panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
160 Commits 1 Branch 2 Tags
fe7cd731d523d3f0aef3e22f9bebbb450d3ac021
Commit Graph
113 Commits
Author SHA1 Message Date
Marco Franssen 75480ede45 Bump spiffe-csi-driver image to 0.2.3 (arm64 support) 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-01 15:41:47 +01:00
Marco Franssen 79889ff3ed Bump spiffe-oidc-discovery-provider image to 1.6.0 (arm64 support) 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-01 15:41:47 +01:00
Marco Franssen a632f76021 Bump spire-agent image to 1.6.0 (arm64 support) 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-01 15:41:47 +01:00
Marco Franssen b92e81d416 Bump spire-server image to 1.6.0 (arm64 support) 
Signed-off-by: Marco Franssen <[email protected]>
 2023-03-01 15:41:47 +01:00
Faisal Memon fe93346b66 Use quote function instead of actual quotes 
Signed-off-by: Faisal Memon <[email protected]>
 2023-03-01 11:10:08 +01:00
kfox1111 4681498559 Better spire-server entry commands (#59) 
* Better spire-server entry commands

Currently in order to use the cli tools such as spire-server entry show
You must know the path within the container to the binary along with what
the path is to the socket. This patch makes that unnessisary. This now
works:
kubectl exec -it spire-server-0 -- spire-server entry show

Signed-off-by: Kevin Fox <[email protected]>

* Remove setting thats set to default

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
 2023-02-28 22:43:49 +01:00
Marco Franssen 72d4929670 Bump spire chart to v0.3.0 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-28 19:21:29 +01:00
Kevin Fox 9d7881f8b4 Switch hostpath to emptydir in spire-server 
The api of the server does not need to be exported out of the
server pod.

Signed-off-by: Kevin Fox <[email protected]>
 2023-02-28 09:49:13 -08:00
Marco Franssen f8cdec3f99 Allow to configure a priorityClassName for Daemonsets 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-27 08:09:00 -08:00
Marco Franssen ba41f04df5 Fix spire-controller-manager healthz port 
This to align with the spire-controller-manager-configmap.yaml

Signed-off-by: Marco Franssen <[email protected]>
 2023-02-27 08:08:17 -08:00
kfox1111andMarco Franssen 35eb3bb42e Basic Prometheus support (#28) 
Co-authored-by: Marco Franssen <[email protected]>
 2023-02-24 22:39:15 +01:00
Marco Franssen 495d9d67e8 Align healthz ports and checks across containers 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-24 21:06:09 +01:00
Marco Franssen 8d97803c8a Bump chart version to 0.2.0 and appVersion to 1.5.5 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:34:52 +01:00
Marco Franssen ec26d85f61 Enable spire-controller-manager by default 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:33:28 +01:00
kfox1111andFaisal Memon 8a3ae10da5 Add the option to disable unix workloadattestor (#26) 
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-23 10:32:35 +01:00
Marco Franssen 115d9bdf80 Add category and license annotations for artifacthub 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-22 12:37:00 +01:00
Kevin Fox 32303d7eba Remove the need for hostpath on oidc provider 
The hostpath isn't needed. This patch removes the extra mount and changes
it to an emptyDir.

Signed-off-by: Kevin Fox <[email protected]>
 2023-02-21 15:48:02 +01:00
Marco Franssen cb3f94022f Remove duplicate volume creation 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:37:31 +01:00
Marco Franssen 99d32050ba Remove option to choose different agent socket path 
Resolves #19

Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:23:36 +01:00
Marco FranssenandFaisal Memon 50846ebe9a Improve spiffe-csi security-context 
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:15 +01:00
Marco Franssen 4e1d3d78bb Improve README.md and artifacthub.io 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:15 +01:00
Marco Franssen ff9ab8693c Replace LICENSE 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:15 +01:00
Marco Franssen b3248e5c9c Remove deprecated k8s workload registrar support 
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:15 +01:00
Ken HuffmanandMarco Franssen 3448897316 Add namespaceSelector for spire-controller-manager (#112) 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:15 +01:00
Marco Franssen bba395b015 Add test for oidc discovery provider 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:15 +01:00
Marco Franssen 7d9ab07e23 Add the namespace to the oidc-discovery-provider allowed dns names 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:14 +01:00
Marco Franssen 5c8f1a7c9b Add spire-controller-manager keyword to chart 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:14 +01:00
Marco Franssen 5fe83469ba Fix link to sources 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:14 +01:00
Marco Franssen 8be96e4530 Fix spire validating webhook configuration 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:14 +01:00
Marco Franssen 3018ef8469 Add icon to spire chart 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:14 +01:00
Marco FranssenandGert Jan Kamstra 225931565a Include spire namespace to fix oidc-provider 
Signed-off-by: Marco Franssen <[email protected]>
Co-authored-by: Gert Jan Kamstra <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:13 +01:00
Marco Franssen 456c9cc53b Add by default k8s workload registrar compatible SPIFFEIDs to controller-manager setup 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:13 +01:00
Marco Franssen 31a75aeb43 Bump minimum spire version to 1.5.4 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:13 +01:00
Marco Franssen 0d49280cda Add support for spire-controller-manager 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:13 +01:00
Marco Franssen 977468bc6a Fix agent connectivity if deployed with different name 
e.g. if deploying with spire-65de556ac

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:13 +01:00
Marco Franssen 875b17a948 Fix RBAC permissions k8s-workload-registrar 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:13 +01:00
Marco Franssen 016e8336d0 Fix agent connectivity if deployed with different name 
e.g. if deploying with spire-65de556ac

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:12 +01:00
Marco Franssen 9921d1df40 Use correct helper function for upstream-ca-secret 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:12 +01:00
Marco Franssen 4a2b0ac69a Add spire-k8s-registrar service 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:12 +01:00
Marco Franssen 175d448341 Utilize helper function for spire-k8s-workload-registrar 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:12 +01:00
Marco Franssen 5ff662acea Update statement on minimum required spire version 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:12 +01:00
Marco Franssen 065689a6a4 Fix k8s workload registrar image pullPolicy 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:12 +01:00
Marco Franssen 05e1c2f736 Bump spire to latest 1.5.4 patch release 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:11 +01:00
Marco Franssen 8277bf0bd4 Patch wait-for-it to latest Januari release 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:11 +01:00
Marco Franssen f0921014cf Use template function from the right chart for oidc discovery provider configmap 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:11 +01:00
Marco Franssen 92440c72cc Add note on scaling spire-server to value docs 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:11 +01:00
Marco Franssen 0a0ddb4a9b Move the k8s-workload-registrar back into same pod as spire-server 
The k8s-workload-registrar needs access to the spire-server socket and
therefore has to run in the same pod to be able to mount the socket
into the container.

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:11 +01:00
Marco Franssen 738842de16 Fix oidc-discovery-provider config mount 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:11 +01:00
Marco Franssen 2c8ca0a237 List spire-server and spire-agent in dependencies 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:10 +01:00
Marco Franssen c7ebf72d13 Remove unused helpers from root 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
 2023-02-18 13:04:10 +01:00