panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,227 Commits 1 Branch 2 Tags
0824944320849b5866512488de2bebf4dd9f24aa
Commit Graph
13 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Daniel Schlatter 59bb8a774c Allow sqlite3 in memory when kind is deployment (#923) 
* Allow sqlite3 in memory when kind is deployment

Signed-off-by: Daniel Schlatter <[email protected]>

* Warn on unsafe in-memory datastore combinations

Signed-off-by: Daniel Schlatter <[email protected]>

---------

Signed-off-by: Daniel Schlatter <[email protected]>
 2026-08-18 14:22:50 -07:00
Daniel Schlatterandkfox1111 e46ad1594a Make spire-server rollout strategy configurable (#924) 
Signed-off-by: Daniel Schlatter <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2026-08-18 11:47:36 -07:00
Daniel Schlatterandkfox1111 21bcece2ac add config to allow disabling jwt svids (#864) 
Signed-off-by: Daniel Schlatter <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2026-07-02 14:57:29 -07:00
Daniel Schlatter c489dfc4db Update helper images in spiffe-csi-driver (#815) 
csi-node-driver-registrar -> 2.15.0
ubi9 -> ubi10/ubi-minimal:10.1-1776834797

Signed-off-by: Daniel Schlatter <[email protected]>
 2026-05-02 00:25:29 -07:00
Daniel Schlatter f537f7702f allow unsupported built-in key manager plugins to be used (#798) 
Signed-off-by: Daniel Schlatter <[email protected]>
 2026-04-23 05:31:17 -07:00
Daniel Schlatter de59147fc5 fix gather hostcert edge case issues (#775) 
* Check each conditional of gather host cert in case a command to create the host cert fails

Signed-off-by: Daniel Schlatter <[email protected]>

* Change curl command to use --cacert in gather-host-cert init container

--capath is for directories. --cacert is the correct option for a single cert.

Signed-off-by: Daniel Schlatter <[email protected]>

---------

Signed-off-by: Daniel Schlatter <[email protected]>
 2026-03-29 16:13:20 +00:00
Daniel Schlatterandkfox1111 0133d4a5a7 add key experimental.requirePQKEM for spire-server and spire-agent (#755) 
Signed-off-by: Daniel Schlatter <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2026-03-03 06:31:44 -08:00
Daniel SchlatterandFaisal Memon a7abf7d7ec disable hostNetwork on spire-agent daemonset if connect by hostname is true (#705) 
* disable hostNetwork on spire-agent daemonset if connect by hostname is true

Signed-off-by: Daniel Schlatter <[email protected]>

* allow spire-agent daemonset dnsPolicy to be configured

Signed-off-by: Daniel Schlatter <[email protected]>

---------

Signed-off-by: Daniel Schlatter <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2026-01-26 12:40:57 -08:00
Daniel Schlatter 8dffc8eda1 use spire-agent.hostCert.resources to set resources for corresponding spire-agent init container (#691) 
* use spire-agent.resources to set resources for associated initContainers, remove specific keys for those initContainers corresponding resources

Signed-off-by: Daniel Schlatter <[email protected]>

* set resources for spire-agent init containers fingerprint-tpm and init-tpm-direct

Signed-off-by: Daniel Schlatter <[email protected]>

* use spiffe-csi-driver.resources to set resources for associated initContainers, remove specific keys for those initContainers corresponding resources

Signed-off-by: Daniel Schlatter <[email protected]>

* set resources for spiffe-csi-driver init container set-context

Signed-off-by: Daniel Schlatter <[email protected]>

---------

Signed-off-by: Daniel Schlatter <[email protected]>
 2025-11-20 21:47:59 -08:00
Daniel Schlatterandkfox1111 41bd5b9598 fix socketAlternate names throwing an error if set to an empty list (#678) 
Signed-off-by: Daniel Schlatter <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2025-10-13 10:11:53 -07:00
Daniel Schlatter 1feeca1ce1 make spire server's auth_opa_policy_engine configurable in the helm chart (#663) 2025-09-16 16:58:37 -07:00
Daniel Schlatter c1b0cfe390 Add controller manager configs gcInterval, logLevel, and make entryIDPrefix configurable (#662) 
* Make controller manager gcInterval configurable in spire-server helm chart

Signed-off-by: Daniel Schlatter <[email protected]>

* Make controller manager logLevel configurable in spire-server helm chart

Signed-off-by: Daniel Schlatter <[email protected]>

* Make controller manager entryIDPrefix configurable in spire-server helm chart

Signed-off-by: Daniel Schlatter <[email protected]>

* change configurable entryIDPrefix to a binary option of add the cluster name or not

Signed-off-by: Daniel Schlatter <[email protected]>

---------

Signed-off-by: Daniel Schlatter <[email protected]>
 2025-09-14 06:14:43 -07:00
Daniel Schlatter ccfb4905e2 Dynamically build the connection_string with options for the spire server when spire-server.dataStore.sql.databaseType == sqlite3 (#576) 
Signed-off-by: Daniel Schlatter <[email protected]>
 2025-05-20 15:26:29 -07:00