Skip to content

Conversation

@sparksam
Copy link
Contributor

@sparksam sparksam commented Dec 4, 2025

Added:

This commit introduces the calico networking chart as a dependency for the secure-enclave chart, enabling network policy functionality. It includes the necessary Chart.yaml, Chart.lock, and values files for calico, along with updates to secure-enclave to reference the new calico dependency. The secure-enclave chart now conditionally installs calico based on the networkPolicy.enabled flag, and includes new network policy templates for trusted output applications. Additionally, the secure-enclave chart now uses a dedicated enclave-secret instead of individual secrets for setup and management apps.

Currently we bundle calico as a sub/chart but could also update the secure-enclave/Chart.yaml to point to the calico repository instead.

Limitations:

  • Calico exisiting installation cannot be checked during deployment so the user will have to only enable it if not installed prior.
  • There is a post install hook that will check the connectivity to google to see if the network constraints are enforced. Still need some work to perfect it.

Todo:

  • Implement a better testing of the network restrictions and fail the install if too permissive.
  • Move TOA and setup app to subcharts of the secure-enclave.

This commit introduces the calico networking chart as a dependency for the secure-enclave chart, enabling network policy functionality. It includes the necessary Chart.yaml, Chart.lock, and values files for calico, along with updates to secure-enclave to reference the new calico dependency. The secure-enclave chart now conditionally installs calico based on the networkPolicy.enabled flag, and includes new network policy templates for trusted output applications. Additionally, the secure-enclave chart now uses a dedicated enclave-secret instead of individual secrets for setup and management apps.
…t.yaml

Renamed the deployment template file to better reflect its purpose as an application deployment configuration, improving clarity and consistency in the secure enclave templates directory.
- Added file readability check before processing docker auth file
- Updated JSON field names from .username/.password to .name/.secret
- Implemented validation for required fields (username, password, serveraddress)
- Added error handling for missing or empty environment variables
- Maintained backward compatibility with existing workflow

The changes improve the robustness of the harbor-login script by adding proper input validation and error handling for the docker authentication file format.
…d" to "name"/"secret" in README.md. Also restructured the AWS storage class configuration documentation to provide more detailed descriptions for each parameter, improving clarity and usability for users deploying on AWS.
@sparksam sparksam requested review from a team and scb6 December 4, 2025 18:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants