From 1446f7ea79e8f4fbaf42b4a6e50ff020dfe761bd Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Tue, 20 Feb 2024 09:11:03 -0800 Subject: [PATCH] Add support for specifying agent authorized_delegates (#255) * Add support for specifying agent authorized_delegates Signed-off-by: Kevin Fox * Update charts/spire/charts/spire-agent/values.yaml Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix docs Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon --- charts/spire/charts/spire-agent/README.md | 1 + charts/spire/charts/spire-agent/templates/configmap.yaml | 4 ++++ charts/spire/charts/spire-agent/values.yaml | 2 ++ 3 files changed, 7 insertions(+) diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 3809774..6d9c733 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -46,6 +46,7 @@ A Helm chart to install the SPIRE agent. | `nodeSelector` | Node selector | `{}` | | `tolerations` | List of tolerations | `[]` | | `affinity` | Node affinity | `{}` | +| `authorizedDelegates` | A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information. | `[]` | | `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | | `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` | | `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 96f47d3..b89df42 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -26,6 +26,10 @@ agent: {{- if .Values.sockets.admin.enabled }} admin_socket_dir: /tmp/spire-agent/private/admin.sock {{- end }} + {{- with .Values.authorizedDelegates }} + authorized_delegates: + {{- toYaml . | nindent 4 }} + {{- end }} data_dir: "/run/spire" log_level: {{ .Values.logLevel | quote }} server_address: {{ include "spire-agent.server-address" . | trim | quote }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 205588b..812de7d 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -80,6 +80,8 @@ tolerations: [] ## @param affinity [object] Node affinity affinity: {} +## @param authorizedDelegates A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information. +authorizedDelegates: [] ## @param logLevel The log level, valid values are "debug", "info", "warn", and "error" logLevel: info ## @param clusterName The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)