panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,181 Commits 1 Branch 2 Tags
af6533d7642578463efac6167f6dcbaaaf5c327d
Commit Graph
1181 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Marco Franssen dfa4e6c784 Ensure CI also runs when test scripts are changed 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-08 07:21:49 -08:00
Marco Franssen 02ed2021c8 Bump spire Helm Chart version from 0.3.0 to 0.4.0 
* 7984bbd Add script to automate cutting a release
* eb186ca Add values for server TTL configurables
* f123296 Add a flag to configure the Kubernetes NodeAttestor (#83)
* 0275569 Incorperate feedback
* a00c97b Incorperate feedback
* f93434a Make server service account allow list configurable
* f0b7f5b Make spire agent server address configurable
* cb627f0 Allow all subchart to conditionally disable (#90)
* 2e9510f Switch to non root nginx (#89)
* a901751 Fix Homepage URL
* 06c395f Fix sources in Chart.yaml (#85)
* d341c5a UpstreamAuthority cert-manager support (#82)
* a82ee69 Make sure all configmap changes rollout
* b7f8c86 Add extra initContainers, containers, volumes to agent and server
* 81ac89a Add k8s 1.26.0 (Kind) to the test matrix
* bb6abfc Merge pull request #76 from spiffe/dependabot/github_actions/sigstore/cosign-installer-3.0.1
* c0e5665 Bump cosign to v2.0.0
* d729a44 Bump sigstore/cosign-installer from 2.8.1 to 3.0.1
* fe7cd73 Merge pull request #74 from spiffe/arm64-support
* a3c04c0 Update supported versions
* 75480ed Bump spiffe-csi-driver image to 0.2.3 (arm64 support)
* 79889ff Bump spiffe-oidc-discovery-provider image to 1.6.0 (arm64 support)
* a632f76 Bump spire-agent image to 1.6.0 (arm64 support)
* b92e81d Bump spire-server image to 1.6.0 (arm64 support)
* fea2aa5 Fix sigstore/cosign-installer usage in release workflow
* fe93346 Use quote function instead of actual quotes
* 9480ab7 Add beta note to readme (#62)
* 4681498 Better spire-server entry commands (#59)

Signed-off-by: Marco Franssen <[email protected]>
 2023-03-08 09:44:02 +01:00
Marco Franssen 517cf9ed2d Add script to automate cutting a release 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-08 09:44:02 +01:00
Marco Franssen 3b7b3564da Allow to configure spire-server CA key type 
Resolves #18

Signed-off-by: Marco Franssen <[email protected]>
 2023-03-07 22:07:54 +01:00
Marco Franssen eb186ca346 Add values for server TTL configurables 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-07 09:47:25 +01:00
kfox1111 f123296032 Add a flag to configure the Kubernetes NodeAttestor (#83) 2023-03-06 19:59:54 +01:00
Kevin Fox 027556904d Incorperate feedback 
Signed-off-by: Kevin Fox <[email protected]>
 2023-03-06 06:53:29 -08:00
Kevin Fox a00c97ba87 Incorperate feedback 
Signed-off-by: Kevin Fox <[email protected]>
 2023-03-06 06:53:29 -08:00
Kevin Fox f93434a926 Make server service account allow list configurable 
If you don't have the agent and server in the same namespace or the same
cluster, or want to bind additional clusters, you need the ability to
configure the service account allow list.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-06 06:53:29 -08:00
Kevin Fox f0b7f5bd8d Make spire agent server address configurable 
If your server is not in the same namespace or cluster as the
agent, you need a config option to specify where it is.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-06 06:40:58 -08:00
kfox1111 cb627f04b2 Allow all subchart to conditionally disable (#90) 2023-03-04 16:09:36 +01:00
kfox1111 2e9510f3ad Switch to non root nginx (#89) 2023-03-04 15:43:03 +01:00
Marco Franssen a901751ee7 Fix Homepage URL 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-04 14:35:39 +01:00
kfox1111 06c395f4d9 Fix sources in Chart.yaml (#85) 2023-03-04 14:22:45 +01:00
kfox1111 d341c5ad58 UpstreamAuthority cert-manager support (#82) 2023-03-03 20:48:35 +01:00
Kevin Fox a82ee694bf Make sure all configmap changes rollout 
Signed-off-by: Kevin Fox <[email protected]>
 2023-03-03 08:39:11 -08:00
Kevin Fox b7f8c86478 Add extra initContainers, containers, volumes to agent and server 
With plugin support, agents and servers need more customization.
This patch enables initContainers, extraContainers, extraVolumes
and extraVolumeMounts to be added to those services.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-02 08:02:19 -08:00
Marco Franssen 81ac89a911 Add k8s 1.26.0 (Kind) to the test matrix 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-02 13:08:37 +01:00
Marco Franssen bb6abfcd3a Merge pull request #76 from spiffe/dependabot/github_actions/sigstore/cosign-installer-3.0.1 2023-03-02 09:16:01 +01:00
Marco Franssen c0e5665702 Bump cosign to v2.0.0 
Cosign v2.0.0 doesn't require the experimental env var anymore

Signed-off-by: Marco Franssen <[email protected]>
 2023-03-02 09:15:46 +01:00
dependabot[bot] d729a4410c Bump sigstore/cosign-installer from 2.8.1 to 3.0.1 
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 2.8.1 to 3.0.1.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/v2.8.1...v3.0.1)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-03-02 01:14:59 +00:00
Marco Franssen fe7cd731d5 Merge pull request #74 from spiffe/arm64-support 2023-03-01 19:47:12 +01:00
Marco Franssen a3c04c0d22 Update supported versions 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-01 15:41:47 +01:00
Marco Franssen 75480ede45 Bump spiffe-csi-driver image to 0.2.3 (arm64 support) 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-01 15:41:47 +01:00
Marco Franssen 79889ff3ed Bump spiffe-oidc-discovery-provider image to 1.6.0 (arm64 support) 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-01 15:41:47 +01:00
Marco Franssen a632f76021 Bump spire-agent image to 1.6.0 (arm64 support) 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-01 15:41:47 +01:00
Marco Franssen b92e81d416 Bump spire-server image to 1.6.0 (arm64 support) 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-01 15:41:47 +01:00
Marco Franssen fea2aa59e2 Fix sigstore/cosign-installer usage in release workflow 
See https://github.com/sigstore/cosign-installer\#usage on proper usage

Resolves #66

Signed-off-by: Marco Franssen <[email protected]>
 2023-03-01 13:52:39 +01:00
Faisal Memon fe93346b66 Use quote function instead of actual quotes 
Signed-off-by: Faisal Memon <[email protected]>
 2023-03-01 11:10:08 +01:00
Faisal MemonandMarco Franssen 9480ab74b4 Add beta note to readme (#62) 
Signed-off-by: Faisal Memon <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-02-28 15:21:51 -08:00
kfox1111 4681498559 Better spire-server entry commands (#59) 
* Better spire-server entry commands

Currently in order to use the cli tools such as spire-server entry show
You must know the path within the container to the binary along with what
the path is to the socket. This patch makes that unnessisary. This now
works:
kubectl exec -it spire-server-0 -- spire-server entry show

Signed-off-by: Kevin Fox <[email protected]>

* Remove setting thats set to default

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
 2023-02-28 22:43:49 +01:00
Marco Franssen 72d4929670 Bump spire chart to v0.3.0 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-28 19:21:29 +01:00
Kevin Fox 9d7881f8b4 Switch hostpath to emptydir in spire-server 
The api of the server does not need to be exported out of the
server pod.

Signed-off-by: Kevin Fox <[email protected]>
 2023-02-28 09:49:13 -08:00
Marco Franssen f8cdec3f99 Allow to configure a priorityClassName for Daemonsets 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-27 08:09:00 -08:00
Marco Franssen ba41f04df5 Fix spire-controller-manager healthz port 
This to align with the spire-controller-manager-configmap.yaml

Signed-off-by: Marco Franssen <[email protected]>
 2023-02-27 08:08:17 -08:00
dependabot[bot] e754b3a6c8 Bump actions/checkout from 3.2.0 to 3.3.0 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3.2.0 to 3.3.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3.2.0...v3.3.0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-02-27 11:32:19 +01:00
kfox1111andMarco Franssen 35eb3bb42e Basic Prometheus support (#28) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-02-24 22:39:15 +01:00
Marco Franssen 495d9d67e8 Align healthz ports and checks across containers 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 21:06:09 +01:00
Faisal Memon 156052ada0 Merge pull request #40 from spiffe/update-contributing 
Clarify Chart version increments in CONTRIBUTING.md
 2023-02-24 11:34:08 -08:00
Marco FranssenandFaisal Memon ef6a6bd53d Improve sentence based on review 
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 20:33:42 +01:00
Marco Franssen 615b4341cc Clarify Chart version increments in CONTRIBUTING.md 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 20:16:47 +01:00
Marco Franssen 8ceb00efe6 Merge pull request #33 from spiffe/version-increment-check 2023-02-24 10:55:17 +01:00
Marco Franssen a29df4f6cc Change to cut releases from the release branch 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 10:55:00 +01:00
Marco Franssen e8768ec955 Add types to trigger workflow when changing the target branch 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 10:55:00 +01:00
Marco Franssen 3c7d828954 Only check for version bump if PR targets main 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 10:55:00 +01:00
Marco Franssen a95ef9f3db Use github.base_ref for target-branch 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 10:54:57 +01:00
kfox1111 f149f2ed82 Merge pull request #23 from spiffe/test-non-defaulted-values 
Test charts without defaulted values
 2023-02-23 09:08:15 -08:00
Marco Franssen 5dc93da6b8 Bump to latest Helm and Python versions 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:35:46 +01:00
Marco Franssen d46c3fc14d Test without ACME tos Accepted 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:35:46 +01:00
Marco Franssen 8d97803c8a Bump chart version to 0.2.0 and appVersion to 1.5.5 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:34:52 +01:00