panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
300 Commits 1 Branch 2 Tags
1675997748f0c2d45bae3568f33dc9c9192e6f80
Commit Graph
196 Commits
Author SHA1 Message Date
Marco FranssenandGert Jan Kamstra aff50434fa Apply suggestions from code review 
Co-authored-by: Gert Jan Kamstra <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:07 +01:00
Marco Franssen 109be1a3cc Replaced wait-for-it image to resolve security issues 
This image was also outdated (no recent releases) and contains whole bunch of vulnerabilities

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:07 +01:00
Ken HuffmanandMarco Franssen a3f1901a6b adding annotations and resources (#81) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:07 +01:00
Marco Franssen 9634df136d Resolve CVE by bumping spire to 1.5.2 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:07 +01:00
Marco Franssen cc54e3bfbe Add liveness prove to csi-node-registrar 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:07 +01:00
Marco Franssen d84a1343c6 Bump csi-node-driver-registrar to v2.6.2 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:06 +01:00
Marco Franssen be163d26cc Allow to configure oidc nginx container resources 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:06 +01:00
Marco Franssen 0e480c6057 Use variable for oidc socket 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:06 +01:00
Marco Franssen 83c3e45e93 Make socketPaths configurable 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:06 +01:00
Marco Franssen c010d6a4b0 Fix spire oidc nginx container 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:06 +01:00
Marco Franssen a159e7b663 Fix image version failing in spire.image template 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:06 +01:00
Marco Franssen 933a75bfd4 Bump spire version to 1.5.1 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:06 +01:00
Marco Franssen fc1bcb35d9 Align spire-server sock naming convention with agent 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 60b2f7c773 Utilize spiffe csi driver in OIDC component 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 1e31a5e359 Remove autoscaling using HPA 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen e770a14629 Align config across components 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 10f0138a25 Enable oidc service domains in oidc by default 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 79b26108f4 Fix oidc nodeSelector 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 746768dc55 Use chainguard nginx image 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 1bdb9a5a50 Move affinity, annotations and tolerations to oidc and server components 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00
Marco Franssen 76a0c5ecfc Move security values to server and oidc components 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00
Marco Franssen 8dd05399d1 Move some values to top 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00
Marco Franssen 7834800463 Move replicaCount to server and oidc components 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00
Marco Franssen 445cde9604 Add the gcr.io images in comment in values.yaml 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00
Marco Franssen 0b6198cf7c Fix loglevel values 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00
Marco Franssen ec61c387b0 Fix oidc health check using using scratch images 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00
Marco Franssen 765a4edaf8 Update spire server config to remove deprecated settings 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:03 +01:00
Marco Franssen 7f5346fc84 Switch to ghcr.io for images and bump to 1.5.0 
Resolves #31

Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:03 +01:00
Marco Franssen a5afe8979e Add a template to build the image string 
This also allows to use image digest as a version

Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:03 +01:00
Batuhan Apaydın 4e5dd65aad move spiffe-csi-driver and node-driver-registrar to values 
Signed-off-by: Batuhan Apaydın <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:03 +01:00
Marco Franssen 569412b5d4 Allow to configure resources per object 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:03 +01:00
Marco Franssen fb5985ada4 Bump spire chart version and require k8s 1.21+ 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:03 +01:00
Marco Franssen 5cb6ebe95e Enforce to amd64 nodes using nodeSelector 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:02 +01:00
Batuhan ApaydınandFurkan Türkal e9912ba39a Add spiffe-csi driver support 
Signed-off-by: Batuhan Apaydın <[email protected]>
Co-authored-by: Furkan Türkal <[email protected]>
Signed-off-by: Batuhan Apaydın <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:02 +01:00
Marco Franssen 3a39fe5666 Bump Spire version to 1.0.2 for oidc fixes 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:02 +01:00
Marco Franssen f11dc08b20 Bump spire image versions from 1.0.0 to 1.0.1 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:02 +01:00
Marco FranssenandGert Jan Kamstra 48dacbca64 Fix agent socket mount in spire-oidc 
Co-authored-by: Gert Jan Kamstra <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:02 +01:00
Marco FranssenandGert Jan Kamstra 4f93ead90a Configurable insecureScheme nginx image 
Co-Authored-by: Gert Jan Kamstra <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:02 +01:00
Marco Franssen 1c54ce82bb Add jwtIssuer configuration 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:02 +01:00
Marco Franssen 46466e5ec6 Run oidc insecure on unix socket using Nginx 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:01 +01:00
Marco Franssen c9f69907ac Use new domains configuration 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:01 +01:00
Marco Franssen 4d3fb47839 Change socket mounts for more control (readonly) 
pods like oidc mount more then one of these sockets, now we can control readonly vs non readonly better

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:01 +01:00
Marco Franssen f2d7aa1f62 Run oidc discovery provider as separate pod using workload api 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:01 +01:00
Marco Franssen 31bce3b09e Remove spire ingress as it complicate SNI acme 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:01 +01:00
Marco Franssen 1e5e84439b Run Spire services by default on ClusterIP 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:01 +01:00
Marco Franssen 007fa7b83d Initial spire chart setup 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:00 +01:00