This patch removes the production bits of the old lockdown test
and establishes the namespace override test as its own test.
---------
Signed-off-by: Kevin Fox <[email protected]>
This patch makes a second copy of the existing lockdown test
because it is doing double duty. In follow on patches we will
make each test do one thing only.
Signed-off-by: Kevin Fox <[email protected]>
- Remove k8s 1.21 from test matrix
- Fix syntax
- Improve readability test step
Officialy according to readme we support last three k8s versions.
Testing last 5 versions should be sufficient.
---------
Signed-off-by: Marco Franssen <[email protected]>
* fae12af Merge pull request #60 from spiffe/oidc-ingress
* 6322a9a Fix tests
* a9b99fe Add some commented lines for best practice annotations on ingress
* e970d52 Align ingress hostname with jwtIssues in spire-server chart
* cc7121e Add ingress support for OIDC discovery provider
* eaed7c9 Bump actions/checkout from 3.3.0 to 3.4.0 (#129)
* 2e3f045 Make webhook fail policy configurable (#124)
* 9ccbd3c Make kubelet path configurable (#123)
* 80e3b58 Remove dead file from failed rebase. (#121)
* 7155d71 Add documentation how to use Spire in own workloads
* 25c77fc Fix the driver not coming up on overloaded nodes
* 5fdd35b Improve Chart API (#119)
* 03db6bb Namespace override
* 661000a Make the agent socket configurable (#114)
* f3a81ad Make csi driver configurable to be able to run multiple instances (#115)
* b198bc7 Fix the tests so they can run locked down. (#111)
* 09b21ac Fix the gate
* b6716ae Test that it is possible to lock down security of pods (#84)
* bfeb217 Fix cluster role name uniqueness
* 490fe8f Enhance the test workflow scripts
* 9e22d2c Make the namespace the bundle is dropped into configurable
* 7d1f821 Fix test.
* 493ad8f Remove some duplication on chart-testing CI
* b6dd136 Add tmp mount so that server can run locked down (#105)
* aaaf2f7 Remove dead role code
* d2eba22 Fix docs
* 6d43625 Add kfox as a maintainer
* dfa4e6c Ensure CI also runs when test scripts are changed
Signed-off-by: Marco Franssen <[email protected]>
This patch enables exposing the oidc server out with an ingress
along with tests to ensure it works.
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
Because we are already in the context of spire-agent the API looks more
logical to not have another 'agent' part in the name.
Furthermore to make it more clear the oidc provider only requires the
name of the socket as opposed to the entire path like in the other
charts I made that more explicit in the name of the value.
---------
Signed-off-by: Marco Franssen <[email protected]>
Adds namespace to the ClusterRole and ClusterRoleBinding so that it
doesn't conflict when you have two instances of the chart, in different
namespaces with the same release name.
Signed-off-by: Kevin Fox <[email protected]>
This makes it so that tests can now:
1. Add additional values files to the test
2. That the post-install.sh script knows if the test passed or failed
for better output
3. That the main test can be skipped in favor of a test provided one
Signed-off-by: Kevin Fox <[email protected]>
When the server and agent are not in the same namespace, the bundle needs to be
uploadable in the agent's namespace.
Signed-off-by: Kevin Fox <[email protected]>
The cluster role does the same thing, but at the cluster level
where it belongs. The extra role code does nothing so we remove
it here.
Signed-off-by: Kevin Fox <[email protected]>
* 7984bbd Add script to automate cutting a release
* eb186ca Add values for server TTL configurables
* f123296 Add a flag to configure the Kubernetes NodeAttestor (#83)
* 0275569 Incorperate feedback
* a00c97b Incorperate feedback
* f93434a Make server service account allow list configurable
* f0b7f5b Make spire agent server address configurable
* cb627f0 Allow all subchart to conditionally disable (#90)
* 2e9510f Switch to non root nginx (#89)
* a901751 Fix Homepage URL
* 06c395f Fix sources in Chart.yaml (#85)
* d341c5a UpstreamAuthority cert-manager support (#82)
* a82ee69 Make sure all configmap changes rollout
* b7f8c86 Add extra initContainers, containers, volumes to agent and server
* 81ac89a Add k8s 1.26.0 (Kind) to the test matrix
* bb6abfc Merge pull request #76 from spiffe/dependabot/github_actions/sigstore/cosign-installer-3.0.1
* c0e5665 Bump cosign to v2.0.0
* d729a44 Bump sigstore/cosign-installer from 2.8.1 to 3.0.1
* fe7cd73 Merge pull request #74 from spiffe/arm64-support
* a3c04c0 Update supported versions
* 75480ed Bump spiffe-csi-driver image to 0.2.3 (arm64 support)
* 79889ff Bump spiffe-oidc-discovery-provider image to 1.6.0 (arm64 support)
* a632f76 Bump spire-agent image to 1.6.0 (arm64 support)
* b92e81d Bump spire-server image to 1.6.0 (arm64 support)
* fea2aa5 Fix sigstore/cosign-installer usage in release workflow
* fe93346 Use quote function instead of actual quotes
* 9480ab7 Add beta note to readme (#62)
* 4681498 Better spire-server entry commands (#59)
Signed-off-by: Marco Franssen <[email protected]>
If you don't have the agent and server in the same namespace or the same
cluster, or want to bind additional clusters, you need the ability to
configure the service account allow list.
Signed-off-by: Kevin Fox <[email protected]>
If your server is not in the same namespace or cluster as the
agent, you need a config option to specify where it is.
Signed-off-by: Kevin Fox <[email protected]>
kfox1111