panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add support for the new hint spire-controller-manager feature (#472)

Browse Source 
* Add support for the new hint spire-controller-manager feature

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
This commit is contained in:
kfox1111
2024-10-17 15:48:09 -07:00
committed by GitHub
parent b08e8bf9b1
commit 13736cdf6f
3 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml
+3
View File
@@ -71,6 +71,9 @@ spec:
items: items:
type: string type: string
type: array type: array
hint:
description: Set the entry hint
type: string
jwtTtl: jwtTtl:
description: JWTTTL indicates an upper-bound time-to-live for JWT description: JWTTTL indicates an upper-bound time-to-live for JWT
SVIDs minted for this ClusterSPIFFEID. SVIDs minted for this ClusterSPIFFEID.
charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml
+8 -1
View File
@@ -30,7 +30,7 @@ matchLabels:
{{ $namespaces := list .Release.Namespace .Values.namespaceOverride (dig "spire" "namespaces" "server" "name" "" .Values.global) (dig "spire" "namespaces" "system" "name" "" .Values.global) | compact | uniq }} {{ $namespaces := list .Release.Namespace .Values.namespaceOverride (dig "spire" "namespaces" "server" "name" "" .Values.global) (dig "spire" "namespaces" "system" "name" "" .Values.global) | compact | uniq }}
{{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }} {{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }}
{{- range $skey, $svalue := $value }} {{- range $skey, $svalue := $value }}
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "type" "admin" "dnsNameTemplates" "downstream" "federatesWith" "jwtTTL" "namespaceSelector" "podSelector" "spiffeIDTemplate" "ttl" "workloadSelectorTemplates" "autoPopulateDNSNames" "fallback")) }} {{- if not (has $skey (list "name" "annotations" "labels" "enabled" "type" "admin" "dnsNameTemplates" "downstream" "federatesWith" "jwtTTL" "namespaceSelector" "podSelector" "spiffeIDTemplate" "ttl" "workloadSelectorTemplates" "autoPopulateDNSNames" "fallback" "hint")) }}
{{- fail (printf "Unsupported property specified: %s" $skey) }} {{- fail (printf "Unsupported property specified: %s" $skey) }}
{{- end }} {{- end }}
{{- end }} {{- end }}
@@ -63,6 +63,13 @@ metadata:
{{- end }} {{- end }}
spec: spec:
className: {{ include "spire-server.controller-manager-class-name" $root | quote }} className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
{{- if hasKey $value "hint" }}
{{- if ne $value.hint "" }}
hint: {{ $value.hint }}
{{- end }}
{{- else }}
hint: {{ $key }}
{{- end }}
{{- if and (hasKey $value "spiffeIDTemplate") (ne (len $value.spiffeIDTemplate) 0) }} {{- if and (hasKey $value "spiffeIDTemplate") (ne (len $value.spiffeIDTemplate) 0) }}
spiffeIDTemplate: {{ $value.spiffeIDTemplate | quote }} spiffeIDTemplate: {{ $value.spiffeIDTemplate | quote }}
{{- else }} {{- else }}
charts/spire/charts/spire-server/values.yaml
+2
View File
@@ -630,6 +630,8 @@ controllerManager:
autoPopulateDNSNames: false autoPopulateDNSNames: false
## @param controllerManager.identities.clusterSPIFFEIDs.default.fallback Apply this ID only if there are no other matching non fallback ClusterSPIFFEIDs ## @param controllerManager.identities.clusterSPIFFEIDs.default.fallback Apply this ID only if there are no other matching non fallback ClusterSPIFFEIDs
fallback: true fallback: true
# Set what hint to use. If unset, it will be asigned the clusterSPIFFEID name. If set to "", it will be unset. Any other value will set the hint to exactly what is specified.
# hint: ""
child-servers: child-servers:
## @param controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable this identity for controller manager ## @param controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable this identity for controller manager