This patch enables exposing the oidc server out with an ingress
along with tests to ensure it works.
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
Because we are already in the context of spire-agent the API looks more
logical to not have another 'agent' part in the name.
Furthermore to make it more clear the oidc provider only requires the
name of the socket as opposed to the entire path like in the other
charts I made that more explicit in the name of the value.
---------
Signed-off-by: Marco Franssen <[email protected]>
Adds namespace to the ClusterRole and ClusterRoleBinding so that it
doesn't conflict when you have two instances of the chart, in different
namespaces with the same release name.
Signed-off-by: Kevin Fox <[email protected]>
This makes it so that tests can now:
1. Add additional values files to the test
2. That the post-install.sh script knows if the test passed or failed
for better output
3. That the main test can be skipped in favor of a test provided one
Signed-off-by: Kevin Fox <[email protected]>
When the server and agent are not in the same namespace, the bundle needs to be
uploadable in the agent's namespace.
Signed-off-by: Kevin Fox <[email protected]>
The cluster role does the same thing, but at the cluster level
where it belongs. The extra role code does nothing so we remove
it here.
Signed-off-by: Kevin Fox <[email protected]>
* 7984bbd Add script to automate cutting a release
* eb186ca Add values for server TTL configurables
* f123296 Add a flag to configure the Kubernetes NodeAttestor (#83)
* 0275569 Incorperate feedback
* a00c97b Incorperate feedback
* f93434a Make server service account allow list configurable
* f0b7f5b Make spire agent server address configurable
* cb627f0 Allow all subchart to conditionally disable (#90)
* 2e9510f Switch to non root nginx (#89)
* a901751 Fix Homepage URL
* 06c395f Fix sources in Chart.yaml (#85)
* d341c5a UpstreamAuthority cert-manager support (#82)
* a82ee69 Make sure all configmap changes rollout
* b7f8c86 Add extra initContainers, containers, volumes to agent and server
* 81ac89a Add k8s 1.26.0 (Kind) to the test matrix
* bb6abfc Merge pull request #76 from spiffe/dependabot/github_actions/sigstore/cosign-installer-3.0.1
* c0e5665 Bump cosign to v2.0.0
* d729a44 Bump sigstore/cosign-installer from 2.8.1 to 3.0.1
* fe7cd73 Merge pull request #74 from spiffe/arm64-support
* a3c04c0 Update supported versions
* 75480ed Bump spiffe-csi-driver image to 0.2.3 (arm64 support)
* 79889ff Bump spiffe-oidc-discovery-provider image to 1.6.0 (arm64 support)
* a632f76 Bump spire-agent image to 1.6.0 (arm64 support)
* b92e81d Bump spire-server image to 1.6.0 (arm64 support)
* fea2aa5 Fix sigstore/cosign-installer usage in release workflow
* fe93346 Use quote function instead of actual quotes
* 9480ab7 Add beta note to readme (#62)
* 4681498 Better spire-server entry commands (#59)
Signed-off-by: Marco Franssen <[email protected]>
If you don't have the agent and server in the same namespace or the same
cluster, or want to bind additional clusters, you need the ability to
configure the service account allow list.
Signed-off-by: Kevin Fox <[email protected]>
If your server is not in the same namespace or cluster as the
agent, you need a config option to specify where it is.
Signed-off-by: Kevin Fox <[email protected]>
With plugin support, agents and servers need more customization.
This patch enables initContainers, extraContainers, extraVolumes
and extraVolumeMounts to be added to those services.
Signed-off-by: Kevin Fox <[email protected]>
Marco Franssen