From 01e031f71c70a7fa3fa5176befb63b5ad4e3e82b Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Fri, 26 Jan 2024 17:47:57 -0800 Subject: [PATCH] Add another upgrade note and fix value name (#215) * Add another upgrade note --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 --- charts/spire/README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 6b0b795..7f207bf 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -70,8 +70,9 @@ We only support upgrading one major version at a time. Version skipping isn't su ### 0.17.X +- If you set spire-server.replicaCount > 1, update it to 1 before upgrading and after upgrade you can set it back to its previous value. - The SPIFFE OIDC Discovery Provider now has many new TLS options and defaults to using SPIRE to issue its certificate. -- The `spiffe-oidc-discovery-provider.insecureScheme.enabled` flag was removed. If you previously set that flag, remove the setting from your values.yaml and see if the new default of using a SPIRE issued certificate is suitable for your deployment. If it isn't, please consider one of the other options under `spiffe-oidc-discovery-provider.tls`. If all other options are still unsuitable, you can still enable the previous mode by disabling TLS. (`spiffe-oidc-discovery-provider.spire.enabled=false`) +- The `spiffe-oidc-discovery-provider.insecureScheme.enabled` flag was removed. If you previously set that flag, remove the setting from your values.yaml and see if the new default of using a SPIRE issued certificate is suitable for your deployment. If it isn't, please consider one of the other options under `spiffe-oidc-discovery-provider.tls`. If all other options are still unsuitable, you can still enable the previous mode by disabling TLS. (`spiffe-oidc-discovery-provider.tls.spire.enabled=false`) - The SPIFFE OIDC Discovery Provider is now enabled by default. If you previously chose to have it off, you can disable it explicitly with `spiffe-oidc-discovery-provider.enabled=false`.