panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
637 Commits 1 Branch 2 Tags
912c61e05c4cb9c4671f8aae0c372336c49591aa
Commit Graph
637 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
kfox1111 d616632810 Bump spire version to 1.8.5 (#115) 2023-11-24 09:32:27 -08:00
marcofranssen 95e1eb7c57 Bump test chart dependencies 
Signed-off-by: GitHub <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-11-20 10:34:08 +01:00
Kevin Fox 966061c6c7 Auto add default CSIDriver labels on OpenShift 
Signed-off-by: Kevin Fox <[email protected]>
 2023-11-20 10:24:53 +01:00
Mariusz Sabath c9885de539 Introduce ReadOnlyRootFilesystem for Tornjak frontend (#110) 
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-11-16 15:47:04 -08:00
Mariusz Sabath 911f51b679 Consolidate all the examples to a common relative path (#109) 
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-11-16 13:14:55 -08:00
Mattias Gees 810709533b Fix typo ClusterSPIFFEID for workloadTSelectoremplates (#107) 
Signed-off-by: Mattias Gees <[email protected]>
 2023-11-16 06:34:56 -08:00
Andrew BlockandFaisal Memon 5c0ce97ad1 Ordering of SecurityContextConstraint array items (#105) 
Signed-off-by: Andrew Block <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-11-15 04:54:17 +00:00
kfox1111andFaisal Memon 8f542f2170 Add some nested diagrams (#102) 
* Add some nested diagrams

Signed-off-by: Kevin Fox <[email protected]>

* Fix typo

Signed-off-by: Kevin Fox <[email protected]>

* Add md

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-11-13 14:14:24 -08:00
marcofranssen 889d0af84d Bump test chart dependencies 
Signed-off-by: GitHub <[email protected]>
 2023-11-13 13:49:52 +01:00
dependabot[bot] ef3b1b7649 Bump github.com/onsi/ginkgo/v2 from 2.13.0 to 2.13.1 in /tests 
Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.13.0 to 2.13.1.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.13.0...v2.13.1)

---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-11-13 13:39:45 +01:00
kfox1111 91d262536e Render notes correctly on vscode (#96) 2023-11-11 15:15:21 -08:00
kfox1111 f5d1376cb6 Documentation cleanup (#97) 
Fix links to the repo after move. Remove references to other versions
of images we don't support.

Signed-off-by: Kevin Fox <[email protected]>
 2023-11-11 12:28:41 -08:00
Marco Franssenandkfox1111 250666a2b0 Bump spire Helm Chart version from 0.15.0 to 0.15.1 
* 821ca12 Add Tornjak ingress example (#30)
* 6cd2282 Update SPIRE crds version (#93)

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-11-10 14:00:58 +01:00
Marco Franssen a1c9205424 Only show changes related to the specific chart in release PR description 
Signed-off-by: Marco Franssen <[email protected]>
 2023-11-10 14:00:58 +01:00
Mariusz SabathMarco Franssenkfox1111
 		821ca1290e Add Tornjak ingress example (#30) 
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2023-11-10 12:30:40 +00:00
Faisal Memon 6cd2282a71 Update SPIRE crds version (#93) 
Signed-off-by: Faisal Memon <[email protected]>
 2023-11-09 16:18:35 -08:00
Faisal Memon 06d8cd2ae5 Bump spire Helm Chart version from 0.14.0 to 0.15.0 
* 6c0a4fb Auto tornjak url (#89)
* f2758a8 Autogen jwtIssuer (#88)
* 93c20c6 Merge pull request #83 from spiffe/doc-ingress-patch
* c662b0c Merge branch 'main' into doc-ingress-patch
* de8cbc8 Bump github.com/onsi/gomega from 1.29.0 to 1.30.0 in /tests (#90)
* 1de838e Bump helm.sh/helm/v3 from 3.13.1 to 3.13.2 in /tests (#91)
* daf9d55 Merge branch 'main' into doc-ingress-patch
* aaeca00 Fix tests after renaming files
* 0320c3f Cleanup documentation
* 37cd9f2 Update to SPIRE 1.8.4 (#84)
* bd7879a Fix the typo in the production ingress README
* 805d869 spire-controller-manager 0.4.0 support (#60)
* edf2381 Bump sigstore/cosign-installer from 3.1.2 to 3.2.0 (#85)
* 0ed6d92 Bump test chart dependencies
* f7b6140 Fix docs
* a7e8785 Add another missing one
* 3778597 Add missing ClusterSPIFFEID fields
* 9b31f3d Bump helm/chart-testing-action from 2.6.0 to 2.6.1
* d6583be Add missing no cleanup flags to example tests (#79)
* 81cc2dc Ingress type openshift (#52)
* 2dce90f Bump helm/chart-releaser-action from 1.5.0 to 1.6.0 (#75)
* f08ebd3 Patch Tornjak ingress (#74)
* 6a6aa1c Cosign download fix (#72)
* 3b01684 Support Openshift deployment  (#13)
* ed23d8b Simple ingress support (#48)
* b354413 Fix incorrect nesting of priorityClassName (#67)
* 09ebfc9 Bump test chart dependencies (#68)
* d50d78d Fix ingress annotation variable for tornjak server (#66)
* b813807 Update docs to simplify, clarify, and prioritize ease of install/upgrade (#62)
* 5ad35bd Merge pull request #59 from sabre1041/spire-agent-nodename
* 02d445c Update charts/spire/README.md
* 9bd7f43 Added environment variable to spire-agent to inject node name
* fb64f8d Bump github.com/onsi/gomega from 1.28.1 to 1.29.0 in /tests (#61)
* 30d0f59 Update helm-charts repository URL (#58)
* 7924323 Specify ingress controller type (#43)
* 0b17434 Bump test chart dependencies (#54)
* a419903 Bump github.com/onsi/gomega from 1.28.0 to 1.28.1 in /tests (#53)
* 5025025 Fix doc missing end tag (#46)
* cf226a7 Bump actions/checkout from 4.1.0 to 4.1.1 (#42)

Signed-off-by: Faisal Memon <[email protected]>
 2023-11-09 13:18:02 -08:00
kfox1111Faisal MemonMariusz Sabath
 		6c0a4fbb86 Auto tornjak url (#89) 
* Autogen jwtIssuer

Unset a default for jwtIssuer and global.spire.jwtIssuer. When unset,
generate it to the default of oidc-discovery.$trustDomain so in many
cases the user doesn't need to set it at all.

Signed-off-by: Kevin Fox <[email protected]>

* Autogen tornjak's apiServerURL

Unset the default tornjak apiServerURL. When unset, default to
https://tornjak-backend.$trustDomain so in many cases users don't
have to set it.

Signed-off-by: Kevin Fox <[email protected]>

* Do more autodetection

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-11-09 13:07:52 -08:00
kfox1111Faisal MemonMariusz Sabath
 		f2758a8b2b Autogen jwtIssuer (#88) 
* Autogen jwtIssuer

Unset a default for jwtIssuer and global.spire.jwtIssuer. When unset,
generate it to the default of oidc-discovery.$trustDomain so in many
cases the user doesn't need to set it at all.

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-11-09 20:31:48 +00:00
Mariusz Sabath 93c20c6830 Merge pull request #83 from spiffe/doc-ingress-patch 
Fix the typo in the production ingress README
 2023-11-09 10:28:14 -05:00
kfox1111 c662b0c522 Merge branch 'main' into doc-ingress-patch 2023-11-09 06:43:52 -08:00
dependabot[bot] de8cbc809f Bump github.com/onsi/gomega from 1.29.0 to 1.30.0 in /tests (#90) 2023-11-09 06:08:36 +00:00
dependabot[bot] 1de838e499 Bump helm.sh/helm/v3 from 3.13.1 to 3.13.2 in /tests (#91) 2023-11-08 22:00:38 -08:00
kfox1111 daf9d55c61 Merge branch 'main' into doc-ingress-patch 2023-11-08 09:24:53 -08:00
Kevin Fox aaeca009c2 Fix tests after renaming files 
Signed-off-by: Kevin Fox <[email protected]>
 2023-11-08 04:50:05 -08:00
Marco Franssen 0320c3f755 Cleanup documentation 
Signed-off-by: Marco Franssen <[email protected]>
 2023-11-08 13:11:58 +01:00
Faisal Memon 37cd9f25e2 Update to SPIRE 1.8.4 (#84) 2023-11-08 03:26:21 -08:00
Mariusz Sabath bd7879a84c Fix the typo in the production ingress README 
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-11-08 11:48:20 +01:00
kfox1111Marco FranssenFaisal Memon
 		805d8696d0 spire-controller-manager 0.4.0 support (#60) 
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-11-08 10:43:19 +00:00
dependabot[bot] edf2381aad Bump sigstore/cosign-installer from 3.1.2 to 3.2.0 (#85) 
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.1.2 to 3.2.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/v3.1.2...v3.2.0)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-11-07 22:56:47 -08:00
marcofranssen 0ed6d9244d Bump test chart dependencies 
Signed-off-by: GitHub <[email protected]>
 2023-11-06 13:15:02 +01:00
Kevin Fox f7b61406fe Fix docs 
Signed-off-by: Kevin Fox <[email protected]>
 2023-11-05 23:29:22 -08:00
Kevin Fox a7e8785420 Add another missing one 
Signed-off-by: Kevin Fox <[email protected]>
 2023-11-05 23:29:22 -08:00
Kevin Fox 3778597e72 Add missing ClusterSPIFFEID fields 
There are a few options in the CRD not available via the chart.
Sync them to the chart.

Signed-off-by: Kevin Fox <[email protected]>
 2023-11-05 23:29:22 -08:00
dependabot[bot] 9b31f3d40b Bump helm/chart-testing-action from 2.6.0 to 2.6.1 
Bumps [helm/chart-testing-action](https://github.com/helm/chart-testing-action) from 2.6.0 to 2.6.1.
- [Release notes](https://github.com/helm/chart-testing-action/releases)
- [Commits](https://github.com/helm/chart-testing-action/compare/v2.6.0...v2.6.1)

---
updated-dependencies:
- dependency-name: helm/chart-testing-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-11-05 23:21:35 -08:00
kfox1111 d6583be179 Add missing no cleanup flags to example tests (#79) 2023-11-05 14:10:16 +01:00
kfox1111Faisal MemonMariusz Sabath
 		81cc2dc573 Ingress type openshift (#52) 
* Specify ingress controller type

Signed-off-by: Kevin Fox <[email protected]>

* Fix indenting, docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix spacing

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Add ingress-nginx support

Signed-off-by: Kevin Fox <[email protected]>

* Use the right example values for test version to upgrade from.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var in wrong location

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing arg

Signed-off-by: Kevin Fox <[email protected]>

* Try this to checkout the right version

Signed-off-by: Kevin Fox <[email protected]>

* Switch to upgrading from 0.14.0

Signed-off-by: Kevin Fox <[email protected]>

* Install crds

Signed-off-by: Kevin Fox <[email protected]>

* Simple ingress support

For a lot of situations, ingress rules can be derived from trustDomain.
Change the code to generate rules by default for the user.

Signed-off-by: Kevin Fox <[email protected]>

* Add upgrade test fix from 43

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Enable unset ingress controller type to use with openshift later

Signed-off-by: Kevin Fox <[email protected]>

* Openshift ingress controller type support

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing end tag

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Fix doc merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Fix automatically generated rules on openshift

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Fix pathType

Signed-off-by: Kevin Fox <[email protected]>

* Make openshift edge rules work

Signed-off-by: Kevin Fox <[email protected]>

* Fix var scoping

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix issue created during merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
 2023-11-03 13:16:14 -07:00
dependabot[bot] 2dce90f44e Bump helm/chart-releaser-action from 1.5.0 to 1.6.0 (#75) 
Bumps [helm/chart-releaser-action](https://github.com/helm/chart-releaser-action) from 1.5.0 to 1.6.0.
- [Release notes](https://github.com/helm/chart-releaser-action/releases)
- [Commits](https://github.com/helm/chart-releaser-action/compare/v1.5.0...v1.6.0)

---
updated-dependencies:
- dependency-name: helm/chart-releaser-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-11-02 23:12:20 -07:00
Mariusz Sabath f08ebd344e Patch Tornjak ingress (#74) 
* Fix the tornjak backend tornjak

Signed-off-by: Mariusz Sabath <[email protected]>

* Revert "Fix the tornjak backend tornjak"

This reverts commit cef5505fab940af34be8cfef3e210f020c2f36a1.

Signed-off-by: Mariusz Sabath <[email protected]>

* Fix the tornjak backend tornjak

Signed-off-by: Mariusz Sabath <[email protected]>

---------

Signed-off-by: Mariusz Sabath <[email protected]>
 2023-11-02 09:38:33 -07:00
kfox1111 6a6aa1c850 Cosign download fix (#72) 2023-10-31 16:44:52 +00:00
Mariusz SabathTrilok GeerAndrew Blockkfox1111
 		3b016841da Support Openshift deployment (#13) 
* Add support for SPIRE deployment on OpenShift 4.13

Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Trilok Geer <[email protected]>
Co-authored-by: Andrew Block <[email protected]>

* Render README

Signed-off-by: Mariusz Sabath <[email protected]>

* Fix tornjak HTTP/HTTPS port values

Signed-off-by: Mariusz Sabath <[email protected]>

* Update Frontend README

Signed-off-by: Mariusz Sabath <[email protected]>

* Add env. variable to Agent to inject node name

Signed-off-by: Mariusz Sabath <[email protected]>

* Implement Marco's suggestion on CSI CSS version

Signed-off-by: Mariusz Sabath <[email protected]>

* Add MY_NODE_NAME env. variable to agent for openshift example

Signed-off-by: Mariusz Sabath <[email protected]>

* Move Openshift examples to dedicated directory

Signed-off-by: Mariusz Sabath <[email protected]>

* Simplified the install instructions

Signed-off-by: Mariusz Sabath <[email protected]>

* Suggested changes

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Andrew Block <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs, fix default for backwards compat

Signed-off-by: Kevin Fox <[email protected]>

* Don't recommend experimental features by default, dont debug helm install by default and explain how to add additional features

Signed-off-by: Kevin Fox <[email protected]>

* Add notes about openshift to the project for other reviewers.

Signed-off-by: Kevin Fox <[email protected]>

* Fix incorrectly reverted change

Signed-off-by: Kevin Fox <[email protected]>

* Correct notes

Signed-off-by: Kevin Fox <[email protected]>

* Update default

Signed-off-by: Kevin Fox <[email protected]>

* Fix issue created from bad merge conflict resolution

Signed-off-by: kfox1111 <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

---------

Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Trilok Geer <[email protected]>
Co-authored-by: Andrew Block <[email protected]>
Co-authored-by: Kevin Fox <[email protected]>
 2023-10-31 16:27:23 +00:00
kfox1111andFaisal Memon ed23d8b714 Simple ingress support (#48) 
Co-authored-by: Faisal Memon <[email protected]>
 2023-10-30 22:16:17 +00:00
Inverse Integralandkfox1111 b354413f62 Fix incorrect nesting of priorityClassName (#67) 
Signed-off-by: Inverse Integral <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2023-10-30 10:32:48 -07:00
github-actions[bot]andmarcofranssen 09ebfc9ee3 Bump test chart dependencies (#68) 
Signed-off-by: GitHub <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
 2023-10-30 09:30:10 -07:00
kfox1111 d50d78d9a0 Fix ingress annotation variable for tornjak server (#66) 2023-10-28 11:47:55 -07:00
kfox1111andMarco Franssen b813807f16 Update docs to simplify, clarify, and prioritize ease of install/upgrade (#62) 
* Update docs to simplify, clarify, and prioritize ease of install/upgrade

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-10-26 22:13:54 +00:00
kfox1111 5ad35bd8d5 Merge pull request #59 from sabre1041/spire-agent-nodename 
Added environment variable to spire-agent to inject node name
 2023-10-26 14:33:13 -07:00
Mariusz Sabathandkfox1111 02d445c87b Update charts/spire/README.md 
Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-10-26 16:08:15 -04:00
Andrew Block 9bd7f43056 Added environment variable to spire-agent to inject node name 
Signed-off-by: Andrew Block <[email protected]>
 2023-10-26 12:14:23 -05:00
dependabot[bot] fb64f8d2d0 Bump github.com/onsi/gomega from 1.28.1 to 1.29.0 in /tests (#61) 2023-10-26 03:29:07 +00:00