panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
249 Commits 1 Branch 2 Tags
0dec80e1d52fb32fccf832c89b7391e906823d61
Commit Graph
249 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Marco Franssen 9921d1df40 Use correct helper function for upstream-ca-secret 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:12 +01:00
Marco Franssen 4a2b0ac69a Add spire-k8s-registrar service 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:12 +01:00
Marco Franssen 175d448341 Utilize helper function for spire-k8s-workload-registrar 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:12 +01:00
Marco Franssen 5ff662acea Update statement on minimum required spire version 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:12 +01:00
Marco Franssen 065689a6a4 Fix k8s workload registrar image pullPolicy 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:12 +01:00
Marco Franssen 05e1c2f736 Bump spire to latest 1.5.4 patch release 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:11 +01:00
Marco Franssen 8277bf0bd4 Patch wait-for-it to latest Januari release 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:11 +01:00
Marco Franssen f0921014cf Use template function from the right chart for oidc discovery provider configmap 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:11 +01:00
Marco Franssen 92440c72cc Add note on scaling spire-server to value docs 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:11 +01:00
Marco Franssen 0a0ddb4a9b Move the k8s-workload-registrar back into same pod as spire-server 
The k8s-workload-registrar needs access to the spire-server socket and
therefore has to run in the same pod to be able to mount the socket
into the container.

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:11 +01:00
Marco Franssen 738842de16 Fix oidc-discovery-provider config mount 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:11 +01:00
Marco Franssen 2c8ca0a237 List spire-server and spire-agent in dependencies 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:10 +01:00
Marco Franssen c7ebf72d13 Remove unused helpers from root 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:10 +01:00
Marco Franssen cdbee1bc1b Cleanup values.yaml 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:10 +01:00
Marco Franssen b3d5b7d80a Remove unused template + fix spiffe-csi-driver 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:10 +01:00
Marco Franssen ce9b58e725 Move spire-server to dedicated subchart 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:10 +01:00
Marco Franssen e312d42350 Move spire-agent to dedicated subchart 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:09 +01:00
Marco Franssen ab2636ae98 Move k8s-workload-registrar to sub chart 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:09 +01:00
Marco FranssenandGert Jan Kamstra 99da500c1c Move oidc-discovery-provider to sub chart 
Signed-off-by: Marco Franssen <[email protected]>
Co-authored-by: Gert Jan Kamstra <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:09 +01:00
Marco Franssen 35b8ad3c00 Move the spiffe-csi-driver into a sub chart 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:09 +01:00
Marco FranssenandGert Jan Kamstra 3fe5f8f145 Improve documentation on values 
Co-authored-by: Gert Jan Kamstra <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:09 +01:00
Marco Franssen 93156bf904 Allow to use external created secret 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:09 +01:00
Marco Franssen 786c6a5d89 Use with statement for readability 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:08 +01:00
Marco Franssen fe38a52a95 Improve upstream CA 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:08 +01:00
Marco Franssen 1ee42c53d3 Bump wait-for-it image latest-20221223 
This version supports arm64 and amd64

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:08 +01:00
Ken HuffmanandMarco Franssen ce86fb97e1 Add optional UpstreamAuthority (#79) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:08 +01:00
Marco Franssen ddf4be3d3d Bump csiDriver to 0.2.1 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:08 +01:00
Marco Franssen bf31bdc2c0 Fix server podAnnotations configurable 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:08 +01:00
Marco Franssen a2abee2f95 Switch oidc image back to static image 
The repo as private and is now set to public

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:08 +01:00
Marco Franssen 94318b02a6 Bump spire to 1.5.3 to fix oidc healthchecks 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:07 +01:00
Marco FranssenandGert Jan Kamstra aff50434fa Apply suggestions from code review 
Co-authored-by: Gert Jan Kamstra <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:07 +01:00
Marco Franssen 109be1a3cc Replaced wait-for-it image to resolve security issues 
This image was also outdated (no recent releases) and contains whole bunch of vulnerabilities

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:07 +01:00
Ken HuffmanandMarco Franssen a3f1901a6b adding annotations and resources (#81) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:07 +01:00
Marco Franssen 9634df136d Resolve CVE by bumping spire to 1.5.2 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:07 +01:00
Marco Franssen cc54e3bfbe Add liveness prove to csi-node-registrar 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:07 +01:00
Marco Franssen d84a1343c6 Bump csi-node-driver-registrar to v2.6.2 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:06 +01:00
Marco Franssen be163d26cc Allow to configure oidc nginx container resources 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:06 +01:00
Marco Franssen 0e480c6057 Use variable for oidc socket 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:06 +01:00
Marco Franssen 83c3e45e93 Make socketPaths configurable 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:06 +01:00
Marco Franssen c010d6a4b0 Fix spire oidc nginx container 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:06 +01:00
Marco Franssen a159e7b663 Fix image version failing in spire.image template 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:06 +01:00
Marco Franssen 933a75bfd4 Bump spire version to 1.5.1 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:06 +01:00
Marco Franssen fc1bcb35d9 Align spire-server sock naming convention with agent 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 60b2f7c773 Utilize spiffe csi driver in OIDC component 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 1e31a5e359 Remove autoscaling using HPA 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen e770a14629 Align config across components 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 10f0138a25 Enable oidc service domains in oidc by default 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 79b26108f4 Fix oidc nodeSelector 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 746768dc55 Use chainguard nginx image 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 1bdb9a5a50 Move affinity, annotations and tolerations to oidc and server components 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00