panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
913 Commits 1 Branch 2 Tags
915744fa4660216e9ee2e39444251ea6575cc760
Commit Graph
583 Commits
Author SHA1 Message Date
kfox1111 a0baace5ea Upgrade to spire-controller-manager 0.4.3 (#258) 
Signed-off-by: Kevin Fox <[email protected]>
 2024-02-22 10:38:58 -08:00
kfox1111andFaisal Memon 1446f7ea79 Add support for specifying agent authorized_delegates (#255) 
* Add support for specifying agent authorized_delegates

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-agent/values.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-02-20 17:11:03 +00:00
kfox1111andFaisal Memon 0b6cd88d56 Add support for specifying server admin_ids (#254) 
* Add support for specifying server admin_ids

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-server/templates/configmap.yaml

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-02-20 08:50:18 -08:00
kfox1111 07a1c391b2 Add global override for kubectl tag (#251) 2024-02-19 20:18:31 +01:00
github-actions[bot]marcofranssenkfox1111
 		b82a84dddb Bump test chart dependencies (#252) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2024-02-19 05:11:45 -08:00
github-actions[bot]marcofranssenkfox1111
 		7a1e731b31 Bump test chart dependencies (#246) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2024-02-12 13:46:21 +00:00
McRors CalhounFaisal Memonkfox1111
 		a7060632a0 make audit_log_enabled configurable (#241) 
* make audit_log_enabled configurable

Signed-off-by: Rory Houlihan <[email protected]>

* Update charts/spire/charts/spire-server/values.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: McRors Calhoun <[email protected]>

* Update charts/spire/charts/spire-server/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Rory Houlihan <[email protected]>
Signed-off-by: McRors Calhoun <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2024-02-12 13:18:41 +00:00
Andrew Block 34a39cb76e Added emptyDir volume to spire-agent SCC (#243) 
Signed-off-by: Andrew Block <[email protected]>
 2024-02-10 04:51:59 -08:00
kfox1111 a2e5a4e629 Add support for enabling the spire-agent admin socket (#234) 
* Add support for enabling the spire-agent admin socket

Signed-off-by: Kevin Fox <[email protected]>

* Fix typo

Signed-off-by: Kevin Fox <[email protected]>

* Update permissions

Signed-off-by: Kevin Fox <[email protected]>

* Update permissions

Signed-off-by: Kevin Fox <[email protected]>

* Fix template

Signed-off-by: Kevin Fox <[email protected]>

* Update upstream agent too

Signed-off-by: Kevin Fox <[email protected]>

* Fix init issue

Signed-off-by: Kevin Fox <[email protected]>

* Refactor a bit to make things more automatic

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
 2024-02-09 12:44:43 -08:00
Marco Franssen febdcbf992 Fix whitespace in spire-agent daemonset 
Signed-off-by: Marco Franssen <[email protected]>
 2024-02-07 16:41:52 +01:00
Faisal Memon 7ad1ae7355 Bump spire Helm Chart version from 0.17.1 to 0.17.2 
* 49e21c3 Add missing affinity settings (#232)
* 8adbb89 Add alternate name support for the socket (#181)
* 350ec89 Bump test chart dependencies (#235)
* 0e12595 Update README.md delete pvc for cleanup (#233)

Signed-off-by: Faisal Memon <[email protected]>
 2024-02-05 13:01:46 -08:00
kfox1111andFaisal Memon 49e21c389b Add missing affinity settings (#232) 
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-02-05 20:33:24 +00:00
kfox1111andFaisal Memon 8adbb89890 Add alternate name support for the socket (#181) 
* Add alternate name support for the socket

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing image reference

Signed-off-by: Kevin Fox <[email protected]>

* Make user changing socket work smoothly.

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Update charts/spire/charts/spire-agent/values.yaml

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-02-05 11:40:19 -08:00
github-actions[bot]andmarcofranssen 350ec89ff2 Bump test chart dependencies (#235) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2024-02-05 06:07:03 -08:00
cccsss01andkfox1111 0e1259546b Update README.md delete pvc for cleanup (#233) 
* Update README.md delete pvc for cleanup

adding command to delete the pvc

Signed-off-by: cccsss01 <[email protected]>

* Update charts/spire/README.md

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: cccsss01 <[email protected]>

---------

Signed-off-by: cccsss01 <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2024-02-02 15:23:44 -08:00
Faisal Memon 16ecfe9bb9 Bump spire Helm Chart version from 0.17.0 to 0.17.1 (#226) 
* d547532 Pass the agent's securityContext on to Kubernetes (#225)
* 6b03d5a Fix hardcoded nodeAttestor and keyManager in spire-agent (#221)
* f4c92ed Update README.md put cleanup seperately (#223)
* 7542052 Bump test chart dependencies (#219)
* 01e031f Add another upgrade note and fix value name (#215)
* 0fbc512 Remove the white line from securityContext rendering
* 573beaf More quickly detect a daemonset is up and running
* e8d527c Update to spire-controller-manager 0.4.2 (#195)
* 25558d3 Update daemonset.yaml (#204)

Signed-off-by: Faisal Memon <[email protected]>
 2024-01-30 13:53:41 -08:00
kfox1111 d5475328b4 Pass the agent's securityContext on to Kubernetes (#225) 
Currently its ignored.

Signed-off-by: Kevin Fox <[email protected]>
 2024-01-30 19:55:12 +00:00
kfox1111 6b03d5a0bd Fix hardcoded nodeAttestor and keyManager in spire-agent (#221) 
* Fix hardcoded nodeAttestor and keyManager in spire-agent

---------

Signed-off-by: Kevin Fox <[email protected]>
 2024-01-30 11:33:32 -08:00
cccsss01andkfox1111 f4c92ed3ca Update README.md put cleanup seperately (#223) 
* Update README.md put cleanup seperately

Signed-off-by: cccsss01 <[email protected]>

* Update README.md

Signed-off-by: cccsss01 <[email protected]>

* Update charts/spire/README.md

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: cccsss01 <[email protected]>

---------

Signed-off-by: cccsss01 <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2024-01-30 10:55:10 -08:00
github-actions[bot]andmarcofranssen 7542052b65 Bump test chart dependencies (#219) 
Co-authored-by: marcofranssen <[email protected]>
 2024-01-29 09:24:31 +00:00
kfox1111 01e031f71c Add another upgrade note and fix value name (#215) 
* Add another upgrade note

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
 2024-01-26 17:47:57 -08:00
Marco Franssen 0fbc51223c Remove the white line from securityContext rendering 
Prevents the following diff introduced since the 0.17.0 release.

```diff
        containers:
        - name: post-install-job
          securityContext:
+
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
```

Signed-off-by: Marco Franssen <[email protected]>
 2024-01-26 13:51:28 +01:00
Marco Franssen 573beaf2b0 More quickly detect a daemonset is up and running 
Overall I see the daemonsets on my nodes be ready in approx 5 to 7 seconds.
Reducing the initial delay allows them to be marked as ready within 10 seconds. In cases it takes longer the next probe will be in 30 seconds so max initial waiting time is 40 seconds to be marked as ready compared to 75 seconds at this point of time. Furhtermore the 30 seconds probes also allow more quick detection of failures

Signed-off-by: Marco Franssen <[email protected]>
 2024-01-26 13:43:28 +01:00
kfox1111 e8d527cd9a Update to spire-controller-manager 0.4.2 (#195) 2024-01-25 12:07:10 +01:00
cccsss01andkfox1111 25558d3410 Update daemonset.yaml (#204) 
Doubt there is a need to provide this as an option.

Signed-off-by: cccsss01 <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2024-01-24 05:02:04 -08:00
Kevin Fox 2df2e1661f Bump spire Helm Chart version from 0.16.0 to 0.17.0 
* 4c307c1 Add missing bundlePublisher section and extraEnv so settings can be set (#201)
* d724d1e Update the documentation (#172)
* e59a29b Bump test chart dependencies (#200)
* 4668151 Add missing extraVolumeMounts to the controllerManager (#196)
* b9ac3c4 Update to spire-controller-manager 0.4.1 (#193)
* 6fec1e5 Update SPIRE to 1.8.7 (#194)
* af155c2 Add support for running spiffe secured discovery provider (default) (#163)
* 3ccdb5e Add tls section to federation bundle endpoint and fix up annotations (#173)
* c7ab131 Add join_token server nodeattestor support (#187)
* 81e9523 Bump test chart dependencies (#186)
* 6d19a76 Fix agent daemonset format (#184)
* b61d4f5 Add spire-agent to spire-agent pod path (#180)
* befa074 Fix notes bug (#178)
* 912c61e Remove deprecated version values (#179)
* ae4ef6e Update HorizontalPodAutoscaler API to autoscaling/v2 (#153)
* e7a61a9 Bump test chart dependencies
* 183e9aa SPIFFE OIDC Discovery Provider Rework (#152)
* 8f1aba8 Bump test chart dependencies (#171)
* 2454b8c Fix links still pointing at older git repo (#167)
* e5c5527 Bump test chart dependencies (#165)
* e630008 Update jwt test to work with newer slim images (#139)
* c39dd44 Add recommendation for namespacePSS (#131)
* 49beb64 Add recommendation for namespaceLayout (#127)
* 33cacd2 Add recommendation for prometheus exporter (#144)
* 6997d6a Add recommendation for securityContext and podSecurityContext (#125)
* 50c4ac3 Add recommendation for strictMode (#143)
* 4fb9d18 Bump test chart dependencies (#155)
* 811123a Update the Tornjak image version (#150)
* 1524537 Update default for additionalDomains not to include localhost (#146)
* e35838c Add recommendation for priorityClass (#124)
* 9f72a8f Use good and automatic defaults for tornjak frontend workingDir (#129)
* 7726351 Tornjak UBI support (#123)
* 89c07e2 Revert openssl 3.2 change (#142)
* a3d3702 Bump test chart dependencies
* 80c7653 Bump test chart dependencies (#134)
* 13f6028 SELinux support (#122)
* 3e8335c Add a flag to enable recommendations (#121)
* 692d463 Remove unneeded lookup function from upgrade hook (#104)
* 8422b8d Added ability to create namespaces (#103)

Signed-off-by: Kevin Fox <[email protected]>
 2024-01-24 12:24:29 +01:00
cccsss01 50d30fd6ef Update statefulset with default container annotation. 
Adding default container annotation to the stateful set

Signed-off-by: cccsss01 <[email protected]>
 2024-01-24 09:30:03 +01:00
kfox1111 4a6c705e6a Update the CRs to enable multiple instance nesting without naming conflicts (#189) 2024-01-24 09:20:18 +01:00
kfox1111andFaisal Memon 4c307c1be1 Add missing bundlePublisher section and extraEnv so settings can be set (#201) 
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-01-23 13:18:49 -08:00
kfox1111andFaisal Memon d724d1e690 Update the documentation (#172) 
* SPIFFE OIDC Discovery Provider Rework

Fixes: https://github.com/spiffe/helm-charts-hardened/issues/151

Signed-off-by: Kevin Fox <[email protected]>

* Enhance clusterspiffeid's so the discovery provider is independently configurable

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Undo

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Try to get output

Signed-off-by: Kevin Fox <[email protected]>

* Try and get error code

Signed-off-by: Kevin Fox <[email protected]>

* Fix more logging. Switch port used.

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Fix port

Signed-off-by: Kevin Fox <[email protected]>

* Fix up logs for nested test and fix values

Signed-off-by: Kevin Fox <[email protected]>

* Make consistent

Signed-off-by: Kevin Fox <[email protected]>

* Fix nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix insecure mode and test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var scoping issue

Signed-off-by: Kevin Fox <[email protected]>

* Set the right flags for ingress

Signed-off-by: Kevin Fox <[email protected]>

* Update dns template

Signed-off-by: Kevin Fox <[email protected]>

* Use more standard port

Signed-off-by: Kevin Fox <[email protected]>

* Fix test logging

Signed-off-by: Kevin Fox <[email protected]>

* Allow reencrypt.

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing changes

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Add LetsEncrypt/ACME/cert-manager support. Remove broken ACME support.

Signed-off-by: Kevin Fox <[email protected]>

* Use spiffe-helper as a sidecar. Significant space savings and read only cert dir

Signed-off-by: Kevin Fox <[email protected]>

* Fix the nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge issue

Signed-off-by: Kevin Fox <[email protected]>

* Remove 1.29.0 until deps catch up.

Related issue: https://github.com/rancher/kubectl/pull/94

Signed-off-by: Kevin Fox <[email protected]>

* Add more error checking

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing code

Signed-off-by: Kevin Fox <[email protected]>

* Simplify the ids. Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix logic

Signed-off-by: Kevin Fox <[email protected]>

* Fix var

Signed-off-by: Kevin Fox <[email protected]>

* Make cert-manager bits more readable

Signed-off-by: Kevin Fox <[email protected]>

* Fix template

Signed-off-by: Kevin Fox <[email protected]>

* Fix openshift ingress

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Add resource spec

Signed-off-by: Kevin Fox <[email protected]>

* Remove parts that cant merge yet

Signed-off-by: Kevin Fox <[email protected]>

* Add support for running spiffe secured discovery provider (default)

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Remove defaults

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Add missing configurable for the discovery providers csi driver

Signed-off-by: Kevin Fox <[email protected]>

* Update the documentation

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Add missing file

Signed-off-by: Kevin Fox <[email protected]>

* Update for changes in spiffe-helper

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-01-23 08:05:49 -08:00
github-actions[bot]andmarcofranssen e59a29b2d4 Bump test chart dependencies (#200) 
Co-authored-by: marcofranssen <[email protected]>
 2024-01-22 10:16:50 +00:00
kfox1111 4668151ff7 Add missing extraVolumeMounts to the controllerManager (#196) 2024-01-22 11:09:10 +01:00
kfox1111 b9ac3c4aec Update to spire-controller-manager 0.4.1 (#193) 
Signed-off-by: Kevin Fox <[email protected]>
 2024-01-19 17:10:41 -08:00
kfox1111 6fec1e598a Update SPIRE to 1.8.7 (#194) 
Signed-off-by: Kevin Fox <[email protected]>
 2024-01-18 21:07:53 -08:00
kfox1111andFaisal Memon af155c2edc Add support for running spiffe secured discovery provider (default) (#163) 
* SPIFFE OIDC Discovery Provider Rework

Fixes: https://github.com/spiffe/helm-charts-hardened/issues/151

Signed-off-by: Kevin Fox <[email protected]>

* Enhance clusterspiffeid's so the discovery provider is independently configurable

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Undo

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Try to get output

Signed-off-by: Kevin Fox <[email protected]>

* Try and get error code

Signed-off-by: Kevin Fox <[email protected]>

* Fix more logging. Switch port used.

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Fix port

Signed-off-by: Kevin Fox <[email protected]>

* Fix up logs for nested test and fix values

Signed-off-by: Kevin Fox <[email protected]>

* Make consistent

Signed-off-by: Kevin Fox <[email protected]>

* Fix nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix insecure mode and test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var scoping issue

Signed-off-by: Kevin Fox <[email protected]>

* Set the right flags for ingress

Signed-off-by: Kevin Fox <[email protected]>

* Update dns template

Signed-off-by: Kevin Fox <[email protected]>

* Use more standard port

Signed-off-by: Kevin Fox <[email protected]>

* Fix test logging

Signed-off-by: Kevin Fox <[email protected]>

* Allow reencrypt.

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing changes

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Add LetsEncrypt/ACME/cert-manager support. Remove broken ACME support.

Signed-off-by: Kevin Fox <[email protected]>

* Use spiffe-helper as a sidecar. Significant space savings and read only cert dir

Signed-off-by: Kevin Fox <[email protected]>

* Fix the nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge issue

Signed-off-by: Kevin Fox <[email protected]>

* Remove 1.29.0 until deps catch up.

Related issue: https://github.com/rancher/kubectl/pull/94

Signed-off-by: Kevin Fox <[email protected]>

* Add more error checking

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing code

Signed-off-by: Kevin Fox <[email protected]>

* Simplify the ids. Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix logic

Signed-off-by: Kevin Fox <[email protected]>

* Fix var

Signed-off-by: Kevin Fox <[email protected]>

* Make cert-manager bits more readable

Signed-off-by: Kevin Fox <[email protected]>

* Fix template

Signed-off-by: Kevin Fox <[email protected]>

* Fix openshift ingress

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Add resource spec

Signed-off-by: Kevin Fox <[email protected]>

* Remove parts that cant merge yet

Signed-off-by: Kevin Fox <[email protected]>

* Add support for running spiffe secured discovery provider (default)

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Remove defaults

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Add missing configurable for the discovery providers csi driver

Signed-off-by: Kevin Fox <[email protected]>

* Update for changes in spiffe-helper

Signed-off-by: Kevin Fox <[email protected]>

* Point at upstream

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2024-01-18 16:08:22 -08:00
kfox1111 3ccdb5e4c1 Add tls section to federation bundle endpoint and fix up annotations (#173) 
* Add cert-manager support to the federation bundle endpoint and fix up bundle endpoint ingress annotations

Signed-off-by: Kevin Fox <[email protected]>

* Add external secret too

Signed-off-by: Kevin Fox <[email protected]>

* Add forgotten files

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
 2024-01-17 00:17:15 -08:00
kfox1111 c7ab1319cc Add join_token server nodeattestor support (#187) 
Signed-off-by: Kevin Fox <[email protected]>
 2024-01-16 14:52:39 -08:00
github-actions[bot]andmarcofranssen 81e9523e03 Bump test chart dependencies (#186) 
Signed-off-by: GitHub <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
 2024-01-15 06:11:02 -08:00
Mariusz Sabath 6d19a76f01 Fix agent daemonset format (#184) 
Signed-off-by: Mariusz Sabath <[email protected]>
 2024-01-12 21:20:10 +00:00
kfox1111 b61d4f5ae1 Add spire-agent to spire-agent pod path (#180) 2024-01-11 10:39:12 +00:00
kfox1111 befa074763 Fix notes bug (#178) 2024-01-11 10:31:02 +00:00
kfox1111 912c61e05c Remove deprecated version values (#179) 2024-01-11 10:29:56 +00:00
Jerome Meyer ae4ef6e992 Update HorizontalPodAutoscaler API to autoscaling/v2 (#153) 2024-01-11 11:19:41 +01:00
marcofranssen e7a61a9ec5 Bump test chart dependencies 
Signed-off-by: GitHub <[email protected]>
 2024-01-08 14:39:46 +01:00
kfox1111andFaisal Memon 183e9aa534 SPIFFE OIDC Discovery Provider Rework (#152) 
Co-authored-by: Faisal Memon <[email protected]>
 2024-01-03 11:40:14 +01:00
github-actions[bot]andmarcofranssen 8f1aba8ad3 Bump test chart dependencies (#171) 
Signed-off-by: GitHub <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
 2024-01-01 06:05:30 -08:00
kfox1111 2454b8cd2a Fix links still pointing at older git repo (#167) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-12-27 17:10:49 -08:00
github-actions[bot]andmarcofranssen e5c5527fd7 Bump test chart dependencies (#165) 
Signed-off-by: GitHub <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
 2023-12-25 14:32:18 -08:00
Drew Wellsandkfox1111 e6300087b7 Update jwt test to work with newer slim images (#139) 
* install newer version of slim debug

  - switch to step tool for jwt verification against jwk public keys

Signed-off-by: Drew Wells <[email protected]>

* use step-cli image

Signed-off-by: Drew Wells <[email protected]>

* Fix image tag and add upgrade logic

Signed-off-by: Kevin Fox <[email protected]>

* use registry for consistency

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Drew Wells <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2023-12-20 19:14:54 -08:00
kfox1111andMarco Franssen c39dd44526 Add recommendation for namespacePSS (#131) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-12-21 00:15:56 +00:00