panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,144 Commits 1 Branch 2 Tags
f9a2c443a62ad996c5bd251d7b93e31311e274de
Commit Graph
248 Commits
Author SHA1 Message Date
github-actions[bot]andmarcofranssen 8f1aba8ad3 Bump test chart dependencies (#171) 
Signed-off-by: GitHub <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
 2024-01-01 06:05:30 -08:00
github-actions[bot]andmarcofranssen e5c5527fd7 Bump test chart dependencies (#165) 
Signed-off-by: GitHub <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
 2023-12-25 14:32:18 -08:00
Drew Wellsandkfox1111 e6300087b7 Update jwt test to work with newer slim images (#139) 
* install newer version of slim debug

  - switch to step tool for jwt verification against jwk public keys

Signed-off-by: Drew Wells <[email protected]>

* use step-cli image

Signed-off-by: Drew Wells <[email protected]>

* Fix image tag and add upgrade logic

Signed-off-by: Kevin Fox <[email protected]>

* use registry for consistency

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Drew Wells <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2023-12-20 19:14:54 -08:00
kfox1111andMarco Franssen 49beb64584 Add recommendation for namespaceLayout (#127) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-12-19 15:02:57 +00:00
kfox1111 33cacd2ee8 Add recommendation for prometheus exporter (#144) 2023-12-19 11:38:20 +00:00
kfox1111andMarco Franssen 6997d6a904 Add recommendation for securityContext and podSecurityContext (#125) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-12-19 11:26:26 +00:00
github-actions[bot]marcofranssenkfox1111
 		4fb9d18f50 Bump test chart dependencies (#155) 
* Bump test chart dependencies

Signed-off-by: GitHub <[email protected]>

* Revert broken image for now

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: GitHub <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2023-12-18 09:12:59 -08:00
kfox1111 1524537318 Update default for additionalDomains not to include localhost (#146) 
Its pretty much only useful if you want to port forward the
discovery provider and use localhost to access it. An uncommon
use case. Its easy to add back for that case. This simplifies
production deploymnet.

Signed-off-by: Kevin Fox <[email protected]>
 2023-12-12 08:14:16 -08:00
kfox1111 89c07e2d04 Revert openssl 3.2 change (#142) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-12-11 06:33:24 -08:00
marcofranssen a3d3702049 Bump test chart dependencies 
Signed-off-by: GitHub <[email protected]>
 2023-12-11 10:44:48 +01:00
github-actions[bot]marcofranssenkfox1111
 		80c7653a21 Bump test chart dependencies (#134) 
* Bump test chart dependencies

Signed-off-by: GitHub <[email protected]>

* Update charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml

Signed-off-by: kfox1111 <[email protected]>

* Fix Docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: GitHub <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
 2023-12-07 22:47:38 +00:00
github-actions[bot]andmarcofranssen e68f6170a6 Bump test chart dependencies (#116) 
Signed-off-by: GitHub <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
 2023-11-27 06:20:42 -08:00
kfox1111 d616632810 Bump spire version to 1.8.5 (#115) 2023-11-24 09:32:27 -08:00
marcofranssen 95e1eb7c57 Bump test chart dependencies 
Signed-off-by: GitHub <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-11-20 10:34:08 +01:00
Andrew BlockandFaisal Memon 5c0ce97ad1 Ordering of SecurityContextConstraint array items (#105) 
Signed-off-by: Andrew Block <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-11-15 04:54:17 +00:00
marcofranssen 889d0af84d Bump test chart dependencies 
Signed-off-by: GitHub <[email protected]>
 2023-11-13 13:49:52 +01:00
kfox1111 f5d1376cb6 Documentation cleanup (#97) 
Fix links to the repo after move. Remove references to other versions
of images we don't support.

Signed-off-by: Kevin Fox <[email protected]>
 2023-11-11 12:28:41 -08:00
kfox1111Faisal MemonMariusz Sabath
 		f2758a8b2b Autogen jwtIssuer (#88) 
* Autogen jwtIssuer

Unset a default for jwtIssuer and global.spire.jwtIssuer. When unset,
generate it to the default of oidc-discovery.$trustDomain so in many
cases the user doesn't need to set it at all.

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-11-09 20:31:48 +00:00
Marco Franssen 0320c3f755 Cleanup documentation 
Signed-off-by: Marco Franssen <[email protected]>
 2023-11-08 13:11:58 +01:00
Faisal Memon 37cd9f25e2 Update to SPIRE 1.8.4 (#84) 2023-11-08 03:26:21 -08:00
marcofranssen 0ed6d9244d Bump test chart dependencies 
Signed-off-by: GitHub <[email protected]>
 2023-11-06 13:15:02 +01:00
kfox1111Faisal MemonMariusz Sabath
 		81cc2dc573 Ingress type openshift (#52) 
* Specify ingress controller type

Signed-off-by: Kevin Fox <[email protected]>

* Fix indenting, docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix spacing

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Add ingress-nginx support

Signed-off-by: Kevin Fox <[email protected]>

* Use the right example values for test version to upgrade from.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var in wrong location

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing arg

Signed-off-by: Kevin Fox <[email protected]>

* Try this to checkout the right version

Signed-off-by: Kevin Fox <[email protected]>

* Switch to upgrading from 0.14.0

Signed-off-by: Kevin Fox <[email protected]>

* Install crds

Signed-off-by: Kevin Fox <[email protected]>

* Simple ingress support

For a lot of situations, ingress rules can be derived from trustDomain.
Change the code to generate rules by default for the user.

Signed-off-by: Kevin Fox <[email protected]>

* Add upgrade test fix from 43

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Enable unset ingress controller type to use with openshift later

Signed-off-by: Kevin Fox <[email protected]>

* Openshift ingress controller type support

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing end tag

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Fix doc merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

* Fix automatically generated rules on openshift

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Fix pathType

Signed-off-by: Kevin Fox <[email protected]>

* Make openshift edge rules work

Signed-off-by: Kevin Fox <[email protected]>

* Fix var scoping

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix issue created during merge conflict

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
 2023-11-03 13:16:14 -07:00
Mariusz SabathTrilok GeerAndrew Blockkfox1111
 		3b016841da Support Openshift deployment (#13) 
* Add support for SPIRE deployment on OpenShift 4.13

Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Trilok Geer <[email protected]>
Co-authored-by: Andrew Block <[email protected]>

* Render README

Signed-off-by: Mariusz Sabath <[email protected]>

* Fix tornjak HTTP/HTTPS port values

Signed-off-by: Mariusz Sabath <[email protected]>

* Update Frontend README

Signed-off-by: Mariusz Sabath <[email protected]>

* Add env. variable to Agent to inject node name

Signed-off-by: Mariusz Sabath <[email protected]>

* Implement Marco's suggestion on CSI CSS version

Signed-off-by: Mariusz Sabath <[email protected]>

* Add MY_NODE_NAME env. variable to agent for openshift example

Signed-off-by: Mariusz Sabath <[email protected]>

* Move Openshift examples to dedicated directory

Signed-off-by: Mariusz Sabath <[email protected]>

* Simplified the install instructions

Signed-off-by: Mariusz Sabath <[email protected]>

* Suggested changes

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Andrew Block <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs, fix default for backwards compat

Signed-off-by: Kevin Fox <[email protected]>

* Don't recommend experimental features by default, dont debug helm install by default and explain how to add additional features

Signed-off-by: Kevin Fox <[email protected]>

* Add notes about openshift to the project for other reviewers.

Signed-off-by: Kevin Fox <[email protected]>

* Fix incorrectly reverted change

Signed-off-by: Kevin Fox <[email protected]>

* Correct notes

Signed-off-by: Kevin Fox <[email protected]>

* Update default

Signed-off-by: Kevin Fox <[email protected]>

* Fix issue created from bad merge conflict resolution

Signed-off-by: kfox1111 <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

---------

Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Trilok Geer <[email protected]>
Co-authored-by: Andrew Block <[email protected]>
Co-authored-by: Kevin Fox <[email protected]>
 2023-10-31 16:27:23 +00:00
kfox1111andFaisal Memon ed23d8b714 Simple ingress support (#48) 
Co-authored-by: Faisal Memon <[email protected]>
 2023-10-30 22:16:17 +00:00
github-actions[bot]andmarcofranssen 09ebfc9ee3 Bump test chart dependencies (#68) 
Signed-off-by: GitHub <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
 2023-10-30 09:30:10 -07:00
kfox1111andFaisal Memon 7924323a8f Specify ingress controller type (#43) 
* Specify ingress controller type

Signed-off-by: Kevin Fox <[email protected]>

* Fix indenting, docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix spacing

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing brackets

Signed-off-by: Kevin Fox <[email protected]>

* Add ingress-nginx support

Signed-off-by: Kevin Fox <[email protected]>

* Use the right example values for test version to upgrade from.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var in wrong location

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing arg

Signed-off-by: Kevin Fox <[email protected]>

* Try this to checkout the right version

Signed-off-by: Kevin Fox <[email protected]>

* Switch to upgrading from 0.14.0

Signed-off-by: Kevin Fox <[email protected]>

* Install crds

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Enable unset ingress controller type to use with openshift later

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs after merge issue

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-10-24 20:18:53 +00:00
github-actions[bot]marcofranssenFaisal Memon
 		0b174345ab Bump test chart dependencies (#54) 
Signed-off-by: GitHub <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-10-23 20:40:30 +00:00
Faisal Memon 78ba615c7d Update to SPIRE 1.8.2 (#40) 
Signed-off-by: Faisal Memon <[email protected]>
 2023-10-17 10:26:14 -07:00
github-actions[bot]andmarcofranssen 2644e4b198 Bump test chart dependencies (#38) 
Signed-off-by: GitHub <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
 2023-10-16 18:00:04 +00:00
kfox1111 dd87bc0fb2 Bump spire versions to 1.7.4 (#35) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-10-12 14:52:18 -07:00
kfox1111 df1abf6235 Bump to spire 1.7.3 (#31) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-10-10 22:28:24 -07:00
marcofranssen 11072780ca Bump test chart dependencies 
Signed-off-by: GitHub <[email protected]>
 2023-10-09 15:53:46 +02:00
github-actions[bot]andfaisal-memon 06d6690d71 Bump test chart dependencies (#20) 
Signed-off-by: GitHub <[email protected]>
Co-authored-by: faisal-memon <[email protected]>
 2023-10-05 11:21:51 -07:00
kfox1111 50825d9fc9 Deny production runs of example.org trust domains (#229) 2023-09-25 12:06:48 -07:00
KrishnaKrishnakumar VenkataramanMarco Franssen
 		65d56957de Migrate to readme-generator for helm maintained by bitnami (#431) 
Co-authored-by: Krishnakumar Venkataraman <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-09-08 09:39:30 +02:00
kfox1111andMarco Franssen e81a59a7e5 ingress-nginx production tests and spiffe-oidc-discovery-provider example (#136) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-08-29 15:22:00 +00:00
Drew Wellskfox1111Marco Franssen
 		cbe0001131 Federation test (#423) 
Co-authored-by: kfox1111 <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
 2023-08-22 20:07:54 +02:00
Marco Franssen 76e3665396 Fix annotation for spire-oidc deployment (#457) 2023-08-18 10:06:15 -07:00
Faisal MemonMarco FranssenKevin Fox
 		b7e15255f3 Allow job hooks to be disabled (#434) 
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Kevin Fox <[email protected]>
 2023-08-18 09:48:14 +02:00
kfox1111 72893515a2 Update spire bits to 1.7.2 (#452) 2023-08-17 10:10:45 -07:00
kfox1111 dc8a4545cc Array spacing in values is incorrect in a file. (#451) 2023-08-17 08:42:21 +02:00
kfox1111 48a2898016 Fix chainguard image references as per issue 442 (#443) 2023-08-16 16:22:09 +02:00
Drew Wells bfec27ef67 Fix jwtIssuer to allow for Uris including scheme (#425) 2023-08-09 16:53:21 +02:00
Drew WellsandFaisal Memon a09e054d04 support annotations so oidc can be annotated (#391) 
Signed-off-by: Drew Wells <[email protected]>
Signed-off-by: Drew Wells <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
 2023-07-31 10:54:01 -07:00
kfox1111 7d94b105ab Update spire to 1.7.1 (#412) 
Signed-off-by: Kevin Fox <[email protected]>
 2023-07-28 23:01:26 +02:00
Marco Franssen 06ddb7cd3f Use chart-testing ci/*-values.yaml for testing 
This also enables the refactor to have multiple root level charts.

Resolves #100

Signed-off-by: Marco Franssen <[email protected]>
 2023-07-19 22:48:19 +02:00
kfox1111 19d3208740 Fix oidc provider config change not rolling out (#383) 2023-07-12 21:05:09 +02:00
Drew Wells 4ad68b154b Add namespace to spiffe-oidc-discovery-provider RBAC definitions (#379) 2023-07-06 09:50:46 -07:00
kfox1111andMarco Franssen c1b1dd3d88 Add additional domains to JWT issued items. (#230) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-07-03 22:26:28 +02:00
Marco Franssen c11a8c00e7 Implement pre-delete hook for graceful delete of spiffe-oidc-discovery-provider (#353) 2023-06-17 06:06:27 -07:00