Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Helm Changes and OpenShift Support #1047

Merged
merged 44 commits into from
Jul 8, 2024
Merged

Helm Changes and OpenShift Support #1047

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
44 commits
Select commit Hold shift + click to select a range
6196330
testing
v0lkan Jul 6, 2024
93a783b
added security context
v0lkan Jul 6, 2024
b0c3607
manifest changes
v0lkan Jul 6, 2024
f60fc80
change root file system
v0lkan Jul 6, 2024
a9e45f5
move restricted to priveleged
v0lkan Jul 6, 2024
ab5f345
remove security context annotations
v0lkan Jul 6, 2024
a91b8f8
remove security context
v0lkan Jul 6, 2024
749a14d
add one more context
v0lkan Jul 6, 2024
4e4549e
test
v0lkan Jul 6, 2024
f07f48b
run as root
v0lkan Jul 6, 2024
4ca1a90
restricted
v0lkan Jul 6, 2024
0ba3867
policy test
v0lkan Jul 6, 2024
9e04af2
add seccomp profile
v0lkan Jul 6, 2024
e1d52ce
scm
v0lkan Jul 6, 2024
3707aab
disable readonly fs
v0lkan Jul 6, 2024
8681aa3
drop all
v0lkan Jul 6, 2024
1563f98
server drop all
v0lkan Jul 6, 2024
0869c4a
more security
v0lkan Jul 6, 2024
844ef87
lastworking
v0lkan Jul 6, 2024
f93e023
lastworking
v0lkan Jul 6, 2024
3d54952
yaml change
v0lkan Jul 6, 2024
0d3f44a
add crds
v0lkan Jul 6, 2024
9361878
add class names to cluster spiffe ids
v0lkan Jul 6, 2024
b70fd5a
clusterspiffeid exceptions
v0lkan Jul 6, 2024
ba78f0c
remove oidc
v0lkan Jul 6, 2024
3cb6051
new SPIRE helm charts (phase 1)
v0lkan Jul 7, 2024
a2c1550
remove hooks
v0lkan Jul 7, 2024
7af03af
create namespaces first
v0lkan Jul 7, 2024
dce7c4b
save config
v0lkan Jul 7, 2024
1685229
remove test connection pod
v0lkan Jul 7, 2024
1f5e148
image pull secrets
v0lkan Jul 7, 2024
826e519
changes
v0lkan Jul 7, 2024
b5fa685
added custom className for spire controller manager
v0lkan Jul 7, 2024
ad4042d
manifest update
v0lkan Jul 7, 2024
e807e47
manifest update
v0lkan Jul 7, 2024
dcebec6
enable openshift
v0lkan Jul 7, 2024
402c0be
add diagnostics
v0lkan Jul 7, 2024
5b2628a
ignore default namespace
v0lkan Jul 7, 2024
f144e10
add more debug
v0lkan Jul 7, 2024
6678c57
remove debugs
v0lkan Jul 7, 2024
363232e
enable openshift support
v0lkan Jul 7, 2024
e09162a
Helm docs update
v0lkan Jul 8, 2024
56fc076
delete spire backups
v0lkan Jul 8, 2024
6140065
remove redundant code
v0lkan Jul 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions examples/multiple_secrets/k8s-eks/Identity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ kind: ClusterSPIFFEID
metadata:
name: example
spec:
className: "vsecm"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This className is important because that’s how SPIRE manages its internal ClusterSPIFFEIDs too.

# SPIFFE ID `MUST` start with "spiffe://vsecm.com/workload/$workloadName/ns/"
# for `vsecm-safe` to recognize the workload and dispatch secrets to it.
spiffeIDTemplate: "spiffe://vsecm.com\
Expand Down
1 change: 1 addition & 0 deletions examples/multiple_secrets/k8s/Identity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ kind: ClusterSPIFFEID
metadata:
name: example
spec:
className: "vsecm"
# SPIFFE ID `MUST` start with "spiffe://vsecm.com/workload/$workloadName/ns/"
# for `vsecm-safe` to recognize the workload and dispatch secrets to it.
spiffeIDTemplate: "spiffe://vsecm.com\
Expand Down
1 change: 1 addition & 0 deletions examples/using_init_container/k8s-eks/Identity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ kind: ClusterSPIFFEID
metadata:
name: example
spec:
className: "vsecm"
# SPIFFE ID `MUST` start with "spiffe://vsecm.com/workload/$workloadName/ns/"
# for `vsecm-safe` to recognize the workload and dispatch secrets to it.
spiffeIDTemplate: "spiffe://vsecm.com\
Expand Down
1 change: 1 addition & 0 deletions examples/using_init_container/k8s/Identity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ kind: ClusterSPIFFEID
metadata:
name: example
spec:
className: "vsecm"
# SPIFFE ID `MUST` start with "spiffe://vsecm.com/workload/$workloadName/ns/"
# for `vsecm-safe` to recognize the workload and dispatch secrets to it.
spiffeIDTemplate: "spiffe://vsecm.com\
Expand Down
1 change: 1 addition & 0 deletions examples/using_sdk_go/k8s-eks/Identity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ kind: ClusterSPIFFEID
metadata:
name: example
spec:
className: "vsecm"
# SPIFFE ID `MUST` start with "spiffe://vsecm.com/workload/$workloadName/ns/"
# for `vsecm-safe` to recognize the workload and dispatch secrets to it.
spiffeIDTemplate: "spiffe://vsecm.com\
Expand Down
1 change: 1 addition & 0 deletions examples/using_sdk_go/k8s/Identity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ kind: ClusterSPIFFEID
metadata:
name: example
spec:
className: "vsecm"
# SPIFFE ID `MUST` start with "spiffe://vsecm.com/workload/$workloadName/ns/"
# for `vsecm-safe` to recognize the workload and dispatch secrets to it.
spiffeIDTemplate: "spiffe://vsecm.com\
Expand Down
1 change: 1 addition & 0 deletions examples/using_sidecar/k8s-eks/Identity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ kind: ClusterSPIFFEID
metadata:
name: example
spec:
className: "vsecm"
# SPIFFE ID `MUST` start with "spiffe://vsecm.com/workload/$workloadName/ns/"
# for `safe` to recognize the workload and dispatch secrets to it.
spiffeIDTemplate: "spiffe://vsecm.com\
Expand Down
1 change: 1 addition & 0 deletions examples/using_sidecar/k8s/Identity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ kind: ClusterSPIFFEID
metadata:
name: example
spec:
className: "vsecm"
# SPIFFE ID `MUST` start with "spiffe://vsecm.com/workload/$workloadName/ns/"
# for `safe` to recognize the workload and dispatch secrets to it.
spiffeIDTemplate: "spiffe://vsecm.com\
Expand Down
1 change: 1 addition & 0 deletions examples/using_vsecm_inspector/Identity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ kind: ClusterSPIFFEID
metadata:
name: vsecm-inspector
spec:
className: "vsecm"
spiffeIDTemplate: "spiffe://vsecm.com\
/workload/example\
/ns/{{ .PodMeta.Namespace }}\
Expand Down
1 change: 1 addition & 0 deletions examples/workshop_aegis/ids/Inspector.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ kind: ClusterSPIFFEID
metadata:
name: vsecm-inspector
spec:
className: "vsecm"
# SPIFFE ID `MUST` start with "spiffe://vsecm.com/workload/$workloadName/ns/"
# for `vsecm-safe` to recognize the workload and dispatch secrets to it.
spiffeIDTemplate: "spiffe://vsecm.com\
Expand Down
1 change: 1 addition & 0 deletions examples/workshop_aegis/ids/Workload.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ kind: ClusterSPIFFEID
metadata:
name: example
spec:
className: "vsecm"
# SPIFFE ID `MUST` start with "spiffe://vsecm.com/workload/$workloadName/ns/"
# for `vsecm-safe` to recognize the workload and dispatch secrets to it.
spiffeIDTemplate: "spiffe://vsecm.com\
Expand Down
1 change: 1 addition & 0 deletions examples/workshop_federation/cluster-1/inspector/Identity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ kind: ClusterSPIFFEID
metadata:
name: vsecm-inspector
spec:
className: "vsecm"
federatesWith: ["cluster2.demo"]
spiffeIDTemplate: "spiffe://cluster1.demo\
/workload/example\
Expand Down
1 change: 1 addition & 0 deletions examples/workshop_federation/cluster-1/sentinel/Identity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ kind: ClusterSPIFFEID
metadata:
name: vsecm-sentinel
spec:
className: "vsecm"
federatesWith: ["cluster2.demo"]
spiffeIDTemplate: "spiffe://cluster1.demo\
/workload/vsecm-sentinel\
Expand Down
1 change: 1 addition & 0 deletions examples/workshop_vsecm/ids/Example.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ kind: ClusterSPIFFEID
metadata:
name: example
spec:
className: "vsecm"
spiffeIDTemplate: "spiffe://vsecm.com\
/workload/example\
/ns/{{ .PodMeta.Namespace }}\
Expand Down
1 change: 1 addition & 0 deletions examples/workshop_vsecm/ids/Inspector.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ kind: ClusterSPIFFEID
metadata:
name: vsecm-inspector
spec:
className: "vsecm"
spiffeIDTemplate: "spiffe://vsecm.com\
/workload/example\
/ns/default\
Expand Down
1 change: 1 addition & 0 deletions examples/workshop_vsecm/workloads/keycloak/id.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ kind: ClusterSPIFFEID
metadata:
name: keycloak
spec:
className: "vsecm"
spiffeIDTemplate: "spiffe://vsecm.com\
/workload/keycloak\
/ns/{{ .PodMeta.Namespace }}\
Expand Down
12 changes: 0 additions & 12 deletions helm-charts-playground/atmp/clusterrole-spire-server-post-upgrade.yaml
View file
Open in desktop

This file was deleted.

12 changes: 0 additions & 12 deletions helm-charts-playground/atmp/clusterrole-spire-server-pre-upgrade.yaml
View file
Open in desktop

This file was deleted.

15 changes: 0 additions & 15 deletions helm-charts-playground/atmp/clusterrolebinding-spire-server-post-upgrade.yaml
View file
Open in desktop

This file was deleted.

14 changes: 0 additions & 14 deletions helm-charts-playground/atmp/clusterspiffeid-spire-server-spire-default.yaml
View file
Open in desktop

This file was deleted.

22 changes: 0 additions & 22 deletions helm-charts-playground/atmp/clusterspiffeid-spire-server-spire-oidc-discovery-provider.yaml
View file
Open in desktop

This file was deleted.

19 changes: 0 additions & 19 deletions helm-charts-playground/atmp/clusterspiffeid-spire-server-spire-test-keys.yaml
View file
Open in desktop

This file was deleted.

90 changes: 0 additions & 90 deletions helm-charts-playground/atmp/crds-v/spire.spiffe.io_clusterfederatedtrustdomains.yaml
View file
Open in desktop

This file was deleted.

Loading