panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,191 Commits 1 Branch 2 Tags
4d96f353bbd237958bd17cc96068e4d9fc4ca991
Commit Graph
257 Commits
Author SHA1 Message Date
Faisal Memon a062e49c91 Bump spire Helm Chart version from 0.28.3 to 0.28.4 
* 01342172 Fix typos in error messages (#788)
* 040ccf90 Bump versions to 1.14.5 (#789)
* 9273f11f Support root-level spire-lib chart reuse (#785)
* 145f3a36 chore: Add configurable probes for controller-manager (#784)
* a27acbcb Bump test chart dependencies (#786)
* 838a3535 Label chart (#783)
* 59de7aa3 Bump test chart dependencies (#779)
* 96773a31 Bump versions (#777)
* aad7527c Add set_key_use configuration option (#774)
* de59147f fix gather hostcert edge case issues (#775)
* bf4bd819 feature: add awsSecretsManager upstreamAuthority (#772)
* f78c1d42 Bump test chart dependencies (#773)
* 7afffd75 Bump test chart dependencies (#771)
* 60899fc9 Add configurable hostNetwork support to spiffe-csi-driver (#769)
* 2de363a4 Bump test chart dependencies (#767)
* 6631349b feat(spire-server): add logEncoding parameter for controller-manager (#766)

Signed-off-by: Faisal Memon <[email protected]>
 2026-04-10 15:48:58 -07:00
kfox1111 040ccf905b Bump versions to 1.14.5 (#789) 
Signed-off-by: Kevin Fox <[email protected]>
 2026-04-09 10:07:37 -07:00
kfox1111 96773a310f Bump versions (#777) 
* Bump versions

Signed-off-by: Kevin Fox <[email protected]>

* Try this

Signed-off-by: Kevin Fox <[email protected]>

* Fix test for newer spire

Signed-off-by: Kevin Fox <[email protected]>

* Bump controller manager version

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
 2026-03-29 12:13:59 -07:00
Faisal Memon 8afe8cf6e7 Bump spire Helm Chart version from 0.28.2 to 0.28.3 
* 2385c2d7 Bump spire to 1.14.2 (#763)

Signed-off-by: Faisal Memon <[email protected]>
 2026-03-04 07:58:57 -08:00
kfox1111 2385c2d7a2 Bump spire to 1.14.2 (#763) 2026-03-04 00:57:14 +00:00
Faisal Memon 85989b45eb Bump spire Helm Chart version from 0.28.1 to 0.28.2 
* 24b3a173 Change hostNetwork to auto (#758)
* 0133d4a5 add key experimental.requirePQKEM for spire-server and spire-agent (#755)
* 0a841c76 Bump test chart dependencies (#759)
* a9bee70c feat(spiffe-oidc-discovery-provider): Add configurable log format option. (#757)
* bb4c0f33 chore: Bump controller manager image tag to 0.6.3 in README and values.yaml (#756)
* 3e8f3f18 Bump test chart dependencies (#753)
* b0aa3e42 Fix duplicate port names in controller-manager containers (#751)
* 3daadc64 fix(spire-server): Support duration strings for connMaxLifetime (#752)
* 730b76bb Bump test chart dependencies (#750)
* e849a1fb Add configurable hostNetwork parameter for spire-agent (#749)
* 982d53c2 Add ContainerResource scaling to spire-server HPA (#746)
* 8abac78a Support leaderElection values in controller manager (#740)
* 75ffbd06 Add imagePullSecrets support to helm hook jobs (#741)
* 141c8865 Add pobLabels support to csi and oidc (#744)
* 6b5d01b7 Bump test chart dependencies (#743)
* ba2b6a5a Add controller-manager metrics to PodMonitor (#748)
* 86a806f3 Add tolerations to spire-server hook pods (#742)
* 7d266454 Fix keyManager check stopping use of unsupported bulit-in plugin (#715)
* 666d304c Bump test chart dependencies (#738)
* a7ac6a49 feat(spire-server): add logFormat configuration option (#735)

Signed-off-by: Faisal Memon <[email protected]>
 2026-03-03 15:21:39 -08:00
Rowan Ruseler 75ffbd06f5 Add imagePullSecrets support to helm hook jobs (#741) 
* Add imagePullSecrets support to helm hook jobs

Hook jobs lacked imagePullSecrets configuration on their pod specs,
causing image pull failures in environments using private registries
with authentication

* spire-server: post-install, pre-upgrade, post-upgrade, pre-delete
  hooks
* spire-oidc-discovery-provider: pre-delete hook
* spike-nexus: bootstrap hook
* spire: global imagePullSecrets

Fixes #649

Signed-off-by: Rowan Ruseler <[email protected]>

* Document global.imagePullSecrets parameter

Signed-off-by: Rowan Ruseler <[email protected]>

* Replaced non functioning 'or' with 'coalesce'

Signed-off-by: Rowan Ruseler <[email protected]>

---------

Signed-off-by: Rowan Ruseler <[email protected]>
 2026-02-11 15:16:16 -08:00
Faisal Memon c826e29705 Bump spire Helm Chart version from 0.28.0 to 0.28.1 
* e99d9609 Bump test chart dependencies (#732)
* a7abf7d7 disable hostNetwork on spire-agent daemonset if connect by hostname is true (#705)

Signed-off-by: Faisal Memon <[email protected]>
 2026-01-27 09:09:02 -08:00
Faisal Memonandkfox1111 3c724632ee Bump spire Helm Chart version from 0.27.1 to 0.28.0 (#731) 
* 6f2c71b0 Update spire to 1.14.1 (#729)
* f8f1e21f CSI driver: Support setting podSecurityContext and securityContext (#642)
* 813203a4 Update spike to the newest version (#665)
* 97c383b1 Add Configurable Kubelet Address for SPIRE Agent (#709)
* 8555efc6 Bump test chart dependencies
* e6c9d975 Bump test chart dependencies
* 87da80a8 Add support for AWS KMS key tagging (#721)
* db8f1352 Bump test chart dependencies (#720)
* b1f902b6 Bump test chart dependencies
* 198cdb60 Bump test chart dependencies
* dfbbecf0 Add guard to the validating admission policy to stop errors when there are no volumes in the spec. This fixes errors with HTTP solver pods in cert manager. (#706)
* 1e1e8daa Add support for attested node pruning configuration (#713)
* a2130ff7 Bump test chart dependencies (#712)
* adc5f3e8 Bump test chart dependencies
* 4e0cdb13 Bump test chart dependencies
* 95fa0deb Allow configuring spire-agent prometheus listening address (#701)

Signed-off-by: Faisal Memon <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2026-01-26 19:42:54 +00:00
kfox1111 6f2c71b04d Update spire to 1.14.1 (#729) 
Signed-off-by: Kevin Fox <[email protected]>
 2026-01-23 21:15:49 +00:00
Faisal Memon 4b85cb6015 Bump spire Helm Chart version from 0.27.0 to 0.27.1 
* 18b81443 Bump test chart dependencies (#698)
* 31091cf5 Add oidc server_path_prefix option (#695)
* 8dffc8ed use spire-agent.hostCert.resources to set resources for corresponding spire-agent init container (#691)
* e75e095e Bump test chart dependencies (#696)
* aab7c68d Bump test chart dependencies (#692)
* ca6e9f34 Bump test chart dependencies
* a3739244 Bump test chart dependencies
* c52edb99 chore: update SPIRE to 1.13.2 (#681)
* 41bd5b95 fix socketAlternate names throwing an error if set to an empty list (#678)
* 54024730 Bump test chart dependencies (#684)
* 89259757 Bump test chart dependencies (#674)
* 0f5bb04a Bump test chart dependencies (#672)

Signed-off-by: Faisal Memon <[email protected]>
 2025-11-25 10:53:21 -07:00
Monfortonandkfox1111 c52edb9928 chore: update SPIRE to 1.13.2 (#681) 
Signed-off-by: Monforton <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2025-10-13 10:59:13 -07:00
Faisal Memon 4da35fabeb Bump spire Helm Chart version from 0.26.1 to 0.27.0 (#670) 
* e73d76a0 Bump test chart dependencies (#669)
* 1ab06a1b Support for Cloud SQL Proxy in GCP (#646)
* 3c3718c9 Update spire to 1.13.0 (#667)
* 1feeca1c make spire server's auth_opa_policy_engine configurable in the helm chart (#663)
* d51bf52a Bump test chart dependencies (#666)
* c1b0cfe3 Add controller manager configs gcInterval, logLevel, and make entryIDPrefix configurable (#662)
* bb876121 Spire agent helm chart: allow configuring logFormat (#661)
* d6edae68 Add labels to the spiffe-oidc-discovery-provider values.yaml (#656)
* 6376190b Bump test chart dependencies (#660)
* 9a802563 Bump test chart dependencies (#658)
* 5e5810be Bump test chart dependencies (#653)
* 86feac63 Bump test chart dependencies (#647)
* 5e40cfb2 Update imagePullPolicy to IfNotPresent (#643)
* 86f0aecc Bump test chart dependencies (#641)
* 3ef5fe6c Add Datadog as telemetry option (#639)

Signed-off-by: Faisal Memon <[email protected]>
 2025-09-24 07:08:26 -07:00
kfox1111 3c3718c904 Update spire to 1.13.0 (#667) 
Signed-off-by: Kevin Fox <[email protected]>
 2025-09-16 22:13:29 -07:00
Faisal Memon acfcc9d0a4 Bump spire Helm Chart version from 0.26.0 to 0.26.1 (#636) 
* 64b9c40 Bump test chart dependencies (#635)
* d516de0 Update spike to 0.4.2 (#632)
* 8904b96 Bump test chart dependencies (#633)
* 6581b11 Add disk based KeyManager (#627)
* d2913ff Remove region from awsiid node attestor (#630)
* 3218db7 Bump test chart dependencies (#628)
* 57a6143 Add aws_iid to helm chart (#620)
* 9a8e5a8 Add Agent TTL to Spire Server (#626)
* 093c593 spire-server: Replace chown image with busybox
* a7d536c tools: Replace rancher/kubectl with registry.k8s.io/kubectl
* fc1791f Bump test chart dependencies (#618)

Signed-off-by: Faisal Memon <[email protected]>
 2025-07-28 12:30:10 -07:00
Marco Franssen a7d536c025 tools: Replace rancher/kubectl with registry.k8s.io/kubectl 
To have an always up to date kubectl image it is probably better to get kubectl from registry.k8s.io

Signed-off-by: Marco Franssen <[email protected]>
 2025-07-08 19:24:08 +02:00
Faisal Memon 88f0108e10 Bump spire Helm Chart version from 0.25.0 to 0.26.0 
* 255106da Update to Tornjak 2.1.0 (#597)
* f37d681b Enable running the oidc discovery provider without cluster-admin/CSI (#570)
* 892051c4 Update for 1.12.4 (#605)
* b74b10a0 Bump test chart dependencies (#615)
* e78400eb Initial spike support (#591)
* 38314ed6 Bump test chart dependencies (#611)
* bfd08bcf Bump test chart dependencies (#608)
* 971e4be7 Bump test chart dependencies (#606)
* ffe43901 Nit: Fix typo in param guide (#595)

Signed-off-by: Faisal Memon <[email protected]>
 2025-07-04 06:55:19 -07:00
kfox1111 892051c466 Update for 1.12.4 (#605) 
* Update for 1.12.3

Signed-off-by: Kevin Fox <[email protected]>

* Fix typo. Use test image

Signed-off-by: Kevin Fox <[email protected]>

* Fix lint

Signed-off-by: Kevin Fox <[email protected]>

* Fix format flag. Update config location for k8s configmap bp

Signed-off-by: Kevin Fox <[email protected]>

* Fix role

Signed-off-by: Kevin Fox <[email protected]>

* Update rbac

Signed-off-by: Kevin Fox <[email protected]>

* Fix key

Signed-off-by: Kevin Fox <[email protected]>

* Fix format

Signed-off-by: Kevin Fox <[email protected]>

* Fix the bundle format for the fetchca bits

Signed-off-by: Kevin Fox <[email protected]>

* Update key

Signed-off-by: Kevin Fox <[email protected]>

* Fix test rather then reconfigure

Signed-off-by: Kevin Fox <[email protected]>

* Add namespace

Signed-off-by: Kevin Fox <[email protected]>

* Update to follow the new patch

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Update filename based on format

Signed-off-by: Kevin Fox <[email protected]>

* Add upgrade notes

Signed-off-by: Kevin Fox <[email protected]>

* Switch to testing nightly. Dont manage bundle configmap.

Signed-off-by: Kevin Fox <[email protected]>

* Update permissions

Signed-off-by: Kevin Fox <[email protected]>

* Update permissions

Signed-off-by: Kevin Fox <[email protected]>

* Update permissions

Signed-off-by: Kevin Fox <[email protected]>

* Update for final release

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
 2025-07-01 16:28:57 -07:00
kfox1111Faisal MemonVolkan Özçelik
 		e78400ebcd Initial spike support (#591) 
* Initial spike support

Signed-off-by: Kevin Fox <[email protected]>

* Fix lint and docs

Signed-off-by: Kevin Fox <[email protected]>

* Update spike to 0.4.1

Signed-off-by: Kevin Fox <[email protected]>

* Update for multiarch

Signed-off-by: Kevin Fox <[email protected]>

* Update

Signed-off-by: Kevin Fox <[email protected]>

* Fix values and docs

Signed-off-by: Kevin Fox <[email protected]>

* Pull in changes from Volkan

Signed-off-by: Kevin Fox <[email protected]>

* Fix service

Signed-off-by: Kevin Fox <[email protected]>

* Typo fix

Signed-off-by: Volkan Özçelik <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: Volkan Özçelik <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Volkan Özçelik <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2025-06-23 23:07:40 -07:00
Faisal Memon 18ec1ef9dd Bump spire Helm Chart version from 0.24.5 to 0.25.0 
* bd2e8e3 Update spire to 1.12.2 (#592)
* d6684bc Add spire-credentialcomposer-cel support (#587)
* ccfb490 Dynamically build the connection_string with options for the spire server when spire-server.dataStore.sql.databaseType == sqlite3 (#576)
* 87bef26 Bump test chart dependencies (#588)
* b72505b Bump test chart dependencies (#580)
* e4bd1df Bump spire to 1.12.1 (#578)
* 9062710 Bump test chart dependencies (#575)
* 94e1d78 Bump test chart dependencies (#573)

Signed-off-by: Faisal Memon <[email protected]>
 2025-05-22 12:08:48 -07:00
kfox1111 bd2e8e3ced Update spire to 1.12.2 (#592) 
Signed-off-by: Kevin Fox <[email protected]>
 2025-05-22 08:54:36 -07:00
kfox1111 e4bd1df76c Bump spire to 1.12.1 (#578) 
Signed-off-by: Kevin Fox <[email protected]>
 2025-05-11 01:14:17 -07:00
Faisal Memon 8ca477a0bf Bump spire Helm Chart version from 0.24.4 to 0.24.5 (#572) 
* 1169dd5 Update spire-controller-manager to 0.6.2 and add its staticManifest support (#563)
* 4dee6ca Fix invalid image name for digest in template function of `spire-lib` (#569)
* ed9fb6a Bump test chart dependencies (#566)
* 912f412 Update tpm plugin version (#564)
* 0fc00cb Bump test chart dependencies (#561)

Signed-off-by: Faisal Memon <[email protected]>
 2025-04-24 10:59:19 -07:00
Faisal MemonFaisal Memonkfox1111
 		4b55f65c62 Bump spire Helm Chart version from 0.24.3 to 0.24.4 (#558) 
* 240176a Postgresql ro connection string fix (#556)
* 2a48bf9 Update csi driver (#555)
* cd39d7b Bump test chart dependencies (#553)

Signed-off-by: Faisal Memon <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2025-04-10 04:33:40 -07:00
Faisal Memon 3b2e564cf0 Bump spire Helm Chart version from 0.24.2 to 0.24.3 
* 25967bae Add new config.jwksUri option to oidc-discovery chart (#547)
* 2f96b0b1 Bump test chart dependencies (#545)
* 663b89e3 Upgrade to SPIRE 1.12.0 (#542)
* 1c73035e Add values to configure apiServiceLabel and webhookLabel (#536)
* 385cbb3e Bump test chart dependencies (#539)
* ad44c486 Bump test chart dependencies (#537)
* 86ea90cb Fixes indentation of sync_interval value inside spire-agent configmap (#534)
* 3940ac3c Bump test chart dependencies (#533)

Signed-off-by: Faisal Memon <[email protected]>
 2025-04-06 04:55:57 -07:00
kfox1111 663b89e3ea Upgrade to SPIRE 1.12.0 (#542) 
Signed-off-by: Kevin Fox <[email protected]>
 2025-03-21 16:43:10 -07:00
Faisal Memon 2af830d06d Bump spire Helm Chart version from 0.24.1 to 0.24.2 (#532) 
* b13f4c0 Bump test chart dependencies
* 915744f Bump test chart dependencies (#529)
* 0368210 Update spire to 1.11.2 (#527)
* ea03059 Bump test chart dependencies (#524)
* 762ba40 Bump test chart dependencies (#523)
* f1ba4ba Bump test chart dependencies (#522)
* 413e579 Bump test chart dependencies
* f88e3d5 Bump test chart dependencies (#517)
* 848f491 Bump test chart dependencies (#516)
* 41cbad2 Bump test chart dependencies (#512)
* 8925ed6 Bump test chart dependencies (#508)
* 70f5b19 Bump test chart dependencies (#500)

Signed-off-by: Faisal Memon <[email protected]>
 2025-02-27 09:27:47 -08:00
kfox1111 0368210d6b Update spire to 1.11.2 (#527) 
* Update spire to 1.11.2

Signed-off-by: Kevin Fox <[email protected]>

* Fix doc

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
 2025-02-13 22:39:13 -08:00
Faisal Memon 61eb715029 Bump spire Helm Chart version from 0.24.0 to 0.24.1 (#497) 
* 6608fc9 Add extraEnvVars support for spiffe-csi-driver containers (#496)
* 6193717 Bump test chart dependencies (#494)
* d5777c3 Bump test chart dependencies (#493)
* 4993b67 Fix GCS Bundle endpoint format variable (#491)

Signed-off-by: Faisal Memon <[email protected]>
 2024-11-17 14:14:01 -08:00
Faisal Memon 5b16168e70 Bump spire Helm Chart version from 0.23.0 to 0.24.0 (#487) 
* a3e607e Bump test chart dependencies (#484)
* a360646 Add validating admission policy to restrict upstream driver access (#482)
* a7368ee Upgrade to spire 1.11.0 (#483)
* fe5464b Update notes (#479)
* 29e9866 Bump test chart dependencies (#481)
* 13736cd Add support for the new hint spire-controller-manager feature (#472)
* b08e8bf Agent support for bundle on host path (#478)
* 7b409ed Fix cert-manager upstream authority when enabling recommendations (#476)
* 01c7227 Add support for the new fallback spire-controller-manager feature (#471)
* 0a6dd19 Bump test chart dependencies (#477)
* fcbd64e Support federation bundle endpoint profile http_web certificates (#469)
* c29f45f Add AWS DB types (#464)
* 898a349 Add remaining data store options (#463)
* 2443515 Bump test chart dependencies (#474)
* c461794 Update the spire-controller-manager to 0.6.0 (#473)
* 5d07eaf Align more settings to convention (#467)
* ea2d673 Bump test chart dependencies (#470)
* 352aee2 Bump test chart dependencies (#468)
* c3c8514 Change curl --caPath to --capath (#462)
* 68d21cc Add an initial json schema file for spire-agent (#458)
* b7e9823 Add new config.jwtDomain value to oidc-discovery chart (#457)
* 8832da3 Protects SPIRE Agent's Chart Against YAML Template Injection (#450)
* 3bc7025 Update spiffe-helper (#453)
* 86d6fca Bump test chart dependencies (#449)

Signed-off-by: Faisal Memon <[email protected]>
 2024-10-28 18:36:17 +00:00
kfox1111 a7368eee1f Upgrade to spire 1.11.0 (#483) 
Signed-off-by: Kevin Fox <[email protected]>
 2024-10-25 22:36:59 -07:00
kfox1111andFaisal Memon fe5464ba9f Update notes (#479) 
* Update notes

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update charts/spire/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-10-24 10:17:46 -07:00
kfox1111andFaisal Memon 898a349297 Add remaining data store options (#463) 
* Add remaining data store options

Signed-off-by: Kevin Fox <[email protected]>

* Fix env var

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update charts/spire/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-10-07 16:18:06 -07:00
Faisal Memon 01b1114e26 Bump spire Helm Chart version from 0.22.0 to 0.23.0 
* 7df063f Upgrade SPIRE to 1.10.3 (#412)
* de5ec47 Bump test chart dependencies (#445)
* e72b94f Add all built in BundlePublishers (#430)
* 532852d Bump test chart dependencies (#440)
* 6e8ad56 Add a spire-agent auto kubelet verification mode (#435)
* 50c741e Remove extra check that sometimes breaks oidc (#437)
* e062b9f Support ipv4 only clusters (#434)
* b96e07e Enable more forms of kubelet certificate verification (#426)
* f92d729 Add missing properties required by SecurityContextConstraints CRD (#432)
* 8553a78 Bump test chart dependencies (#431)

Signed-off-by: Faisal Memon <[email protected]>
 2024-09-04 14:00:46 -07:00
kfox1111andFaisal Memon 7df063f8db Upgrade SPIRE to 1.10.3 (#412) 
* Update SPIRE to 1.10.3

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-agent/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-09-04 13:16:50 -07:00
kfox1111 6e8ad569b3 Add a spire-agent auto kubelet verification mode (#435) 
* Add a spire-agent auto kubelet verification mode

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
 2024-08-23 15:09:55 -07:00
kfox1111andFaisal Memon b96e07e349 Enable more forms of kubelet certificate verification (#426) 
* Enable kubelet certificate verification by default

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/README.md

Signed-off-by: kfox1111 <[email protected]>

* Update charts/spire/charts/spire-agent/templates/configmap.yaml

Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Fix image

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-agent/templates/configmap.yaml

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-08-20 22:08:39 -07:00
Faisal Memon de1e98337a Bump spire Helm Chart version from 0.21.1 to 0.22.0 (#428) 
* 9b2d72f Fix permission issue with 1.10 and defaults when upgraded (#423)
* 827a3ea Bump spire to 1.10.1 (#424)
* 0289e5f Revert "Added support for specifying Kubelet CA Path (#415)" (#422)
* bf40797 Bump test chart dependencies (#418)
* abcf019 Added support for specifying Kubelet CA Path (#415)
* 6d4d526 Allow configuring persistence in the spire-agent (#414)

Signed-off-by: Faisal Memon <[email protected]>
 2024-08-15 13:59:31 +00:00
kfox1111 827a3ea80c Bump spire to 1.10.1 (#424) 
Signed-off-by: Kevin Fox <[email protected]>
 2024-08-13 11:44:07 -07:00
Faisal Memon b4d4d901b9 Bump spire Helm Chart version from 0.21.0 to 0.21.1 (#409) 
* 82a6d5d Should be `admin_socket_path` not `admin_socket_dir` (#407)
* 6240c0b Bump test chart dependencies (#402)
* c3d1d39 Update to SPIRE 1.10.0 (#393)
* 741cd9c Bump test chart dependencies (#398)
* c507ee0 Bump test chart dependencies (#397)
* 199bb6f Add connect by hostname to agent cofigmap (#392)
* eb6d89b Update charts/spire/README.md
* c93ad87 Add valid kubectl version to examples
* 500fdd9 Bump test chart dependencies (#391)
* 08fc5f3 Bump test chart dependencies (#390)
* 6904295 Bump test chart dependencies (#389)
* fb7fb80 Fix format for ignoreNamespaces (#388)
* 7a0a77b Fix host path of "spire-agent-admin-socket-dir" volume (#386)
* 1d2d755 Add resource limits for upgrade and delete hook batch jobs (#366)
* f7e0d4b Update _spire-system-namespace.yaml (#381)
* 29d4b57 Bump test chart dependencies
* 4c9059e Bump test chart dependencies (#379)
* 1dc650f Apply wildcard for ignoreNamespaces in Controller Manager (#378)
* 6c2b5e6 Bump test chart dependencies (#376)

Signed-off-by: Faisal Memon <[email protected]>
 2024-08-06 08:28:22 -07:00
kfox1111andFaisal Memon c3d1d39ed7 Update to SPIRE 1.10.0 (#393) 
* Update to SPIRE 1.10.0

Remove the options that were removed in 1.10, and update.

Signed-off-by: Kevin Fox <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix uid mismatch issue on 1.10.0+

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-07-24 12:19:06 -07:00
Mariusz Sabathandkfox1111 eb6d89b472 Update charts/spire/README.md 
Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>
 2024-07-09 14:08:55 -04:00
Mariusz Sabath c93ad87c15 Add valid kubectl version to examples 
Signed-off-by: Mariusz Sabath <[email protected]>
 2024-07-09 11:42:27 -04:00
kfox1111andaniket patel 1d2d7550c5 Add resource limits for upgrade and delete hook batch jobs (#366) 
* Add resource limits for upgrade and delete hook batch jobs

Signed-off-by: aniket patel <[email protected]>

* Fix value of resource

Signed-off-by: aniket patel <[email protected]>

* Fix resource limit in server template

Signed-off-by: aniket patel <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix up doc comment

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: aniket patel <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: aniket patel <[email protected]>
 2024-06-19 12:50:21 -07:00
Faisal Memon 63853f5494 Bump spire Helm Chart version from 0.20.0 to 0.21.0 (#373) 
* 54a2f03 Change cleanup default (#349)
* d29ad06 Bump test chart dependencies (#369)
* 7dabbf1 Add Openshift ignore namespaces to Controller Manager (#363)
* db177d4 Fix spelling error in Controller Manager config (#362)
* d236154 Fix upstream ca name suffix issue (#361)
* bfcf418 Bump test chart dependencies (#359)
* c31a2e9 Bump up spire to 1.9.6 (#356)
* 2c5dfa0 Improve Tornjak NOTES. Fixes #132 (#354)
* a453a2c Bump test chart dependencies (#355)
* b6575c1 Update Tornjak deployment docs (#288)
* be560d9 Check for a misconfiguration of bundle endpoint profiles (#348)
* b2e9f40 Bump spire version (#352)
* 7165b20 Bump test chart dependencies (#350)
* da4ebdf Fix federation certificate name when upstream enabled (#347)
* c37de1e Fix Tornjak logsDir for Openshift (#344)
* 8fef1bd Add external spire-controller-managers (#284)
* ee12404 set refresh hint to 1/3 of default CA TTL value fixes #335 (#343)
* 2d9866a Bump test chart dependencies (#338)
* 6de23d3 Don't create role/binding when bundle disabled (#336)
* c132cc4 Add support for externalServer=true (#303)
* a2494ee Add auth option for Tornjak (#259)
* f679a0d Bump test chart dependencies (#333)
* 5149256 Work around curl change
* 3d2ac16 Bump test chart dependencies
* 08f699b Add spire-lib chart (#289)
* 260b02f Add an easy to use identity for child servers (#302)

Signed-off-by: Faisal Memon <[email protected]>
 2024-05-30 22:00:00 +00:00
kfox1111andFaisal Memon 54a2f036bf Change cleanup default (#349) 
* Change cleanup default

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update charts/spire/README.md

Signed-off-by: kfox1111 <[email protected]>

* Update charts/spire/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix merge issue and incorperate feedback.

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-05-30 12:22:03 -07:00
kfox1111 d2361549db Fix upstream ca name suffix issue (#361) 
* Fix upstream ca name suffix issue

Signed-off-by: Kevin Fox <[email protected]>

* Fix quoting

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
 2024-05-23 09:43:19 -07:00
kfox1111 c31a2e9f65 Bump up spire to 1.9.6 (#356) 
Signed-off-by: Kevin Fox <[email protected]>
 2024-05-16 09:20:14 -07:00
kfox1111 b2e9f40774 Bump spire version (#352) 
Signed-off-by: Kevin Fox <[email protected]>
 2024-05-07 20:16:15 -07:00
kfox1111andFaisal Memon 8fef1bd050 Add external spire-controller-managers (#284) 
* Complete Server K8S PSAT support

Add all the SPIRE Server supported options for the K8S PSAT attestor. This retains the
ease of use for configuring local cluster support while adding the ability to configure
multiple/external clusters as well. Kubeconfig support is added in its own config block
as it will be used/shared with spire-controller-manager support in the future.

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Add support for integration tests in the tests/integration dir

Signed-off-by: Kevin Fox <[email protected]>

* Fix split issue and typo

Signed-off-by: Kevin Fox <[email protected]>

* Add basic psat test

Signed-off-by: Kevin Fox <[email protected]>

* Fix linter

Signed-off-by: Kevin Fox <[email protected]>

* Fix up test

Signed-off-by: Kevin Fox <[email protected]>

* Add missing file

Signed-off-by: Kevin Fox <[email protected]>

* Better encode config

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-server/values.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-server/values.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Add external k8s bundler

Adds support to sync the CA bundle to configmaps in external
Kubernetes clusters

Signed-off-by: Kevin Fox <[email protected]>

* Update default

Signed-off-by: Kevin Fox <[email protected]>

* Fix config file layout. Incorperate feedback.

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Update based on parent pr feedback

Signed-off-by: Kevin Fox <[email protected]>

* Reformat config file

Signed-off-by: Kevin Fox <[email protected]>

* Fix some things

Signed-off-by: Kevin Fox <[email protected]>

* Reconfigure kind

Signed-off-by: Kevin Fox <[email protected]>

* More debugging

Signed-off-by: Kevin Fox <[email protected]>

* Fix up kind

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Add external spire-controller-managers

Only one external controller manager is supported at a time until
https://github.com/spiffe/spire/issues/4898 is resolved.

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Upgrade to spire-controller-manager 0.5.0

Signed-off-by: Kevin Fox <[email protected]>

* Update for released 0.5.0

Signed-off-by: Kevin Fox <[email protected]>

* Merge in some of the id prefix pr

Signed-off-by: Kevin Fox <[email protected]>

* Entry ID Prefix (#287)

* Add Entry ID Prefix support

Signed-off-by: Kevin Fox <[email protected]>

* Mulitcluster test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Implement cleanup setting too

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Bump up test container

Signed-off-by: Kevin Fox <[email protected]>

* Swith to testing with nightly

Signed-off-by: Kevin Fox <[email protected]>

* Fix value name

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix up doc formatting

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-server/values.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-05-02 21:08:31 +00:00