panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
651 Commits 1 Branch 2 Tags
b9ac3c4aec287ac9ea911e1e8be3ec0d487a2c9b
Commit Graph
651 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot]andMarco Franssen 386e736e78 Bump sigstore/cosign-installer from 3.0.5 to 3.1.0 (#368) 
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marco Franssen <[email protected]>
 2023-06-26 08:54:42 -07:00
Marco Franssen 99e01c6722 Bump spire-controller-manager from 0.2.2 to 0.2.3 (#367) 
resolves a bunch of vulnerabilities in the Image

Signed-off-by: Marco Franssen <[email protected]>

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-22 16:16:43 -07:00
Marco Franssen 4dccb0d3b6 Bump spire Helm Chart version from 0.9.0 to 0.9.1 (#365) 2023-06-22 18:57:33 +02:00
kfox1111 8409674a3e Fix the init container flags of the statefulset (#366) 2023-06-22 18:57:07 +02:00
Drew Wells 3b6666016c add missing federatesWith option (#361) 
DEMO

```
spire-server-0 -- spire-server entry show -spiffeID spiffe://box-4.example.com/ns/dwells/sa/dwells-rc-realm-client
Defaulted container "spire-server" out of: spire-server, spire-controller-manager, wait (init)
Found 1 entry
Entry ID         : 09301666-010e-4ba9-9dcb-44370d4e49e4
SPIFFE ID        : spiffe://box-4.example.com/ns/dwells/sa/dwells-rc-realm-client
Parent ID        : spiffe://box-4.example.com/spire/agent/k8s_psat/example-cluster/ff93872d-791f-4bf3-a532-475775d03d3e
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : k8s:pod-uid:40e0bcad-6ec8-460b-a839-659654549d7a
FederatesWith    : box-3.example.com
```

Signed-off-by: Drew Wells <[email protected]>
 2023-06-22 08:45:37 -07:00
Drew Wells 0533d92594 fixes missing template (#362) 2023-06-22 09:40:08 -04:00
Faisal Memon 1333b6ab34 Always add parseTime=true for mysql query string (#352) 2023-06-20 21:14:42 +02:00
github-actions[bot]marcofranssenFaisal Memon
 		ac3be716dd Bump test chart dependencies (#358) 
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-06-20 08:41:41 +02:00
Marco Franssen 44f3554708 Bump spire Helm Chart version from 0.8.1 to 0.9.0 
* 57a9320 Add SPIRE 1.7.0 to main readme (#357)
* af36f7c Align the bash image version with other instances for spire-agent (#356)
* c11a8c0 Implement pre-delete hook for graceful delete of spiffe-oidc-discovery-provider (#353)
* a6dcf26 Allow for SPIRE Agent to run as non root user (#209)
* 9cf6049 Allow contributors to run linting easily on local
* e88f7f6 Add configmap annotation to spire-bundle configmap (#351)
* 020bde8 Add support to create a issuer and CA via cert-manager (#342)
* 9d504de Ignore .DS_Store files
* e6b608c Bump spire images to 1.7.0 (#348)
* c97a788 Fix bundle role/rolebinding naming conflict (#333)
* b66077e Bump peter-evans/create-pull-request from 5.0.1 to 5.0.2 (#349)
* d0da864 Add missing metadata to subcharts (#347)
* 4c0a1d5 Allow overriding test images (#186)
* 250fd5d Add missing global values to charts (#311)
* 5d8c907 Dropping k8s versions in CI older than 3, as per readme (#344)
* 8748933 Update upstream-ca-secret.yaml (#341)
* 4e07450 Fix ingress annotations for federation (#337)
* ea09199 Bump actions/checkout from 3.5.0 to 3.5.3
* 87fe198 Merge pull request #331 from edwbuck/key_conventions
* ddc0166 Fix line wrapping.
* 0cae9ce Update project/conventions.md
* cb18255 Update project/conventions.md
* 52e5c24 Upgrade Tornjak to image v1.2.2 (#328)
* 28e2abf Choose a different example for dotted Acronyms.
* d60d68c Added accidentally clipped explicit name guidelines.
* abe9fde Merge branch 'main' into key_conventions
* f6a7b62 Update project/conventions.md
* c4d19db Update project/conventions.md
* cfa9f78 Bump test chart dependencies (#332)
* c3213ab Initial submission of Helm Chart key naming conventions.
* 28c0824 Bump test chart dependencies (#322)
* d333154 Add Makefile for local testing (#327)
* 9fa1ec2 Improve Tornjak backend test (#321)
* 5b779dc Improve Tornjak frontend test (#320)

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-20 00:14:48 +02:00
Faisal Memon 57a93205a7 Add SPIRE 1.7.0 to main readme (#357) 2023-06-19 20:29:17 +02:00
Marco Franssen af36f7c09b Align the bash image version with other instances for spire-agent (#356) 
Signed-off-by: Marco Franssen <[email protected]>

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-19 11:28:35 -07:00
Marco Franssen c11a8c00e7 Implement pre-delete hook for graceful delete of spiffe-oidc-discovery-provider (#353) 2023-06-17 06:06:27 -07:00
kfox1111Marco FranssenFaisal Memon
 		a6dcf267d1 Allow for SPIRE Agent to run as non root user (#209) 
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-06-17 10:32:41 +02:00
Marco Franssen 9cf6049afd Allow contributors to run linting easily on local 
Signed-off-by: Marco Franssen <[email protected]>
 2023-06-17 03:42:41 +02:00
Faisal Memon e88f7f6fe2 Add configmap annotation to spire-bundle configmap (#351) 2023-06-16 23:22:44 +02:00
Drew WellsandKevin Fox 020bde8561 Add support to create a issuer and CA via cert-manager (#342) 
Co-authored-by: Kevin Fox <[email protected]>
 2023-06-16 21:04:11 +00:00
Faisal Memon 9d504de05b Ignore .DS_Store files 
Signed-off-by: Faisal Memon <[email protected]>
 2023-06-16 17:30:51 +02:00
kfox1111 e6b608c9fd Bump spire images to 1.7.0 (#348) 2023-06-16 07:26:59 +00:00
kfox1111 c97a788c85 Fix bundle role/rolebinding naming conflict (#333) 2023-06-16 08:55:49 +02:00
dependabot[bot] b66077eff1 Bump peter-evans/create-pull-request from 5.0.1 to 5.0.2 (#349) 
Bumps
[peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request)
from 5.0.1 to 5.0.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/peter-evans/create-pull-request/releases">peter-evans/create-pull-request's
releases</a>.</em></p>
<blockquote>
<h2>Create Pull Request v5.0.2</h2>
<p>⚙️ Fixes an issue that occurs when using <code>push-to-fork</code>
and both base and head repositories are in the same org/user
account.</p>
<h2>What's Changed</h2>
<ul>
<li>fix: specify head repo by <a
href="https://github.com/peter-evans"><code>@​peter-evans</code></a> in
<a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/2044">peter-evans/create-pull-request#2044</a></li>
<li>20 dependency updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/peter-evans/create-pull-request/compare/v5.0.1...v5.0.2">https://github.com/peter-evans/create-pull-request/compare/v5.0.1...v5.0.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/153407881ec5c347639a548ade7d8ad1d6740e38"><code>1534078</code></a>
fix: specify head repo (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2044">#2044</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/143be5d671929f35a2d146afde2bbf411a1cdae7"><code>143be5d</code></a>
build(deps-dev): bump <code>@​typescript-eslint/parser</code> from
5.59.9 to 5.59.11 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2048">#2048</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/51e8ca23403d80681e9ee4d3a6f2a7749650103f"><code>51e8ca2</code></a>
build(deps-dev): bump <code>@​types/node</code> from 18.16.16 to
18.16.18 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2047">#2047</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/712add83f26c1e359c046a6ca3dd677fb7017626"><code>712add8</code></a>
build(deps-dev): bump <code>@​types/jest</code> from 29.5.1 to 29.5.2
(<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2026">#2026</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/a9e8aabc8b4513752b51efcb32d166e65979b3e5"><code>a9e8aab</code></a>
build(deps-dev): bump eslint from 8.41.0 to 8.42.0 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2024">#2024</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/37be4ffd941e930a6dc8d42c5a893e62760a6105"><code>37be4ff</code></a>
build(deps-dev): bump <code>@​typescript-eslint/parser</code> from
5.59.8 to 5.59.9 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2023">#2023</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/a5f0e5dc8e47c41b694db6acd592fb79ff9be31f"><code>a5f0e5d</code></a>
build(deps-dev): bump eslint-plugin-github from 4.7.0 to 4.8.0 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2025">#2025</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/9ef70ee495af6d0ff9825b3e6050f304a290283a"><code>9ef70ee</code></a>
build(deps-dev): bump <code>@​types/node</code> from 18.16.14 to
18.16.16 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2009">#2009</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/0a287739d3c2d8485ed6e8be96cba0ab8ce870ee"><code>0a28773</code></a>
build(deps-dev): bump <code>@​typescript-eslint/parser</code> from
5.59.7 to 5.59.8 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2008">#2008</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/4ddb8c8fe7f58d02d4d1d62359fd91fe4d54361d"><code>4ddb8c8</code></a>
build: update distribution (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/1986">#1986</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/peter-evans/create-pull-request/compare/v5.0.1...v5.0.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=peter-evans/create-pull-request&package-manager=github_actions&previous-version=5.0.1&new-version=5.0.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-06-15 09:53:51 -07:00
kfox1111 d0da864113 Add missing metadata to subcharts (#347) 2023-06-14 12:46:22 -07:00
kfox1111 4c0a1d52c5 Allow overriding test images (#186) 2023-06-14 21:17:08 +02:00
kfox1111 250fd5db00 Add missing global values to charts (#311) 2023-06-14 09:16:02 +02:00
Drew Wells 5d8c9079a1 Dropping k8s versions in CI older than 3, as per readme (#344) 2023-06-13 11:54:30 -07:00
Drew Wells 8748933548 Update upstream-ca-secret.yaml (#341) 
Fix an issue with nested context being used for namespace

Fixes this issue:
```
Error: UPGRADE FAILED: template: spire/charts/spire-server/templates/upstream-ca-secret.yaml:8:16: executing "spire/charts/spire-server/templates/upstream-ca-secret.yaml" at <include "spire-server.names
pace" .>: error calling include: template: spire/charts/spire-server/templates/_helpers.tpl:30:16: executing "spire-server.namespace" at <.Values.namespaceOverride>: nil pointer evaluating interface {}.
namespaceOverride
helm.go:84: [debug] template: spire/charts/spire-server/templates/upstream-ca-secret.yaml:8:16: executing "spire/charts/spire-server/templates/upstream-ca-secret.yaml" at <include "spire-server.namespac
e" .>: error calling include: template: spire/charts/spire-server/templates/_helpers.tpl:30:16: executing "spire-server.namespace" at <.Values.namespaceOverride>: nil pointer evaluating interface {}.nam
espaceOverride
```

Signed-off-by: Drew Wells <[email protected]>
 2023-06-12 11:25:14 -07:00
kfox1111 4e07450781 Fix ingress annotations for federation (#337) 
fixes: https://github.com/spiffe/helm-charts/issues/336

Signed-off-by: Kevin Fox <[email protected]>
 2023-06-12 05:50:26 -07:00
dependabot[bot] ea09199196 Bump actions/checkout from 3.5.0 to 3.5.3 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3.5.0 to 3.5.3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3.5.0...v3.5.3)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-06-12 10:11:23 +02:00
Edwin Buck 87fe19888b Merge pull request #331 from edwbuck/key_conventions 
Initial submission of Helm Chart key naming conventions.
 2023-06-09 11:51:55 -05:00
Edwin Buck ddc0166689 Fix line wrapping. 
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-09 11:47:11 -05:00
Edwin Buckandkfox1111 0cae9ce7c7 Update project/conventions.md 
Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-09 11:08:10 -05:00
Edwin Buckandkfox1111 cb18255815 Update project/conventions.md 
Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-09 11:07:51 -05:00
Mariusz SabathandEdwin Buck 52e5c24947 Upgrade Tornjak to image v1.2.2 (#328) 
Upgrade Tornjak image to version v1.2.2
(https://github.com/spiffe/tornjak/releases/tag/v1.2.2)

- Resolving issue #326 (remove an emergency patch) 
- Refactor and improve Tornajk image build process

---------

Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Edwin Buck <[email protected]>
 2023-06-08 14:29:01 -04:00
Edwin Buck 28e2abf762 Choose a different example for dotted Acronyms. 
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-08 07:00:12 -07:00
Edwin Buck d60d68c131 Added accidentally clipped explicit name guidelines. 
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-08 06:54:49 -07:00
Edwin Buck abe9fde697 Merge branch 'main' into key_conventions 2023-06-07 14:37:13 -05:00
Edwin BuckandMarco Franssen f6a7b62d98 Update project/conventions.md 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-07 14:36:59 -05:00
Edwin BuckandFaisal Memon c4d19db98d Update project/conventions.md 
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-07 14:33:00 -05:00
github-actions[bot] cfa9f78885 Bump test chart dependencies (#332) 2023-06-05 16:46:48 -07:00
Edwin Buck c3213abe37 Initial submission of Helm Chart key naming conventions. 
Closes #329

Signed-off-by: Edwin Buck <[email protected]>
 2023-06-03 09:58:50 -07:00
github-actions[bot]andmarcofranssen 28c0824714 Bump test chart dependencies (#322) 
Co-authored-by: marcofranssen <[email protected]>
 2023-06-02 08:37:25 +02:00
Marco Franssen d333154369 Add Makefile for local testing (#327) 2023-05-30 16:19:23 -07:00
Mariusz Sabath 9fa1ec28a7 Improve Tornjak backend test (#321) 2023-05-30 23:29:29 +02:00
Mariusz Sabath 5b779dc88a Improve Tornjak frontend test (#320) 2023-05-30 23:28:35 +02:00
Marco Franssen 71d110e730 Bump python + helm in CI workflow (#325) 
Signed-off-by: Marco Franssen <[email protected]>

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-30 09:12:22 -07:00
Marco Franssen dddefd88c0 Bump spire Helm Chart version from 0.8.0 to 0.8.1 
* d83d6a8e Emergency patch for Tornjak Frontend (#319)
* ed172e41 Bump k8s versions to latest patches (#317)
* 05629460 Removed pull_request edited event from ci workflow (#318)
* 3cb55dfb Allow for having no registry specified (#312)
* 1247b68f Parametrize probes (#310)

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-30 18:10:31 +02:00
Mariusz SabathandFaisal Memon d83d6a8efe Emergency patch for Tornjak Frontend (#319) 
Tornjak Frontend serves incorrect dashboard due to restricted namespace.
Fixing the cache file location leads to this error:
```Error: EACCES: permission denied, open './build/env.js'```

Solution, to redirect the env.js output to writeable space e.g. /tmp

Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-05-26 21:50:41 -07:00
Marco FranssenandFaisal Memon ed172e41ae Bump k8s versions to latest patches (#317) 
@faisal-memon we will need to update the required checks in branch
protection to use the new version

---------

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Faisal Memon <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-05-26 21:41:53 -07:00
Marco Franssen 05629460ef Removed pull_request edited event from ci workflow (#318) 
Edited event is only useful if you want a workflow to act on a PR
description or title or labels and such, we are not doing that in this
workflow.

Removing the edited type from the event doesn't unnecessarily run the
workflow again when title, description and such are changed.

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-26 08:13:45 -07:00
Faisal Memon 3cb55dfb4e Allow for having no registry specified (#312) 2023-05-25 14:15:46 -07:00
Mariusz Sabath 1247b68f4d Parametrize probes (#310) 
This PR addresses #307 by parametrizing Probes and moving them to
values.yaml

---------

Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-25 08:53:44 -04:00