* 64585ba Fix formatting issues introduced with #152
* 0dac0db Improve Spire Chart documentation
* f709ed9 Bump actions/checkout from 3.4.0 to 3.5.0
* faef439 Bump helm/chart-testing-action from 2.3.1 to 2.4.0
* ae62dd1 Bump spire version to 1.6.1
* 02fda80 Add Artifact Hub badge to README.md
* 901e670 Disable default Tornjak deployment (#153)
* 05d0f47 Introduction of Tornjak to SPIRE Server helm charts (#144)
* b25dc77 Test fixing the tests (#148)
* b4be9ed Add maturity tag (#138)
* d4fd2ce Extract the namespace override test out of the old lockdown test. (#145)
* 4f85802 Update lockdown test to test the production example
* 04a1305 Fork the lockdown test to two tests as it is doing the work of 2 (#134)
* 64d0107 Resolve issue in prod example on volume mount (#143)
* 5b6708b Remove @dennisgove from CODEOWNERS (#140)
* a516caa Remove k8s 1.21 from test matrix + small syntax error fix (#133)
* 811a2f6 Add option to enable federation on spire-server (#97)
Signed-off-by: Marco Franssen <[email protected]>
This PR introduces a simplified version of
[Tornjak](https://github.com/spiffe/tornjak) to support UI and SPIRE
control plane.
It extends the `/charts/spire-server` sub-chart by injecting *tornjak*
container to the *spire-server* pod. Tornjak image consists of Tornjak
API (Tornjak Backend), Tornjak UI (Frontend), and database for storing
Tornjak specific information.
Tornjak Backend communicates with SPIRE API via SPIRE Server socket.
Since Tornjak UI (Frontend) is a React code that renders in a browser,
it needs to communicate with Tornjak APIs, and that requires
communication ports to be open, either via Ingress (in Cloud deployment)
or via port forwarding in local deployments (e.g. kind, minikube etc).
Typically port 10000 is used for HTTP connection to Backend, and port
3000 for the HTTP connection to Frontend.
End user management, TLS, and mTLS connections will be addressed by
future PRs.
This PR resolves issue #31
---------
Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
Co-authored-by: Kevin Fox <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Pete Cable <[email protected]>
Co-authored-by: Dennis Gove <[email protected]>
* fae12af Merge pull request #60 from spiffe/oidc-ingress
* 6322a9a Fix tests
* a9b99fe Add some commented lines for best practice annotations on ingress
* e970d52 Align ingress hostname with jwtIssues in spire-server chart
* cc7121e Add ingress support for OIDC discovery provider
* eaed7c9 Bump actions/checkout from 3.3.0 to 3.4.0 (#129)
* 2e3f045 Make webhook fail policy configurable (#124)
* 9ccbd3c Make kubelet path configurable (#123)
* 80e3b58 Remove dead file from failed rebase. (#121)
* 7155d71 Add documentation how to use Spire in own workloads
* 25c77fc Fix the driver not coming up on overloaded nodes
* 5fdd35b Improve Chart API (#119)
* 03db6bb Namespace override
* 661000a Make the agent socket configurable (#114)
* f3a81ad Make csi driver configurable to be able to run multiple instances (#115)
* b198bc7 Fix the tests so they can run locked down. (#111)
* 09b21ac Fix the gate
* b6716ae Test that it is possible to lock down security of pods (#84)
* bfeb217 Fix cluster role name uniqueness
* 490fe8f Enhance the test workflow scripts
* 9e22d2c Make the namespace the bundle is dropped into configurable
* 7d1f821 Fix test.
* 493ad8f Remove some duplication on chart-testing CI
* b6dd136 Add tmp mount so that server can run locked down (#105)
* aaaf2f7 Remove dead role code
* d2eba22 Fix docs
* 6d43625 Add kfox as a maintainer
* dfa4e6c Ensure CI also runs when test scripts are changed
Signed-off-by: Marco Franssen <[email protected]>
This patch enables exposing the oidc server out with an ingress
along with tests to ensure it works.
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
Because we are already in the context of spire-agent the API looks more
logical to not have another 'agent' part in the name.
Furthermore to make it more clear the oidc provider only requires the
name of the socket as opposed to the entire path like in the other
charts I made that more explicit in the name of the value.
---------
Signed-off-by: Marco Franssen <[email protected]>
Adds namespace to the ClusterRole and ClusterRoleBinding so that it
doesn't conflict when you have two instances of the chart, in different
namespaces with the same release name.
Signed-off-by: Kevin Fox <[email protected]>
When the server and agent are not in the same namespace, the bundle needs to be
uploadable in the agent's namespace.
Signed-off-by: Kevin Fox <[email protected]>
The cluster role does the same thing, but at the cluster level
where it belongs. The extra role code does nothing so we remove
it here.
Signed-off-by: Kevin Fox <[email protected]>
* 7984bbd Add script to automate cutting a release
* eb186ca Add values for server TTL configurables
* f123296 Add a flag to configure the Kubernetes NodeAttestor (#83)
* 0275569 Incorperate feedback
* a00c97b Incorperate feedback
* f93434a Make server service account allow list configurable
* f0b7f5b Make spire agent server address configurable
* cb627f0 Allow all subchart to conditionally disable (#90)
* 2e9510f Switch to non root nginx (#89)
* a901751 Fix Homepage URL
* 06c395f Fix sources in Chart.yaml (#85)
* d341c5a UpstreamAuthority cert-manager support (#82)
* a82ee69 Make sure all configmap changes rollout
* b7f8c86 Add extra initContainers, containers, volumes to agent and server
* 81ac89a Add k8s 1.26.0 (Kind) to the test matrix
* bb6abfc Merge pull request #76 from spiffe/dependabot/github_actions/sigstore/cosign-installer-3.0.1
* c0e5665 Bump cosign to v2.0.0
* d729a44 Bump sigstore/cosign-installer from 2.8.1 to 3.0.1
* fe7cd73 Merge pull request #74 from spiffe/arm64-support
* a3c04c0 Update supported versions
* 75480ed Bump spiffe-csi-driver image to 0.2.3 (arm64 support)
* 79889ff Bump spiffe-oidc-discovery-provider image to 1.6.0 (arm64 support)
* a632f76 Bump spire-agent image to 1.6.0 (arm64 support)
* b92e81d Bump spire-server image to 1.6.0 (arm64 support)
* fea2aa5 Fix sigstore/cosign-installer usage in release workflow
* fe93346 Use quote function instead of actual quotes
* 9480ab7 Add beta note to readme (#62)
* 4681498 Better spire-server entry commands (#59)
Signed-off-by: Marco Franssen <[email protected]>
If you don't have the agent and server in the same namespace or the same
cluster, or want to bind additional clusters, you need the ability to
configure the service account allow list.
Signed-off-by: Kevin Fox <[email protected]>
If your server is not in the same namespace or cluster as the
agent, you need a config option to specify where it is.
Signed-off-by: Kevin Fox <[email protected]>
With plugin support, agents and servers need more customization.
This patch enables initContainers, extraContainers, extraVolumes
and extraVolumeMounts to be added to those services.
Signed-off-by: Kevin Fox <[email protected]>
* Better spire-server entry commands
Currently in order to use the cli tools such as spire-server entry show
You must know the path within the container to the binary along with what
the path is to the socket. This patch makes that unnessisary. This now
works:
kubectl exec -it spire-server-0 -- spire-server entry show
Signed-off-by: Kevin Fox <[email protected]>
* Remove setting thats set to default
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Marco Franssen