Merge branch 'main' into release

.github/tests/charts.json

@@ -2,12 +2,12 @@
   {
     "name": "kube-prometheus-stack",
     "repo": "https://prometheus-community.github.io/helm-charts",
-    "version": "45.26.0"
+    "version": "45.29.0"
   },
   {
     "name": "cert-manager",
     "repo": "https://charts.jetstack.io",
-    "version": "v1.11.1"
+    "version": "v1.12.0"
   },
   {
     "name": "ingress-nginx",
@@ -17,11 +17,11 @@
   {
     "name": "mysql",
     "repo": "https://charts.bitnami.com/bitnami",
-    "version": "9.7.2"
+    "version": "9.10.1"
   },
   {
     "name": "postgresql",
     "repo": "https://charts.bitnami.com/bitnami",
-    "version": "12.2.2"
+    "version": "12.5.3"
   }
 ]

.github/tests/spire-oidc-insecure/values.yaml

@@ -1,3 +1,23 @@
+spire-server:
+  ingress:
+    enabled: true
+    className: "nginx"
+    annotations:
+      nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+      nginx.ingress.kubernetes.io/ssl-redirect: "true"
+      nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    hosts:
+    - host: ingress-nginx-controller.spire-oidc-insecure
+      paths:
+        - path: /
+          pathType: Prefix
+
+spire-agent:
+  server:
+    address: ingress-nginx-controller.spire-oidc-insecure
+    port: 443
+
 spiffe-oidc-discovery-provider:
   enabled: true
 

.github/tests/tornjak/install.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT=$(readlink -f "$0")
+SCRIPTPATH=$(dirname "$SCRIPT")
+
+helm install \
+  --namespace spire-server \
+  --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
+  --values "${SCRIPTPATH}/../../../examples/tornjak/values.yaml" \
+  spire charts/spire --wait
+helm test spire -n spire-server

.github/tests/tornjak/post-install.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
+
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../common.sh"
+
+print_helm_releases
+print_spire_workload_status spire-server spire-system
+
+kubectl rollout status --watch --timeout 180s --namespace spire-server deployments.apps spire-tornjak-frontend
+kubectl -n spire-server get deploy spire-tornjak-frontend
+kubectl -n spire-server get service spire-tornjak-frontend
+
+
+if [[ "$1" -ne 0 ]]; then
+  get_namespace_details spire-server
+  get_namespace_details spire-system
+fi

.github/tests/tornjak/pre-install.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+kubectl create namespace spire-system
+kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
+kubectl create namespace spire-server
+kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted

.github/workflows/check-versions.yaml

@@ -36,6 +36,7 @@ jobs:
         id: cpr
         uses: peter-evans/[email protected]
         with:
+          token: ${{ secrets.GITHUB_TOKEN }}
           title: Bump test chart dependencies
           branch: bump-test-chart-deps
           commit-message: Bump test chart dependencies

.github/workflows/helm-chart-ci-ignore.yaml

@@ -0,0 +1,60 @@
+name: Helm Chart CI
+
+on:
+  pull_request:
+    types: [synchronize, opened, reopened]
+    paths-ignore:
+      - 'charts/**'
+      - '.github/workflows/helm-chart-ci.yaml'
+      - '.github/kind/conf/kind-config.yaml'
+      - '.github/tests/**/*.yaml'
+      - '.github/tests/**/*.sh'
+      - '.github/tests/**/*.json'
+      - 'examples/**/*.yaml'
+      - 'helm-docs.sh'
+
+jobs:
+  lint-chart:
+    runs-on: ubuntu-22.04
+    steps:
+      - run: 'echo "Skipping linter"'
+
+  checks:
+    runs-on: ubuntu-22.04
+    steps:
+      - run: 'echo "Skipping checks"'
+
+  build-matrix:
+    name: Build matrix
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Checkout
+        uses: actions/[email protected]
+
+      - id: set-matrix
+        name: Collect all tests
+        run: |
+          tests="$(echo -e "default\n$(find .github/tests -maxdepth 1 -type d | grep -Ev 'tests$' | xargs -I % basename % | sort | uniq)")"
+          tests_json="$(echo "$tests" | jq -c --slurp --raw-input 'split("\n") | map(select(. != ""))')"
+          echo "tests=$tests_json" >> $GITHUB_OUTPUT
+
+    outputs:
+      tests: ${{ steps.set-matrix.outputs.tests }}
+
+  test:
+    runs-on: ubuntu-22.04
+    needs:
+      - build-matrix
+
+    strategy:
+      matrix:
+        k8s:
+          - v1.27.0
+          - v1.26.3
+          - v1.25.8
+        values:
+          - ${{ fromJson(needs.build-matrix.outputs.tests) }}
+
+    steps:
+      - run: 'echo "Skipping tests"'

.github/workflows/helm-chart-ci.yaml

@@ -10,6 +10,7 @@ on:
       - '.github/kind/conf/kind-config.yaml'
       - '.github/tests/**/*.yaml'
       - '.github/tests/**/*.sh'
+      - '.github/tests/**/*.json'
       - 'examples/**/*.yaml'
       - 'helm-docs.sh'
 
@@ -92,14 +93,6 @@ jobs:
         with:
           version: ${{ env.CHART_TESTING_VERSION }}
 
-      - name: Run chart-testing (list-changed)
-        id: list-changed
-        run: |
-          changed=$(ct list-changed --target-branch ${{ github.base_ref }})
-          if [[ -n "$changed" ]]; then
-            echo "changed=true" >> $GITHUB_OUTPUT
-          fi
-
       - name: Run chart-testing (lint)
         run: |
           ct lint --debug ${{ github.base_ref != 'release' && '--check-version-increment=false' || '' }} \
@@ -114,8 +107,6 @@ jobs:
 
     needs: [lint-chart]
 
-    if: needs.lint-chart.outputs.changed == 'true'
-
     steps:
       - name: Checkout
         uses: actions/[email protected]
@@ -137,8 +128,6 @@ jobs:
       - lint-chart
       - build-matrix
 
-    if: needs.lint-chart.outputs.changed == 'true'
-
     strategy:
       fail-fast: false
       matrix:
@@ -153,7 +142,6 @@ jobs:
           - v1.24.12
           - v1.23.17
           - v1.22.17
-          - v1.21.14
         values:
           - ${{ fromJson(needs.build-matrix.outputs.tests) }}
 
@@ -179,7 +167,7 @@ jobs:
           version: ${{ env.CHART_TESTING_VERSION }}
 
       - name: Create kind ${{ matrix.k8s }} cluster
-        uses: helm/kind-action@v1.5.0
+        uses: helm/kind-action@v1.7.0
         # Only build a kind cluster if there are chart changes to test.
         with:
           version: v0.18.0
@@ -209,6 +197,7 @@ jobs:
             "${TEST_DIR}/install.sh"
           else
             ct install --debug \
+              --charts "charts/spire" \
               --namespace "${scenario}" \
               --target-branch ${{ github.base_ref }} \
               --exclude-deprecated \

.github/workflows/helm-release.yaml

@@ -29,7 +29,7 @@ jobs:
           git config user.email "[email protected]"
 
       - name: Setup cosign
-        uses: sigstore/[email protected].3
+        uses: sigstore/[email protected].5
         with:
           cosign-release: v2.0.2
 

README.md

@@ -23,9 +23,9 @@ Unless otherwise noted in an application chart README, the following dependencie
 |:-----------|:-------------------|
 | SPIRE      | `1.5.3`+, `1.6.x`  |
 | Helm       | `3.x`              |
-| Kubernetes | `1.21+`            |
+| Kubernetes | `1.22+`            |
 
-> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. *The first version we tested this chart with is `1.21`.*
+> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. *The first version we tested this chart with is `1.22`.*
 
 ## Contributing
 

charts/spire/Chart.yaml

@@ -3,8 +3,8 @@ name: spire
 description: >
   A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
 type: application
-version: 0.7.0
-appVersion: "1.6.3"
+version: 0.8.0
+appVersion: "1.6.4"
 keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
 home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
 sources:
@@ -38,6 +38,10 @@ dependencies:
     condition: spiffe-oidc-discovery-provider.enabled
     repository: file://./charts/spiffe-oidc-discovery-provider
     version: 0.1.0
+  - name: tornjak-frontend
+    condition: tornjak-frontend.enabled
+    repository: file://./charts/tornjak-frontend
+    version: 0.1.0
 annotations:
   artifacthub.io/category: security
   artifacthub.io/license: Apache-2.0