Faisal MemonandKevin Fox
98ec4e680b
* Bump spire-lib and dependent Helm Chart versions (minor)
* 3c1dec30 fix casing of svidStore (#787)
Signed-off-by: Faisal Memon <[email protected]>
* Add missing repo reference
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Faisal Memon <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Kevin Fox <[email protected]>
spire-values.yaml
spire-server:
nodeAttestor:
httpChallenge:
enabled: true
controllerManager:
identities:
clusterSPIFFEIDs:
spiffe-step-ssh-config:
type: raw
namespaceSelector:
matchLabels:
"kubernetes.io/metadata.name": default
podSelector:
matchLabels:
app: spiffe-step-ssh
component: config
spiffe-step-ssh-fetchca:
type: raw
namespaceSelector:
matchLabels:
"kubernetes.io/metadata.name": default
podSelector:
matchLabels:
app: spiffe-step-ssh
component: fetchca
dnsNameTemplates:
- "spiffe-step-ssh-fetchca.{{ .TrustDomain }}"
helm upgrade --install -n spire-server spire-crds spire-crds --repo https://spiffe.github.io/helm-charts-hardened/ --create-namespace
helm upgrade --install -n spire-server spire spire --repo https://spiffe.github.io/helm-charts-hardened/ -f spire-values.yaml --set global.spire.ingressControllerType=ingress-nginx,spire-server.ingress.enabled=true
helm upgrade --install ingress-nginx ingress-nginx -n ingress-nginx --create-namespace --repo https://kubernetes.github.io/ingress-nginx --set controller.service.type=ClusterIP,controller.service.externalIPs[0]=$(minikube ip) --set controller.watchIngressWithoutClass=true --set controller.extraArgs.enable-ssl-passthrough=
PASSWORD=$(openssl rand -base64 48)
echo "$PASSWORD" > spiffe-step-ssh-password.txt
step ca init --helm --deployment-type=Standalone --name='My CA' --dns spiffe-step-ssh.example.org --ssh --address :8443 --provisioner default --password-file spiffe-step-ssh-password.txt > spiffe-step-ssh-values.yaml
ingress-values.yaml
global:
spiffe:
ingressControllerType: ingress-nginx
stepIngress:
enabled: true
fetchCA:
ingress:
enabled: true
helm upgrade --install spiffe-step-ssh . --set caPassword=`cat spiffe-step-ssh-password.txt` -f spiffe-step-ssh-values.yaml -f ingress-values.yaml --set trustDomain=example.org