Add support for spire-controller-manager
Signed-off-by: Marco Franssen <[email protected]> Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
@@ -68,7 +68,6 @@ Kubernetes: `>=1.21.0-0`
|
||||
| spire-server.bundleConfigMap | string | `"spire-bundle"` | |
|
||||
| spire-server.clusterName | string | `"example-cluster"` | |
|
||||
| spire-server.nameOverride | string | `"server"` | |
|
||||
| spire-server.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | |
|
||||
| spire-server.trustDomain | string | `"example.org"` | |
|
||||
|
||||
----------------------------------------------
|
||||
|
||||
@@ -18,6 +18,16 @@ A Helm chart to install the SPIRE server.
|
||||
| ca_subject.country | string | `"NL"` | |
|
||||
| ca_subject.organization | string | `"Example"` | |
|
||||
| clusterName | string | `"example-cluster"` | |
|
||||
| controllerManager.enabled | bool | `false` | |
|
||||
| controllerManager.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| controllerManager.image.registry | string | `"ghcr.io"` | |
|
||||
| controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | |
|
||||
| controllerManager.image.version | string | `"0.2.1"` | |
|
||||
| controllerManager.resources | object | `{}` | |
|
||||
| controllerManager.securityContext | object | `{}` | |
|
||||
| controllerManager.service.annotations | object | `{}` | |
|
||||
| controllerManager.service.port | int | `443` | |
|
||||
| controllerManager.service.type | string | `"ClusterIP"` | |
|
||||
| dataStorage.accessMode | string | `"ReadWriteOnce"` | |
|
||||
| dataStorage.enabled | bool | `true` | |
|
||||
| dataStorage.size | string | `"1Gi"` | |
|
||||
@@ -29,7 +39,7 @@ A Helm chart to install the SPIRE server.
|
||||
| image.version | string | `""` | |
|
||||
| imagePullSecrets | list | `[]` | |
|
||||
| jwtIssuer | string | `"oidc-discovery.example.org"` | |
|
||||
| k8sWorkloadRegistrar.enabled | bool | `true` | |
|
||||
| k8sWorkloadRegistrar.enabled | bool | `true` | The `k8s-workload-registrar` is deprecated in favor of the `spire-controller-manager` A next release will switch to use the `spire-controller-manager` by default. |
|
||||
| k8sWorkloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| k8sWorkloadRegistrar.image.registry | string | `"gcr.io"` | |
|
||||
| k8sWorkloadRegistrar.image.repository | string | `"spiffe-io/k8s-workload-registrar"` | |
|
||||
|
||||
@@ -0,0 +1,96 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.8.0
|
||||
creationTimestamp: null
|
||||
name: clusterfederatedtrustdomains.spire.spiffe.io
|
||||
spec:
|
||||
group: spire.spiffe.io
|
||||
names:
|
||||
kind: ClusterFederatedTrustDomain
|
||||
listKind: ClusterFederatedTrustDomainList
|
||||
plural: clusterfederatedtrustdomains
|
||||
singular: clusterfederatedtrustdomain
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.trustDomain
|
||||
name: Trust Domain
|
||||
type: string
|
||||
- jsonPath: .spec.bundleEndpointURL
|
||||
name: Endpoint URL
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ClusterFederatedTrustDomain is the Schema for the clusterfederatedtrustdomains
|
||||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ClusterFederatedTrustDomainSpec defines the desired state
|
||||
of ClusterFederatedTrustDomain
|
||||
properties:
|
||||
bundleEndpointProfile:
|
||||
description: BundleEndpointProfile is the profile for the bundle endpoint.
|
||||
properties:
|
||||
endpointSPIFFEID:
|
||||
description: EndpointSPIFFEID is the SPIFFE ID of the bundle endpoint.
|
||||
It is required for the "https_spiffe" profile.
|
||||
type: string
|
||||
type:
|
||||
description: Type is the type of the bundle endpoint profile.
|
||||
enum:
|
||||
- https_spiffe
|
||||
- https_web
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
bundleEndpointURL:
|
||||
description: BundleEndpointURL is the URL of the bundle endpoint.
|
||||
It must be an HTTPS URL and cannot contain userinfo (i.e. username/password).
|
||||
type: string
|
||||
trustDomain:
|
||||
description: TrustDomain is the name of the trust domain to federate
|
||||
with (e.g. example.org)
|
||||
pattern: '[a-z0-9._-]{1,255}'
|
||||
type: string
|
||||
trustDomainBundle:
|
||||
description: TrustDomainBundle is the contents of the bundle for the
|
||||
referenced trust domain. This field is optional when the resource
|
||||
is created.
|
||||
type: string
|
||||
required:
|
||||
- bundleEndpointProfile
|
||||
- bundleEndpointURL
|
||||
- trustDomain
|
||||
type: object
|
||||
status:
|
||||
description: ClusterFederatedTrustDomainStatus defines the observed state
|
||||
of ClusterFederatedTrustDomain
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
@@ -0,0 +1,221 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.8.0
|
||||
creationTimestamp: null
|
||||
name: clusterspiffeids.spire.spiffe.io
|
||||
spec:
|
||||
group: spire.spiffe.io
|
||||
names:
|
||||
kind: ClusterSPIFFEID
|
||||
listKind: ClusterSPIFFEIDList
|
||||
plural: clusterspiffeids
|
||||
singular: clusterspiffeid
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ClusterSPIFFEID is the Schema for the clusterspiffeids API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ClusterSPIFFEIDSpec defines the desired state of ClusterSPIFFEID
|
||||
properties:
|
||||
admin:
|
||||
description: Admin indicates whether or not the SVID can be used to
|
||||
access the SPIRE administrative APIs. Extra care should be taken
|
||||
to only apply this SPIFFE ID to admin workloads.
|
||||
type: boolean
|
||||
dnsNameTemplates:
|
||||
description: DNSNameTemplate represents templates for extra DNS names
|
||||
that are applicable to SVIDs minted for this ClusterSPIFFEID. The
|
||||
node and pod spec are made available to the template under .NodeSpec,
|
||||
.PodSpec respectively.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
federatesWith:
|
||||
description: FederatesWith is a list of trust domain names that workloads
|
||||
that obtain this SPIFFE ID will federate with.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
namespaceSelector:
|
||||
description: NamespaceSelector selects the namespaces that are targetted
|
||||
by this CRD.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements.
|
||||
The requirements are ANDed.
|
||||
items:
|
||||
description: A label selector requirement is a selector that
|
||||
contains values, a key, and an operator that relates the key
|
||||
and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: operator represents a key's relationship to
|
||||
a set of values. Valid operators are In, NotIn, Exists
|
||||
and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: values is an array of string values. If the
|
||||
operator is In or NotIn, the values array must be non-empty.
|
||||
If the operator is Exists or DoesNotExist, the values
|
||||
array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: matchLabels is a map of {key,value} pairs. A single
|
||||
{key,value} in the matchLabels map is equivalent to an element
|
||||
of matchExpressions, whose key field is "key", the operator
|
||||
is "In", and the values array contains only "value". The requirements
|
||||
are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
podSelector:
|
||||
description: PodSelector selects the pods that are targetted by this
|
||||
CRD.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements.
|
||||
The requirements are ANDed.
|
||||
items:
|
||||
description: A label selector requirement is a selector that
|
||||
contains values, a key, and an operator that relates the key
|
||||
and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: operator represents a key's relationship to
|
||||
a set of values. Valid operators are In, NotIn, Exists
|
||||
and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: values is an array of string values. If the
|
||||
operator is In or NotIn, the values array must be non-empty.
|
||||
If the operator is Exists or DoesNotExist, the values
|
||||
array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: matchLabels is a map of {key,value} pairs. A single
|
||||
{key,value} in the matchLabels map is equivalent to an element
|
||||
of matchExpressions, whose key field is "key", the operator
|
||||
is "In", and the values array contains only "value". The requirements
|
||||
are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
spiffeIDTemplate:
|
||||
description: SPIFFEID is the SPIFFE ID template. The node and pod
|
||||
spec are made available to the template under .NodeSpec, .PodSpec
|
||||
respectively.
|
||||
type: string
|
||||
ttl:
|
||||
description: TTL indicates an upper-bound time-to-live for SVIDs minted
|
||||
for this ClusterSPIFFEID. If unset, a default will be chosen.
|
||||
type: string
|
||||
workloadSelectorTemplates:
|
||||
description: WorkloadSelectorTemplates are templates to produce arbitrary
|
||||
workload selectors that apply to a given workload before it will
|
||||
receive this SPIFFE ID. The rendered value is interpreted by SPIRE
|
||||
and are of the form type:value, where the value may, and often does,
|
||||
contain semicolons, .e.g., k8s:container-image:docker/hello-world
|
||||
The node and pod spec are made available to the template under .NodeSpec,
|
||||
.PodSpec respectively.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- spiffeIDTemplate
|
||||
type: object
|
||||
status:
|
||||
description: ClusterSPIFFEIDStatus defines the observed state of ClusterSPIFFEID
|
||||
properties:
|
||||
stats:
|
||||
description: Stats produced by the last entry reconciliation run
|
||||
properties:
|
||||
entriesMasked:
|
||||
description: How many entries were masked by entries for other
|
||||
ClusterSPIFFEIDs. This happens when one or more ClusterSPIFFEIDs
|
||||
produce an entry for the same pod with the same set of workload
|
||||
selectors.
|
||||
type: integer
|
||||
entriesToSet:
|
||||
description: How many entries are to be set for this ClusterSPIFFEID.
|
||||
In nominal conditions, this should reflect the number of pods
|
||||
selected, but not always if there were problems encountered
|
||||
rendering an entry for the pod (RenderFailures) or entries are
|
||||
masked (EntriesMasked).
|
||||
type: integer
|
||||
entryFailures:
|
||||
description: How many entries were unable to be set due to failures
|
||||
to create or update the entries via the SPIRE Server API.
|
||||
type: integer
|
||||
namespacesIgnored:
|
||||
description: How many (selected) namespaces were ignored (based
|
||||
on configuration).
|
||||
type: integer
|
||||
namespacesSelected:
|
||||
description: How many namespaces were selected.
|
||||
type: integer
|
||||
podEntryRenderFailures:
|
||||
description: How many failures were encountered rendering an entry
|
||||
selected pods. This could be due to either a bad template in
|
||||
the ClusterSPIFFEID or Pod metadata that when applied to the
|
||||
template did not produce valid entry values.
|
||||
type: integer
|
||||
podsSelected:
|
||||
description: How many pods were selected out of the namespaces.
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
@@ -0,0 +1,59 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.8.0
|
||||
creationTimestamp: null
|
||||
name: controllermanagerconfigs.spire.spiffe.io
|
||||
spec:
|
||||
group: spire.spiffe.io
|
||||
names:
|
||||
kind: ControllerManagerConfig
|
||||
listKind: ControllerManagerConfigList
|
||||
plural: controllermanagerconfigs
|
||||
singular: controllermanagerconfig
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ControllerManagerConfig is the Schema for the controllermanagerconfigs
|
||||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ControllerManagerConfigSpec defines the desired state of
|
||||
ControllerManagerConfig
|
||||
properties:
|
||||
foo:
|
||||
description: Foo is an example field of ControllerManagerConfig. Edit
|
||||
controllermanagerconfig_types.go to remove/update
|
||||
type: string
|
||||
type: object
|
||||
status:
|
||||
description: ControllerManagerConfigStatus defines the observed state
|
||||
of ControllerManagerConfig
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
@@ -85,6 +85,10 @@ Create the name of the service account to use
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-controller-manager.fullname" -}}
|
||||
{{ include "spire-server.fullname" . | trimSuffix "-server" }}-controller-manager
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-k8s-workload-registrar.fullname" -}}
|
||||
{{ include "spire-server.fullname" . | trimSuffix "-server" }}-k8s-workload-registrar
|
||||
{{- end }}
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
controller-manager-config.yaml: |
|
||||
apiVersion: spire.spiffe.io/v1alpha1
|
||||
kind: ControllerManagerConfig
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "spire-server.labels" . | nindent 8 }}
|
||||
metrics:
|
||||
bindAddress: 127.0.0.1:8082
|
||||
healthProbe:
|
||||
bindAddress: 127.0.0.1:8083
|
||||
leaderElection:
|
||||
leaderElect: true
|
||||
resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
|
||||
resourceNamespace: {{ .Release.Namespace }}
|
||||
clusterName: {{ .Values.clusterName }}
|
||||
trustDomain: {{ .Values.trustDomain }}
|
||||
ignoreNamespaces:
|
||||
- kube-system
|
||||
- kube-public
|
||||
- {{ .Release.Namespace }}
|
||||
- local-path-storage
|
||||
spireServerSocketPath: {{ .Values.socketPath | quote }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,80 @@
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-leader-election
|
||||
namespace: {{ .Release.Namespace }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-leader-election
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-leader-election
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire-server.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["namespaces"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "patch", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterfederatedtrustdomains"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterfederatedtrustdomains/finalizers"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterfederatedtrustdomains/status"]
|
||||
verbs: ["get", "patch", "update"]
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterspiffeids"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterspiffeids/finalizers"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterspiffeids/status"]
|
||||
verbs: ["get", "patch", "update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire-server.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,22 @@
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "spire-server.labels" . | nindent 4 }}
|
||||
{{- with .Values.controllerManager.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.controllerManager.service.type }}
|
||||
ports:
|
||||
- name: https
|
||||
port: {{ .Values.controllerManager.service.port }}
|
||||
targetPort: https
|
||||
protocol: TCP
|
||||
selector:
|
||||
{{- include "spire-server.selectorLabels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,35 @@
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
webhooks:
|
||||
- admissionReviewVersions: ["v1"]
|
||||
clientConfig:
|
||||
service:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-spire-spiffe-io-v1alpha1-clusterfederatedtrustdomain
|
||||
failurePolicy: Fail
|
||||
name: vclusterfederatedtrustdomain.kb.io
|
||||
rules:
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
apiVersions: ["v1alpha1"]
|
||||
operations: ["CREATE", "UPDATE"]
|
||||
resources: ["clusterfederatedtrustdomains"]
|
||||
sideEffects: None
|
||||
- admissionReviewVersions: ["v1"]
|
||||
clientConfig:
|
||||
service:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-spire-spiffe-io-v1alpha1-clusterspiffeid
|
||||
failurePolicy: Fail
|
||||
name: vclusterspiffeid.kb.io
|
||||
rules:
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
apiVersions: ["v1alpha1"]
|
||||
operations: ["CREATE", "UPDATE"]
|
||||
resources: ["clusterspiffeids"]
|
||||
sideEffects: None
|
||||
{{- end }}
|
||||
@@ -99,6 +99,38 @@ spec:
|
||||
mountPath: /run/spire/k8s-workload-registrar/config
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
- name: spire-controller-manager
|
||||
securityContext:
|
||||
{{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
|
||||
image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image) }}
|
||||
imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }}
|
||||
args:
|
||||
- --config=controller-manager-config.yaml
|
||||
ports:
|
||||
- name: https
|
||||
containerPort: 9443
|
||||
protocol: TCP
|
||||
# TODO: implement probes
|
||||
# livenessProbe:
|
||||
# httpGet:
|
||||
# path: /
|
||||
# port: https
|
||||
# readinessProbe:
|
||||
# httpGet:
|
||||
# path: /
|
||||
# port: https
|
||||
resources:
|
||||
{{- toYaml .Values.controllerManager.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spire-server-socket
|
||||
mountPath: /run/spire/server-sockets
|
||||
readOnly: true
|
||||
- name: controller-manager-config
|
||||
mountPath: /controller-manager-config.yaml
|
||||
subPath: controller-manager-config.yaml
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -133,6 +165,11 @@ spec:
|
||||
configMap:
|
||||
name: {{ include "spire-k8s-workload-registrar.fullname" . }}
|
||||
{{- end }}
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
- name: controller-manager-config
|
||||
configMap:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
{{- end }}
|
||||
volumeClaimTemplates:
|
||||
{{- if eq (.Values.dataStorage.enabled | toString) "true" }}
|
||||
- metadata:
|
||||
|
||||
@@ -107,7 +107,44 @@ upstreamAuthority:
|
||||
key: ""
|
||||
bundle: ""
|
||||
|
||||
controllerManager:
|
||||
enabled: false
|
||||
|
||||
image:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-controller-manager
|
||||
pullPolicy: IfNotPresent
|
||||
# Overrides the image tag whose default is the chart appVersion.
|
||||
version: "0.2.1"
|
||||
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
securityContext: {}
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 443
|
||||
annotations: {}
|
||||
|
||||
k8sWorkloadRegistrar:
|
||||
# -- The `k8s-workload-registrar` is deprecated in favor of the `spire-controller-manager`
|
||||
# A next release will switch to use the `spire-controller-manager` by default.
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
|
||||
@@ -9,8 +9,6 @@ spire-server:
|
||||
clusterName: &clusterName "example-cluster"
|
||||
trustDomain: &trustDomain "example.org"
|
||||
|
||||
socketPath: &serverSocketPath /run/spire/server-sockets/spire-server.sock
|
||||
|
||||
spire-agent:
|
||||
nameOverride: agent
|
||||
bundleConfigMap: *bundleConfigMap
|
||||
|
||||
Reference in New Issue
Block a user