Commit Graph
100 Commits
Author SHA1 Message Date
kfox1111andFaisal Memon 993ee8582b Change production example to be an integration test (#237)
* Change production example to be an integration test

The documentation is a better example then the test now. Separate the
two.

Signed-off-by: Kevin Fox <[email protected]>

* Fix job name reference

Signed-off-by: Kevin Fox <[email protected]>

* Fix job name reference

Signed-off-by: Kevin Fox <[email protected]>

* Update postgresql example

Signed-off-by: Kevin Fox <[email protected]>

* Update mysql example

Signed-off-by: Kevin Fox <[email protected]>

* Update nested and mysql

Signed-off-by: Kevin Fox <[email protected]>

* Fix typo

Signed-off-by: Kevin Fox <[email protected]>

* Add support for integration tests in the tests/integration dir

Signed-off-by: Kevin Fox <[email protected]>

* Fix split issue and typo

Signed-off-by: Kevin Fox <[email protected]>

* Fix split issue

Signed-off-by: Kevin Fox <[email protected]>

* Try folding example your values into bash so that its not laying around in an fs for a user to accidently use.

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Cleanup

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2024-03-20 14:12:48 -07:00
kfox1111andFaisal Memon 72768ecdbc Support hybrid nodes with different attestors or config (#218)
* Add direct tpm support for spire-agent

Signed-off-by: Kevin Fox <[email protected]>

* Add fingerprinting support

Signed-off-by: Kevin Fox <[email protected]>

* Add example

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-agent/templates/configmap.yaml

Signed-off-by: kfox1111 <[email protected]>

* Support hybrid nodes with different attestors

In some clusters, you may have a mix of nodes with differing attestor
needs. For example, some nodes have hardware TPMs and some without.
This patch enables configuring multiple daemonsets for the agent
that you can target to pools of nodes.

Signed-off-by: Kevin Fox <[email protected]>

* Remove extra slash

Signed-off-by: Kevin Fox <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-agent/templates/configmap.yaml

Signed-off-by: kfox1111 <[email protected]>

* Fix broken tests

Signed-off-by: Kevin Fox <[email protected]>

* Add daemonset labels

Signed-off-by: Kevin Fox <[email protected]>

* Add temporary upgrade hook

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix include

Signed-off-by: Kevin Fox <[email protected]>

* Add missing values

Signed-off-by: Kevin Fox <[email protected]>

* Fix perms, add upgrade note

Signed-off-by: Kevin Fox <[email protected]>

* Fix hardcoded nodeAttestor and keyManager in spire-agent

Fixes: https://github.com/spiffe/helm-charts-hardened/issues/220

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge issues

Signed-off-by: Kevin Fox <[email protected]>

* Fix unit tests

Signed-off-by: Kevin Fox <[email protected]>

* Pass the agent's securityContext on to Kubernetes

Currently its ignored.

Signed-off-by: Kevin Fox <[email protected]>

* Update example to be usable

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Update example

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict issue

Signed-off-by: Kevin Fox <[email protected]>

* Update to the newest release

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix version numbers in docs

Signed-off-by: Kevin Fox <[email protected]>

* Remove merge conflicted extra code

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2024-03-20 13:58:43 -07:00
kfox1111andFaisal Memon 36e931572e Add external k8s bundler (#270)
* Complete Server K8S PSAT support

Add all the SPIRE Server supported options for the K8S PSAT attestor. This retains the
ease of use for configuring local cluster support while adding the ability to configure
multiple/external clusters as well. Kubeconfig support is added in its own config block
as it will be used/shared with spire-controller-manager support in the future.

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Add support for integration tests in the tests/integration dir

Signed-off-by: Kevin Fox <[email protected]>

* Fix split issue and typo

Signed-off-by: Kevin Fox <[email protected]>

* Add basic psat test

Signed-off-by: Kevin Fox <[email protected]>

* Fix linter

Signed-off-by: Kevin Fox <[email protected]>

* Fix up test

Signed-off-by: Kevin Fox <[email protected]>

* Add missing file

Signed-off-by: Kevin Fox <[email protected]>

* Better encode config

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-server/values.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-server/values.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Add external k8s bundler

Adds support to sync the CA bundle to configmaps in external
Kubernetes clusters

Signed-off-by: Kevin Fox <[email protected]>

* Update default

Signed-off-by: Kevin Fox <[email protected]>

* Fix config file layout. Incorperate feedback.

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Update based on parent pr feedback

Signed-off-by: Kevin Fox <[email protected]>

* Reformat config file

Signed-off-by: Kevin Fox <[email protected]>

* Fix some things

Signed-off-by: Kevin Fox <[email protected]>

* Reconfigure kind

Signed-off-by: Kevin Fox <[email protected]>

* More debugging

Signed-off-by: Kevin Fox <[email protected]>

* Fix up kind

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2024-03-13 21:07:53 +00:00
kfox1111andFaisal Memon ef610df51f Complete Server K8S PSAT support (#242)
* Complete Server K8S PSAT support

Add all the SPIRE Server supported options for the K8S PSAT attestor. This retains the
ease of use for configuring local cluster support while adding the ability to configure
multiple/external clusters as well. Kubeconfig support is added in its own config block
as it will be used/shared with spire-controller-manager support in the future.

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Add support for integration tests in the tests/integration dir

Signed-off-by: Kevin Fox <[email protected]>

* Fix split issue and typo

Signed-off-by: Kevin Fox <[email protected]>

* Add basic psat test

Signed-off-by: Kevin Fox <[email protected]>

* Fix linter

Signed-off-by: Kevin Fox <[email protected]>

* Fix up test

Signed-off-by: Kevin Fox <[email protected]>

* Add missing file

Signed-off-by: Kevin Fox <[email protected]>

* Better encode config

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-server/values.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-server/values.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Update default

Signed-off-by: Kevin Fox <[email protected]>

* Fix config file layout. Incorperate feedback.

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix up kind

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2024-03-13 13:36:19 -07:00
kfox1111 fd3b7d5fc7 Fix duplicate securityContext section in spire-agent (#279)
A duplicate section was added due to incorrect merge conflict resolution.
Helm seems ok with it but Kustomize + FluxCD has issues with it.

Signed-off-by: Kevin Fox <[email protected]>
2024-03-07 09:52:00 -08:00
kfox1111 aea37a9cd0 Update SPIRE to 1.9.1 (#277)
Signed-off-by: Kevin Fox <[email protected]>
2024-03-05 17:49:26 -08:00
kfox1111andFaisal Memon a539065c02 Add direct tpm support for spire-agent (#216)
* Add direct tpm support for spire-agent

Signed-off-by: Kevin Fox <[email protected]>

* Add fingerprinting support

Signed-off-by: Kevin Fox <[email protected]>

* Add example

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-agent/templates/configmap.yaml

Signed-off-by: kfox1111 <[email protected]>

* Update charts/spire/charts/spire-agent/templates/configmap.yaml

Signed-off-by: kfox1111 <[email protected]>

* Fix broken tests

Signed-off-by: Kevin Fox <[email protected]>

* Fix hardcoded nodeAttestor and keyManager in spire-agent

Fixes: https://github.com/spiffe/helm-charts-hardened/issues/220

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge issues

Signed-off-by: Kevin Fox <[email protected]>

* Fix unit tests

Signed-off-by: Kevin Fox <[email protected]>

* Pass the agent's securityContext on to Kubernetes

Currently its ignored.

Signed-off-by: Kevin Fox <[email protected]>

* Update example to be usable

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Update to the newest release

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2024-02-29 20:33:57 +00:00
kfox1111andFaisal Memon fcd0c11e14 Add direct tpm support for spire-server (#211)
* Add direct tpm support

Signed-off-by: Kevin Fox <[email protected]>

* Add agent support

Signed-off-by: Kevin Fox <[email protected]>

* Add missing condition

Signed-off-by: Kevin Fox <[email protected]>

* Add missing condition

Signed-off-by: Kevin Fox <[email protected]>

* Remove agent bits from this pr

Signed-off-by: Kevin Fox <[email protected]>

* Plugin needs to write to /tmp

Signed-off-by: Kevin Fox <[email protected]>

* Fix tmp mount

Signed-off-by: Kevin Fox <[email protected]>

* Make it possible to manage cas/hashes via values

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Update to the newest release

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2024-02-29 11:41:25 -08:00
kfox1111 c57017425e Enable CA settings via global (#268)
Adds a global.spire.caSubject section where you can set the CA
subject information for all spire-server instances.

Signed-off-by: Kevin Fox <[email protected]>
2024-02-28 11:47:24 -08:00
kfox1111 ac83694970 Initial SPIRE 1.9.0 support (#262) 2024-02-28 17:54:53 +00:00
kfox1111 a0baace5ea Upgrade to spire-controller-manager 0.4.3 (#258)
Signed-off-by: Kevin Fox <[email protected]>
2024-02-22 10:38:58 -08:00
kfox1111andFaisal Memon 1446f7ea79 Add support for specifying agent authorized_delegates (#255)
* Add support for specifying agent authorized_delegates

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-agent/values.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2024-02-20 17:11:03 +00:00
kfox1111andFaisal Memon 0b6cd88d56 Add support for specifying server admin_ids (#254)
* Add support for specifying server admin_ids

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-server/templates/configmap.yaml

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2024-02-20 08:50:18 -08:00
kfox1111 a4e91c6ba8 Add support for integration tests in the tests/integration dir (#253)
* Add support for integration tests in the tests/integration dir

Signed-off-by: Kevin Fox <[email protected]>

* Fix split issue and typo

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
2024-02-20 08:16:16 -08:00
kfox1111 07a1c391b2 Add global override for kubectl tag (#251) 2024-02-19 20:18:31 +01:00
kfox1111 a2e5a4e629 Add support for enabling the spire-agent admin socket (#234)
* Add support for enabling the spire-agent admin socket

Signed-off-by: Kevin Fox <[email protected]>

* Fix typo

Signed-off-by: Kevin Fox <[email protected]>

* Update permissions

Signed-off-by: Kevin Fox <[email protected]>

* Update permissions

Signed-off-by: Kevin Fox <[email protected]>

* Fix template

Signed-off-by: Kevin Fox <[email protected]>

* Update upstream agent too

Signed-off-by: Kevin Fox <[email protected]>

* Fix init issue

Signed-off-by: Kevin Fox <[email protected]>

* Refactor a bit to make things more automatic

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
2024-02-09 12:44:43 -08:00
kfox1111andFaisal Memon 49e21c389b Add missing affinity settings (#232)
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2024-02-05 20:33:24 +00:00
kfox1111andFaisal Memon 8adbb89890 Add alternate name support for the socket (#181)
* Add alternate name support for the socket

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing image reference

Signed-off-by: Kevin Fox <[email protected]>

* Make user changing socket work smoothly.

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Update charts/spire/charts/spire-agent/values.yaml

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2024-02-05 11:40:19 -08:00
kfox1111 fce95cb443 Add example of mysql using spire (#164)
* Add example of mysql using spire

Signed-off-by: Kevin Fox <[email protected]>

* Finish up the implementation

Signed-off-by: Kevin Fox <[email protected]>

* Update the image

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Update. Restested.

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
2024-02-05 11:17:19 -08:00
kfox1111 35215aee33 Add missing upgrade test bypass (#231)
* Add missing upgrade test bypass

Signed-off-by: Kevin Fox <[email protected]>

* Too many iterations. Update comment.

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
2024-02-01 09:28:20 -08:00
kfox1111 d5475328b4 Pass the agent's securityContext on to Kubernetes (#225)
Currently its ignored.

Signed-off-by: Kevin Fox <[email protected]>
2024-01-30 19:55:12 +00:00
kfox1111 6b03d5a0bd Fix hardcoded nodeAttestor and keyManager in spire-agent (#221)
* Fix hardcoded nodeAttestor and keyManager in spire-agent

---------

Signed-off-by: Kevin Fox <[email protected]>
2024-01-30 11:33:32 -08:00
kfox1111 01e031f71c Add another upgrade note and fix value name (#215)
* Add another upgrade note

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
2024-01-26 17:47:57 -08:00
kfox1111 e8d527cd9a Update to spire-controller-manager 0.4.2 (#195) 2024-01-25 12:07:10 +01:00
kfox1111 3e1c5199b7 Always upgrade test from the previous major release (#207) 2024-01-24 17:02:31 +01:00
Kevin Fox 2df2e1661f Bump spire Helm Chart version from 0.16.0 to 0.17.0
* 4c307c1 Add missing bundlePublisher section and extraEnv so settings can be set (#201)
* d724d1e Update the documentation (#172)
* e59a29b Bump test chart dependencies (#200)
* 4668151 Add missing extraVolumeMounts to the controllerManager (#196)
* b9ac3c4 Update to spire-controller-manager 0.4.1 (#193)
* 6fec1e5 Update SPIRE to 1.8.7 (#194)
* af155c2 Add support for running spiffe secured discovery provider (default) (#163)
* 3ccdb5e Add tls section to federation bundle endpoint and fix up annotations (#173)
* c7ab131 Add join_token server nodeattestor support (#187)
* 81e9523 Bump test chart dependencies (#186)
* 6d19a76 Fix agent daemonset format (#184)
* b61d4f5 Add spire-agent to spire-agent pod path (#180)
* befa074 Fix notes bug (#178)
* 912c61e Remove deprecated version values (#179)
* ae4ef6e Update HorizontalPodAutoscaler API to autoscaling/v2 (#153)
* e7a61a9 Bump test chart dependencies
* 183e9aa SPIFFE OIDC Discovery Provider Rework (#152)
* 8f1aba8 Bump test chart dependencies (#171)
* 2454b8c Fix links still pointing at older git repo (#167)
* e5c5527 Bump test chart dependencies (#165)
* e630008 Update jwt test to work with newer slim images (#139)
* c39dd44 Add recommendation for namespacePSS (#131)
* 49beb64 Add recommendation for namespaceLayout (#127)
* 33cacd2 Add recommendation for prometheus exporter (#144)
* 6997d6a Add recommendation for securityContext and podSecurityContext (#125)
* 50c4ac3 Add recommendation for strictMode (#143)
* 4fb9d18 Bump test chart dependencies (#155)
* 811123a Update the Tornjak image version (#150)
* 1524537 Update default for additionalDomains not to include localhost (#146)
* e35838c Add recommendation for priorityClass (#124)
* 9f72a8f Use good and automatic defaults for tornjak frontend workingDir (#129)
* 7726351 Tornjak UBI support (#123)
* 89c07e2 Revert openssl 3.2 change (#142)
* a3d3702 Bump test chart dependencies
* 80c7653 Bump test chart dependencies (#134)
* 13f6028 SELinux support (#122)
* 3e8335c Add a flag to enable recommendations (#121)
* 692d463 Remove unneeded lookup function from upgrade hook (#104)
* 8422b8d Added ability to create namespaces (#103)

Signed-off-by: Kevin Fox <[email protected]>
2024-01-24 12:24:29 +01:00
kfox1111 4a6c705e6a Update the CRs to enable multiple instance nesting without naming conflicts (#189) 2024-01-24 09:20:18 +01:00
kfox1111andFaisal Memon 4c307c1be1 Add missing bundlePublisher section and extraEnv so settings can be set (#201)
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2024-01-23 13:18:49 -08:00
kfox1111andFaisal Memon d724d1e690 Update the documentation (#172)
* SPIFFE OIDC Discovery Provider Rework

Fixes: https://github.com/spiffe/helm-charts-hardened/issues/151

Signed-off-by: Kevin Fox <[email protected]>

* Enhance clusterspiffeid's so the discovery provider is independently configurable

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Undo

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Try to get output

Signed-off-by: Kevin Fox <[email protected]>

* Try and get error code

Signed-off-by: Kevin Fox <[email protected]>

* Fix more logging. Switch port used.

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Fix port

Signed-off-by: Kevin Fox <[email protected]>

* Fix up logs for nested test and fix values

Signed-off-by: Kevin Fox <[email protected]>

* Make consistent

Signed-off-by: Kevin Fox <[email protected]>

* Fix nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix insecure mode and test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var scoping issue

Signed-off-by: Kevin Fox <[email protected]>

* Set the right flags for ingress

Signed-off-by: Kevin Fox <[email protected]>

* Update dns template

Signed-off-by: Kevin Fox <[email protected]>

* Use more standard port

Signed-off-by: Kevin Fox <[email protected]>

* Fix test logging

Signed-off-by: Kevin Fox <[email protected]>

* Allow reencrypt.

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing changes

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Add LetsEncrypt/ACME/cert-manager support. Remove broken ACME support.

Signed-off-by: Kevin Fox <[email protected]>

* Use spiffe-helper as a sidecar. Significant space savings and read only cert dir

Signed-off-by: Kevin Fox <[email protected]>

* Fix the nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge issue

Signed-off-by: Kevin Fox <[email protected]>

* Remove 1.29.0 until deps catch up.

Related issue: https://github.com/rancher/kubectl/pull/94

Signed-off-by: Kevin Fox <[email protected]>

* Add more error checking

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing code

Signed-off-by: Kevin Fox <[email protected]>

* Simplify the ids. Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix logic

Signed-off-by: Kevin Fox <[email protected]>

* Fix var

Signed-off-by: Kevin Fox <[email protected]>

* Make cert-manager bits more readable

Signed-off-by: Kevin Fox <[email protected]>

* Fix template

Signed-off-by: Kevin Fox <[email protected]>

* Fix openshift ingress

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Add resource spec

Signed-off-by: Kevin Fox <[email protected]>

* Remove parts that cant merge yet

Signed-off-by: Kevin Fox <[email protected]>

* Add support for running spiffe secured discovery provider (default)

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Remove defaults

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Add missing configurable for the discovery providers csi driver

Signed-off-by: Kevin Fox <[email protected]>

* Update the documentation

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Add missing file

Signed-off-by: Kevin Fox <[email protected]>

* Update for changes in spiffe-helper

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2024-01-23 08:05:49 -08:00
kfox1111 4668151ff7 Add missing extraVolumeMounts to the controllerManager (#196) 2024-01-22 11:09:10 +01:00
kfox1111 808795379c Remove CRD that isn't really a CRD (#197)
Signed-off-by: Kevin Fox <[email protected]>
2024-01-20 10:54:00 -08:00
kfox1111 b9ac3c4aec Update to spire-controller-manager 0.4.1 (#193)
Signed-off-by: Kevin Fox <[email protected]>
2024-01-19 17:10:41 -08:00
kfox1111 6fec1e598a Update SPIRE to 1.8.7 (#194)
Signed-off-by: Kevin Fox <[email protected]>
2024-01-18 21:07:53 -08:00
kfox1111andFaisal Memon af155c2edc Add support for running spiffe secured discovery provider (default) (#163)
* SPIFFE OIDC Discovery Provider Rework

Fixes: https://github.com/spiffe/helm-charts-hardened/issues/151

Signed-off-by: Kevin Fox <[email protected]>

* Enhance clusterspiffeid's so the discovery provider is independently configurable

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Undo

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Try to get output

Signed-off-by: Kevin Fox <[email protected]>

* Try and get error code

Signed-off-by: Kevin Fox <[email protected]>

* Fix more logging. Switch port used.

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Fix port

Signed-off-by: Kevin Fox <[email protected]>

* Fix up logs for nested test and fix values

Signed-off-by: Kevin Fox <[email protected]>

* Make consistent

Signed-off-by: Kevin Fox <[email protected]>

* Fix nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix insecure mode and test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var scoping issue

Signed-off-by: Kevin Fox <[email protected]>

* Set the right flags for ingress

Signed-off-by: Kevin Fox <[email protected]>

* Update dns template

Signed-off-by: Kevin Fox <[email protected]>

* Use more standard port

Signed-off-by: Kevin Fox <[email protected]>

* Fix test logging

Signed-off-by: Kevin Fox <[email protected]>

* Allow reencrypt.

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing changes

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Add LetsEncrypt/ACME/cert-manager support. Remove broken ACME support.

Signed-off-by: Kevin Fox <[email protected]>

* Use spiffe-helper as a sidecar. Significant space savings and read only cert dir

Signed-off-by: Kevin Fox <[email protected]>

* Fix the nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge issue

Signed-off-by: Kevin Fox <[email protected]>

* Remove 1.29.0 until deps catch up.

Related issue: https://github.com/rancher/kubectl/pull/94

Signed-off-by: Kevin Fox <[email protected]>

* Add more error checking

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing code

Signed-off-by: Kevin Fox <[email protected]>

* Simplify the ids. Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix logic

Signed-off-by: Kevin Fox <[email protected]>

* Fix var

Signed-off-by: Kevin Fox <[email protected]>

* Make cert-manager bits more readable

Signed-off-by: Kevin Fox <[email protected]>

* Fix template

Signed-off-by: Kevin Fox <[email protected]>

* Fix openshift ingress

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Add resource spec

Signed-off-by: Kevin Fox <[email protected]>

* Remove parts that cant merge yet

Signed-off-by: Kevin Fox <[email protected]>

* Add support for running spiffe secured discovery provider (default)

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Remove defaults

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Add missing configurable for the discovery providers csi driver

Signed-off-by: Kevin Fox <[email protected]>

* Update for changes in spiffe-helper

Signed-off-by: Kevin Fox <[email protected]>

* Point at upstream

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2024-01-18 16:08:22 -08:00
kfox1111andFaisal Memon f8327657cd Add a test and example for federation support (#169)
* SPIFFE OIDC Discovery Provider Rework

Fixes: https://github.com/spiffe/helm-charts-hardened/issues/151

Signed-off-by: Kevin Fox <[email protected]>

* Enhance clusterspiffeid's so the discovery provider is independently configurable

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Undo

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Try to get output

Signed-off-by: Kevin Fox <[email protected]>

* Try and get error code

Signed-off-by: Kevin Fox <[email protected]>

* Fix more logging. Switch port used.

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Fix port

Signed-off-by: Kevin Fox <[email protected]>

* Fix up logs for nested test and fix values

Signed-off-by: Kevin Fox <[email protected]>

* Make consistent

Signed-off-by: Kevin Fox <[email protected]>

* Fix nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix insecure mode and test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var scoping issue

Signed-off-by: Kevin Fox <[email protected]>

* Set the right flags for ingress

Signed-off-by: Kevin Fox <[email protected]>

* Update dns template

Signed-off-by: Kevin Fox <[email protected]>

* Use more standard port

Signed-off-by: Kevin Fox <[email protected]>

* Fix test logging

Signed-off-by: Kevin Fox <[email protected]>

* Allow reencrypt.

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing changes

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Add LetsEncrypt/ACME/cert-manager support. Remove broken ACME support.

Signed-off-by: Kevin Fox <[email protected]>

* Use spiffe-helper as a sidecar. Significant space savings and read only cert dir

Signed-off-by: Kevin Fox <[email protected]>

* Fix the nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge issue

Signed-off-by: Kevin Fox <[email protected]>

* Remove 1.29.0 until deps catch up.

Related issue: https://github.com/rancher/kubectl/pull/94

Signed-off-by: Kevin Fox <[email protected]>

* Add more error checking

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing code

Signed-off-by: Kevin Fox <[email protected]>

* Simplify the ids. Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix logic

Signed-off-by: Kevin Fox <[email protected]>

* Fix var

Signed-off-by: Kevin Fox <[email protected]>

* Make cert-manager bits more readable

Signed-off-by: Kevin Fox <[email protected]>

* Fix template

Signed-off-by: Kevin Fox <[email protected]>

* Fix openshift ingress

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Add resource spec

Signed-off-by: Kevin Fox <[email protected]>

* Remove parts that cant merge yet

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Add missing configurable for the discovery providers csi driver

Signed-off-by: Kevin Fox <[email protected]>

* Add a test and example for federation support

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix ingress annotations for federation bundle endpoint

Signed-off-by: Kevin Fox <[email protected]>

* Add cert-manager support to the federation bundle endpoint and fix up bundle endpoint ingress annotations

Signed-off-by: Kevin Fox <[email protected]>

* Add external secret too

Signed-off-by: Kevin Fox <[email protected]>

* Add forgotten files

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2024-01-17 15:09:32 -08:00
kfox1111 3ccdb5e4c1 Add tls section to federation bundle endpoint and fix up annotations (#173)
* Add cert-manager support to the federation bundle endpoint and fix up bundle endpoint ingress annotations

Signed-off-by: Kevin Fox <[email protected]>

* Add external secret too

Signed-off-by: Kevin Fox <[email protected]>

* Add forgotten files

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
2024-01-17 00:17:15 -08:00
kfox1111 c7ab1319cc Add join_token server nodeattestor support (#187)
Signed-off-by: Kevin Fox <[email protected]>
2024-01-16 14:52:39 -08:00
kfox1111 b61d4f5ae1 Add spire-agent to spire-agent pod path (#180) 2024-01-11 10:39:12 +00:00
kfox1111 befa074763 Fix notes bug (#178) 2024-01-11 10:31:02 +00:00
kfox1111 912c61e05c Remove deprecated version values (#179) 2024-01-11 10:29:56 +00:00
kfox1111andFaisal Memon 183e9aa534 SPIFFE OIDC Discovery Provider Rework (#152)
Co-authored-by: Faisal Memon <[email protected]>
2024-01-03 11:40:14 +01:00
kfox1111 2454b8cd2a Fix links still pointing at older git repo (#167)
Signed-off-by: Kevin Fox <[email protected]>
2023-12-27 17:10:49 -08:00
kfox1111andMarco Franssen c39dd44526 Add recommendation for namespacePSS (#131)
Co-authored-by: Marco Franssen <[email protected]>
2023-12-21 00:15:56 +00:00
kfox1111 80f9d3823c Revert to older ingress-nginx to fix tests (#161)
Signed-off-by: Kevin Fox <[email protected]>
2023-12-20 09:05:23 -08:00
kfox1111 cb7e7e82c0 Remove 1.29.0 until deps catch up. (#159)
Related issue: https://github.com/rancher/kubectl/pull/94

Signed-off-by: Kevin Fox <[email protected]>
2023-12-19 19:00:41 -08:00
kfox1111 ad905d9c3e Fix the nested test (#158)
Signed-off-by: Kevin Fox <[email protected]>
2023-12-19 16:12:46 -08:00
kfox1111andMarco Franssen 49beb64584 Add recommendation for namespaceLayout (#127)
Co-authored-by: Marco Franssen <[email protected]>
2023-12-19 15:02:57 +00:00
kfox1111andMarco Franssen f642feafef Fix test logging (#154)
Co-authored-by: Marco Franssen <[email protected]>
2023-12-19 11:52:21 +00:00
kfox1111 33cacd2ee8 Add recommendation for prometheus exporter (#144) 2023-12-19 11:38:20 +00:00
kfox1111andMarco Franssen 6997d6a904 Add recommendation for securityContext and podSecurityContext (#125)
Co-authored-by: Marco Franssen <[email protected]>
2023-12-19 11:26:26 +00:00
kfox1111 50c4ac35b0 Add recommendation for strictMode (#143) 2023-12-19 12:12:53 +01:00
kfox1111andFaisal Memon a097606d77 Remove extra example values that are already set by default (#128)
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-12-12 16:23:23 +00:00
kfox1111 1524537318 Update default for additionalDomains not to include localhost (#146)
Its pretty much only useful if you want to port forward the
discovery provider and use localhost to access it. An uncommon
use case. Its easy to add back for that case. This simplifies
production deploymnet.

Signed-off-by: Kevin Fox <[email protected]>
2023-12-12 08:14:16 -08:00
kfox1111 8615cb0840 Add devcontainer support to the repo (#98) 2023-12-12 12:50:32 +01:00
kfox1111andFaisal Memon e35838c309 Add recommendation for priorityClass (#124)
* Add a flag to enable recommendations

Signed-off-by: Kevin Fox <[email protected]>

* Add recommendation for priorityClass

Signed-off-by: Kevin Fox <[email protected]>

* Fix vars

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs. Fix typo.

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-12-11 11:42:40 -08:00
kfox1111 9f72a8f971 Use good and automatic defaults for tornjak frontend workingDir (#129)
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
2023-12-11 07:52:44 -08:00
kfox1111andMariusz Sabath 7726351955 Tornjak UBI support (#123)
* Tornjak UBI support

The Tornjak containers now have two different flavors. Vanilla and UBI.
Automatically select the UBI image when deploying on OpenShift.

Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
2023-12-11 06:56:58 -08:00
kfox1111 89c07e2d04 Revert openssl 3.2 change (#142)
Signed-off-by: Kevin Fox <[email protected]>
2023-12-11 06:33:24 -08:00
kfox1111 13f6028ccd SELinux support (#122)
* SELinux support

Add support to the chart to set the SELinux context to enable a working
system. Enable it by default on OpenShift clusters.

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
2023-12-07 11:02:06 -08:00
kfox1111andFaisal Memon 3e8335c0ee Add a flag to enable recommendations (#121)
* Add a flag to enable recommendations

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge issue

Signed-off-by: Kevin Fox <[email protected]>

* Update after reaching consensus.

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-12-02 05:15:32 -08:00
kfox1111andFaisal Memon 692d463718 Remove unneeded lookup function from upgrade hook (#104)
Those upgrading to 0.17.0 should no longer need the code to check for the old webhook.

Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-12-01 10:49:29 -08:00
Kevin Fox 69511f5a6c Merge branch 'main' into release 2023-12-01 07:17:40 -08:00
kfox1111 4281114b49 Fix missing release name from install documentation (#118)
Signed-off-by: Kevin Fox <[email protected]>
2023-11-28 12:57:11 -08:00
e030fa171b Allow additional CRs to be managed by the chart (#117)
* Add support for the new spire-controller-manager class feature

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs. Swich nested deployment to use controller manager

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Test with nightly

Signed-off-by: Kevin Fox <[email protected]>

* Fix global object naming clash

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing dot

Signed-off-by: Kevin Fox <[email protected]>

* Fix naming conflict with cluster ids

Signed-off-by: Kevin Fox <[email protected]>

* Fix scoping issue

Signed-off-by: Kevin Fox <[email protected]>

* Fix typo

Signed-off-by: Kevin Fox <[email protected]>

* Fix webhook name collision

Signed-off-by: Kevin Fox <[email protected]>

* Fix webhook reference and add note to user about className

Signed-off-by: Kevin Fox <[email protected]>

* Upgrade has to work on the old version of the object before rename

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Remove extra junk from job

Signed-off-by: Kevin Fox <[email protected]>

* Easier local runs and wait for crds

Signed-off-by: Kevin Fox <[email protected]>

* Add missing crd upgrade

Signed-off-by: Kevin Fox <[email protected]>

* Update upgrade notes

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml

Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Bump version to the released 0.4.0

Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Merge in crd changes from upstream

Signed-off-by: Kevin Fox <[email protected]>

* Add auto populate dns

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Add missing ClusterSPIFFEID fields

There are a few options in the CRD not available via the chart.
Sync them to the chart.

Signed-off-by: Kevin Fox <[email protected]>

* Add another missing one

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Allow additional CRs to be managed by the chart

Sometimes additional ClusterSPIFFEIDs and the other CRs are needed. Add
support for the end user to manage those extra CRs via the chart.

Signed-off-by: Kevin Fox <[email protected]>

* Add validation

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Add className to crs

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix readme formatting

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/README.md

Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Remove dead code

Signed-off-by: Kevin Fox <[email protected]>

* Fix extra newline

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-11-28 09:15:23 -08:00
kfox1111andMarco Franssen d936293d50 Enable agent to kubelet connection to use hostname (#112)
Co-authored-by: Marco Franssen <[email protected]>
2023-11-28 08:43:09 +01:00
kfox1111 d616632810 Bump spire version to 1.8.5 (#115) 2023-11-24 09:32:27 -08:00
Kevin Fox 966061c6c7 Auto add default CSIDriver labels on OpenShift
Signed-off-by: Kevin Fox <[email protected]>
2023-11-20 10:24:53 +01:00
kfox1111andFaisal Memon 8f542f2170 Add some nested diagrams (#102)
* Add some nested diagrams

Signed-off-by: Kevin Fox <[email protected]>

* Fix typo

Signed-off-by: Kevin Fox <[email protected]>

* Add md

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-11-13 14:14:24 -08:00
kfox1111 91d262536e Render notes correctly on vscode (#96) 2023-11-11 15:15:21 -08:00
kfox1111 f5d1376cb6 Documentation cleanup (#97)
Fix links to the repo after move. Remove references to other versions
of images we don't support.

Signed-off-by: Kevin Fox <[email protected]>
2023-11-11 12:28:41 -08:00
6c0a4fbb86 Auto tornjak url (#89)
* Autogen jwtIssuer

Unset a default for jwtIssuer and global.spire.jwtIssuer. When unset,
generate it to the default of oidc-discovery.$trustDomain so in many
cases the user doesn't need to set it at all.

Signed-off-by: Kevin Fox <[email protected]>

* Autogen tornjak's apiServerURL

Unset the default tornjak apiServerURL. When unset, default to
https://tornjak-backend.$trustDomain so in many cases users don't
have to set it.

Signed-off-by: Kevin Fox <[email protected]>

* Do more autodetection

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-11-09 13:07:52 -08:00
f2758a8b2b Autogen jwtIssuer (#88)
* Autogen jwtIssuer

Unset a default for jwtIssuer and global.spire.jwtIssuer. When unset,
generate it to the default of oidc-discovery.$trustDomain so in many
cases the user doesn't need to set it at all.

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-11-09 20:31:48 +00:00
kfox1111 c662b0c522 Merge branch 'main' into doc-ingress-patch 2023-11-09 06:43:52 -08:00
kfox1111 daf9d55c61 Merge branch 'main' into doc-ingress-patch 2023-11-08 09:24:53 -08:00
Kevin Fox aaeca009c2 Fix tests after renaming files
Signed-off-by: Kevin Fox <[email protected]>
2023-11-08 04:50:05 -08:00
805d8696d0 spire-controller-manager 0.4.0 support (#60)
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-11-08 10:43:19 +00:00
Kevin Fox f7b61406fe Fix docs
Signed-off-by: Kevin Fox <[email protected]>
2023-11-05 23:29:22 -08:00
Kevin Fox a7e8785420 Add another missing one
Signed-off-by: Kevin Fox <[email protected]>
2023-11-05 23:29:22 -08:00
Kevin Fox 3778597e72 Add missing ClusterSPIFFEID fields
There are a few options in the CRD not available via the chart.
Sync them to the chart.

Signed-off-by: Kevin Fox <[email protected]>
2023-11-05 23:29:22 -08:00
kfox1111 d6583be179 Add missing no cleanup flags to example tests (#79) 2023-11-05 14:10:16 +01:00
81cc2dc573 Ingress type openshift (#52)
* Specify ingress controller type

Signed-off-by: Kevin Fox <[email protected]>

* Fix indenting, docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix spacing

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Add ingress-nginx support

Signed-off-by: Kevin Fox <[email protected]>

* Use the right example values for test version to upgrade from.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var in wrong location

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing arg

Signed-off-by: Kevin Fox <[email protected]>

* Try this to checkout the right version

Signed-off-by: Kevin Fox <[email protected]>

* Switch to upgrading from 0.14.0

Signed-off-by: Kevin Fox <[email protected]>

* Install crds

Signed-off-by: Kevin Fox <[email protected]>

* Simple ingress support

For a lot of situations, ingress rules can be derived from trustDomain.
Change the code to generate rules by default for the user.

Signed-off-by: Kevin Fox <[email protected]>

* Add upgrade test fix from 43

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Enable unset ingress controller type to use with openshift later

Signed-off-by: Kevin Fox <[email protected]>

* Openshift ingress controller type support

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing end tag

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Fix doc merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Fix automatically generated rules on openshift

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Fix pathType

Signed-off-by: Kevin Fox <[email protected]>

* Make openshift edge rules work

Signed-off-by: Kevin Fox <[email protected]>

* Fix var scoping

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix issue created during merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
2023-11-03 13:16:14 -07:00
kfox1111 6a6aa1c850 Cosign download fix (#72) 2023-10-31 16:44:52 +00:00
kfox1111andFaisal Memon ed23d8b714 Simple ingress support (#48)
Co-authored-by: Faisal Memon <[email protected]>
2023-10-30 22:16:17 +00:00
kfox1111 d50d78d9a0 Fix ingress annotation variable for tornjak server (#66) 2023-10-28 11:47:55 -07:00
kfox1111andMarco Franssen b813807f16 Update docs to simplify, clarify, and prioritize ease of install/upgrade (#62)
* Update docs to simplify, clarify, and prioritize ease of install/upgrade

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
2023-10-26 22:13:54 +00:00
kfox1111 5ad35bd8d5 Merge pull request #59 from sabre1041/spire-agent-nodename
Added environment variable to spire-agent to inject node name
2023-10-26 14:33:13 -07:00
kfox1111andFaisal Memon 7924323a8f Specify ingress controller type (#43)
* Specify ingress controller type

Signed-off-by: Kevin Fox <[email protected]>

* Fix indenting, docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix spacing

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Add ingress-nginx support

Signed-off-by: Kevin Fox <[email protected]>

* Use the right example values for test version to upgrade from.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var in wrong location

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing arg

Signed-off-by: Kevin Fox <[email protected]>

* Try this to checkout the right version

Signed-off-by: Kevin Fox <[email protected]>

* Switch to upgrading from 0.14.0

Signed-off-by: Kevin Fox <[email protected]>

* Install crds

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Enable unset ingress controller type to use with openshift later

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs after merge issue

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-10-24 20:18:53 +00:00
kfox1111andFaisal Memon 5025025fdc Fix doc missing end tag (#46)
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-10-18 21:28:00 +00:00
kfox1111 a01cdc96d6 Production test don't cleanup flag (#44)
* Production test don't cleanup flag

For use in the future with uprade tests, we add a flag -c to the production
test to not cleanup after the testing.

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
2023-10-18 13:29:56 -07:00
56445c4f94 Spire controller manager upgrade (#8)
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
2023-10-17 19:54:12 +00:00
kfox1111 af842bec0a Bump spire versions to 1.7.4 (#35)
Signed-off-by: Kevin Fox <[email protected]>
2023-10-12 15:17:46 -07:00
kfox1111 dd87bc0fb2 Bump spire versions to 1.7.4 (#35)
Signed-off-by: Kevin Fox <[email protected]>
2023-10-12 14:52:18 -07:00
kfox1111 d13a68c5ce Bump to spire 1.7.3 (#31)
Signed-off-by: Kevin Fox <[email protected]>
2023-10-11 11:27:53 -07:00
kfox1111 df1abf6235 Bump to spire 1.7.3 (#31)
Signed-off-by: Kevin Fox <[email protected]>
2023-10-10 22:28:24 -07:00
kfox1111 0fa43a507d Add plugin support to the spire agent (#22)
* Exit code from diff indicating changes should not block commit.

Signed-off-by: Kevin Fox <[email protected]>

* Push the changes that update-tags creates

Signed-off-by: Kevin Fox <[email protected]>

* Add plugin support to the spire agent

This adapts the existing spire server plugin support to be usable by
the agent as well.

Signed-off-by: Kevin Fox <[email protected]>

* Fix notes

Signed-off-by: Kevin Fox <[email protected]>

* Add plugin support to the spire agent

This adapts the existing spire server plugin support to be usable by
the agent as well.

Signed-off-by: Kevin Fox <[email protected]>

* Fix notes

Signed-off-by: Kevin Fox <[email protected]>

* Update documentation

Signed-off-by: Kevin Fox <[email protected]>

* Update example

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
2023-10-10 08:09:11 +00:00
kfox1111andFaisal Memon afba33f179 Add spire agent experimental flags (#26)
* Add spire agent experimental flags

Signed-off-by: Kevin Fox <[email protected]>

* Fix nested test

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-agent/templates/configmap.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Regen docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-10-09 16:09:28 -07:00
kfox1111 8aca48f14c Push the changes that update-tags creates (#19)
* Exit code from diff indicating changes should not block commit.

Signed-off-by: Kevin Fox <[email protected]>

* Push the changes that update-tags creates

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
2023-10-05 10:40:32 -07:00
kfox1111 a6cb3974ac Exit code from diff indicating changes should not block commit. (#17)
Signed-off-by: Kevin Fox <[email protected]>
2023-10-05 10:23:50 -07:00
kfox1111andFaisal Memon 21db1e4b9a Add a test to ensure upgrades work (#6)
* Add a test to ensure upgrades work

Signed-off-by: Kevin Fox <[email protected]>

* Update examples/production/run-tests.sh

Co-authored-by: Faisal Memon <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-10-02 17:05:25 -07:00
kfox1111 50825d9fc9 Deny production runs of example.org trust domains (#229) 2023-09-25 12:06:48 -07:00