6c0a4fbb86
* Autogen jwtIssuer Unset a default for jwtIssuer and global.spire.jwtIssuer. When unset, generate it to the default of oidc-discovery.$trustDomain so in many cases the user doesn't need to set it at all. Signed-off-by: Kevin Fox <[email protected]> * Autogen tornjak's apiServerURL Unset the default tornjak apiServerURL. When unset, default to https://tornjak-backend.$trustDomain so in many cases users don't have to set it. Signed-off-by: Kevin Fox <[email protected]> * Do more autodetection Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Mariusz Sabath <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
Recommended setup to deploy Tornjak
Warning
The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production.
To install Spire with the least privileges possible we deploy spire across 2 namespaces.
kubectl create namespace "spire-system"
kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
kubectl create namespace "spire-server"
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
# deploy SPIRE with Tornjak enabled
helm upgrade --install --namespace spire-server \
--values ../production/values.yaml \
--values ./values.yaml \
--render-subchart-notes \
spire ../../charts/spire
# test the Tornjak deployment
helm test spire -n spire-server
Access tornjak
To access Tornjak you will have to use port-forwarding for the time being (until we add authentication and ingress).
Run following commands from your shell, if you ran with different values your namespace might differ. Consult the install notes printed when running above helm upgrade command in that case.
Since port-forward is a blocking command, execute them in two different consoles:
kubectl -n spire-server port-forward service/spire-tornjak-backend 10000:10000
kubectl -n spire-server port-forward service/spire-tornjak-frontend 3000:3000
You can now access Tornjak at localhost:3000.
See values.yaml for more details on the chart configurations to achieve this setup.