The convention in most charts is to use image.tag. This patch updates the values
to use it instead of the less standard image.version.
Signed-off-by: Kevin Fox <[email protected]>
Tornjak only supports amd64 builds at the moment
To prevent deployment failures on clusters with arm64 nodes I have added a nodeSelector for tornjak frontend, and documentation for spire-server
Signed-off-by: Marco Franssen <[email protected]>
I have added a flag to the helm-docs script to include the documentation
for dependencies.
This will add more complete documentation to
https://artifacthub.io/packages/helm/spiffe/spire#values so it is easier
for our users to get started and having a complete overview.
---------
Signed-off-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Without an annotation, spinnaker will rename the configmap.
---------
Signed-off-by: Faisal Memon <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
This PR introduces a simplified version of
[Tornjak](https://github.com/spiffe/tornjak) to support UI and SPIRE
control plane.
It extends the `/charts/spire-server` sub-chart by injecting *tornjak*
container to the *spire-server* pod. Tornjak image consists of Tornjak
API (Tornjak Backend), Tornjak UI (Frontend), and database for storing
Tornjak specific information.
Tornjak Backend communicates with SPIRE API via SPIRE Server socket.
Since Tornjak UI (Frontend) is a React code that renders in a browser,
it needs to communicate with Tornjak APIs, and that requires
communication ports to be open, either via Ingress (in Cloud deployment)
or via port forwarding in local deployments (e.g. kind, minikube etc).
Typically port 10000 is used for HTTP connection to Backend, and port
3000 for the HTTP connection to Frontend.
End user management, TLS, and mTLS connections will be addressed by
future PRs.
This PR resolves issue #31
---------
Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
Co-authored-by: Kevin Fox <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Pete Cable <[email protected]>
Co-authored-by: Dennis Gove <[email protected]>
When the server and agent are not in the same namespace, the bundle needs to be
uploadable in the agent's namespace.
Signed-off-by: Kevin Fox <[email protected]>
If you don't have the agent and server in the same namespace or the same
cluster, or want to bind additional clusters, you need the ability to
configure the service account allow list.
Signed-off-by: Kevin Fox <[email protected]>
With plugin support, agents and servers need more customization.
This patch enables initContainers, extraContainers, extraVolumes
and extraVolumeMounts to be added to those services.
Signed-off-by: Kevin Fox <[email protected]>
* Better spire-server entry commands
Currently in order to use the cli tools such as spire-server entry show
You must know the path within the container to the binary along with what
the path is to the socket. This patch makes that unnessisary. This now
works:
kubectl exec -it spire-server-0 -- spire-server entry show
Signed-off-by: Kevin Fox <[email protected]>
* Remove setting thats set to default
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
The k8s-workload-registrar needs access to the spire-server socket and
therefore has to run in the same pod to be able to mount the socket
into the container.
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
Mariusz Sabath