panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
887 Commits 1 Branch 2 Tags
61eb715029503b3d2fe044fb63a2be7f209ca9c5
Commit Graph
887 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot] cc8ec897bf Bump helm.sh/helm/v3 from 3.14.0 to 3.14.1 in /tests (#249) 
Bumps [helm.sh/helm/v3](https://github.com/helm/helm) from 3.14.0 to 3.14.1.
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](https://github.com/helm/helm/compare/v3.14.0...v3.14.1)

---
updated-dependencies:
- dependency-name: helm.sh/helm/v3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-02-15 07:17:54 -08:00
github-actions[bot]marcofranssenkfox1111
 		7a1e731b31 Bump test chart dependencies (#246) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2024-02-12 13:46:21 +00:00
dependabot[bot] 13af653e3e Bump helm/kind-action from 1.8.0 to 1.9.0 (#245) 
Bumps [helm/kind-action](https://github.com/helm/kind-action) from 1.8.0 to 1.9.0.
- [Release notes](https://github.com/helm/kind-action/releases)
- [Commits](https://github.com/helm/kind-action/compare/v1.8.0...v1.9.0)

---
updated-dependencies:
- dependency-name: helm/kind-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-02-12 13:27:17 +00:00
McRors CalhounFaisal Memonkfox1111
 		a7060632a0 make audit_log_enabled configurable (#241) 
* make audit_log_enabled configurable

Signed-off-by: Rory Houlihan <[email protected]>

* Update charts/spire/charts/spire-server/values.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: McRors Calhoun <[email protected]>

* Update charts/spire/charts/spire-server/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Rory Houlihan <[email protected]>
Signed-off-by: McRors Calhoun <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2024-02-12 13:18:41 +00:00
Andrew Block 34a39cb76e Added emptyDir volume to spire-agent SCC (#243) 
Signed-off-by: Andrew Block <[email protected]>
 2024-02-10 04:51:59 -08:00
kfox1111 a2e5a4e629 Add support for enabling the spire-agent admin socket (#234) 
* Add support for enabling the spire-agent admin socket

Signed-off-by: Kevin Fox <[email protected]>

* Fix typo

Signed-off-by: Kevin Fox <[email protected]>

* Update permissions

Signed-off-by: Kevin Fox <[email protected]>

* Update permissions

Signed-off-by: Kevin Fox <[email protected]>

* Fix template

Signed-off-by: Kevin Fox <[email protected]>

* Update upstream agent too

Signed-off-by: Kevin Fox <[email protected]>

* Fix init issue

Signed-off-by: Kevin Fox <[email protected]>

* Refactor a bit to make things more automatic

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
 2024-02-09 12:44:43 -08:00
Marco Franssen febdcbf992 Fix whitespace in spire-agent daemonset 
Signed-off-by: Marco Franssen <[email protected]>
 2024-02-07 16:41:52 +01:00
Faisal Memon 7ad1ae7355 Bump spire Helm Chart version from 0.17.1 to 0.17.2 
* 49e21c3 Add missing affinity settings (#232)
* 8adbb89 Add alternate name support for the socket (#181)
* 350ec89 Bump test chart dependencies (#235)
* 0e12595 Update README.md delete pvc for cleanup (#233)

Signed-off-by: Faisal Memon <[email protected]>
 2024-02-05 13:01:46 -08:00
kfox1111andFaisal Memon 49e21c389b Add missing affinity settings (#232) 
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-02-05 20:33:24 +00:00
kfox1111andFaisal Memon 8adbb89890 Add alternate name support for the socket (#181) 
* Add alternate name support for the socket

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing image reference

Signed-off-by: Kevin Fox <[email protected]>

* Make user changing socket work smoothly.

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Update charts/spire/charts/spire-agent/values.yaml

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-02-05 11:40:19 -08:00
kfox1111 fce95cb443 Add example of mysql using spire (#164) 
* Add example of mysql using spire

Signed-off-by: Kevin Fox <[email protected]>

* Finish up the implementation

Signed-off-by: Kevin Fox <[email protected]>

* Update the image

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Update. Restested.

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
 2024-02-05 11:17:19 -08:00
github-actions[bot]andmarcofranssen 350ec89ff2 Bump test chart dependencies (#235) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2024-02-05 06:07:03 -08:00
cccsss01andkfox1111 0e1259546b Update README.md delete pvc for cleanup (#233) 
* Update README.md delete pvc for cleanup

adding command to delete the pvc

Signed-off-by: cccsss01 <[email protected]>

* Update charts/spire/README.md

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: cccsss01 <[email protected]>

---------

Signed-off-by: cccsss01 <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2024-02-02 15:23:44 -08:00
dependabot[bot]kfox1111Marco Franssen
 		40b5cc3601 Bump sigstore/cosign-installer from 3.3.0 to 3.4.0 (#228) 
* Bump sigstore/cosign-installer from 3.3.0 to 3.4.0

Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.3.0 to 3.4.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/v3.3.0...v3.4.0)

Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kfox1111 <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2024-02-01 09:46:58 -08:00
kfox1111 35215aee33 Add missing upgrade test bypass (#231) 
* Add missing upgrade test bypass

Signed-off-by: Kevin Fox <[email protected]>

* Too many iterations. Update comment.

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
 2024-02-01 09:28:20 -08:00
dependabot[bot] c1783f639c Bump peter-evans/create-pull-request from 5.0.2 to 6.0.0 
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 5.0.2 to 6.0.0.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](https://github.com/peter-evans/create-pull-request/compare/v5.0.2...v6.0.0)

---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
 2024-02-01 09:20:34 +01:00
Faisal Memon 16ecfe9bb9 Bump spire Helm Chart version from 0.17.0 to 0.17.1 (#226) 
* d547532 Pass the agent's securityContext on to Kubernetes (#225)
* 6b03d5a Fix hardcoded nodeAttestor and keyManager in spire-agent (#221)
* f4c92ed Update README.md put cleanup seperately (#223)
* 7542052 Bump test chart dependencies (#219)
* 01e031f Add another upgrade note and fix value name (#215)
* 0fbc512 Remove the white line from securityContext rendering
* 573beaf More quickly detect a daemonset is up and running
* e8d527c Update to spire-controller-manager 0.4.2 (#195)
* 25558d3 Update daemonset.yaml (#204)

Signed-off-by: Faisal Memon <[email protected]>
 2024-01-30 13:53:41 -08:00
kfox1111 d5475328b4 Pass the agent's securityContext on to Kubernetes (#225) 
Currently its ignored.

Signed-off-by: Kevin Fox <[email protected]>
 2024-01-30 19:55:12 +00:00
kfox1111 6b03d5a0bd Fix hardcoded nodeAttestor and keyManager in spire-agent (#221) 
* Fix hardcoded nodeAttestor and keyManager in spire-agent

---------

Signed-off-by: Kevin Fox <[email protected]>
 2024-01-30 11:33:32 -08:00
cccsss01andkfox1111 f4c92ed3ca Update README.md put cleanup seperately (#223) 
* Update README.md put cleanup seperately

Signed-off-by: cccsss01 <[email protected]>

* Update README.md

Signed-off-by: cccsss01 <[email protected]>

* Update charts/spire/README.md

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: cccsss01 <[email protected]>

---------

Signed-off-by: cccsss01 <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2024-01-30 10:55:10 -08:00
github-actions[bot]andmarcofranssen 7542052b65 Bump test chart dependencies (#219) 
Co-authored-by: marcofranssen <[email protected]>
 2024-01-29 09:24:31 +00:00
kfox1111 01e031f71c Add another upgrade note and fix value name (#215) 
* Add another upgrade note

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
 2024-01-26 17:47:57 -08:00
Marco Franssen 0fbc51223c Remove the white line from securityContext rendering 
Prevents the following diff introduced since the 0.17.0 release.

```diff
        containers:
        - name: post-install-job
          securityContext:
+
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
```

Signed-off-by: Marco Franssen <[email protected]>
 2024-01-26 13:51:28 +01:00
Marco Franssen 573beaf2b0 More quickly detect a daemonset is up and running 
Overall I see the daemonsets on my nodes be ready in approx 5 to 7 seconds.
Reducing the initial delay allows them to be marked as ready within 10 seconds. In cases it takes longer the next probe will be in 30 seconds so max initial waiting time is 40 seconds to be marked as ready compared to 75 seconds at this point of time. Furhtermore the 30 seconds probes also allow more quick detection of failures

Signed-off-by: Marco Franssen <[email protected]>
 2024-01-26 13:43:28 +01:00
kfox1111 e8d527cd9a Update to spire-controller-manager 0.4.2 (#195) 2024-01-25 12:07:10 +01:00
kfox1111 3e1c5199b7 Always upgrade test from the previous major release (#207) 2024-01-24 17:02:31 +01:00
cccsss01andkfox1111 25558d3410 Update daemonset.yaml (#204) 
Doubt there is a need to provide this as an option.

Signed-off-by: cccsss01 <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2024-01-24 05:02:04 -08:00
Kevin Fox 2df2e1661f Bump spire Helm Chart version from 0.16.0 to 0.17.0 
* 4c307c1 Add missing bundlePublisher section and extraEnv so settings can be set (#201)
* d724d1e Update the documentation (#172)
* e59a29b Bump test chart dependencies (#200)
* 4668151 Add missing extraVolumeMounts to the controllerManager (#196)
* b9ac3c4 Update to spire-controller-manager 0.4.1 (#193)
* 6fec1e5 Update SPIRE to 1.8.7 (#194)
* af155c2 Add support for running spiffe secured discovery provider (default) (#163)
* 3ccdb5e Add tls section to federation bundle endpoint and fix up annotations (#173)
* c7ab131 Add join_token server nodeattestor support (#187)
* 81e9523 Bump test chart dependencies (#186)
* 6d19a76 Fix agent daemonset format (#184)
* b61d4f5 Add spire-agent to spire-agent pod path (#180)
* befa074 Fix notes bug (#178)
* 912c61e Remove deprecated version values (#179)
* ae4ef6e Update HorizontalPodAutoscaler API to autoscaling/v2 (#153)
* e7a61a9 Bump test chart dependencies
* 183e9aa SPIFFE OIDC Discovery Provider Rework (#152)
* 8f1aba8 Bump test chart dependencies (#171)
* 2454b8c Fix links still pointing at older git repo (#167)
* e5c5527 Bump test chart dependencies (#165)
* e630008 Update jwt test to work with newer slim images (#139)
* c39dd44 Add recommendation for namespacePSS (#131)
* 49beb64 Add recommendation for namespaceLayout (#127)
* 33cacd2 Add recommendation for prometheus exporter (#144)
* 6997d6a Add recommendation for securityContext and podSecurityContext (#125)
* 50c4ac3 Add recommendation for strictMode (#143)
* 4fb9d18 Bump test chart dependencies (#155)
* 811123a Update the Tornjak image version (#150)
* 1524537 Update default for additionalDomains not to include localhost (#146)
* e35838c Add recommendation for priorityClass (#124)
* 9f72a8f Use good and automatic defaults for tornjak frontend workingDir (#129)
* 7726351 Tornjak UBI support (#123)
* 89c07e2 Revert openssl 3.2 change (#142)
* a3d3702 Bump test chart dependencies
* 80c7653 Bump test chart dependencies (#134)
* 13f6028 SELinux support (#122)
* 3e8335c Add a flag to enable recommendations (#121)
* 692d463 Remove unneeded lookup function from upgrade hook (#104)
* 8422b8d Added ability to create namespaces (#103)

Signed-off-by: Kevin Fox <[email protected]>
 2024-01-24 12:24:29 +01:00
cccsss01 50d30fd6ef Update statefulset with default container annotation. 
Adding default container annotation to the stateful set

Signed-off-by: cccsss01 <[email protected]>
 2024-01-24 09:30:03 +01:00
kfox1111 4a6c705e6a Update the CRs to enable multiple instance nesting without naming conflicts (#189) 2024-01-24 09:20:18 +01:00
kfox1111andFaisal Memon 4c307c1be1 Add missing bundlePublisher section and extraEnv so settings can be set (#201) 
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-01-23 13:18:49 -08:00
kfox1111andFaisal Memon d724d1e690 Update the documentation (#172) 
* SPIFFE OIDC Discovery Provider Rework

Fixes: https://github.com/spiffe/helm-charts-hardened/issues/151

Signed-off-by: Kevin Fox <[email protected]>

* Enhance clusterspiffeid's so the discovery provider is independently configurable

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Undo

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Try to get output

Signed-off-by: Kevin Fox <[email protected]>

* Try and get error code

Signed-off-by: Kevin Fox <[email protected]>

* Fix more logging. Switch port used.

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Fix port

Signed-off-by: Kevin Fox <[email protected]>

* Fix up logs for nested test and fix values

Signed-off-by: Kevin Fox <[email protected]>

* Make consistent

Signed-off-by: Kevin Fox <[email protected]>

* Fix nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix insecure mode and test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var scoping issue

Signed-off-by: Kevin Fox <[email protected]>

* Set the right flags for ingress

Signed-off-by: Kevin Fox <[email protected]>

* Update dns template

Signed-off-by: Kevin Fox <[email protected]>

* Use more standard port

Signed-off-by: Kevin Fox <[email protected]>

* Fix test logging

Signed-off-by: Kevin Fox <[email protected]>

* Allow reencrypt.

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing changes

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Add LetsEncrypt/ACME/cert-manager support. Remove broken ACME support.

Signed-off-by: Kevin Fox <[email protected]>

* Use spiffe-helper as a sidecar. Significant space savings and read only cert dir

Signed-off-by: Kevin Fox <[email protected]>

* Fix the nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge issue

Signed-off-by: Kevin Fox <[email protected]>

* Remove 1.29.0 until deps catch up.

Related issue: https://github.com/rancher/kubectl/pull/94

Signed-off-by: Kevin Fox <[email protected]>

* Add more error checking

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing code

Signed-off-by: Kevin Fox <[email protected]>

* Simplify the ids. Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix logic

Signed-off-by: Kevin Fox <[email protected]>

* Fix var

Signed-off-by: Kevin Fox <[email protected]>

* Make cert-manager bits more readable

Signed-off-by: Kevin Fox <[email protected]>

* Fix template

Signed-off-by: Kevin Fox <[email protected]>

* Fix openshift ingress

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Add resource spec

Signed-off-by: Kevin Fox <[email protected]>

* Remove parts that cant merge yet

Signed-off-by: Kevin Fox <[email protected]>

* Add support for running spiffe secured discovery provider (default)

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Remove defaults

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Add missing configurable for the discovery providers csi driver

Signed-off-by: Kevin Fox <[email protected]>

* Update the documentation

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Add missing file

Signed-off-by: Kevin Fox <[email protected]>

* Update for changes in spiffe-helper

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-01-23 08:05:49 -08:00
github-actions[bot]andmarcofranssen e59a29b2d4 Bump test chart dependencies (#200) 
Co-authored-by: marcofranssen <[email protected]>
 2024-01-22 10:16:50 +00:00
kfox1111 4668151ff7 Add missing extraVolumeMounts to the controllerManager (#196) 2024-01-22 11:09:10 +01:00
dependabot[bot] 367292682b Bump github.com/onsi/gomega from 1.31.0 to 1.31.1 in /tests (#199) 
Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.31.0 to 1.31.1.
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/gomega/compare/v1.31.0...v1.31.1)

---
updated-dependencies:
- dependency-name: github.com/onsi/gomega
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-01-21 20:07:51 -08:00
kfox1111 808795379c Remove CRD that isn't really a CRD (#197) 
Signed-off-by: Kevin Fox <[email protected]>
 2024-01-20 10:54:00 -08:00
kfox1111 b9ac3c4aec Update to spire-controller-manager 0.4.1 (#193) 
Signed-off-by: Kevin Fox <[email protected]>
 2024-01-19 17:10:41 -08:00
kfox1111 6fec1e598a Update SPIRE to 1.8.7 (#194) 
Signed-off-by: Kevin Fox <[email protected]>
 2024-01-18 21:07:53 -08:00
kfox1111andFaisal Memon af155c2edc Add support for running spiffe secured discovery provider (default) (#163) 
* SPIFFE OIDC Discovery Provider Rework

Fixes: https://github.com/spiffe/helm-charts-hardened/issues/151

Signed-off-by: Kevin Fox <[email protected]>

* Enhance clusterspiffeid's so the discovery provider is independently configurable

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Undo

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Try to get output

Signed-off-by: Kevin Fox <[email protected]>

* Try and get error code

Signed-off-by: Kevin Fox <[email protected]>

* Fix more logging. Switch port used.

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Fix port

Signed-off-by: Kevin Fox <[email protected]>

* Fix up logs for nested test and fix values

Signed-off-by: Kevin Fox <[email protected]>

* Make consistent

Signed-off-by: Kevin Fox <[email protected]>

* Fix nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix insecure mode and test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var scoping issue

Signed-off-by: Kevin Fox <[email protected]>

* Set the right flags for ingress

Signed-off-by: Kevin Fox <[email protected]>

* Update dns template

Signed-off-by: Kevin Fox <[email protected]>

* Use more standard port

Signed-off-by: Kevin Fox <[email protected]>

* Fix test logging

Signed-off-by: Kevin Fox <[email protected]>

* Allow reencrypt.

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing changes

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Add LetsEncrypt/ACME/cert-manager support. Remove broken ACME support.

Signed-off-by: Kevin Fox <[email protected]>

* Use spiffe-helper as a sidecar. Significant space savings and read only cert dir

Signed-off-by: Kevin Fox <[email protected]>

* Fix the nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge issue

Signed-off-by: Kevin Fox <[email protected]>

* Remove 1.29.0 until deps catch up.

Related issue: https://github.com/rancher/kubectl/pull/94

Signed-off-by: Kevin Fox <[email protected]>

* Add more error checking

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing code

Signed-off-by: Kevin Fox <[email protected]>

* Simplify the ids. Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix logic

Signed-off-by: Kevin Fox <[email protected]>

* Fix var

Signed-off-by: Kevin Fox <[email protected]>

* Make cert-manager bits more readable

Signed-off-by: Kevin Fox <[email protected]>

* Fix template

Signed-off-by: Kevin Fox <[email protected]>

* Fix openshift ingress

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Add resource spec

Signed-off-by: Kevin Fox <[email protected]>

* Remove parts that cant merge yet

Signed-off-by: Kevin Fox <[email protected]>

* Add support for running spiffe secured discovery provider (default)

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Remove defaults

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Add missing configurable for the discovery providers csi driver

Signed-off-by: Kevin Fox <[email protected]>

* Update for changes in spiffe-helper

Signed-off-by: Kevin Fox <[email protected]>

* Point at upstream

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-01-18 16:08:22 -08:00
dependabot[bot] 9a483c174a Bump github.com/onsi/gomega from 1.30.0 to 1.31.0 in /tests (#192) 
Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.30.0 to 1.31.0.
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/gomega/compare/v1.30.0...v1.31.0)

---
updated-dependencies:
- dependency-name: github.com/onsi/gomega
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-01-18 04:07:00 -08:00
dependabot[bot] a59220dd86 Bump helm.sh/helm/v3 from 3.13.3 to 3.14.0 in /tests (#190) 
Bumps [helm.sh/helm/v3](https://github.com/helm/helm) from 3.13.3 to 3.14.0.
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](https://github.com/helm/helm/compare/v3.13.3...v3.14.0)

---
updated-dependencies:
- dependency-name: helm.sh/helm/v3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-01-18 03:31:32 -08:00
dependabot[bot] 2c56c4a5b1 Bump github.com/onsi/ginkgo/v2 from 2.14.0 to 2.15.0 in /tests (#191) 
Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.14.0 to 2.15.0.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.14.0...v2.15.0)

---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-01-18 03:15:51 -08:00
kfox1111andFaisal Memon f8327657cd Add a test and example for federation support (#169) 
* SPIFFE OIDC Discovery Provider Rework

Fixes: https://github.com/spiffe/helm-charts-hardened/issues/151

Signed-off-by: Kevin Fox <[email protected]>

* Enhance clusterspiffeid's so the discovery provider is independently configurable

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Undo

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Try to get output

Signed-off-by: Kevin Fox <[email protected]>

* Try and get error code

Signed-off-by: Kevin Fox <[email protected]>

* Fix more logging. Switch port used.

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Fix port

Signed-off-by: Kevin Fox <[email protected]>

* Fix up logs for nested test and fix values

Signed-off-by: Kevin Fox <[email protected]>

* Make consistent

Signed-off-by: Kevin Fox <[email protected]>

* Fix nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix insecure mode and test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var scoping issue

Signed-off-by: Kevin Fox <[email protected]>

* Set the right flags for ingress

Signed-off-by: Kevin Fox <[email protected]>

* Update dns template

Signed-off-by: Kevin Fox <[email protected]>

* Use more standard port

Signed-off-by: Kevin Fox <[email protected]>

* Fix test logging

Signed-off-by: Kevin Fox <[email protected]>

* Allow reencrypt.

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing changes

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Add LetsEncrypt/ACME/cert-manager support. Remove broken ACME support.

Signed-off-by: Kevin Fox <[email protected]>

* Use spiffe-helper as a sidecar. Significant space savings and read only cert dir

Signed-off-by: Kevin Fox <[email protected]>

* Fix the nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge issue

Signed-off-by: Kevin Fox <[email protected]>

* Remove 1.29.0 until deps catch up.

Related issue: https://github.com/rancher/kubectl/pull/94

Signed-off-by: Kevin Fox <[email protected]>

* Add more error checking

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing code

Signed-off-by: Kevin Fox <[email protected]>

* Simplify the ids. Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix logic

Signed-off-by: Kevin Fox <[email protected]>

* Fix var

Signed-off-by: Kevin Fox <[email protected]>

* Make cert-manager bits more readable

Signed-off-by: Kevin Fox <[email protected]>

* Fix template

Signed-off-by: Kevin Fox <[email protected]>

* Fix openshift ingress

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Add resource spec

Signed-off-by: Kevin Fox <[email protected]>

* Remove parts that cant merge yet

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Add missing configurable for the discovery providers csi driver

Signed-off-by: Kevin Fox <[email protected]>

* Add a test and example for federation support

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix ingress annotations for federation bundle endpoint

Signed-off-by: Kevin Fox <[email protected]>

* Add cert-manager support to the federation bundle endpoint and fix up bundle endpoint ingress annotations

Signed-off-by: Kevin Fox <[email protected]>

* Add external secret too

Signed-off-by: Kevin Fox <[email protected]>

* Add forgotten files

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-01-17 15:09:32 -08:00
kfox1111 3ccdb5e4c1 Add tls section to federation bundle endpoint and fix up annotations (#173) 
* Add cert-manager support to the federation bundle endpoint and fix up bundle endpoint ingress annotations

Signed-off-by: Kevin Fox <[email protected]>

* Add external secret too

Signed-off-by: Kevin Fox <[email protected]>

* Add forgotten files

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
 2024-01-17 00:17:15 -08:00
kfox1111 c7ab1319cc Add join_token server nodeattestor support (#187) 
Signed-off-by: Kevin Fox <[email protected]>
 2024-01-16 14:52:39 -08:00
github-actions[bot]andmarcofranssen 81e9523e03 Bump test chart dependencies (#186) 
Signed-off-by: GitHub <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
 2024-01-15 06:11:02 -08:00
Mariusz Sabath 6d19a76f01 Fix agent daemonset format (#184) 
Signed-off-by: Mariusz Sabath <[email protected]>
 2024-01-12 21:20:10 +00:00
dependabot[bot] f3a85bdb98 Bump github.com/onsi/ginkgo/v2 from 2.13.2 to 2.14.0 in /tests (#183) 
Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.13.2 to 2.14.0.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.13.2...v2.14.0)

---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-01-12 00:55:06 -08:00
kfox1111 b61d4f5ae1 Add spire-agent to spire-agent pod path (#180) 2024-01-11 10:39:12 +00:00
kfox1111 befa074763 Fix notes bug (#178) 2024-01-11 10:31:02 +00:00