panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
167 Commits 1 Branch 2 Tags
d341c5ad58268fe09dcbb7cce2fcdf8ac9e3aeba
Commit Graph
167 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
kfox1111 d341c5ad58 UpstreamAuthority cert-manager support (#82) 2023-03-03 20:48:35 +01:00
Kevin Fox a82ee694bf Make sure all configmap changes rollout 
Signed-off-by: Kevin Fox <[email protected]>
 2023-03-03 08:39:11 -08:00
Kevin Fox b7f8c86478 Add extra initContainers, containers, volumes to agent and server 
With plugin support, agents and servers need more customization.
This patch enables initContainers, extraContainers, extraVolumes
and extraVolumeMounts to be added to those services.

Signed-off-by: Kevin Fox <[email protected]>
 2023-03-02 08:02:19 -08:00
Marco Franssen 81ac89a911 Add k8s 1.26.0 (Kind) to the test matrix 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-02 13:08:37 +01:00
Marco Franssen bb6abfcd3a Merge pull request #76 from spiffe/dependabot/github_actions/sigstore/cosign-installer-3.0.1 2023-03-02 09:16:01 +01:00
Marco Franssen c0e5665702 Bump cosign to v2.0.0 
Cosign v2.0.0 doesn't require the experimental env var anymore

Signed-off-by: Marco Franssen <[email protected]>
 2023-03-02 09:15:46 +01:00
dependabot[bot] d729a4410c Bump sigstore/cosign-installer from 2.8.1 to 3.0.1 
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 2.8.1 to 3.0.1.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/v2.8.1...v3.0.1)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-03-02 01:14:59 +00:00
Marco Franssen fe7cd731d5 Merge pull request #74 from spiffe/arm64-support 2023-03-01 19:47:12 +01:00
Marco Franssen a3c04c0d22 Update supported versions 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-01 15:41:47 +01:00
Marco Franssen 75480ede45 Bump spiffe-csi-driver image to 0.2.3 (arm64 support) 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-01 15:41:47 +01:00
Marco Franssen 79889ff3ed Bump spiffe-oidc-discovery-provider image to 1.6.0 (arm64 support) 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-01 15:41:47 +01:00
Marco Franssen a632f76021 Bump spire-agent image to 1.6.0 (arm64 support) 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-01 15:41:47 +01:00
Marco Franssen b92e81d416 Bump spire-server image to 1.6.0 (arm64 support) 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-01 15:41:47 +01:00
Marco Franssen fea2aa59e2 Fix sigstore/cosign-installer usage in release workflow 
See https://github.com/sigstore/cosign-installer\#usage on proper usage

Resolves #66

Signed-off-by: Marco Franssen <[email protected]>
 2023-03-01 13:52:39 +01:00
Faisal Memon fe93346b66 Use quote function instead of actual quotes 
Signed-off-by: Faisal Memon <[email protected]>
 2023-03-01 11:10:08 +01:00
Faisal MemonandMarco Franssen 9480ab74b4 Add beta note to readme (#62) 
Signed-off-by: Faisal Memon <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-02-28 15:21:51 -08:00
kfox1111 4681498559 Better spire-server entry commands (#59) 
* Better spire-server entry commands

Currently in order to use the cli tools such as spire-server entry show
You must know the path within the container to the binary along with what
the path is to the socket. This patch makes that unnessisary. This now
works:
kubectl exec -it spire-server-0 -- spire-server entry show

Signed-off-by: Kevin Fox <[email protected]>

* Remove setting thats set to default

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
 2023-02-28 22:43:49 +01:00
Marco Franssen 72d4929670 Bump spire chart to v0.3.0 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-28 19:21:29 +01:00
Kevin Fox 9d7881f8b4 Switch hostpath to emptydir in spire-server 
The api of the server does not need to be exported out of the
server pod.

Signed-off-by: Kevin Fox <[email protected]>
 2023-02-28 09:49:13 -08:00
Marco Franssen f8cdec3f99 Allow to configure a priorityClassName for Daemonsets 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-27 08:09:00 -08:00
Marco Franssen ba41f04df5 Fix spire-controller-manager healthz port 
This to align with the spire-controller-manager-configmap.yaml

Signed-off-by: Marco Franssen <[email protected]>
 2023-02-27 08:08:17 -08:00
dependabot[bot] e754b3a6c8 Bump actions/checkout from 3.2.0 to 3.3.0 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3.2.0 to 3.3.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3.2.0...v3.3.0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-02-27 11:32:19 +01:00
kfox1111andMarco Franssen 35eb3bb42e Basic Prometheus support (#28) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-02-24 22:39:15 +01:00
Marco Franssen 495d9d67e8 Align healthz ports and checks across containers 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 21:06:09 +01:00
Faisal Memon 156052ada0 Merge pull request #40 from spiffe/update-contributing 
Clarify Chart version increments in CONTRIBUTING.md
 2023-02-24 11:34:08 -08:00
Marco FranssenandFaisal Memon ef6a6bd53d Improve sentence based on review 
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 20:33:42 +01:00
Marco Franssen 615b4341cc Clarify Chart version increments in CONTRIBUTING.md 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 20:16:47 +01:00
Marco Franssen 8ceb00efe6 Merge pull request #33 from spiffe/version-increment-check 2023-02-24 10:55:17 +01:00
Marco Franssen a29df4f6cc Change to cut releases from the release branch 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 10:55:00 +01:00
Marco Franssen e8768ec955 Add types to trigger workflow when changing the target branch 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 10:55:00 +01:00
Marco Franssen 3c7d828954 Only check for version bump if PR targets main 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 10:55:00 +01:00
Marco Franssen a95ef9f3db Use github.base_ref for target-branch 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 10:54:57 +01:00
kfox1111 f149f2ed82 Merge pull request #23 from spiffe/test-non-defaulted-values 
Test charts without defaulted values
 2023-02-23 09:08:15 -08:00
Marco Franssen 5dc93da6b8 Bump to latest Helm and Python versions 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:35:46 +01:00
Marco Franssen d46c3fc14d Test without ACME tos Accepted 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:35:46 +01:00
Marco Franssen 8d97803c8a Bump chart version to 0.2.0 and appVersion to 1.5.5 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:34:52 +01:00
Marco Franssen 49a68c3aed Add test for spire-oidc 
Using the nginx insecure option, because we can't rely on the ACME
protocol as this server isn't reachable.

Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:33:29 +01:00
Marco Franssen c9779b24ed Add test for upstream-authority-disk 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:33:28 +01:00
Marco Franssen b24faa9373 Add test for disabled spire-controller-manager 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:33:28 +01:00
Marco Franssen ec26d85f61 Enable spire-controller-manager by default 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:33:28 +01:00
Marco Franssen 9135086f8e Add infrastructure to test charts without defaulted values 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:33:28 +01:00
kfox1111andFaisal Memon 8a3ae10da5 Add the option to disable unix workloadattestor (#26) 
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:32:35 +01:00
Marco Franssen 115d9bdf80 Add category and license annotations for artifacthub 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-22 12:37:00 +01:00
Marco Franssen b804b0a932 Fix workflow trigger path 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-21 20:28:53 +01:00
Kevin Fox 32303d7eba Remove the need for hostpath on oidc provider 
The hostpath isn't needed. This patch removes the extra mount and changes
it to an emptyDir.

Signed-off-by: Kevin Fox <[email protected]>
 2023-02-21 15:48:02 +01:00
Marco Franssen 8974a3086d Disable jekyll for gh-pages 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-21 15:47:06 +01:00
Marco Franssen 9dee09e38e Merge pull request #14 from spiffe/base-chart 2023-02-20 10:59:32 +01:00
Marco Franssen cb3f94022f Remove duplicate volume creation 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:37:31 +01:00
Marco Franssen 73d4ed2ee5 Add .gitignore for the bin folder containing helm-docs 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:37:31 +01:00
Marco Franssen 99d32050ba Remove option to choose different agent socket path 
Resolves #19

Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:23:36 +01:00