Skip to content

Commit 80cb3c6

Browse files
minmzzhangminmzzhang
authored
Merge pull request #2 from minmzzhang/externalizing-charts
feat: Externalize ZTVP charts: ztwim
2 parents 961b9ea + f0ee762 commit 80cb3c6

18 files changed

Lines changed: 366 additions & 19 deletions

‎.github/linters/.checkov.yaml‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,13 @@ directory:
55
skip-path:
66
- tests
77
skip-check:
8-
- CKV_K8S_49 # Minimize wildcard use in Roles and ClusterRoles
9-
- CKV_K8S_155 # Minimize ClusterRoles that grant control over validating or mutating admission webhook configurations
10-
- CKV_K8S_156 # Minimize ClusterRoles that grant permissions to approve CertificateSigningRequests
11-
- CKV_K8S_157 # Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings
12-
- CKV_K8S_158 # Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles
8+
# CKV_K8S_49: Minimize wildcard use in Roles and ClusterRoles
9+
- CKV_K8S_49
10+
# CKV_K8S_155: ClusterRoles for admission webhook configurations
11+
- CKV_K8S_155
12+
# CKV_K8S_156: ClusterRoles to approve CertificateSigningRequests
13+
- CKV_K8S_156
14+
# CKV_K8S_157: Roles/ClusterRoles to bind RoleBindings or ClusterRoleBindings
15+
- CKV_K8S_157
16+
# CKV_K8S_158: Roles/ClusterRoles to escalate Roles or ClusterRoles
17+
- CKV_K8S_158

‎.github/workflows/superlinter.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,6 @@ jobs:
1414
with:
1515
sl_env: |
1616
VALIDATE_BIOME_FORMAT=false
17+
# Exclude Helm templates ({{ }} not valid YAML for yamllint/kubeconform)
18+
FILTER_REGEX_EXCLUDE=.*/templates/.*
19+
VALIDATE_GITHUB_ACTIONS_ZIZMOR=false

‎.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎.yamllint‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
extends: default
2+
ignore:
3+
- templates/
4+
- "**/templates/**"
5+
rules:
6+
document-start: disable
7+
line-length:
8+
max: 120
9+
brackets:
10+
min-spaces-inside: 0
11+
max-spaces-inside: 1

‎Chart.yaml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
apiVersion: v2
2-
description: A Helm chart to serve as the Validated Patterns Template
3-
keywords:
4-
- pattern
5-
name: vp-template
6-
version: 0.0.1
2+
name: zero-trust-workload-identity-manager
3+
description: Zero Trust Workload Identity Manager Helm Chart
4+
type: application
5+
version: 0.1.0
6+
home: https://github.com/validatedpatterns/ztwim-chart
7+
maintainers:
8+
- name: Validated Patterns Team
9+
email: validatedpatterns@googlegroups.com

‎Makefile‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,10 @@ test: helm-lint helm-unittest ## Runs helm lint and unit tests
3636
.PHONY: super-linter
3737
super-linter: ## Runs super linter locally
3838
rm -rf .mypy_cache
39-
podman run -e RUN_LOCAL=true -e USE_FIND_ALGORITHM=true \
40-
-e VALIDATE_BIOME_FORMAT=false \
41-
-v $(PWD):/tmp/lint:rw,z \
42-
-w /tmp/lint \
43-
ghcr.io/super-linter/super-linter:slim-v8
39+
podman run -e RUN_LOCAL=true -e USE_FIND_ALGORITHM=true \
40+
-e VALIDATE_BIOME_FORMAT=false \
41+
-e "FILTER_REGEX_EXCLUDE=.*/templates/.*" \
42+
-e VALIDATE_GITHUB_ACTIONS_ZIZMOR=false \
43+
-v $(PWD):/tmp/lint:rw,z \
44+
-w /tmp/lint \
45+
ghcr.io/super-linter/super-linter:slim-v8

‎README.md‎

Lines changed: 63 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,73 @@
1-
# vp-template
1+
# zero-trust-workload-identity-manager
22

3-
![Version: 0.0.1](https://img.shields.io/badge/Version-0.0.1-informational?style=flat-square)
3+
<!-- markdownlint-disable MD013 -->
44

5-
A Helm chart to serve as the Validated Patterns Template
5+
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
6+
7+
<!-- markdownlint-enable MD013 -->
8+
9+
<!-- markdownlint-disable MD013 -->
10+
11+
Zero Trust Workload Identity Manager Helm Chart
12+
13+
<!-- markdownlint-enable MD013 -->
614

715
This chart is used to serve as the template for Validated Patterns Charts
816

917
## Notable changes
1018

19+
**Homepage:** <https://github.com/validatedpatterns/ztwim-chart>
20+
21+
## Maintainers
22+
23+
| Name | Email | Url |
24+
| ----------------------- | ------------------------------------ | --- |
25+
| Validated Patterns Team | <validatedpatterns@googlegroups.com> | |
26+
27+
<!-- markdownlint-disable MD013 MD034 MD060 -->
28+
29+
## Values
30+
31+
| Key | Type | Default | Description |
32+
| -------------------------------------------------------------------------------- | ------ | -------------------------------------------------------------------------------- | ----------- |
33+
| global.hubClusterDomain | string | `"hub.example.com"` | |
34+
| global.localClusterDomain | string | `"local.example.com"` | |
35+
| spiffe.csi.agentSocketPath | string | `"/run/spire/agent-sockets"` | |
36+
| spire.agent.nodeAttestor.k8sPSATEnabled | string | `"true"` | |
37+
| spire.agent.workloadAttestors.k8sEnabled | string | `"true"` | |
38+
| spire.agent.workloadAttestors.workloadAttestorsVerification.hostCertBasePath | string | `"/var/lib/kubelet/pki"` | |
39+
| spire.agent.workloadAttestors.workloadAttestorsVerification.hostCertFileName | string | `""` | |
40+
| spire.agent.workloadAttestors.workloadAttestorsVerification.type | string | `"auto"` | |
41+
| spire.bundleConfigMap | string | `"spire-bundle"` | |
42+
| spire.clusterName | string | `"cluster"` | |
43+
| spire.oidcDiscoveryProvider.ingress.annotations."route.openshift.io/termination" | string | `"reencrypt"` | |
44+
| spire.oidcDiscoveryProvider.ingress.host | string | `"spire-spiffe-oidc-discovery-provider.{{ .Values.global.localClusterDomain }}"` | |
45+
| spire.oidcDiscoveryProvider.ingress.operatorManaged | string | `"true"` | |
46+
| spire.oidcDiscoveryProvider.service.name | string | `"spire-spiffe-oidc-discovery-provider"` | |
47+
| spire.oidcDiscoveryProvider.service.port | int | `443` | |
48+
| spire.server.ca.commonName | string | `"redhat.com"` | |
49+
| spire.server.ca.country | string | `"US"` | |
50+
| spire.server.ca.organization | string | `"Red Hat"` | |
51+
| spire.server.datastore.connMaxLifetime | int | `0` | |
52+
| spire.server.datastore.connectionString | string | `"/run/spire/data/datastore.sqlite3"` | |
53+
| spire.server.datastore.databaseType | string | `"sqlite3"` | |
54+
| spire.server.datastore.maxIdleConns | int | `10` | |
55+
| spire.server.datastore.maxOpenConns | int | `100` | |
56+
| spire.server.federation.bundleEndpoint.profile | string | `"https_spiffe"` | |
57+
| spire.server.federation.enabled | string | `"false"` | |
58+
| spire.server.federation.federatesWith | list | `[]` | |
59+
| spire.server.federation.ingress.annotations."route.openshift.io/termination" | string | `"passthrough"` | |
60+
| spire.server.federation.ingress.host | string | `"spire-server.{{ .Values.global.localClusterDomain }}"` | |
61+
| spire.server.federation.ingress.operatorManaged | string | `"true"` | |
62+
| spire.server.persistence.accessMode | string | `"ReadWriteOnce"` | |
63+
| spire.server.persistence.size | string | `"5Gi"` | |
64+
| spire.server.persistence.storageClass | string | `""` | |
65+
| spire.server.service.name | string | `"spire-server"` | |
66+
| spire.server.service.port | int | `443` | |
67+
| spire.trustDomain | string | `"{{ .Values.global.localClusterDomain }}"` | |
68+
69+
<!-- markdownlint-enable MD013 MD034 MD060 -->
70+
1171
---
1272

1373
Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)

‎README.md.gotmpl‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,13 @@
11
{{ template "chart.header" . }}
22
{{ template "chart.deprecationWarning" . }}
33

4+
<!-- markdownlint-disable MD013 -->
45
{{ template "chart.badgesSection" . }}
6+
<!-- markdownlint-enable MD013 -->
57

8+
<!-- markdownlint-disable MD013 -->
69
{{ template "chart.description" . }}
10+
<!-- markdownlint-enable MD013 -->
711

812
This chart is used to serve as the template for Validated Patterns Charts
913

@@ -17,6 +21,8 @@ This chart is used to serve as the template for Validated Patterns Charts
1721

1822
{{ template "chart.requirementsSection" . }}
1923

24+
<!-- markdownlint-disable MD013 MD034 MD060 -->
2025
{{ template "chart.valuesSection" . }}
26+
<!-- markdownlint-enable MD013 MD034 MD060 -->
2127

2228
{{ template "helm-docs.versionFooter" . }}

‎templates/.keep‎

Whitespace-only changes.

‎templates/SpiffeCSIDriver.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: operator.openshift.io/v1alpha1
2+
kind: SpiffeCSIDriver
3+
metadata:
4+
name: cluster
5+
spec:
6+
agentSocketPath: {{ .Values.spiffe.csi.agentSocketPath }}

0 commit comments

Comments
 (0)