panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update spire-controller-manager to 0.6.2 and add its staticManifest support (#563)

Browse Source 
* Update spire-controller-manager to 0.6.2 and add its staticManifest support

Signed-off-by: Kevin Fox <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix indent

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
2025-04-23 10:56:55 -07:00
committed by GitHub
parent 4dee6ca72e
commit 1169dd5692
16 changed files with 197 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+2 -1
View File
@@ -257,6 +257,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `notifier.externalK8sBundle.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `bundle.crt` | | `notifier.externalK8sBundle.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `bundle.crt` |
| `notifier.externalK8sBundle.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` | | `notifier.externalK8sBundle.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
| `controllerManager.enabled` | Flag to enable controller manager | `false` | | `controllerManager.enabled` | Flag to enable controller manager | `false` |
| `controllerManager.staticManifestMode` | Flag to configure static mode. Valid options off, internal, and external. If internal, the identities config options will be rendered to an included configmap | `off` |
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` | | `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` | | `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
| `controllerManager.entryIDPrefixCleanup` | Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` | | `controllerManager.entryIDPrefixCleanup` | Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` |
@@ -268,7 +269,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.0` | | `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.2` |
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
| `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.securityContext` | Security context | `{}` |
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
charts/spire/charts/spire-server/templates/_controller-manager-container.tpl
+10
View File
@@ -75,7 +75,11 @@
{{- end }} {{- end }}
env: env:
- name: ENABLE_WEBHOOKS - name: ENABLE_WEBHOOKS
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
value: {{ .webhooksEnabled | toString | quote }} value: {{ .webhooksEnabled | toString | quote }}
{{- else }}
value: "false"
{{- end }}
{{- if gt (len $extraEnv) 0 }} {{- if gt (len $extraEnv) 0 }}
{{- $extraEnv | toYaml | nindent 4 }} {{- $extraEnv | toYaml | nindent 4 }}
{{- end }} {{- end }}
@@ -91,6 +95,7 @@
- containerPort: {{ $promPort }} - containerPort: {{ $promPort }}
name: prom-cm{{ .suffix }} name: prom-cm{{ .suffix }}
{{- end }} {{- end }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
livenessProbe: livenessProbe:
httpGet: httpGet:
path: /healthz path: /healthz
@@ -99,12 +104,17 @@
httpGet: httpGet:
path: /readyz path: /readyz
port: healthz port: healthz
{{- end }}
resources: resources:
{{- toYaml .Values.controllerManager.resources | nindent 4 }} {{- toYaml .Values.controllerManager.resources | nindent 4 }}
volumeMounts: volumeMounts:
- name: spire-server-socket - name: spire-server-socket
mountPath: /tmp/spire-server/private mountPath: /tmp/spire-server/private
readOnly: true readOnly: true
{{- if ne .Values.controllerManager.staticManifestMode "off" }}
- name: controller-manager-static-config
mountPath: /manifests
{{- end }}
- name: controller-manager-config - name: controller-manager-config
mountPath: /controller-manager-config{{ .suffix }}.yaml mountPath: /controller-manager-config{{ .suffix }}.yaml
subPath: controller-manager-config{{ .suffix }}.yaml subPath: controller-manager-config{{ .suffix }}.yaml
charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml
+2
View File
@@ -26,6 +26,7 @@ matchLabels:
{} {}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
{{- $root := . }} {{- $root := . }}
{{ $namespaces := list .Release.Namespace .Values.namespaceOverride (dig "spire" "namespaces" "server" "name" "" .Values.global) (dig "spire" "namespaces" "system" "name" "" .Values.global) | compact | uniq }} {{ $namespaces := list .Release.Namespace .Values.namespaceOverride (dig "spire" "namespaces" "server" "name" "" .Values.global) (dig "spire" "namespaces" "system" "name" "" .Values.global) | compact | uniq }}
{{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }} {{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }}
@@ -116,3 +117,4 @@ spec:
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
+7
View File
@@ -47,10 +47,12 @@ metrics:
bindAddress: 0.0.0.0:{{ $promPort }} bindAddress: 0.0.0.0:{{ $promPort }}
health: health:
healthProbeBindAddress: 0.0.0.0:{{ $healthPort }} healthProbeBindAddress: 0.0.0.0:{{ $healthPort }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
leaderElection: leaderElection:
leaderElect: true leaderElect: true
resourceName: {{ printf "%s-%s%s" .Release.Namespace (default .Release.Name .Values.crNameOverride) .suffix | sha256sum | trunc 8 }}.spiffe.io resourceName: {{ printf "%s-%s%s" .Release.Namespace (default .Release.Name .Values.crNameOverride) .suffix | sha256sum | trunc 8 }}.spiffe.io
resourceNamespace: {{ include "spire-server.namespace" . }} resourceNamespace: {{ include "spire-server.namespace" . }}
{{- end }}
{{- with .settings.cacheNamespaces }} {{- with .settings.cacheNamespaces }}
cacheNamespaces: cacheNamespaces:
{{- toYaml . | nindent 2 }} {{- toYaml . | nindent 2 }}
@@ -85,7 +87,12 @@ parentIDTemplate: {{ if hasKey .settings "parentIDTemplate" }}{{ .settings.paren
{{- $reconcile = .settings.reconcile }} {{- $reconcile = .settings.reconcile }}
{{- end }} {{- end }}
reconcile: reconcile:
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
clusterSPIFFEIDs: {{ if hasKey $reconcile "clusterSPIFFEIDs" }}{{ toYaml $reconcile.clusterSPIFFEIDs }}{{ else }}{{ toYaml .defaults.reconcile.clusterSPIFFEIDs }}{{ end }} clusterSPIFFEIDs: {{ if hasKey $reconcile "clusterSPIFFEIDs" }}{{ toYaml $reconcile.clusterSPIFFEIDs }}{{ else }}{{ toYaml .defaults.reconcile.clusterSPIFFEIDs }}{{ end }}
{{- end }}
clusterStaticEntries: {{ if hasKey $reconcile "clusterStaticEntries" }}{{ toYaml $reconcile.clusterStaticEntries }}{{ else }}{{ toYaml .defaults.reconcile.clusterStaticEntries }}{{ end }} clusterStaticEntries: {{ if hasKey $reconcile "clusterStaticEntries" }}{{ toYaml $reconcile.clusterStaticEntries }}{{ else }}{{ toYaml .defaults.reconcile.clusterStaticEntries }}{{ end }}
clusterFederatedTrustDomains: {{ if hasKey $reconcile "clusterFederatedTrustDomains" }}{{ toYaml $reconcile.clusterFederatedTrustDomains }}{{ else }}{{ toYaml .defaults.reconcile.clusterFederatedTrustDomains }}{{ end }} clusterFederatedTrustDomains: {{ if hasKey $reconcile "clusterFederatedTrustDomains" }}{{ toYaml $reconcile.clusterFederatedTrustDomains }}{{ else }}{{ toYaml .defaults.reconcile.clusterFederatedTrustDomains }}{{ end }}
{{- if ne .Values.controllerManager.staticManifestMode "off" }}
staticManifestPath: /manifests
{{- end }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/templates/controller-manager-ftd.yaml
+43 -30
View File
@@ -1,5 +1,7 @@
{{- $root := . }} {{- define "spire-server.cluster-federated-trust-domains" -}}
{{- range $key, $value := .Values.controllerManager.identities.clusterFederatedTrustDomains }} {{- $root := .root }}
{{- $useShortName := .useShortName }}
{{- range $key, $value := $root.Values.controllerManager.identities.clusterFederatedTrustDomains }}
{{- range $skey, $svalue := $value }} {{- range $skey, $svalue := $value }}
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "bundleEndpointProfile" "bundleEndpointURL" "trustDomain" "trustDomainBundle")) }} {{- if not (has $skey (list "name" "annotations" "labels" "enabled" "bundleEndpointProfile" "bundleEndpointURL" "trustDomain" "trustDomainBundle")) }}
{{- fail (printf "Unsupported property specified: %s" $skey) }} {{- fail (printf "Unsupported property specified: %s" $skey) }}
@@ -12,34 +14,45 @@
{{- end }} {{- end }}
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }} {{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }} {{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
--- - apiVersion: spire.spiffe.io/v1alpha1
apiVersion: spire.spiffe.io/v1alpha1 kind: ClusterFederatedTrustDomain
kind: ClusterFederatedTrustDomain metadata:
metadata: {{- if $useShortName }}
name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }} name: {{ $key }}
{{- with $value.annotations }} {{- else }}
annotations: name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }}
{{- toYaml . | nindent 4 }} {{- end }}
{{- end }} {{- with $value.annotations }}
{{- with $value.labels }} annotations:
labels: {{- toYaml . | nindent 6 }}
{{- toYaml . | nindent 4 }} {{- end }}
{{- end }} {{- with $value.labels }}
spec: labels:
className: {{ include "spire-server.controller-manager-class-name" $root | quote }} {{- toYaml . | nindent 6 }}
{{- with $value.bundleEndpointProfile }} {{- end }}
bundleEndpointProfile: spec:
{{- toYaml . | nindent 4 }} className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
{{- end }} {{- with $value.bundleEndpointProfile }}
{{- with $value.bundleEndpointURL }} bundleEndpointProfile:
bundleEndpointURL: {{ . | quote }} {{- toYaml . | nindent 6 }}
{{- end }} {{- end }}
{{- with $value.trustDomain }} {{- with $value.bundleEndpointURL }}
trustDomain: {{ . | quote }} bundleEndpointURL: {{ . | quote }}
{{- end }} {{- end }}
{{- with $value.trustDomainBundle }} {{- with $value.trustDomain }}
trustDomainBundle: {{ . | quote }} trustDomain: {{ . | quote }}
{{- end }} {{- end }}
{{- with $value.trustDomainBundle }}
trustDomainBundle: {{ . | quote }}
{{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
{{- $t := include "spire-server.cluster-federated-trust-domains" (dict "root" . "useShortName" false) | fromYamlArray }}
{{- range $_, $v := $t }}
---
{{- $v | toYaml }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/controller-manager-roles.yaml
+1 -1
View File
@@ -1,4 +1,4 @@
{{- if eq (.Values.controllerManager.enabled | toString) "true" }} {{- if and (eq (.Values.controllerManager.enabled | toString) "true") (eq .Values.controllerManager.staticManifestMode "off") }}
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: Role kind: Role
metadata: metadata:
charts/spire/charts/spire-server/templates/controller-manager-service.yaml
+2
View File
@@ -1,4 +1,5 @@
{{- if not .Values.externalServer }} {{- if not .Values.externalServer }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
{{- if eq (.Values.controllerManager.enabled | toString) "true" }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
apiVersion: v1 apiVersion: v1
kind: Service kind: Service
@@ -22,3 +23,4 @@ spec:
{{- include "spire-server.selectorLabels" . | nindent 4 }} {{- include "spire-server.selectorLabels" . | nindent 4 }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/controller-manager-static-configmap.yaml
+21
View File
@@ -0,0 +1,21 @@
{{- if not (has .Values.controllerManager.staticManifestMode (list "off" "internal" "external" )) }}
{{- fail "Unsupported option specified for controllerManager.staticManifestMode" }}
{{- end }}
{{- if eq .Values.controllerManager.staticManifestMode "internal" }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "spire-controller-manager.fullname" . }}-static
namespace: {{ include "spire-server.namespace" . }}
data:
{{- $t := include "spire-server.cluster-static-entries" (dict "root" . "useShortName" true) | fromYamlArray }}
{{- range $_, $v := $t }}
"e-{{ $v.metadata.name }}.yaml": |
{{- $v | toYaml | nindent 4 }}
{{- end }}
{{- $t := include "spire-server.cluster-federated-trust-domains" (dict "root" . "useShortName" true) | fromYamlArray }}
{{- range $_, $v := $t }}
"f-{{ $v.metadata.name }}.yaml": |
{{- $v | toYaml | nindent 4 }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/controller-manager-static-entries.yaml
+61 -48
View File
@@ -1,5 +1,7 @@
{{- $root := . }} {{- define "spire-server.cluster-static-entries" -}}
{{- range $key, $value := .Values.controllerManager.identities.clusterStaticEntries }} {{- $root := .root }}
{{- $useShortName := .useShortName }}
{{- range $key, $value := $root.Values.controllerManager.identities.clusterStaticEntries }}
{{- range $skey, $svalue := $value }} {{- range $skey, $svalue := $value }}
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "admin" "dnsNames" "downstream" "federatesWith" "hint" "jwtSVIDTTL" "parentID" "selectors" "spiffeID" "x509SVIDTTL")) }} {{- if not (has $skey (list "name" "annotations" "labels" "enabled" "admin" "dnsNames" "downstream" "federatesWith" "hint" "jwtSVIDTTL" "parentID" "selectors" "spiffeID" "x509SVIDTTL")) }}
{{- fail (printf "Unsupported property specified: %s" $skey) }} {{- fail (printf "Unsupported property specified: %s" $skey) }}
@@ -12,52 +14,63 @@
{{- end }} {{- end }}
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }} {{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }} {{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
--- - apiVersion: spire.spiffe.io/v1alpha1
apiVersion: spire.spiffe.io/v1alpha1 kind: ClusterStaticEntry
kind: ClusterStaticEntry metadata:
metadata: {{- if $useShortName }}
name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }} name: {{ $key }}
{{- with $value.annotations }} {{- else }}
annotations: name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }}
{{- toYaml . | nindent 4 }} {{- end }}
{{- end }} {{- with $value.annotations }}
{{- with $value.labels }} annotations:
labels: {{- toYaml . | nindent 6 }}
{{- toYaml . | nindent 4 }} {{- end }}
{{- end }} {{- with $value.labels }}
spec: labels:
className: {{ include "spire-server.controller-manager-class-name" $root | quote }} {{- toYaml . | nindent 6 }}
spiffeID: {{ $value.spiffeID | quote }} {{- end }}
{{- with $value.federatesWith }} spec:
federatesWith: className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
{{- toYaml . | nindent 4 }} spiffeID: {{ $value.spiffeID | quote }}
{{- end }} {{- with $value.federatesWith }}
{{- with $value.selectors }} federatesWith:
selectors: {{- toYaml . | nindent 6 }}
{{- toYaml . | nindent 4 }} {{- end }}
{{- end }} {{- with $value.selectors }}
{{- with $value.parentID }} selectors:
parentID: {{ . | quote }} {{- toYaml . | nindent 6 }}
{{- end }} {{- end }}
{{- with $value.dnsNames }} {{- with $value.parentID }}
dnsNames: parentID: {{ . | quote }}
{{- toYaml . | nindent 4 }} {{- end }}
{{- end }} {{- with $value.dnsNames }}
{{- with $value.hint }} dnsNames:
hint: {{ . | quote }} {{- toYaml . | nindent 6 }}
{{- end }} {{- end }}
{{- with $value.x509SVIDTTL }} {{- with $value.hint }}
x509SVIDTTL: {{ . | quote }} hint: {{ . | quote }}
{{- end }} {{- end }}
{{- with $value.jwtSVIDTTL }} {{- with $value.x509SVIDTTL }}
jwtSVIDTTL: {{ . | quote }} x509SVIDTTL: {{ . | quote }}
{{- end }} {{- end }}
{{- with $value.admin }} {{- with $value.jwtSVIDTTL }}
admin: {{ . }} jwtSVIDTTL: {{ . | quote }}
{{- end }} {{- end }}
{{- with $value.downstream }} {{- with $value.admin }}
downstream: {{ . }} admin: {{ . }}
{{- end }} {{- end }}
{{- with $value.downstream }}
downstream: {{ . }}
{{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
{{- $t := include "spire-server.cluster-static-entries" (dict "root" . "useShortName" false) | fromYamlArray }}
{{- range $_, $v := $t }}
---
{{- $v | toYaml }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml
+2
View File
@@ -1,4 +1,5 @@
{{- if not .Values.externalServer }} {{- if not .Values.externalServer }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }} {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
apiVersion: admissionregistration.k8s.io/v1 apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration kind: ValidatingWebhookConfiguration
@@ -39,3 +40,4 @@ webhooks:
sideEffects: None sideEffects: None
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/post-install-hook.yaml
+2
View File
@@ -1,5 +1,6 @@
{{- if not .Values.externalServer }} {{- if not .Values.externalServer }}
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }} {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
apiVersion: v1 apiVersion: v1
@@ -93,3 +94,4 @@ spec:
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+2
View File
@@ -1,5 +1,6 @@
{{- if not .Values.externalServer }} {{- if not .Values.externalServer }}
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }} {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
apiVersion: v1 apiVersion: v1
@@ -93,3 +94,4 @@ spec:
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+2
View File
@@ -1,5 +1,6 @@
{{- if not .Values.externalServer }} {{- if not .Values.externalServer }}
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }} {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
apiVersion: v1 apiVersion: v1
@@ -93,3 +94,4 @@ spec:
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/server-resource.yaml
+5
View File
@@ -505,6 +505,11 @@ spec:
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- if eq (.Values.controllerManager.enabled | toString) "true" }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
{{- if ne .Values.controllerManager.staticManifestMode "off" }}
- name: controller-manager-static-config
configMap:
name: {{ include "spire-controller-manager.fullname" . }}-static
{{- end }}
- name: controller-manager-config - name: controller-manager-config
configMap: configMap:
name: {{ include "spire-controller-manager.fullname" . }} name: {{ include "spire-controller-manager.fullname" . }}
charts/spire/charts/spire-server/values.yaml
+4 -1
View File
@@ -511,6 +511,9 @@ controllerManager:
## @param controllerManager.enabled Flag to enable controller manager ## @param controllerManager.enabled Flag to enable controller manager
enabled: false enabled: false
## @param controllerManager.staticManifestMode Flag to configure static mode. Valid options off, internal, and external. If internal, the identities config options will be rendered to an included configmap
staticManifestMode: "off"
## @param controllerManager.className specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. ## @param controllerManager.className specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs.
className: "" className: ""
## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. ## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.
@@ -544,7 +547,7 @@ controllerManager:
registry: ghcr.io registry: ghcr.io
repository: spiffe/spire-controller-manager repository: spiffe/spire-controller-manager
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: "0.6.0" tag: "0.6.2"
## @param controllerManager.resources [object] Resource requests and limits for controller manager ## @param controllerManager.resources [object] Resource requests and limits for controller manager
resources: {} resources: {}
examples/static-manifest-server/values.yaml
+31
View File
@@ -0,0 +1,31 @@
spire-server:
nodeAttestor:
k8sPSAT:
enabled: false
joinToken:
enabled: true
tpmDirect:
enabled: true
controllerManager:
enabled: true
staticManifestMode: internal
identities:
clusterStaticEntries:
foo-node:
parentID: spiffe://example.org/spire/server
spiffeID: spiffe://example.org/hosts/foo
selectors:
- tpm:pub_hash:12345
foo-kubelet:
parentID: spiffe://example.org/foo
spiffeID: spiffe://example.org/k8s/one/node/foo
selectors:
- systemd:id:kubelet.service
ingress:
enabled: true
spire-agent:
enabled: false
spiffe-csi-driver:
enabled: false
spiffe-oidc-discovery-provider:
enabled: false