Update spire-identity-exchange for 0.4.0 (#900)

* Update spire-identity-exchange for 0.4.0 Signed-off-by: Kevin Fox <[email protected]> * Understand the plugin config Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Update ip Signed-off-by: Kevin Fox <[email protected]> * Update name Signed-off-by: Kevin Fox <[email protected]> * Update name Signed-off-by: Kevin Fox <[email protected]> * Update name Signed-off-by: Kevin Fox <[email protected]> * Fix broken socket path Signed-off-by: Kevin Fox <[email protected]> * Nope, it was right before Signed-off-by: Kevin Fox <[email protected]> * Try disabling the spiffe plugin for now Signed-off-by: Kevin Fox <[email protected]> * Try logging more Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Add missing csi driver settings Signed-off-by: Kevin Fox <[email protected]> * Test Signed-off-by: Kevin Fox <[email protected]> * Test Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Use local oidc discovery provider path by default Signed-off-by: Kevin Fox <[email protected]> * Enable spire-identity-exchange in shared infrastructure Signed-off-by: Kevin Fox <[email protected]> * Update timeout Signed-off-by: Kevin Fox <[email protected]> * Update timeout Signed-off-by: Kevin Fox <[email protected]> * Test config Signed-off-by: Kevin Fox <[email protected]> * Test config Signed-off-by: Kevin Fox <[email protected]> * Test config Signed-off-by: Kevin Fox <[email protected]> * Test config Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Bump spire-ha-agent version to fix issue Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Bump version Signed-off-by: Kevin Fox <[email protected]> * Update version bits to match what it should be, minus final bump Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
2026-08-18 05:17:43 +00:00
parent de48d14312
commit 07ba722da0
45 changed files with 2120 additions and 580 deletions
@@ -1,4 +1,4 @@
-internal-spire-server-bottom-turtle-ha-a:
+internal-spire-server-bottom-turtle-ha-a: &server
  controllerManager:
    identities:
      clusterStaticEntries:
@@ -11,49 +11,25 @@ internal-spire-server-bottom-turtle-ha-a:
  spireIdentityExchange:
    enabled: true

-internal-spire-server-bottom-turtle-ha-b:
-  controllerManager:
-    identities:
-      clusterStaticEntries:
-        test:
-          parentID: spiffe://production.other/spire-identity-exchange
-          spiffeID: spiffe://production.other/k8s-psat/test
-          selectors:
-            - k8s_psat:namespace:default
-            - k8s_psat:service_account_name:default
-  spireIdentityExchange:
-    enabled: true
+#Set the same settings on the B side
+internal-spire-server-bottom-turtle-ha-b: *server

-spire-identity-exchange-bottom-turtle-ha-a:
-  rest:
-    ingress:
-      enabled: true
+spire-identity-exchange-bottom-turtle-ha-a: &six
  tls:
    externalSecret:
      enabled: true
      secretName: spire-identity-exchange
+    rest:
+      enabled: true
+      ingress:
+        enabled: true
  auth:
+    passthroughPlugins: true
    plugins:
-      - plugin: k8s_psat
+      k8s_psat:
        config:
-          audiences:
-            - spire-identity-exchange
          allowedServiceAccounts:
            - default/default

-spire-identity-exchange-bottom-turtle-ha-b:
-  rest:
-    ingress:
-      enabled: true
-  tls:
-    externalSecret:
-      enabled: true
-      secretName: spire-identity-exchange
-  auth:
-    plugins:
-      - plugin: k8s_psat
-        config:
-          audiences:
-            - spire-identity-exchange
-          allowedServiceAccounts:
-            - default/default
+#Set the same settings on the B side
+spire-identity-exchange-bottom-turtle-ha-b: *six