panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
398 Commits 1 Branch 2 Tags
8409674a3e21127e5f79563786b3e39327f19c58
Commit Graph
398 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
kfox1111 ed038feae1 Upgrade to spire 1.6.4 (#308) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 16:17:34 -07:00
Kevin Fox dc5d9cfeec Fix root README.md 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 16:15:21 -07:00
Mariusz Sabath e4447fd8eb Upgrade Tornjak to new image v1.2.1 (#299) 
This upgrade enables the production version of React in Tornjak Frontend
with a smaller footprint and faster startup time.

Using Tornjak v1.2.1 release
https://github.com/spiffe/tornjak/releases/tag/v1.2.1

---------

Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-23 13:32:20 -04:00
Kevin Fox 69f402ecc6 Update docs 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 09:56:05 -07:00
kfox1111andFaisal Memon 38d51d5985 Apply suggestions from code review 
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
 2023-05-23 09:55:38 -07:00
Kevin Fox a1ba235c99 Update docs 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 09:44:06 -07:00
Faisal Memonandkfox1111 1922085ba7 Fix hooks for K3s (#305) 
Co-authored-by: kfox1111 <[email protected]>
 2023-05-23 08:59:21 -07:00
Kevin Fox 4fb549e954 Remove 1.21.x testing 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 08:57:07 -07:00
kfox1111andMarco Franssen 88efc77bee Allow to use spire-server as an upstream authority (#304) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-05-23 14:39:37 +00:00
kfox1111Faisal MemonMarco Franssendependabot[bot]
 		0ba03880a1 Add support for spire-server ingress (#68) 
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-05-23 13:58:58 +00:00
github-actions[bot]andmarcofranssen 4777a30012 Bump test chart dependencies (#301) 
Co-authored-by: marcofranssen <[email protected]>
 2023-05-23 10:19:40 +00:00
kfox1111 00c2c1a533 Fix the generated pr so that it runs jobs too (#303) 2023-05-23 12:14:40 +02:00
kfox1111 dd1ad495bd Update images for cve's found by the cronjob (#290) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-18 14:55:39 -07:00
Mariusz Sabath 1c6947078a Updated Tornjak documenation with Not-for-production labels (#297) 2023-05-18 23:31:03 +02:00
Edwin Buck 7809637424 Merge pull request #296 from spiffe/dependabot/github_actions/helm/kind-action-1.7.0 
Bump helm/kind-action from 1.6.0 to 1.7.0
 2023-05-18 10:25:28 -05:00
Edwin Buck e61ed17b5a Merge pull request #295 from spiffe/dependabot/github_actions/sigstore/cosign-installer-3.0.5 
Bump sigstore/cosign-installer from 3.0.4 to 3.0.5
 2023-05-18 08:59:52 -05:00
Marco Franssen 9975e58f5c Merge pull request #245 from spiffe/tags 2023-05-18 09:18:22 +02:00
dependabot[bot] 7bb7ece123 Bump helm/kind-action from 1.6.0 to 1.7.0 
Bumps [helm/kind-action](https://github.com/helm/kind-action) from 1.6.0 to 1.7.0.
- [Release notes](https://github.com/helm/kind-action/releases)
- [Commits](https://github.com/helm/kind-action/compare/v1.6.0...v1.7.0)

---
updated-dependencies:
- dependency-name: helm/kind-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-05-18 01:05:53 +00:00
dependabot[bot] f1623a59bb Bump sigstore/cosign-installer from 3.0.4 to 3.0.5 
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.0.4 to 3.0.5.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/v3.0.4...v3.0.5)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-05-18 01:05:50 +00:00
kfox1111 f8db5a313b Fix Tornjak persistence issue (#294) 2023-05-18 01:54:26 +02:00
Marco Franssen b30b412edb Tornjak reuse spire-lib.cluster-domain macro (#292) 
Resolves #291

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-17 12:42:17 -07:00
Marco Franssen 90c9eb50f9 Fix kubectl-image macro to handle version deprecation 
Signed-off-by: Marco Franssen <[email protected]>
 2023-05-17 20:21:07 +02:00
Marco Franssen 300d1ccf28 Apply deprecation of image.version to Tornjak 
Signed-off-by: Marco Franssen <[email protected]>
 2023-05-17 20:21:07 +02:00
Marco Franssen d850486478 Instead of removing version, first deprecate version 
Deprecating version allows users of the chart to have a migration path

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-17 20:21:07 +02:00
Marco Franssen 59e422b9e3 Add documentation for all image.tag values 
Signed-off-by: Marco Franssen <[email protected]>
 2023-05-17 20:21:07 +02:00
Kevin Fox d1f3cdb909 Switch image.version to image.tag 
The convention in most charts is to use image.tag. This patch updates the values
to use it instead of the less standard image.version.

Signed-off-by: Kevin Fox <[email protected]>
 2023-05-17 20:21:07 +02:00
Faisal Memon 31ce704fa8 Cleanup maintainer handbook (#287) 2023-05-17 08:49:02 -07:00
Marco Franssen a2da94374c Remove manual dispatch from dummy workflow (#288) 2023-05-17 09:25:15 -05:00
dependabot[bot] 807558bb9c Bump helm/kind-action from 1.5.0 to 1.6.0 (#285) 
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-05-17 10:39:35 +02:00
dependabot[bot] 3df67dbbc0 Bump sigstore/cosign-installer from 3.0.3 to 3.0.4 (#286) 
Bumps
[sigstore/cosign-installer](https://github.com/sigstore/cosign-installer)
from 3.0.3 to 3.0.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sigstore/cosign-installer/releases">sigstore/cosign-installer's
releases</a>.</em></p>
<blockquote>
<h2>v3.0.4</h2>
<ul>
<li>Include fix for <a
href="https://redirect.github.com/sigstore/cosign-installer/pull/124">sigstore/cosign-installer#124</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sigstore/cosign-installer/commit/03d0fecf172873164a163bbc64bed0f3bf114ed7"><code>03d0fec</code></a>
Fix unsafe evaluation of inputs.use-sudo (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/124">#124</a>)</li>
<li><a
href="https://github.com/sigstore/cosign-installer/commit/46b5db744906311fb5af96dec633d262d16dfb5b"><code>46b5db7</code></a>
use intermediate environment variables to avoid risks of script
injection (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/122">#122</a>)</li>
<li><a
href="https://github.com/sigstore/cosign-installer/commit/84448ba515b2a5ac9853582a471184394c67631b"><code>84448ba</code></a>
we should rely upon the digests not the tags, typos (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/121">#121</a>)</li>
<li>See full diff in <a
href="https://github.com/sigstore/cosign-installer/compare/v3.0.3...v3.0.4">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sigstore/cosign-installer&package-manager=github_actions&previous-version=3.0.3&new-version=3.0.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-05-17 01:04:16 -07:00
Marco Franssen 5505d41d8f Merge pull request #283 from spiffe/additional-k8s-native-feature-tornjak-frontend 2023-05-16 23:43:24 +02:00
Marco Franssen 391f093ae9 Allow to configure topologySpreadConstraints for tornjak-frontend 
Signed-off-by: Marco Franssen <[email protected]>
 2023-05-16 20:29:41 +02:00
Marco Franssen 5cc26d3142 Allow to configure tolerations for tornjak-frontend 
Signed-off-by: Marco Franssen <[email protected]>
 2023-05-16 20:29:41 +02:00
Marco Franssen 3537161cdf Allow to configure affinity for tornjak-frontend 
Signed-off-by: Marco Franssen <[email protected]>
 2023-05-16 20:29:41 +02:00
kfox1111 aed6fdfe4e Use the correct kubectl for the cluster (#248) 2023-05-16 20:28:53 +02:00
Marco Franssen ee43c5e36f Add nodeSelector for tornjak 
Tornjak only supports amd64 builds at the moment

To prevent deployment failures on clusters with arm64 nodes I have added a nodeSelector for tornjak frontend, and documentation for spire-server

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-16 20:20:32 +02:00
Marco Franssen fc13cbd911 Merge pull request #234 from spiffe/tornjak 2023-05-16 19:53:42 +02:00
Mariusz Sabath ed472aa98b Update documentation 
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-16 19:31:38 +02:00
Marco Franssen a11cfc99ac Allow to define the resources for tornjak backend 
Signed-off-by: Marco Franssen <[email protected]>
 2023-05-16 19:31:38 +02:00
Mariusz SabathandMarco Franssen 382e0d4a47 Upgrade Tornjak image to version v1.2.0 (#259) 
Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-05-16 19:31:38 +02:00
Mariusz SabathandMarco Franssen 657c460e67 Update charts/spire/charts/tornjak-frontend/templates/service.yaml 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-16 19:31:38 +02:00
Mariusz SabathandMarco Franssen 7521cafcc6 Update charts/spire/charts/spire-server/templates/tornjak-config.yaml 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-16 19:31:38 +02:00
Mariusz SabathandMarco Franssen b64c352b15 Update charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-16 19:31:38 +02:00
Marco Franssen 6ddf6ab9fa Improve tornjak docs (#276) 
- Align tornjak backend naming with same convention as frontend
- Align Tornjak backend and frontend notes style
- Add disclaimer for Tornjak usage to example

---------

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-16 19:31:38 +02:00
Mariusz Sabath 80d34f0485 Use common post-install scripts for testing 
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-16 19:31:38 +02:00
Mariusz Sabath f5efa0cefd Remove dead macros 
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-16 19:31:38 +02:00
Mariusz Sabath bd86518abc Fixing shellcheck 
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-16 19:31:38 +02:00
Mariusz Sabath 91bdea2a1d Provide minimal resources to prevent accidental crashes due to resource exhaustion 
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-16 19:31:38 +02:00
kfox1111 1675997748 Tornjak global image fix (#228) 
This pr updates the Tornjak branch to work with the merged global
registry configuration support.

Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
 2023-05-16 19:31:38 +02:00
Mariusz SabathMarco Franssenkfox1111
 		5e827ee45e Add Tornjak Tests (#220) 
Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2023-05-16 19:31:38 +02:00