Update spire-controller-manager to 0.6.2 and add its staticManifest support (#563)
* Update spire-controller-manager to 0.6.2 and add its staticManifest support Signed-off-by: Kevin Fox <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> * Fix indent Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
@@ -75,7 +75,11 @@
|
||||
{{- end }}
|
||||
env:
|
||||
- name: ENABLE_WEBHOOKS
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
value: {{ .webhooksEnabled | toString | quote }}
|
||||
{{- else }}
|
||||
value: "false"
|
||||
{{- end }}
|
||||
{{- if gt (len $extraEnv) 0 }}
|
||||
{{- $extraEnv | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -91,6 +95,7 @@
|
||||
- containerPort: {{ $promPort }}
|
||||
name: prom-cm{{ .suffix }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
@@ -99,12 +104,17 @@
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: healthz
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.controllerManager.resources | nindent 4 }}
|
||||
volumeMounts:
|
||||
- name: spire-server-socket
|
||||
mountPath: /tmp/spire-server/private
|
||||
readOnly: true
|
||||
{{- if ne .Values.controllerManager.staticManifestMode "off" }}
|
||||
- name: controller-manager-static-config
|
||||
mountPath: /manifests
|
||||
{{- end }}
|
||||
- name: controller-manager-config
|
||||
mountPath: /controller-manager-config{{ .suffix }}.yaml
|
||||
subPath: controller-manager-config{{ .suffix }}.yaml
|
||||
|
||||
@@ -26,6 +26,7 @@ matchLabels:
|
||||
{}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- $root := . }}
|
||||
{{ $namespaces := list .Release.Namespace .Values.namespaceOverride (dig "spire" "namespaces" "server" "name" "" .Values.global) (dig "spire" "namespaces" "system" "name" "" .Values.global) | compact | uniq }}
|
||||
{{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }}
|
||||
@@ -116,3 +117,4 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -47,10 +47,12 @@ metrics:
|
||||
bindAddress: 0.0.0.0:{{ $promPort }}
|
||||
health:
|
||||
healthProbeBindAddress: 0.0.0.0:{{ $healthPort }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
leaderElection:
|
||||
leaderElect: true
|
||||
resourceName: {{ printf "%s-%s%s" .Release.Namespace (default .Release.Name .Values.crNameOverride) .suffix | sha256sum | trunc 8 }}.spiffe.io
|
||||
resourceNamespace: {{ include "spire-server.namespace" . }}
|
||||
{{- end }}
|
||||
{{- with .settings.cacheNamespaces }}
|
||||
cacheNamespaces:
|
||||
{{- toYaml . | nindent 2 }}
|
||||
@@ -85,7 +87,12 @@ parentIDTemplate: {{ if hasKey .settings "parentIDTemplate" }}{{ .settings.paren
|
||||
{{- $reconcile = .settings.reconcile }}
|
||||
{{- end }}
|
||||
reconcile:
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
clusterSPIFFEIDs: {{ if hasKey $reconcile "clusterSPIFFEIDs" }}{{ toYaml $reconcile.clusterSPIFFEIDs }}{{ else }}{{ toYaml .defaults.reconcile.clusterSPIFFEIDs }}{{ end }}
|
||||
{{- end }}
|
||||
clusterStaticEntries: {{ if hasKey $reconcile "clusterStaticEntries" }}{{ toYaml $reconcile.clusterStaticEntries }}{{ else }}{{ toYaml .defaults.reconcile.clusterStaticEntries }}{{ end }}
|
||||
clusterFederatedTrustDomains: {{ if hasKey $reconcile "clusterFederatedTrustDomains" }}{{ toYaml $reconcile.clusterFederatedTrustDomains }}{{ else }}{{ toYaml .defaults.reconcile.clusterFederatedTrustDomains }}{{ end }}
|
||||
{{- if ne .Values.controllerManager.staticManifestMode "off" }}
|
||||
staticManifestPath: /manifests
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
{{- $root := . }}
|
||||
{{- range $key, $value := .Values.controllerManager.identities.clusterFederatedTrustDomains }}
|
||||
{{- define "spire-server.cluster-federated-trust-domains" -}}
|
||||
{{- $root := .root }}
|
||||
{{- $useShortName := .useShortName }}
|
||||
{{- range $key, $value := $root.Values.controllerManager.identities.clusterFederatedTrustDomains }}
|
||||
{{- range $skey, $svalue := $value }}
|
||||
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "bundleEndpointProfile" "bundleEndpointURL" "trustDomain" "trustDomainBundle")) }}
|
||||
{{- fail (printf "Unsupported property specified: %s" $skey) }}
|
||||
@@ -12,34 +14,45 @@
|
||||
{{- end }}
|
||||
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
|
||||
---
|
||||
apiVersion: spire.spiffe.io/v1alpha1
|
||||
kind: ClusterFederatedTrustDomain
|
||||
metadata:
|
||||
name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }}
|
||||
{{- with $value.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $value.labels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
|
||||
{{- with $value.bundleEndpointProfile }}
|
||||
bundleEndpointProfile:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $value.bundleEndpointURL }}
|
||||
bundleEndpointURL: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.trustDomain }}
|
||||
trustDomain: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.trustDomainBundle }}
|
||||
trustDomainBundle: {{ . | quote }}
|
||||
{{- end }}
|
||||
- apiVersion: spire.spiffe.io/v1alpha1
|
||||
kind: ClusterFederatedTrustDomain
|
||||
metadata:
|
||||
{{- if $useShortName }}
|
||||
name: {{ $key }}
|
||||
{{- else }}
|
||||
name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }}
|
||||
{{- end }}
|
||||
{{- with $value.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.labels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
|
||||
{{- with $value.bundleEndpointProfile }}
|
||||
bundleEndpointProfile:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.bundleEndpointURL }}
|
||||
bundleEndpointURL: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.trustDomain }}
|
||||
trustDomain: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.trustDomainBundle }}
|
||||
trustDomainBundle: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- $t := include "spire-server.cluster-federated-trust-domains" (dict "root" . "useShortName" false) | fromYamlArray }}
|
||||
{{- range $_, $v := $t }}
|
||||
---
|
||||
{{- $v | toYaml }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") (eq .Values.controllerManager.staticManifestMode "off") }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -22,3 +23,4 @@ spec:
|
||||
{{- include "spire-server.selectorLabels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
{{- if not (has .Values.controllerManager.staticManifestMode (list "off" "internal" "external" )) }}
|
||||
{{- fail "Unsupported option specified for controllerManager.staticManifestMode" }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "internal" }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-static
|
||||
namespace: {{ include "spire-server.namespace" . }}
|
||||
data:
|
||||
{{- $t := include "spire-server.cluster-static-entries" (dict "root" . "useShortName" true) | fromYamlArray }}
|
||||
{{- range $_, $v := $t }}
|
||||
"e-{{ $v.metadata.name }}.yaml": |
|
||||
{{- $v | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- $t := include "spire-server.cluster-federated-trust-domains" (dict "root" . "useShortName" true) | fromYamlArray }}
|
||||
{{- range $_, $v := $t }}
|
||||
"f-{{ $v.metadata.name }}.yaml": |
|
||||
{{- $v | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -1,5 +1,7 @@
|
||||
{{- $root := . }}
|
||||
{{- range $key, $value := .Values.controllerManager.identities.clusterStaticEntries }}
|
||||
{{- define "spire-server.cluster-static-entries" -}}
|
||||
{{- $root := .root }}
|
||||
{{- $useShortName := .useShortName }}
|
||||
{{- range $key, $value := $root.Values.controllerManager.identities.clusterStaticEntries }}
|
||||
{{- range $skey, $svalue := $value }}
|
||||
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "admin" "dnsNames" "downstream" "federatesWith" "hint" "jwtSVIDTTL" "parentID" "selectors" "spiffeID" "x509SVIDTTL")) }}
|
||||
{{- fail (printf "Unsupported property specified: %s" $skey) }}
|
||||
@@ -12,52 +14,63 @@
|
||||
{{- end }}
|
||||
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
|
||||
---
|
||||
apiVersion: spire.spiffe.io/v1alpha1
|
||||
kind: ClusterStaticEntry
|
||||
metadata:
|
||||
name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }}
|
||||
{{- with $value.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $value.labels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
|
||||
spiffeID: {{ $value.spiffeID | quote }}
|
||||
{{- with $value.federatesWith }}
|
||||
federatesWith:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $value.selectors }}
|
||||
selectors:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $value.parentID }}
|
||||
parentID: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.dnsNames }}
|
||||
dnsNames:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $value.hint }}
|
||||
hint: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.x509SVIDTTL }}
|
||||
x509SVIDTTL: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.jwtSVIDTTL }}
|
||||
jwtSVIDTTL: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.admin }}
|
||||
admin: {{ . }}
|
||||
{{- end }}
|
||||
{{- with $value.downstream }}
|
||||
downstream: {{ . }}
|
||||
{{- end }}
|
||||
- apiVersion: spire.spiffe.io/v1alpha1
|
||||
kind: ClusterStaticEntry
|
||||
metadata:
|
||||
{{- if $useShortName }}
|
||||
name: {{ $key }}
|
||||
{{- else }}
|
||||
name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }}
|
||||
{{- end }}
|
||||
{{- with $value.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.labels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
|
||||
spiffeID: {{ $value.spiffeID | quote }}
|
||||
{{- with $value.federatesWith }}
|
||||
federatesWith:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.selectors }}
|
||||
selectors:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.parentID }}
|
||||
parentID: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.dnsNames }}
|
||||
dnsNames:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.hint }}
|
||||
hint: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.x509SVIDTTL }}
|
||||
x509SVIDTTL: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.jwtSVIDTTL }}
|
||||
jwtSVIDTTL: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.admin }}
|
||||
admin: {{ . }}
|
||||
{{- end }}
|
||||
{{- with $value.downstream }}
|
||||
downstream: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- $t := include "spire-server.cluster-static-entries" (dict "root" . "useShortName" false) | fromYamlArray }}
|
||||
{{- range $_, $v := $t }}
|
||||
---
|
||||
{{- $v | toYaml }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
@@ -39,3 +40,4 @@ webhooks:
|
||||
sideEffects: None
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
|
||||
apiVersion: v1
|
||||
@@ -93,3 +94,4 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
|
||||
apiVersion: v1
|
||||
@@ -93,3 +94,4 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
|
||||
apiVersion: v1
|
||||
@@ -93,3 +94,4 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -505,6 +505,11 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if ne .Values.controllerManager.staticManifestMode "off" }}
|
||||
- name: controller-manager-static-config
|
||||
configMap:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-static
|
||||
{{- end }}
|
||||
- name: controller-manager-config
|
||||
configMap:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
|
||||
Reference in New Issue
Block a user