Update spire-controller-manager to 0.6.2 and add its staticManifest support (#563)
* Update spire-controller-manager to 0.6.2 and add its staticManifest support Signed-off-by: Kevin Fox <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> * Fix indent Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
@@ -257,6 +257,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `notifier.externalK8sBundle.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `bundle.crt` |
|
||||
| `notifier.externalK8sBundle.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
||||
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
||||
| `controllerManager.staticManifestMode` | Flag to configure static mode. Valid options off, internal, and external. If internal, the identities config options will be rendered to an included configmap | `off` |
|
||||
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
||||
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
||||
| `controllerManager.entryIDPrefixCleanup` | Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` |
|
||||
@@ -268,7 +269,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
||||
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.0` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.2` |
|
||||
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
||||
| `controllerManager.securityContext` | Security context | `{}` |
|
||||
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
||||
|
||||
@@ -75,7 +75,11 @@
|
||||
{{- end }}
|
||||
env:
|
||||
- name: ENABLE_WEBHOOKS
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
value: {{ .webhooksEnabled | toString | quote }}
|
||||
{{- else }}
|
||||
value: "false"
|
||||
{{- end }}
|
||||
{{- if gt (len $extraEnv) 0 }}
|
||||
{{- $extraEnv | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -91,6 +95,7 @@
|
||||
- containerPort: {{ $promPort }}
|
||||
name: prom-cm{{ .suffix }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
@@ -99,12 +104,17 @@
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: healthz
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.controllerManager.resources | nindent 4 }}
|
||||
volumeMounts:
|
||||
- name: spire-server-socket
|
||||
mountPath: /tmp/spire-server/private
|
||||
readOnly: true
|
||||
{{- if ne .Values.controllerManager.staticManifestMode "off" }}
|
||||
- name: controller-manager-static-config
|
||||
mountPath: /manifests
|
||||
{{- end }}
|
||||
- name: controller-manager-config
|
||||
mountPath: /controller-manager-config{{ .suffix }}.yaml
|
||||
subPath: controller-manager-config{{ .suffix }}.yaml
|
||||
|
||||
@@ -26,6 +26,7 @@ matchLabels:
|
||||
{}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- $root := . }}
|
||||
{{ $namespaces := list .Release.Namespace .Values.namespaceOverride (dig "spire" "namespaces" "server" "name" "" .Values.global) (dig "spire" "namespaces" "system" "name" "" .Values.global) | compact | uniq }}
|
||||
{{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }}
|
||||
@@ -116,3 +117,4 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -47,10 +47,12 @@ metrics:
|
||||
bindAddress: 0.0.0.0:{{ $promPort }}
|
||||
health:
|
||||
healthProbeBindAddress: 0.0.0.0:{{ $healthPort }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
leaderElection:
|
||||
leaderElect: true
|
||||
resourceName: {{ printf "%s-%s%s" .Release.Namespace (default .Release.Name .Values.crNameOverride) .suffix | sha256sum | trunc 8 }}.spiffe.io
|
||||
resourceNamespace: {{ include "spire-server.namespace" . }}
|
||||
{{- end }}
|
||||
{{- with .settings.cacheNamespaces }}
|
||||
cacheNamespaces:
|
||||
{{- toYaml . | nindent 2 }}
|
||||
@@ -85,7 +87,12 @@ parentIDTemplate: {{ if hasKey .settings "parentIDTemplate" }}{{ .settings.paren
|
||||
{{- $reconcile = .settings.reconcile }}
|
||||
{{- end }}
|
||||
reconcile:
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
clusterSPIFFEIDs: {{ if hasKey $reconcile "clusterSPIFFEIDs" }}{{ toYaml $reconcile.clusterSPIFFEIDs }}{{ else }}{{ toYaml .defaults.reconcile.clusterSPIFFEIDs }}{{ end }}
|
||||
{{- end }}
|
||||
clusterStaticEntries: {{ if hasKey $reconcile "clusterStaticEntries" }}{{ toYaml $reconcile.clusterStaticEntries }}{{ else }}{{ toYaml .defaults.reconcile.clusterStaticEntries }}{{ end }}
|
||||
clusterFederatedTrustDomains: {{ if hasKey $reconcile "clusterFederatedTrustDomains" }}{{ toYaml $reconcile.clusterFederatedTrustDomains }}{{ else }}{{ toYaml .defaults.reconcile.clusterFederatedTrustDomains }}{{ end }}
|
||||
{{- if ne .Values.controllerManager.staticManifestMode "off" }}
|
||||
staticManifestPath: /manifests
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
{{- $root := . }}
|
||||
{{- range $key, $value := .Values.controllerManager.identities.clusterFederatedTrustDomains }}
|
||||
{{- define "spire-server.cluster-federated-trust-domains" -}}
|
||||
{{- $root := .root }}
|
||||
{{- $useShortName := .useShortName }}
|
||||
{{- range $key, $value := $root.Values.controllerManager.identities.clusterFederatedTrustDomains }}
|
||||
{{- range $skey, $svalue := $value }}
|
||||
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "bundleEndpointProfile" "bundleEndpointURL" "trustDomain" "trustDomainBundle")) }}
|
||||
{{- fail (printf "Unsupported property specified: %s" $skey) }}
|
||||
@@ -12,24 +14,27 @@
|
||||
{{- end }}
|
||||
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
|
||||
---
|
||||
apiVersion: spire.spiffe.io/v1alpha1
|
||||
- apiVersion: spire.spiffe.io/v1alpha1
|
||||
kind: ClusterFederatedTrustDomain
|
||||
metadata:
|
||||
{{- if $useShortName }}
|
||||
name: {{ $key }}
|
||||
{{- else }}
|
||||
name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }}
|
||||
{{- end }}
|
||||
{{- with $value.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.labels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
|
||||
{{- with $value.bundleEndpointProfile }}
|
||||
bundleEndpointProfile:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.bundleEndpointURL }}
|
||||
bundleEndpointURL: {{ . | quote }}
|
||||
@@ -43,3 +48,11 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- $t := include "spire-server.cluster-federated-trust-domains" (dict "root" . "useShortName" false) | fromYamlArray }}
|
||||
{{- range $_, $v := $t }}
|
||||
---
|
||||
{{- $v | toYaml }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") (eq .Values.controllerManager.staticManifestMode "off") }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -22,3 +23,4 @@ spec:
|
||||
{{- include "spire-server.selectorLabels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
{{- if not (has .Values.controllerManager.staticManifestMode (list "off" "internal" "external" )) }}
|
||||
{{- fail "Unsupported option specified for controllerManager.staticManifestMode" }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "internal" }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-static
|
||||
namespace: {{ include "spire-server.namespace" . }}
|
||||
data:
|
||||
{{- $t := include "spire-server.cluster-static-entries" (dict "root" . "useShortName" true) | fromYamlArray }}
|
||||
{{- range $_, $v := $t }}
|
||||
"e-{{ $v.metadata.name }}.yaml": |
|
||||
{{- $v | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- $t := include "spire-server.cluster-federated-trust-domains" (dict "root" . "useShortName" true) | fromYamlArray }}
|
||||
{{- range $_, $v := $t }}
|
||||
"f-{{ $v.metadata.name }}.yaml": |
|
||||
{{- $v | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -1,5 +1,7 @@
|
||||
{{- $root := . }}
|
||||
{{- range $key, $value := .Values.controllerManager.identities.clusterStaticEntries }}
|
||||
{{- define "spire-server.cluster-static-entries" -}}
|
||||
{{- $root := .root }}
|
||||
{{- $useShortName := .useShortName }}
|
||||
{{- range $key, $value := $root.Values.controllerManager.identities.clusterStaticEntries }}
|
||||
{{- range $skey, $svalue := $value }}
|
||||
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "admin" "dnsNames" "downstream" "federatesWith" "hint" "jwtSVIDTTL" "parentID" "selectors" "spiffeID" "x509SVIDTTL")) }}
|
||||
{{- fail (printf "Unsupported property specified: %s" $skey) }}
|
||||
@@ -12,36 +14,39 @@
|
||||
{{- end }}
|
||||
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
|
||||
---
|
||||
apiVersion: spire.spiffe.io/v1alpha1
|
||||
- apiVersion: spire.spiffe.io/v1alpha1
|
||||
kind: ClusterStaticEntry
|
||||
metadata:
|
||||
{{- if $useShortName }}
|
||||
name: {{ $key }}
|
||||
{{- else }}
|
||||
name: {{ $root.Release.Namespace }}-{{ default $root.Release.Name $root.Values.crNameOverride }}-{{ $key }}
|
||||
{{- end }}
|
||||
{{- with $value.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.labels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
|
||||
spiffeID: {{ $value.spiffeID | quote }}
|
||||
{{- with $value.federatesWith }}
|
||||
federatesWith:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.selectors }}
|
||||
selectors:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.parentID }}
|
||||
parentID: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.dnsNames }}
|
||||
dnsNames:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.hint }}
|
||||
hint: {{ . | quote }}
|
||||
@@ -61,3 +66,11 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- $t := include "spire-server.cluster-static-entries" (dict "root" . "useShortName" false) | fromYamlArray }}
|
||||
{{- range $_, $v := $t }}
|
||||
---
|
||||
{{- $v | toYaml }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
@@ -39,3 +40,4 @@ webhooks:
|
||||
sideEffects: None
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
|
||||
apiVersion: v1
|
||||
@@ -93,3 +94,4 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
|
||||
apiVersion: v1
|
||||
@@ -93,3 +94,4 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
|
||||
apiVersion: v1
|
||||
@@ -93,3 +94,4 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -505,6 +505,11 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if ne .Values.controllerManager.staticManifestMode "off" }}
|
||||
- name: controller-manager-static-config
|
||||
configMap:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-static
|
||||
{{- end }}
|
||||
- name: controller-manager-config
|
||||
configMap:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
|
||||
@@ -511,6 +511,9 @@ controllerManager:
|
||||
## @param controllerManager.enabled Flag to enable controller manager
|
||||
enabled: false
|
||||
|
||||
## @param controllerManager.staticManifestMode Flag to configure static mode. Valid options off, internal, and external. If internal, the identities config options will be rendered to an included configmap
|
||||
staticManifestMode: "off"
|
||||
|
||||
## @param controllerManager.className specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs.
|
||||
className: ""
|
||||
## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.
|
||||
@@ -544,7 +547,7 @@ controllerManager:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-controller-manager
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "0.6.0"
|
||||
tag: "0.6.2"
|
||||
|
||||
## @param controllerManager.resources [object] Resource requests and limits for controller manager
|
||||
resources: {}
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
spire-server:
|
||||
nodeAttestor:
|
||||
k8sPSAT:
|
||||
enabled: false
|
||||
joinToken:
|
||||
enabled: true
|
||||
tpmDirect:
|
||||
enabled: true
|
||||
controllerManager:
|
||||
enabled: true
|
||||
staticManifestMode: internal
|
||||
identities:
|
||||
clusterStaticEntries:
|
||||
foo-node:
|
||||
parentID: spiffe://example.org/spire/server
|
||||
spiffeID: spiffe://example.org/hosts/foo
|
||||
selectors:
|
||||
- tpm:pub_hash:12345
|
||||
foo-kubelet:
|
||||
parentID: spiffe://example.org/foo
|
||||
spiffeID: spiffe://example.org/k8s/one/node/foo
|
||||
selectors:
|
||||
- systemd:id:kubelet.service
|
||||
ingress:
|
||||
enabled: true
|
||||
spire-agent:
|
||||
enabled: false
|
||||
spiffe-csi-driver:
|
||||
enabled: false
|
||||
spiffe-oidc-discovery-provider:
|
||||
enabled: false
|
||||
Reference in New Issue
Block a user