sabsariandClaude Opus 4.8
cc164bad6b
Add support for the EJBCA UpstreamAuthority plugin, allowing the SPIRE server to use an EJBCA instance as its upstream CA over mTLS. - Add upstreamAuthority.ejbca values (hostname, caName, endEntityProfileName, certificateProfileName, optional endEntityName and accountBindingId). - Render the ejbca UpstreamAuthority block in the server config and count it toward the single-upstream-authority guard. - Mount the mTLS client credentials (and optional CA cert) from a secret, either chart-created (secret.create) or externally provided. - Gate ca_cert_path on secret.data.caCert, mirroring the disk plugin's bundle handling for deterministic rendering. - Regenerate the chart README and add a unit render test. Signed-off-by: sabsari <[email protected]> Co-authored-by: Claude Opus 4.8 <[email protected]>
Note
Things to consider:
- We do not support running out of the git main branch. This is where development happens. Please use released versions via the published repo or git tags.
- All the helm charts in this repo are beta. We encourage you to try them out and contribute. The API may change as we move towards a production ready release.
SPIFFE Helm Charts
A suite of Helm Charts for standardized installations of SPIRE components in Kubernetes environments.
How to install or upgrade
You most likely want to do an integrated setup based on the spire chart. See the Instructions.
Contributing
Before contributing ensure to check our CONTRIBUTING guidelines.
LICENSE
This project is licensed under Apache License, Version 2.0.
Reporting a Vulnerability
Vulnerabilities can be reported by sending an email to [email protected]. A confirmation email will be sent to acknowledge the report within 72 hours. A second acknowledgement will be sent within 7 days when the vulnerability has been positively or negatively confirmed.