panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
587 Commits 1 Branch 2 Tags
d616632810436446ad5ca3b0e26d0f00b796e2b5
Commit Graph
239 Commits
Author SHA1 Message Date
kfox1111 d616632810 Bump spire version to 1.8.5 (#115) 2023-11-24 09:32:27 -08:00
marcofranssen 95e1eb7c57 Bump test chart dependencies 
Signed-off-by: GitHub <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-11-20 10:34:08 +01:00
Kevin Fox 966061c6c7 Auto add default CSIDriver labels on OpenShift 
Signed-off-by: Kevin Fox <[email protected]>
 2023-11-20 10:24:53 +01:00
Mariusz Sabath c9885de539 Introduce ReadOnlyRootFilesystem for Tornjak frontend (#110) 
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-11-16 15:47:04 -08:00
Mattias Gees 810709533b Fix typo ClusterSPIFFEID for workloadTSelectoremplates (#107) 
Signed-off-by: Mattias Gees <[email protected]>
 2023-11-16 06:34:56 -08:00
Andrew BlockandFaisal Memon 5c0ce97ad1 Ordering of SecurityContextConstraint array items (#105) 
Signed-off-by: Andrew Block <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-11-15 04:54:17 +00:00
marcofranssen 889d0af84d Bump test chart dependencies 
Signed-off-by: GitHub <[email protected]>
 2023-11-13 13:49:52 +01:00
kfox1111 f5d1376cb6 Documentation cleanup (#97) 
Fix links to the repo after move. Remove references to other versions
of images we don't support.

Signed-off-by: Kevin Fox <[email protected]>
 2023-11-11 12:28:41 -08:00
kfox1111Faisal MemonMariusz Sabath
 		6c0a4fbb86 Auto tornjak url (#89) 
* Autogen jwtIssuer

Unset a default for jwtIssuer and global.spire.jwtIssuer. When unset,
generate it to the default of oidc-discovery.$trustDomain so in many
cases the user doesn't need to set it at all.

Signed-off-by: Kevin Fox <[email protected]>

* Autogen tornjak's apiServerURL

Unset the default tornjak apiServerURL. When unset, default to
https://tornjak-backend.$trustDomain so in many cases users don't
have to set it.

Signed-off-by: Kevin Fox <[email protected]>

* Do more autodetection

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-11-09 13:07:52 -08:00
kfox1111Faisal MemonMariusz Sabath
 		f2758a8b2b Autogen jwtIssuer (#88) 
* Autogen jwtIssuer

Unset a default for jwtIssuer and global.spire.jwtIssuer. When unset,
generate it to the default of oidc-discovery.$trustDomain so in many
cases the user doesn't need to set it at all.

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-11-09 20:31:48 +00:00
Marco Franssen 0320c3f755 Cleanup documentation 
Signed-off-by: Marco Franssen <[email protected]>
 2023-11-08 13:11:58 +01:00
Faisal Memon 37cd9f25e2 Update to SPIRE 1.8.4 (#84) 2023-11-08 03:26:21 -08:00
kfox1111Marco FranssenFaisal Memon
 		805d8696d0 spire-controller-manager 0.4.0 support (#60) 
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-11-08 10:43:19 +00:00
marcofranssen 0ed6d9244d Bump test chart dependencies 
Signed-off-by: GitHub <[email protected]>
 2023-11-06 13:15:02 +01:00
Kevin Fox f7b61406fe Fix docs 
Signed-off-by: Kevin Fox <[email protected]>
 2023-11-05 23:29:22 -08:00
Kevin Fox a7e8785420 Add another missing one 
Signed-off-by: Kevin Fox <[email protected]>
 2023-11-05 23:29:22 -08:00
Kevin Fox 3778597e72 Add missing ClusterSPIFFEID fields 
There are a few options in the CRD not available via the chart.
Sync them to the chart.

Signed-off-by: Kevin Fox <[email protected]>
 2023-11-05 23:29:22 -08:00
kfox1111Faisal MemonMariusz Sabath
 		81cc2dc573 Ingress type openshift (#52) 
* Specify ingress controller type

Signed-off-by: Kevin Fox <[email protected]>

* Fix indenting, docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix spacing

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Add ingress-nginx support

Signed-off-by: Kevin Fox <[email protected]>

* Use the right example values for test version to upgrade from.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var in wrong location

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing arg

Signed-off-by: Kevin Fox <[email protected]>

* Try this to checkout the right version

Signed-off-by: Kevin Fox <[email protected]>

* Switch to upgrading from 0.14.0

Signed-off-by: Kevin Fox <[email protected]>

* Install crds

Signed-off-by: Kevin Fox <[email protected]>

* Simple ingress support

For a lot of situations, ingress rules can be derived from trustDomain.
Change the code to generate rules by default for the user.

Signed-off-by: Kevin Fox <[email protected]>

* Add upgrade test fix from 43

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Enable unset ingress controller type to use with openshift later

Signed-off-by: Kevin Fox <[email protected]>

* Openshift ingress controller type support

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing end tag

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Fix doc merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Fix automatically generated rules on openshift

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Fix pathType

Signed-off-by: Kevin Fox <[email protected]>

* Make openshift edge rules work

Signed-off-by: Kevin Fox <[email protected]>

* Fix var scoping

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix issue created during merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
 2023-11-03 13:16:14 -07:00
Mariusz Sabath f08ebd344e Patch Tornjak ingress (#74) 
* Fix the tornjak backend tornjak

Signed-off-by: Mariusz Sabath <[email protected]>

* Revert "Fix the tornjak backend tornjak"

This reverts commit cef5505fab940af34be8cfef3e210f020c2f36a1.

Signed-off-by: Mariusz Sabath <[email protected]>

* Fix the tornjak backend tornjak

Signed-off-by: Mariusz Sabath <[email protected]>

---------

Signed-off-by: Mariusz Sabath <[email protected]>
 2023-11-02 09:38:33 -07:00
Mariusz SabathTrilok GeerAndrew Blockkfox1111
 		3b016841da Support Openshift deployment (#13) 
* Add support for SPIRE deployment on OpenShift 4.13

Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Trilok Geer <[email protected]>
Co-authored-by: Andrew Block <[email protected]>

* Render README

Signed-off-by: Mariusz Sabath <[email protected]>

* Fix tornjak HTTP/HTTPS port values

Signed-off-by: Mariusz Sabath <[email protected]>

* Update Frontend README

Signed-off-by: Mariusz Sabath <[email protected]>

* Add env. variable to Agent to inject node name

Signed-off-by: Mariusz Sabath <[email protected]>

* Implement Marco's suggestion on CSI CSS version

Signed-off-by: Mariusz Sabath <[email protected]>

* Add MY_NODE_NAME env. variable to agent for openshift example

Signed-off-by: Mariusz Sabath <[email protected]>

* Move Openshift examples to dedicated directory

Signed-off-by: Mariusz Sabath <[email protected]>

* Simplified the install instructions

Signed-off-by: Mariusz Sabath <[email protected]>

* Suggested changes

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Andrew Block <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs, fix default for backwards compat

Signed-off-by: Kevin Fox <[email protected]>

* Don't recommend experimental features by default, dont debug helm install by default and explain how to add additional features

Signed-off-by: Kevin Fox <[email protected]>

* Add notes about openshift to the project for other reviewers.

Signed-off-by: Kevin Fox <[email protected]>

* Fix incorrectly reverted change

Signed-off-by: Kevin Fox <[email protected]>

* Correct notes

Signed-off-by: Kevin Fox <[email protected]>

* Update default

Signed-off-by: Kevin Fox <[email protected]>

* Fix issue created from bad merge conflict resolution

Signed-off-by: kfox1111 <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

---------

Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Trilok Geer <[email protected]>
Co-authored-by: Andrew Block <[email protected]>
Co-authored-by: Kevin Fox <[email protected]>
 2023-10-31 16:27:23 +00:00
kfox1111andFaisal Memon ed23d8b714 Simple ingress support (#48) 
Co-authored-by: Faisal Memon <[email protected]>
 2023-10-30 22:16:17 +00:00
Inverse Integralandkfox1111 b354413f62 Fix incorrect nesting of priorityClassName (#67) 
Signed-off-by: Inverse Integral <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2023-10-30 10:32:48 -07:00
github-actions[bot]andmarcofranssen 09ebfc9ee3 Bump test chart dependencies (#68) 
Signed-off-by: GitHub <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
 2023-10-30 09:30:10 -07:00
kfox1111 d50d78d9a0 Fix ingress annotation variable for tornjak server (#66) 2023-10-28 11:47:55 -07:00
Andrew Block 9bd7f43056 Added environment variable to spire-agent to inject node name 
Signed-off-by: Andrew Block <[email protected]>
 2023-10-26 12:14:23 -05:00
kfox1111andFaisal Memon 7924323a8f Specify ingress controller type (#43) 
* Specify ingress controller type

Signed-off-by: Kevin Fox <[email protected]>

* Fix indenting, docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix spacing

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Add ingress-nginx support

Signed-off-by: Kevin Fox <[email protected]>

* Use the right example values for test version to upgrade from.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var in wrong location

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing arg

Signed-off-by: Kevin Fox <[email protected]>

* Try this to checkout the right version

Signed-off-by: Kevin Fox <[email protected]>

* Switch to upgrading from 0.14.0

Signed-off-by: Kevin Fox <[email protected]>

* Install crds

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Enable unset ingress controller type to use with openshift later

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs after merge issue

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-10-24 20:18:53 +00:00
github-actions[bot]marcofranssenFaisal Memon
 		0b174345ab Bump test chart dependencies (#54) 
Signed-off-by: GitHub <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-10-23 20:40:30 +00:00
kfox1111Faisal MemonMarco Franssen
 		56445c4f94 Spire controller manager upgrade (#8) 
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-10-17 19:54:12 +00:00
Mariusz Sabath 663551297a Fix Tornjak HTTPS ingress port (#39) 
* Fix failing Tornjak ingress port

Signed-off-by: Mariusz Sabath <[email protected]>

* Add HTTPS port to Tornjak ingress

Signed-off-by: Mariusz Sabath <[email protected]>

* Remove tlsBackendPort flag

Signed-off-by: Mariusz Sabath <[email protected]>

---------

Signed-off-by: Mariusz Sabath <[email protected]>
 2023-10-17 19:48:54 +00:00
Faisal Memon 78ba615c7d Update to SPIRE 1.8.2 (#40) 
Signed-off-by: Faisal Memon <[email protected]>
 2023-10-17 10:26:14 -07:00
github-actions[bot]andmarcofranssen 2644e4b198 Bump test chart dependencies (#38) 
Signed-off-by: GitHub <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
 2023-10-16 18:00:04 +00:00
kfox1111 dd87bc0fb2 Bump spire versions to 1.7.4 (#35) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-10-12 14:52:18 -07:00
Mariusz SabathandFaisal Memon 0e41a7d1b4 Fix failing Tornjak ingress port (#28) 
Co-authored-by: Faisal Memon <[email protected]>
 2023-10-11 14:36:15 +00:00
kfox1111 df1abf6235 Bump to spire 1.7.3 (#31) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-10-10 22:28:24 -07:00
Mariusz Sabath 3036a41c02 Switch to version v1.4.0 
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-10-10 15:07:14 -04:00
Mariusz Sabath da49059c87 Update Tornjak image version 
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-10-10 15:01:31 -04:00
kfox1111 0fa43a507d Add plugin support to the spire agent (#22) 
* Exit code from diff indicating changes should not block commit.

Signed-off-by: Kevin Fox <[email protected]>

* Push the changes that update-tags creates

Signed-off-by: Kevin Fox <[email protected]>

* Add plugin support to the spire agent

This adapts the existing spire server plugin support to be usable by
the agent as well.

Signed-off-by: Kevin Fox <[email protected]>

* Fix notes

Signed-off-by: Kevin Fox <[email protected]>

* Add plugin support to the spire agent

This adapts the existing spire server plugin support to be usable by
the agent as well.

Signed-off-by: Kevin Fox <[email protected]>

* Fix notes

Signed-off-by: Kevin Fox <[email protected]>

* Update documentation

Signed-off-by: Kevin Fox <[email protected]>

* Update example

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
 2023-10-10 08:09:11 +00:00
kfox1111andFaisal Memon afba33f179 Add spire agent experimental flags (#26) 
* Add spire agent experimental flags

Signed-off-by: Kevin Fox <[email protected]>

* Fix nested test

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-agent/templates/configmap.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Regen docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-10-09 16:09:28 -07:00
marcofranssen 11072780ca Bump test chart dependencies 
Signed-off-by: GitHub <[email protected]>
 2023-10-09 15:53:46 +02:00
Mariusz SabathandMarco Franssen 03ff618958 Add Tornjak ingress (#16) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-10-09 11:31:55 +00:00
github-actions[bot]andfaisal-memon 06d6690d71 Bump test chart dependencies (#20) 
Signed-off-by: GitHub <[email protected]>
Co-authored-by: faisal-memon <[email protected]>
 2023-10-05 11:21:51 -07:00
kfox1111 50825d9fc9 Deny production runs of example.org trust domains (#229) 2023-09-25 12:06:48 -07:00
Faisal Memon f04bdc3618 Add support for experimental flags (#492) 
Add support for the experimental section of the config. Needed for
developers. This PR doesnt add support for the `auth_opa_policy_engine`
experimental config.

---------

Signed-off-by: Faisal Memon <[email protected]>
 2023-09-22 14:55:03 -07:00
unufr33andFaisal Memon d3091a829c Fix spire-server configmap UpstreamAuthority/aws_pca and KeyManager/a… (#489) 
Current configmap template renders to a wrong KeyManager and
UpstreamAuthority configurarion when aws_kms and aws_pca are enabled and
container is crashing. The proposed changes will fix the issue.

---------

Signed-off-by: unufree <[email protected]>
Signed-off-by: unufr33 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-09-20 09:12:11 -07:00
LaithLiteandMarco Franssen 38f0af4491 Add support for Vault UpstreamAuthority plugin - K8s Auth (#415) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-09-15 08:48:56 +02:00
Inverse Integral 1f908676bb Allow configuration of priorityClassName on spire-server statefulset (#480) 2023-09-12 22:31:23 +02:00
grameshtwilioandMarco Franssen 9ad2ed59b1 option to configure agent sds (#479) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-09-11 11:42:27 +00:00
KrishnaKrishnakumar VenkataramanMarco Franssen
 		65d56957de Migrate to readme-generator for helm maintained by bitnami (#431) 
Co-authored-by: Krishnakumar Venkataraman <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-09-08 09:39:30 +02:00
Simon Ostendorf dcc60a2896 fix(charts/spire/spire-agent): podmonitor templating (#478) 2023-09-08 09:31:18 +02:00
kfox1111andMarco Franssen e81a59a7e5 ingress-nginx production tests and spiffe-oidc-discovery-provider example (#136) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-08-29 15:22:00 +00:00