panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
439 Commits 1 Branch 2 Tags
af13f1fc643d2b355c3e00fc978fd9ca35953e99
Commit Graph
91 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
kfox1111 e16210c653 Merge branch 'main' into persistence-type 2023-07-21 09:36:18 -07:00
kfox1111 624ca9cc49 Remove misadded lockfile (#400) 2023-07-20 15:28:32 -07:00
Kevin Fox a6bdb4d1e7 Add persistence type flag 
This patch adds a type flag to the persistence settings to enable
specifying the backing volume's type.

Signed-off-by: Kevin Fox <[email protected]>
 2023-07-19 23:40:23 +02:00
kfox1111andMarco Franssen a4c1de7b30 Add basic unit test framework (#390) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-07-19 18:36:07 +00:00
kfox1111 19d3208740 Fix oidc provider config change not rolling out (#383) 2023-07-12 21:05:09 +02:00
kfox1111 3ed1859cd1 Add missing tolerations config to daemonsets (#381) 
spiffe-csi-driver and spire-agent are missing the ability to specify
tolerations. This PR adds the missing functionality.

fixes: https://github.com/spiffe/helm-charts/issues/380

Signed-off-by: Kevin Fox <[email protected]>
 2023-07-06 12:48:59 -05:00
kfox1111andMarco Franssen c1b1dd3d88 Add additional domains to JWT issued items. (#230) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-07-03 22:26:28 +02:00
kfox1111 8409674a3e Fix the init container flags of the statefulset (#366) 2023-06-22 18:57:07 +02:00
kfox1111Marco FranssenFaisal Memon
 		a6dcf267d1 Allow for SPIRE Agent to run as non root user (#209) 
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-06-17 10:32:41 +02:00
kfox1111 e6b608c9fd Bump spire images to 1.7.0 (#348) 2023-06-16 07:26:59 +00:00
kfox1111 c97a788c85 Fix bundle role/rolebinding naming conflict (#333) 2023-06-16 08:55:49 +02:00
kfox1111 d0da864113 Add missing metadata to subcharts (#347) 2023-06-14 12:46:22 -07:00
kfox1111 4c0a1d52c5 Allow overriding test images (#186) 2023-06-14 21:17:08 +02:00
kfox1111 250fd5db00 Add missing global values to charts (#311) 2023-06-14 09:16:02 +02:00
kfox1111 4e07450781 Fix ingress annotations for federation (#337) 
fixes: https://github.com/spiffe/helm-charts/issues/336

Signed-off-by: Kevin Fox <[email protected]>
 2023-06-12 05:50:26 -07:00
Kevin Fox 0df45e3cd8 Fix up docs 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 16:26:23 -07:00
kfox1111 ed038feae1 Upgrade to spire 1.6.4 (#308) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 16:17:34 -07:00
Kevin Fox dc5d9cfeec Fix root README.md 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 16:15:21 -07:00
Kevin Fox 69f402ecc6 Update docs 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 09:56:05 -07:00
kfox1111andFaisal Memon 38d51d5985 Apply suggestions from code review 
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
 2023-05-23 09:55:38 -07:00
Kevin Fox a1ba235c99 Update docs 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 09:44:06 -07:00
Kevin Fox 4fb549e954 Remove 1.21.x testing 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 08:57:07 -07:00
kfox1111andMarco Franssen 88efc77bee Allow to use spire-server as an upstream authority (#304) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-05-23 14:39:37 +00:00
kfox1111Faisal MemonMarco Franssendependabot[bot]
 		0ba03880a1 Add support for spire-server ingress (#68) 
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-05-23 13:58:58 +00:00
kfox1111 00c2c1a533 Fix the generated pr so that it runs jobs too (#303) 2023-05-23 12:14:40 +02:00
kfox1111 dd1ad495bd Update images for cve's found by the cronjob (#290) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-18 14:55:39 -07:00
kfox1111 f8db5a313b Fix Tornjak persistence issue (#294) 2023-05-18 01:54:26 +02:00
Kevin Fox d1f3cdb909 Switch image.version to image.tag 
The convention in most charts is to use image.tag. This patch updates the values
to use it instead of the less standard image.version.

Signed-off-by: Kevin Fox <[email protected]>
 2023-05-17 20:21:07 +02:00
kfox1111 aed6fdfe4e Use the correct kubectl for the cluster (#248) 2023-05-16 20:28:53 +02:00
kfox1111 1675997748 Tornjak global image fix (#228) 
This pr updates the Tornjak branch to work with the merged global
registry configuration support.

Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
 2023-05-16 19:31:38 +02:00
kfox1111 8d9b73496d Switch the spire tests to always run (#250) 
This patch sets the spire chart tests to always run. This enables
changes in tests to be tested and sets a base for split out charts.

---------

Signed-off-by: Kevin Fox <[email protected]>
 2023-05-14 17:39:08 -07:00
kfox1111Faisal MemonMarco Franssen
 		c4656a74b2 Replicas > 1 is not allowed with sqlite driver (#269) 
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-05-10 16:30:05 +02:00
kfox1111Faisal MemonMarco Franssen
 		d3da3eed55 External database configuration (#225) 
This patch makes all the database settings configurable.

fixes: https://github.com/spiffe/helm-charts/issues/37

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-05-10 14:04:34 +02:00
kfox1111andFaisal Memon 8e7e6ebc76 Allow trust bundle url to be set along with format (#256) 
This patch enables the spire-agent to retrieve the trust bundle via url.

fixes: https://github.com/spiffe/helm-charts/issues/254

---------

Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-05-04 13:15:17 -07:00
kfox1111 61e338df55 Fix example production typos (#244) 
Signed-off-by: kfox1111 <[email protected]>
 2023-04-27 14:02:48 -07:00
kfox1111andMarco Franssen 17d62f1246 Add an action to find new versions of helm charts (#184) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-04-25 10:04:38 +02:00
kfox1111andMarco Franssen 2c360a50fd Add global for image registry (#201) 
This patch enables a user to override all image registry settings all at
once to point to their own registry to enable easy custom mirrors.

partially implements: https://github.com/spiffe/helm-charts/issues/139

---------

Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-04-20 20:08:14 +02:00
kfox1111 3cc8955429 Move reusable macros to root chart (#218) 
This patch adds the start of a library to help reduce code duplication.
It will be split out to its own library chart at the same time the other
charts are split out.

---------

Signed-off-by: Kevin Fox <[email protected]>
 2023-04-18 08:54:46 +02:00
kfox1111 9e03f29760 Merge branch 'main' into spire-config-as-yaml-converted-json 2023-04-17 08:43:19 -07:00
kfox1111 210ed02c58 Remove dead code (#217) 2023-04-17 12:18:18 +02:00
Kevin Fox 0f57f5683a Update to the 1.6.3 spire release 
Update the images to point to the 1.6.3 version of spire.

Signed-off-by: Kevin Fox <[email protected]>
 2023-04-13 23:14:50 +02:00
kfox1111 b82abab357 Revert "Switch to persistence" (#210) 
Reverts spiffe/helm-charts#200

Signed-off-by: Kevin Fox <[email protected]>
 2023-04-12 16:12:07 -04:00
kfox1111 0dec80e1d5 Switch to persistence (#200) 
This patch switches the value to persistence to follow the helm
convention.

fixes: https://github.com/spiffe/helm-charts/issues/199

Signed-off-by: Kevin Fox <[email protected]>
 2023-04-12 08:56:10 -07:00
kfox1111andMarco Franssen 563e1f7920 Add podmonitors (#165) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-04 09:55:35 +02:00
kfox1111andMarco Franssen daa620bf05 Fix production example test (#183) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-03 19:54:53 +02:00
kfox1111andMarco Franssen c661d0bc7e Make service dns domain configurable (#164) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-03 19:52:36 +02:00
kfox1111andMarco Franssen ec236e9762 Test for configurable images (#182) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-03 19:50:06 +02:00
kfox1111andMarco Franssen 280315ca68 Fix namespace-override github test summary (#154) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-03 19:37:19 +02:00
kfox1111andMarco Franssen 072d952d9a Switch tests to curl (#178) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-04-03 19:32:18 +02:00
kfox1111 87904164ad Enable global config for clusterName, trustDomain, and bundleConfigMap (#156) 2023-04-02 19:28:49 +02:00
kfox1111andMarco Franssen e2ec6ac47d Add a test to ensure the chart versions match (#163) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-03-28 10:21:24 +02:00
kfox1111andMarco Franssen b25dc773bc Test fixing the tests (#148) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-03-22 09:49:33 +01:00
kfox1111 d4fd2ced39 Extract the namespace override test out of the old lockdown test. (#145) 
This patch removes the production bits of the old lockdown test
and establishes the namespace override test as its own test.

---------

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-21 22:13:26 +01:00
kfox1111 04a1305556 Fork the lockdown test to two tests as it is doing the work of 2 (#134) 
This patch makes a second copy of the existing lockdown test
because it is doing double duty. In follow on patches we will
make each test do one thing only.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-21 10:14:38 -07:00
Kevin FoxandMarco Franssen 6322a9a138 Fix tests 
Signed-off-by: Kevin Fox <[email protected]>

Co-authored-by: Marco Franssen <[email protected]>
 2023-03-16 18:58:31 +01:00
Kevin FoxandMarco Franssen cc7121e021 Add ingress support for OIDC discovery provider 
This patch enables exposing the oidc server out with an ingress
along with tests to ensure it works.

Signed-off-by: Kevin Fox <[email protected]>

Co-authored-by: Marco Franssen <[email protected]>
 2023-03-16 10:02:22 +01:00
kfox1111 2e3f045826 Make webhook fail policy configurable (#124) 
This patch makes the webhook fail policy configurable.

---------

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-15 12:55:07 -07:00
kfox1111 9ccbd3c67f Make kubelet path configurable (#123) 2023-03-15 10:25:06 +01:00
kfox1111 80e3b58dcd Remove dead file from failed rebase. (#121) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-03-14 13:23:02 -07:00
Kevin Fox 25c77fc0cb Fix the driver not coming up on overloaded nodes 
Add to the reference production example a fix for overloaded nodes.

fixes: https://github.com/spiffe/helm-charts/issues/80

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-14 20:10:51 +01:00
kfox1111 03db6bb5fe Namespace override 
This patch makes it possible to install the subcharts in different
namespaces as needed.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-13 15:03:16 -07:00
kfox1111 661000a29a Make the agent socket configurable (#114) 2023-03-13 20:35:27 +01:00
kfox1111andMarco Franssen f3a81ad78d Make csi driver configurable to be able to run multiple instances (#115) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-03-13 14:12:37 +01:00
kfox1111 b198bc7e39 Fix the tests so they can run locked down. (#111) 2023-03-11 22:10:14 +01:00
Kevin Fox 09b21acca2 Fix the gate 
Signed-off-by: Kevin Fox <[email protected]>
 2023-03-11 19:21:59 +01:00
kfox1111 b6716aee17 Test that it is possible to lock down security of pods (#84) 2023-03-11 12:11:19 +01:00
Kevin Fox bfeb217558 Fix cluster role name uniqueness 
Adds namespace to the ClusterRole and ClusterRoleBinding so that it
doesn't conflict when you have two instances of the chart, in different
namespaces with the same release name.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-10 15:45:49 +01:00
Kevin Fox 490fe8f543 Enhance the test workflow scripts 
This makes it so that tests can now:
1. Add additional values files to the test
2. That the post-install.sh script knows if the test passed or failed
   for better output
3. That the main test can be skipped in favor of a test provided one

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-10 08:46:27 +01:00
Kevin Fox 9e22d2c303 Make the namespace the bundle is dropped into configurable 
When the server and agent are not in the same namespace, the bundle needs to be
uploadable in the agent's namespace.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-09 12:00:41 -08:00
Kevin Fox 7d1f8217ce Fix test. 
Signed-off-by: Kevin Fox <[email protected]>
 2023-03-09 10:09:50 -08:00
kfox1111 b6dd136af2 Add tmp mount so that server can run locked down (#105) 
This pr adds a tmp mount to the spire server pod so that it can run with
read only root.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-08 14:21:45 -08:00
Kevin Fox aaaf2f7625 Remove dead role code 
The cluster role does the same thing, but at the cluster level
where it belongs. The extra role code does nothing so we remove
it here.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-08 12:36:35 -08:00
Kevin Fox d2eba226d4 Fix docs 
Signed-off-by: Kevin Fox <[email protected]>
 2023-03-08 19:31:54 +01:00
Kevin Fox 6d43625f4d Add kfox as a maintainer 
Signed-off-by: Kevin Fox <[email protected]>
 2023-03-08 19:31:54 +01:00
kfox1111 f123296032 Add a flag to configure the Kubernetes NodeAttestor (#83) 2023-03-06 19:59:54 +01:00
Kevin Fox 027556904d Incorperate feedback 
Signed-off-by: Kevin Fox <[email protected]>
 2023-03-06 06:53:29 -08:00
Kevin Fox a00c97ba87 Incorperate feedback 
Signed-off-by: Kevin Fox <[email protected]>
 2023-03-06 06:53:29 -08:00
Kevin Fox f93434a926 Make server service account allow list configurable 
If you don't have the agent and server in the same namespace or the same
cluster, or want to bind additional clusters, you need the ability to
configure the service account allow list.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-06 06:53:29 -08:00
Kevin Fox f0b7f5bd8d Make spire agent server address configurable 
If your server is not in the same namespace or cluster as the
agent, you need a config option to specify where it is.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-06 06:40:58 -08:00
kfox1111 cb627f04b2 Allow all subchart to conditionally disable (#90) 2023-03-04 16:09:36 +01:00
kfox1111 2e9510f3ad Switch to non root nginx (#89) 2023-03-04 15:43:03 +01:00
kfox1111 06c395f4d9 Fix sources in Chart.yaml (#85) 2023-03-04 14:22:45 +01:00
kfox1111 d341c5ad58 UpstreamAuthority cert-manager support (#82) 2023-03-03 20:48:35 +01:00
Kevin Fox a82ee694bf Make sure all configmap changes rollout 
Signed-off-by: Kevin Fox <[email protected]>
 2023-03-03 08:39:11 -08:00
Kevin Fox b7f8c86478 Add extra initContainers, containers, volumes to agent and server 
With plugin support, agents and servers need more customization.
This patch enables initContainers, extraContainers, extraVolumes
and extraVolumeMounts to be added to those services.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-02 08:02:19 -08:00
kfox1111 4681498559 Better spire-server entry commands (#59) 
* Better spire-server entry commands

Currently in order to use the cli tools such as spire-server entry show
You must know the path within the container to the binary along with what
the path is to the socket. This patch makes that unnessisary. This now
works:
kubectl exec -it spire-server-0 -- spire-server entry show

Signed-off-by: Kevin Fox <[email protected]>

* Remove setting thats set to default

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
 2023-02-28 22:43:49 +01:00
Kevin Fox 9d7881f8b4 Switch hostpath to emptydir in spire-server 
The api of the server does not need to be exported out of the
server pod.

Signed-off-by: Kevin Fox <[email protected]>
 2023-02-28 09:49:13 -08:00
kfox1111andMarco Franssen 35eb3bb42e Basic Prometheus support (#28) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-02-24 22:39:15 +01:00
kfox1111 f149f2ed82 Merge pull request #23 from spiffe/test-non-defaulted-values 
Test charts without defaulted values
 2023-02-23 09:08:15 -08:00
kfox1111andFaisal Memon 8a3ae10da5 Add the option to disable unix workloadattestor (#26) 
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:32:35 +01:00
Kevin Fox 32303d7eba Remove the need for hostpath on oidc provider 
The hostpath isn't needed. This patch removes the extra mount and changes
it to an emptyDir.

Signed-off-by: Kevin Fox <[email protected]>
 2023-02-21 15:48:02 +01:00