panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,219 Commits 1 Branch 2 Tags
59bb8a774cfdaf7178bb71ddd7392893f2de5164
Commit Graph
82 Commits
Author SHA1 Message Date
Daniel Schlatter 59bb8a774c Allow sqlite3 in memory when kind is deployment (#923) 
* Allow sqlite3 in memory when kind is deployment

Signed-off-by: Daniel Schlatter <[email protected]>

* Warn on unsafe in-memory datastore combinations

Signed-off-by: Daniel Schlatter <[email protected]>

---------

Signed-off-by: Daniel Schlatter <[email protected]>
 2026-08-18 14:22:50 -07:00
kfox1111 3cfefb72ba Gateway api support (#890) 
* Gateway api support

Signed-off-by: Kevin Fox <[email protected]>

* Update readme

Signed-off-by: Kevin Fox <[email protected]>

* Fix gateway name. a gateway doesnt need to be named gateway

Signed-off-by: Kevin Fox <[email protected]>

* Fix naming issue

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
 2026-07-30 19:38:43 +00:00
kfox1111andMarco Franssen 08f699bdb0 Add spire-lib chart (#289) 
* Add spire-lib chart

Make spire-lib bits into its own library chart.

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Move notes back

Signed-off-by: Kevin Fox <[email protected]>

* Fix NOTES

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2024-04-18 08:21:31 -07:00
kfox1111 c1e4feb34d Fix ingress host with a dot (#323) 
Fixes: https://github.com/spiffe/helm-charts-hardened/issues/312

Signed-off-by: Kevin Fox <[email protected]>
 2024-04-11 11:16:08 -07:00
kfox1111 07a1c391b2 Add global override for kubectl tag (#251) 2024-02-19 20:18:31 +01:00
Marco Franssen 0fbc51223c Remove the white line from securityContext rendering 
Prevents the following diff introduced since the 0.17.0 release.

```diff
        containers:
        - name: post-install-job
          securityContext:
+
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
```

Signed-off-by: Marco Franssen <[email protected]>
 2024-01-26 13:51:28 +01:00
kfox1111 befa074763 Fix notes bug (#178) 2024-01-11 10:31:02 +00:00
kfox1111 912c61e05c Remove deprecated version values (#179) 2024-01-11 10:29:56 +00:00
Jerome Meyer ae4ef6e992 Update HorizontalPodAutoscaler API to autoscaling/v2 (#153) 2024-01-11 11:19:41 +01:00
kfox1111andMarco Franssen c39dd44526 Add recommendation for namespacePSS (#131) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-12-21 00:15:56 +00:00
kfox1111andMarco Franssen 6997d6a904 Add recommendation for securityContext and podSecurityContext (#125) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-12-19 11:26:26 +00:00
kfox1111 50c4ac35b0 Add recommendation for strictMode (#143) 2023-12-19 12:12:53 +01:00
kfox1111andFaisal Memon e35838c309 Add recommendation for priorityClass (#124) 
* Add a flag to enable recommendations

Signed-off-by: Kevin Fox <[email protected]>

* Add recommendation for priorityClass

Signed-off-by: Kevin Fox <[email protected]>

* Fix vars

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs. Fix typo.

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-12-11 11:42:40 -08:00
kfox1111andMariusz Sabath 7726351955 Tornjak UBI support (#123) 
* Tornjak UBI support

The Tornjak containers now have two different flavors. Vanilla and UBI.
Automatically select the UBI image when deploying on OpenShift.

Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
 2023-12-11 06:56:58 -08:00
Andrew BlockMariusz Sabathkfox1111
 		8422b8d141 Added ability to create namespaces (#103) 
* Added ability to create namespaces

Signed-off-by: Andrew Block <[email protected]>

* Add openshift labels

Signed-off-by: Mariusz Sabath <[email protected]>

---------

Signed-off-by: Andrew Block <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2023-12-01 15:42:27 +00:00
Mariusz Sabath b7d8590b77 Fix missing protocol in JWT Issuer (#120) 
* Add missing protocol to jwt_issuer

Signed-off-by: Mariusz Sabath <[email protected]>

* Removed trailing spaces

Signed-off-by: Mariusz Sabath <[email protected]>

---------

Signed-off-by: Mariusz Sabath <[email protected]>
 2023-11-29 00:13:32 +00:00
kfox1111Faisal MemonMariusz Sabath
 		f2758a8b2b Autogen jwtIssuer (#88) 
* Autogen jwtIssuer

Unset a default for jwtIssuer and global.spire.jwtIssuer. When unset,
generate it to the default of oidc-discovery.$trustDomain so in many
cases the user doesn't need to set it at all.

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-11-09 20:31:48 +00:00
kfox1111Marco FranssenFaisal Memon
 		805d8696d0 spire-controller-manager 0.4.0 support (#60) 
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-11-08 10:43:19 +00:00
kfox1111Faisal MemonMariusz Sabath
 		81cc2dc573 Ingress type openshift (#52) 
* Specify ingress controller type

Signed-off-by: Kevin Fox <[email protected]>

* Fix indenting, docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix spacing

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Add ingress-nginx support

Signed-off-by: Kevin Fox <[email protected]>

* Use the right example values for test version to upgrade from.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var in wrong location

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing arg

Signed-off-by: Kevin Fox <[email protected]>

* Try this to checkout the right version

Signed-off-by: Kevin Fox <[email protected]>

* Switch to upgrading from 0.14.0

Signed-off-by: Kevin Fox <[email protected]>

* Install crds

Signed-off-by: Kevin Fox <[email protected]>

* Simple ingress support

For a lot of situations, ingress rules can be derived from trustDomain.
Change the code to generate rules by default for the user.

Signed-off-by: Kevin Fox <[email protected]>

* Add upgrade test fix from 43

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Enable unset ingress controller type to use with openshift later

Signed-off-by: Kevin Fox <[email protected]>

* Openshift ingress controller type support

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing end tag

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Fix doc merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Fix automatically generated rules on openshift

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Fix pathType

Signed-off-by: Kevin Fox <[email protected]>

* Make openshift edge rules work

Signed-off-by: Kevin Fox <[email protected]>

* Fix var scoping

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix issue created during merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
 2023-11-03 13:16:14 -07:00
kfox1111andFaisal Memon ed23d8b714 Simple ingress support (#48) 
Co-authored-by: Faisal Memon <[email protected]>
 2023-10-30 22:16:17 +00:00
kfox1111andFaisal Memon 7924323a8f Specify ingress controller type (#43) 
* Specify ingress controller type

Signed-off-by: Kevin Fox <[email protected]>

* Fix indenting, docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix spacing

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Add ingress-nginx support

Signed-off-by: Kevin Fox <[email protected]>

* Use the right example values for test version to upgrade from.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var in wrong location

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing arg

Signed-off-by: Kevin Fox <[email protected]>

* Try this to checkout the right version

Signed-off-by: Kevin Fox <[email protected]>

* Switch to upgrading from 0.14.0

Signed-off-by: Kevin Fox <[email protected]>

* Install crds

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Enable unset ingress controller type to use with openshift later

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs after merge issue

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-10-24 20:18:53 +00:00
kfox1111 0fa43a507d Add plugin support to the spire agent (#22) 
* Exit code from diff indicating changes should not block commit.

Signed-off-by: Kevin Fox <[email protected]>

* Push the changes that update-tags creates

Signed-off-by: Kevin Fox <[email protected]>

* Add plugin support to the spire agent

This adapts the existing spire server plugin support to be usable by
the agent as well.

Signed-off-by: Kevin Fox <[email protected]>

* Fix notes

Signed-off-by: Kevin Fox <[email protected]>

* Add plugin support to the spire agent

This adapts the existing spire server plugin support to be usable by
the agent as well.

Signed-off-by: Kevin Fox <[email protected]>

* Fix notes

Signed-off-by: Kevin Fox <[email protected]>

* Update documentation

Signed-off-by: Kevin Fox <[email protected]>

* Update example

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
 2023-10-10 08:09:11 +00:00
kfox1111andFaisal Memon afba33f179 Add spire agent experimental flags (#26) 
* Add spire agent experimental flags

Signed-off-by: Kevin Fox <[email protected]>

* Fix nested test

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-agent/templates/configmap.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Regen docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-10-09 16:09:28 -07:00
kfox1111 50825d9fc9 Deny production runs of example.org trust domains (#229) 2023-09-25 12:06:48 -07:00
Faisal Memon f04bdc3618 Add support for experimental flags (#492) 
Add support for the experimental section of the config. Needed for
developers. This PR doesnt add support for the `auth_opa_policy_engine`
experimental config.

---------

Signed-off-by: Faisal Memon <[email protected]>
 2023-09-22 14:55:03 -07:00
kfox1111Edwin BuckFaisal Memon
 		51cba5b530 Add customPlugins and unsupportedBuiltInPlugins sections to spire-server (#198) 
This patch enables end users to configure external plugins in the
spire-server config. Unsupported internal plugins are not able to be
set.

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Edwin Buck <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-08-24 21:13:28 +00:00
kfox1111andMarco Franssen c1b1dd3d88 Add additional domains to JWT issued items. (#230) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-07-03 22:26:28 +02:00
Marco Franssen c11a8c00e7 Implement pre-delete hook for graceful delete of spiffe-oidc-discovery-provider (#353) 2023-06-17 06:06:27 -07:00
Faisal Memon 3cb55dfb4e Allow for having no registry specified (#312) 2023-05-25 14:15:46 -07:00
kfox1111Faisal MemonMarco Franssendependabot[bot]
 		0ba03880a1 Add support for spire-server ingress (#68) 
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-05-23 13:58:58 +00:00
Marco Franssen d850486478 Instead of removing version, first deprecate version 
Deprecating version allows users of the chart to have a migration path

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-17 20:21:07 +02:00
Kevin Fox d1f3cdb909 Switch image.version to image.tag 
The convention in most charts is to use image.tag. This patch updates the values
to use it instead of the less standard image.version.

Signed-off-by: Kevin Fox <[email protected]>
 2023-05-17 20:21:07 +02:00
kfox1111andMarco Franssen 2c360a50fd Add global for image registry (#201) 
This patch enables a user to override all image registry settings all at
once to point to their own registry to enable easy custom mirrors.

partially implements: https://github.com/spiffe/helm-charts/issues/139

---------

Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-04-20 20:08:14 +02:00
kfox1111 3cc8955429 Move reusable macros to root chart (#218) 
This patch adds the start of a library to help reduce code duplication.
It will be split out to its own library chart at the same time the other
charts are split out.

---------

Signed-off-by: Kevin Fox <[email protected]>
 2023-04-18 08:54:46 +02:00
kfox1111 210ed02c58 Remove dead code (#217) 2023-04-17 12:18:18 +02:00
kfox1111 661000a29a Make the agent socket configurable (#114) 2023-03-13 20:35:27 +01:00
Marco Franssen 99d32050ba Remove option to choose different agent socket path 
Resolves #19

Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:23:36 +01:00
Marco Franssen c7ebf72d13 Remove unused helpers from root 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:10 +01:00
Marco Franssen b3d5b7d80a Remove unused template + fix spiffe-csi-driver 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:10 +01:00
Marco Franssen ce9b58e725 Move spire-server to dedicated subchart 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:10 +01:00
Marco Franssen e312d42350 Move spire-agent to dedicated subchart 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:09 +01:00
Marco Franssen ab2636ae98 Move k8s-workload-registrar to sub chart 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:09 +01:00
Marco FranssenandGert Jan Kamstra 99da500c1c Move oidc-discovery-provider to sub chart 
Signed-off-by: Marco Franssen <[email protected]>
Co-authored-by: Gert Jan Kamstra <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:09 +01:00
Marco Franssen 35b8ad3c00 Move the spiffe-csi-driver into a sub chart 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:09 +01:00
Marco Franssen 93156bf904 Allow to use external created secret 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:09 +01:00
Marco Franssen 786c6a5d89 Use with statement for readability 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:08 +01:00
Marco Franssen fe38a52a95 Improve upstream CA 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:08 +01:00
Ken HuffmanandMarco Franssen ce86fb97e1 Add optional UpstreamAuthority (#79) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:08 +01:00
Marco Franssen bf31bdc2c0 Fix server podAnnotations configurable 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:08 +01:00
Marco Franssen 94318b02a6 Bump spire to 1.5.3 to fix oidc healthchecks 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:07 +01:00