* 7df063f Upgrade SPIRE to 1.10.3 (#412)
* de5ec47 Bump test chart dependencies (#445)
* e72b94f Add all built in BundlePublishers (#430)
* 532852d Bump test chart dependencies (#440)
* 6e8ad56 Add a spire-agent auto kubelet verification mode (#435)
* 50c741e Remove extra check that sometimes breaks oidc (#437)
* e062b9f Support ipv4 only clusters (#434)
* b96e07e Enable more forms of kubelet certificate verification (#426)
* f92d729 Add missing properties required by SecurityContextConstraints CRD (#432)
* 8553a78 Bump test chart dependencies (#431)
Signed-off-by: Faisal Memon <[email protected]>
* Add a spire-agent auto kubelet verification mode
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
* 9b2d72f Fix permission issue with 1.10 and defaults when upgraded (#423)
* 827a3ea Bump spire to 1.10.1 (#424)
* 0289e5f Revert "Added support for specifying Kubelet CA Path (#415)" (#422)
* bf40797 Bump test chart dependencies (#418)
* abcf019 Added support for specifying Kubelet CA Path (#415)
* 6d4d526 Allow configuring persistence in the spire-agent (#414)
Signed-off-by: Faisal Memon <[email protected]>
* Update to SPIRE 1.10.0
Remove the options that were removed in 1.10, and update.
Signed-off-by: Kevin Fox <[email protected]>
* Update docs
Signed-off-by: Kevin Fox <[email protected]>
* Fix uid mismatch issue on 1.10.0+
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* Complete Server K8S PSAT support
Add all the SPIRE Server supported options for the K8S PSAT attestor. This retains the
ease of use for configuring local cluster support while adding the ability to configure
multiple/external clusters as well. Kubeconfig support is added in its own config block
as it will be used/shared with spire-controller-manager support in the future.
Signed-off-by: Kevin Fox <[email protected]>
* Fix merge conflict
Signed-off-by: Kevin Fox <[email protected]>
* Add support for integration tests in the tests/integration dir
Signed-off-by: Kevin Fox <[email protected]>
* Fix split issue and typo
Signed-off-by: Kevin Fox <[email protected]>
* Add basic psat test
Signed-off-by: Kevin Fox <[email protected]>
* Fix linter
Signed-off-by: Kevin Fox <[email protected]>
* Fix up test
Signed-off-by: Kevin Fox <[email protected]>
* Add missing file
Signed-off-by: Kevin Fox <[email protected]>
* Better encode config
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-server/values.yaml
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Update docs
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-server/values.yaml
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Add external k8s bundler
Adds support to sync the CA bundle to configmaps in external
Kubernetes clusters
Signed-off-by: Kevin Fox <[email protected]>
* Update default
Signed-off-by: Kevin Fox <[email protected]>
* Fix config file layout. Incorperate feedback.
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Update based on parent pr feedback
Signed-off-by: Kevin Fox <[email protected]>
* Reformat config file
Signed-off-by: Kevin Fox <[email protected]>
* Fix some things
Signed-off-by: Kevin Fox <[email protected]>
* Reconfigure kind
Signed-off-by: Kevin Fox <[email protected]>
* More debugging
Signed-off-by: Kevin Fox <[email protected]>
* Fix up kind
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Add external spire-controller-managers
Only one external controller manager is supported at a time until
https://github.com/spiffe/spire/issues/4898 is resolved.
Signed-off-by: Kevin Fox <[email protected]>
* Fix tests
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Upgrade to spire-controller-manager 0.5.0
Signed-off-by: Kevin Fox <[email protected]>
* Update for released 0.5.0
Signed-off-by: Kevin Fox <[email protected]>
* Merge in some of the id prefix pr
Signed-off-by: Kevin Fox <[email protected]>
* Entry ID Prefix (#287)
* Add Entry ID Prefix support
Signed-off-by: Kevin Fox <[email protected]>
* Mulitcluster test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Implement cleanup setting too
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Bump up test container
Signed-off-by: Kevin Fox <[email protected]>
* Swith to testing with nightly
Signed-off-by: Kevin Fox <[email protected]>
* Fix value name
Signed-off-by: Kevin Fox <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix up doc formatting
Signed-off-by: Kevin Fox <[email protected]>
* Fix merge conflict
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-server/values.yaml
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Changes the default service port for the spire-server to 443 to allow easier switching between internal access and external access through an ingress controller.
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: Faisal Memon <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
When you have multiple spire servers, they often all need to be
configured to use the same storage class. Let them all be set
to the same value all at once.
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* Bump spire Helm Chart version from 0.18.1 to 0.18.2
* fd3b7d5 Fix duplicate securityContext section in spire-agent (#279)
Signed-off-by: Faisal Memon <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Add spire-server as deployment
Signed-off-by: aniket patel <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Add stateless-server example
Signed-off-by: aniket patel <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Update README.md to add deploymentType
Signed-off-by: anhpatel <[email protected]>
Signed-off-by: aniket patel <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Set hpa type based on deploymentType
Signed-off-by: aniket patel <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Change deploymentType values to lowercase in README
Signed-off-by: aniket patel <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Update readme for stateless-server
Signed-off-by: aniket patel <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Revert README changes
Signed-off-by: aniket patel <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Update readme for deploymentType
Signed-off-by: aniket patel <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Failure handling only when deployment type checked
Signed-off-by: aniket patel <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Fix issue with tests not running on automated PRs (#266)
* Use github app for version checker
Signed-off-by: Faisal Memon <[email protected]>
* Use full version
Signed-off-by: Faisal Memon <[email protected]>
---------
Signed-off-by: Faisal Memon <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Bump test chart dependencies (#282)
Co-authored-by: marcofranssen <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Bump peter-evans/create-pull-request from 6.0.1 to 6.0.2 (#283)
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 6.0.1 to 6.0.2.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](https://github.com/peter-evans/create-pull-request/compare/v6.0.1...v6.0.2)
---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: aniket patel <[email protected]>
* Complete Server K8S PSAT support (#242)
* Complete Server K8S PSAT support
Add all the SPIRE Server supported options for the K8S PSAT attestor. This retains the
ease of use for configuring local cluster support while adding the ability to configure
multiple/external clusters as well. Kubeconfig support is added in its own config block
as it will be used/shared with spire-controller-manager support in the future.
Signed-off-by: Kevin Fox <[email protected]>
* Fix merge conflict
Signed-off-by: Kevin Fox <[email protected]>
* Add support for integration tests in the tests/integration dir
Signed-off-by: Kevin Fox <[email protected]>
* Fix split issue and typo
Signed-off-by: Kevin Fox <[email protected]>
* Add basic psat test
Signed-off-by: Kevin Fox <[email protected]>
* Fix linter
Signed-off-by: Kevin Fox <[email protected]>
* Fix up test
Signed-off-by: Kevin Fox <[email protected]>
* Add missing file
Signed-off-by: Kevin Fox <[email protected]>
* Better encode config
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-server/values.yaml
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Update docs
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-server/values.yaml
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Update default
Signed-off-by: Kevin Fox <[email protected]>
* Fix config file layout. Incorperate feedback.
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Fix up kind
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Add external k8s bundler (#270)
* Complete Server K8S PSAT support
Add all the SPIRE Server supported options for the K8S PSAT attestor. This retains the
ease of use for configuring local cluster support while adding the ability to configure
multiple/external clusters as well. Kubeconfig support is added in its own config block
as it will be used/shared with spire-controller-manager support in the future.
Signed-off-by: Kevin Fox <[email protected]>
* Fix merge conflict
Signed-off-by: Kevin Fox <[email protected]>
* Add support for integration tests in the tests/integration dir
Signed-off-by: Kevin Fox <[email protected]>
* Fix split issue and typo
Signed-off-by: Kevin Fox <[email protected]>
* Add basic psat test
Signed-off-by: Kevin Fox <[email protected]>
* Fix linter
Signed-off-by: Kevin Fox <[email protected]>
* Fix up test
Signed-off-by: Kevin Fox <[email protected]>
* Add missing file
Signed-off-by: Kevin Fox <[email protected]>
* Better encode config
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-server/values.yaml
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Update docs
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-server/values.yaml
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Add external k8s bundler
Adds support to sync the CA bundle to configmaps in external
Kubernetes clusters
Signed-off-by: Kevin Fox <[email protected]>
* Update default
Signed-off-by: Kevin Fox <[email protected]>
* Fix config file layout. Incorperate feedback.
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Update based on parent pr feedback
Signed-off-by: Kevin Fox <[email protected]>
* Reformat config file
Signed-off-by: Kevin Fox <[email protected]>
* Fix some things
Signed-off-by: Kevin Fox <[email protected]>
* Reconfigure kind
Signed-off-by: Kevin Fox <[email protected]>
* More debugging
Signed-off-by: Kevin Fox <[email protected]>
* Fix up kind
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Bump helm.sh/helm/v3 from 3.14.2 to 3.14.3 in /tests (#285)
Bumps [helm.sh/helm/v3](https://github.com/helm/helm) from 3.14.2 to 3.14.3.
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](https://github.com/helm/helm/compare/v3.14.2...v3.14.3)
---
updated-dependencies:
- dependency-name: helm.sh/helm/v3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: aniket patel <[email protected]>
* Bump docker/login-action from 3.0.0 to 3.1.0 (#286)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.0.0 to 3.1.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v3...v3.1.0)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: aniket patel <[email protected]>
* Bump test chart dependencies
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: aniket patel <[email protected]>
* Bump github.com/onsi/gomega from 1.31.1 to 1.32.0 in /tests (#291)
Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.31.1 to 1.32.0.
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/gomega/compare/v1.31.1...v1.32.0)
---
updated-dependencies:
- dependency-name: github.com/onsi/gomega
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: aniket patel <[email protected]>
* Bump github.com/onsi/ginkgo/v2 from 2.16.0 to 2.17.0 in /tests (#292)
Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.16.0 to 2.17.0.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.16.0...v2.17.0)
---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: aniket patel <[email protected]>
* Update examples/stateless-server/README.md
Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: anhpatel <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Update charts/spire/charts/spire-server/templates/hpa.yaml
Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: anhpatel <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Update examples/stateless-server/README.md
Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: anhpatel <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Update examples/stateless-server/README.md
Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: anhpatel <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Move spire-server pod spec to _pod_spec
Signed-off-by: aniket patel <[email protected]>
* Support hybrid nodes with different attestors or config (#218)
* Add direct tpm support for spire-agent
Signed-off-by: Kevin Fox <[email protected]>
* Add fingerprinting support
Signed-off-by: Kevin Fox <[email protected]>
* Add example
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-agent/templates/configmap.yaml
Signed-off-by: kfox1111 <[email protected]>
* Support hybrid nodes with different attestors
In some clusters, you may have a mix of nodes with differing attestor
needs. For example, some nodes have hardware TPMs and some without.
This patch enables configuring multiple daemonsets for the agent
that you can target to pools of nodes.
Signed-off-by: Kevin Fox <[email protected]>
* Remove extra slash
Signed-off-by: Kevin Fox <[email protected]>
* Update docs
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-agent/templates/configmap.yaml
Signed-off-by: kfox1111 <[email protected]>
* Fix broken tests
Signed-off-by: Kevin Fox <[email protected]>
* Add daemonset labels
Signed-off-by: Kevin Fox <[email protected]>
* Add temporary upgrade hook
Signed-off-by: Kevin Fox <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Fix include
Signed-off-by: Kevin Fox <[email protected]>
* Add missing values
Signed-off-by: Kevin Fox <[email protected]>
* Fix perms, add upgrade note
Signed-off-by: Kevin Fox <[email protected]>
* Fix hardcoded nodeAttestor and keyManager in spire-agent
Fixes: https://github.com/spiffe/helm-charts-hardened/issues/220
Signed-off-by: Kevin Fox <[email protected]>
* Fix merge issues
Signed-off-by: Kevin Fox <[email protected]>
* Fix unit tests
Signed-off-by: Kevin Fox <[email protected]>
* Pass the agent's securityContext on to Kubernetes
Currently its ignored.
Signed-off-by: Kevin Fox <[email protected]>
* Update example to be usable
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Signed-off-by: kfox1111 <[email protected]>
* Update example
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Fix merge conflict issue
Signed-off-by: Kevin Fox <[email protected]>
* Update to the newest release
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Signed-off-by: kfox1111 <[email protected]>
* Apply suggestions from code review
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix version numbers in docs
Signed-off-by: Kevin Fox <[email protected]>
* Remove merge conflicted extra code
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Change production example to be an integration test (#237)
* Change production example to be an integration test
The documentation is a better example then the test now. Separate the
two.
Signed-off-by: Kevin Fox <[email protected]>
* Fix job name reference
Signed-off-by: Kevin Fox <[email protected]>
* Fix job name reference
Signed-off-by: Kevin Fox <[email protected]>
* Update postgresql example
Signed-off-by: Kevin Fox <[email protected]>
* Update mysql example
Signed-off-by: Kevin Fox <[email protected]>
* Update nested and mysql
Signed-off-by: Kevin Fox <[email protected]>
* Fix typo
Signed-off-by: Kevin Fox <[email protected]>
* Add support for integration tests in the tests/integration dir
Signed-off-by: Kevin Fox <[email protected]>
* Fix split issue and typo
Signed-off-by: Kevin Fox <[email protected]>
* Fix split issue
Signed-off-by: Kevin Fox <[email protected]>
* Try folding example your values into bash so that its not laying around in an fs for a user to accidently use.
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Cleanup
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Remove production values reference
Signed-off-by: aniket patel <[email protected]>
* Update charts/spire/charts/spire-server/templates/pre-delete-hook.yaml
Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: anhpatel <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Update examples/stateless-server/run-tests.sh
Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: anhpatel <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Bump spire Helm Chart version from 0.18.2 to 0.19.0
* 72768ec Support hybrid nodes with different attestors or config (#218)
* 5299642 Bump test chart dependencies
* 36e9315 Add external k8s bundler (#270)
* ef610df Complete Server K8S PSAT support (#242)
* d96271c Bump test chart dependencies (#282)
Signed-off-by: Faisal Memon <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Fix production test (#297)
Signed-off-by: aniket patel <[email protected]>
* Bump test chart dependencies (#299)
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Bump github.com/onsi/ginkgo/v2 from 2.17.0 to 2.17.1 in /tests (#298)
Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.17.0 to 2.17.1.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.17.0...v2.17.1)
---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Fix documentation issue (#300)
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: aniket patel <[email protected]>
* Move statefulset and deployment to server-resource
Signed-off-by: aniket patel <[email protected]>
* Change deploymentType to kind
Signed-off-by: aniket patel <[email protected]>
---------
Signed-off-by: Faisal Memon <[email protected]>
Signed-off-by: aniket patel <[email protected]>
Signed-off-by: aniket patel <[email protected]>
Signed-off-by: anhpatel <[email protected]>
Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: aniket patel <[email protected]>
Co-authored-by: spire-helm-version-checker[bot] <161522935+spire-helm-version-checker[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kfox1111 <[email protected]>
* Add direct tpm support for spire-agent
Signed-off-by: Kevin Fox <[email protected]>
* Add fingerprinting support
Signed-off-by: Kevin Fox <[email protected]>
* Add example
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-agent/templates/configmap.yaml
Signed-off-by: kfox1111 <[email protected]>
* Support hybrid nodes with different attestors
In some clusters, you may have a mix of nodes with differing attestor
needs. For example, some nodes have hardware TPMs and some without.
This patch enables configuring multiple daemonsets for the agent
that you can target to pools of nodes.
Signed-off-by: Kevin Fox <[email protected]>
* Remove extra slash
Signed-off-by: Kevin Fox <[email protected]>
* Update docs
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-agent/templates/configmap.yaml
Signed-off-by: kfox1111 <[email protected]>
* Fix broken tests
Signed-off-by: Kevin Fox <[email protected]>
* Add daemonset labels
Signed-off-by: Kevin Fox <[email protected]>
* Add temporary upgrade hook
Signed-off-by: Kevin Fox <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Fix include
Signed-off-by: Kevin Fox <[email protected]>
* Add missing values
Signed-off-by: Kevin Fox <[email protected]>
* Fix perms, add upgrade note
Signed-off-by: Kevin Fox <[email protected]>
* Fix hardcoded nodeAttestor and keyManager in spire-agent
Fixes: https://github.com/spiffe/helm-charts-hardened/issues/220
Signed-off-by: Kevin Fox <[email protected]>
* Fix merge issues
Signed-off-by: Kevin Fox <[email protected]>
* Fix unit tests
Signed-off-by: Kevin Fox <[email protected]>
* Pass the agent's securityContext on to Kubernetes
Currently its ignored.
Signed-off-by: Kevin Fox <[email protected]>
* Update example to be usable
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Signed-off-by: kfox1111 <[email protected]>
* Update example
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Fix merge conflict issue
Signed-off-by: Kevin Fox <[email protected]>
* Update to the newest release
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Signed-off-by: kfox1111 <[email protected]>
* Apply suggestions from code review
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix version numbers in docs
Signed-off-by: Kevin Fox <[email protected]>
* Remove merge conflicted extra code
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* beda725 Add pod labels to the SPIRE agent (#273)
* 077f152 Bump test chart dependencies (#272)
* 5849ea2 add pod labels to spire server values (#271)
* f512b06 Configurable daemonsets updateStrategy (#212)
* a539065 Add direct tpm support for spire-agent (#216)
* fcd0c11 Add direct tpm support for spire-server (#211)
* c570174 Enable CA settings via global (#268)
* ac83694 Initial SPIRE 1.9.0 support (#262)
* ddb4eff Bump test chart dependencies (#263)
* bfbafbc Fix OpenShift Federation Ingress bug (#260)
* a0baace Upgrade to spire-controller-manager 0.4.3 (#258)
* 1446f7e Add support for specifying agent authorized_delegates (#255)
* 0b6cd88 Add support for specifying server admin_ids (#254)
* 07a1c39 Add global override for kubectl tag (#251)
* b82a84d Bump test chart dependencies (#252)
* 7a1e731 Bump test chart dependencies (#246)
* a706063 make audit_log_enabled configurable (#241)
* 34a39cb Added emptyDir volume to spire-agent SCC (#243)
* a2e5a4e Add support for enabling the spire-agent admin socket (#234)
* febdcbf Fix whitespace in spire-agent daemonset
Signed-off-by: Faisal Memon <[email protected]>
Adds a global.spire.caSubject section where you can set the CA
subject information for all spire-server instances.
Signed-off-by: Kevin Fox <[email protected]>
* d547532 Pass the agent's securityContext on to Kubernetes (#225)
* 6b03d5a Fix hardcoded nodeAttestor and keyManager in spire-agent (#221)
* f4c92ed Update README.md put cleanup seperately (#223)
* 7542052 Bump test chart dependencies (#219)
* 01e031f Add another upgrade note and fix value name (#215)
* 0fbc512 Remove the white line from securityContext rendering
* 573beaf More quickly detect a daemonset is up and running
* e8d527c Update to spire-controller-manager 0.4.2 (#195)
* 25558d3 Update daemonset.yaml (#204)
Signed-off-by: Faisal Memon <[email protected]>
* 4c307c1 Add missing bundlePublisher section and extraEnv so settings can be set (#201)
* d724d1e Update the documentation (#172)
* e59a29b Bump test chart dependencies (#200)
* 4668151 Add missing extraVolumeMounts to the controllerManager (#196)
* b9ac3c4 Update to spire-controller-manager 0.4.1 (#193)
* 6fec1e5 Update SPIRE to 1.8.7 (#194)
* af155c2 Add support for running spiffe secured discovery provider (default) (#163)
* 3ccdb5e Add tls section to federation bundle endpoint and fix up annotations (#173)
* c7ab131 Add join_token server nodeattestor support (#187)
* 81e9523 Bump test chart dependencies (#186)
* 6d19a76 Fix agent daemonset format (#184)
* b61d4f5 Add spire-agent to spire-agent pod path (#180)
* befa074 Fix notes bug (#178)
* 912c61e Remove deprecated version values (#179)
* ae4ef6e Update HorizontalPodAutoscaler API to autoscaling/v2 (#153)
* e7a61a9 Bump test chart dependencies
* 183e9aa SPIFFE OIDC Discovery Provider Rework (#152)
* 8f1aba8 Bump test chart dependencies (#171)
* 2454b8c Fix links still pointing at older git repo (#167)
* e5c5527 Bump test chart dependencies (#165)
* e630008 Update jwt test to work with newer slim images (#139)
* c39dd44 Add recommendation for namespacePSS (#131)
* 49beb64 Add recommendation for namespaceLayout (#127)
* 33cacd2 Add recommendation for prometheus exporter (#144)
* 6997d6a Add recommendation for securityContext and podSecurityContext (#125)
* 50c4ac3 Add recommendation for strictMode (#143)
* 4fb9d18 Bump test chart dependencies (#155)
* 811123a Update the Tornjak image version (#150)
* 1524537 Update default for additionalDomains not to include localhost (#146)
* e35838c Add recommendation for priorityClass (#124)
* 9f72a8f Use good and automatic defaults for tornjak frontend workingDir (#129)
* 7726351 Tornjak UBI support (#123)
* 89c07e2 Revert openssl 3.2 change (#142)
* a3d3702 Bump test chart dependencies
* 80c7653 Bump test chart dependencies (#134)
* 13f6028 SELinux support (#122)
* 3e8335c Add a flag to enable recommendations (#121)
* 692d463 Remove unneeded lookup function from upgrade hook (#104)
* 8422b8d Added ability to create namespaces (#103)
Signed-off-by: Kevin Fox <[email protected]>
