3b016841da
* Add support for SPIRE deployment on OpenShift 4.13 Signed-off-by: Mariusz Sabath <[email protected]> Co-authored-by: Trilok Geer <[email protected]> Co-authored-by: Andrew Block <[email protected]> * Render README Signed-off-by: Mariusz Sabath <[email protected]> * Fix tornjak HTTP/HTTPS port values Signed-off-by: Mariusz Sabath <[email protected]> * Update Frontend README Signed-off-by: Mariusz Sabath <[email protected]> * Add env. variable to Agent to inject node name Signed-off-by: Mariusz Sabath <[email protected]> * Implement Marco's suggestion on CSI CSS version Signed-off-by: Mariusz Sabath <[email protected]> * Add MY_NODE_NAME env. variable to agent for openshift example Signed-off-by: Mariusz Sabath <[email protected]> * Move Openshift examples to dedicated directory Signed-off-by: Mariusz Sabath <[email protected]> * Simplified the install instructions Signed-off-by: Mariusz Sabath <[email protected]> * Suggested changes Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Andrew Block <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Update docs, fix default for backwards compat Signed-off-by: Kevin Fox <[email protected]> * Don't recommend experimental features by default, dont debug helm install by default and explain how to add additional features Signed-off-by: Kevin Fox <[email protected]> * Add notes about openshift to the project for other reviewers. Signed-off-by: Kevin Fox <[email protected]> * Fix incorrectly reverted change Signed-off-by: Kevin Fox <[email protected]> * Correct notes Signed-off-by: Kevin Fox <[email protected]> * Update default Signed-off-by: Kevin Fox <[email protected]> * Fix issue created from bad merge conflict resolution Signed-off-by: kfox1111 <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> --------- Signed-off-by: Mariusz Sabath <[email protected]> Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Trilok Geer <[email protected]> Co-authored-by: Andrew Block <[email protected]> Co-authored-by: Kevin Fox <[email protected]>
83 lines
1.8 KiB
YAML
83 lines
1.8 KiB
YAML
global:
|
|
openshift: true
|
|
telemetry:
|
|
prometheus:
|
|
enabled: true
|
|
|
|
spire-server:
|
|
tornjak:
|
|
image:
|
|
registry: ghcr.io
|
|
repository: spiffe/tornjak-backend
|
|
tag: ubi-v1.4.1
|
|
|
|
nodeAttestor:
|
|
k8sPsat:
|
|
serviceAccountAllowList: ["spire-system:spire-agent"]
|
|
notifier:
|
|
k8sbundle:
|
|
namespace: spire-system
|
|
podSecurityContext:
|
|
# These are unset so that openshift can automatically assign its own restricted uids to the pods
|
|
runAsUser: null
|
|
runAsGroup: null
|
|
fsGroup: null
|
|
|
|
spire-agent:
|
|
podSecurityContext:
|
|
runAsUser: null
|
|
runAsGroup: null
|
|
fsGroup: null
|
|
# Talk from the agent to kubelet based on hostname instead of localhost
|
|
extraEnvVars:
|
|
- name: MY_NODE_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: spec.nodeName
|
|
|
|
upstream-spire-agent:
|
|
podSecurityContext:
|
|
runAsUser: null
|
|
runAsGroup: null
|
|
fsGroup: null
|
|
|
|
spiffe-oidc-discovery-provider:
|
|
podSecurityContext:
|
|
runAsUser: null
|
|
runAsGroup: null
|
|
fsGroup: null
|
|
|
|
tornjak-frontend:
|
|
workingDir: /opt/app-root/src
|
|
image:
|
|
registry: ghcr.io
|
|
repository: spiffe/tornjak-frontend
|
|
tag: ubi-v1.4.1
|
|
podSecurityContext:
|
|
runAsUser: null
|
|
runAsGroup: null
|
|
fsGroup: null
|
|
|
|
spiffe-csi-driver:
|
|
csiDriverLabels:
|
|
security.openshift.io/csi-ephemeral-volume-profile: restricted
|
|
initContainers:
|
|
- terminationMessagePath: /dev/termination-log
|
|
name: set-context
|
|
command:
|
|
- chcon
|
|
- '-Rvt'
|
|
- container_file_t
|
|
- spire-agent-socket/
|
|
securityContext:
|
|
capabilities:
|
|
drop:
|
|
- all
|
|
privileged: true
|
|
imagePullPolicy: Always
|
|
volumeMounts:
|
|
- name: spire-agent-socket-dir
|
|
mountPath: /spire-agent-socket
|
|
terminationMessagePolicy: File
|
|
image: 'registry.access.redhat.com/ubi9:latest'
|