panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
107 Commits 1 Branch 2 Tags
3018ef84691e95181a9526f32265493f773875f5
Commit Graph
107 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Marco Franssen fc1bcb35d9 Align spire-server sock naming convention with agent 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 60b2f7c773 Utilize spiffe csi driver in OIDC component 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 1e31a5e359 Remove autoscaling using HPA 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen e770a14629 Align config across components 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 10f0138a25 Enable oidc service domains in oidc by default 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 79b26108f4 Fix oidc nodeSelector 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 746768dc55 Use chainguard nginx image 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 1bdb9a5a50 Move affinity, annotations and tolerations to oidc and server components 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00
Marco Franssen 76a0c5ecfc Move security values to server and oidc components 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00
Marco Franssen 8dd05399d1 Move some values to top 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00
Marco Franssen 7834800463 Move replicaCount to server and oidc components 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00
Marco Franssen 445cde9604 Add the gcr.io images in comment in values.yaml 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00
Marco Franssen 0b6198cf7c Fix loglevel values 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00
Marco Franssen ec61c387b0 Fix oidc health check using using scratch images 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00
Marco Franssen 765a4edaf8 Update spire server config to remove deprecated settings 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:03 +01:00
Marco Franssen 7f5346fc84 Switch to ghcr.io for images and bump to 1.5.0 
Resolves #31

Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:03 +01:00
Marco Franssen a5afe8979e Add a template to build the image string 
This also allows to use image digest as a version

Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:03 +01:00
Batuhan Apaydın 4e5dd65aad move spiffe-csi-driver and node-driver-registrar to values 
Signed-off-by: Batuhan Apaydın <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:03 +01:00
Marco Franssen 569412b5d4 Allow to configure resources per object 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:03 +01:00
Marco Franssen fb5985ada4 Bump spire chart version and require k8s 1.21+ 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:03 +01:00
Marco Franssen 5cb6ebe95e Enforce to amd64 nodes using nodeSelector 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:02 +01:00
Batuhan ApaydınandFurkan Türkal e9912ba39a Add spiffe-csi driver support 
Signed-off-by: Batuhan Apaydın <[email protected]>
Co-authored-by: Furkan Türkal <[email protected]>
Signed-off-by: Batuhan Apaydın <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:02 +01:00
Marco Franssen 3a39fe5666 Bump Spire version to 1.0.2 for oidc fixes 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:02 +01:00
Marco Franssen f11dc08b20 Bump spire image versions from 1.0.0 to 1.0.1 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:02 +01:00
Marco FranssenandGert Jan Kamstra 48dacbca64 Fix agent socket mount in spire-oidc 
Co-authored-by: Gert Jan Kamstra <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:02 +01:00
Marco FranssenandGert Jan Kamstra 4f93ead90a Configurable insecureScheme nginx image 
Co-Authored-by: Gert Jan Kamstra <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:02 +01:00
Marco Franssen 1c54ce82bb Add jwtIssuer configuration 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:02 +01:00
Marco Franssen 46466e5ec6 Run oidc insecure on unix socket using Nginx 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:01 +01:00
Marco Franssen c9f69907ac Use new domains configuration 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:01 +01:00
Marco Franssen 4d3fb47839 Change socket mounts for more control (readonly) 
pods like oidc mount more then one of these sockets, now we can control readonly vs non readonly better

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:01 +01:00
Marco Franssen f2d7aa1f62 Run oidc discovery provider as separate pod using workload api 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:01 +01:00
Marco Franssen 31bce3b09e Remove spire ingress as it complicate SNI acme 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:01 +01:00
Marco Franssen 1e5e84439b Run Spire services by default on ClusterIP 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:01 +01:00
Marco Franssen 007fa7b83d Initial spire chart setup 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:00 +01:00
Faisal Memon 258a5a2ca7 Merge pull request #15 from spiffe/helm-docs-script 
Move docs script to root of repo
 2023-02-17 09:55:57 -08:00
Marco Franssen c3ac45eec8 Move docs script to root of repo 
This makes it easier for contributors to ensure docs are updated by having the script
more easy at hand.

Signed-off-by: Marco Franssen <[email protected]>
 2023-02-14 14:04:31 +01:00
Marco Franssen fe5b3a2a16 Add .editorconfig 
This is convenient to have some basic formatting automatically done on files

At least for the people that have the .editorconfig plugin in their IDE

Signed-off-by: Marco Franssen <[email protected]>
 2023-02-09 10:31:49 +01:00
dependabot[bot] 9fbf532d9f Bump helm/chart-releaser-action from 1.4.1 to 1.5.0 
Bumps [helm/chart-releaser-action](https://github.com/helm/chart-releaser-action) from 1.4.1 to 1.5.0.
- [Release notes](https://github.com/helm/chart-releaser-action/releases)
- [Commits](https://github.com/helm/chart-releaser-action/compare/v1.4.1...v1.5.0)

---
updated-dependencies:
- dependency-name: helm/chart-releaser-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-01-09 09:20:14 +01:00
dependabot[bot] ea3b07983e Bump actions/checkout from 3.2.0 to 3.3.0 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3.2.0 to 3.3.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3.2.0...v3.3.0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-01-06 19:05:53 +01:00
Marco Franssen 98ce524618 Add workflow to release helm-charts to gh-pages and ghcr.io 
Signed-off-by: Marco Franssen <[email protected]>
 2023-01-02 13:46:20 +01:00
Dennis Gove b306cd4cf2 Merge pull request #9 from spiffe/add-codeowner 
Add additional codeowner and ignores .idea IDE files
 2022-12-29 20:30:30 -05:00
Dennis Gove 71d7cb95cc Ignore .idea IDE files 
Signed-off-by: Dennis Gove <[email protected]>
 2022-12-28 18:43:23 -05:00
Dennis Gove 004be1064b Add @mrsabath to CODEOWNERS 
Signed-off-by: Dennis Gove <[email protected]>
 2022-12-28 18:43:23 -05:00
dependabot[bot] 4ee2c207e7 Bump helm/kind-action from 1.4.0 to 1.5.0 
Bumps [helm/kind-action](https://github.com/helm/kind-action) from 1.4.0 to 1.5.0.
- [Release notes](https://github.com/helm/kind-action/releases)
- [Commits](https://github.com/helm/kind-action/compare/v1.4.0...v1.5.0)

---
updated-dependencies:
- dependency-name: helm/kind-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
 2022-12-28 18:43:18 -05:00
dependabot[bot] d1aa978d3a Bump helm/kind-action from 1.4.0 to 1.5.0 
Bumps [helm/kind-action](https://github.com/helm/kind-action) from 1.4.0 to 1.5.0.
- [Release notes](https://github.com/helm/kind-action/releases)
- [Commits](https://github.com/helm/kind-action/compare/v1.4.0...v1.5.0)

---
updated-dependencies:
- dependency-name: helm/kind-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
 2022-12-16 08:49:38 +01:00
Marco Franssen 2ab97de63c Merge pull request #6 from spiffe/ci-workflow 2022-12-15 10:23:33 +01:00
Marco Franssen 320dce4eb2 Only run tests if a chart changed 
Signed-off-by: Marco Franssen <[email protected]>
 2022-12-15 10:22:27 +01:00
Marco Franssen 1ed5cf1239 Bump actions to latest version 
Signed-off-by: Marco Franssen <[email protected]>
 2022-12-15 10:17:52 +01:00
Marco Franssen d1106fdd4c Allow manual dispatch of CI workflow 
Signed-off-by: Marco Franssen <[email protected]>
 2022-12-15 10:17:52 +01:00
Marco Franssen f7443d22b8 Add job to test Helm chart using Kind 
Signed-off-by: Marco Franssen <[email protected]>
 2022-12-15 10:17:52 +01:00