This patch removes the production bits of the old lockdown test
and establishes the namespace override test as its own test.
---------
Signed-off-by: Kevin Fox <[email protected]>
This patch makes a second copy of the existing lockdown test
because it is doing double duty. In follow on patches we will
make each test do one thing only.
Signed-off-by: Kevin Fox <[email protected]>
This patch enables exposing the oidc server out with an ingress
along with tests to ensure it works.
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
Adds namespace to the ClusterRole and ClusterRoleBinding so that it
doesn't conflict when you have two instances of the chart, in different
namespaces with the same release name.
Signed-off-by: Kevin Fox <[email protected]>
This makes it so that tests can now:
1. Add additional values files to the test
2. That the post-install.sh script knows if the test passed or failed
for better output
3. That the main test can be skipped in favor of a test provided one
Signed-off-by: Kevin Fox <[email protected]>
When the server and agent are not in the same namespace, the bundle needs to be
uploadable in the agent's namespace.
Signed-off-by: Kevin Fox <[email protected]>
The cluster role does the same thing, but at the cluster level
where it belongs. The extra role code does nothing so we remove
it here.
Signed-off-by: Kevin Fox <[email protected]>
If you don't have the agent and server in the same namespace or the same
cluster, or want to bind additional clusters, you need the ability to
configure the service account allow list.
Signed-off-by: Kevin Fox <[email protected]>
If your server is not in the same namespace or cluster as the
agent, you need a config option to specify where it is.
Signed-off-by: Kevin Fox <[email protected]>
With plugin support, agents and servers need more customization.
This patch enables initContainers, extraContainers, extraVolumes
and extraVolumeMounts to be added to those services.
Signed-off-by: Kevin Fox <[email protected]>
* Better spire-server entry commands
Currently in order to use the cli tools such as spire-server entry show
You must know the path within the container to the binary along with what
the path is to the socket. This patch makes that unnessisary. This now
works:
kubectl exec -it spire-server-0 -- spire-server entry show
Signed-off-by: Kevin Fox <[email protected]>
* Remove setting thats set to default
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
