* Add validating admission policy to restrict upstream driver access
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spiffe-csi-driver/templates/policy.yaml
Signed-off-by: kfox1111 <[email protected]>
* Fix logic
Signed-off-by: Kevin Fox <[email protected]>
* Upgrade helm
Signed-off-by: Kevin Fox <[email protected]>
* Upgrade kind and fix node version
Signed-off-by: Kevin Fox <[email protected]>
* Upgrade kind and fix node version
Signed-off-by: Kevin Fox <[email protected]>
* Upgrade kind and fix node version
Signed-off-by: Kevin Fox <[email protected]>
* Upgrade kind and fix node version
Signed-off-by: Kevin Fox <[email protected]>
* Add version info
Signed-off-by: Kevin Fox <[email protected]>
* Add version info
Signed-off-by: Kevin Fox <[email protected]>
* Fix kind version
Signed-off-by: Kevin Fox <[email protected]>
* Fix kind version
Signed-off-by: Kevin Fox <[email protected]>
* Fix kind version
Signed-off-by: Kevin Fox <[email protected]>
* Fix detection
Signed-off-by: Kevin Fox <[email protected]>
* Just for testing...
Signed-off-by: Kevin Fox <[email protected]>
* Just for testing...
Signed-off-by: Kevin Fox <[email protected]>
* Just for testing
Signed-off-by: Kevin Fox <[email protected]>
* Fix policy
Signed-off-by: Kevin Fox <[email protected]>
* Fix policy
Signed-off-by: Kevin Fox <[email protected]>
* Fix policy
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spiffe-csi-driver/values.yaml
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Update docs
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* Add support for the new hint spire-controller-manager feature
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Add support for the new fallback spire-controller-manager feature
Signed-off-by: Kevin Fox <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
* 7df063f Upgrade SPIRE to 1.10.3 (#412)
* de5ec47 Bump test chart dependencies (#445)
* e72b94f Add all built in BundlePublishers (#430)
* 532852d Bump test chart dependencies (#440)
* 6e8ad56 Add a spire-agent auto kubelet verification mode (#435)
* 50c741e Remove extra check that sometimes breaks oidc (#437)
* e062b9f Support ipv4 only clusters (#434)
* b96e07e Enable more forms of kubelet certificate verification (#426)
* f92d729 Add missing properties required by SecurityContextConstraints CRD (#432)
* 8553a78 Bump test chart dependencies (#431)
Signed-off-by: Faisal Memon <[email protected]>
* Add a spire-agent auto kubelet verification mode
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
* Support ipv4 only clusters
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml
Signed-off-by: kfox1111 <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* 9b2d72f Fix permission issue with 1.10 and defaults when upgraded (#423)
* 827a3ea Bump spire to 1.10.1 (#424)
* 0289e5f Revert "Added support for specifying Kubelet CA Path (#415)" (#422)
* bf40797 Bump test chart dependencies (#418)
* abcf019 Added support for specifying Kubelet CA Path (#415)
* 6d4d526 Allow configuring persistence in the spire-agent (#414)
Signed-off-by: Faisal Memon <[email protected]>
* Fix permission issue with 1.10 and defaults when upgraded
Signed-off-by: Kevin Fox <[email protected]>
* Fix indenting
Signed-off-by: Kevin Fox <[email protected]>
* incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
* Allow configuring persistence in the spire-agent
Signed-off-by: Kevin Fox <[email protected]>
* Better wording. Leave space for other services if needed some day.
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
* Update to SPIRE 1.10.0
Remove the options that were removed in 1.10, and update.
Signed-off-by: Kevin Fox <[email protected]>
* Update docs
Signed-off-by: Kevin Fox <[email protected]>
* Fix uid mismatch issue on 1.10.0+
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
When setting the kubeletConnectByHostname to "true", the charts update the agent daemonset to define the MY_NODE_NAME environment variable, but it doesn't set the "node_name_env" setting in the WorkloadAttestor:k8s plugin, therefore the agent continues trying to connect to the kubelet using the localhost interface
Signed-off-by: tuxotron <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
