panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
447 Commits 1 Branch 2 Tags
bfec27ef6723d3f8a4d46d8a1459f82a772d9274
Commit Graph
136 Commits
Author SHA1 Message Date
Drew Wells bfec27ef67 Fix jwtIssuer to allow for Uris including scheme (#425) 2023-08-09 16:53:21 +02:00
Mariusz Sabath 7a6e4f8d75 Change Tornjak backend default port (#436) 2023-08-09 16:46:08 +02:00
Faisal Memon 1e3039ccb9 Bump spire Helm Chart version from 0.11.0 to 0.11.1 (#419) 
Please review the below changelog to ensure this matches up with the
semantic version being applied.

**Note**: As this is a patch release we will make a cherry-picked
release using a followup PR targetering the release branch. Will
cherrypick the following commits into this patch release + the commit
bumping this version number.

**Changes in this release**

* d2e1606 issuer naming should respect issuer_name override (#378)
* a09e054 support annotations so oidc can be annotated (#391)
* 7d94b10 Update spire to 1.7.1 (#412)
* 9a6768b Add support for disabling container selectors (#399)
* 624ca9c Remove misadded lockfile (#400)

Signed-off-by: Faisal Memon <[email protected]>
 2023-08-03 09:12:03 -07:00
Drew WellsandFaisal Memon a09e054d04 support annotations so oidc can be annotated (#391) 
Signed-off-by: Drew Wells <[email protected]>
Signed-off-by: Drew Wells <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-07-31 10:54:01 -07:00
kfox1111 7d94b105ab Update spire to 1.7.1 (#412) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-07-28 23:01:26 +02:00
Petr McAllisterMarco Franssenkfox1111
 		9f4d4ace84 Add aws_pca to the spire-server (#404) 
This change allows aws_pca to be configured via values of this chart.

__Requires 1.7.1 version__ per
[bug](https://github.com/spiffe/spire/issues/4351) - this will not work
until 1.7.1 is released.

---------

Signed-off-by: Petr McAllister <[email protected]>
Signed-off-by: Petr McAllister <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2023-07-27 14:27:51 -07:00
Faisal Memon 9a6768bca1 Add support for disabling container selectors (#399) 2023-07-27 13:27:57 -04:00
kfox1111 e16210c653 Merge branch 'main' into persistence-type 2023-07-21 09:36:18 -07:00
Marco Franssen 1898a18f0b Bump spire Helm Chart version from 0.10.1 to 0.11.0 (#394) 2023-07-19 15:23:43 -07:00
Kevin Fox a6bdb4d1e7 Add persistence type flag 
This patch adds a type flag to the persistence settings to enable
specifying the backing volume's type.

Signed-off-by: Kevin Fox <[email protected]>
 2023-07-19 23:40:23 +02:00
Marco Franssen 088b29608e Improve tornjak service API to have object structure (#392) 2023-07-19 09:17:45 -07:00
Marco Franssen 522066e9f9 Align tornjak clientCA naming convention (#393) 2023-07-19 09:13:50 -07:00
Mariusz SabathandMarco Franssen f05cb4fe1e Add option to configure TLS/mTLS endpoint for Tornjak (#338) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-07-19 14:32:32 +02:00
kfox1111 3ed1859cd1 Add missing tolerations config to daemonsets (#381) 
spiffe-csi-driver and spire-agent are missing the ability to specify
tolerations. This PR adds the missing functionality.

fixes: https://github.com/spiffe/helm-charts/issues/380

Signed-off-by: Kevin Fox <[email protected]>
 2023-07-06 12:48:59 -05:00
kfox1111andMarco Franssen c1b1dd3d88 Add additional domains to JWT issued items. (#230) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-07-03 22:26:28 +02:00
Marco Franssen ac5977288e Bump spire Helm Chart version from 0.10.0 to 0.10.1 
* d7a03f62 Fix bug in cert-manager upstream authority
* e57c13ac Bump test chart dependencies (#370)

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-30 16:06:21 +02:00
Marco Franssen 5500d36b1a Bump spire Helm Chart version from 0.9.1 to 0.10.0 
* f4c421af Ensure the released OCI artifact is also captured in rekor
* 386e736e Bump sigstore/cosign-installer from 3.0.5 to 3.1.0 (#368)
* 99e01c67 Bump spire-controller-manager from 0.2.2 to 0.2.3 (#367)
* 4dccb0d3 Bump spire Helm Chart version from 0.9.0 to 0.9.1 (#365)
* 8409674a Fix the init container flags of the statefulset (#366)
* 3b666601 add missing federatesWith option (#361)
* 0533d925 fixes missing template (#362)
* 1333b6ab Always add parseTime=true for mysql query string (#352)
* ac3be716 Bump test chart dependencies (#358)

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-28 19:01:25 +02:00
Marco Franssen 99e01c6722 Bump spire-controller-manager from 0.2.2 to 0.2.3 (#367) 
resolves a bunch of vulnerabilities in the Image

Signed-off-by: Marco Franssen <[email protected]>

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-22 16:16:43 -07:00
Marco Franssen 4dccb0d3b6 Bump spire Helm Chart version from 0.9.0 to 0.9.1 (#365) 2023-06-22 18:57:33 +02:00
Drew Wells 3b6666016c add missing federatesWith option (#361) 
DEMO

```
spire-server-0 -- spire-server entry show -spiffeID spiffe://box-4.example.com/ns/dwells/sa/dwells-rc-realm-client
Defaulted container "spire-server" out of: spire-server, spire-controller-manager, wait (init)
Found 1 entry
Entry ID         : 09301666-010e-4ba9-9dcb-44370d4e49e4
SPIFFE ID        : spiffe://box-4.example.com/ns/dwells/sa/dwells-rc-realm-client
Parent ID        : spiffe://box-4.example.com/spire/agent/k8s_psat/example-cluster/ff93872d-791f-4bf3-a532-475775d03d3e
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : k8s:pod-uid:40e0bcad-6ec8-460b-a839-659654549d7a
FederatesWith    : box-3.example.com
```

Signed-off-by: Drew Wells <[email protected]>
 2023-06-22 08:45:37 -07:00
Marco Franssen 44f3554708 Bump spire Helm Chart version from 0.8.1 to 0.9.0 
* 57a9320 Add SPIRE 1.7.0 to main readme (#357)
* af36f7c Align the bash image version with other instances for spire-agent (#356)
* c11a8c0 Implement pre-delete hook for graceful delete of spiffe-oidc-discovery-provider (#353)
* a6dcf26 Allow for SPIRE Agent to run as non root user (#209)
* 9cf6049 Allow contributors to run linting easily on local
* e88f7f6 Add configmap annotation to spire-bundle configmap (#351)
* 020bde8 Add support to create a issuer and CA via cert-manager (#342)
* 9d504de Ignore .DS_Store files
* e6b608c Bump spire images to 1.7.0 (#348)
* c97a788 Fix bundle role/rolebinding naming conflict (#333)
* b66077e Bump peter-evans/create-pull-request from 5.0.1 to 5.0.2 (#349)
* d0da864 Add missing metadata to subcharts (#347)
* 4c0a1d5 Allow overriding test images (#186)
* 250fd5d Add missing global values to charts (#311)
* 5d8c907 Dropping k8s versions in CI older than 3, as per readme (#344)
* 8748933 Update upstream-ca-secret.yaml (#341)
* 4e07450 Fix ingress annotations for federation (#337)
* ea09199 Bump actions/checkout from 3.5.0 to 3.5.3
* 87fe198 Merge pull request #331 from edwbuck/key_conventions
* ddc0166 Fix line wrapping.
* 0cae9ce Update project/conventions.md
* cb18255 Update project/conventions.md
* 52e5c24 Upgrade Tornjak to image v1.2.2 (#328)
* 28e2abf Choose a different example for dotted Acronyms.
* d60d68c Added accidentally clipped explicit name guidelines.
* abe9fde Merge branch 'main' into key_conventions
* f6a7b62 Update project/conventions.md
* c4d19db Update project/conventions.md
* cfa9f78 Bump test chart dependencies (#332)
* c3213ab Initial submission of Helm Chart key naming conventions.
* 28c0824 Bump test chart dependencies (#322)
* d333154 Add Makefile for local testing (#327)
* 9fa1ec2 Improve Tornjak backend test (#321)
* 5b779dc Improve Tornjak frontend test (#320)

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-20 00:14:48 +02:00
Marco Franssen af36f7c09b Align the bash image version with other instances for spire-agent (#356) 
Signed-off-by: Marco Franssen <[email protected]>

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-19 11:28:35 -07:00
Marco Franssen c11a8c00e7 Implement pre-delete hook for graceful delete of spiffe-oidc-discovery-provider (#353) 2023-06-17 06:06:27 -07:00
kfox1111Marco FranssenFaisal Memon
 		a6dcf267d1 Allow for SPIRE Agent to run as non root user (#209) 
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-06-17 10:32:41 +02:00
Drew WellsandKevin Fox 020bde8561 Add support to create a issuer and CA via cert-manager (#342) 
Co-authored-by: Kevin Fox <[email protected]>
 2023-06-16 21:04:11 +00:00
kfox1111 e6b608c9fd Bump spire images to 1.7.0 (#348) 2023-06-16 07:26:59 +00:00
Mariusz SabathandEdwin Buck 52e5c24947 Upgrade Tornjak to image v1.2.2 (#328) 
Upgrade Tornjak image to version v1.2.2
(https://github.com/spiffe/tornjak/releases/tag/v1.2.2)

- Resolving issue #326 (remove an emergency patch) 
- Refactor and improve Tornajk image build process

---------

Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Edwin Buck <[email protected]>
 2023-06-08 14:29:01 -04:00
Marco Franssen dddefd88c0 Bump spire Helm Chart version from 0.8.0 to 0.8.1 
* d83d6a8e Emergency patch for Tornjak Frontend (#319)
* ed172e41 Bump k8s versions to latest patches (#317)
* 05629460 Removed pull_request edited event from ci workflow (#318)
* 3cb55dfb Allow for having no registry specified (#312)
* 1247b68f Parametrize probes (#310)

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-30 18:10:31 +02:00
Mariusz Sabath 1247b68f4d Parametrize probes (#310) 
This PR addresses #307 by parametrizing Probes and moving them to
values.yaml

---------

Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-25 08:53:44 -04:00
Marco Franssen efdeb2e123 Bump spire Helm Chart version from 0.7.0 to 0.8.0 
* c1c5b112 Merge pull request #306 from spiffe/remove-1.21
* 0df45e3c Fix up docs
* ed038fea Upgrade to spire 1.6.4 (#308)
* dc5d9cfe Fix root README.md
* e4447fd8 Upgrade Tornjak to new image v1.2.1 (#299)
* 69f402ec Update docs
* 38d51d59 Apply suggestions from code review
* a1ba235c Update docs
* 1922085b Fix hooks for K3s (#305)
* 4fb549e9 Remove 1.21.x testing
* 88efc77b Allow to use spire-server as an upstream authority (#304)
* 0ba03880 Add support for spire-server ingress (#68)
* 4777a300 Bump test chart dependencies (#301)
* 00c2c1a5 Fix the generated pr so that it runs jobs too (#303)
* dd1ad495 Update images for cve's found by the cronjob (#290)
* 1c694707 Updated Tornjak documenation with Not-for-production labels (#297)
* 78096374 Merge pull request #296 from spiffe/dependabot/github_actions/helm/kind-action-1.7.0
* e61ed17b Merge pull request #295 from spiffe/dependabot/github_actions/sigstore/cosign-installer-3.0.5
* 9975e58f Merge pull request #245 from spiffe/tags
* 7bb7ece1 Bump helm/kind-action from 1.6.0 to 1.7.0
* f1623a59 Bump sigstore/cosign-installer from 3.0.4 to 3.0.5
* f8db5a31 Fix Tornjak persistence issue (#294)
* b30b412e Tornjak reuse spire-lib.cluster-domain macro (#292)
* 90c9eb50 Fix kubectl-image macro to handle version deprecation
* 300d1ccf Apply deprecation of image.version to Tornjak
* d8504864 Instead of removing version, first deprecate version
* 59e422b9 Add documentation for all image.tag values
* d1f3cdb9 Switch image.version to image.tag
* 31ce704f Cleanup maintainer handbook (#287)
* a2da9437 Remove manual dispatch from dummy workflow (#288)
* 807558bb Bump helm/kind-action from 1.5.0 to 1.6.0 (#285)
* 3df67dbb Bump sigstore/cosign-installer from 3.0.3 to 3.0.4 (#286)
* 5505d41d Merge pull request #283 from spiffe/additional-k8s-native-feature-tornjak-frontend
* 391f093a Allow to configure topologySpreadConstraints for tornjak-frontend
* 5cc26d31 Allow to configure tolerations for tornjak-frontend
* 3537161c Allow to configure affinity for tornjak-frontend
* aed6fdfe Use the correct kubectl for the cluster (#248)
* ee43c5e3 Add nodeSelector for tornjak
* fc13cbd9 Merge pull request #234 from spiffe/tornjak
* ed472aa9 Update documentation
* a11cfc99 Allow to define the resources for tornjak backend
* 382e0d4a Upgrade Tornjak image to version v1.2.0  (#259)
* 657c460e Update charts/spire/charts/tornjak-frontend/templates/service.yaml
* 7521cafc Update charts/spire/charts/spire-server/templates/tornjak-config.yaml
* b64c352b Update charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
* 6ddf6ab9 Improve tornjak docs (#276)
* 80d34f04 Use common post-install scripts for testing
* f5efa0ce Remove dead macros
* bd86518a Fixing shellcheck
* 91bdea2a Provide minimal resources to prevent accidental crashes due to resource exhaustion
* 16759977 Tornjak global image fix (#228)
* 5e827ee4 Add Tornjak Tests (#220)
* bdba97b6 Add empty directory to Tornjak to support npm cache (#224)
* da186c5f Split Tornjak Frontend into separate subchart (#179)
* 6d221263 Add Tornjak
* 2669d8b5 Add maintainer's handbook. (#265)
* 72596aea Skip tests for docs folders (#281)
* 7c71738d Bump test chart dependencies (#279)
* 05addae9 Add json to test path (#280)
* 8d9b7349 Switch the spire tests to always run (#250)

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-25 14:22:31 +02:00
Edwin Buck c1c5b112c0 Merge pull request #306 from spiffe/remove-1.21 
Remove 1.21.x testing
 2023-05-23 18:33:58 -05:00
Kevin Fox 0df45e3cd8 Fix up docs 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 16:26:23 -07:00
kfox1111 ed038feae1 Upgrade to spire 1.6.4 (#308) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 16:17:34 -07:00
Mariusz Sabath e4447fd8eb Upgrade Tornjak to new image v1.2.1 (#299) 
This upgrade enables the production version of React in Tornjak Frontend
with a smaller footprint and faster startup time.

Using Tornjak v1.2.1 release
https://github.com/spiffe/tornjak/releases/tag/v1.2.1

---------

Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-23 13:32:20 -04:00
Kevin Fox 69f402ecc6 Update docs 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 09:56:05 -07:00
Kevin Fox a1ba235c99 Update docs 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 09:44:06 -07:00
kfox1111andMarco Franssen 88efc77bee Allow to use spire-server as an upstream authority (#304) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-05-23 14:39:37 +00:00
kfox1111Faisal MemonMarco Franssendependabot[bot]
 		0ba03880a1 Add support for spire-server ingress (#68) 
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-05-23 13:58:58 +00:00
kfox1111 dd1ad495bd Update images for cve's found by the cronjob (#290) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-18 14:55:39 -07:00
Mariusz Sabath 1c6947078a Updated Tornjak documenation with Not-for-production labels (#297) 2023-05-18 23:31:03 +02:00
Marco Franssen 300d1ccf28 Apply deprecation of image.version to Tornjak 
Signed-off-by: Marco Franssen <[email protected]>
 2023-05-17 20:21:07 +02:00
Marco Franssen d850486478 Instead of removing version, first deprecate version 
Deprecating version allows users of the chart to have a migration path

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-17 20:21:07 +02:00
Marco Franssen 59e422b9e3 Add documentation for all image.tag values 
Signed-off-by: Marco Franssen <[email protected]>
 2023-05-17 20:21:07 +02:00
Kevin Fox d1f3cdb909 Switch image.version to image.tag 
The convention in most charts is to use image.tag. This patch updates the values
to use it instead of the less standard image.version.

Signed-off-by: Kevin Fox <[email protected]>
 2023-05-17 20:21:07 +02:00
Marco Franssen 391f093ae9 Allow to configure topologySpreadConstraints for tornjak-frontend 
Signed-off-by: Marco Franssen <[email protected]>
 2023-05-16 20:29:41 +02:00
Marco Franssen 5cc26d3142 Allow to configure tolerations for tornjak-frontend 
Signed-off-by: Marco Franssen <[email protected]>
 2023-05-16 20:29:41 +02:00
Marco Franssen 3537161cdf Allow to configure affinity for tornjak-frontend 
Signed-off-by: Marco Franssen <[email protected]>
 2023-05-16 20:29:41 +02:00
kfox1111 aed6fdfe4e Use the correct kubectl for the cluster (#248) 2023-05-16 20:28:53 +02:00
Marco Franssen ee43c5e36f Add nodeSelector for tornjak 
Tornjak only supports amd64 builds at the moment

To prevent deployment failures on clusters with arm64 nodes I have added a nodeSelector for tornjak frontend, and documentation for spire-server

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-16 20:20:32 +02:00
Mariusz Sabath ed472aa98b Update documentation 
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-16 19:31:38 +02:00