e030fa171b
* Add support for the new spire-controller-manager class feature Signed-off-by: Kevin Fox <[email protected]> * Fix docs. Swich nested deployment to use controller manager Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Test with nightly Signed-off-by: Kevin Fox <[email protected]> * Fix global object naming clash Signed-off-by: Kevin Fox <[email protected]> * Fix missing dot Signed-off-by: Kevin Fox <[email protected]> * Fix naming conflict with cluster ids Signed-off-by: Kevin Fox <[email protected]> * Fix scoping issue Signed-off-by: Kevin Fox <[email protected]> * Fix typo Signed-off-by: Kevin Fox <[email protected]> * Fix webhook name collision Signed-off-by: Kevin Fox <[email protected]> * Fix webhook reference and add note to user about className Signed-off-by: Kevin Fox <[email protected]> * Upgrade has to work on the old version of the object before rename Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Remove extra junk from job Signed-off-by: Kevin Fox <[email protected]> * Easier local runs and wait for crds Signed-off-by: Kevin Fox <[email protected]> * Add missing crd upgrade Signed-off-by: Kevin Fox <[email protected]> * Update upgrade notes Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml Co-authored-by: Marco Franssen <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Bump version to the released 0.4.0 Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Merge in crd changes from upstream Signed-off-by: Kevin Fox <[email protected]> * Add auto populate dns Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Add missing ClusterSPIFFEID fields There are a few options in the CRD not available via the chart. Sync them to the chart. Signed-off-by: Kevin Fox <[email protected]> * Add another missing one Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Allow additional CRs to be managed by the chart Sometimes additional ClusterSPIFFEIDs and the other CRs are needed. Add support for the end user to manage those extra CRs via the chart. Signed-off-by: Kevin Fox <[email protected]> * Add validation Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Add className to crs Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Fix readme formatting Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/README.md Signed-off-by: kfox1111 <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Remove dead code Signed-off-by: Kevin Fox <[email protected]> * Fix extra newline Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Marco Franssen <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
Recommended production setup
To install Spire with the least privileges possible we deploy spire across 2 namespaces.
kubectl create namespace "spire-system"
kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
kubectl create namespace "spire-server"
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
Update the example-your-values.yaml file with your values, then:
helm upgrade --install --namespace spire-server spire charts/spire \
-f examples/production/values.yaml -f examples/production/example-your-values.yaml --render-subchart-notes
If your using ingress-nginx and want to expose the spiffe oidc discovery provider outside the cluster, add the following to the end of the helm upgrade example:
-f examples/production/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml
If you want to expose your spire-server outside of Kubernetes and are using ingress-nginx, add following values file when running helm template/install/upgrade.
-f examples/production/values-expose-spire-server-ingress-nginx.yaml
For example:
helm upgrade --install --namespace spire-server spire charts/spire -f examples/production/values.yaml -f examples/production/values-expose-spire-server-ingress-nginx.yaml
If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx you have two options as described here: github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles
If you chose profile https_web, use:
-f examples/production/values-expose-federation-https-web-ingress-nginx.yaml
For example:
helm upgrade --install --namespace spire-server spire charts/spire -f examples/production/values.yaml -f examples/production/values-expose-federation-https-web-ingress-nginx.yaml
If you chose profile https_spiffe, use:
-f examples/production/values-expose-federation-https-spiffe-ingress-nginx.yaml
For example:
helm upgrade --install --namespace spire-server spire charts/spire -f examples/production/values.yaml -f examples/production/values-expose-federation-https-spiffe-ingress-nginx.yaml
See values.yaml for more details on the chart configurations to achieve this setup.