panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add support for the new fallback spire-controller-manager feature (#471)

Browse Source 
* Add support for the new fallback spire-controller-manager feature

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
2024-10-17 12:38:25 -07:00
committed by GitHub
parent 0a6dd19906
commit 01c7227b13
4 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml
+5
View File
@@ -45,6 +45,11 @@ spec:
description: AutoPopulateDNSNames indicates whether or not to auto description: AutoPopulateDNSNames indicates whether or not to auto
populate service DNS names. populate service DNS names.
type: boolean type: boolean
fallback:
description: |-
Apply this ID only if there are no other matching non fallback
ClusterSPIFFEIDs
type: boolean
dnsNameTemplates: dnsNameTemplates:
description: DNSNameTemplate represents templates for extra DNS names description: DNSNameTemplate represents templates for extra DNS names
that are applicable to SVIDs minted for this ClusterSPIFFEID. The that are applicable to SVIDs minted for this ClusterSPIFFEID. The
charts/spire/charts/spire-server/README.md
+1
View File
@@ -289,6 +289,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.identities.clusterSPIFFEIDs.default.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` | | `controllerManager.identities.clusterSPIFFEIDs.default.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
| `controllerManager.identities.clusterSPIFFEIDs.default.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` | | `controllerManager.identities.clusterSPIFFEIDs.default.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` |
| `controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` | | `controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` |
| `controllerManager.identities.clusterSPIFFEIDs.default.fallback` | Apply this ID only if there are no other matching non fallback ClusterSPIFFEIDs | `true` |
| `controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled` | Enable this identity for controller manager | `false` | | `controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled` | Enable this identity for controller manager | `false` |
| `controllerManager.identities.clusterSPIFFEIDs.child-servers.type` | The type of rule this is. | `child-servers` | | `controllerManager.identities.clusterSPIFFEIDs.child-servers.type` | The type of rule this is. | `child-servers` |
| `controllerManager.identities.clusterSPIFFEIDs.child-servers.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `true` | | `controllerManager.identities.clusterSPIFFEIDs.child-servers.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `true` |
charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml
+4 -1
View File
@@ -30,7 +30,7 @@ matchLabels:
{{ $namespaces := list .Release.Namespace .Values.namespaceOverride (dig "spire" "namespaces" "server" "name" "" .Values.global) (dig "spire" "namespaces" "system" "name" "" .Values.global) | compact | uniq }} {{ $namespaces := list .Release.Namespace .Values.namespaceOverride (dig "spire" "namespaces" "server" "name" "" .Values.global) (dig "spire" "namespaces" "system" "name" "" .Values.global) | compact | uniq }}
{{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }} {{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }}
{{- range $skey, $svalue := $value }} {{- range $skey, $svalue := $value }}
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "type" "admin" "dnsNameTemplates" "downstream" "federatesWith" "jwtTTL" "namespaceSelector" "podSelector" "spiffeIDTemplate" "ttl" "workloadSelectorTemplates" "autoPopulateDNSNames")) }} {{- if not (has $skey (list "name" "annotations" "labels" "enabled" "type" "admin" "dnsNameTemplates" "downstream" "federatesWith" "jwtTTL" "namespaceSelector" "podSelector" "spiffeIDTemplate" "ttl" "workloadSelectorTemplates" "autoPopulateDNSNames" "fallback")) }}
{{- fail (printf "Unsupported property specified: %s" $skey) }} {{- fail (printf "Unsupported property specified: %s" $skey) }}
{{- end }} {{- end }}
{{- end }} {{- end }}
@@ -103,6 +103,9 @@ spec:
{{- with $value.autoPopulateDNSNames }} {{- with $value.autoPopulateDNSNames }}
autoPopulateDNSNames: {{ . }} autoPopulateDNSNames: {{ . }}
{{- end }} {{- end }}
{{- with $value.fallback }}
fallback: {{ . }}
{{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/values.yaml
+2
View File
@@ -628,6 +628,8 @@ controllerManager:
downstream: false downstream: false
## @param controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames Auto populate DNS names from services attached to pods ## @param controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames Auto populate DNS names from services attached to pods
autoPopulateDNSNames: false autoPopulateDNSNames: false
## @param controllerManager.identities.clusterSPIFFEIDs.default.fallback Apply this ID only if there are no other matching non fallback ClusterSPIFFEIDs
fallback: true
child-servers: child-servers:
## @param controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable this identity for controller manager ## @param controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable this identity for controller manager