Marco Franssen
02ed2021c8
* 7984bbd Add script to automate cutting a release *eb186caAdd values for server TTL configurables *f123296Add a flag to configure the Kubernetes NodeAttestor (#83) *0275569Incorperate feedback *a00c97bIncorperate feedback *f93434aMake server service account allow list configurable *f0b7f5bMake spire agent server address configurable *cb627f0Allow all subchart to conditionally disable (#90) *2e9510fSwitch to non root nginx (#89) *a901751Fix Homepage URL *06c395fFix sources in Chart.yaml (#85) *d341c5aUpstreamAuthority cert-manager support (#82) *a82ee69Make sure all configmap changes rollout *b7f8c86Add extra initContainers, containers, volumes to agent and server *81ac89aAdd k8s 1.26.0 (Kind) to the test matrix *bb6abfcMerge pull request #76 from spiffe/dependabot/github_actions/sigstore/cosign-installer-3.0.1 *c0e5665Bump cosign to v2.0.0 *d729a44Bump sigstore/cosign-installer from 2.8.1 to 3.0.1 *fe7cd73Merge pull request #74 from spiffe/arm64-support *a3c04c0Update supported versions *75480edBump spiffe-csi-driver image to 0.2.3 (arm64 support) *79889ffBump spiffe-oidc-discovery-provider image to 1.6.0 (arm64 support) *a632f76Bump spire-agent image to 1.6.0 (arm64 support) *b92e81dBump spire-server image to 1.6.0 (arm64 support) *fea2aa5Fix sigstore/cosign-installer usage in release workflow *fe93346Use quote function instead of actual quotes *9480ab7Add beta note to readme (#62) *4681498Better spire-server entry commands (#59) Signed-off-by: Marco Franssen <[email protected]>
78 lines
2.9 KiB
Markdown
78 lines
2.9 KiB
Markdown
# spire
|
|
|
|
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
|
|
|
  
|
|
|
|
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
|
|
|
**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
|
|
|
> **Warning**: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server.
|
|
|
|
> **Note**: Minimum Spire version is `v1.5.3`.
|
|
|
|
To enable Projected Service Account Tokens on Docker for Mac/Windows run the following
|
|
command to SSH into the Docker Desktop K8s VM.
|
|
|
|
```bash
|
|
docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh
|
|
```
|
|
|
|
Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml`
|
|
|
|
```yaml
|
|
spec:
|
|
containers:
|
|
- command:
|
|
- kube-apiserver
|
|
- --api-audiences=api,spire-server
|
|
- --service-account-issuer=api,spire-agent
|
|
- --service-account-key-file=/run/config/pki/sa.pub
|
|
- --service-account-signing-key-file=/run/config/pki/sa.key
|
|
```
|
|
|
|
## Maintainers
|
|
|
|
| Name | Email | Url |
|
|
| ---- | ------ | --- |
|
|
| marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
|
|
|
|
## Source Code
|
|
|
|
* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
|
|
|
|
## Requirements
|
|
|
|
Kubernetes: `>=1.21.0-0`
|
|
|
|
| Repository | Name | Version |
|
|
|------------|------|---------|
|
|
| file://./charts/spiffe-csi-driver | spiffe-csi-driver | 0.1.0 |
|
|
| file://./charts/spiffe-oidc-discovery-provider | spiffe-oidc-discovery-provider | 0.1.0 |
|
|
| file://./charts/spire-agent | spire-agent | 0.1.0 |
|
|
| file://./charts/spire-server | spire-server | 0.1.0 |
|
|
|
|
## Values
|
|
|
|
| Key | Type | Default | Description |
|
|
|-----|------|---------|-------------|
|
|
| fullnameOverride | string | `""` | |
|
|
| nameOverride | string | `""` | |
|
|
| spiffe-csi-driver.enabled | bool | `true` | |
|
|
| spiffe-oidc-discovery-provider.enabled | bool | `false` | |
|
|
| spiffe-oidc-discovery-provider.trustDomain | string | `"example.org"` | |
|
|
| spire-agent.bundleConfigMap | string | `"spire-bundle"` | |
|
|
| spire-agent.clusterName | string | `"example-cluster"` | |
|
|
| spire-agent.enabled | bool | `true` | |
|
|
| spire-agent.nameOverride | string | `"agent"` | |
|
|
| spire-agent.trustDomain | string | `"example.org"` | |
|
|
| spire-server.bundleConfigMap | string | `"spire-bundle"` | |
|
|
| spire-server.clusterName | string | `"example-cluster"` | |
|
|
| spire-server.controllerManager.enabled | bool | `true` | |
|
|
| spire-server.enabled | bool | `true` | |
|
|
| spire-server.nameOverride | string | `"server"` | |
|
|
| spire-server.trustDomain | string | `"example.org"` | |
|
|
|
|
----------------------------------------------
|