diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml index bcaa57d65..a24562471 100644 --- a/.github/workflows/helm-release.yaml +++ b/.github/workflows/helm-release.yaml @@ -29,9 +29,9 @@ jobs: git config user.email "$GITHUB_ACTOR@users.noreply.github.com" - name: Setup cosign - uses: sigstore/cosign-installer@v3.0.5 + uses: sigstore/cosign-installer@v3.1.1 with: - cosign-release: v2.0.2 + cosign-release: v2.1.1 - name: Set up Helm uses: azure/setup-helm@v3.5 @@ -66,3 +66,5 @@ jobs: digest="$(awk -F "[, ]+" '/Digest/{print $NF}' < .digest)" cosign sign ghcr.io/"${GITHUB_REPOSITORY_OWNER}"/helm-charts/"${name}"@"${digest}" done + env: + COSIGN_YES: true diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 900b8ecbb..4faa51581 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -3,7 +3,7 @@ name: spire description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.9.1 +version: 0.10.0 appVersion: "1.7.0" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts/tree/main/charts/spire diff --git a/charts/spire/README.md b/charts/spire/README.md index 740db08da..92accbf48 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -2,7 +2,7 @@ -![Version: 0.9.1](https://img.shields.io/badge/Version-0.9.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) +![Version: 0.10.0](https://img.shields.io/badge/Version-0.10.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. @@ -300,6 +300,7 @@ Now you can interact with the Spire agent socket from your own application. The | spire-server.controllerManager.enabled | bool | `false` | | | spire-server.controllerManager.identities.dnsNameTemplates | list | `[]` | | | spire-server.controllerManager.identities.enabled | bool | `true` | | +| spire-server.controllerManager.identities.federatesWith | list | `[]` | | | spire-server.controllerManager.identities.namespaceSelector | object | `{}` | | | spire-server.controllerManager.identities.podSelector | object | `{}` | | | spire-server.controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | | @@ -309,7 +310,7 @@ Now you can interact with the Spire agent socket from your own application. The | spire-server.controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | | spire-server.controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | | spire-server.controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry | -| spire-server.controllerManager.image.tag | string | `"0.2.2"` | Overrides the image tag | +| spire-server.controllerManager.image.tag | string | `"0.2.3"` | Overrides the image tag | | spire-server.controllerManager.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | spire-server.controllerManager.resources | object | `{}` | | | spire-server.controllerManager.securityContext | object | `{}` | | diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 36bcbe409..0f581a17f 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -50,6 +50,7 @@ A Helm chart to install the SPIRE server. | controllerManager.enabled | bool | `false` | | | controllerManager.identities.dnsNameTemplates | list | `[]` | | | controllerManager.identities.enabled | bool | `true` | | +| controllerManager.identities.federatesWith | list | `[]` | | | controllerManager.identities.namespaceSelector | object | `{}` | | | controllerManager.identities.podSelector | object | `{}` | | | controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | | @@ -59,7 +60,7 @@ A Helm chart to install the SPIRE server. | controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy | | controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from | | controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry | -| controllerManager.image.tag | string | `"0.2.2"` | Overrides the image tag | +| controllerManager.image.tag | string | `"0.2.3"` | Overrides the image tag | | controllerManager.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | controllerManager.resources | object | `{}` | | | controllerManager.securityContext | object | `{}` | | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml index 5967d313c..69c7c6f0d 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml @@ -8,6 +8,10 @@ metadata: namespace: {{ include "spire-server.namespace" $root }} spec: spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }} + {{- with .identities.federatesWith }} + federatesWith: + {{- toYaml . | nindent 4 }} + {{- end }} {{- with .identities.podSelector }} podSelector: {{- toYaml . | nindent 4 }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 17095b012..c859ddced 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -231,7 +231,7 @@ controllerManager: # -- This value is deprecated in favor of tag. (Will be removed in a future release) version: "" # -- Overrides the image tag - tag: "0.2.2" + tag: "0.2.3" resources: {} # We usually recommend not to specify default resources and to leave this as a conscious @@ -279,6 +279,9 @@ controllerManager: # spiffe.io/spiffe-id: "true" dnsNameTemplates: [] # - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local' + federatesWith: [] + # - example.io + # - example.ai validatingWebhookConfiguration: failurePolicy: Fail