panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
456 Commits 1 Branch 2 Tags
ae8941c49d7e9d73d64c5ba9a3d914ee133e9572
Commit Graph
62 Commits
Author SHA1 Message Date
kfox1111 ae8941c49d Support Nested Spire with External Agent (#117) 2023-08-16 16:35:41 +02:00
Drew Wells bfec27ef67 Fix jwtIssuer to allow for Uris including scheme (#425) 2023-08-09 16:53:21 +02:00
kfox1111andMarco Franssen c1b1dd3d88 Add additional domains to JWT issued items. (#230) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-07-03 22:26:28 +02:00
Mariusz Sabath 1c6947078a Updated Tornjak documenation with Not-for-production labels (#297) 2023-05-18 23:31:03 +02:00
Mariusz SabathandMarco Franssen da186c5f53 Split Tornjak Frontend into separate subchart (#179) 
Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-05-16 19:31:38 +02:00
Marco FranssenandFaisal Memon 65312f8525 Include dependency values in documentation (#275) 
I have added a flag to the helm-docs script to include the documentation
for dependencies.

This will add more complete documentation to
https://artifacthub.io/packages/helm/spiffe/spire#values so it is easier
for our users to get started and having a complete overview.

---------

Signed-off-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-05-12 18:12:23 +00:00
kfox1111andMarco Franssen 2c360a50fd Add global for image registry (#201) 
This patch enables a user to override all image registry settings all at
once to point to their own registry to enable easy custom mirrors.

partially implements: https://github.com/spiffe/helm-charts/issues/139

---------

Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-04-20 20:08:14 +02:00
kfox1111 210ed02c58 Remove dead code (#217) 2023-04-17 12:18:18 +02:00
Marco Franssen db148c8aeb Fix trustDomain global for oidc discovery provider (#193) 2023-04-05 10:46:53 -04:00
kfox1111andMarco Franssen 563e1f7920 Add podmonitors (#165) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-04 09:55:35 +02:00
kfox1111andMarco Franssen c661d0bc7e Make service dns domain configurable (#164) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-03 19:52:36 +02:00
kfox1111 87904164ad Enable global config for clusterName, trustDomain, and bundleConfigMap (#156) 2023-04-02 19:28:49 +02:00
kfox1111 cb627f04b2 Allow all subchart to conditionally disable (#90) 2023-03-04 16:09:36 +01:00
kfox1111andMarco Franssen 35eb3bb42e Basic Prometheus support (#28) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-02-24 22:39:15 +01:00
Marco Franssen ec26d85f61 Enable spire-controller-manager by default 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:33:28 +01:00
Marco Franssen 99d32050ba Remove option to choose different agent socket path 
Resolves #19

Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:23:36 +01:00
Marco Franssen 0d49280cda Add support for spire-controller-manager 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:13 +01:00
Marco Franssen 0a0ddb4a9b Move the k8s-workload-registrar back into same pod as spire-server 
The k8s-workload-registrar needs access to the spire-server socket and
therefore has to run in the same pod to be able to mount the socket
into the container.

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:11 +01:00
Marco Franssen c7ebf72d13 Remove unused helpers from root 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:10 +01:00
Marco Franssen cdbee1bc1b Cleanup values.yaml 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:10 +01:00
Marco Franssen ce9b58e725 Move spire-server to dedicated subchart 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:10 +01:00
Marco Franssen e312d42350 Move spire-agent to dedicated subchart 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:09 +01:00
Marco Franssen ab2636ae98 Move k8s-workload-registrar to sub chart 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:09 +01:00
Marco FranssenandGert Jan Kamstra 99da500c1c Move oidc-discovery-provider to sub chart 
Signed-off-by: Marco Franssen <[email protected]>
Co-authored-by: Gert Jan Kamstra <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:09 +01:00
Marco Franssen 35b8ad3c00 Move the spiffe-csi-driver into a sub chart 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:09 +01:00
Marco FranssenandGert Jan Kamstra 3fe5f8f145 Improve documentation on values 
Co-authored-by: Gert Jan Kamstra <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:09 +01:00
Marco Franssen 93156bf904 Allow to use external created secret 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:09 +01:00
Marco Franssen fe38a52a95 Improve upstream CA 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:08 +01:00
Marco Franssen 1ee42c53d3 Bump wait-for-it image latest-20221223 
This version supports arm64 and amd64

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:08 +01:00
Ken HuffmanandMarco Franssen ce86fb97e1 Add optional UpstreamAuthority (#79) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:08 +01:00
Marco Franssen ddf4be3d3d Bump csiDriver to 0.2.1 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:08 +01:00
Marco Franssen bf31bdc2c0 Fix server podAnnotations configurable 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:08 +01:00
Marco Franssen a2abee2f95 Switch oidc image back to static image 
The repo as private and is now set to public

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:08 +01:00
Marco Franssen 94318b02a6 Bump spire to 1.5.3 to fix oidc healthchecks 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:07 +01:00
Marco Franssen 109be1a3cc Replaced wait-for-it image to resolve security issues 
This image was also outdated (no recent releases) and contains whole bunch of vulnerabilities

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:07 +01:00
Ken HuffmanandMarco Franssen a3f1901a6b adding annotations and resources (#81) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:07 +01:00
Marco Franssen d84a1343c6 Bump csi-node-driver-registrar to v2.6.2 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:06 +01:00
Marco Franssen be163d26cc Allow to configure oidc nginx container resources 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:06 +01:00
Marco Franssen 83c3e45e93 Make socketPaths configurable 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:06 +01:00
Marco Franssen c010d6a4b0 Fix spire oidc nginx container 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:06 +01:00
Marco Franssen a159e7b663 Fix image version failing in spire.image template 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:06 +01:00
Marco Franssen 1e31a5e359 Remove autoscaling using HPA 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen e770a14629 Align config across components 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 10f0138a25 Enable oidc service domains in oidc by default 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 746768dc55 Use chainguard nginx image 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:05 +01:00
Marco Franssen 1bdb9a5a50 Move affinity, annotations and tolerations to oidc and server components 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00
Marco Franssen 76a0c5ecfc Move security values to server and oidc components 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00
Marco Franssen 8dd05399d1 Move some values to top 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00
Marco Franssen 7834800463 Move replicaCount to server and oidc components 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00
Marco Franssen 445cde9604 Add the gcr.io images in comment in values.yaml 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:04 +01:00