panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,057 Commits 1 Branch 2 Tags
97c383b1cbb59d45e489d2b0f703095abb5eeab3
Commit Graph
677 Commits
Author SHA1 Message Date
Oliver Bassettandkfox1111 97c383b1cb Add Configurable Kubelet Address for SPIRE Agent (#709) 
* Add kubeletAddress.mode configuration to spire-agent

Introduces new enum-based configuration for kubelet connection modes:
- auto (default): hostname for OpenShift, localhost otherwise
- localhost: SPIRE default behavior (127.0.0.1:10250)
- hostname: Connect via node hostname
- hostip: Connect via node IP
- custom: User-provided configuration

Deprecates kubeletConnectByHostname but maintains backward compatibility.

Signed-off-by: Oliver Bassett <[email protected]>

* Replace connect-by-hostname helper with mode resolution

Adds three new helpers:
- spire-agent.kubelet-address-mode: Determine mode with backward compat
- spire-agent.kubelet-address-mode-resolved: Resolve auto to actual mode
- spire-agent.should-set-node-name-env: Determine if node_name_env needed

Includes validation of enum values and maintains backward compatibility
by keeping the old connect-by-hostname helper as deprecated.

Signed-off-by: Oliver Bassett <[email protected]>

* Update daemonset to use KUBELET_ADDR env variable

- Sets KUBELET_ADDR from downward API for hostname/hostip modes
- Maintains MY_NODE_NAME for backward compatibility
- No env var set for localhost mode (SPIRE default)
- Custom mode allows user control via extraEnvVars
- Updates init container env to support both hostname and hostip modes

Signed-off-by: Oliver Bassett <[email protected]>

* Update workload attestor config and add validation

- Changes node_name_env from MY_NODE_NAME to KUBELET_ADDR
- Adds validation for kubeletAddress.mode enum
- Prevents using both old and new config simultaneously

Signed-off-by: Oliver Bassett <[email protected]>

* Improve documentation for custom mode

Clarifies that custom mode does not validate KUBELET_ADDR presence,
allowing for external secret injection and other advanced configuration
methods.

Signed-off-by: Oliver Bassett <[email protected]>

* Fix backward compatibility for kubeletConnectByHostname

Two critical fixes for backward compatibility:

1. Helper template priority: Reorder kubelet-address-mode helper to
   prioritize kubeletConnectByHostname when kubeletAddress.mode is
   'auto' or empty. This ensures deprecated config still works.

2. Type-safe validation: Convert kubeletConnectByHostname to string
   in validation and helper to handle both boolean and string types
   consistently. Original chart required string type.

3. Smart dual-config validation: Only fail when both configs are
   explicitly set to non-default values. Allow kubeletConnectByHostname
   with mode='auto' for backward compatibility.

Tested scenarios:
- kubeletConnectByHostname='true' maps to hostname mode
- kubeletConnectByHostname='false' maps to localhost mode
- Both set with mode='auto' allows backward compat to take priority
- Both set with different non-defaults triggers validation error
- OpenShift auto mode correctly resolves to hostname mode

Signed-off-by: Oliver Bassett <[email protected]>

* Use parentheses for DEPRECATED tag in values.yaml

Change [DEPRECATED] to (DEPRECATED) to avoid conflicts with automated
README generator which uses square brackets for special tags.

Signed-off-by: Oliver Bassett <[email protected]>

* Update generated README documentation

Regenerate README.md from values.yaml using documentation generator.
Includes new kubeletAddress.mode configuration and deprecation notice
for kubeletConnectByHostname.

Signed-off-by: Oliver Bassett <[email protected]>

* Remove MY_NODE_NAME environment variable

Remove MY_NODE_NAME as it is not used within the spire-agent chart.
Initially kept for backwards compatibility concerns, but confirmed
unnecessary after review.

The KUBELET_ADDR environment variable is sufficient for the workload
attestor configuration via node_name_env setting.

Addresses PR feedback: https://github.com/spiffe/helm-charts-hardened/pull/709#discussion_r1909855869

Signed-off-by: Oliver Bassett <[email protected]>

* Fix init container for custom kubelet address mode

Address PR #709 feedback by standardizing on KUBELET_ADDR environment
variable and passing extraEnvVars to init containers.

Changes:

1. Init container env variable:
   - Renamed NODE_NAME to KUBELET_ADDR for consistency
   - Made hostip check explicit with 'else if'
   - Passes extraEnvVars to init container for custom mode support

2. Init container script:
   - Updated URL construction to use KUBELET_ADDR for all modes
   - Added validation for custom mode: fails with clear error if
     KUBELET_ADDR is not set via extraEnvVars
   - hostname/hostip modes: Use KUBELET_ADDR from downward API
   - custom mode: Use KUBELET_ADDR from extraEnvVars with validation
   - localhost mode: Use hardcoded 'localhost'

3. Documentation updates:
   - Updated custom mode docs to explain extraEnvVars is passed to
     both main and init containers
   - Noted init container validation behavior
   - Updated extraEnvVars param docs to mention init containers

Testing verified:
- Template rendering for all modes (hostname, hostip, custom, localhost)
- Runtime validation: deployed custom mode without KUBELET_ADDR to kind
  cluster, init container correctly failed with clear error message

Addresses: https://github.com/spiffe/helm-charts-hardened/pull/709#discussion_r1909855869
Signed-off-by: Oliver Bassett <[email protected]>

* Update generated README for init container changes

Regenerate README.md to reflect that extraEnvVars is now passed
to both the main container and init containers.

Signed-off-by: Oliver Bassett <[email protected]>

---------

Signed-off-by: Oliver Bassett <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2026-01-21 16:47:55 -08:00
marcofranssen 8555efc6f9 Bump test chart dependencies 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-01-19 18:38:03 +01:00
marcofranssen e6c9d975e7 Bump test chart dependencies 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-01-12 11:04:24 +01:00
Shubham HibareandMarco Franssen 87da80a89a Add support for AWS KMS key tagging (#721) 
* Add support for AWS KMS key tagging

Signed-off-by: Shubham Hibare <[email protected]>

* fix doc

Signed-off-by: Shubham Hibare <[email protected]>

* Update charts/spire/charts/spire-server/templates/configmap.yaml

Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Shubham Hibare <[email protected]>

---------

Signed-off-by: Shubham Hibare <[email protected]>
Signed-off-by: Shubham Hibare <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2026-01-06 12:43:18 +01:00
spire-helm-version-checker[bot]andmarcofranssen db8f135204 Bump test chart dependencies (#720) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2026-01-05 08:20:43 +00:00
marcofranssen b1f902b670 Bump test chart dependencies 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2025-12-29 10:25:43 +01:00
marcofranssen 198cdb6075 Bump test chart dependencies 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2025-12-22 18:01:42 +01:00
Oliver Bassettandkfox1111 dfbbecf077 Add guard to the validating admission policy to stop errors when there are no volumes in the spec. This fixes errors with HTTP solver pods in cert manager. (#706) 
Signed-off-by: Oliver Bassett <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2025-12-18 14:47:45 -08:00
Pratik Lotia 1e1e8daa69 Add support for attested node pruning configuration (#713) 
Expose SPIRE server's prune_attested_nodes_expired_for and prune_tofu_nodes
configuration through new Helm values: pruneAttestedNodesExpiredFor and
pruneTOFUNodes.

This prevents database bloat from expired attested nodes in long-running
deployments with node churn.

Signed-off-by: pratik-lotia <[email protected]>
 2025-12-18 14:23:30 -08:00
spire-helm-version-checker[bot]andmarcofranssen a2130ff72e Bump test chart dependencies (#712) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2025-12-15 10:10:05 +01:00
marcofranssen adc5f3e8c3 Bump test chart dependencies 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2025-12-08 09:26:17 +01:00
marcofranssen 4e0cdb1306 Bump test chart dependencies 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2025-12-01 10:56:08 +01:00
Matthew McKeen 95fa0deb5f Allow configuring spire-agent prometheus listening address (#701) 2025-11-27 22:36:56 -07:00
Faisal Memon 4b85cb6015 Bump spire Helm Chart version from 0.27.0 to 0.27.1 
* 18b81443 Bump test chart dependencies (#698)
* 31091cf5 Add oidc server_path_prefix option (#695)
* 8dffc8ed use spire-agent.hostCert.resources to set resources for corresponding spire-agent init container (#691)
* e75e095e Bump test chart dependencies (#696)
* aab7c68d Bump test chart dependencies (#692)
* ca6e9f34 Bump test chart dependencies
* a3739244 Bump test chart dependencies
* c52edb99 chore: update SPIRE to 1.13.2 (#681)
* 41bd5b95 fix socketAlternate names throwing an error if set to an empty list (#678)
* 54024730 Bump test chart dependencies (#684)
* 89259757 Bump test chart dependencies (#674)
* 0f5bb04a Bump test chart dependencies (#672)

Signed-off-by: Faisal Memon <[email protected]>
 2025-11-25 10:53:21 -07:00
spire-helm-version-checker[bot]andmarcofranssen 18b8144303 Bump test chart dependencies (#698) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2025-11-24 15:58:43 +01:00
kfox1111andFaisal Memon 31091cf5b1 Add oidc server_path_prefix option (#695) 
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2025-11-23 21:28:44 +00:00
Daniel Schlatter 8dffc8eda1 use spire-agent.hostCert.resources to set resources for corresponding spire-agent init container (#691) 
* use spire-agent.resources to set resources for associated initContainers, remove specific keys for those initContainers corresponding resources

Signed-off-by: Daniel Schlatter <[email protected]>

* set resources for spire-agent init containers fingerprint-tpm and init-tpm-direct

Signed-off-by: Daniel Schlatter <[email protected]>

* use spiffe-csi-driver.resources to set resources for associated initContainers, remove specific keys for those initContainers corresponding resources

Signed-off-by: Daniel Schlatter <[email protected]>

* set resources for spiffe-csi-driver init container set-context

Signed-off-by: Daniel Schlatter <[email protected]>

---------

Signed-off-by: Daniel Schlatter <[email protected]>
 2025-11-20 21:47:59 -08:00
spire-helm-version-checker[bot]andmarcofranssen e75e095e1e Bump test chart dependencies (#696) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2025-11-18 17:21:32 -08:00
spire-helm-version-checker[bot]andmarcofranssen aab7c68d02 Bump test chart dependencies (#692) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2025-11-10 09:45:37 +01:00
marcofranssen ca6e9f342d Bump test chart dependencies 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2025-11-03 12:34:59 +01:00
marcofranssen a373924405 Bump test chart dependencies 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2025-10-27 12:08:37 +01:00
Monfortonandkfox1111 c52edb9928 chore: update SPIRE to 1.13.2 (#681) 
Signed-off-by: Monforton <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2025-10-13 10:59:13 -07:00
Daniel Schlatterandkfox1111 41bd5b9598 fix socketAlternate names throwing an error if set to an empty list (#678) 
Signed-off-by: Daniel Schlatter <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2025-10-13 10:11:53 -07:00
spire-helm-version-checker[bot]andmarcofranssen 54024730d0 Bump test chart dependencies (#684) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2025-10-13 09:49:17 -07:00
spire-helm-version-checker[bot]marcofranssenKevin Fox
 		892597576f Bump test chart dependencies (#674) 
* Bump test chart dependencies

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* Fix bitnami chart support

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: Kevin Fox <[email protected]>
 2025-10-08 08:04:48 -07:00
spire-helm-version-checker[bot]andmarcofranssen 0f5bb04a6d Bump test chart dependencies (#672) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2025-09-29 06:13:36 -07:00
Faisal Memon 4da35fabeb Bump spire Helm Chart version from 0.26.1 to 0.27.0 (#670) 
* e73d76a0 Bump test chart dependencies (#669)
* 1ab06a1b Support for Cloud SQL Proxy in GCP (#646)
* 3c3718c9 Update spire to 1.13.0 (#667)
* 1feeca1c make spire server's auth_opa_policy_engine configurable in the helm chart (#663)
* d51bf52a Bump test chart dependencies (#666)
* c1b0cfe3 Add controller manager configs gcInterval, logLevel, and make entryIDPrefix configurable (#662)
* bb876121 Spire agent helm chart: allow configuring logFormat (#661)
* d6edae68 Add labels to the spiffe-oidc-discovery-provider values.yaml (#656)
* 6376190b Bump test chart dependencies (#660)
* 9a802563 Bump test chart dependencies (#658)
* 5e5810be Bump test chart dependencies (#653)
* 86feac63 Bump test chart dependencies (#647)
* 5e40cfb2 Update imagePullPolicy to IfNotPresent (#643)
* 86f0aecc Bump test chart dependencies (#641)
* 3ef5fe6c Add Datadog as telemetry option (#639)

Signed-off-by: Faisal Memon <[email protected]>
 2025-09-24 07:08:26 -07:00
spire-helm-version-checker[bot]marcofranssenFaisal Memon
 		e73d76a039 Bump test chart dependencies (#669) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2025-09-23 06:17:20 +00:00
Hamdan Al-Radaidehdependabot[bot]kfox1111marcofranssenspire-helm-version-checker[bot]tuxotronNikolaiDaniel Schlatter
 		1ab06a1b11 Support for Cloud SQL Proxy in GCP (#646) 
* allow IAM auth for non-password methods

Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* add example, patch charts' versions and values

Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* updates

Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* Bump test chart dependencies (#647)

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* Bump github.com/onsi/ginkgo/v2 from 2.23.4 to 2.24.0 in /tests (#648)

Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.23.4 to 2.24.0.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.23.4...v2.24.0)

---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-version: 2.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* Bump helm.sh/helm/v3 from 3.18.4 to 3.18.6 in /tests (#650)

Bumps [helm.sh/helm/v3](https://github.com/helm/helm) from 3.18.4 to 3.18.6.
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](https://github.com/helm/helm/compare/v3.18.4...v3.18.6)

---
updated-dependencies:
- dependency-name: helm.sh/helm/v3
  dependency-version: 3.18.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* Bump github.com/onsi/ginkgo/v2 from 2.24.0 to 2.25.1 in /tests (#651)

Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.24.0 to 2.25.1.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.24.0...v2.25.1)

---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-version: 2.25.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* Bump test chart dependencies (#653)

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* Bump github.com/onsi/gomega from 1.38.0 to 1.38.1 in /tests (#652)

Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.38.0 to 1.38.1.
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/gomega/compare/v1.38.0...v1.38.1)

---
updated-dependencies:
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.38.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* Bump github.com/onsi/gomega from 1.38.1 to 1.38.2 in /tests (#654)

Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.38.1 to 1.38.2.
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/gomega/compare/v1.38.1...v1.38.2)

---
updated-dependencies:
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* Bump test chart dependencies (#658)

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* Bump github.com/onsi/ginkgo/v2 from 2.25.1 to 2.25.3 in /tests (#659)

Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.25.1 to 2.25.3.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.25.1...v2.25.3)

---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-version: 2.25.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* Bump test chart dependencies (#660)

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* Add labels to the spiffe-oidc-discovery-provider values.yaml (#656)

* add labels to the spiffe-oidc-discovery-provider values.yaml

Signed-off-by: tuxotron <[email protected]>

* add labels to readme

Signed-off-by: tuxotron <[email protected]>

* Bump github.com/onsi/gomega from 1.38.1 to 1.38.2 in /tests (#654)

Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.38.1 to 1.38.2.
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/gomega/compare/v1.38.1...v1.38.2)

---
updated-dependencies:
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: tuxotron <[email protected]>

* Bump test chart dependencies (#658)

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
Signed-off-by: tuxotron <[email protected]>

---------

Signed-off-by: tuxotron <[email protected]>
Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: spire-helm-version-checker[bot] <161522935+spire-helm-version-checker[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* Bump helm.sh/helm/v3 from 3.18.6 to 3.19.0 in /tests (#664)

Bumps [helm.sh/helm/v3](https://github.com/helm/helm) from 3.18.6 to 3.19.0.
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](https://github.com/helm/helm/compare/v3.18.6...v3.19.0)

---
updated-dependencies:
- dependency-name: helm.sh/helm/v3
  dependency-version: 3.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* blend into same logic in the chart for the new auth method, add the ability to add loadbalancer ip

Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* remove whitespaces

Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* update README and values file

Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* Spire agent helm chart: allow configuring logFormat (#661)

* Spire agent helm chart: allow configuring logFormat

Signed-off-by: Nikolai Tihhomirov <[email protected]>

* Fixup: wrong doc parameter

Signed-off-by: Nikolai Tihhomirov <[email protected]>

---------

Signed-off-by: Nikolai Tihhomirov <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* Add controller manager configs gcInterval, logLevel, and make entryIDPrefix configurable (#662)

* Make controller manager gcInterval configurable in spire-server helm chart

Signed-off-by: Daniel Schlatter <[email protected]>

* Make controller manager logLevel configurable in spire-server helm chart

Signed-off-by: Daniel Schlatter <[email protected]>

* Make controller manager entryIDPrefix configurable in spire-server helm chart

Signed-off-by: Daniel Schlatter <[email protected]>

* change configurable entryIDPrefix to a binary option of add the cluster name or not

Signed-off-by: Daniel Schlatter <[email protected]>

---------

Signed-off-by: Daniel Schlatter <[email protected]>
Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* Bump test chart dependencies (#666)

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* make spire server's auth_opa_policy_engine configurable in the helm chart (#663)

Signed-off-by: Hamdan Al-Radaideh <[email protected]>

* Update spire to 1.13.0 (#667)

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: Hamdan Al-Radaideh <[email protected]>

---------

Signed-off-by: Hamdan Al-Radaideh <[email protected]>
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: tuxotron <[email protected]>
Signed-off-by: Nikolai Tihhomirov <[email protected]>
Signed-off-by: Daniel Schlatter <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: spire-helm-version-checker[bot] <161522935+spire-helm-version-checker[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: tuxotron <[email protected]>
Co-authored-by: Nikolai <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
Co-authored-by: Daniel Schlatter <[email protected]>
 2025-09-23 02:46:18 +00:00
kfox1111 3c3718c904 Update spire to 1.13.0 (#667) 
Signed-off-by: Kevin Fox <[email protected]>
 2025-09-16 22:13:29 -07:00
Daniel Schlatter 1feeca1ce1 make spire server's auth_opa_policy_engine configurable in the helm chart (#663) 2025-09-16 16:58:37 -07:00
spire-helm-version-checker[bot]andmarcofranssen d51bf52a91 Bump test chart dependencies (#666) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2025-09-15 23:09:42 -07:00
Daniel Schlatter c1b0cfe390 Add controller manager configs gcInterval, logLevel, and make entryIDPrefix configurable (#662) 
* Make controller manager gcInterval configurable in spire-server helm chart

Signed-off-by: Daniel Schlatter <[email protected]>

* Make controller manager logLevel configurable in spire-server helm chart

Signed-off-by: Daniel Schlatter <[email protected]>

* Make controller manager entryIDPrefix configurable in spire-server helm chart

Signed-off-by: Daniel Schlatter <[email protected]>

* change configurable entryIDPrefix to a binary option of add the cluster name or not

Signed-off-by: Daniel Schlatter <[email protected]>

---------

Signed-off-by: Daniel Schlatter <[email protected]>
 2025-09-14 06:14:43 -07:00
Nikolaiandkfox1111 bb87612140 Spire agent helm chart: allow configuring logFormat (#661) 
* Spire agent helm chart: allow configuring logFormat

Signed-off-by: Nikolai Tihhomirov <[email protected]>

* Fixup: wrong doc parameter

Signed-off-by: Nikolai Tihhomirov <[email protected]>

---------

Signed-off-by: Nikolai Tihhomirov <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2025-09-13 11:44:17 -07:00
tuxotrondependabot[bot]marcofranssenspire-helm-version-checker[bot]
 		d6edae682b Add labels to the spiffe-oidc-discovery-provider values.yaml (#656) 
* add labels to the spiffe-oidc-discovery-provider values.yaml

Signed-off-by: tuxotron <[email protected]>

* add labels to readme

Signed-off-by: tuxotron <[email protected]>

* Bump github.com/onsi/gomega from 1.38.1 to 1.38.2 in /tests (#654)

Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.38.1 to 1.38.2.
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/gomega/compare/v1.38.1...v1.38.2)

---
updated-dependencies:
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: tuxotron <[email protected]>

* Bump test chart dependencies (#658)

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
Signed-off-by: tuxotron <[email protected]>

---------

Signed-off-by: tuxotron <[email protected]>
Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: spire-helm-version-checker[bot] <161522935+spire-helm-version-checker[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2025-09-10 06:36:03 -07:00
spire-helm-version-checker[bot]andmarcofranssen 6376190b0b Bump test chart dependencies (#660) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2025-09-08 06:39:44 -07:00
spire-helm-version-checker[bot]andmarcofranssen 9a802563e3 Bump test chart dependencies (#658) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2025-09-01 15:19:43 -07:00
spire-helm-version-checker[bot]andmarcofranssen 5e5810be1f Bump test chart dependencies (#653) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2025-08-25 06:56:02 -07:00
spire-helm-version-checker[bot]andmarcofranssen 86feac63d4 Bump test chart dependencies (#647) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2025-08-18 07:43:20 -07:00
Eric Cavalcanti 5e40cfb222 Update imagePullPolicy to IfNotPresent (#643) 
* Change selinux image pullpolicy and tag version

Signed-off-by: Eric Cavalcanti <[email protected]>

* Change image pullpolicy

Signed-off-by: Eric Cavalcanti <[email protected]>

* Update readme

Signed-off-by: Eric Cavalcanti <[email protected]>

* update examples

Signed-off-by: Eric Cavalcanti <[email protected]>

* Update image pullpolicy

Signed-off-by: Eric Cavalcanti <[email protected]>

* Fix readme as well

Signed-off-by: Eric Cavalcanti <[email protected]>

* Undo pullpolicy readme

Signed-off-by: Eric Cavalcanti <[email protected]>

* Add selinux

Signed-off-by: Eric Cavalcanti <[email protected]>

* Revert code block

Signed-off-by: Eric Cavalcanti <[email protected]>

* Change regex

Signed-off-by: Eric Cavalcanti <[email protected]>

---------

Signed-off-by: Eric Cavalcanti <[email protected]>
 2025-08-11 06:19:27 -07:00
spire-helm-version-checker[bot]marcofranssenkfox1111
 		86f0aecc57 Bump test chart dependencies (#641) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2025-08-07 07:27:41 -07:00
Eric Cavalcantiandkfox1111 3ef5fe6c49 Add Datadog as telemetry option (#639) 
* Add Datadog as telemetry option

Signed-off-by: Eric Cavalcanti <[email protected]>

* Use correct local domain

Signed-off-by: Eric Cavalcanti <[email protected]>

* Change doc

Signed-off-by: Eric Cavalcanti <[email protected]>

* Add docs

Signed-off-by: Eric Cavalcanti <[email protected]>

* remove .cluster.local

Signed-off-by: Eric Cavalcanti <[email protected]>

* Remove cluster.local

Signed-off-by: Eric Cavalcanti <[email protected]>

* Fix doc

Signed-off-by: Eric Cavalcanti <[email protected]>

---------

Signed-off-by: Eric Cavalcanti <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2025-08-07 07:03:15 -07:00
Faisal Memon acfcc9d0a4 Bump spire Helm Chart version from 0.26.0 to 0.26.1 (#636) 
* 64b9c40 Bump test chart dependencies (#635)
* d516de0 Update spike to 0.4.2 (#632)
* 8904b96 Bump test chart dependencies (#633)
* 6581b11 Add disk based KeyManager (#627)
* d2913ff Remove region from awsiid node attestor (#630)
* 3218db7 Bump test chart dependencies (#628)
* 57a6143 Add aws_iid to helm chart (#620)
* 9a8e5a8 Add Agent TTL to Spire Server (#626)
* 093c593 spire-server: Replace chown image with busybox
* a7d536c tools: Replace rancher/kubectl with registry.k8s.io/kubectl
* fc1791f Bump test chart dependencies (#618)

Signed-off-by: Faisal Memon <[email protected]>
 2025-07-28 12:30:10 -07:00
spire-helm-version-checker[bot]andmarcofranssen 64b9c400cc Bump test chart dependencies (#635) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2025-07-28 07:19:58 -07:00
kfox1111 d516de01bd Update spike to 0.4.2 (#632) 
Signed-off-by: Kevin Fox <[email protected]>
 2025-07-22 11:21:11 +00:00
spire-helm-version-checker[bot]andmarcofranssen 8904b96be8 Bump test chart dependencies (#633) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2025-07-21 08:18:22 -07:00
Eric Cavalcantiandkfox1111 6581b117a0 Add disk based KeyManager (#627) 
* Add disk based KeyManager

Signed-off-by: Eric Cavalcanti <[email protected]>
Signed-off-by: Eric Cavalcanti <[email protected]>

* Change disk to false

Signed-off-by: Eric Cavalcanti <[email protected]>
Signed-off-by: Eric Cavalcanti <[email protected]>

* Change disk to false

Signed-off-by: Eric Cavalcanti <[email protected]>
Signed-off-by: Eric Cavalcanti <[email protected]>

* Fix per requirement

Signed-off-by: Eric Cavalcanti <[email protected]>

* Update information

Signed-off-by: Eric Cavalcanti <[email protected]>

* Detail doc

Signed-off-by: Eric Cavalcanti <[email protected]>

* Test change comment

Signed-off-by: Eric Cavalcanti <[email protected]>

* Commnet better before

Signed-off-by: Eric Cavalcanti <[email protected]>

---------

Signed-off-by: Eric Cavalcanti <[email protected]>
Signed-off-by: Eric Cavalcanti <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2025-07-19 18:06:02 -07:00
Eric Cavalcanti d2913ffca0 Remove region from awsiid node attestor (#630) 
* Remove spire-server.nodeAttestor.awsIID.region

Signed-off-by: Eric Cavalcanti <[email protected]>

* Remove spire-server.nodeAttestor.awsIID.region

Signed-off-by: Eric Cavalcanti <[email protected]>

* Remove spire-server.nodeAttestor.awsIID.region

Signed-off-by: Eric Cavalcanti <[email protected]>

* Update README.md

Signed-off-by: Eric Cavalcanti <[email protected]>

---------

Signed-off-by: Eric Cavalcanti <[email protected]>
 2025-07-15 16:23:18 -07:00
spire-helm-version-checker[bot]andmarcofranssen 3218db7bbb Bump test chart dependencies (#628) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
 2025-07-14 09:36:36 -07:00
Eric Cavalcanti 57a61438be Add aws_iid to helm chart (#620) 
* Add aws_iid

Signed-off-by: Eric Cavalcanti <[email protected]>

* Change to awsIid

Signed-off-by: Eric Cavalcanti <[email protected]>

* Change to awsIid

Signed-off-by: Eric Cavalcanti <[email protected]>

* update helm

Signed-off-by: Eric Cavalcanti <[email protected]>

* Change to awsIID

Signed-off-by: Eric Cavalcanti <[email protected]>
Signed-off-by: Eric Cavalcanti <[email protected]>

* Change to awsIID

Signed-off-by: Eric Cavalcanti <[email protected]>
Signed-off-by: Eric Cavalcanti <[email protected]>

* Change to awsIID

Signed-off-by: Eric Cavalcanti <[email protected]>
Signed-off-by: Eric Cavalcanti <[email protected]>

* Change to awsIID

Signed-off-by: Eric Cavalcanti <[email protected]>
Signed-off-by: Eric Cavalcanti <[email protected]>

* Change to awsIID

Signed-off-by: Eric Cavalcanti <[email protected]>
Signed-off-by: Eric Cavalcanti <[email protected]>

* Change to awsIID

Signed-off-by: Eric Cavalcanti <[email protected]>
Signed-off-by: Eric Cavalcanti <[email protected]>

* add signed off

Signed-off-by: Eric Cavalcanti <[email protected]>

* Add doc

Signed-off-by: Eric Cavalcanti <[email protected]>

* remove not used config

Signed-off-by: Eric Cavalcanti <[email protected]>

* remove not used config

Signed-off-by: Eric Cavalcanti <[email protected]>

* add example awsiid

Signed-off-by: Eric Cavalcanti <[email protected]>

---------

Signed-off-by: Eric Cavalcanti <[email protected]>
Signed-off-by: Eric Cavalcanti <[email protected]>
 2025-07-10 22:27:07 +00:00