panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
423 Commits 1 Branch 2 Tags
4b4cef1eae36dbdc25a1eb7e4dcf35953af11811
Commit Graph
53 Commits
Author SHA1 Message Date
Marco Franssen 06ddb7cd3f Use chart-testing ci/*-values.yaml for testing 
This also enables the refactor to have multiple root level charts.

Resolves #100

Signed-off-by: Marco Franssen <[email protected]>
 2023-07-19 22:48:19 +02:00
kfox1111 19d3208740 Fix oidc provider config change not rolling out (#383) 2023-07-12 21:05:09 +02:00
Drew Wells 4ad68b154b Add namespace to spiffe-oidc-discovery-provider RBAC definitions (#379) 2023-07-06 09:50:46 -07:00
kfox1111andMarco Franssen c1b1dd3d88 Add additional domains to JWT issued items. (#230) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-07-03 22:26:28 +02:00
Marco Franssen c11a8c00e7 Implement pre-delete hook for graceful delete of spiffe-oidc-discovery-provider (#353) 2023-06-17 06:06:27 -07:00
kfox1111 e6b608c9fd Bump spire images to 1.7.0 (#348) 2023-06-16 07:26:59 +00:00
kfox1111 d0da864113 Add missing metadata to subcharts (#347) 2023-06-14 12:46:22 -07:00
kfox1111 4c0a1d52c5 Allow overriding test images (#186) 2023-06-14 21:17:08 +02:00
kfox1111 250fd5db00 Add missing global values to charts (#311) 2023-06-14 09:16:02 +02:00
Mariusz Sabath 1247b68f4d Parametrize probes (#310) 
This PR addresses #307 by parametrizing Probes and moving them to
values.yaml

---------

Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-25 08:53:44 -04:00
kfox1111 ed038feae1 Upgrade to spire 1.6.4 (#308) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 16:17:34 -07:00
kfox1111Faisal MemonMarco Franssendependabot[bot]
 		0ba03880a1 Add support for spire-server ingress (#68) 
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-05-23 13:58:58 +00:00
kfox1111 dd1ad495bd Update images for cve's found by the cronjob (#290) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-18 14:55:39 -07:00
Marco Franssen d850486478 Instead of removing version, first deprecate version 
Deprecating version allows users of the chart to have a migration path

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-17 20:21:07 +02:00
Marco Franssen 59e422b9e3 Add documentation for all image.tag values 
Signed-off-by: Marco Franssen <[email protected]>
 2023-05-17 20:21:07 +02:00
Kevin Fox d1f3cdb909 Switch image.version to image.tag 
The convention in most charts is to use image.tag. This patch updates the values
to use it instead of the less standard image.version.

Signed-off-by: Kevin Fox <[email protected]>
 2023-05-17 20:21:07 +02:00
Marco FranssenandFaisal Memon 65312f8525 Include dependency values in documentation (#275) 
I have added a flag to the helm-docs script to include the documentation
for dependencies.

This will add more complete documentation to
https://artifacthub.io/packages/helm/spiffe/spire#values so it is easier
for our users to get started and having a complete overview.

---------

Signed-off-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-05-12 18:12:23 +00:00
Faisal Memonandkfox1111 b315324244 Allow for ConfigMaps to be annotated (#272) 
Without an annotation, spinnaker will rename the configmap.

---------

Signed-off-by: Faisal Memon <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2023-05-11 10:49:06 -07:00
kfox1111andMarco Franssen 2c360a50fd Add global for image registry (#201) 
This patch enables a user to override all image registry settings all at
once to point to their own registry to enable easy custom mirrors.

partially implements: https://github.com/spiffe/helm-charts/issues/139

---------

Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-04-20 20:08:14 +02:00
kfox1111 3cc8955429 Move reusable macros to root chart (#218) 
This patch adds the start of a library to help reduce code duplication.
It will be split out to its own library chart at the same time the other
charts are split out.

---------

Signed-off-by: Kevin Fox <[email protected]>
 2023-04-18 08:54:46 +02:00
Marco Franssen d7dcfeb66c Change spiffe-oidc-provider-config configmap to yaml format 
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-17 12:02:09 +02:00
Kevin Fox 0f57f5683a Update to the 1.6.3 spire release 
Update the images to point to the 1.6.3 version of spire.

Signed-off-by: Kevin Fox <[email protected]>
 2023-04-13 23:14:50 +02:00
Marco Franssen db148c8aeb Fix trustDomain global for oidc discovery provider (#193) 2023-04-05 10:46:53 -04:00
kfox1111andMarco Franssen 563e1f7920 Add podmonitors (#165) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-04 09:55:35 +02:00
kfox1111andMarco Franssen c661d0bc7e Make service dns domain configurable (#164) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-03 19:52:36 +02:00
kfox1111andMarco Franssen 072d952d9a Switch tests to curl (#178) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-03 19:32:18 +02:00
Marco Franssen a7709287bf Switch busybox image to cgr.dev/chainguard/busybox:latest-glibc (#175) 2023-04-03 05:33:30 -07:00
kfox1111 87904164ad Enable global config for clusterName, trustDomain, and bundleConfigMap (#156) 2023-04-02 19:28:49 +02:00
Marco Franssen ae62dd1af7 Bump spire version to 1.6.1 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-25 00:40:24 +01:00
Kevin FoxandMarco Franssen 6322a9a138 Fix tests 
Signed-off-by: Kevin Fox <[email protected]>

Co-authored-by: Marco Franssen <[email protected]>
 2023-03-16 18:58:31 +01:00
Marco Franssen a9b99febb3 Add some commented lines for best practice annotations on ingress 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-16 10:08:00 +01:00
Marco Franssen e970d52ea4 Align ingress hostname with jwtIssues in spire-server chart 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-16 10:05:33 +01:00
Kevin FoxandMarco Franssen cc7121e021 Add ingress support for OIDC discovery provider 
This patch enables exposing the oidc server out with an ingress
along with tests to ensure it works.

Signed-off-by: Kevin Fox <[email protected]>

Co-authored-by: Marco Franssen <[email protected]>
 2023-03-16 10:02:22 +01:00
Marco Franssen 5fdd35b426 Improve Chart API (#119) 
Because we are already in the context of spire-agent the API looks more
logical to not have another 'agent' part in the name.

Furthermore to make it more clear the oidc provider only requires the
name of the socket as opposed to the entire path like in the other
charts I made that more explicit in the name of the value.

---------

Signed-off-by: Marco Franssen <[email protected]>
 2023-03-14 09:55:24 -07:00
kfox1111 03db6bb5fe Namespace override 
This patch makes it possible to install the subcharts in different
namespaces as needed.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-13 15:03:16 -07:00
kfox1111 661000a29a Make the agent socket configurable (#114) 2023-03-13 20:35:27 +01:00
kfox1111 b198bc7e39 Fix the tests so they can run locked down. (#111) 2023-03-11 22:10:14 +01:00
kfox1111 2e9510f3ad Switch to non root nginx (#89) 2023-03-04 15:43:03 +01:00
Kevin Fox a82ee694bf Make sure all configmap changes rollout 
Signed-off-by: Kevin Fox <[email protected]>
 2023-03-03 08:39:11 -08:00
Marco Franssen 79889ff3ed Bump spiffe-oidc-discovery-provider image to 1.6.0 (arm64 support) 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-01 15:41:47 +01:00
kfox1111andMarco Franssen 35eb3bb42e Basic Prometheus support (#28) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-02-24 22:39:15 +01:00
Marco Franssen 495d9d67e8 Align healthz ports and checks across containers 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 21:06:09 +01:00
Kevin Fox 32303d7eba Remove the need for hostpath on oidc provider 
The hostpath isn't needed. This patch removes the extra mount and changes
it to an emptyDir.

Signed-off-by: Kevin Fox <[email protected]>
 2023-02-21 15:48:02 +01:00
Marco Franssen 99d32050ba Remove option to choose different agent socket path 
Resolves #19

Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:23:36 +01:00
Marco Franssen 4e1d3d78bb Improve README.md and artifacthub.io 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:15 +01:00
Marco Franssen bba395b015 Add test for oidc discovery provider 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:15 +01:00
Marco Franssen 7d9ab07e23 Add the namespace to the oidc-discovery-provider allowed dns names 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:14 +01:00
Marco Franssen 31a75aeb43 Bump minimum spire version to 1.5.4 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:13 +01:00
Marco Franssen 05e1c2f736 Bump spire to latest 1.5.4 patch release 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:11 +01:00
Marco Franssen f0921014cf Use template function from the right chart for oidc discovery provider configmap 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:11 +01:00