Allows operators to configure CA bundles for external PKI-based node
attestation via two approaches:
- Inline PEM content (chart creates and manages ConfigMap)
- Reference to existing ConfigMap with ca-bundle.pem key
Includes volume/volumeMount definitions for CA bundle mounting at
/run/spire/data/x509pop-ca-bundle.pem and unit tests for both modes.
Signed-off-by: Savitha Ganapathi <[email protected]>
* refactor: simplify x509pop externalPKI template guard logic
Remove nested conditional guard for ca_bundle_path rendering. When
externalPKI mode is enabled, ca_bundle_path is always rendered; if no
CA bundle is provided, SPIRE will fail at startup with a clear error.
Drop unit tests pending fix to the unit test framework (which currently
has issues loading values from chart, forcing overly-defensive template
guards for test compatibility). Tests can be re-added once framework is
fixed.
Signed-off-by: Savitha Ganapathi <[email protected]>
* refactor: simplify x509pop volume/volumeMount guard logic
Remove nested caBundle existence checks from volume and volumeMount
guard conditions. When externalPKI mode is enabled, volume/volumeMount
are created; if no CA bundle is provided, SPIRE fails at startup with
clear error (missing mount).
Signed-off-by: Savitha Ganapathi <[email protected]>
* refactor: reorder if/with clauses for clarity
Move if condition checks to outer scope before entering with blocks.
This is more idiomatic Helm pattern and avoids unnecessary context
switching if condition fails.
Signed-off-by: Savitha Ganapathi <[email protected]>
* refactor: simplify conditionals to match chart patterns
Replace complex toString/eq comparisons with simpler boolean checks that
match existing patterns in the chart (e.g., federation.tls.certManager.enabled).
Changes:
- .enabled checks: remove toString wrapping, use simple boolean test
- .mode checks: remove toString, use simple eq comparison
- .caBundle checks: simplify from 'ne (... | default "") ""' to simple boolean test
This aligns with chart conventions and avoids tripping broken unit test
framework that struggles with complex conditionals.
Signed-off-by: Savitha Ganapathi <[email protected]>
* test: resurrect x509POP unit tests with simplified conditionals
Re-add unit tests for externalPKI mode now that template conditionals
have been simplified to match chart patterns. Simplified conditionals
should be less fragile with unit test framework.
Tests cover:
- externalPKI with chart-managed CA bundle (inline)
- externalPKI with existing ConfigMap reference
Signed-off-by: Savitha Ganapathi <[email protected]>
* docs: regenerate spire-server README for x509pop caBundle params
Updated parameter documentation for nodeAttestor.x509POP section to
include new caBundle configuration options (inline bundle and existing
ConfigMap reference).
Auto-generated documentation based on @param comments in values.yaml.
Signed-off-by: Savitha Ganapathi <[email protected]>
---------
Signed-off-by: Savitha Ganapathi <[email protected]>
Co-authored-by: Savitha Ganapathi <[email protected]>
* Expose filterByClassName setting to restrict the controller manager's ClusterSPIFFEID cache by class name, defaulting to false for backward compatibility.
Signed-off-by: Joel Goh <[email protected]>
* Shorten filterByClassName param descriptions and regenerate README.
Signed-off-by: Joel Goh <[email protected]>
---------
Signed-off-by: Joel Goh <[email protected]>
Co-authored-by: Joel Goh <[email protected]>
Replace the hardcoded `User: spire-root` subject with an `externalServerSubject`
block (`kind`/`name`/`namespace`) so the downstream RBAC can bind to a User,
Group, or ServiceAccount. Defaults preserve the previous behavior.
Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
* Gateway api support
Signed-off-by: Kevin Fox <[email protected]>
* Update readme
Signed-off-by: Kevin Fox <[email protected]>
* Fix gateway name. a gateway doesnt need to be named gateway
Signed-off-by: Kevin Fox <[email protected]>
* Fix naming issue
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
* Adds a changed-charts script to detect charts needing release
Shows charts where a release needs to be made, and in what order.
Example:
$ ./scripts/changed-charts.py
spire-lib
spire-identity-exchange
spire
spire-nested
Signed-off-by: Kevin Fox <[email protected]>
* Add deps that will change
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Allow each kubeConfigs entry to reference an externally-managed Secret
(externalSecret{name,key}) instead of embedding the kubeconfig in values.
Entries may reference different Secrets and mix inline with external ones.
The kubeconfigs volume becomes a projected volume; consumer mount paths are
unchanged. Each entry must set exactly one of kubeConfig, kubeConfigBase64,
or externalSecret.
Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
* Broker updates
Signed-off-by: Kevin Fox <[email protected]>
* Fix broker permission when running as nonroot
Signed-off-by: Kevin Fox <[email protected]>
* Fix broker permission when running as nonroot
Signed-off-by: Kevin Fox <[email protected]>
* Add workload attestor config
Signed-off-by: Kevin Fox <[email protected]>
* Add workload attestor config
Signed-off-by: Kevin Fox <[email protected]>
* Bump versions
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
* Update spire-identity-exchange version
Signed-off-by: Kevin Fox <[email protected]>
* Update spire-identity-exchange version
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
* Automatically label clusterspiffeids with their class name
Signed-off-by: Kevin Fox <[email protected]>
* Automatically label clusterspiffeids with their class name
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* SPIRE Agent support for Broker API
Signed-off-by: Kevin Fox <[email protected]>
* SPIRE Agent support for Broker API
Signed-off-by: Kevin Fox <[email protected]>
* SPIRE Agent support for Broker API
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-agent/templates/configmap.yaml
Co-authored-by: Matheus Pimenta <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
* Remove the istio entry
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Matheus Pimenta <[email protected]>
Add support for the EJBCA UpstreamAuthority plugin, allowing the SPIRE
server to use an EJBCA instance as its upstream CA over mTLS.
- Add upstreamAuthority.ejbca values (hostname, caName, endEntityProfileName,
certificateProfileName, optional endEntityName and accountBindingId).
- Render the ejbca UpstreamAuthority block in the server config and count it
toward the single-upstream-authority guard.
- Mount the mTLS client credentials (and optional CA cert) from a secret,
either chart-created (secret.create) or externally provided.
- Gate ca_cert_path on secret.data.caCert, mirroring the disk plugin's bundle
handling for deterministic rendering.
- Regenerate the chart README and add a unit render test.
Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
* Enable easy plugin loading
customPluings have to be loaded into the main container somehow. Extend
the existing cel plugin loader to allow users to easily specify an image
to load it from.
Signed-off-by: Kevin Fox <[email protected]>
* Add some missing bits
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Fix formatting
Signed-off-by: Kevin Fox <[email protected]>
* Fix formatting
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
