Commit Graph
29 Commits
Author SHA1 Message Date
Mariusz Sabathandkfox1111 c37de1ea0c Fix Tornjak logsDir for Openshift (#344)
* Fix Tornjak logsDir for Openshift

Signed-off-by: Mariusz Sabath <[email protected]>

* Update docs

Signed-off-by: Mariusz Sabath <[email protected]>

* Update charts/spire/charts/tornjak-frontend/templates/_helpers.tpl

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

---------

Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
2024-05-03 08:04:38 -07:00
a2494ee45e Add auth option for Tornjak (#259)
* Added auth option, specifically keycloak for tornjak production use

Signed-off-by: Mohammed Abdi <[email protected]>

* Added auth values for tornjak

Signed-off-by: Mohammed Abdi <[email protected]>

* Update charts/spire/charts/tornjak-frontend/values.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Mohammed Abdi <[email protected]>

* Update examples/tornjak/keycloak/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Mohammed Abdi <[email protected]>

* Update examples/tornjak/keycloak/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Mohammed Abdi <[email protected]>

* Update examples/tornjak/keycloak/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Mohammed Abdi <[email protected]>

* Update examples/tornjak/keycloak/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Mohammed Abdi <[email protected]>

* Update examples/tornjak/keycloak/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Mohammed Abdi <[email protected]>

* Update examples/tornjak/keycloak/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Mohammed Abdi <[email protected]>

* nit

Signed-off-by: Mohammed Abdi <[email protected]>

* nit

Signed-off-by: Mohammed Abdi <[email protected]>

* nit

Signed-off-by: Mohammed Abdi <[email protected]>

* Update examples/tornjak/keycloak/README.md

Co-authored-by: Mariusz Sabath <[email protected]>
Signed-off-by: Mohammed Abdi <[email protected]>

* nit

Signed-off-by: Mohammed Abdi <[email protected]>

* install keycloak first

Signed-off-by: Mohammed Abdi <[email protected]>

* add logs volume back

Signed-off-by: Mohammed Abdi <[email protected]>

* Fixed NPM init error

Signed-off-by: Mariusz Sabath <[email protected]>

* Fixed the values documentation errors

Signed-off-by: Mariusz Sabath <[email protected]>

* Post-review suggestion fixes

Signed-off-by: Mariusz Sabath <[email protected]>

* Fixed typo

Signed-off-by: Mariusz Sabath <[email protected]>

* Updating Keyclaok examples README

Signed-off-by: Mariusz Sabath <[email protected]>

* Fixed the parameter reference

Signed-off-by: Mariusz Sabath <[email protected]>

* Fix typo

Signed-off-by: Mariusz Sabath <[email protected]>

* use keycloak-config-cli to simplify tornjak realm import

Signed-off-by: MohammedAbdi <[email protected]>

* edit client id

Signed-off-by: MohammedAbdi <[email protected]>

* reverse client id

Signed-off-by: MohammedAbdi <[email protected]>

* fix the doc

Signed-off-by: Mariusz Sabath <[email protected]>

* update tornjak version and backend auth

Signed-off-by: MohammedAbdi <[email protected]>

* update client id

Signed-off-by: MohammedAbdi <[email protected]>

* updates values yaml

Signed-off-by: MohammedAbdi <[email protected]>

* update documentation

Signed-off-by: MohammedAbdi <[email protected]>

* nit

Signed-off-by: MohammedAbdi <[email protected]>

* update doc

Signed-off-by: MohammedAbdi <[email protected]>

* add audience check tornjak

Signed-off-by: MohammedAbdi <[email protected]>

* remove unused file

Signed-off-by: MohammedAbdi <[email protected]>

* update doc

Signed-off-by: MohammedAbdi <[email protected]>

* nit and add auth not enabled warning back

Signed-off-by: MohammedAbdi <[email protected]>

* adjust liveness probe until tornjak handles liveendpoint for auth and direct connection to discovery

Signed-off-by: MohammedAbdi <[email protected]>

* update doc and add keycloak proxy

Signed-off-by: MohammedAbdi <[email protected]>

---------

Signed-off-by: Mohammed Abdi <[email protected]>
Signed-off-by: Mohammed Abdi <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: MohammedAbdi <[email protected]>
Co-authored-by: Mohammed Abdi <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
2024-04-25 15:49:20 -07:00
kfox1111andMarco Franssen 49beb64584 Add recommendation for namespaceLayout (#127)
Co-authored-by: Marco Franssen <[email protected]>
2023-12-19 15:02:57 +00:00
kfox1111andMarco Franssen 6997d6a904 Add recommendation for securityContext and podSecurityContext (#125)
Co-authored-by: Marco Franssen <[email protected]>
2023-12-19 11:26:26 +00:00
kfox1111 9f72a8f971 Use good and automatic defaults for tornjak frontend workingDir (#129)
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
2023-12-11 07:52:44 -08:00
kfox1111andMariusz Sabath 7726351955 Tornjak UBI support (#123)
* Tornjak UBI support

The Tornjak containers now have two different flavors. Vanilla and UBI.
Automatically select the UBI image when deploying on OpenShift.

Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
2023-12-11 06:56:58 -08:00
Mariusz Sabath c9885de539 Introduce ReadOnlyRootFilesystem for Tornjak frontend (#110)
Signed-off-by: Mariusz Sabath <[email protected]>
2023-11-16 15:47:04 -08:00
6c0a4fbb86 Auto tornjak url (#89)
* Autogen jwtIssuer

Unset a default for jwtIssuer and global.spire.jwtIssuer. When unset,
generate it to the default of oidc-discovery.$trustDomain so in many
cases the user doesn't need to set it at all.

Signed-off-by: Kevin Fox <[email protected]>

* Autogen tornjak's apiServerURL

Unset the default tornjak apiServerURL. When unset, default to
https://tornjak-backend.$trustDomain so in many cases users don't
have to set it.

Signed-off-by: Kevin Fox <[email protected]>

* Do more autodetection

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-11-09 13:07:52 -08:00
81cc2dc573 Ingress type openshift (#52)
* Specify ingress controller type

Signed-off-by: Kevin Fox <[email protected]>

* Fix indenting, docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix spacing

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Add ingress-nginx support

Signed-off-by: Kevin Fox <[email protected]>

* Use the right example values for test version to upgrade from.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var in wrong location

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing arg

Signed-off-by: Kevin Fox <[email protected]>

* Try this to checkout the right version

Signed-off-by: Kevin Fox <[email protected]>

* Switch to upgrading from 0.14.0

Signed-off-by: Kevin Fox <[email protected]>

* Install crds

Signed-off-by: Kevin Fox <[email protected]>

* Simple ingress support

For a lot of situations, ingress rules can be derived from trustDomain.
Change the code to generate rules by default for the user.

Signed-off-by: Kevin Fox <[email protected]>

* Add upgrade test fix from 43

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Enable unset ingress controller type to use with openshift later

Signed-off-by: Kevin Fox <[email protected]>

* Openshift ingress controller type support

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing end tag

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Fix doc merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Fix automatically generated rules on openshift

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Fix pathType

Signed-off-by: Kevin Fox <[email protected]>

* Make openshift edge rules work

Signed-off-by: Kevin Fox <[email protected]>

* Fix var scoping

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix issue created during merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
2023-11-03 13:16:14 -07:00
3b016841da Support Openshift deployment (#13)
* Add support for SPIRE deployment on OpenShift 4.13

Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Trilok Geer <[email protected]>
Co-authored-by: Andrew Block <[email protected]>

* Render README

Signed-off-by: Mariusz Sabath <[email protected]>

* Fix tornjak HTTP/HTTPS port values

Signed-off-by: Mariusz Sabath <[email protected]>

* Update Frontend README

Signed-off-by: Mariusz Sabath <[email protected]>

* Add env. variable to Agent to inject node name

Signed-off-by: Mariusz Sabath <[email protected]>

* Implement Marco's suggestion on CSI CSS version

Signed-off-by: Mariusz Sabath <[email protected]>

* Add MY_NODE_NAME env. variable to agent for openshift example

Signed-off-by: Mariusz Sabath <[email protected]>

* Move Openshift examples to dedicated directory

Signed-off-by: Mariusz Sabath <[email protected]>

* Simplified the install instructions

Signed-off-by: Mariusz Sabath <[email protected]>

* Suggested changes

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Andrew Block <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs, fix default for backwards compat

Signed-off-by: Kevin Fox <[email protected]>

* Don't recommend experimental features by default, dont debug helm install by default and explain how to add additional features

Signed-off-by: Kevin Fox <[email protected]>

* Add notes about openshift to the project for other reviewers.

Signed-off-by: Kevin Fox <[email protected]>

* Fix incorrectly reverted change

Signed-off-by: Kevin Fox <[email protected]>

* Correct notes

Signed-off-by: Kevin Fox <[email protected]>

* Update default

Signed-off-by: Kevin Fox <[email protected]>

* Fix issue created from bad merge conflict resolution

Signed-off-by: kfox1111 <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

---------

Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Trilok Geer <[email protected]>
Co-authored-by: Andrew Block <[email protected]>
Co-authored-by: Kevin Fox <[email protected]>
2023-10-31 16:27:23 +00:00
kfox1111andFaisal Memon ed23d8b714 Simple ingress support (#48)
Co-authored-by: Faisal Memon <[email protected]>
2023-10-30 22:16:17 +00:00
kfox1111andFaisal Memon 7924323a8f Specify ingress controller type (#43)
* Specify ingress controller type

Signed-off-by: Kevin Fox <[email protected]>

* Fix indenting, docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix spacing

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Add ingress-nginx support

Signed-off-by: Kevin Fox <[email protected]>

* Use the right example values for test version to upgrade from.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var in wrong location

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing arg

Signed-off-by: Kevin Fox <[email protected]>

* Try this to checkout the right version

Signed-off-by: Kevin Fox <[email protected]>

* Switch to upgrading from 0.14.0

Signed-off-by: Kevin Fox <[email protected]>

* Install crds

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Enable unset ingress controller type to use with openshift later

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs after merge issue

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-10-24 20:18:53 +00:00
Mariusz SabathandMarco Franssen 03ff618958 Add Tornjak ingress (#16)
Co-authored-by: Marco Franssen <[email protected]>
2023-10-09 11:31:55 +00:00
kfox1111 4c0a1d52c5 Allow overriding test images (#186) 2023-06-14 21:17:08 +02:00
Mariusz SabathandEdwin Buck 52e5c24947 Upgrade Tornjak to image v1.2.2 (#328)
Upgrade Tornjak image to version v1.2.2
(https://github.com/spiffe/tornjak/releases/tag/v1.2.2)

- Resolving issue #326 (remove an emergency patch) 
- Refactor and improve Tornajk image build process

---------

Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Edwin Buck <[email protected]>
2023-06-08 14:29:01 -04:00
Mariusz Sabath 5b779dc88a Improve Tornjak frontend test (#320) 2023-05-30 23:28:35 +02:00
Mariusz SabathandFaisal Memon d83d6a8efe Emergency patch for Tornjak Frontend (#319)
Tornjak Frontend serves incorrect dashboard due to restricted namespace.
Fixing the cache file location leads to this error:
```Error: EACCES: permission denied, open './build/env.js'```

Solution, to redirect the env.js output to writeable space e.g. /tmp

Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-05-26 21:50:41 -07:00
Mariusz Sabath e4447fd8eb Upgrade Tornjak to new image v1.2.1 (#299)
This upgrade enables the production version of React in Tornjak Frontend
with a smaller footprint and faster startup time.

Using Tornjak v1.2.1 release
https://github.com/spiffe/tornjak/releases/tag/v1.2.1

---------

Signed-off-by: Mariusz Sabath <[email protected]>
2023-05-23 13:32:20 -04:00
Marco Franssen b30b412edb Tornjak reuse spire-lib.cluster-domain macro (#292)
Resolves #291

Signed-off-by: Marco Franssen <[email protected]>
2023-05-17 12:42:17 -07:00
Marco Franssen 391f093ae9 Allow to configure topologySpreadConstraints for tornjak-frontend
Signed-off-by: Marco Franssen <[email protected]>
2023-05-16 20:29:41 +02:00
Marco Franssen 5cc26d3142 Allow to configure tolerations for tornjak-frontend
Signed-off-by: Marco Franssen <[email protected]>
2023-05-16 20:29:41 +02:00
Marco Franssen 3537161cdf Allow to configure affinity for tornjak-frontend
Signed-off-by: Marco Franssen <[email protected]>
2023-05-16 20:29:41 +02:00
Marco Franssen ee43c5e36f Add nodeSelector for tornjak
Tornjak only supports amd64 builds at the moment

To prevent deployment failures on clusters with arm64 nodes I have added a nodeSelector for tornjak frontend, and documentation for spire-server

Signed-off-by: Marco Franssen <[email protected]>
2023-05-16 20:20:32 +02:00
Mariusz SabathandMarco Franssen 382e0d4a47 Upgrade Tornjak image to version v1.2.0 (#259)
Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
2023-05-16 19:31:38 +02:00
Mariusz SabathandMarco Franssen 657c460e67 Update charts/spire/charts/tornjak-frontend/templates/service.yaml
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>
2023-05-16 19:31:38 +02:00
Marco Franssen 6ddf6ab9fa Improve tornjak docs (#276)
- Align tornjak backend naming with same convention as frontend
- Align Tornjak backend and frontend notes style
- Add disclaimer for Tornjak usage to example

---------

Signed-off-by: Marco Franssen <[email protected]>
2023-05-16 19:31:38 +02:00
kfox1111 1675997748 Tornjak global image fix (#228)
This pr updates the Tornjak branch to work with the merged global
registry configuration support.

Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
2023-05-16 19:31:38 +02:00
Mariusz Sabath bdba97b629 Add empty directory to Tornjak to support npm cache (#224)
Resolves issue #223

Signed-off-by: Mariusz Sabath <[email protected]>
2023-05-16 19:31:38 +02:00
Mariusz SabathandMarco Franssen da186c5f53 Split Tornjak Frontend into separate subchart (#179)
Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
2023-05-16 19:31:38 +02:00