panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
569 Commits 1 Branch 2 Tags
f2758a8b2b275daf90c2e3906f25b277707908df
Commit Graph
167 Commits
Author SHA1 Message Date
Kevin Fox a6bdb4d1e7 Add persistence type flag 
This patch adds a type flag to the persistence settings to enable
specifying the backing volume's type.

Signed-off-by: Kevin Fox <[email protected]>
 2023-07-19 23:40:23 +02:00
Marco Franssen 088b29608e Improve tornjak service API to have object structure (#392) 2023-07-19 09:17:45 -07:00
Marco Franssen 522066e9f9 Align tornjak clientCA naming convention (#393) 2023-07-19 09:13:50 -07:00
Mariusz SabathandMarco Franssen f05cb4fe1e Add option to configure TLS/mTLS endpoint for Tornjak (#338) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-07-19 14:32:32 +02:00
kfox1111andMarco Franssen c1b1dd3d88 Add additional domains to JWT issued items. (#230) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-07-03 22:26:28 +02:00
Marco Franssen d7a03f620d Fix bug in cert-manager upstream authority 
The arguments for default function need to be the other way around

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-29 17:39:21 +02:00
Marco Franssen 99e01c6722 Bump spire-controller-manager from 0.2.2 to 0.2.3 (#367) 
resolves a bunch of vulnerabilities in the Image

Signed-off-by: Marco Franssen <[email protected]>

Signed-off-by: Marco Franssen <[email protected]>
 2023-06-22 16:16:43 -07:00
kfox1111 8409674a3e Fix the init container flags of the statefulset (#366) 2023-06-22 18:57:07 +02:00
Drew Wells 3b6666016c add missing federatesWith option (#361) 
DEMO

```
spire-server-0 -- spire-server entry show -spiffeID spiffe://box-4.example.com/ns/dwells/sa/dwells-rc-realm-client
Defaulted container "spire-server" out of: spire-server, spire-controller-manager, wait (init)
Found 1 entry
Entry ID         : 09301666-010e-4ba9-9dcb-44370d4e49e4
SPIFFE ID        : spiffe://box-4.example.com/ns/dwells/sa/dwells-rc-realm-client
Parent ID        : spiffe://box-4.example.com/spire/agent/k8s_psat/example-cluster/ff93872d-791f-4bf3-a532-475775d03d3e
Revision         : 0
X509-SVID TTL    : default
JWT-SVID TTL     : default
Selector         : k8s:pod-uid:40e0bcad-6ec8-460b-a839-659654549d7a
FederatesWith    : box-3.example.com
```

Signed-off-by: Drew Wells <[email protected]>
 2023-06-22 08:45:37 -07:00
Drew Wells 0533d92594 fixes missing template (#362) 2023-06-22 09:40:08 -04:00
Faisal Memon 1333b6ab34 Always add parseTime=true for mysql query string (#352) 2023-06-20 21:14:42 +02:00
Marco Franssen c11a8c00e7 Implement pre-delete hook for graceful delete of spiffe-oidc-discovery-provider (#353) 2023-06-17 06:06:27 -07:00
Faisal Memon e88f7f6fe2 Add configmap annotation to spire-bundle configmap (#351) 2023-06-16 23:22:44 +02:00
Drew WellsandKevin Fox 020bde8561 Add support to create a issuer and CA via cert-manager (#342) 
Co-authored-by: Kevin Fox <[email protected]>
 2023-06-16 21:04:11 +00:00
kfox1111 e6b608c9fd Bump spire images to 1.7.0 (#348) 2023-06-16 07:26:59 +00:00
kfox1111 c97a788c85 Fix bundle role/rolebinding naming conflict (#333) 2023-06-16 08:55:49 +02:00
kfox1111 d0da864113 Add missing metadata to subcharts (#347) 2023-06-14 12:46:22 -07:00
kfox1111 4c0a1d52c5 Allow overriding test images (#186) 2023-06-14 21:17:08 +02:00
kfox1111 250fd5db00 Add missing global values to charts (#311) 2023-06-14 09:16:02 +02:00
Drew Wells 8748933548 Update upstream-ca-secret.yaml (#341) 
Fix an issue with nested context being used for namespace

Fixes this issue:
```
Error: UPGRADE FAILED: template: spire/charts/spire-server/templates/upstream-ca-secret.yaml:8:16: executing "spire/charts/spire-server/templates/upstream-ca-secret.yaml" at <include "spire-server.names
pace" .>: error calling include: template: spire/charts/spire-server/templates/_helpers.tpl:30:16: executing "spire-server.namespace" at <.Values.namespaceOverride>: nil pointer evaluating interface {}.
namespaceOverride
helm.go:84: [debug] template: spire/charts/spire-server/templates/upstream-ca-secret.yaml:8:16: executing "spire/charts/spire-server/templates/upstream-ca-secret.yaml" at <include "spire-server.namespac
e" .>: error calling include: template: spire/charts/spire-server/templates/_helpers.tpl:30:16: executing "spire-server.namespace" at <.Values.namespaceOverride>: nil pointer evaluating interface {}.nam
espaceOverride
```

Signed-off-by: Drew Wells <[email protected]>
 2023-06-12 11:25:14 -07:00
kfox1111 4e07450781 Fix ingress annotations for federation (#337) 
fixes: https://github.com/spiffe/helm-charts/issues/336

Signed-off-by: Kevin Fox <[email protected]>
 2023-06-12 05:50:26 -07:00
Mariusz SabathandEdwin Buck 52e5c24947 Upgrade Tornjak to image v1.2.2 (#328) 
Upgrade Tornjak image to version v1.2.2
(https://github.com/spiffe/tornjak/releases/tag/v1.2.2)

- Resolving issue #326 (remove an emergency patch) 
- Refactor and improve Tornajk image build process

---------

Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Edwin Buck <[email protected]>
 2023-06-08 14:29:01 -04:00
Mariusz Sabath 9fa1ec28a7 Improve Tornjak backend test (#321) 2023-05-30 23:29:29 +02:00
Mariusz Sabath 1247b68f4d Parametrize probes (#310) 
This PR addresses #307 by parametrizing Probes and moving them to
values.yaml

---------

Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-25 08:53:44 -04:00
kfox1111 ed038feae1 Upgrade to spire 1.6.4 (#308) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 16:17:34 -07:00
Mariusz Sabath e4447fd8eb Upgrade Tornjak to new image v1.2.1 (#299) 
This upgrade enables the production version of React in Tornjak Frontend
with a smaller footprint and faster startup time.

Using Tornjak v1.2.1 release
https://github.com/spiffe/tornjak/releases/tag/v1.2.1

---------

Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-23 13:32:20 -04:00
Faisal Memonandkfox1111 1922085ba7 Fix hooks for K3s (#305) 
Co-authored-by: kfox1111 <[email protected]>
 2023-05-23 08:59:21 -07:00
kfox1111andMarco Franssen 88efc77bee Allow to use spire-server as an upstream authority (#304) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-05-23 14:39:37 +00:00
kfox1111Faisal MemonMarco Franssendependabot[bot]
 		0ba03880a1 Add support for spire-server ingress (#68) 
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-05-23 13:58:58 +00:00
Mariusz Sabath 1c6947078a Updated Tornjak documenation with Not-for-production labels (#297) 2023-05-18 23:31:03 +02:00
Marco Franssen 9975e58f5c Merge pull request #245 from spiffe/tags 2023-05-18 09:18:22 +02:00
kfox1111 f8db5a313b Fix Tornjak persistence issue (#294) 2023-05-18 01:54:26 +02:00
Marco Franssen 90c9eb50f9 Fix kubectl-image macro to handle version deprecation 
Signed-off-by: Marco Franssen <[email protected]>
 2023-05-17 20:21:07 +02:00
Marco Franssen 300d1ccf28 Apply deprecation of image.version to Tornjak 
Signed-off-by: Marco Franssen <[email protected]>
 2023-05-17 20:21:07 +02:00
Marco Franssen d850486478 Instead of removing version, first deprecate version 
Deprecating version allows users of the chart to have a migration path

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-17 20:21:07 +02:00
Marco Franssen 59e422b9e3 Add documentation for all image.tag values 
Signed-off-by: Marco Franssen <[email protected]>
 2023-05-17 20:21:07 +02:00
Kevin Fox d1f3cdb909 Switch image.version to image.tag 
The convention in most charts is to use image.tag. This patch updates the values
to use it instead of the less standard image.version.

Signed-off-by: Kevin Fox <[email protected]>
 2023-05-17 20:21:07 +02:00
kfox1111 aed6fdfe4e Use the correct kubectl for the cluster (#248) 2023-05-16 20:28:53 +02:00
Marco Franssen ee43c5e36f Add nodeSelector for tornjak 
Tornjak only supports amd64 builds at the moment

To prevent deployment failures on clusters with arm64 nodes I have added a nodeSelector for tornjak frontend, and documentation for spire-server

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-16 20:20:32 +02:00
Mariusz Sabath ed472aa98b Update documentation 
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-16 19:31:38 +02:00
Marco Franssen a11cfc99ac Allow to define the resources for tornjak backend 
Signed-off-by: Marco Franssen <[email protected]>
 2023-05-16 19:31:38 +02:00
Mariusz SabathandMarco Franssen 382e0d4a47 Upgrade Tornjak image to version v1.2.0 (#259) 
Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-05-16 19:31:38 +02:00
Mariusz SabathandMarco Franssen 7521cafcc6 Update charts/spire/charts/spire-server/templates/tornjak-config.yaml 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-16 19:31:38 +02:00
Mariusz SabathandMarco Franssen b64c352b15 Update charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-16 19:31:38 +02:00
Marco Franssen 6ddf6ab9fa Improve tornjak docs (#276) 
- Align tornjak backend naming with same convention as frontend
- Align Tornjak backend and frontend notes style
- Add disclaimer for Tornjak usage to example

---------

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-16 19:31:38 +02:00
Mariusz Sabath f5efa0cefd Remove dead macros 
Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-16 19:31:38 +02:00
kfox1111 1675997748 Tornjak global image fix (#228) 
This pr updates the Tornjak branch to work with the merged global
registry configuration support.

Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
 2023-05-16 19:31:38 +02:00
Mariusz SabathandMarco Franssen da186c5f53 Split Tornjak Frontend into separate subchart (#179) 
Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-05-16 19:31:38 +02:00
Marco Franssen 6d221263fb Add Tornjak 
This reverts commit 3210dfe49dfabc96437d1fe60a1b9a5eedb2312b.

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-16 19:31:38 +02:00
Marco FranssenandFaisal Memon 65312f8525 Include dependency values in documentation (#275) 
I have added a flag to the helm-docs script to include the documentation
for dependencies.

This will add more complete documentation to
https://artifacthub.io/packages/helm/spiffe/spire#values so it is easier
for our users to get started and having a complete overview.

---------

Signed-off-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-05-12 18:12:23 +00:00