panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,189 Commits 1 Branch 2 Tags
f548e058994e06bfd36e59486c7a9a6d07dfdfaf
Commit Graph
1189 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
kfox1111Marco FranssenFaisal Memon
 		a6dcf267d1 Allow for SPIRE Agent to run as non root user (#209) 
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-06-17 10:32:41 +02:00
Marco Franssen 9cf6049afd Allow contributors to run linting easily on local 
Signed-off-by: Marco Franssen <[email protected]>
 2023-06-17 03:42:41 +02:00
Faisal Memon e88f7f6fe2 Add configmap annotation to spire-bundle configmap (#351) 2023-06-16 23:22:44 +02:00
Drew WellsandKevin Fox 020bde8561 Add support to create a issuer and CA via cert-manager (#342) 
Co-authored-by: Kevin Fox <[email protected]>
 2023-06-16 21:04:11 +00:00
Faisal Memon 9d504de05b Ignore .DS_Store files 
Signed-off-by: Faisal Memon <[email protected]>
 2023-06-16 17:30:51 +02:00
kfox1111 e6b608c9fd Bump spire images to 1.7.0 (#348) 2023-06-16 07:26:59 +00:00
kfox1111 c97a788c85 Fix bundle role/rolebinding naming conflict (#333) 2023-06-16 08:55:49 +02:00
dependabot[bot] b66077eff1 Bump peter-evans/create-pull-request from 5.0.1 to 5.0.2 (#349) 
Bumps
[peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request)
from 5.0.1 to 5.0.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/peter-evans/create-pull-request/releases">peter-evans/create-pull-request's
releases</a>.</em></p>
<blockquote>
<h2>Create Pull Request v5.0.2</h2>
<p>⚙️ Fixes an issue that occurs when using <code>push-to-fork</code>
and both base and head repositories are in the same org/user
account.</p>
<h2>What's Changed</h2>
<ul>
<li>fix: specify head repo by <a
href="https://github.com/peter-evans"><code>@​peter-evans</code></a> in
<a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/2044">peter-evans/create-pull-request#2044</a></li>
<li>20 dependency updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/peter-evans/create-pull-request/compare/v5.0.1...v5.0.2">https://github.com/peter-evans/create-pull-request/compare/v5.0.1...v5.0.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/153407881ec5c347639a548ade7d8ad1d6740e38"><code>1534078</code></a>
fix: specify head repo (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2044">#2044</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/143be5d671929f35a2d146afde2bbf411a1cdae7"><code>143be5d</code></a>
build(deps-dev): bump <code>@​typescript-eslint/parser</code> from
5.59.9 to 5.59.11 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2048">#2048</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/51e8ca23403d80681e9ee4d3a6f2a7749650103f"><code>51e8ca2</code></a>
build(deps-dev): bump <code>@​types/node</code> from 18.16.16 to
18.16.18 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2047">#2047</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/712add83f26c1e359c046a6ca3dd677fb7017626"><code>712add8</code></a>
build(deps-dev): bump <code>@​types/jest</code> from 29.5.1 to 29.5.2
(<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2026">#2026</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/a9e8aabc8b4513752b51efcb32d166e65979b3e5"><code>a9e8aab</code></a>
build(deps-dev): bump eslint from 8.41.0 to 8.42.0 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2024">#2024</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/37be4ffd941e930a6dc8d42c5a893e62760a6105"><code>37be4ff</code></a>
build(deps-dev): bump <code>@​typescript-eslint/parser</code> from
5.59.8 to 5.59.9 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2023">#2023</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/a5f0e5dc8e47c41b694db6acd592fb79ff9be31f"><code>a5f0e5d</code></a>
build(deps-dev): bump eslint-plugin-github from 4.7.0 to 4.8.0 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2025">#2025</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/9ef70ee495af6d0ff9825b3e6050f304a290283a"><code>9ef70ee</code></a>
build(deps-dev): bump <code>@​types/node</code> from 18.16.14 to
18.16.16 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2009">#2009</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/0a287739d3c2d8485ed6e8be96cba0ab8ce870ee"><code>0a28773</code></a>
build(deps-dev): bump <code>@​typescript-eslint/parser</code> from
5.59.7 to 5.59.8 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/2008">#2008</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/4ddb8c8fe7f58d02d4d1d62359fd91fe4d54361d"><code>4ddb8c8</code></a>
build: update distribution (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/1986">#1986</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/peter-evans/create-pull-request/compare/v5.0.1...v5.0.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=peter-evans/create-pull-request&package-manager=github_actions&previous-version=5.0.1&new-version=5.0.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-06-15 09:53:51 -07:00
kfox1111 d0da864113 Add missing metadata to subcharts (#347) 2023-06-14 12:46:22 -07:00
kfox1111 4c0a1d52c5 Allow overriding test images (#186) 2023-06-14 21:17:08 +02:00
kfox1111 250fd5db00 Add missing global values to charts (#311) 2023-06-14 09:16:02 +02:00
Drew Wells 5d8c9079a1 Dropping k8s versions in CI older than 3, as per readme (#344) 2023-06-13 11:54:30 -07:00
Drew Wells 8748933548 Update upstream-ca-secret.yaml (#341) 
Fix an issue with nested context being used for namespace

Fixes this issue:
```
Error: UPGRADE FAILED: template: spire/charts/spire-server/templates/upstream-ca-secret.yaml:8:16: executing "spire/charts/spire-server/templates/upstream-ca-secret.yaml" at <include "spire-server.names
pace" .>: error calling include: template: spire/charts/spire-server/templates/_helpers.tpl:30:16: executing "spire-server.namespace" at <.Values.namespaceOverride>: nil pointer evaluating interface {}.
namespaceOverride
helm.go:84: [debug] template: spire/charts/spire-server/templates/upstream-ca-secret.yaml:8:16: executing "spire/charts/spire-server/templates/upstream-ca-secret.yaml" at <include "spire-server.namespac
e" .>: error calling include: template: spire/charts/spire-server/templates/_helpers.tpl:30:16: executing "spire-server.namespace" at <.Values.namespaceOverride>: nil pointer evaluating interface {}.nam
espaceOverride
```

Signed-off-by: Drew Wells <[email protected]>
 2023-06-12 11:25:14 -07:00
kfox1111 4e07450781 Fix ingress annotations for federation (#337) 
fixes: https://github.com/spiffe/helm-charts/issues/336

Signed-off-by: Kevin Fox <[email protected]>
 2023-06-12 05:50:26 -07:00
dependabot[bot] ea09199196 Bump actions/checkout from 3.5.0 to 3.5.3 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3.5.0 to 3.5.3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3.5.0...v3.5.3)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
 2023-06-12 10:11:23 +02:00
Edwin Buck 87fe19888b Merge pull request #331 from edwbuck/key_conventions 
Initial submission of Helm Chart key naming conventions.
 2023-06-09 11:51:55 -05:00
Edwin Buck ddc0166689 Fix line wrapping. 
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-09 11:47:11 -05:00
Edwin Buckandkfox1111 0cae9ce7c7 Update project/conventions.md 
Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-09 11:08:10 -05:00
Edwin Buckandkfox1111 cb18255815 Update project/conventions.md 
Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-09 11:07:51 -05:00
Mariusz SabathandEdwin Buck 52e5c24947 Upgrade Tornjak to image v1.2.2 (#328) 
Upgrade Tornjak image to version v1.2.2
(https://github.com/spiffe/tornjak/releases/tag/v1.2.2)

- Resolving issue #326 (remove an emergency patch) 
- Refactor and improve Tornajk image build process

---------

Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Edwin Buck <[email protected]>
 2023-06-08 14:29:01 -04:00
Edwin Buck 28e2abf762 Choose a different example for dotted Acronyms. 
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-08 07:00:12 -07:00
Edwin Buck d60d68c131 Added accidentally clipped explicit name guidelines. 
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-08 06:54:49 -07:00
Edwin Buck abe9fde697 Merge branch 'main' into key_conventions 2023-06-07 14:37:13 -05:00
Edwin BuckandMarco Franssen f6a7b62d98 Update project/conventions.md 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-07 14:36:59 -05:00
Edwin BuckandFaisal Memon c4d19db98d Update project/conventions.md 
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Edwin Buck <[email protected]>
 2023-06-07 14:33:00 -05:00
github-actions[bot] cfa9f78885 Bump test chart dependencies (#332) 2023-06-05 16:46:48 -07:00
Edwin Buck c3213abe37 Initial submission of Helm Chart key naming conventions. 
Closes #329

Signed-off-by: Edwin Buck <[email protected]>
 2023-06-03 09:58:50 -07:00
github-actions[bot]andmarcofranssen 28c0824714 Bump test chart dependencies (#322) 
Co-authored-by: marcofranssen <[email protected]>
 2023-06-02 08:37:25 +02:00
Marco Franssen d333154369 Add Makefile for local testing (#327) 2023-05-30 16:19:23 -07:00
Mariusz Sabath 9fa1ec28a7 Improve Tornjak backend test (#321) 2023-05-30 23:29:29 +02:00
Mariusz Sabath 5b779dc88a Improve Tornjak frontend test (#320) 2023-05-30 23:28:35 +02:00
Marco Franssen 71d110e730 Bump python + helm in CI workflow (#325) 
Signed-off-by: Marco Franssen <[email protected]>

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-30 09:12:22 -07:00
Marco Franssen dddefd88c0 Bump spire Helm Chart version from 0.8.0 to 0.8.1 
* d83d6a8e Emergency patch for Tornjak Frontend (#319)
* ed172e41 Bump k8s versions to latest patches (#317)
* 05629460 Removed pull_request edited event from ci workflow (#318)
* 3cb55dfb Allow for having no registry specified (#312)
* 1247b68f Parametrize probes (#310)

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-30 18:10:31 +02:00
Mariusz SabathandFaisal Memon d83d6a8efe Emergency patch for Tornjak Frontend (#319) 
Tornjak Frontend serves incorrect dashboard due to restricted namespace.
Fixing the cache file location leads to this error:
```Error: EACCES: permission denied, open './build/env.js'```

Solution, to redirect the env.js output to writeable space e.g. /tmp

Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-05-26 21:50:41 -07:00
Marco FranssenandFaisal Memon ed172e41ae Bump k8s versions to latest patches (#317) 
@faisal-memon we will need to update the required checks in branch
protection to use the new version

---------

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Faisal Memon <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-05-26 21:41:53 -07:00
Marco Franssen 05629460ef Removed pull_request edited event from ci workflow (#318) 
Edited event is only useful if you want a workflow to act on a PR
description or title or labels and such, we are not doing that in this
workflow.

Removing the edited type from the event doesn't unnecessarily run the
workflow again when title, description and such are changed.

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-26 08:13:45 -07:00
Faisal Memon 3cb55dfb4e Allow for having no registry specified (#312) 2023-05-25 14:15:46 -07:00
Mariusz Sabath 1247b68f4d Parametrize probes (#310) 
This PR addresses #307 by parametrizing Probes and moving them to
values.yaml

---------

Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-25 08:53:44 -04:00
Marco Franssen efdeb2e123 Bump spire Helm Chart version from 0.7.0 to 0.8.0 
* c1c5b112 Merge pull request #306 from spiffe/remove-1.21
* 0df45e3c Fix up docs
* ed038fea Upgrade to spire 1.6.4 (#308)
* dc5d9cfe Fix root README.md
* e4447fd8 Upgrade Tornjak to new image v1.2.1 (#299)
* 69f402ec Update docs
* 38d51d59 Apply suggestions from code review
* a1ba235c Update docs
* 1922085b Fix hooks for K3s (#305)
* 4fb549e9 Remove 1.21.x testing
* 88efc77b Allow to use spire-server as an upstream authority (#304)
* 0ba03880 Add support for spire-server ingress (#68)
* 4777a300 Bump test chart dependencies (#301)
* 00c2c1a5 Fix the generated pr so that it runs jobs too (#303)
* dd1ad495 Update images for cve's found by the cronjob (#290)
* 1c694707 Updated Tornjak documenation with Not-for-production labels (#297)
* 78096374 Merge pull request #296 from spiffe/dependabot/github_actions/helm/kind-action-1.7.0
* e61ed17b Merge pull request #295 from spiffe/dependabot/github_actions/sigstore/cosign-installer-3.0.5
* 9975e58f Merge pull request #245 from spiffe/tags
* 7bb7ece1 Bump helm/kind-action from 1.6.0 to 1.7.0
* f1623a59 Bump sigstore/cosign-installer from 3.0.4 to 3.0.5
* f8db5a31 Fix Tornjak persistence issue (#294)
* b30b412e Tornjak reuse spire-lib.cluster-domain macro (#292)
* 90c9eb50 Fix kubectl-image macro to handle version deprecation
* 300d1ccf Apply deprecation of image.version to Tornjak
* d8504864 Instead of removing version, first deprecate version
* 59e422b9 Add documentation for all image.tag values
* d1f3cdb9 Switch image.version to image.tag
* 31ce704f Cleanup maintainer handbook (#287)
* a2da9437 Remove manual dispatch from dummy workflow (#288)
* 807558bb Bump helm/kind-action from 1.5.0 to 1.6.0 (#285)
* 3df67dbb Bump sigstore/cosign-installer from 3.0.3 to 3.0.4 (#286)
* 5505d41d Merge pull request #283 from spiffe/additional-k8s-native-feature-tornjak-frontend
* 391f093a Allow to configure topologySpreadConstraints for tornjak-frontend
* 5cc26d31 Allow to configure tolerations for tornjak-frontend
* 3537161c Allow to configure affinity for tornjak-frontend
* aed6fdfe Use the correct kubectl for the cluster (#248)
* ee43c5e3 Add nodeSelector for tornjak
* fc13cbd9 Merge pull request #234 from spiffe/tornjak
* ed472aa9 Update documentation
* a11cfc99 Allow to define the resources for tornjak backend
* 382e0d4a Upgrade Tornjak image to version v1.2.0  (#259)
* 657c460e Update charts/spire/charts/tornjak-frontend/templates/service.yaml
* 7521cafc Update charts/spire/charts/spire-server/templates/tornjak-config.yaml
* b64c352b Update charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
* 6ddf6ab9 Improve tornjak docs (#276)
* 80d34f04 Use common post-install scripts for testing
* f5efa0ce Remove dead macros
* bd86518a Fixing shellcheck
* 91bdea2a Provide minimal resources to prevent accidental crashes due to resource exhaustion
* 16759977 Tornjak global image fix (#228)
* 5e827ee4 Add Tornjak Tests (#220)
* bdba97b6 Add empty directory to Tornjak to support npm cache (#224)
* da186c5f Split Tornjak Frontend into separate subchart (#179)
* 6d221263 Add Tornjak
* 2669d8b5 Add maintainer's handbook. (#265)
* 72596aea Skip tests for docs folders (#281)
* 7c71738d Bump test chart dependencies (#279)
* 05addae9 Add json to test path (#280)
* 8d9b7349 Switch the spire tests to always run (#250)

Signed-off-by: Marco Franssen <[email protected]>
 2023-05-25 14:22:31 +02:00
Edwin Buck c1c5b112c0 Merge pull request #306 from spiffe/remove-1.21 
Remove 1.21.x testing
 2023-05-23 18:33:58 -05:00
Kevin Fox 0df45e3cd8 Fix up docs 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 16:26:23 -07:00
kfox1111 ed038feae1 Upgrade to spire 1.6.4 (#308) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 16:17:34 -07:00
Kevin Fox dc5d9cfeec Fix root README.md 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 16:15:21 -07:00
Mariusz Sabath e4447fd8eb Upgrade Tornjak to new image v1.2.1 (#299) 
This upgrade enables the production version of React in Tornjak Frontend
with a smaller footprint and faster startup time.

Using Tornjak v1.2.1 release
https://github.com/spiffe/tornjak/releases/tag/v1.2.1

---------

Signed-off-by: Mariusz Sabath <[email protected]>
 2023-05-23 13:32:20 -04:00
Kevin Fox 69f402ecc6 Update docs 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 09:56:05 -07:00
kfox1111andFaisal Memon 38d51d5985 Apply suggestions from code review 
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
 2023-05-23 09:55:38 -07:00
Kevin Fox a1ba235c99 Update docs 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 09:44:06 -07:00
Faisal Memonandkfox1111 1922085ba7 Fix hooks for K3s (#305) 
Co-authored-by: kfox1111 <[email protected]>
 2023-05-23 08:59:21 -07:00
Kevin Fox 4fb549e954 Remove 1.21.x testing 
Signed-off-by: Kevin Fox <[email protected]>
 2023-05-23 08:57:07 -07:00
kfox1111andMarco Franssen 88efc77bee Allow to use spire-server as an upstream authority (#304) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-05-23 14:39:37 +00:00