Please review the below changelog to ensure this matches up with the
semantic version being applied.
> **Note**: **Maintainers** ensure to run following after merging this
PR to trigger the release workflow:
>
> ```shell
> git checkout main
> git pull
> git checkout release
> git pull
> git merge main
> git push
> ```
**Changes in this release**
* 5e2e8a91 Adds AWS KMS KeyManager support (#435)
* 77fe43f3 Cron job to check for and update images (#249)
* b7e15255 Allow job hooks to be disabled (#434)
* 5e4cf6f5 Clarify project issues identified with nesting document
(#450)
* 72893515 Update spire bits to 1.7.2 (#452)
* dc8a4545 Array spacing in values is incorrect in a file. (#451)
* 94326d9c Fixup Helm docs
* ae8941c4 Support Nested Spire with External Agent (#117)
* f40743d4 Improve Tornjak documentation (#439)
* 0124f633 Bypass example-test for docs only changes (#449)
* 48a28980 Fix chainguard image references as per issue 442 (#443)
* bd393e95 Bump test chart dependencies (#445)
* a52818a7 Add a FAQ and switch rare issue from README to it (#437)
* e60f5287 option to set KeyManager memory in spire server (#444)
* a167ce68 Bump actions/setup-go from 4.0.1 to 4.1.0
* e774584c Bump test chart dependencies (#426)
* bfec27ef Fix jwtIssuer to allow for Uris including scheme (#425)
* 7a6e4f8d Change Tornjak backend default port (#436)
* 1e3039cc Bump spire Helm Chart version from 0.11.0 to 0.11.1 (#419)
* d2e16062 issuer naming should respect issuer_name override (#378)
* a2e5c36c Bump test chart dependencies (#416)
* a09e054d support annotations so oidc can be annotated (#391)
* 7d94b105 Update spire to 1.7.1 (#412)
* 9f4d4ace Add aws_pca to the spire-server (#404)
* af13f1fc Bump test chart dependencies (#401)
* 9a6768bc Add support for disabling container selectors (#399)
* 4687e20d Merge pull request #315 from spiffe/persistence-type
* e16210c6 Merge branch 'main' into persistence-type
* 624ca9cc Remove misadded lockfile (#400)
* 7ce67c62 Bump actions/checkout from 3.5.2 to 3.5.3 (#395)
* b85ba64d Bump helm/kind-action from 1.7.0 to 1.8.0 (#396)
* a6bdb4d1 Add persistence type flag
Signed-off-by: Marco Franssen <[email protected]>
To allow for inplace upgrades of spire-server statefulset we are not
allowed to
make changes to all fields of the statefulset spec.
When bumping from 0.8.1 to the latest version the `initContainers:`
field is added in the spec and therefore does not allow for updating the
statefulset.
This fix prevents the empty initContainers block when bumping from a
previous chart version.
Signed-off-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* f4c421af Ensure the released OCI artifact is also captured in rekor
* 386e736e Bump sigstore/cosign-installer from 3.0.5 to 3.1.0 (#368)
* 99e01c67 Bump spire-controller-manager from 0.2.2 to 0.2.3 (#367)
* 4dccb0d3 Bump spire Helm Chart version from 0.9.0 to 0.9.1 (#365)
* 8409674a Fix the init container flags of the statefulset (#366)
* 3b666601 add missing federatesWith option (#361)
* 0533d925 fixes missing template (#362)
* 1333b6ab Always add parseTime=true for mysql query string (#352)
* ac3be716 Bump test chart dependencies (#358)
Signed-off-by: Marco Franssen <[email protected]>
* 57a9320 Add SPIRE 1.7.0 to main readme (#357)
* af36f7c Align the bash image version with other instances for spire-agent (#356)
* c11a8c0 Implement pre-delete hook for graceful delete of spiffe-oidc-discovery-provider (#353)
* a6dcf26 Allow for SPIRE Agent to run as non root user (#209)
* 9cf6049 Allow contributors to run linting easily on local
* e88f7f6 Add configmap annotation to spire-bundle configmap (#351)
* 020bde8 Add support to create a issuer and CA via cert-manager (#342)
* 9d504de Ignore .DS_Store files
* e6b608c Bump spire images to 1.7.0 (#348)
* c97a788 Fix bundle role/rolebinding naming conflict (#333)
* b66077e Bump peter-evans/create-pull-request from 5.0.1 to 5.0.2 (#349)
* d0da864 Add missing metadata to subcharts (#347)
* 4c0a1d5 Allow overriding test images (#186)
* 250fd5d Add missing global values to charts (#311)
* 5d8c907 Dropping k8s versions in CI older than 3, as per readme (#344)
* 8748933 Update upstream-ca-secret.yaml (#341)
* 4e07450 Fix ingress annotations for federation (#337)
* ea09199 Bump actions/checkout from 3.5.0 to 3.5.3
* 87fe198 Merge pull request #331 from edwbuck/key_conventions
* ddc0166 Fix line wrapping.
* 0cae9ce Update project/conventions.md
* cb18255 Update project/conventions.md
* 52e5c24 Upgrade Tornjak to image v1.2.2 (#328)
* 28e2abf Choose a different example for dotted Acronyms.
* d60d68c Added accidentally clipped explicit name guidelines.
* abe9fde Merge branch 'main' into key_conventions
* f6a7b62 Update project/conventions.md
* c4d19db Update project/conventions.md
* cfa9f78 Bump test chart dependencies (#332)
* c3213ab Initial submission of Helm Chart key naming conventions.
* 28c0824 Bump test chart dependencies (#322)
* d333154 Add Makefile for local testing (#327)
* 9fa1ec2 Improve Tornjak backend test (#321)
* 5b779dc Improve Tornjak frontend test (#320)
Signed-off-by: Marco Franssen <[email protected]>
@faisal-memon we will need to update the required checks in branch
protection to use the new version
---------
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Faisal Memon <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Edited event is only useful if you want a workflow to act on a PR
description or title or labels and such, we are not doing that in this
workflow.
Removing the edited type from the event doesn't unnecessarily run the
workflow again when title, description and such are changed.
Signed-off-by: Marco Franssen <[email protected]>
Tornjak only supports amd64 builds at the moment
To prevent deployment failures on clusters with arm64 nodes I have added a nodeSelector for tornjak frontend, and documentation for spire-server
Signed-off-by: Marco Franssen <[email protected]>
- Align tornjak backend naming with same convention as frontend
- Align Tornjak backend and frontend notes style
- Add disclaimer for Tornjak usage to example
---------
Signed-off-by: Marco Franssen <[email protected]>
Please review the below changelog to ensure this matches up with the
semantic version being applied.
> **Note**: **Maintainers** ensure to run following after merging this
PR to trigger the release workflow:
>
> ```shell
> git checkout main
> git pull
> git checkout release
> git pull
> git merge main
> git push
> ```
**Changes in this release**
* 65312f85 Include dependency values in documentation (#275)
* 5489212b Remove persistence.enabled flag (#274)
* b3153242 Allow for ConfigMaps to be annotated (#272)
* 013eb617 Fix spacing for spire server service annotation (#273)
* 73435be9 Add project glossary. (#262)
* c4656a74 Replicas > 1 is not allowed with sqlite driver (#269)
* d3da3eed External database configuration (#225)
* ce78bea1 Add Edwin Buck as a maintainer. (#267)
* 1f09d7b3 Bump test chart dependencies (#264)
* aa6b40c0 Add project overview. (#258)
* 8e7e6ebc Allow trust bundle url to be set along with format (#256)
* 1e09ea54 Bump peter-evans/create-pull-request from 5.0.0 to 5.0.1
(#253)
* 6760cd22 Bump test chart dependencies (#252)
* 61e338df Fix example production typos (#244)
* 3d81928f Add skipKubeletVerification configurable (#243)
* 46f10e1d Merge pull request #237 from spiffe/fix-check-versions
* 3889d22e Fix quotation bug in update-version.sh
* 6a894e8c Move update-versions.sh script
* 91083a6b Add post-install scripts to all tests to capture failure
details in GitHub workflow summary (#88)
* 9afb6f80 Merge pull request #242 from spiffe/shellcheck
* 99af475f Resolve shellcheck issues
* d0a1e128 Add workflow with shellcheck
* 8abd75ef Merge pull request #241 from
spiffe/dependabot/github_actions/sigstore/cosign-installer-3.0.3
* 252f1f5a Bump cosign to v2.0.2
* 247e3e5d Bump sigstore/cosign-installer from 3.0.2 to 3.0.3
* 17d62f12 Add an action to find new versions of helm charts (#184)
* 2c360a50 Add global for image registry (#201)
* 3cc89554 Move reusable macros to root chart (#218)
* 3fc81780 Add k8s 1.27 to CI + bump other versions to latest patches
(#219)
* 6b617440 Merge pull request #113 from
spiffe/spire-config-as-yaml-converted-json
* 9e03f297 Merge branch 'main' into spire-config-as-yaml-converted-json
* 210ed02c Remove dead code (#217)
* e3b0d00b Bump min required spire 1.6.x version for this chart
* d7dcfeb6 Change spiffe-oidc-provider-config configmap to yaml format
* 861108c0 Change spire-agent configmap to yaml format
* 1d72b572 Change spire-server configmap to yaml format
Signed-off-by: Marco Franssen <[email protected]>
I have added a flag to the helm-docs script to include the documentation
for dependencies.
This will add more complete documentation to
https://artifacthub.io/packages/helm/spiffe/spire#values so it is easier
for our users to get started and having a complete overview.
---------
Signed-off-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* 6c21f13 Bump actions/checkout from 3.5.0 to 3.5.2
* 0f57f56 Update to the 1.6.3 spire release
* b82abab Revert "Switch to persistence" (#210)
* 0dec80e Switch to persistence (#200)
Signed-off-by: Marco Franssen <[email protected]>
* 563e1f7 Add podmonitors (#165)
* 456075f Add hooks to set failurepolicy to ignore on webhook (#128)
* d5dc706 Add Kubernetes 1.21 back (#188)
* daa620b Fix production example test (#183)
* c661d0b Make service dns domain configurable (#164)
* ec236e9 Test for configurable images (#182)
* 280315c Fix namespace-override github test summary (#154)
* 072d952 Switch tests to curl (#178)
* 1b4bfb7 Cleanup old leftover to k8s-workload-registrar
* a770928 Switch busybox image to cgr.dev/chainguard/busybox:latest-glibc (#175)
* 8790416 Enable global config for clusterName, trustDomain, and bundleConfigMap (#156)
* b54c41a Enhance the production example
* dfb32dc Revert adding tornjak to be releasable (#180)
* 059d5fb Bump spire Helm Chart version from 0.5.0 to 0.5.1
* e2ec6ac Add a test to ensure the chart versions match (#163)
* 64585ba Fix formatting issues introduced with #152
* 0dac0db Improve Spire Chart documentation
* f709ed9 Bump actions/checkout from 3.4.0 to 3.5.0
* faef439 Bump helm/chart-testing-action from 2.3.1 to 2.4.0
* ae62dd1 Bump spire version to 1.6.1
* 02fda80 Add Artifact Hub badge to README.md
* 901e670 Disable default Tornjak deployment (#153)
* 05d0f47 Introduction of Tornjak to SPIRE Server helm charts (#144)
* b25dc77 Test fixing the tests (#148)
* b4be9ed Add maturity tag (#138)
* d4fd2ce Extract the namespace override test out of the old lockdown test. (#145)
* 4f85802 Update lockdown test to test the production example
* 04a1305 Fork the lockdown test to two tests as it is doing the work of 2 (#134)
* 64d0107 Resolve issue in prod example on volume mount (#143)
* 5b6708b Remove @dennisgove from CODEOWNERS (#140)
* a516caa Remove k8s 1.21 from test matrix + small syntax error fix (#133)
* 811a2f6 Add option to enable federation on spire-server (#97)
Signed-off-by: Marco Franssen <[email protected]>
* 64585ba Fix formatting issues introduced with #152
* 0dac0db Improve Spire Chart documentation
* f709ed9 Bump actions/checkout from 3.4.0 to 3.5.0
* faef439 Bump helm/chart-testing-action from 2.3.1 to 2.4.0
* ae62dd1 Bump spire version to 1.6.1
* 02fda80 Add Artifact Hub badge to README.md
* 901e670 Disable default Tornjak deployment (#153)
* 05d0f47 Introduction of Tornjak to SPIRE Server helm charts (#144)
* b25dc77 Test fixing the tests (#148)
* b4be9ed Add maturity tag (#138)
* d4fd2ce Extract the namespace override test out of the old lockdown test. (#145)
* 4f85802 Update lockdown test to test the production example
* 04a1305 Fork the lockdown test to two tests as it is doing the work of 2 (#134)
* 64d0107 Resolve issue in prod example on volume mount (#143)
* 5b6708b Remove @dennisgove from CODEOWNERS (#140)
* a516caa Remove k8s 1.21 from test matrix + small syntax error fix (#133)
* 811a2f6 Add option to enable federation on spire-server (#97)
Signed-off-by: Marco Franssen <[email protected]>
- Remove k8s 1.21 from test matrix
- Fix syntax
- Improve readability test step
Officialy according to readme we support last three k8s versions.
Testing last 5 versions should be sufficient.
---------
Signed-off-by: Marco Franssen <[email protected]>
* fae12af Merge pull request #60 from spiffe/oidc-ingress
* 6322a9a Fix tests
* a9b99fe Add some commented lines for best practice annotations on ingress
* e970d52 Align ingress hostname with jwtIssues in spire-server chart
* cc7121e Add ingress support for OIDC discovery provider
* eaed7c9 Bump actions/checkout from 3.3.0 to 3.4.0 (#129)
* 2e3f045 Make webhook fail policy configurable (#124)
* 9ccbd3c Make kubelet path configurable (#123)
* 80e3b58 Remove dead file from failed rebase. (#121)
* 7155d71 Add documentation how to use Spire in own workloads
* 25c77fc Fix the driver not coming up on overloaded nodes
* 5fdd35b Improve Chart API (#119)
* 03db6bb Namespace override
* 661000a Make the agent socket configurable (#114)
* f3a81ad Make csi driver configurable to be able to run multiple instances (#115)
* b198bc7 Fix the tests so they can run locked down. (#111)
* 09b21ac Fix the gate
* b6716ae Test that it is possible to lock down security of pods (#84)
* bfeb217 Fix cluster role name uniqueness
* 490fe8f Enhance the test workflow scripts
* 9e22d2c Make the namespace the bundle is dropped into configurable
* 7d1f821 Fix test.
* 493ad8f Remove some duplication on chart-testing CI
* b6dd136 Add tmp mount so that server can run locked down (#105)
* aaaf2f7 Remove dead role code
* d2eba22 Fix docs
* 6d43625 Add kfox as a maintainer
* dfa4e6c Ensure CI also runs when test scripts are changed
Signed-off-by: Marco Franssen <[email protected]>
Because we are already in the context of spire-agent the API looks more
logical to not have another 'agent' part in the name.
Furthermore to make it more clear the oidc provider only requires the
name of the socket as opposed to the entire path like in the other
charts I made that more explicit in the name of the value.
---------
Signed-off-by: Marco Franssen <[email protected]>
