Marco Franssen
738842de16
Fix oidc-discovery-provider config mount
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:11 +01:00
Marco Franssen
2c8ca0a237
List spire-server and spire-agent in dependencies
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:10 +01:00
Marco Franssen
c7ebf72d13
Remove unused helpers from root
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:10 +01:00
Marco Franssen
cdbee1bc1b
Cleanup values.yaml
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:10 +01:00
Marco Franssen
b3d5b7d80a
Remove unused template + fix spiffe-csi-driver
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:10 +01:00
Marco Franssen
ce9b58e725
Move spire-server to dedicated subchart
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:10 +01:00
Marco Franssen
e312d42350
Move spire-agent to dedicated subchart
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:09 +01:00
Marco Franssen
ab2636ae98
Move k8s-workload-registrar to sub chart
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:09 +01:00
Marco Franssen and Gert Jan Kamstra
99da500c1c
Move oidc-discovery-provider to sub chart
...
Signed-off-by: Marco Franssen <[email protected] [email protected] [email protected] [email protected]
2023-02-18 13:04:09 +01:00
Marco Franssen
35b8ad3c00
Move the spiffe-csi-driver into a sub chart
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:09 +01:00
Marco Franssen and Gert Jan Kamstra
3fe5f8f145
Improve documentation on values
...
Co-authored-by: Gert Jan Kamstra <[email protected] [email protected]
2023-02-18 13:04:09 +01:00
Marco Franssen
93156bf904
Allow to use external created secret
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:09 +01:00
Marco Franssen
786c6a5d89
Use with statement for readability
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:08 +01:00
Marco Franssen
fe38a52a95
Improve upstream CA
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:08 +01:00
Marco Franssen
1ee42c53d3
Bump wait-for-it image latest-20221223
...
This version supports arm64 and amd64
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:08 +01:00
Marco Franssen
ddf4be3d3d
Bump csiDriver to 0.2.1
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:08 +01:00
Marco Franssen
bf31bdc2c0
Fix server podAnnotations configurable
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:08 +01:00
Marco Franssen
a2abee2f95
Switch oidc image back to static image
...
The repo as private and is now set to public
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:08 +01:00
Marco Franssen
94318b02a6
Bump spire to 1.5.3 to fix oidc healthchecks
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:07 +01:00
Marco Franssen and Gert Jan Kamstra
aff50434fa
Apply suggestions from code review
...
Co-authored-by: Gert Jan Kamstra <[email protected] [email protected]
2023-02-18 13:04:07 +01:00
Marco Franssen
109be1a3cc
Replaced wait-for-it image to resolve security issues
...
This image was also outdated (no recent releases) and contains whole bunch of vulnerabilities
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:07 +01:00
Marco Franssen
9634df136d
Resolve CVE by bumping spire to 1.5.2
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:07 +01:00
Marco Franssen
cc54e3bfbe
Add liveness prove to csi-node-registrar
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:07 +01:00
Marco Franssen
d84a1343c6
Bump csi-node-driver-registrar to v2.6.2
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:06 +01:00
Marco Franssen
be163d26cc
Allow to configure oidc nginx container resources
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:06 +01:00
Marco Franssen
0e480c6057
Use variable for oidc socket
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:06 +01:00
Marco Franssen
83c3e45e93
Make socketPaths configurable
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:06 +01:00
Marco Franssen
c010d6a4b0
Fix spire oidc nginx container
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:06 +01:00
Marco Franssen
a159e7b663
Fix image version failing in spire.image template
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:06 +01:00
Marco Franssen
933a75bfd4
Bump spire version to 1.5.1
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:06 +01:00
Marco Franssen
fc1bcb35d9
Align spire-server sock naming convention with agent
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:05 +01:00
Marco Franssen
60b2f7c773
Utilize spiffe csi driver in OIDC component
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:05 +01:00
Marco Franssen
1e31a5e359
Remove autoscaling using HPA
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:05 +01:00
Marco Franssen
e770a14629
Align config across components
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:05 +01:00
Marco Franssen
10f0138a25
Enable oidc service domains in oidc by default
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:05 +01:00
Marco Franssen
79b26108f4
Fix oidc nodeSelector
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:05 +01:00
Marco Franssen
746768dc55
Use chainguard nginx image
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:05 +01:00
Marco Franssen
1bdb9a5a50
Move affinity, annotations and tolerations to oidc and server components
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:04 +01:00
Marco Franssen
76a0c5ecfc
Move security values to server and oidc components
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:04 +01:00
Marco Franssen
8dd05399d1
Move some values to top
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:04 +01:00
Marco Franssen
7834800463
Move replicaCount to server and oidc components
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:04 +01:00
Marco Franssen
445cde9604
Add the gcr.io images in comment in values.yaml
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:04 +01:00
Marco Franssen
0b6198cf7c
Fix loglevel values
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:04 +01:00
Marco Franssen
ec61c387b0
Fix oidc health check using using scratch images
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:04 +01:00
Marco Franssen
765a4edaf8
Update spire server config to remove deprecated settings
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:03 +01:00
Marco Franssen
7f5346fc84
Switch to ghcr.io for images and bump to 1.5.0
...
Resolves #31
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:03 +01:00
Marco Franssen
a5afe8979e
Add a template to build the image string
...
This also allows to use image digest as a version
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:03 +01:00
Marco Franssen
569412b5d4
Allow to configure resources per object
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:03 +01:00
Marco Franssen
fb5985ada4
Bump spire chart version and require k8s 1.21+
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:03 +01:00
Marco Franssen
5cb6ebe95e
Enforce to amd64 nodes using nodeSelector
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:02 +01:00
Marco Franssen
3a39fe5666
Bump Spire version to 1.0.2 for oidc fixes
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:02 +01:00
Marco Franssen
f11dc08b20
Bump spire image versions from 1.0.0 to 1.0.1
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:02 +01:00
Marco Franssen and Gert Jan Kamstra
48dacbca64
Fix agent socket mount in spire-oidc
...
Co-authored-by: Gert Jan Kamstra <[email protected] [email protected]
2023-02-18 13:04:02 +01:00
Marco Franssen and Gert Jan Kamstra
4f93ead90a
Configurable insecureScheme nginx image
...
Co-Authored-by: Gert Jan Kamstra <[email protected] [email protected]
2023-02-18 13:04:02 +01:00
Marco Franssen
1c54ce82bb
Add jwtIssuer configuration
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:02 +01:00
Marco Franssen
46466e5ec6
Run oidc insecure on unix socket using Nginx
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:01 +01:00
Marco Franssen
c9f69907ac
Use new domains configuration
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:01 +01:00
Marco Franssen
4d3fb47839
Change socket mounts for more control (readonly)
...
pods like oidc mount more then one of these sockets, now we can control readonly vs non readonly better
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:01 +01:00
Marco Franssen
f2d7aa1f62
Run oidc discovery provider as separate pod using workload api
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:01 +01:00
Marco Franssen
31bce3b09e
Remove spire ingress as it complicate SNI acme
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:01 +01:00
Marco Franssen
1e5e84439b
Run Spire services by default on ClusterIP
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:01 +01:00
Marco Franssen
007fa7b83d
Initial spire chart setup
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:00 +01:00
Marco Franssen