panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
412 Commits 1 Branch 2 Tags
3ed1859cd1c860be67605509e23d9da1b4e3c935
Commit Graph
412 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
kfox1111 3ed1859cd1 Add missing tolerations config to daemonsets (#381) 
spiffe-csi-driver and spire-agent are missing the ability to specify
tolerations. This PR adds the missing functionality.

fixes: https://github.com/spiffe/helm-charts/issues/380

Signed-off-by: Kevin Fox <[email protected]>
 2023-07-06 12:48:59 -05:00
Drew Wells 4ad68b154b Add namespace to spiffe-oidc-discovery-provider RBAC definitions (#379) 2023-07-06 09:50:46 -07:00
kfox1111andMarco Franssen c1b1dd3d88 Add additional domains to JWT issued items. (#230) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-07-03 22:26:28 +02:00
marcofranssen 3405e13944 Bump test chart dependencies 
Signed-off-by: GitHub <[email protected]>
Signed-off-by: Faisal Memon <[email protected]>
 2023-07-03 17:38:56 +02:00
LaithLite 81452d5e7e Fix missing spiffe-csi-driver imagePullSecrets template (#376) 2023-07-03 12:52:31 +02:00
Marco Franssen ac5977288e Bump spire Helm Chart version from 0.10.0 to 0.10.1 
* d7a03f62 Fix bug in cert-manager upstream authority
* e57c13ac Bump test chart dependencies (#370)

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-30 16:06:21 +02:00
Marco Franssen d7a03f620d Fix bug in cert-manager upstream authority 
The arguments for default function need to be the other way around

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-29 17:39:21 +02:00
github-actions[bot]andmarcofranssen e57c13ac13 Bump test chart dependencies (#370) 
Co-authored-by: marcofranssen <[email protected]>
 2023-06-29 08:16:31 +02:00
Marco Franssen 5500d36b1a Bump spire Helm Chart version from 0.9.1 to 0.10.0 
* f4c421af Ensure the released OCI artifact is also captured in rekor
* 386e736e Bump sigstore/cosign-installer from 3.0.5 to 3.1.0 (#368)
* 99e01c67 Bump spire-controller-manager from 0.2.2 to 0.2.3 (#367)
* 4dccb0d3 Bump spire Helm Chart version from 0.9.0 to 0.9.1 (#365)
* 8409674a Fix the init container flags of the statefulset (#366)
* 3b666601 add missing federatesWith option (#361)
* 0533d925 fixes missing template (#362)
* 1333b6ab Always add parseTime=true for mysql query string (#352)
* ac3be716 Bump test chart dependencies (#358)

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-28 19:01:25 +02:00
dependabot[bot]andMarco Franssen 731c8b45b5 Bump sigstore/cosign-installer from 3.1.0 to 3.1.1 (#373) 
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marco Franssen <[email protected]>
 2023-06-28 08:40:55 -07:00
Marco Franssen f4c421afa0 Ensure the released OCI artifact is also captured in rekor 
Signed-off-by: Marco Franssen <[email protected]>
 2023-06-27 09:30:09 +02:00
dependabot[bot]andMarco Franssen 386e736e78 Bump sigstore/cosign-installer from 3.0.5 to 3.1.0 (#368) 
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marco Franssen <[email protected]>
 2023-06-26 08:54:42 -07:00
Marco Franssen 99e01c6722 Bump spire-controller-manager from 0.2.2 to 0.2.3 (#367) 
resolves a bunch of vulnerabilities in the Image

Signed-off-by: Marco Franssen <[email protected]>

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-22 16:16:43 -07:00
Marco Franssen 4dccb0d3b6 Bump spire Helm Chart version from 0.9.0 to 0.9.1 (#365) 2023-06-22 18:57:33 +02:00
kfox1111 8409674a3e Fix the init container flags of the statefulset (#366) 2023-06-22 18:57:07 +02:00
Drew Wells 3b6666016c add missing federatesWith option (#361) 
DEMO

```
spire-server-0 -- spire-server entry show -spiffeID spiffe://box-4.example.com/ns/dwells/sa/dwells-rc-realm-client
Defaulted container "spire-server" out of: spire-server, spire-controller-manager, wait (init)
Found 1 entry
Entry ID         : 09301666-010e-4ba9-9dcb-44370d4e49e4
SPIFFE ID        : spiffe://box-4.example.com/ns/dwells/sa/dwells-rc-realm-client
Parent ID        : spiffe://box-4.example.com/spire/agent/k8s_psat/example-cluster/ff93872d-791f-4bf3-a532-475775d03d3e
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : k8s:pod-uid:40e0bcad-6ec8-460b-a839-659654549d7a
FederatesWith    : box-3.example.com
```

Signed-off-by: Drew Wells <[email protected]>
 2023-06-22 08:45:37 -07:00
Drew Wells 0533d92594 fixes missing template (#362) 2023-06-22 09:40:08 -04:00
Faisal Memon 1333b6ab34 Always add parseTime=true for mysql query string (#352) 2023-06-20 21:14:42 +02:00
github-actions[bot]marcofranssenFaisal Memon
 		ac3be716dd Bump test chart dependencies (#358) 
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-06-20 08:41:41 +02:00
Marco Franssen 44f3554708 Bump spire Helm Chart version from 0.8.1 to 0.9.0 
* 57a9320 Add SPIRE 1.7.0 to main readme (#357)
* af36f7c Align the bash image version with other instances for spire-agent (#356)
* c11a8c0 Implement pre-delete hook for graceful delete of spiffe-oidc-discovery-provider (#353)
* a6dcf26 Allow for SPIRE Agent to run as non root user (#209)
* 9cf6049 Allow contributors to run linting easily on local
* e88f7f6 Add configmap annotation to spire-bundle configmap (#351)
* 020bde8 Add support to create a issuer and CA via cert-manager (#342)
* 9d504de Ignore .DS_Store files
* e6b608c Bump spire images to 1.7.0 (#348)
* c97a788 Fix bundle role/rolebinding naming conflict (#333)
* b66077e Bump peter-evans/create-pull-request from 5.0.1 to 5.0.2 (#349)
* d0da864 Add missing metadata to subcharts (#347)
* 4c0a1d5 Allow overriding test images (#186)
* 250fd5d Add missing global values to charts (#311)
* 5d8c907 Dropping k8s versions in CI older than 3, as per readme (#344)
* 8748933 Update upstream-ca-secret.yaml (#341)
* 4e07450 Fix ingress annotations for federation (#337)
* ea09199 Bump actions/checkout from 3.5.0 to 3.5.3
* 87fe198 Merge pull request #331 from edwbuck/key_conventions
* ddc0166 Fix line wrapping.
* 0cae9ce Update project/conventions.md
* cb18255 Update project/conventions.md
* 52e5c24 Upgrade Tornjak to image v1.2.2 (#328)
* 28e2abf Choose a different example for dotted Acronyms.
* d60d68c Added accidentally clipped explicit name guidelines.
* abe9fde Merge branch 'main' into key_conventions
* f6a7b62 Update project/conventions.md
* c4d19db Update project/conventions.md
* cfa9f78 Bump test chart dependencies (#332)
* c3213ab Initial submission of Helm Chart key naming conventions.
* 28c0824 Bump test chart dependencies (#322)
* d333154 Add Makefile for local testing (#327)
* 9fa1ec2 Improve Tornjak backend test (#321)
* 5b779dc Improve Tornjak frontend test (#320)

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-20 00:14:48 +02:00
Faisal Memon 57a93205a7 Add SPIRE 1.7.0 to main readme (#357) 2023-06-19 20:29:17 +02:00
Marco Franssen af36f7c09b Align the bash image version with other instances for spire-agent (#356) 
Signed-off-by: Marco Franssen <[email protected]>

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-19 11:28:35 -07:00
Marco Franssen c11a8c00e7 Implement pre-delete hook for graceful delete of spiffe-oidc-discovery-provider (#353) 2023-06-17 06:06:27 -07:00
kfox1111Marco FranssenFaisal Memon
 		a6dcf267d1 Allow for SPIRE Agent to run as non root user (#209) 
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-06-17 10:32:41 +02:00
Marco Franssen 9cf6049afd Allow contributors to run linting easily on local 
Signed-off-by: Marco Franssen <[email protected]>
 2023-06-17 03:42:41 +02:00
Faisal Memon e88f7f6fe2 Add configmap annotation to spire-bundle configmap (#351) 2023-06-16 23:22:44 +02:00
Drew WellsandKevin Fox 020bde8561 Add support to create a issuer and CA via cert-manager (#342) 
Co-authored-by: Kevin Fox <[email protected]>
 2023-06-16 21:04:11 +00:00
Faisal Memon 9d504de05b Ignore .DS_Store files 
Signed-off-by: Faisal Memon <[email protected]>
 2023-06-16 17:30:51 +02:00
kfox1111 e6b608c9fd Bump spire images to 1.7.0 (#348) 2023-06-16 07:26:59 +00:00
kfox1111 c97a788c85 Fix bundle role/rolebinding naming conflict (#333) 2023-06-16 08:55:49 +02:00
dependabot[bot] b66077eff1 Bump peter-evans/create-pull-request from 5.0.1 to 5.0.2 (#349) 
Bumps
[peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request)
from 5.0.1 to 5.0.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/peter-evans/create-pull-request/releases">peter-evans/create-pull-request's
releases</a>.</em></p>
<blockquote>
<h2>Create Pull Request v5.0.2</h2>
<p>⚙️ Fixes an issue that occurs when using <code>push-to-fork</code>
and both base and head repositories are in the same org/user
account.</p>
<h2>What's Changed</h2>
<ul>
<li>fix: specify head repo by <a
href="https://github.com/peter-evans"><code>@​peter-evans</code></a> in
<a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/2044">peter-evans/create-pull-request#2044</a></li>
<li>20 dependency updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/peter-evans/create-pull-request/compare/v5.0.1...v5.0.2">https://github.com/peter-evans/create-pull-request/compare/v5.0.1...v5.0.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/153407881ec5c347639a548ade7d8ad1d6740e38"><code>1534078</code></a>
fix: specify head repo (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2044">#2044</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/143be5d671929f35a2d146afde2bbf411a1cdae7"><code>143be5d</code></a>
build(deps-dev): bump <code>@​typescript-eslint/parser</code> from
5.59.9 to 5.59.11 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2048">#2048</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/51e8ca23403d80681e9ee4d3a6f2a7749650103f"><code>51e8ca2</code></a>
build(deps-dev): bump <code>@​types/node</code> from 18.16.16 to
18.16.18 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2047">#2047</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/712add83f26c1e359c046a6ca3dd677fb7017626"><code>712add8</code></a>
build(deps-dev): bump <code>@​types/jest</code> from 29.5.1 to 29.5.2
(<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2026">#2026</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/a9e8aabc8b4513752b51efcb32d166e65979b3e5"><code>a9e8aab</code></a>
build(deps-dev): bump eslint from 8.41.0 to 8.42.0 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2024">#2024</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/37be4ffd941e930a6dc8d42c5a893e62760a6105"><code>37be4ff</code></a>
build(deps-dev): bump <code>@​typescript-eslint/parser</code> from
5.59.8 to 5.59.9 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2023">#2023</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/a5f0e5dc8e47c41b694db6acd592fb79ff9be31f"><code>a5f0e5d</code></a>
build(deps-dev): bump eslint-plugin-github from 4.7.0 to 4.8.0 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2025">#2025</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/9ef70ee495af6d0ff9825b3e6050f304a290283a"><code>9ef70ee</code></a>
build(deps-dev): bump <code>@​types/node</code> from 18.16.14 to
18.16.16 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2009">#2009</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/0a287739d3c2d8485ed6e8be96cba0ab8ce870ee"><code>0a28773</code></a>
build(deps-dev): bump <code>@​typescript-eslint/parser</code> from
5.59.7 to 5.59.8 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2008">#2008</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/4ddb8c8fe7f58d02d4d1d62359fd91fe4d54361d"><code>4ddb8c8</code></a>
build: update distribution (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/1986">#1986</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/peter-evans/create-pull-request/compare/v5.0.1...v5.0.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=peter-evans/create-pull-request&package-manager=github_actions&previous-version=5.0.1&new-version=5.0.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-06-15 09:53:51 -07:00
kfox1111 d0da864113 Add missing metadata to subcharts (#347) 2023-06-14 12:46:22 -07:00
kfox1111 4c0a1d52c5 Allow overriding test images (#186) 2023-06-14 21:17:08 +02:00
kfox1111 250fd5db00 Add missing global values to charts (#311) 2023-06-14 09:16:02 +02:00
Drew Wells 5d8c9079a1 Dropping k8s versions in CI older than 3, as per readme (#344) 2023-06-13 11:54:30 -07:00
Drew Wells 8748933548 Update upstream-ca-secret.yaml (#341) 
Fix an issue with nested context being used for namespace

Fixes this issue:
```
Error: UPGRADE FAILED: template: spire/charts/spire-server/templates/upstream-ca-secret.yaml:8:16: executing "spire/charts/spire-server/templates/upstream-ca-secret.yaml" at <include "spire-server.names
pace" .>: error calling include: template: spire/charts/spire-server/templates/_helpers.tpl:30:16: executing "spire-server.namespace" at <.Values.namespaceOverride>: nil pointer evaluating interface {}.
namespaceOverride
helm.go:84: [debug] template: spire/charts/spire-server/templates/upstream-ca-secret.yaml:8:16: executing "spire/charts/spire-server/templates/upstream-ca-secret.yaml" at <include "spire-server.namespac
e" .>: error calling include: template: spire/charts/spire-server/templates/_helpers.tpl:30:16: executing "spire-server.namespace" at <.Values.namespaceOverride>: nil pointer evaluating interface {}.nam
espaceOverride
```

Signed-off-by: Drew Wells <[email protected]>
 2023-06-12 11:25:14 -07:00
kfox1111 4e07450781 Fix ingress annotations for federation (#337) 
fixes: https://github.com/spiffe/helm-charts/issues/336

Signed-off-by: Kevin Fox <[email protected]>
 2023-06-12 05:50:26 -07:00
dependabot[bot] ea09199196 Bump actions/checkout from 3.5.0 to 3.5.3 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3.5.0 to 3.5.3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3.5.0...v3.5.3)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-06-12 10:11:23 +02:00
Edwin Buck 87fe19888b Merge pull request #331 from edwbuck/key_conventions 
Initial submission of Helm Chart key naming conventions.
 2023-06-09 11:51:55 -05:00
Edwin Buck ddc0166689 Fix line wrapping. 
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-09 11:47:11 -05:00
Edwin Buckandkfox1111 0cae9ce7c7 Update project/conventions.md 
Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-09 11:08:10 -05:00
Edwin Buckandkfox1111 cb18255815 Update project/conventions.md 
Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-09 11:07:51 -05:00
Mariusz SabathandEdwin Buck 52e5c24947 Upgrade Tornjak to image v1.2.2 (#328) 
Upgrade Tornjak image to version v1.2.2
(https://github.com/spiffe/tornjak/releases/tag/v1.2.2)

- Resolving issue #326 (remove an emergency patch) 
- Refactor and improve Tornajk image build process

---------

Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Edwin Buck <[email protected]>
 2023-06-08 14:29:01 -04:00
Edwin Buck 28e2abf762 Choose a different example for dotted Acronyms. 
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-08 07:00:12 -07:00
Edwin Buck d60d68c131 Added accidentally clipped explicit name guidelines. 
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-08 06:54:49 -07:00
Edwin Buck abe9fde697 Merge branch 'main' into key_conventions 2023-06-07 14:37:13 -05:00
Edwin BuckandMarco Franssen f6a7b62d98 Update project/conventions.md 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-07 14:36:59 -05:00
Edwin BuckandFaisal Memon c4d19db98d Update project/conventions.md 
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-07 14:33:00 -05:00
github-actions[bot] cfa9f78885 Bump test chart dependencies (#332) 2023-06-05 16:46:48 -07:00
Edwin Buck c3213abe37 Initial submission of Helm Chart key naming conventions. 
Closes #329

Signed-off-by: Edwin Buck <[email protected]>
 2023-06-03 09:58:50 -07:00