panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
606 Commits 1 Branch 2 Tags
7726351955491c5cba79381fc779cf1994ede350
Commit Graph
375 Commits
Author SHA1 Message Date
kfox1111 624ca9cc49 Remove misadded lockfile (#400) 2023-07-20 15:28:32 -07:00
Marco Franssen 1898a18f0b Bump spire Helm Chart version from 0.10.1 to 0.11.0 (#394) 2023-07-19 15:23:43 -07:00
Kevin Fox a6bdb4d1e7 Add persistence type flag 
This patch adds a type flag to the persistence settings to enable
specifying the backing volume's type.

Signed-off-by: Kevin Fox <[email protected]>
 2023-07-19 23:40:23 +02:00
Marco Franssen e426bc06e9 Downgrade chart-testing tool to 3.8.0 
Unfortunatily it fails on linting

Signed-off-by: Marco Franssen <[email protected]>
 2023-07-19 22:54:04 +02:00
Marco Franssen 4b4cef1eae Skip namespace-override test because of #330 
Signed-off-by: Marco Franssen <[email protected]>
 2023-07-19 22:48:20 +02:00
Marco Franssen 380979c71c Prevent ci folder ending up in Helm package 
Signed-off-by: Marco Franssen <[email protected]>
 2023-07-19 22:48:20 +02:00
Marco Franssen 06ddb7cd3f Use chart-testing ci/*-values.yaml for testing 
This also enables the refactor to have multiple root level charts.

Resolves #100

Signed-off-by: Marco Franssen <[email protected]>
 2023-07-19 22:48:19 +02:00
Marco Franssen 088b29608e Improve tornjak service API to have object structure (#392) 2023-07-19 09:17:45 -07:00
Marco Franssen 522066e9f9 Align tornjak clientCA naming convention (#393) 2023-07-19 09:13:50 -07:00
Mariusz SabathandMarco Franssen f05cb4fe1e Add option to configure TLS/mTLS endpoint for Tornjak (#338) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-07-19 14:32:32 +02:00
kfox1111 19d3208740 Fix oidc provider config change not rolling out (#383) 2023-07-12 21:05:09 +02:00
kfox1111 3ed1859cd1 Add missing tolerations config to daemonsets (#381) 
spiffe-csi-driver and spire-agent are missing the ability to specify
tolerations. This PR adds the missing functionality.

fixes: https://github.com/spiffe/helm-charts/issues/380

Signed-off-by: Kevin Fox <[email protected]>
 2023-07-06 12:48:59 -05:00
Drew Wells 4ad68b154b Add namespace to spiffe-oidc-discovery-provider RBAC definitions (#379) 2023-07-06 09:50:46 -07:00
kfox1111andMarco Franssen c1b1dd3d88 Add additional domains to JWT issued items. (#230) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-07-03 22:26:28 +02:00
LaithLite 81452d5e7e Fix missing spiffe-csi-driver imagePullSecrets template (#376) 2023-07-03 12:52:31 +02:00
Marco Franssen ac5977288e Bump spire Helm Chart version from 0.10.0 to 0.10.1 
* d7a03f62 Fix bug in cert-manager upstream authority
* e57c13ac Bump test chart dependencies (#370)

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-30 16:06:21 +02:00
Marco Franssen d7a03f620d Fix bug in cert-manager upstream authority 
The arguments for default function need to be the other way around

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-29 17:39:21 +02:00
Marco Franssen 5500d36b1a Bump spire Helm Chart version from 0.9.1 to 0.10.0 
* f4c421af Ensure the released OCI artifact is also captured in rekor
* 386e736e Bump sigstore/cosign-installer from 3.0.5 to 3.1.0 (#368)
* 99e01c67 Bump spire-controller-manager from 0.2.2 to 0.2.3 (#367)
* 4dccb0d3 Bump spire Helm Chart version from 0.9.0 to 0.9.1 (#365)
* 8409674a Fix the init container flags of the statefulset (#366)
* 3b666601 add missing federatesWith option (#361)
* 0533d925 fixes missing template (#362)
* 1333b6ab Always add parseTime=true for mysql query string (#352)
* ac3be716 Bump test chart dependencies (#358)

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-28 19:01:25 +02:00
Marco Franssen 99e01c6722 Bump spire-controller-manager from 0.2.2 to 0.2.3 (#367) 
resolves a bunch of vulnerabilities in the Image

Signed-off-by: Marco Franssen <[email protected]>

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-22 16:16:43 -07:00
Marco Franssen 4dccb0d3b6 Bump spire Helm Chart version from 0.9.0 to 0.9.1 (#365) 2023-06-22 18:57:33 +02:00
kfox1111 8409674a3e Fix the init container flags of the statefulset (#366) 2023-06-22 18:57:07 +02:00
Drew Wells 3b6666016c add missing federatesWith option (#361) 
DEMO

```
spire-server-0 -- spire-server entry show -spiffeID spiffe://box-4.example.com/ns/dwells/sa/dwells-rc-realm-client
Defaulted container "spire-server" out of: spire-server, spire-controller-manager, wait (init)
Found 1 entry
Entry ID         : 09301666-010e-4ba9-9dcb-44370d4e49e4
SPIFFE ID        : spiffe://box-4.example.com/ns/dwells/sa/dwells-rc-realm-client
Parent ID        : spiffe://box-4.example.com/spire/agent/k8s_psat/example-cluster/ff93872d-791f-4bf3-a532-475775d03d3e
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : k8s:pod-uid:40e0bcad-6ec8-460b-a839-659654549d7a
FederatesWith    : box-3.example.com
```

Signed-off-by: Drew Wells <[email protected]>
 2023-06-22 08:45:37 -07:00
Drew Wells 0533d92594 fixes missing template (#362) 2023-06-22 09:40:08 -04:00
Faisal Memon 1333b6ab34 Always add parseTime=true for mysql query string (#352) 2023-06-20 21:14:42 +02:00
Marco Franssen 44f3554708 Bump spire Helm Chart version from 0.8.1 to 0.9.0 
* 57a9320 Add SPIRE 1.7.0 to main readme (#357)
* af36f7c Align the bash image version with other instances for spire-agent (#356)
* c11a8c0 Implement pre-delete hook for graceful delete of spiffe-oidc-discovery-provider (#353)
* a6dcf26 Allow for SPIRE Agent to run as non root user (#209)
* 9cf6049 Allow contributors to run linting easily on local
* e88f7f6 Add configmap annotation to spire-bundle configmap (#351)
* 020bde8 Add support to create a issuer and CA via cert-manager (#342)
* 9d504de Ignore .DS_Store files
* e6b608c Bump spire images to 1.7.0 (#348)
* c97a788 Fix bundle role/rolebinding naming conflict (#333)
* b66077e Bump peter-evans/create-pull-request from 5.0.1 to 5.0.2 (#349)
* d0da864 Add missing metadata to subcharts (#347)
* 4c0a1d5 Allow overriding test images (#186)
* 250fd5d Add missing global values to charts (#311)
* 5d8c907 Dropping k8s versions in CI older than 3, as per readme (#344)
* 8748933 Update upstream-ca-secret.yaml (#341)
* 4e07450 Fix ingress annotations for federation (#337)
* ea09199 Bump actions/checkout from 3.5.0 to 3.5.3
* 87fe198 Merge pull request #331 from edwbuck/key_conventions
* ddc0166 Fix line wrapping.
* 0cae9ce Update project/conventions.md
* cb18255 Update project/conventions.md
* 52e5c24 Upgrade Tornjak to image v1.2.2 (#328)
* 28e2abf Choose a different example for dotted Acronyms.
* d60d68c Added accidentally clipped explicit name guidelines.
* abe9fde Merge branch 'main' into key_conventions
* f6a7b62 Update project/conventions.md
* c4d19db Update project/conventions.md
* cfa9f78 Bump test chart dependencies (#332)
* c3213ab Initial submission of Helm Chart key naming conventions.
* 28c0824 Bump test chart dependencies (#322)
* d333154 Add Makefile for local testing (#327)
* 9fa1ec2 Improve Tornjak backend test (#321)
* 5b779dc Improve Tornjak frontend test (#320)

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-20 00:14:48 +02:00
Marco Franssen af36f7c09b Align the bash image version with other instances for spire-agent (#356) 
Signed-off-by: Marco Franssen <[email protected]>

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-19 11:28:35 -07:00
Marco Franssen c11a8c00e7 Implement pre-delete hook for graceful delete of spiffe-oidc-discovery-provider (#353) 2023-06-17 06:06:27 -07:00
kfox1111Marco FranssenFaisal Memon
 		a6dcf267d1 Allow for SPIRE Agent to run as non root user (#209) 
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-06-17 10:32:41 +02:00
Faisal Memon e88f7f6fe2 Add configmap annotation to spire-bundle configmap (#351) 2023-06-16 23:22:44 +02:00
Drew WellsandKevin Fox 020bde8561 Add support to create a issuer and CA via cert-manager (#342) 
Co-authored-by: Kevin Fox <[email protected]>
 2023-06-16 21:04:11 +00:00
kfox1111 e6b608c9fd Bump spire images to 1.7.0 (#348) 2023-06-16 07:26:59 +00:00
kfox1111 c97a788c85 Fix bundle role/rolebinding naming conflict (#333) 2023-06-16 08:55:49 +02:00
kfox1111 d0da864113 Add missing metadata to subcharts (#347) 2023-06-14 12:46:22 -07:00
kfox1111 4c0a1d52c5 Allow overriding test images (#186) 2023-06-14 21:17:08 +02:00
kfox1111 250fd5db00 Add missing global values to charts (#311) 2023-06-14 09:16:02 +02:00
Drew Wells 8748933548 Update upstream-ca-secret.yaml (#341) 
Fix an issue with nested context being used for namespace

Fixes this issue:
```
Error: UPGRADE FAILED: template: spire/charts/spire-server/templates/upstream-ca-secret.yaml:8:16: executing "spire/charts/spire-server/templates/upstream-ca-secret.yaml" at <include "spire-server.names
pace" .>: error calling include: template: spire/charts/spire-server/templates/_helpers.tpl:30:16: executing "spire-server.namespace" at <.Values.namespaceOverride>: nil pointer evaluating interface {}.
namespaceOverride
helm.go:84: [debug] template: spire/charts/spire-server/templates/upstream-ca-secret.yaml:8:16: executing "spire/charts/spire-server/templates/upstream-ca-secret.yaml" at <include "spire-server.namespac
e" .>: error calling include: template: spire/charts/spire-server/templates/_helpers.tpl:30:16: executing "spire-server.namespace" at <.Values.namespaceOverride>: nil pointer evaluating interface {}.nam
espaceOverride
```

Signed-off-by: Drew Wells <[email protected]>
 2023-06-12 11:25:14 -07:00
kfox1111 4e07450781 Fix ingress annotations for federation (#337) 
fixes: https://github.com/spiffe/helm-charts/issues/336

Signed-off-by: Kevin Fox <[email protected]>
 2023-06-12 05:50:26 -07:00
Mariusz SabathandEdwin Buck 52e5c24947 Upgrade Tornjak to image v1.2.2 (#328) 
Upgrade Tornjak image to version v1.2.2
(https://github.com/spiffe/tornjak/releases/tag/v1.2.2)

- Resolving issue #326 (remove an emergency patch) 
- Refactor and improve Tornajk image build process

---------

Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Edwin Buck <[email protected]>
 2023-06-08 14:29:01 -04:00
Mariusz Sabath 9fa1ec28a7 Improve Tornjak backend test (#321) 2023-05-30 23:29:29 +02:00
Mariusz Sabath 5b779dc88a Improve Tornjak frontend test (#320) 2023-05-30 23:28:35 +02:00
Marco Franssen dddefd88c0 Bump spire Helm Chart version from 0.8.0 to 0.8.1 
* d83d6a8e Emergency patch for Tornjak Frontend (#319)
* ed172e41 Bump k8s versions to latest patches (#317)
* 05629460 Removed pull_request edited event from ci workflow (#318)
* 3cb55dfb Allow for having no registry specified (#312)
* 1247b68f Parametrize probes (#310)

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-30 18:10:31 +02:00
Mariusz SabathandFaisal Memon d83d6a8efe Emergency patch for Tornjak Frontend (#319) 
Tornjak Frontend serves incorrect dashboard due to restricted namespace.
Fixing the cache file location leads to this error:
```Error: EACCES: permission denied, open './build/env.js'```

Solution, to redirect the env.js output to writeable space e.g. /tmp

Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-05-26 21:50:41 -07:00
Faisal Memon 3cb55dfb4e Allow for having no registry specified (#312) 2023-05-25 14:15:46 -07:00
Mariusz Sabath 1247b68f4d Parametrize probes (#310) 
This PR addresses #307 by parametrizing Probes and moving them to
values.yaml

---------

Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-25 08:53:44 -04:00
Marco Franssen efdeb2e123 Bump spire Helm Chart version from 0.7.0 to 0.8.0 
* c1c5b112 Merge pull request #306 from spiffe/remove-1.21
* 0df45e3c Fix up docs
* ed038fea Upgrade to spire 1.6.4 (#308)
* dc5d9cfe Fix root README.md
* e4447fd8 Upgrade Tornjak to new image v1.2.1 (#299)
* 69f402ec Update docs
* 38d51d59 Apply suggestions from code review
* a1ba235c Update docs
* 1922085b Fix hooks for K3s (#305)
* 4fb549e9 Remove 1.21.x testing
* 88efc77b Allow to use spire-server as an upstream authority (#304)
* 0ba03880 Add support for spire-server ingress (#68)
* 4777a300 Bump test chart dependencies (#301)
* 00c2c1a5 Fix the generated pr so that it runs jobs too (#303)
* dd1ad495 Update images for cve's found by the cronjob (#290)
* 1c694707 Updated Tornjak documenation with Not-for-production labels (#297)
* 78096374 Merge pull request #296 from spiffe/dependabot/github_actions/helm/kind-action-1.7.0
* e61ed17b Merge pull request #295 from spiffe/dependabot/github_actions/sigstore/cosign-installer-3.0.5
* 9975e58f Merge pull request #245 from spiffe/tags
* 7bb7ece1 Bump helm/kind-action from 1.6.0 to 1.7.0
* f1623a59 Bump sigstore/cosign-installer from 3.0.4 to 3.0.5
* f8db5a31 Fix Tornjak persistence issue (#294)
* b30b412e Tornjak reuse spire-lib.cluster-domain macro (#292)
* 90c9eb50 Fix kubectl-image macro to handle version deprecation
* 300d1ccf Apply deprecation of image.version to Tornjak
* d8504864 Instead of removing version, first deprecate version
* 59e422b9 Add documentation for all image.tag values
* d1f3cdb9 Switch image.version to image.tag
* 31ce704f Cleanup maintainer handbook (#287)
* a2da9437 Remove manual dispatch from dummy workflow (#288)
* 807558bb Bump helm/kind-action from 1.5.0 to 1.6.0 (#285)
* 3df67dbb Bump sigstore/cosign-installer from 3.0.3 to 3.0.4 (#286)
* 5505d41d Merge pull request #283 from spiffe/additional-k8s-native-feature-tornjak-frontend
* 391f093a Allow to configure topologySpreadConstraints for tornjak-frontend
* 5cc26d31 Allow to configure tolerations for tornjak-frontend
* 3537161c Allow to configure affinity for tornjak-frontend
* aed6fdfe Use the correct kubectl for the cluster (#248)
* ee43c5e3 Add nodeSelector for tornjak
* fc13cbd9 Merge pull request #234 from spiffe/tornjak
* ed472aa9 Update documentation
* a11cfc99 Allow to define the resources for tornjak backend
* 382e0d4a Upgrade Tornjak image to version v1.2.0  (#259)
* 657c460e Update charts/spire/charts/tornjak-frontend/templates/service.yaml
* 7521cafc Update charts/spire/charts/spire-server/templates/tornjak-config.yaml
* b64c352b Update charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
* 6ddf6ab9 Improve tornjak docs (#276)
* 80d34f04 Use common post-install scripts for testing
* f5efa0ce Remove dead macros
* bd86518a Fixing shellcheck
* 91bdea2a Provide minimal resources to prevent accidental crashes due to resource exhaustion
* 16759977 Tornjak global image fix (#228)
* 5e827ee4 Add Tornjak Tests (#220)
* bdba97b6 Add empty directory to Tornjak to support npm cache (#224)
* da186c5f Split Tornjak Frontend into separate subchart (#179)
* 6d221263 Add Tornjak
* 2669d8b5 Add maintainer's handbook. (#265)
* 72596aea Skip tests for docs folders (#281)
* 7c71738d Bump test chart dependencies (#279)
* 05addae9 Add json to test path (#280)
* 8d9b7349 Switch the spire tests to always run (#250)

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-25 14:22:31 +02:00
Edwin Buck c1c5b112c0 Merge pull request #306 from spiffe/remove-1.21 
Remove 1.21.x testing
 2023-05-23 18:33:58 -05:00
Kevin Fox 0df45e3cd8 Fix up docs 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 16:26:23 -07:00
kfox1111 ed038feae1 Upgrade to spire 1.6.4 (#308) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 16:17:34 -07:00
Mariusz Sabath e4447fd8eb Upgrade Tornjak to new image v1.2.1 (#299) 
This upgrade enables the production version of React in Tornjak Frontend
with a smaller footprint and faster startup time.

Using Tornjak v1.2.1 release
https://github.com/spiffe/tornjak/releases/tag/v1.2.1

---------

Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-23 13:32:20 -04:00
Kevin Fox 69f402ecc6 Update docs 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 09:56:05 -07:00