Merge branch 'main' into release

spiffe · Mar 29, 2024 · b693e74 · b693e74
2 parents 3e70c74 + 530b0bd
commit b693e74
Show file tree

Hide file tree

Showing 31 changed files with 206 additions and 88 deletions.
diff --git a/.github/tests/charts.json b/.github/tests/charts.json
@@ -2,7 +2,7 @@
  {
  "name": "kube-prometheus-stack",
  "repo": "https://prometheus-community.github.io/helm-charts",
- "version": "57.0.3"
+ "version": "57.1.1"
  },
  {
  "name": "cert-manager",
@@ -17,11 +17,11 @@
  {
  "name": "mysql",
  "repo": "https://charts.bitnami.com/bitnami",
- "version": "9.23.0"
+ "version": "10.1.0"
  },
  {
  "name": "postgresql",
  "repo": "https://charts.bitnami.com/bitnami",
- "version": "14.3.3"
+ "version": "15.1.4"
  }
 ]
diff --git a/.github/tests/common.sh b/.github/tests/common.sh
@@ -55,6 +55,7 @@ print_spire_workload_status () {
 | Namespace | Workload | Status |
 | --------- | ---------------------------------------------- | ------ |
 | ${ns1} | ${release_name}-server | <pre>$(k_rollout_status "${ns1}" statefulset "${release_name}-server")</pre> |
+| ${ns1} | ${release_name}-server | <pre>$(k_rollout_status "${ns1}" deployments.apps "${release_name}-server")</pre> |
 | ${ns2} | ${release_name}-spiffe-csi-driver | <pre>$(k_rollout_status "${ns2}" daemonset "${release_name}-spiffe-csi-driver")</pre> |
 | ${ns2} | ${release_name}-agent | <pre>$(k_rollout_status "${ns2}" daemonset "${release_name}-agent")</pre> |
 | ${ns1} | ${release_name}-spiffe-oidc-discovery-provider | <pre>$(k_rollout_status "${ns1}" deployments.apps "${release_name}-spiffe-oidc-discovery-provider")</pre> |

diff --git a/.github/tests/images.json b/.github/tests/images.json
@@ -7,11 +7,6 @@
  }
  ],
  "spire-agent/values.yaml": [
- {
- "query": "waitForIt.image",
- "filter": "LATESTSHA",
- "sort-flags": []
- },
  {
  "query": "socketAlternate.image",
  "filter": "LATESTSHA",

diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml
@@ -3,8 +3,8 @@ name: spire
 description: >
  A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
 type: application
-version: 0.19.0
-appVersion: "1.9.1"
+version: 0.19.1
+appVersion: "1.9.2"
 keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
 home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
 sources:

diff --git a/charts/spire/README.md b/charts/spire/README.md
@@ -1,6 +1,6 @@
 # spire
 
-![Version: 0.19.0](https://img.shields.io/badge/Version-0.19.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.9.1](https://img.shields.io/badge/AppVersion-1.9.1-informational?style=flat-square)
+![Version: 0.19.1](https://img.shields.io/badge/Version-0.19.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.9.2](https://img.shields.io/badge/AppVersion-1.9.2-informational?style=flat-square)
 [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
 
 A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
@@ -244,11 +244,12 @@ Now you can interact with the Spire agent socket from your own application. The
 
 ### Spire server parameters
 
-| Name | Description | Value |
-| ---------------------------------------- | --------------------------------------------- | -------- |
-| `spire-server.enabled` | Flag to enable Spire server | `true` |
-| `spire-server.nameOverride` | Overrides the name of Spire server pods | `server` |
-| `spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
+| Name | Description | Value |
+| ---------------------------------------- | ------------------------------------------------------------------------- | ------------- |
+| `spire-server.enabled` | Flag to enable Spire server | `true` |
+| `spire-server.nameOverride` | Overrides the name of Spire server pods | `server` |
+| `spire-server.kind` | Run spire server as deployment/statefulset. This feature is experimental. | `statefulset` |
+| `spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
 
 ### Spire agent parameters
 

diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md
@@ -57,7 +57,7 @@ A Helm chart to install the SPIFFE CSI driver.
 | `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
 | `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` |
 | `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` |
-| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.3` |
+| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.4` |
 | `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` |
 | `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
 | `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` |

diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml
@@ -116,7 +116,7 @@ nodeDriverRegistrar:
  registry: registry.k8s.io
  repository: sig-storage/csi-node-driver-registrar
  pullPolicy: IfNotPresent
- tag: v2.9.3
+ tag: v2.9.4
  ## @param nodeDriverRegistrar.resources Resource requests and limits for CSI driver pods
  resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious

diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md
@@ -115,11 +115,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
 | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
 | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
 | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
-| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d69268f206bc7914c25f7377309a73406517678458ebccec0e6bfab7b9b7e9d2` |
+| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:3b5e8046bc76624f645b97684845c3aef3c27d001db0f3f71d1ffbdf885edea7` |
 | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
 | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` |
 | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
-| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:faaccf708167925bbbf1dbfcbaf6ab733a170074bce7901542a0c38b87838842` |
+| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:803995505bc612174a9594a85493916a5234b6a8e0fa619763eceaf2d189cd75` |
 | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` |
 | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` |
 | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` |

diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
@@ -328,7 +328,7 @@ tests:
  registry: cgr.dev
  repository: chainguard/bash
  pullPolicy: IfNotPresent
- tag: latest@sha256:d69268f206bc7914c25f7377309a73406517678458ebccec0e6bfab7b9b7e9d2
+ tag: latest@sha256:3b5e8046bc76624f645b97684845c3aef3c27d001db0f3f71d1ffbdf885edea7
 
  toolkit:
  ## @param tests.toolkit.image.registry The OCI registry to pull the image from
@@ -340,7 +340,7 @@ tests:
  registry: cgr.dev
  repository: chainguard/slim-toolkit-debug
  pullPolicy: IfNotPresent
- tag: latest@sha256:faaccf708167925bbbf1dbfcbaf6ab733a170074bce7901542a0c38b87838842
+ tag: latest@sha256:803995505bc612174a9594a85493916a5234b6a8e0fa619763eceaf2d189cd75
 
  step:
  ## @param tests.step.image.registry The OCI registry to pull the image from

diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml
@@ -3,7 +3,7 @@ name: spire-agent
 description: A Helm chart to install the SPIRE agent.
 type: application
 version: 0.1.0
-appVersion: "1.9.1"
+appVersion: "1.9.2"
 keywords: ["spiffe", "spire-agent"]
 home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
 sources: