panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
838 Commits 1 Branch 2 Tags
532852d9072e50be976ad7cd6dedb0f8bafe3e4c
Commit Graph
538 Commits
Author SHA1 Message Date
spire-helm-version-checker[bot]andmarcofranssen 532852d907 Bump test chart dependencies (#440) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2024-08-26 09:45:03 -07:00
kfox1111 6e8ad569b3 Add a spire-agent auto kubelet verification mode (#435) 
* Add a spire-agent auto kubelet verification mode

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
 2024-08-23 15:09:55 -07:00
kfox1111 50c741e047 Remove extra check that sometimes breaks oidc (#437) 
Signed-off-by: Kevin Fox <[email protected]>
 2024-08-22 12:08:18 -07:00
kfox1111 e062b9f196 Support ipv4 only clusters (#434) 
* Support ipv4 only clusters

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
 2024-08-21 12:00:38 -07:00
kfox1111andFaisal Memon b96e07e349 Enable more forms of kubelet certificate verification (#426) 
* Enable kubelet certificate verification by default

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/README.md

Signed-off-by: kfox1111 <[email protected]>

* Update charts/spire/charts/spire-agent/templates/configmap.yaml

Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Fix image

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-agent/templates/configmap.yaml

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-08-20 22:08:39 -07:00
Erik Godding Boye f92d729137 Add missing properties required by SecurityContextConstraints CRD (#432) 
Signed-off-by: Erik Godding Boye <[email protected]>
 2024-08-20 08:55:35 -07:00
spire-helm-version-checker[bot]andmarcofranssen 8553a78f6c Bump test chart dependencies (#431) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2024-08-19 12:39:18 +02:00
Faisal Memon de1e98337a Bump spire Helm Chart version from 0.21.1 to 0.22.0 (#428) 
* 9b2d72f Fix permission issue with 1.10 and defaults when upgraded (#423)
* 827a3ea Bump spire to 1.10.1 (#424)
* 0289e5f Revert "Added support for specifying Kubelet CA Path (#415)" (#422)
* bf40797 Bump test chart dependencies (#418)
* abcf019 Added support for specifying Kubelet CA Path (#415)
* 6d4d526 Allow configuring persistence in the spire-agent (#414)

Signed-off-by: Faisal Memon <[email protected]>
 2024-08-15 13:59:31 +00:00
kfox1111 9b2d72f6a2 Fix permission issue with 1.10 and defaults when upgraded (#423) 
* Fix permission issue with 1.10 and defaults when upgraded

Signed-off-by: Kevin Fox <[email protected]>

* Fix indenting

Signed-off-by: Kevin Fox <[email protected]>

* incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
 2024-08-13 22:21:20 -07:00
kfox1111 827a3ea80c Bump spire to 1.10.1 (#424) 
Signed-off-by: Kevin Fox <[email protected]>
 2024-08-13 11:44:07 -07:00
kfox1111 0289e5fb00 Revert "Added support for specifying Kubelet CA Path (#415)" (#422) 
This reverts commit abcf01958a.

Signed-off-by: Kevin Fox <[email protected]>
 2024-08-13 11:03:31 -07:00
spire-helm-version-checker[bot]andmarcofranssen bf40797049 Bump test chart dependencies (#418) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2024-08-12 07:05:38 -07:00
Andrew BlockandFaisal Memon abcf01958a Added support for specifying Kubelet CA Path (#415) 
Signed-off-by: Andrew Block <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-08-09 04:56:11 +00:00
kfox1111 6d4d52604a Allow configuring persistence in the spire-agent (#414) 
* Allow configuring persistence in the spire-agent

Signed-off-by: Kevin Fox <[email protected]>

* Better wording. Leave space for other services if needed some day.

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
 2024-08-08 20:06:06 -07:00
Faisal Memon b4d4d901b9 Bump spire Helm Chart version from 0.21.0 to 0.21.1 (#409) 
* 82a6d5d Should be `admin_socket_path` not `admin_socket_dir` (#407)
* 6240c0b Bump test chart dependencies (#402)
* c3d1d39 Update to SPIRE 1.10.0 (#393)
* 741cd9c Bump test chart dependencies (#398)
* c507ee0 Bump test chart dependencies (#397)
* 199bb6f Add connect by hostname to agent cofigmap (#392)
* eb6d89b Update charts/spire/README.md
* c93ad87 Add valid kubectl version to examples
* 500fdd9 Bump test chart dependencies (#391)
* 08fc5f3 Bump test chart dependencies (#390)
* 6904295 Bump test chart dependencies (#389)
* fb7fb80 Fix format for ignoreNamespaces (#388)
* 7a0a77b Fix host path of "spire-agent-admin-socket-dir" volume (#386)
* 1d2d755 Add resource limits for upgrade and delete hook batch jobs (#366)
* f7e0d4b Update _spire-system-namespace.yaml (#381)
* 29d4b57 Bump test chart dependencies
* 4c9059e Bump test chart dependencies (#379)
* 1dc650f Apply wildcard for ignoreNamespaces in Controller Manager (#378)
* 6c2b5e6 Bump test chart dependencies (#376)

Signed-off-by: Faisal Memon <[email protected]>
 2024-08-06 08:28:22 -07:00
Ben Leggett 82a6d5d410 Should be admin_socket_path not admin_socket_dir (#407) 
Signed-off-by: Benjamin Leggett <[email protected]>
 2024-08-05 15:49:01 -07:00
spire-helm-version-checker[bot]marcofranssenkfox1111
 		6240c0b08c Bump test chart dependencies (#402) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2024-07-29 12:57:07 +00:00
kfox1111andFaisal Memon c3d1d39ed7 Update to SPIRE 1.10.0 (#393) 
* Update to SPIRE 1.10.0

Remove the options that were removed in 1.10, and update.

Signed-off-by: Kevin Fox <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix uid mismatch issue on 1.10.0+

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-07-24 12:19:06 -07:00
spire-helm-version-checker[bot]andmarcofranssen 741cd9c6b4 Bump test chart dependencies (#398) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2024-07-22 07:41:57 -07:00
spire-helm-version-checker[bot]andmarcofranssen c507ee0ea3 Bump test chart dependencies (#397) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2024-07-15 15:14:13 +02:00
tuxotronandkfox1111 199bb6f998 Add connect by hostname to agent cofigmap (#392) 
When setting the kubeletConnectByHostname to "true", the charts update the agent daemonset to define the MY_NODE_NAME environment variable, but it doesn't set the "node_name_env" setting in the WorkloadAttestor:k8s plugin, therefore the agent continues trying to connect to the kubelet using the localhost interface

Signed-off-by: tuxotron <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2024-07-11 12:47:57 -07:00
Mariusz Sabathandkfox1111 eb6d89b472 Update charts/spire/README.md 
Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>
 2024-07-09 14:08:55 -04:00
Mariusz Sabath c93ad87c15 Add valid kubectl version to examples 
Signed-off-by: Mariusz Sabath <[email protected]>
 2024-07-09 11:42:27 -04:00
spire-helm-version-checker[bot]andmarcofranssen 500fdd9ac3 Bump test chart dependencies (#391) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2024-07-08 12:03:03 +02:00
spire-helm-version-checker[bot]andmarcofranssen 08fc5f3d46 Bump test chart dependencies (#390) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2024-07-01 08:20:53 +00:00
spire-helm-version-checker[bot]andmarcofranssen 690429525c Bump test chart dependencies (#389) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2024-06-24 08:20:59 +00:00
Mariusz Sabath fb7fb809fa Fix format for ignoreNamespaces (#388) 
Signed-off-by: Mariusz Sabath <[email protected]>
 2024-06-23 16:29:39 -07:00
knp-sap 7a0a77b6b8 Fix host path of "spire-agent-admin-socket-dir" volume (#386) 
Signed-off-by: knp-sap <[email protected]>
 2024-06-23 09:54:39 -07:00
kfox1111andaniket patel 1d2d7550c5 Add resource limits for upgrade and delete hook batch jobs (#366) 
* Add resource limits for upgrade and delete hook batch jobs

Signed-off-by: aniket patel <[email protected]>

* Fix value of resource

Signed-off-by: aniket patel <[email protected]>

* Fix resource limit in server template

Signed-off-by: aniket patel <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix up doc comment

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: aniket patel <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: aniket patel <[email protected]>
 2024-06-19 12:50:21 -07:00
tuxotronandkfox1111 f7e0d4b831 Update _spire-system-namespace.yaml (#381) 
set right namespace labels

Signed-off-by: tuxotron <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2024-06-17 16:56:35 -07:00
marcofranssen 29d4b57373 Bump test chart dependencies 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2024-06-17 11:37:20 +02:00
spire-helm-version-checker[bot]andmarcofranssen 4c9059ea52 Bump test chart dependencies (#379) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2024-06-10 05:24:55 -07:00
Mariusz Sabathkfox1111Edwin Buck
 		1dc650f06e Apply wildcard for ignoreNamespaces in Controller Manager (#378) 
* Apply wildcard for ignoreNamespaces in Controller Manager

Signed-off-by: Mariusz Sabath <[email protected]>

* Add the doc updates

Signed-off-by: Mariusz Sabath <[email protected]>

* Update charts/spire/charts/spire-server/values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Edwin Buck <[email protected]>

---------

Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: Edwin Buck <[email protected]>
Co-authored-by: Edwin Buck <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2024-06-06 15:56:15 -07:00
spire-helm-version-checker[bot]andmarcofranssen 6c2b5e64cc Bump test chart dependencies (#376) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2024-06-03 06:50:32 -07:00
Faisal Memon 63853f5494 Bump spire Helm Chart version from 0.20.0 to 0.21.0 (#373) 
* 54a2f03 Change cleanup default (#349)
* d29ad06 Bump test chart dependencies (#369)
* 7dabbf1 Add Openshift ignore namespaces to Controller Manager (#363)
* db177d4 Fix spelling error in Controller Manager config (#362)
* d236154 Fix upstream ca name suffix issue (#361)
* bfcf418 Bump test chart dependencies (#359)
* c31a2e9 Bump up spire to 1.9.6 (#356)
* 2c5dfa0 Improve Tornjak NOTES. Fixes #132 (#354)
* a453a2c Bump test chart dependencies (#355)
* b6575c1 Update Tornjak deployment docs (#288)
* be560d9 Check for a misconfiguration of bundle endpoint profiles (#348)
* b2e9f40 Bump spire version (#352)
* 7165b20 Bump test chart dependencies (#350)
* da4ebdf Fix federation certificate name when upstream enabled (#347)
* c37de1e Fix Tornjak logsDir for Openshift (#344)
* 8fef1bd Add external spire-controller-managers (#284)
* ee12404 set refresh hint to 1/3 of default CA TTL value fixes #335 (#343)
* 2d9866a Bump test chart dependencies (#338)
* 6de23d3 Don't create role/binding when bundle disabled (#336)
* c132cc4 Add support for externalServer=true (#303)
* a2494ee Add auth option for Tornjak (#259)
* f679a0d Bump test chart dependencies (#333)
* 5149256 Work around curl change
* 3d2ac16 Bump test chart dependencies
* 08f699b Add spire-lib chart (#289)
* 260b02f Add an easy to use identity for child servers (#302)

Signed-off-by: Faisal Memon <[email protected]>
 2024-05-30 22:00:00 +00:00
kfox1111andFaisal Memon 54a2f036bf Change cleanup default (#349) 
* Change cleanup default

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update charts/spire/README.md

Signed-off-by: kfox1111 <[email protected]>

* Update charts/spire/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix merge issue and incorperate feedback.

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-05-30 12:22:03 -07:00
spire-helm-version-checker[bot]marcofranssenKevin Fox
 		d29ad0649f Bump test chart dependencies (#369) 
* Bump test chart dependencies

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* Remove workaround as they fixed curl

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: Kevin Fox <[email protected]>
 2024-05-27 06:36:36 -07:00
Mariusz Sabath 7dabbf16d3 Add Openshift ignore namespaces to Controller Manager (#363) 
* Fix spelling error in Controller Manager config

Signed-off-by: Mariusz Sabath <[email protected]>

* Add ignoreNamespaces to ControllerManager for Openshift

Signed-off-by: Mariusz Sabath <[email protected]>

---------

Signed-off-by: Mariusz Sabath <[email protected]>
 2024-05-26 07:55:26 -07:00
Mariusz Sabath db177d4b85 Fix spelling error in Controller Manager config (#362) 
Signed-off-by: Mariusz Sabath <[email protected]>
 2024-05-23 19:26:44 +00:00
kfox1111 d2361549db Fix upstream ca name suffix issue (#361) 
* Fix upstream ca name suffix issue

Signed-off-by: Kevin Fox <[email protected]>

* Fix quoting

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
 2024-05-23 09:43:19 -07:00
spire-helm-version-checker[bot]andmarcofranssen bfcf418301 Bump test chart dependencies (#359) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2024-05-20 06:33:31 -07:00
kfox1111 c31a2e9f65 Bump up spire to 1.9.6 (#356) 
Signed-off-by: Kevin Fox <[email protected]>
 2024-05-16 09:20:14 -07:00
Mariusz Sabath 2c5dfa010f Improve Tornjak NOTES. Fixes #132 (#354) 
* Improve Tornjak NOTES. Fixes #132

Signed-off-by: Mariusz Sabath <[email protected]>

* Fix Tornjak ingress value

Signed-off-by: Mariusz Sabath <[email protected]>

---------

Signed-off-by: Mariusz Sabath <[email protected]>
 2024-05-14 13:52:55 -07:00
spire-helm-version-checker[bot]andmarcofranssen a453a2c1b4 Bump test chart dependencies (#355) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2024-05-13 13:11:02 +02:00
Mariusz Sabathkfox1111Mohammed Abdi
 		b6575c172d Update Tornjak deployment docs (#288) 
* Update Tornjak deployment docs

Signed-off-by: Mariusz Sabath <[email protected]>

* Change the  reference for installing standard Tornjak

Signed-off-by: Mariusz Sabath <[email protected]>

* Update examples/tornjak/README.md

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

* Adjust deployment paths

Signed-off-by: Mariusz Sabath <[email protected]>

* Remove the production README changes

Signed-off-by: Mariusz Sabath <[email protected]>

* Minor text edits

Signed-off-by: Mariusz Sabath <[email protected]>

* Fix incorrect namespace value

Signed-off-by: Mariusz Sabath <[email protected]>

* Updat Tornjak README

Signed-off-by: Mariusz Sabath <[email protected]>

* Update Keycloak README

Signed-off-by: Mariusz Sabath <[email protected]>

* Text updates in Keycloak doc

Signed-off-by: Mariusz Sabath <[email protected]>

* Post-review updates

Signed-off-by: Mariusz Sabath <[email protected]>

* Update Tornjak message for User Management

Signed-off-by: Mariusz Sabath <[email protected]>

* Update examples/tornjak/keycloak/README.md

Co-authored-by: Mohammed Abdi <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

* Update Tornjak deployment doc

Signed-off-by: Mariusz Sabath <[email protected]>

* Improve the Tornjak Auth message

Signed-off-by: Mariusz Sabath <[email protected]>

* Fix error with incorrect Ingress value

Signed-off-by: Mariusz Sabath <[email protected]>

* Fix documentation format

Signed-off-by: Mariusz Sabath <[email protected]>

* Update parameter format

Signed-off-by: Mariusz Sabath <[email protected]>

* Removed redundand doc sections

Signed-off-by: Mariusz Sabath <[email protected]>

---------

Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
Co-authored-by: Mohammed Abdi <[email protected]>
 2024-05-09 04:26:17 -07:00
kfox1111andFaisal Memon be560d95d8 Check for a misconfiguration of bundle endpoint profiles (#348) 
* Check for a misconfiguration of bundle endpoint profiles

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-server/templates/configmap.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-05-08 03:38:04 +00:00
kfox1111 b2e9f40774 Bump spire version (#352) 
Signed-off-by: Kevin Fox <[email protected]>
 2024-05-07 20:16:15 -07:00
spire-helm-version-checker[bot]andmarcofranssen 7165b20ddf Bump test chart dependencies (#350) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2024-05-06 12:57:43 -07:00
kfox1111 da4ebdfcaf Fix federation certificate name when upstream enabled (#347) 
When both federation certificates and upstream authority both
use cert-manager, there is a naming conflict.

Signed-off-by: Kevin Fox <[email protected]>
 2024-05-03 14:17:31 -07:00
Mariusz Sabathandkfox1111 c37de1ea0c Fix Tornjak logsDir for Openshift (#344) 
* Fix Tornjak logsDir for Openshift

Signed-off-by: Mariusz Sabath <[email protected]>

* Update docs

Signed-off-by: Mariusz Sabath <[email protected]>

* Update charts/spire/charts/tornjak-frontend/templates/_helpers.tpl

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

---------

Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2024-05-03 08:04:38 -07:00