From 1169dd5692ffbd7b704df0587450cb33dbaae5e0 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Wed, 23 Apr 2025 10:56:55 -0700 Subject: [PATCH] Update spire-controller-manager to 0.6.2 and add its staticManifest support (#563) * Update spire-controller-manager to 0.6.2 and add its staticManifest support Signed-off-by: Kevin Fox * Update docs Signed-off-by: Kevin Fox * Fix indent Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox --- charts/spire/charts/spire-server/README.md | 3 +- .../_controller-manager-container.tpl | 10 ++ .../controller-manager-cluster-ids.yaml | 2 + .../controller-manager-configmap.yaml | 7 ++ .../templates/controller-manager-ftd.yaml | 73 +++++++----- .../templates/controller-manager-roles.yaml | 2 +- .../templates/controller-manager-service.yaml | 2 + .../controller-manager-static-configmap.yaml | 21 ++++ .../controller-manager-static-entries.yaml | 109 ++++++++++-------- .../templates/controller-manager-webhook.yaml | 2 + .../templates/post-install-hook.yaml | 2 + .../templates/post-upgrade-hook.yaml | 2 + .../templates/pre-upgrade-hook.yaml | 2 + .../templates/server-resource.yaml | 5 + charts/spire/charts/spire-server/values.yaml | 5 +- examples/static-manifest-server/values.yaml | 31 +++++ 16 files changed, 197 insertions(+), 81 deletions(-) create mode 100644 charts/spire/charts/spire-server/templates/controller-manager-static-configmap.yaml create mode 100644 examples/static-manifest-server/values.yaml diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 7882326..df2c2c6 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -257,6 +257,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `notifier.externalK8sBundle.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `bundle.crt` | | `notifier.externalK8sBundle.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` | | `controllerManager.enabled` | Flag to enable controller manager | `false` | +| `controllerManager.staticManifestMode` | Flag to configure static mode. Valid options off, internal, and external. If internal, the identities config options will be rendered to an included configmap | `off` | | `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` | | `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` | | `controllerManager.entryIDPrefixCleanup` | Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` | @@ -268,7 +269,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.0` | +| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.2` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | diff --git a/charts/spire/charts/spire-server/templates/_controller-manager-container.tpl b/charts/spire/charts/spire-server/templates/_controller-manager-container.tpl index 4c0b4e9..5ce76c3 100644 --- a/charts/spire/charts/spire-server/templates/_controller-manager-container.tpl +++ b/charts/spire/charts/spire-server/templates/_controller-manager-container.tpl @@ -75,7 +75,11 @@ {{- end }} env: - name: ENABLE_WEBHOOKS + {{- if eq .Values.controllerManager.staticManifestMode "off" }} value: {{ .webhooksEnabled | toString | quote }} + {{- else }} + value: "false" + {{- end }} {{- if gt (len $extraEnv) 0 }} {{- $extraEnv | toYaml | nindent 4 }} {{- end }} @@ -91,6 +95,7 @@ - containerPort: {{ $promPort }} name: prom-cm{{ .suffix }} {{- end }} +{{- if eq .Values.controllerManager.staticManifestMode "off" }} livenessProbe: httpGet: path: /healthz @@ -99,12 +104,17 @@ httpGet: path: /readyz port: healthz +{{- end }} resources: {{- toYaml .Values.controllerManager.resources | nindent 4 }} volumeMounts: - name: spire-server-socket mountPath: /tmp/spire-server/private readOnly: true + {{- if ne .Values.controllerManager.staticManifestMode "off" }} + - name: controller-manager-static-config + mountPath: /manifests + {{- end }} - name: controller-manager-config mountPath: /controller-manager-config{{ .suffix }}.yaml subPath: controller-manager-config{{ .suffix }}.yaml diff --git a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml index 1973bda..f16c4de 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml @@ -26,6 +26,7 @@ matchLabels: {} {{- end }} {{- end }} +{{- if eq .Values.controllerManager.staticManifestMode "off" }} {{- $root := . }} {{ $namespaces := list .Release.Namespace .Values.namespaceOverride (dig "spire" "namespaces" "server" "name" "" .Values.global) (dig "spire" "namespaces" "system" "name" "" .Values.global) | compact | uniq }} {{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }} @@ -116,3 +117,4 @@ spec: {{- end }} {{- end }} {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml index f5bad18..57a2f9e 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -47,10 +47,12 @@ metrics: bindAddress: 0.0.0.0:{{ $promPort }} health: healthProbeBindAddress: 0.0.0.0:{{ $healthPort }} +{{- if eq .Values.controllerManager.staticManifestMode "off" }} leaderElection: leaderElect: true resourceName: {{ printf "%s-%s%s" .Release.Namespace (default .Release.Name .Values.crNameOverride) .suffix | sha256sum | trunc 8 }}.spiffe.io resourceNamespace: {{ include "spire-server.namespace" . }} +{{- end }} {{- with .settings.cacheNamespaces }} cacheNamespaces: {{- toYaml . | nindent 2 }} @@ -85,7 +87,12 @@ parentIDTemplate: {{ if hasKey .settings "parentIDTemplate" }}{{ .settings.paren {{- $reconcile = .settings.reconcile }} {{- end }} reconcile: + {{- if eq .Values.controllerManager.staticManifestMode "off" }} clusterSPIFFEIDs: {{ if hasKey $reconcile "clusterSPIFFEIDs" }}{{ toYaml $reconcile.clusterSPIFFEIDs }}{{ else }}{{ toYaml .defaults.reconcile.clusterSPIFFEIDs }}{{ end }} + {{- end }} clusterStaticEntries: {{ if hasKey $reconcile "clusterStaticEntries" }}{{ toYaml $reconcile.clusterStaticEntries }}{{ else }}{{ toYaml .defaults.reconcile.clusterStaticEntries }}{{ end }} clusterFederatedTrustDomains: {{ if hasKey $reconcile "clusterFederatedTrustDomains" }}{{ toYaml $reconcile.clusterFederatedTrustDomains }}{{ else }}{{ toYaml .defaults.reconcile.clusterFederatedTrustDomains }}{{ end }} +{{- if ne .Values.controllerManager.staticManifestMode "off" }} +staticManifestPath: /manifests +{{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-ftd.yaml b/charts/spire/charts/spire-server/templates/controller-manager-ftd.yaml index d41c0b7..dcf0f05 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-ftd.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-ftd.yaml @@ -1,5 +1,7 @@ -{{- $root := . }} -{{- range $key, $value := .Values.controllerManager.identities.clusterFederatedTrustDomains }} +{{- define "spire-server.cluster-federated-trust-domains" -}} +{{- $root := .root }} +{{- $useShortName := .useShortName }} +{{- range $key, $value := $root.Values.controllerManager.identities.clusterFederatedTrustDomains }} {{- range $skey, $svalue := $value }} {{- if not (has $skey (list "name" "annotations" "labels" "enabled" "bundleEndpointProfile" "bundleEndpointURL" "trustDomain" "trustDomainBundle")) }} {{- fail (printf "Unsupported property specified: %s" $skey) }} @@ -12,34 +14,45 @@ {{- end }} {{- if eq ($root.Values.controllerManager.enabled | toString) "true" }} {{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }} ---- -apiVersion: spire.spiffe.io/v1alpha1 -kind: ClusterFederatedTrustDomain -metadata: - name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }} - {{- with $value.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with $value.labels }} - labels: - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - className: {{ include "spire-server.controller-manager-class-name" $root | quote }} - {{- with $value.bundleEndpointProfile }} - bundleEndpointProfile: - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with $value.bundleEndpointURL }} - bundleEndpointURL: {{ . | quote }} - {{- end }} - {{- with $value.trustDomain }} - trustDomain: {{ . | quote }} - {{- end }} - {{- with $value.trustDomainBundle }} - trustDomainBundle: {{ . | quote }} - {{- end }} +- apiVersion: spire.spiffe.io/v1alpha1 + kind: ClusterFederatedTrustDomain + metadata: + {{- if $useShortName }} + name: {{ $key }} + {{- else }} + name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }} + {{- end }} + {{- with $value.annotations }} + annotations: + {{- toYaml . | nindent 6 }} + {{- end }} + {{- with $value.labels }} + labels: + {{- toYaml . | nindent 6 }} + {{- end }} + spec: + className: {{ include "spire-server.controller-manager-class-name" $root | quote }} + {{- with $value.bundleEndpointProfile }} + bundleEndpointProfile: + {{- toYaml . | nindent 6 }} + {{- end }} + {{- with $value.bundleEndpointURL }} + bundleEndpointURL: {{ . | quote }} + {{- end }} + {{- with $value.trustDomain }} + trustDomain: {{ . | quote }} + {{- end }} + {{- with $value.trustDomainBundle }} + trustDomainBundle: {{ . | quote }} + {{- end }} {{- end }} {{- end }} {{- end }} +{{- end }} +{{- if eq .Values.controllerManager.staticManifestMode "off" }} +{{- $t := include "spire-server.cluster-federated-trust-domains" (dict "root" . "useShortName" false) | fromYamlArray }} +{{- range $_, $v := $t }} +--- +{{- $v | toYaml }} +{{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml index 8b18b3d..eee0a00 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml @@ -1,4 +1,4 @@ -{{- if eq (.Values.controllerManager.enabled | toString) "true" }} +{{- if and (eq (.Values.controllerManager.enabled | toString) "true") (eq .Values.controllerManager.staticManifestMode "off") }} apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: diff --git a/charts/spire/charts/spire-server/templates/controller-manager-service.yaml b/charts/spire/charts/spire-server/templates/controller-manager-service.yaml index 864c204..e9f547c 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-service.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-service.yaml @@ -1,4 +1,5 @@ {{- if not .Values.externalServer }} +{{- if eq .Values.controllerManager.staticManifestMode "off" }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }} apiVersion: v1 kind: Service @@ -22,3 +23,4 @@ spec: {{- include "spire-server.selectorLabels" . | nindent 4 }} {{- end }} {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-static-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-static-configmap.yaml new file mode 100644 index 0000000..0a40ef8 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/controller-manager-static-configmap.yaml @@ -0,0 +1,21 @@ +{{- if not (has .Values.controllerManager.staticManifestMode (list "off" "internal" "external" )) }} +{{- fail "Unsupported option specified for controllerManager.staticManifestMode" }} +{{- end }} +{{- if eq .Values.controllerManager.staticManifestMode "internal" }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "spire-controller-manager.fullname" . }}-static + namespace: {{ include "spire-server.namespace" . }} +data: + {{- $t := include "spire-server.cluster-static-entries" (dict "root" . "useShortName" true) | fromYamlArray }} + {{- range $_, $v := $t }} + "e-{{ $v.metadata.name }}.yaml": | + {{- $v | toYaml | nindent 4 }} + {{- end }} + {{- $t := include "spire-server.cluster-federated-trust-domains" (dict "root" . "useShortName" true) | fromYamlArray }} + {{- range $_, $v := $t }} + "f-{{ $v.metadata.name }}.yaml": | + {{- $v | toYaml | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-static-entries.yaml b/charts/spire/charts/spire-server/templates/controller-manager-static-entries.yaml index df76208..b557203 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-static-entries.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-static-entries.yaml @@ -1,5 +1,7 @@ -{{- $root := . }} -{{- range $key, $value := .Values.controllerManager.identities.clusterStaticEntries }} +{{- define "spire-server.cluster-static-entries" -}} +{{- $root := .root }} +{{- $useShortName := .useShortName }} +{{- range $key, $value := $root.Values.controllerManager.identities.clusterStaticEntries }} {{- range $skey, $svalue := $value }} {{- if not (has $skey (list "name" "annotations" "labels" "enabled" "admin" "dnsNames" "downstream" "federatesWith" "hint" "jwtSVIDTTL" "parentID" "selectors" "spiffeID" "x509SVIDTTL")) }} {{- fail (printf "Unsupported property specified: %s" $skey) }} @@ -12,52 +14,63 @@ {{- end }} {{- if eq ($root.Values.controllerManager.enabled | toString) "true" }} {{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }} ---- -apiVersion: spire.spiffe.io/v1alpha1 -kind: ClusterStaticEntry -metadata: - name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }} - {{- with $value.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with $value.labels }} - labels: - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - className: {{ include "spire-server.controller-manager-class-name" $root | quote }} - spiffeID: {{ $value.spiffeID | quote }} - {{- with $value.federatesWith }} - federatesWith: - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with $value.selectors }} - selectors: - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with $value.parentID }} - parentID: {{ . | quote }} - {{- end }} - {{- with $value.dnsNames }} - dnsNames: - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with $value.hint }} - hint: {{ . | quote }} - {{- end }} - {{- with $value.x509SVIDTTL }} - x509SVIDTTL: {{ . | quote }} - {{- end }} - {{- with $value.jwtSVIDTTL }} - jwtSVIDTTL: {{ . | quote }} - {{- end }} - {{- with $value.admin }} - admin: {{ . }} - {{- end }} - {{- with $value.downstream }} - downstream: {{ . }} - {{- end }} +- apiVersion: spire.spiffe.io/v1alpha1 + kind: ClusterStaticEntry + metadata: + {{- if $useShortName }} + name: {{ $key }} + {{- else }} + name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }} + {{- end }} + {{- with $value.annotations }} + annotations: + {{- toYaml . | nindent 6 }} + {{- end }} + {{- with $value.labels }} + labels: + {{- toYaml . | nindent 6 }} + {{- end }} + spec: + className: {{ include "spire-server.controller-manager-class-name" $root | quote }} + spiffeID: {{ $value.spiffeID | quote }} + {{- with $value.federatesWith }} + federatesWith: + {{- toYaml . | nindent 6 }} + {{- end }} + {{- with $value.selectors }} + selectors: + {{- toYaml . | nindent 6 }} + {{- end }} + {{- with $value.parentID }} + parentID: {{ . | quote }} + {{- end }} + {{- with $value.dnsNames }} + dnsNames: + {{- toYaml . | nindent 6 }} + {{- end }} + {{- with $value.hint }} + hint: {{ . | quote }} + {{- end }} + {{- with $value.x509SVIDTTL }} + x509SVIDTTL: {{ . | quote }} + {{- end }} + {{- with $value.jwtSVIDTTL }} + jwtSVIDTTL: {{ . | quote }} + {{- end }} + {{- with $value.admin }} + admin: {{ . }} + {{- end }} + {{- with $value.downstream }} + downstream: {{ . }} + {{- end }} {{- end }} {{- end }} {{- end }} +{{- end }} +{{- if eq .Values.controllerManager.staticManifestMode "off" }} +{{- $t := include "spire-server.cluster-static-entries" (dict "root" . "useShortName" false) | fromYamlArray }} +{{- range $_, $v := $t }} +--- +{{- $v | toYaml }} +{{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml index 660c2f8..8e80679 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml @@ -1,4 +1,5 @@ {{- if not .Values.externalServer }} +{{- if eq .Values.controllerManager.staticManifestMode "off" }} {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }} apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration @@ -39,3 +40,4 @@ webhooks: sideEffects: None {{- end }} {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml index 4f43dd2..325fbef 100644 --- a/charts/spire/charts/spire-server/templates/post-install-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml @@ -1,5 +1,6 @@ {{- if not .Values.externalServer }} {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} +{{- if eq .Values.controllerManager.staticManifestMode "off" }} {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} apiVersion: v1 @@ -93,3 +94,4 @@ spec: {{- end }} {{- end }} {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml index 1d6f0a0..309b63c 100644 --- a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml @@ -1,5 +1,6 @@ {{- if not .Values.externalServer }} {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} +{{- if eq .Values.controllerManager.staticManifestMode "off" }} {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} apiVersion: v1 @@ -93,3 +94,4 @@ spec: {{- end }} {{- end }} {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml index a3258b0..ee92e0d 100644 --- a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml @@ -1,5 +1,6 @@ {{- if not .Values.externalServer }} {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} +{{- if eq .Values.controllerManager.staticManifestMode "off" }} {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} apiVersion: v1 @@ -93,3 +94,4 @@ spec: {{- end }} {{- end }} {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/server-resource.yaml b/charts/spire/charts/spire-server/templates/server-resource.yaml index fd25438..9b6f7dc 100644 --- a/charts/spire/charts/spire-server/templates/server-resource.yaml +++ b/charts/spire/charts/spire-server/templates/server-resource.yaml @@ -505,6 +505,11 @@ spec: {{- end }} {{- end }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }} + {{- if ne .Values.controllerManager.staticManifestMode "off" }} + - name: controller-manager-static-config + configMap: + name: {{ include "spire-controller-manager.fullname" . }}-static + {{- end }} - name: controller-manager-config configMap: name: {{ include "spire-controller-manager.fullname" . }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 26faea2..c5e6f5c 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -511,6 +511,9 @@ controllerManager: ## @param controllerManager.enabled Flag to enable controller manager enabled: false + ## @param controllerManager.staticManifestMode Flag to configure static mode. Valid options off, internal, and external. If internal, the identities config options will be rendered to an included configmap + staticManifestMode: "off" + ## @param controllerManager.className specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. className: "" ## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. @@ -544,7 +547,7 @@ controllerManager: registry: ghcr.io repository: spiffe/spire-controller-manager pullPolicy: IfNotPresent - tag: "0.6.0" + tag: "0.6.2" ## @param controllerManager.resources [object] Resource requests and limits for controller manager resources: {} diff --git a/examples/static-manifest-server/values.yaml b/examples/static-manifest-server/values.yaml new file mode 100644 index 0000000..99c1d1c --- /dev/null +++ b/examples/static-manifest-server/values.yaml @@ -0,0 +1,31 @@ +spire-server: + nodeAttestor: + k8sPSAT: + enabled: false + joinToken: + enabled: true + tpmDirect: + enabled: true + controllerManager: + enabled: true + staticManifestMode: internal + identities: + clusterStaticEntries: + foo-node: + parentID: spiffe://example.org/spire/server + spiffeID: spiffe://example.org/hosts/foo + selectors: + - tpm:pub_hash:12345 + foo-kubelet: + parentID: spiffe://example.org/foo + spiffeID: spiffe://example.org/k8s/one/node/foo + selectors: + - systemd:id:kubelet.service + ingress: + enabled: true +spire-agent: + enabled: false +spiffe-csi-driver: + enabled: false +spiffe-oidc-discovery-provider: + enabled: false