Tornjak-helm

This release contains helm charts and documentation for Tornjak with SPIRE version 0.12.1

Initial SPIRE release

Introduction of SPIRE service

Added support for initContainers, TPM, Attestation and Keycloak

• Added initContainer to retrieve secrets from Vault
• Support for multiple initContainers
• Support for multiple pod images
• README documentation updates
• Added attestation to VTPM service
• Support for TPM Proxy when TPM device busy
• Introduced encoded owner password for TPM
• Enable Keycloak for Identity Management PoC

Secrects revocation and CRC support

• Supports secretes revocation. Sidecar removes the secrets from the container when they are removed from Vault
• move scripts to utils directory
• updates to OpenShift installation, including support for RH Code Ready Containers (CRC)
• automate demos with demos scripts
• move the location of the TSI directory from /tsi-secure to /var/tsi-secure on worker node

Application on-boarding scripts

• Added a script to help on-boarding applications: inspect secretes, create a secret injection, script to inspect claims and cluster information
• consolidated vault setup and initial policy load
• containerized all the scripts, so no additional tooling is needed locally
• redesign policy and role format
• added examples for pod, daemonset and deployment
• updated documentation for a vault demo and attack surface reduction

Moved 'vault-plugin' to 'components' directory

• moved 'vault-plugin' to 'components' directory
• fixed the bug that was preventing restart of JSS daemonsets
• published docs/attack-surface-reduction.md document

Location trust boundary enforcement

TSI ensures location trust boundary enforcement through embedding the location properties into the certificate structure. If the claims don't match the x509_v3 CA extensions the Signing Service and TSI Vault Auth Plugin will reject the request.

Protect TSI namespace

From now on, all the application containers must be deployed in a namespace different than TSI (default: trusted-identity)

Removed unnecessary pycrypto and extended examples

Removed unnecessary pycrypto requirement, extended examples (JWT client/server) and ti-setup helm charts

Webhook prevents containers from connecting to host socket

This release prevents containers from mounting to host socket files. Only the sidecar is allowed to access it. There are also new test cases for webhook. Upgraded to Go 1.14. This is the last release that contains extended examples: jwt-client and jwt-server