panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "Added support for specifying Kubelet CA Path (#415)" (#422)

Browse Source 
This reverts commit abcf01958a.

Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
2024-08-13 11:03:31 -07:00
committed by GitHub
parent bf40797049
commit 0289e5fb00
3 changed files with 0 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-agent/README.md
-1
View File
@@ -88,7 +88,6 @@ A Helm chart to install the SPIRE agent.
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
| `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` | | `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` |
| `workloadAttestors.k8s.kubeletCaPath` | Path to the file containing CA certificates used to verify the kubelet certificate | `/run/secrets/kubernetes.io/serviceaccount/ca.crt` |
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` | | `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false | `false` | | `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false | `false` |
| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` | | `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` |
charts/spire/charts/spire-agent/templates/configmap.yaml
-1
View File
@@ -110,7 +110,6 @@ plugins:
# Minikube does not have a cert in the cluster CA bundle that # Minikube does not have a cert in the cluster CA bundle that
# can authenticate the kubelet cert, so skip validation. # can authenticate the kubelet cert, so skip validation.
skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }} skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }}
kubelet_ca_path: {{ .Values.workloadAttestors.k8s.kubeletCaPath }}
disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }} disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }}
use_new_container_locator: {{ .Values.workloadAttestors.k8s.useNewContainerLocator }} use_new_container_locator: {{ .Values.workloadAttestors.k8s.useNewContainerLocator }}
verbose_container_locator_logs: {{ .Values.workloadAttestors.k8s.verboseContainerLocatorLogs }} verbose_container_locator_logs: {{ .Values.workloadAttestors.k8s.verboseContainerLocatorLogs }}
charts/spire/charts/spire-agent/values.yaml
-2
View File
@@ -208,8 +208,6 @@ workloadAttestors:
enabled: true enabled: true
## @param workloadAttestors.k8s.skipKubeletVerification If true, kubelet certificate verification is skipped ## @param workloadAttestors.k8s.skipKubeletVerification If true, kubelet certificate verification is skipped
skipKubeletVerification: true skipKubeletVerification: true
## @param workloadAttestors.k8s.kubeletCaPath Path to the file containing CA certificates used to verify the kubelet certificate
kubeletCaPath: /run/secrets/kubernetes.io/serviceaccount/ca.crt
## @param workloadAttestors.k8s.disableContainerSelectors Set to true if using holdApplicationUntilProxyStarts in Istio ## @param workloadAttestors.k8s.disableContainerSelectors Set to true if using holdApplicationUntilProxyStarts in Istio
disableContainerSelectors: false disableContainerSelectors: false
## @param workloadAttestors.k8s.useNewContainerLocator If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false ## @param workloadAttestors.k8s.useNewContainerLocator If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false