* Broker updates
Signed-off-by: Kevin Fox <[email protected]>
* Fix broker permission when running as nonroot
Signed-off-by: Kevin Fox <[email protected]>
* Fix broker permission when running as nonroot
Signed-off-by: Kevin Fox <[email protected]>
* Add workload attestor config
Signed-off-by: Kevin Fox <[email protected]>
* Add workload attestor config
Signed-off-by: Kevin Fox <[email protected]>
* Bump versions
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
* SPIRE Agent support for Broker API
Signed-off-by: Kevin Fox <[email protected]>
* SPIRE Agent support for Broker API
Signed-off-by: Kevin Fox <[email protected]>
* SPIRE Agent support for Broker API
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-agent/templates/configmap.yaml
Co-authored-by: Matheus Pimenta <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
* Remove the istio entry
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Matheus Pimenta <[email protected]>
* Enable easy plugin loading
customPluings have to be loaded into the main container somehow. Extend
the existing cel plugin loader to allow users to easily specify an image
to load it from.
Signed-off-by: Kevin Fox <[email protected]>
* Add some missing bits
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Fix formatting
Signed-off-by: Kevin Fox <[email protected]>
* Fix formatting
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
* Add kubeletAddress.mode configuration to spire-agent
Introduces new enum-based configuration for kubelet connection modes:
- auto (default): hostname for OpenShift, localhost otherwise
- localhost: SPIRE default behavior (127.0.0.1:10250)
- hostname: Connect via node hostname
- hostip: Connect via node IP
- custom: User-provided configuration
Deprecates kubeletConnectByHostname but maintains backward compatibility.
Signed-off-by: Oliver Bassett <[email protected]>
* Replace connect-by-hostname helper with mode resolution
Adds three new helpers:
- spire-agent.kubelet-address-mode: Determine mode with backward compat
- spire-agent.kubelet-address-mode-resolved: Resolve auto to actual mode
- spire-agent.should-set-node-name-env: Determine if node_name_env needed
Includes validation of enum values and maintains backward compatibility
by keeping the old connect-by-hostname helper as deprecated.
Signed-off-by: Oliver Bassett <[email protected]>
* Update daemonset to use KUBELET_ADDR env variable
- Sets KUBELET_ADDR from downward API for hostname/hostip modes
- Maintains MY_NODE_NAME for backward compatibility
- No env var set for localhost mode (SPIRE default)
- Custom mode allows user control via extraEnvVars
- Updates init container env to support both hostname and hostip modes
Signed-off-by: Oliver Bassett <[email protected]>
* Update workload attestor config and add validation
- Changes node_name_env from MY_NODE_NAME to KUBELET_ADDR
- Adds validation for kubeletAddress.mode enum
- Prevents using both old and new config simultaneously
Signed-off-by: Oliver Bassett <[email protected]>
* Improve documentation for custom mode
Clarifies that custom mode does not validate KUBELET_ADDR presence,
allowing for external secret injection and other advanced configuration
methods.
Signed-off-by: Oliver Bassett <[email protected]>
* Fix backward compatibility for kubeletConnectByHostname
Two critical fixes for backward compatibility:
1. Helper template priority: Reorder kubelet-address-mode helper to
prioritize kubeletConnectByHostname when kubeletAddress.mode is
'auto' or empty. This ensures deprecated config still works.
2. Type-safe validation: Convert kubeletConnectByHostname to string
in validation and helper to handle both boolean and string types
consistently. Original chart required string type.
3. Smart dual-config validation: Only fail when both configs are
explicitly set to non-default values. Allow kubeletConnectByHostname
with mode='auto' for backward compatibility.
Tested scenarios:
- kubeletConnectByHostname='true' maps to hostname mode
- kubeletConnectByHostname='false' maps to localhost mode
- Both set with mode='auto' allows backward compat to take priority
- Both set with different non-defaults triggers validation error
- OpenShift auto mode correctly resolves to hostname mode
Signed-off-by: Oliver Bassett <[email protected]>
* Use parentheses for DEPRECATED tag in values.yaml
Change [DEPRECATED] to (DEPRECATED) to avoid conflicts with automated
README generator which uses square brackets for special tags.
Signed-off-by: Oliver Bassett <[email protected]>
* Update generated README documentation
Regenerate README.md from values.yaml using documentation generator.
Includes new kubeletAddress.mode configuration and deprecation notice
for kubeletConnectByHostname.
Signed-off-by: Oliver Bassett <[email protected]>
* Remove MY_NODE_NAME environment variable
Remove MY_NODE_NAME as it is not used within the spire-agent chart.
Initially kept for backwards compatibility concerns, but confirmed
unnecessary after review.
The KUBELET_ADDR environment variable is sufficient for the workload
attestor configuration via node_name_env setting.
Addresses PR feedback: https://github.com/spiffe/helm-charts-hardened/pull/709#discussion_r1909855869
Signed-off-by: Oliver Bassett <[email protected]>
* Fix init container for custom kubelet address mode
Address PR #709 feedback by standardizing on KUBELET_ADDR environment
variable and passing extraEnvVars to init containers.
Changes:
1. Init container env variable:
- Renamed NODE_NAME to KUBELET_ADDR for consistency
- Made hostip check explicit with 'else if'
- Passes extraEnvVars to init container for custom mode support
2. Init container script:
- Updated URL construction to use KUBELET_ADDR for all modes
- Added validation for custom mode: fails with clear error if
KUBELET_ADDR is not set via extraEnvVars
- hostname/hostip modes: Use KUBELET_ADDR from downward API
- custom mode: Use KUBELET_ADDR from extraEnvVars with validation
- localhost mode: Use hardcoded 'localhost'
3. Documentation updates:
- Updated custom mode docs to explain extraEnvVars is passed to
both main and init containers
- Noted init container validation behavior
- Updated extraEnvVars param docs to mention init containers
Testing verified:
- Template rendering for all modes (hostname, hostip, custom, localhost)
- Runtime validation: deployed custom mode without KUBELET_ADDR to kind
cluster, init container correctly failed with clear error message
Addresses: https://github.com/spiffe/helm-charts-hardened/pull/709#discussion_r1909855869
Signed-off-by: Oliver Bassett <[email protected]>
* Update generated README for init container changes
Regenerate README.md to reflect that extraEnvVars is now passed
to both the main container and init containers.
Signed-off-by: Oliver Bassett <[email protected]>
---------
Signed-off-by: Oliver Bassett <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
* Update for 1.12.3
Signed-off-by: Kevin Fox <[email protected]>
* Fix typo. Use test image
Signed-off-by: Kevin Fox <[email protected]>
* Fix lint
Signed-off-by: Kevin Fox <[email protected]>
* Fix format flag. Update config location for k8s configmap bp
Signed-off-by: Kevin Fox <[email protected]>
* Fix role
Signed-off-by: Kevin Fox <[email protected]>
* Update rbac
Signed-off-by: Kevin Fox <[email protected]>
* Fix key
Signed-off-by: Kevin Fox <[email protected]>
* Fix format
Signed-off-by: Kevin Fox <[email protected]>
* Fix the bundle format for the fetchca bits
Signed-off-by: Kevin Fox <[email protected]>
* Update key
Signed-off-by: Kevin Fox <[email protected]>
* Fix test rather then reconfigure
Signed-off-by: Kevin Fox <[email protected]>
* Add namespace
Signed-off-by: Kevin Fox <[email protected]>
* Update to follow the new patch
Signed-off-by: Kevin Fox <[email protected]>
* Fix formatting
Signed-off-by: Kevin Fox <[email protected]>
* Fix formatting
Signed-off-by: Kevin Fox <[email protected]>
* Update filename based on format
Signed-off-by: Kevin Fox <[email protected]>
* Add upgrade notes
Signed-off-by: Kevin Fox <[email protected]>
* Switch to testing nightly. Dont manage bundle configmap.
Signed-off-by: Kevin Fox <[email protected]>
* Update permissions
Signed-off-by: Kevin Fox <[email protected]>
* Update permissions
Signed-off-by: Kevin Fox <[email protected]>
* Update permissions
Signed-off-by: Kevin Fox <[email protected]>
* Update for final release
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
* Add a spire-agent auto kubelet verification mode
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
* Update to SPIRE 1.10.0
Remove the options that were removed in 1.10, and update.
Signed-off-by: Kevin Fox <[email protected]>
* Update docs
Signed-off-by: Kevin Fox <[email protected]>
* Fix uid mismatch issue on 1.10.0+
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
When setting the kubeletConnectByHostname to "true", the charts update the agent daemonset to define the MY_NODE_NAME environment variable, but it doesn't set the "node_name_env" setting in the WorkloadAttestor:k8s plugin, therefore the agent continues trying to connect to the kubelet using the localhost interface
Signed-off-by: tuxotron <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
* Add direct tpm support for spire-agent
Signed-off-by: Kevin Fox <[email protected]>
* Add fingerprinting support
Signed-off-by: Kevin Fox <[email protected]>
* Add example
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-agent/templates/configmap.yaml
Signed-off-by: kfox1111 <[email protected]>
* Support hybrid nodes with different attestors
In some clusters, you may have a mix of nodes with differing attestor
needs. For example, some nodes have hardware TPMs and some without.
This patch enables configuring multiple daemonsets for the agent
that you can target to pools of nodes.
Signed-off-by: Kevin Fox <[email protected]>
* Remove extra slash
Signed-off-by: Kevin Fox <[email protected]>
* Update docs
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-agent/templates/configmap.yaml
Signed-off-by: kfox1111 <[email protected]>
* Fix broken tests
Signed-off-by: Kevin Fox <[email protected]>
* Add daemonset labels
Signed-off-by: Kevin Fox <[email protected]>
* Add temporary upgrade hook
Signed-off-by: Kevin Fox <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Fix include
Signed-off-by: Kevin Fox <[email protected]>
* Add missing values
Signed-off-by: Kevin Fox <[email protected]>
* Fix perms, add upgrade note
Signed-off-by: Kevin Fox <[email protected]>
* Fix hardcoded nodeAttestor and keyManager in spire-agent
Fixes: https://github.com/spiffe/helm-charts-hardened/issues/220
Signed-off-by: Kevin Fox <[email protected]>
* Fix merge issues
Signed-off-by: Kevin Fox <[email protected]>
* Fix unit tests
Signed-off-by: Kevin Fox <[email protected]>
* Pass the agent's securityContext on to Kubernetes
Currently its ignored.
Signed-off-by: Kevin Fox <[email protected]>
* Update example to be usable
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Signed-off-by: kfox1111 <[email protected]>
* Update example
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Fix merge conflict issue
Signed-off-by: Kevin Fox <[email protected]>
* Update to the newest release
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Signed-off-by: kfox1111 <[email protected]>
* Apply suggestions from code review
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix version numbers in docs
Signed-off-by: Kevin Fox <[email protected]>
* Remove merge conflicted extra code
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* Add alternate name support for the socket
Signed-off-by: Kevin Fox <[email protected]>
* Fix missing image reference
Signed-off-by: Kevin Fox <[email protected]>
* Make user changing socket work smoothly.
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Signed-off-by: kfox1111 <[email protected]>
* Update charts/spire/charts/spire-agent/values.yaml
Signed-off-by: kfox1111 <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* Exit code from diff indicating changes should not block commit.
Signed-off-by: Kevin Fox <[email protected]>
* Push the changes that update-tags creates
Signed-off-by: Kevin Fox <[email protected]>
* Add plugin support to the spire agent
This adapts the existing spire server plugin support to be usable by
the agent as well.
Signed-off-by: Kevin Fox <[email protected]>
* Fix notes
Signed-off-by: Kevin Fox <[email protected]>
* Add plugin support to the spire agent
This adapts the existing spire server plugin support to be usable by
the agent as well.
Signed-off-by: Kevin Fox <[email protected]>
* Fix notes
Signed-off-by: Kevin Fox <[email protected]>
* Update documentation
Signed-off-by: Kevin Fox <[email protected]>
* Update example
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Without an annotation, spinnaker will rename the configmap.
---------
Signed-off-by: Faisal Memon <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
This patch adds the start of a library to help reduce code duplication.
It will be split out to its own library chart at the same time the other
charts are split out.
---------
Signed-off-by: Kevin Fox <[email protected]>
Because we are already in the context of spire-agent the API looks more
logical to not have another 'agent' part in the name.
Furthermore to make it more clear the oidc provider only requires the
name of the socket as opposed to the entire path like in the other
charts I made that more explicit in the name of the value.
---------
Signed-off-by: Marco Franssen <[email protected]>
kfox1111