Commit Graph
78 Commits
Author SHA1 Message Date
kfox1111 07a1c391b2 Add global override for kubectl tag (#251) 2024-02-19 20:18:31 +01:00
kfox1111andFaisal Memon af155c2edc Add support for running spiffe secured discovery provider (default) (#163)
* SPIFFE OIDC Discovery Provider Rework

Fixes: https://github.com/spiffe/helm-charts-hardened/issues/151

Signed-off-by: Kevin Fox <[email protected]>

* Enhance clusterspiffeid's so the discovery provider is independently configurable

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Undo

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Try to get output

Signed-off-by: Kevin Fox <[email protected]>

* Try and get error code

Signed-off-by: Kevin Fox <[email protected]>

* Fix more logging. Switch port used.

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Fix port

Signed-off-by: Kevin Fox <[email protected]>

* Fix up logs for nested test and fix values

Signed-off-by: Kevin Fox <[email protected]>

* Make consistent

Signed-off-by: Kevin Fox <[email protected]>

* Fix nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix insecure mode and test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var scoping issue

Signed-off-by: Kevin Fox <[email protected]>

* Set the right flags for ingress

Signed-off-by: Kevin Fox <[email protected]>

* Update dns template

Signed-off-by: Kevin Fox <[email protected]>

* Use more standard port

Signed-off-by: Kevin Fox <[email protected]>

* Fix test logging

Signed-off-by: Kevin Fox <[email protected]>

* Allow reencrypt.

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing changes

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Add LetsEncrypt/ACME/cert-manager support. Remove broken ACME support.

Signed-off-by: Kevin Fox <[email protected]>

* Use spiffe-helper as a sidecar. Significant space savings and read only cert dir

Signed-off-by: Kevin Fox <[email protected]>

* Fix the nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge issue

Signed-off-by: Kevin Fox <[email protected]>

* Remove 1.29.0 until deps catch up.

Related issue: https://github.com/rancher/kubectl/pull/94

Signed-off-by: Kevin Fox <[email protected]>

* Add more error checking

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing code

Signed-off-by: Kevin Fox <[email protected]>

* Simplify the ids. Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix logic

Signed-off-by: Kevin Fox <[email protected]>

* Fix var

Signed-off-by: Kevin Fox <[email protected]>

* Make cert-manager bits more readable

Signed-off-by: Kevin Fox <[email protected]>

* Fix template

Signed-off-by: Kevin Fox <[email protected]>

* Fix openshift ingress

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Add resource spec

Signed-off-by: Kevin Fox <[email protected]>

* Remove parts that cant merge yet

Signed-off-by: Kevin Fox <[email protected]>

* Add support for running spiffe secured discovery provider (default)

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Remove defaults

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Add missing configurable for the discovery providers csi driver

Signed-off-by: Kevin Fox <[email protected]>

* Update for changes in spiffe-helper

Signed-off-by: Kevin Fox <[email protected]>

* Point at upstream

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2024-01-18 16:08:22 -08:00
kfox1111andMarco Franssen c39dd44526 Add recommendation for namespacePSS (#131)
Co-authored-by: Marco Franssen <[email protected]>
2023-12-21 00:15:56 +00:00
kfox1111andMarco Franssen 49beb64584 Add recommendation for namespaceLayout (#127)
Co-authored-by: Marco Franssen <[email protected]>
2023-12-19 15:02:57 +00:00
kfox1111 33cacd2ee8 Add recommendation for prometheus exporter (#144) 2023-12-19 11:38:20 +00:00
kfox1111andMarco Franssen 6997d6a904 Add recommendation for securityContext and podSecurityContext (#125)
Co-authored-by: Marco Franssen <[email protected]>
2023-12-19 11:26:26 +00:00
kfox1111 50c4ac35b0 Add recommendation for strictMode (#143) 2023-12-19 12:12:53 +01:00
kfox1111andFaisal Memon e35838c309 Add recommendation for priorityClass (#124)
* Add a flag to enable recommendations

Signed-off-by: Kevin Fox <[email protected]>

* Add recommendation for priorityClass

Signed-off-by: Kevin Fox <[email protected]>

* Fix vars

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs. Fix typo.

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-12-11 11:42:40 -08:00
kfox1111andFaisal Memon 3e8335c0ee Add a flag to enable recommendations (#121)
* Add a flag to enable recommendations

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge issue

Signed-off-by: Kevin Fox <[email protected]>

* Update after reaching consensus.

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-12-02 05:15:32 -08:00
8422b8d141 Added ability to create namespaces (#103)
* Added ability to create namespaces

Signed-off-by: Andrew Block <[email protected]>

* Add openshift labels

Signed-off-by: Mariusz Sabath <[email protected]>

---------

Signed-off-by: Andrew Block <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
2023-12-01 15:42:27 +00:00
f2758a8b2b Autogen jwtIssuer (#88)
* Autogen jwtIssuer

Unset a default for jwtIssuer and global.spire.jwtIssuer. When unset,
generate it to the default of oidc-discovery.$trustDomain so in many
cases the user doesn't need to set it at all.

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-11-09 20:31:48 +00:00
81cc2dc573 Ingress type openshift (#52)
* Specify ingress controller type

Signed-off-by: Kevin Fox <[email protected]>

* Fix indenting, docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix spacing

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Add ingress-nginx support

Signed-off-by: Kevin Fox <[email protected]>

* Use the right example values for test version to upgrade from.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var in wrong location

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing arg

Signed-off-by: Kevin Fox <[email protected]>

* Try this to checkout the right version

Signed-off-by: Kevin Fox <[email protected]>

* Switch to upgrading from 0.14.0

Signed-off-by: Kevin Fox <[email protected]>

* Install crds

Signed-off-by: Kevin Fox <[email protected]>

* Simple ingress support

For a lot of situations, ingress rules can be derived from trustDomain.
Change the code to generate rules by default for the user.

Signed-off-by: Kevin Fox <[email protected]>

* Add upgrade test fix from 43

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Enable unset ingress controller type to use with openshift later

Signed-off-by: Kevin Fox <[email protected]>

* Openshift ingress controller type support

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing end tag

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Fix doc merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Fix automatically generated rules on openshift

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Fix pathType

Signed-off-by: Kevin Fox <[email protected]>

* Make openshift edge rules work

Signed-off-by: Kevin Fox <[email protected]>

* Fix var scoping

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix issue created during merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
2023-11-03 13:16:14 -07:00
kfox1111andFaisal Memon 7924323a8f Specify ingress controller type (#43)
* Specify ingress controller type

Signed-off-by: Kevin Fox <[email protected]>

* Fix indenting, docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix spacing

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Add ingress-nginx support

Signed-off-by: Kevin Fox <[email protected]>

* Use the right example values for test version to upgrade from.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var in wrong location

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing arg

Signed-off-by: Kevin Fox <[email protected]>

* Try this to checkout the right version

Signed-off-by: Kevin Fox <[email protected]>

* Switch to upgrading from 0.14.0

Signed-off-by: Kevin Fox <[email protected]>

* Install crds

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Enable unset ingress controller type to use with openshift later

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs after merge issue

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-10-24 20:18:53 +00:00
kfox1111 50825d9fc9 Deny production runs of example.org trust domains (#229) 2023-09-25 12:06:48 -07:00
65d56957de Migrate to readme-generator for helm maintained by bitnami (#431)
Co-authored-by: Krishnakumar Venkataraman <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
2023-09-08 09:39:30 +02:00
b7e15255f3 Allow job hooks to be disabled (#434)
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Kevin Fox <[email protected]>
2023-08-18 09:48:14 +02:00
kfox1111 ae8941c49d Support Nested Spire with External Agent (#117) 2023-08-16 16:35:41 +02:00
Drew Wells bfec27ef67 Fix jwtIssuer to allow for Uris including scheme (#425) 2023-08-09 16:53:21 +02:00
kfox1111andMarco Franssen c1b1dd3d88 Add additional domains to JWT issued items. (#230)
Co-authored-by: Marco Franssen <[email protected]>
2023-07-03 22:26:28 +02:00
Mariusz Sabath 1c6947078a Updated Tornjak documenation with Not-for-production labels (#297) 2023-05-18 23:31:03 +02:00
Mariusz SabathandMarco Franssen da186c5f53 Split Tornjak Frontend into separate subchart (#179)
Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
2023-05-16 19:31:38 +02:00
Marco FranssenandFaisal Memon 65312f8525 Include dependency values in documentation (#275)
I have added a flag to the helm-docs script to include the documentation
for dependencies.

This will add more complete documentation to
https://artifacthub.io/packages/helm/spiffe/spire#values so it is easier
for our users to get started and having a complete overview.

---------

Signed-off-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-05-12 18:12:23 +00:00
kfox1111andMarco Franssen 2c360a50fd Add global for image registry (#201)
This patch enables a user to override all image registry settings all at
once to point to their own registry to enable easy custom mirrors.

partially implements: https://github.com/spiffe/helm-charts/issues/139

---------

Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
2023-04-20 20:08:14 +02:00
kfox1111 210ed02c58 Remove dead code (#217) 2023-04-17 12:18:18 +02:00
Marco Franssen db148c8aeb Fix trustDomain global for oidc discovery provider (#193) 2023-04-05 10:46:53 -04:00
kfox1111andMarco Franssen 563e1f7920 Add podmonitors (#165)
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-04-04 09:55:35 +02:00
kfox1111andMarco Franssen c661d0bc7e Make service dns domain configurable (#164)
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-04-03 19:52:36 +02:00
kfox1111 87904164ad Enable global config for clusterName, trustDomain, and bundleConfigMap (#156) 2023-04-02 19:28:49 +02:00
kfox1111 cb627f04b2 Allow all subchart to conditionally disable (#90) 2023-03-04 16:09:36 +01:00
kfox1111andMarco Franssen 35eb3bb42e Basic Prometheus support (#28)
Co-authored-by: Marco Franssen <[email protected]>
2023-02-24 22:39:15 +01:00
Marco Franssen ec26d85f61 Enable spire-controller-manager by default
Signed-off-by: Marco Franssen <[email protected]>
2023-02-23 10:33:28 +01:00
Marco Franssen 99d32050ba Remove option to choose different agent socket path
Resolves #19

Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:23:36 +01:00
Marco Franssen 0d49280cda Add support for spire-controller-manager
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:13 +01:00
Marco Franssen 0a0ddb4a9b Move the k8s-workload-registrar back into same pod as spire-server
The k8s-workload-registrar needs access to the spire-server socket and
therefore has to run in the same pod to be able to mount the socket
into the container.

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:11 +01:00
Marco Franssen c7ebf72d13 Remove unused helpers from root
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:10 +01:00
Marco Franssen cdbee1bc1b Cleanup values.yaml
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:10 +01:00
Marco Franssen ce9b58e725 Move spire-server to dedicated subchart
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:10 +01:00
Marco Franssen e312d42350 Move spire-agent to dedicated subchart
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:09 +01:00
Marco Franssen ab2636ae98 Move k8s-workload-registrar to sub chart
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:09 +01:00
Marco FranssenandGert Jan Kamstra 99da500c1c Move oidc-discovery-provider to sub chart
Signed-off-by: Marco Franssen <[email protected]>
Co-authored-by: Gert Jan Kamstra <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:09 +01:00
Marco Franssen 35b8ad3c00 Move the spiffe-csi-driver into a sub chart
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:09 +01:00
Marco FranssenandGert Jan Kamstra 3fe5f8f145 Improve documentation on values
Co-authored-by: Gert Jan Kamstra <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:09 +01:00
Marco Franssen 93156bf904 Allow to use external created secret
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:09 +01:00
Marco Franssen fe38a52a95 Improve upstream CA
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:08 +01:00
Marco Franssen 1ee42c53d3 Bump wait-for-it image latest-20221223
This version supports arm64 and amd64

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:08 +01:00
Ken HuffmanandMarco Franssen ce86fb97e1 Add optional UpstreamAuthority (#79)
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:08 +01:00
Marco Franssen ddf4be3d3d Bump csiDriver to 0.2.1
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:08 +01:00
Marco Franssen bf31bdc2c0 Fix server podAnnotations configurable
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:08 +01:00
Marco Franssen a2abee2f95 Switch oidc image back to static image
The repo as private and is now set to public

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:08 +01:00
Marco Franssen 94318b02a6 Bump spire to 1.5.3 to fix oidc healthchecks
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:07 +01:00