* Add direct tpm support for spire-agent
Signed-off-by: Kevin Fox <[email protected]>
* Add fingerprinting support
Signed-off-by: Kevin Fox <[email protected]>
* Add example
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-agent/templates/configmap.yaml
Signed-off-by: kfox1111 <[email protected]>
* Support hybrid nodes with different attestors
In some clusters, you may have a mix of nodes with differing attestor
needs. For example, some nodes have hardware TPMs and some without.
This patch enables configuring multiple daemonsets for the agent
that you can target to pools of nodes.
Signed-off-by: Kevin Fox <[email protected]>
* Remove extra slash
Signed-off-by: Kevin Fox <[email protected]>
* Update docs
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-agent/templates/configmap.yaml
Signed-off-by: kfox1111 <[email protected]>
* Fix broken tests
Signed-off-by: Kevin Fox <[email protected]>
* Add daemonset labels
Signed-off-by: Kevin Fox <[email protected]>
* Add temporary upgrade hook
Signed-off-by: Kevin Fox <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Fix include
Signed-off-by: Kevin Fox <[email protected]>
* Add missing values
Signed-off-by: Kevin Fox <[email protected]>
* Fix perms, add upgrade note
Signed-off-by: Kevin Fox <[email protected]>
* Fix hardcoded nodeAttestor and keyManager in spire-agent
Fixes: https://github.com/spiffe/helm-charts-hardened/issues/220
Signed-off-by: Kevin Fox <[email protected]>
* Fix merge issues
Signed-off-by: Kevin Fox <[email protected]>
* Fix unit tests
Signed-off-by: Kevin Fox <[email protected]>
* Pass the agent's securityContext on to Kubernetes
Currently its ignored.
Signed-off-by: Kevin Fox <[email protected]>
* Update example to be usable
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Signed-off-by: kfox1111 <[email protected]>
* Update example
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Fix merge conflict issue
Signed-off-by: Kevin Fox <[email protected]>
* Update to the newest release
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Signed-off-by: kfox1111 <[email protected]>
* Apply suggestions from code review
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix version numbers in docs
Signed-off-by: Kevin Fox <[email protected]>
* Remove merge conflicted extra code
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* beda725 Add pod labels to the SPIRE agent (#273)
* 077f152 Bump test chart dependencies (#272)
* 5849ea2 add pod labels to spire server values (#271)
* f512b06 Configurable daemonsets updateStrategy (#212)
* a539065 Add direct tpm support for spire-agent (#216)
* fcd0c11 Add direct tpm support for spire-server (#211)
* c570174 Enable CA settings via global (#268)
* ac83694 Initial SPIRE 1.9.0 support (#262)
* ddb4eff Bump test chart dependencies (#263)
* bfbafbc Fix OpenShift Federation Ingress bug (#260)
* a0baace Upgrade to spire-controller-manager 0.4.3 (#258)
* 1446f7e Add support for specifying agent authorized_delegates (#255)
* 0b6cd88 Add support for specifying server admin_ids (#254)
* 07a1c39 Add global override for kubectl tag (#251)
* b82a84d Bump test chart dependencies (#252)
* 7a1e731 Bump test chart dependencies (#246)
* a706063 make audit_log_enabled configurable (#241)
* 34a39cb Added emptyDir volume to spire-agent SCC (#243)
* a2e5a4e Add support for enabling the spire-agent admin socket (#234)
* febdcbf Fix whitespace in spire-agent daemonset
Signed-off-by: Faisal Memon <[email protected]>
Adds a global.spire.caSubject section where you can set the CA
subject information for all spire-server instances.
Signed-off-by: Kevin Fox <[email protected]>
* d547532 Pass the agent's securityContext on to Kubernetes (#225)
* 6b03d5a Fix hardcoded nodeAttestor and keyManager in spire-agent (#221)
* f4c92ed Update README.md put cleanup seperately (#223)
* 7542052 Bump test chart dependencies (#219)
* 01e031f Add another upgrade note and fix value name (#215)
* 0fbc512 Remove the white line from securityContext rendering
* 573beaf More quickly detect a daemonset is up and running
* e8d527c Update to spire-controller-manager 0.4.2 (#195)
* 25558d3 Update daemonset.yaml (#204)
Signed-off-by: Faisal Memon <[email protected]>
* 4c307c1 Add missing bundlePublisher section and extraEnv so settings can be set (#201)
* d724d1e Update the documentation (#172)
* e59a29b Bump test chart dependencies (#200)
* 4668151 Add missing extraVolumeMounts to the controllerManager (#196)
* b9ac3c4 Update to spire-controller-manager 0.4.1 (#193)
* 6fec1e5 Update SPIRE to 1.8.7 (#194)
* af155c2 Add support for running spiffe secured discovery provider (default) (#163)
* 3ccdb5e Add tls section to federation bundle endpoint and fix up annotations (#173)
* c7ab131 Add join_token server nodeattestor support (#187)
* 81e9523 Bump test chart dependencies (#186)
* 6d19a76 Fix agent daemonset format (#184)
* b61d4f5 Add spire-agent to spire-agent pod path (#180)
* befa074 Fix notes bug (#178)
* 912c61e Remove deprecated version values (#179)
* ae4ef6e Update HorizontalPodAutoscaler API to autoscaling/v2 (#153)
* e7a61a9 Bump test chart dependencies
* 183e9aa SPIFFE OIDC Discovery Provider Rework (#152)
* 8f1aba8 Bump test chart dependencies (#171)
* 2454b8c Fix links still pointing at older git repo (#167)
* e5c5527 Bump test chart dependencies (#165)
* e630008 Update jwt test to work with newer slim images (#139)
* c39dd44 Add recommendation for namespacePSS (#131)
* 49beb64 Add recommendation for namespaceLayout (#127)
* 33cacd2 Add recommendation for prometheus exporter (#144)
* 6997d6a Add recommendation for securityContext and podSecurityContext (#125)
* 50c4ac3 Add recommendation for strictMode (#143)
* 4fb9d18 Bump test chart dependencies (#155)
* 811123a Update the Tornjak image version (#150)
* 1524537 Update default for additionalDomains not to include localhost (#146)
* e35838c Add recommendation for priorityClass (#124)
* 9f72a8f Use good and automatic defaults for tornjak frontend workingDir (#129)
* 7726351 Tornjak UBI support (#123)
* 89c07e2 Revert openssl 3.2 change (#142)
* a3d3702 Bump test chart dependencies
* 80c7653 Bump test chart dependencies (#134)
* 13f6028 SELinux support (#122)
* 3e8335c Add a flag to enable recommendations (#121)
* 692d463 Remove unneeded lookup function from upgrade hook (#104)
* 8422b8d Added ability to create namespaces (#103)
Signed-off-by: Kevin Fox <[email protected]>
* Add support for the new spire-controller-manager class feature
Signed-off-by: Kevin Fox <[email protected]>
* Fix docs. Swich nested deployment to use controller manager
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Test with nightly
Signed-off-by: Kevin Fox <[email protected]>
* Fix global object naming clash
Signed-off-by: Kevin Fox <[email protected]>
* Fix missing dot
Signed-off-by: Kevin Fox <[email protected]>
* Fix naming conflict with cluster ids
Signed-off-by: Kevin Fox <[email protected]>
* Fix scoping issue
Signed-off-by: Kevin Fox <[email protected]>
* Fix typo
Signed-off-by: Kevin Fox <[email protected]>
* Fix webhook name collision
Signed-off-by: Kevin Fox <[email protected]>
* Fix webhook reference and add note to user about className
Signed-off-by: Kevin Fox <[email protected]>
* Upgrade has to work on the old version of the object before rename
Signed-off-by: Kevin Fox <[email protected]>
* Fix formatting
Signed-off-by: Kevin Fox <[email protected]>
* Remove extra junk from job
Signed-off-by: Kevin Fox <[email protected]>
* Easier local runs and wait for crds
Signed-off-by: Kevin Fox <[email protected]>
* Add missing crd upgrade
Signed-off-by: Kevin Fox <[email protected]>
* Update upgrade notes
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Bump version to the released 0.4.0
Signed-off-by: kfox1111 <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Merge in crd changes from upstream
Signed-off-by: Kevin Fox <[email protected]>
* Add auto populate dns
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/README.md
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Add missing ClusterSPIFFEID fields
There are a few options in the CRD not available via the chart.
Sync them to the chart.
Signed-off-by: Kevin Fox <[email protected]>
* Add another missing one
Signed-off-by: Kevin Fox <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Allow additional CRs to be managed by the chart
Sometimes additional ClusterSPIFFEIDs and the other CRs are needed. Add
support for the end user to manage those extra CRs via the chart.
Signed-off-by: Kevin Fox <[email protected]>
* Add validation
Signed-off-by: Kevin Fox <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Add className to crs
Signed-off-by: Kevin Fox <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Fix readme formatting
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/README.md
Signed-off-by: kfox1111 <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Apply suggestions from code review
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Remove dead code
Signed-off-by: Kevin Fox <[email protected]>
* Fix extra newline
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* Autogen jwtIssuer
Unset a default for jwtIssuer and global.spire.jwtIssuer. When unset,
generate it to the default of oidc-discovery.$trustDomain so in many
cases the user doesn't need to set it at all.
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* Specify ingress controller type
Signed-off-by: Kevin Fox <[email protected]>
* Fix indenting, docs
Signed-off-by: Kevin Fox <[email protected]>
* Fix spacing
Signed-off-by: Kevin Fox <[email protected]>
* Fix missing brackets
Signed-off-by: Kevin Fox <[email protected]>
* Fix missing brackets
Signed-off-by: Kevin Fox <[email protected]>
* Add ingress-nginx support
Signed-off-by: Kevin Fox <[email protected]>
* Use the right example values for test version to upgrade from.
Signed-off-by: Kevin Fox <[email protected]>
* Fix var in wrong location
Signed-off-by: Kevin Fox <[email protected]>
* Fix missing arg
Signed-off-by: Kevin Fox <[email protected]>
* Try this to checkout the right version
Signed-off-by: Kevin Fox <[email protected]>
* Switch to upgrading from 0.14.0
Signed-off-by: Kevin Fox <[email protected]>
* Install crds
Signed-off-by: Kevin Fox <[email protected]>
* Simple ingress support
For a lot of situations, ingress rules can be derived from trustDomain.
Change the code to generate rules by default for the user.
Signed-off-by: Kevin Fox <[email protected]>
* Add upgrade test fix from 43
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Enable unset ingress controller type to use with openshift later
Signed-off-by: Kevin Fox <[email protected]>
* Openshift ingress controller type support
Signed-off-by: Kevin Fox <[email protected]>
* Fix missing end tag
Signed-off-by: Kevin Fox <[email protected]>
* Fix merge conflicts
Signed-off-by: Kevin Fox <[email protected]>
* Fix doc merge conflicts
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Update docs
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Fix merge conflicts
Signed-off-by: Kevin Fox <[email protected]>
* Fix automatically generated rules on openshift
Signed-off-by: Kevin Fox <[email protected]>
* Fix formatting
Signed-off-by: Kevin Fox <[email protected]>
* Fix pathType
Signed-off-by: Kevin Fox <[email protected]>
* Make openshift edge rules work
Signed-off-by: Kevin Fox <[email protected]>
* Fix var scoping
Signed-off-by: Kevin Fox <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Fix issue created during merge conflict
Signed-off-by: Kevin Fox <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
* Specify ingress controller type
Signed-off-by: Kevin Fox <[email protected]>
* Fix indenting, docs
Signed-off-by: Kevin Fox <[email protected]>
* Fix spacing
Signed-off-by: Kevin Fox <[email protected]>
* Fix missing brackets
Signed-off-by: Kevin Fox <[email protected]>
* Fix missing brackets
Signed-off-by: Kevin Fox <[email protected]>
* Add ingress-nginx support
Signed-off-by: Kevin Fox <[email protected]>
* Use the right example values for test version to upgrade from.
Signed-off-by: Kevin Fox <[email protected]>
* Fix var in wrong location
Signed-off-by: Kevin Fox <[email protected]>
* Fix missing arg
Signed-off-by: Kevin Fox <[email protected]>
* Try this to checkout the right version
Signed-off-by: Kevin Fox <[email protected]>
* Switch to upgrading from 0.14.0
Signed-off-by: Kevin Fox <[email protected]>
* Install crds
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Enable unset ingress controller type to use with openshift later
Signed-off-by: Kevin Fox <[email protected]>
* Fix docs after merge issue
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* a01cdc9 Production test don't cleanup flag (#44)
* 56445c4 Spire controller manager upgrade (#8)
* 6635512 Fix Tornjak HTTPS ingress port (#39)
* 78ba615 Update to SPIRE 1.8.2 (#40)
* 2644e4b Bump test chart dependencies (#38)
* 5cb3c6d Bump helm.sh/helm/v3 from 3.13.0 to 3.13.1 in /tests (#37)
* 42bb8cf Bump spire Helm Chart version from 0.13.1 to 0.13.2
* dd87bc0 Bump spire versions to 1.7.4 (#35)
* fdba5d0 Bump spire Helm Chart version from 0.13.0 to 0.13.1
* 0e41a7d Fix failing Tornjak ingress port (#28)
* df1abf6 Bump to spire 1.7.3 (#31)
* 69a20e3 Merge pull request #29 from spiffe/tornjak-version
* 3036a41 Switch to version v1.4.0
* da49059 Update Tornjak image version
* 0fa43a5 Add plugin support to the spire agent (#22)
* c5c5320 Bump github.com/onsi/ginkgo/v2 from 2.12.1 to 2.13.0 in /tests (#27)
* afba33f Add spire agent experimental flags (#26)
* 1107278 Bump test chart dependencies
* 03ff618 Add Tornjak ingress (#16)
* 8f1bfc1 Merge pull request #23 from spiffe/examples-doc
* cd386eb Merge branch 'main' into examples-doc
* 12937db Update Example README
* 06d6690 Bump test chart dependencies (#20)
* 8aca48f Push the changes that update-tags creates (#19)
* a6cb397 Exit code from diff indicating changes should not block commit. (#17)
* ebfa518 Update FAQ from repo switch (#15)
* c23e6cb Fix issue with version checker not running
* 51c20b1 Bump actions/checkout from 4.0.0 to 4.1.0 (#9)
* 21db1e4 Add a test to ensure upgrades work (#6)
* f86648f Bump github.com/onsi/gomega from 1.27.10 to 1.28.0 in /tests
* babd677 Bump helm.sh/helm/v3 from 3.12.3 to 3.13.0 in /tests
* 45187fe Add back CODE-OF-CONDUCT
* 50825d9 Deny production runs of example.org trust domains (#229)
* 712a0f6 Bump actions/checkout from 4.0.0 to 4.1.0
* f04bdc3 Add support for experimental flags (#492)
* 7cdae92 Bump github.com/onsi/ginkgo/v2 from 2.12.0 to 2.12.1 in /tests (#490)
* d3091a8 Fix spire-server configmap UpstreamAuthority/aws_pca and KeyManager/a… (#489)
* 7a96175 Remove developer-guy as a CODEOWNER
Signed-off-by: Faisal Memon <[email protected]>
* dd87bc0 Bump spire versions to 1.7.4 (#35)
* fdba5d0 Bump spire Helm Chart version from 0.13.0 to 0.13.1
* 0e41a7d Fix failing Tornjak ingress port (#28)
* df1abf6 Bump to spire 1.7.3 (#31)
* 69a20e3 Merge pull request #29 from spiffe/tornjak-version
* 3036a41 Switch to version v1.4.0
* da49059 Update Tornjak image version
* 0fa43a5 Add plugin support to the spire agent (#22)
* c5c5320 Bump github.com/onsi/ginkgo/v2 from 2.12.1 to 2.13.0 in /tests (#27)
* afba33f Add spire agent experimental flags (#26)
* 1107278 Bump test chart dependencies
* 03ff618 Add Tornjak ingress (#16)
* 8f1bfc1 Merge pull request #23 from spiffe/examples-doc
* cd386eb Merge branch 'main' into examples-doc
* 12937db Update Example README
* 06d6690 Bump test chart dependencies (#20)
* 8aca48f Push the changes that update-tags creates (#19)
* a6cb397 Exit code from diff indicating changes should not block commit. (#17)
* ebfa518 Update FAQ from repo switch (#15)
* c23e6cb Fix issue with version checker not running
* 51c20b1 Bump actions/checkout from 4.0.0 to 4.1.0 (#9)
* 21db1e4 Add a test to ensure upgrades work (#6)
* f86648f Bump github.com/onsi/gomega from 1.27.10 to 1.28.0 in /tests
* babd677 Bump helm.sh/helm/v3 from 3.12.3 to 3.13.0 in /tests
* 45187fe Add back CODE-OF-CONDUCT
* 50825d9 Deny production runs of example.org trust domains (#229)
* 712a0f6 Bump actions/checkout from 4.0.0 to 4.1.0
* f04bdc3 Add support for experimental flags (#492)
* 7cdae92 Bump github.com/onsi/ginkgo/v2 from 2.12.0 to 2.12.1 in /tests (#490)
* d3091a8 Fix spire-server configmap UpstreamAuthority/aws_pca and KeyManager/a… (#489)
* 7a96175 Remove developer-guy as a CODEOWNER
Signed-off-by: Faisal Memon <[email protected]>
* 0e41a7d Fix failing Tornjak ingress port (#28)
* df1abf6 Bump to spire 1.7.3 (#31)
* 69a20e3 Merge pull request #29 from spiffe/tornjak-version
* 3036a41 Switch to version v1.4.0
* da49059 Update Tornjak image version
* 0fa43a5 Add plugin support to the spire agent (#22)
* c5c5320 Bump github.com/onsi/ginkgo/v2 from 2.12.1 to 2.13.0 in /tests (#27)
* afba33f Add spire agent experimental flags (#26)
* 1107278 Bump test chart dependencies
* 03ff618 Add Tornjak ingress (#16)
* 8f1bfc1 Merge pull request #23 from spiffe/examples-doc
* cd386eb Merge branch 'main' into examples-doc
* 12937db Update Example README
* 06d6690 Bump test chart dependencies (#20)
* 8aca48f Push the changes that update-tags creates (#19)
* a6cb397 Exit code from diff indicating changes should not block commit. (#17)
* ebfa518 Update FAQ from repo switch (#15)
* c23e6cb Fix issue with version checker not running
* 51c20b1 Bump actions/checkout from 4.0.0 to 4.1.0 (#9)
* 21db1e4 Add a test to ensure upgrades work (#6)
* f86648f Bump github.com/onsi/gomega from 1.27.10 to 1.28.0 in /tests
* babd677 Bump helm.sh/helm/v3 from 3.12.3 to 3.13.0 in /tests
* 45187fe Add back CODE-OF-CONDUCT
* 50825d9 Deny production runs of example.org trust domains (#229)
* 712a0f6 Bump actions/checkout from 4.0.0 to 4.1.0
* f04bdc3 Add support for experimental flags (#492)
* 7cdae92 Bump github.com/onsi/ginkgo/v2 from 2.12.0 to 2.12.1 in /tests (#490)
* d3091a8 Fix spire-server configmap UpstreamAuthority/aws_pca and KeyManager/a… (#489)
* 7a96175 Remove developer-guy as a CODEOWNER
Signed-off-by: Faisal Memon <[email protected]>
Faisal Memon