From 0b6cd88d5627161fccd9680323e7f3d140b118b1 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Tue, 20 Feb 2024 08:50:18 -0800 Subject: [PATCH] Add support for specifying server admin_ids (#254) * Add support for specifying server admin_ids Signed-off-by: Kevin Fox * Update charts/spire/charts/spire-server/templates/configmap.yaml Signed-off-by: kfox1111 --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon --- charts/spire/charts/spire-server/README.md | 1 + charts/spire/charts/spire-server/templates/configmap.yaml | 4 ++++ charts/spire/charts/spire-server/values.yaml | 2 ++ 3 files changed, 7 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index d05abc1..d1a23e5 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -133,6 +133,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `dataStore.sql.externalSecret.enabled` | Enable external secret for datastore creds | `false` | | `dataStore.sql.externalSecret.name` | The name of the secret object | `""` | | `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` | +| `adminIDs` | SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges. | `[]` | | `auditLogEnabled` | If true, enables audit logging | `false` | | `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | | `jwtIssuer` | The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset | `""` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index fffc2eb..c4f9d73 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -40,6 +40,10 @@ {{- $keyManagerUsed := 0 }} {{- $root := . }} server: +{{- with .Values.adminIDs }} + admin_ids: + {{- toYaml . | nindent 4}} +{{- end }} bind_address: "0.0.0.0" bind_port: "8081" trust_domain: {{ include "spire-lib.trust-domain" . | quote }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index a955531..6bc6a78 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -173,6 +173,8 @@ dataStore: ## @param dataStore.sql.externalSecret.key The key of the secret object whose value is the dataStore.sql password key: "" +## @param adminIDs SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges. +adminIDs: [] ## @param auditLogEnabled If true, enables audit logging auditLogEnabled: false ## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"