panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
486 Commits 1 Branch 2 Tags
65d56957de2e746c4ee4eb2bdd9dbc79a4daae5f
Commit Graph
486 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Faisal Memon 013eb617a9 Fix spacing for spire server service annotation (#273) 
Spacing off by 4.

Signed-off-by: Faisal Memon <[email protected]>
 2023-05-10 18:22:07 -07:00
Edwin BuckMarco Franssenkfox1111
 		73435be9a1 Add project glossary. (#262) 
This glossary is not meant to be complete, as
no glossary can be.  It does mean to cover the
basic different deployments.

To keep things clear, federation was also added
to clarify that federation is not a deployment
but a different "thing".

Closes #261

---------

Signed-off-by: Edwin Buck <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2023-05-10 12:53:17 -07:00
kfox1111Faisal MemonMarco Franssen
 		c4656a74b2 Replicas > 1 is not allowed with sqlite driver (#269) 
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-05-10 16:30:05 +02:00
kfox1111Faisal MemonMarco Franssen
 		d3da3eed55 External database configuration (#225) 
This patch makes all the database settings configurable.

fixes: https://github.com/spiffe/helm-charts/issues/37

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-05-10 14:04:34 +02:00
Edwin Buck ce78bea121 Add Edwin Buck as a maintainer. (#267) 2023-05-09 17:00:02 +02:00
github-actions[bot]marcofranssenKevin Fox
 		1f09d7b386 Bump test chart dependencies (#264) 
Bump the Helm charts used in test scenarios to latest available
versions.

---------

Signed-off-by: GitHub <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: Kevin Fox <[email protected]>
 2023-05-08 06:38:29 -07:00
Edwin Buck aa6b40c0f8 Add project overview. (#258) 2023-05-05 20:55:42 +02:00
kfox1111andFaisal Memon 8e7e6ebc76 Allow trust bundle url to be set along with format (#256) 
This patch enables the spire-agent to retrieve the trust bundle via url.

fixes: https://github.com/spiffe/helm-charts/issues/254

---------

Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-05-04 13:15:17 -07:00
dependabot[bot] 1e09ea54a1 Bump peter-evans/create-pull-request from 5.0.0 to 5.0.1 (#253) 
Bumps
[peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request)
from 5.0.0 to 5.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/peter-evans/create-pull-request/releases">peter-evans/create-pull-request's
releases</a>.</em></p>
<blockquote>
<h2>Create Pull Request v5.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: truncate body if exceeds max length by <a
href="https://github.com/peter-evans"><code>@​peter-evans</code></a> in
<a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/1915">peter-evans/create-pull-request#1915</a></li>
<li>12 dependency updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/peter-evans/create-pull-request/compare/v5.0.0...v5.0.1">https://github.com/peter-evans/create-pull-request/compare/v5.0.0...v5.0.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/284f54f989303d2699d373481a0cfa13ad5a6666"><code>284f54f</code></a>
fix: truncate body if exceeds max length (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/1915">#1915</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/9e5b2344021c369f621dcb89ffde8fd910dac08c"><code>9e5b234</code></a>
build(deps-dev): bump eslint from 8.38.0 to 8.39.0 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/1888">#1888</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/2d8e7db84cac6d2c614124f2f4a8582a45f3b6f6"><code>2d8e7db</code></a>
build(deps-dev): bump <code>@​types/node</code> from 18.15.11 to 18.16.0
(<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/1887">#1887</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/041b6ab1635f4e31e86773ec8a91cf42d1403b67"><code>041b6ab</code></a>
build(deps-dev): bump prettier from 2.8.7 to 2.8.8 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/1886">#1886</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/31de0fdf3fbb0da088e82df3d7ae33c4112d4ef6"><code>31de0fd</code></a>
build(deps-dev): bump <code>@​types/jest</code> from 29.5.0 to 29.5.1
(<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/1885">#1885</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/28295f66367f85dd76ea1d27825cb5987f67c861"><code>28295f6</code></a>
build(deps-dev): bump <code>@​typescript-eslint/parser</code> from
5.59.0 to 5.59.1 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/1884">#1884</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/8dcaf3883b89ee69284b5200207140ee0ff16fd4"><code>8dcaf38</code></a>
build(deps-dev): bump <code>@​typescript-eslint/parser</code> from
5.58.0 to 5.59.0 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/1876">#1876</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/2827897dcca3eb94b42cba2228d9abc3ff04185e"><code>2827897</code></a>
docs: add note about push-to-fork with remote repos</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/c4f19d3a23df3f9c18e7893bb435a88a2e045c49"><code>c4f19d3</code></a>
build(deps-dev): bump eslint-import-resolver-typescript (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/1844">#1844</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/46035868a3d3d84411578c2a440de0f822dd7a06"><code>4603586</code></a>
build(deps-dev): bump eslint from 8.37.0 to 8.38.0 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/1842">#1842</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/peter-evans/create-pull-request/compare/v5.0.0...v5.0.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=peter-evans/create-pull-request&package-manager=github_actions&previous-version=5.0.0&new-version=5.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-05-03 09:13:42 -07:00
github-actions[bot]andKevin Fox 6760cd22cd Bump test chart dependencies (#252) 
Bump the Helm charts used in test scenarios to latest available
versions.

---------

Signed-off-by: GitHub <[email protected]>
Co-authored-by: Kevin Fox <[email protected]>
 2023-05-01 09:16:43 -07:00
kfox1111 61e338df55 Fix example production typos (#244) 
Signed-off-by: kfox1111 <[email protected]>
 2023-04-27 14:02:48 -07:00
Faisal Memon 3d81928ff8 Add skipKubeletVerification configurable (#243) 2023-04-26 21:38:14 +02:00
Marco Franssen 46f10e1df2 Merge pull request #237 from spiffe/fix-check-versions 2023-04-26 16:20:17 +02:00
Marco Franssen 3889d22e34 Fix quotation bug in update-version.sh 
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-26 16:20:07 +02:00
Marco Franssen 6a894e8c38 Move update-versions.sh script 
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-26 16:20:07 +02:00
Marco Franssen 91083a6b4e Add post-install scripts to all tests to capture failure details in GitHub workflow summary (#88) 2023-04-26 07:17:29 -07:00
Marco Franssen 9afb6f80ac Merge pull request #242 from spiffe/shellcheck 2023-04-26 16:06:08 +02:00
Marco Franssen 99af475f1c Resolve shellcheck issues 
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-26 16:04:02 +02:00
Marco Franssen d0a1e12825 Add workflow with shellcheck 
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-26 12:02:27 +02:00
Marco Franssen 8abd75ef7b Merge pull request #241 from spiffe/dependabot/github_actions/sigstore/cosign-installer-3.0.3 2023-04-26 10:20:38 +02:00
Marco Franssen 252f1f5a19 Bump cosign to v2.0.2 
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-26 10:20:20 +02:00
dependabot[bot] 247e3e5d31 Bump sigstore/cosign-installer from 3.0.2 to 3.0.3 
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.0.2 to 3.0.3.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/v3.0.2...v3.0.3)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-04-26 01:03:32 +00:00
kfox1111andMarco Franssen 17d62f1246 Add an action to find new versions of helm charts (#184) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-04-25 10:04:38 +02:00
kfox1111andMarco Franssen 2c360a50fd Add global for image registry (#201) 
This patch enables a user to override all image registry settings all at
once to point to their own registry to enable easy custom mirrors.

partially implements: https://github.com/spiffe/helm-charts/issues/139

---------

Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-04-20 20:08:14 +02:00
kfox1111 3cc8955429 Move reusable macros to root chart (#218) 
This patch adds the start of a library to help reduce code duplication.
It will be split out to its own library chart at the same time the other
charts are split out.

---------

Signed-off-by: Kevin Fox <[email protected]>
 2023-04-18 08:54:46 +02:00
Marco Franssen 3fc81780d9 Add k8s 1.27 to CI + bump other versions to latest patches (#219) 
- Add k8s 1.27 to test workflow
- Bump other k8s versions to latest patch release

---------

Signed-off-by: Marco Franssen <[email protected]>
 2023-04-17 23:28:28 -07:00
Marco Franssen 6b6174400f Merge pull request #113 from spiffe/spire-config-as-yaml-converted-json 2023-04-17 17:50:20 +02:00
kfox1111 9e03f29760 Merge branch 'main' into spire-config-as-yaml-converted-json 2023-04-17 08:43:19 -07:00
kfox1111 210ed02c58 Remove dead code (#217) 2023-04-17 12:18:18 +02:00
Marco Franssen e3b0d00bd7 Bump min required spire 1.6.x version for this chart 
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-17 12:02:09 +02:00
Marco Franssen d7dcfeb66c Change spiffe-oidc-provider-config configmap to yaml format 
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-17 12:02:09 +02:00
Marco Franssen 861108c0ab Change spire-agent configmap to yaml format 
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-17 11:52:47 +02:00
Marco Franssen 1d72b57260 Change spire-server configmap to yaml format 
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-17 11:52:45 +02:00
Marco Franssen ad8bee0d3f Bump spire Helm Chart version from 0.6.2 to 0.6.3 
* 6c21f13 Bump actions/checkout from 3.5.0 to 3.5.2
* 0f57f56 Update to the 1.6.3 spire release
* b82abab Revert "Switch to persistence" (#210)
* 0dec80e Switch to persistence (#200)

Signed-off-by: Marco Franssen <[email protected]>
 2023-04-14 09:45:46 +02:00
dependabot[bot] 6c21f13264 Bump actions/checkout from 3.5.0 to 3.5.2 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3.5.0 to 3.5.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3.5.0...v3.5.2)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-04-14 08:42:40 +02:00
Kevin Fox 0f57f5683a Update to the 1.6.3 spire release 
Update the images to point to the 1.6.3 version of spire.

Signed-off-by: Kevin Fox <[email protected]>
 2023-04-13 23:14:50 +02:00
kfox1111 b82abab357 Revert "Switch to persistence" (#210) 
Reverts spiffe/helm-charts#200

Signed-off-by: Kevin Fox <[email protected]>
 2023-04-12 16:12:07 -04:00
kfox1111 0dec80e1d5 Switch to persistence (#200) 
This patch switches the value to persistence to follow the helm
convention.

fixes: https://github.com/spiffe/helm-charts/issues/199

Signed-off-by: Kevin Fox <[email protected]>
 2023-04-12 08:56:10 -07:00
Faisal Memon bd8bcb2ffa Add Faisal Memon as maintainer to spire chart (#208) 2023-04-12 11:09:18 +02:00
dependabot[bot]andMarco Franssen b73f694a84 Bump sigstore/cosign-installer from 3.0.1 to 3.0.2 (#204) 
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marco Franssen <[email protected]>
 2023-04-12 10:54:31 +02:00
Marco Franssen 67a63bfa94 Bump spire Helm Chart version from 0.6.1 to 0.6.2 
* eeda042 Add  before-hook-creation delete policy

Signed-off-by: Marco Franssen <[email protected]>
 2023-04-11 18:15:45 +02:00
Faisal Memon eeda0428b4 Add before-hook-creation delete policy 
Signed-off-by: Faisal Memon <[email protected]>
 2023-04-09 22:22:59 +02:00
Marco Franssen f6219d9627 Bump spire Helm Chart version from 0.6.0 to 0.6.1 
* db148c8 Fix trustDomain global for oidc discovery provider (#193)

Signed-off-by: Marco Franssen <[email protected]>
 2023-04-06 09:45:29 +02:00
Marco Franssen db148c8aeb Fix trustDomain global for oidc discovery provider (#193) 2023-04-05 10:46:53 -04:00
Marco Franssen 2a2615b2c6 Bump spire Helm Chart version from 0.5.1 to 0.6.0 
* 563e1f7 Add podmonitors (#165)
* 456075f Add hooks to set failurepolicy to ignore on webhook (#128)
* d5dc706 Add Kubernetes 1.21 back (#188)
* daa620b Fix production example test (#183)
* c661d0b Make service dns domain configurable (#164)
* ec236e9 Test for configurable images (#182)
* 280315c Fix namespace-override github test summary (#154)
* 072d952 Switch tests to curl (#178)
* 1b4bfb7 Cleanup old leftover to k8s-workload-registrar
* a770928 Switch busybox image to cgr.dev/chainguard/busybox:latest-glibc (#175)
* 8790416 Enable global config for clusterName, trustDomain, and bundleConfigMap (#156)
* b54c41a Enhance the production example
* dfb32dc Revert adding tornjak to be releasable (#180)
* 059d5fb Bump spire Helm Chart version from 0.5.0 to 0.5.1
* e2ec6ac Add a test to ensure the chart versions match (#163)
* 64585ba Fix formatting issues introduced with #152
* 0dac0db Improve Spire Chart documentation
* f709ed9 Bump actions/checkout from 3.4.0 to 3.5.0
* faef439 Bump helm/chart-testing-action from 2.3.1 to 2.4.0
* ae62dd1 Bump spire version to 1.6.1
* 02fda80 Add Artifact Hub badge to README.md
* 901e670 Disable default Tornjak deployment (#153)
* 05d0f47 Introduction of Tornjak to SPIRE Server helm charts (#144)
* b25dc77 Test fixing the tests (#148)
* b4be9ed Add maturity tag (#138)
* d4fd2ce Extract the namespace override test out of the old lockdown test. (#145)
* 4f85802 Update lockdown test to test the production example
* 04a1305 Fork the lockdown test to two tests as it is doing the work of 2 (#134)
* 64d0107 Resolve issue in prod example on volume mount (#143)
* 5b6708b Remove @dennisgove from CODEOWNERS (#140)
* a516caa Remove k8s 1.21 from test matrix + small syntax error fix (#133)
* 811a2f6 Add option to enable federation on spire-server (#97)

Signed-off-by: Marco Franssen <[email protected]>
 2023-04-04 14:25:31 +02:00
kfox1111andMarco Franssen 563e1f7920 Add podmonitors (#165) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-04 09:55:35 +02:00
Faisal MemonandMarco Franssen 456075f843 Add hooks to set failurepolicy to ignore on webhook (#128) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-04 09:46:49 +02:00
Faisal MemonandMarco Franssen d5dc706592 Add Kubernetes 1.21 back (#188) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-04 09:25:19 +02:00
kfox1111andMarco Franssen daa620bf05 Fix production example test (#183) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-03 19:54:53 +02:00
kfox1111andMarco Franssen c661d0bc7e Make service dns domain configurable (#164) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-03 19:52:36 +02:00