panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
270 Commits 1 Branch 2 Tags
9afb6f80ac0b215a2de1f7db2bbfe469d491d550
Commit Graph
65 Commits
Author SHA1 Message Date
Marco Franssen 99af475f1c Resolve shellcheck issues 
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-26 16:04:02 +02:00
Marco Franssen d0a1e12825 Add workflow with shellcheck 
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-26 12:02:27 +02:00
Marco Franssen 252f1f5a19 Bump cosign to v2.0.2 
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-26 10:20:20 +02:00
dependabot[bot] 247e3e5d31 Bump sigstore/cosign-installer from 3.0.2 to 3.0.3 
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.0.2 to 3.0.3.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/v3.0.2...v3.0.3)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-04-26 01:03:32 +00:00
kfox1111andMarco Franssen 17d62f1246 Add an action to find new versions of helm charts (#184) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-04-25 10:04:38 +02:00
Marco Franssen 3fc81780d9 Add k8s 1.27 to CI + bump other versions to latest patches (#219) 
- Add k8s 1.27 to test workflow
- Bump other k8s versions to latest patch release

---------

Signed-off-by: Marco Franssen <[email protected]>
 2023-04-17 23:28:28 -07:00
dependabot[bot] 6c21f13264 Bump actions/checkout from 3.5.0 to 3.5.2 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3.5.0 to 3.5.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3.5.0...v3.5.2)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-04-14 08:42:40 +02:00
dependabot[bot]andMarco Franssen b73f694a84 Bump sigstore/cosign-installer from 3.0.1 to 3.0.2 (#204) 
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marco Franssen <[email protected]>
 2023-04-12 10:54:31 +02:00
kfox1111andMarco Franssen 563e1f7920 Add podmonitors (#165) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-04 09:55:35 +02:00
Faisal MemonandMarco Franssen d5dc706592 Add Kubernetes 1.21 back (#188) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-04 09:25:19 +02:00
kfox1111andMarco Franssen daa620bf05 Fix production example test (#183) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-03 19:54:53 +02:00
kfox1111andMarco Franssen ec236e9762 Test for configurable images (#182) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-03 19:50:06 +02:00
kfox1111andMarco Franssen 280315ca68 Fix namespace-override github test summary (#154) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-03 19:37:19 +02:00
Marco Franssen a7709287bf Switch busybox image to cgr.dev/chainguard/busybox:latest-glibc (#175) 2023-04-03 05:33:30 -07:00
kfox1111andMarco Franssen e2ec6ac47d Add a test to ensure the chart versions match (#163) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-03-28 10:21:24 +02:00
dependabot[bot] f709ed9705 Bump actions/checkout from 3.4.0 to 3.5.0 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3.4.0 to 3.5.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3.4.0...v3.5.0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-03-27 09:55:36 +02:00
dependabot[bot] faef4391a6 Bump helm/chart-testing-action from 2.3.1 to 2.4.0 
Bumps [helm/chart-testing-action](https://github.com/helm/chart-testing-action) from 2.3.1 to 2.4.0.
- [Release notes](https://github.com/helm/chart-testing-action/releases)
- [Commits](https://github.com/helm/chart-testing-action/compare/v2.3.1...v2.4.0)

---
updated-dependencies:
- dependency-name: helm/chart-testing-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-03-27 08:53:01 +02:00
kfox1111andMarco Franssen b25dc773bc Test fixing the tests (#148) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-03-22 09:49:33 +01:00
kfox1111 d4fd2ced39 Extract the namespace override test out of the old lockdown test. (#145) 
This patch removes the production bits of the old lockdown test
and establishes the namespace override test as its own test.

---------

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-21 22:13:26 +01:00
Marco Franssen 4f85802ae0 Update lockdown test to test the production example 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-21 21:55:20 +01:00
kfox1111 04a1305556 Fork the lockdown test to two tests as it is doing the work of 2 (#134) 
This patch makes a second copy of the existing lockdown test
because it is doing double duty. In follow on patches we will
make each test do one thing only.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-21 10:14:38 -07:00
Marco Franssen a516caa8a6 Remove k8s 1.21 from test matrix + small syntax error fix (#133) 
- Remove k8s 1.21 from test matrix
- Fix syntax
- Improve readability test step

Officialy according to readme we support last three k8s versions.
Testing last 5 versions should be sufficient.

---------

Signed-off-by: Marco Franssen <[email protected]>
 2023-03-17 14:37:31 -07:00
Pete Cable 811a2f6b01 Add option to enable federation on spire-server (#97) 2023-03-16 20:36:13 +01:00
Kevin FoxandMarco Franssen 6322a9a138 Fix tests 
Signed-off-by: Kevin Fox <[email protected]>

Co-authored-by: Marco Franssen <[email protected]>
 2023-03-16 18:58:31 +01:00
Kevin FoxandMarco Franssen cc7121e021 Add ingress support for OIDC discovery provider 
This patch enables exposing the oidc server out with an ingress
along with tests to ensure it works.

Signed-off-by: Kevin Fox <[email protected]>

Co-authored-by: Marco Franssen <[email protected]>
 2023-03-16 10:02:22 +01:00
dependabot[bot] eaed7c9b60 Bump actions/checkout from 3.3.0 to 3.4.0 (#129) 
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-03-16 09:36:54 +01:00
kfox1111 80e3b58dcd Remove dead file from failed rebase. (#121) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-03-14 13:23:02 -07:00
kfox1111 03db6bb5fe Namespace override 
This patch makes it possible to install the subcharts in different
namespaces as needed.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-13 15:03:16 -07:00
Kevin Fox 09b21acca2 Fix the gate 
Signed-off-by: Kevin Fox <[email protected]>
 2023-03-11 19:21:59 +01:00
kfox1111 b6716aee17 Test that it is possible to lock down security of pods (#84) 2023-03-11 12:11:19 +01:00
Kevin Fox 490fe8f543 Enhance the test workflow scripts 
This makes it so that tests can now:
1. Add additional values files to the test
2. That the post-install.sh script knows if the test passed or failed
   for better output
3. That the main test can be skipped in favor of a test provided one

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-10 08:46:27 +01:00
Kevin Fox 7d1f8217ce Fix test. 
Signed-off-by: Kevin Fox <[email protected]>
 2023-03-09 10:09:50 -08:00
Marco Franssen 493ad8fbed Remove some duplication on chart-testing CI 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-09 10:09:50 -08:00
Marco Franssen dfa4e6c784 Ensure CI also runs when test scripts are changed 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-08 07:21:49 -08:00
kfox1111 d341c5ad58 UpstreamAuthority cert-manager support (#82) 2023-03-03 20:48:35 +01:00
Kevin Fox b7f8c86478 Add extra initContainers, containers, volumes to agent and server 
With plugin support, agents and servers need more customization.
This patch enables initContainers, extraContainers, extraVolumes
and extraVolumeMounts to be added to those services.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-02 08:02:19 -08:00
Marco Franssen 81ac89a911 Add k8s 1.26.0 (Kind) to the test matrix 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-02 13:08:37 +01:00
Marco Franssen c0e5665702 Bump cosign to v2.0.0 
Cosign v2.0.0 doesn't require the experimental env var anymore

Signed-off-by: Marco Franssen <[email protected]>
 2023-03-02 09:15:46 +01:00
dependabot[bot] d729a4410c Bump sigstore/cosign-installer from 2.8.1 to 3.0.1 
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 2.8.1 to 3.0.1.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/v2.8.1...v3.0.1)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-03-02 01:14:59 +00:00
Marco Franssen fea2aa59e2 Fix sigstore/cosign-installer usage in release workflow 
See https://github.com/sigstore/cosign-installer\#usage on proper usage

Resolves #66

Signed-off-by: Marco Franssen <[email protected]>
 2023-03-01 13:52:39 +01:00
dependabot[bot] e754b3a6c8 Bump actions/checkout from 3.2.0 to 3.3.0 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3.2.0 to 3.3.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3.2.0...v3.3.0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-02-27 11:32:19 +01:00
kfox1111andMarco Franssen 35eb3bb42e Basic Prometheus support (#28) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-02-24 22:39:15 +01:00
Marco Franssen a29df4f6cc Change to cut releases from the release branch 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 10:55:00 +01:00
Marco Franssen e8768ec955 Add types to trigger workflow when changing the target branch 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 10:55:00 +01:00
Marco Franssen 3c7d828954 Only check for version bump if PR targets main 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 10:55:00 +01:00
Marco Franssen a95ef9f3db Use github.base_ref for target-branch 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 10:54:57 +01:00
Marco Franssen 5dc93da6b8 Bump to latest Helm and Python versions 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:35:46 +01:00
Marco Franssen d46c3fc14d Test without ACME tos Accepted 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:35:46 +01:00
Marco Franssen 49a68c3aed Add test for spire-oidc 
Using the nginx insecure option, because we can't rely on the ACME
protocol as this server isn't reachable.

Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:33:29 +01:00
Marco Franssen c9779b24ed Add test for upstream-authority-disk 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:33:28 +01:00