panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
174 Commits 1 Branch 2 Tags
a00c97ba875164dda6596d85570eb9fd5e4992c1
Commit Graph
15 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Kevin Fox a00c97ba87 Incorperate feedback 
Signed-off-by: Kevin Fox <[email protected]>
 2023-03-06 06:53:29 -08:00
Kevin Fox f93434a926 Make server service account allow list configurable 
If you don't have the agent and server in the same namespace or the same
cluster, or want to bind additional clusters, you need the ability to
configure the service account allow list.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-06 06:53:29 -08:00
Kevin Fox f0b7f5bd8d Make spire agent server address configurable 
If your server is not in the same namespace or cluster as the
agent, you need a config option to specify where it is.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-06 06:40:58 -08:00
kfox1111 cb627f04b2 Allow all subchart to conditionally disable (#90) 2023-03-04 16:09:36 +01:00
kfox1111 2e9510f3ad Switch to non root nginx (#89) 2023-03-04 15:43:03 +01:00
kfox1111 06c395f4d9 Fix sources in Chart.yaml (#85) 2023-03-04 14:22:45 +01:00
kfox1111 d341c5ad58 UpstreamAuthority cert-manager support (#82) 2023-03-03 20:48:35 +01:00
Kevin Fox a82ee694bf Make sure all configmap changes rollout 
Signed-off-by: Kevin Fox <[email protected]>
 2023-03-03 08:39:11 -08:00
Kevin Fox b7f8c86478 Add extra initContainers, containers, volumes to agent and server 
With plugin support, agents and servers need more customization.
This patch enables initContainers, extraContainers, extraVolumes
and extraVolumeMounts to be added to those services.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-02 08:02:19 -08:00
kfox1111 4681498559 Better spire-server entry commands (#59) 
* Better spire-server entry commands

Currently in order to use the cli tools such as spire-server entry show
You must know the path within the container to the binary along with what
the path is to the socket. This patch makes that unnessisary. This now
works:
kubectl exec -it spire-server-0 -- spire-server entry show

Signed-off-by: Kevin Fox <[email protected]>

* Remove setting thats set to default

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
 2023-02-28 22:43:49 +01:00
Kevin Fox 9d7881f8b4 Switch hostpath to emptydir in spire-server 
The api of the server does not need to be exported out of the
server pod.

Signed-off-by: Kevin Fox <[email protected]>
 2023-02-28 09:49:13 -08:00
kfox1111andMarco Franssen 35eb3bb42e Basic Prometheus support (#28) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-02-24 22:39:15 +01:00
kfox1111 f149f2ed82 Merge pull request #23 from spiffe/test-non-defaulted-values 
Test charts without defaulted values
 2023-02-23 09:08:15 -08:00
kfox1111andFaisal Memon 8a3ae10da5 Add the option to disable unix workloadattestor (#26) 
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:32:35 +01:00
Kevin Fox 32303d7eba Remove the need for hostpath on oidc provider 
The hostpath isn't needed. This patch removes the extra mount and changes
it to an emptyDir.

Signed-off-by: Kevin Fox <[email protected]>
 2023-02-21 15:48:02 +01:00