0ba03880a1
Add support for spire-server ingress ( #68 )
...
Co-authored-by: Faisal Memon <[email protected] [email protected]
2023-05-23 13:58:58 +00:00
Marco Franssen
d850486478
Instead of removing version, first deprecate version
...
Deprecating version allows users of the chart to have a migration path
Signed-off-by: Marco Franssen <[email protected]
2023-05-17 20:21:07 +02:00
Kevin Fox
d1f3cdb909
Switch image.version to image.tag
...
The convention in most charts is to use image.tag. This patch updates the values
to use it instead of the less standard image.version.
Signed-off-by: Kevin Fox <[email protected]
2023-05-17 20:21:07 +02:00
kfox1111 and Marco Franssen
2c360a50fd
Add global for image registry ( #201 )
...
This patch enables a user to override all image registry settings all at
once to point to their own registry to enable easy custom mirrors.
partially implements: https://github.com/spiffe/helm-charts/issues/139
---------
Signed-off-by: Kevin Fox <[email protected] [email protected]
2023-04-20 20:08:14 +02:00
kfox1111
3cc8955429
Move reusable macros to root chart ( #218 )
...
This patch adds the start of a library to help reduce code duplication.
It will be split out to its own library chart at the same time the other
charts are split out.
---------
Signed-off-by: Kevin Fox <[email protected]
2023-04-18 08:54:46 +02:00
kfox1111
210ed02c58
Remove dead code ( #217 )
2023-04-17 12:18:18 +02:00
kfox1111
661000a29a
Make the agent socket configurable ( #114 )
2023-03-13 20:35:27 +01:00
Marco Franssen
99d32050ba
Remove option to choose different agent socket path
...
Resolves #19
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:23:36 +01:00
Marco Franssen
c7ebf72d13
Remove unused helpers from root
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:10 +01:00
Marco Franssen
b3d5b7d80a
Remove unused template + fix spiffe-csi-driver
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:10 +01:00
Marco Franssen
ce9b58e725
Move spire-server to dedicated subchart
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:10 +01:00
Marco Franssen
e312d42350
Move spire-agent to dedicated subchart
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:09 +01:00
Marco Franssen
ab2636ae98
Move k8s-workload-registrar to sub chart
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:09 +01:00
Marco Franssen and Gert Jan Kamstra
99da500c1c
Move oidc-discovery-provider to sub chart
...
Signed-off-by: Marco Franssen <[email protected] [email protected] [email protected] [email protected]
2023-02-18 13:04:09 +01:00
Marco Franssen
35b8ad3c00
Move the spiffe-csi-driver into a sub chart
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:09 +01:00
Marco Franssen
93156bf904
Allow to use external created secret
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:09 +01:00
Marco Franssen
786c6a5d89
Use with statement for readability
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:08 +01:00
Marco Franssen
fe38a52a95
Improve upstream CA
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:08 +01:00
Ken Huffman and Marco Franssen
ce86fb97e1
Add optional UpstreamAuthority ( #79 )
...
Co-authored-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:08 +01:00
Marco Franssen
bf31bdc2c0
Fix server podAnnotations configurable
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:08 +01:00
Marco Franssen
94318b02a6
Bump spire to 1.5.3 to fix oidc healthchecks
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:07 +01:00
Marco Franssen and Gert Jan Kamstra
aff50434fa
Apply suggestions from code review
...
Co-authored-by: Gert Jan Kamstra <[email protected] [email protected]
2023-02-18 13:04:07 +01:00
Marco Franssen
109be1a3cc
Replaced wait-for-it image to resolve security issues
...
This image was also outdated (no recent releases) and contains whole bunch of vulnerabilities
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:07 +01:00
Ken Huffman and Marco Franssen
a3f1901a6b
adding annotations and resources ( #81 )
...
Co-authored-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:07 +01:00
Marco Franssen
cc54e3bfbe
Add liveness prove to csi-node-registrar
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:07 +01:00
Marco Franssen
be163d26cc
Allow to configure oidc nginx container resources
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:06 +01:00
Marco Franssen
0e480c6057
Use variable for oidc socket
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:06 +01:00
Marco Franssen
83c3e45e93
Make socketPaths configurable
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:06 +01:00
Marco Franssen
fc1bcb35d9
Align spire-server sock naming convention with agent
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:05 +01:00
Marco Franssen
60b2f7c773
Utilize spiffe csi driver in OIDC component
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:05 +01:00
Marco Franssen
1e31a5e359
Remove autoscaling using HPA
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:05 +01:00
Marco Franssen
e770a14629
Align config across components
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:05 +01:00
Marco Franssen
10f0138a25
Enable oidc service domains in oidc by default
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:05 +01:00
Marco Franssen
79b26108f4
Fix oidc nodeSelector
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:05 +01:00
Marco Franssen
1bdb9a5a50
Move affinity, annotations and tolerations to oidc and server components
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:04 +01:00
Marco Franssen
76a0c5ecfc
Move security values to server and oidc components
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:04 +01:00
Marco Franssen
7834800463
Move replicaCount to server and oidc components
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:04 +01:00
Marco Franssen
ec61c387b0
Fix oidc health check using using scratch images
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:04 +01:00
Marco Franssen
765a4edaf8
Update spire server config to remove deprecated settings
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:03 +01:00
Marco Franssen
a5afe8979e
Add a template to build the image string
...
This also allows to use image digest as a version
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:03 +01:00
Batuhan Apaydın
4e5dd65aad
move spiffe-csi-driver and node-driver-registrar to values
...
Signed-off-by: Batuhan Apaydın <[email protected] [email protected]
2023-02-18 13:04:03 +01:00
Marco Franssen
569412b5d4
Allow to configure resources per object
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:03 +01:00
Marco Franssen
5cb6ebe95e
Enforce to amd64 nodes using nodeSelector
...
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:02 +01:00
Batuhan Apaydın and Furkan Türkal
e9912ba39a
Add spiffe-csi driver support
...
Signed-off-by: Batuhan Apaydın <[email protected] [email protected] [email protected] [email protected]
2023-02-18 13:04:02 +01:00
Marco Franssen and Gert Jan Kamstra
48dacbca64
Fix agent socket mount in spire-oidc
...
Co-authored-by: Gert Jan Kamstra <[email protected] [email protected]
2023-02-18 13:04:02 +01:00
Marco Franssen and Gert Jan Kamstra
4f93ead90a
Configurable insecureScheme nginx image
...
Co-Authored-by: Gert Jan Kamstra <[email protected] [email protected]
2023-02-18 13:04:02 +01:00
Marco Franssen
1c54ce82bb
Add jwtIssuer configuration
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:02 +01:00
Marco Franssen
46466e5ec6
Run oidc insecure on unix socket using Nginx
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:01 +01:00
Marco Franssen
c9f69907ac
Use new domains configuration
...
Signed-off-by: Marco Franssen <[email protected]
2023-02-18 13:04:01 +01:00
Marco Franssen
4d3fb47839
Change socket mounts for more control (readonly)
...
pods like oidc mount more then one of these sockets, now we can control readonly vs non readonly better
Signed-off-by: Marco Franssen <[email protected] [email protected]
2023-02-18 13:04:01 +01:00
