Default spire-server port 443 (#308)
Changes the default service port for the spire-server to 443 to allow easier switching between internal access and external access through an ingress controller. Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: Faisal Memon <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -77,7 +77,10 @@ We only support upgrading one major version at a time. Version skipping isn't su
|
|||||||
|
|
||||||
### 0.20.X
|
### 0.20.X
|
||||||
|
|
||||||
This release configures the entries managed by the spire-controller-manager to move into their own managed space within SPIRE. This should be transparent. In a future release, we will
|
- The default service port for the spire-server was changed to be port 443 to allow easier switching between internal access and external access through an ingress controller. For most users, this will be a transparent
|
||||||
|
change.
|
||||||
|
|
||||||
|
- This release configures the entries managed by the spire-controller-manager to move into their own managed space within SPIRE. This should be transparent. In a future release, we will
|
||||||
disable cleanup by default of the old space. This release lays the groundwork for future support for manually created entries in the SPIRE database without the spire-controller-manager
|
disable cleanup by default of the old space. This release lays the groundwork for future support for manually created entries in the SPIRE database without the spire-controller-manager
|
||||||
destroying them. It is supported in this release by manually setting spire-server.controllerManager.entryIDPrefixCleanup=false after successfully upgrading to the chart without the
|
destroying them. It is supported in this release by manually setting spire-server.controllerManager.entryIDPrefixCleanup=false after successfully upgrading to the chart without the
|
||||||
setting and waiting for a spire-controller-manager sync.
|
setting and waiting for a spire-controller-manager sync.
|
||||||
|
|||||||
@@ -57,7 +57,7 @@ A Helm chart to install the SPIRE agent.
|
|||||||
| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` |
|
| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` |
|
||||||
| `disableReattestToRenew` | Deprecated: Allow agent to renew certificate when it expires rather than reattest | `false` |
|
| `disableReattestToRenew` | Deprecated: Allow agent to renew certificate when it expires rather than reattest | `false` |
|
||||||
| `server.address` | Address for Spire server | `""` |
|
| `server.address` | Address for Spire server | `""` |
|
||||||
| `server.port` | Port number for Spire server | `8081` |
|
| `server.port` | Port number for Spire server | `443` |
|
||||||
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
||||||
| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
||||||
| `healthChecks.port` | override the host port used for health checking | `9982` |
|
| `healthChecks.port` | override the host port used for health checking | `9982` |
|
||||||
|
|||||||
@@ -113,7 +113,7 @@ upstream: false
|
|||||||
##
|
##
|
||||||
server:
|
server:
|
||||||
address: ""
|
address: ""
|
||||||
port: 8081
|
port: 443
|
||||||
namespaceOverride: ""
|
namespaceOverride: ""
|
||||||
nameOverride: ""
|
nameOverride: ""
|
||||||
|
|
||||||
|
|||||||
@@ -101,7 +101,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `securityContext` | Security context | `{}` |
|
| `securityContext` | Security context | `{}` |
|
||||||
| `priorityClassName` | Priority class assigned to statefulset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
| `priorityClassName` | Priority class assigned to statefulset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||||
| `service.type` | Type of the Spire server service created | `ClusterIP` |
|
| `service.type` | Type of the Spire server service created | `ClusterIP` |
|
||||||
| `service.port` | Port for the created service | `8081` |
|
| `service.port` | Port for the created service | `443` |
|
||||||
| `service.annotations` | Annotations to add to the service object | `{}` |
|
| `service.annotations` | Annotations to add to the service object | `{}` |
|
||||||
| `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` |
|
| `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` |
|
||||||
| `resources` | Resource requests and limits | `{}` |
|
| `resources` | Resource requests and limits | `{}` |
|
||||||
@@ -215,7 +215,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | |
|
| `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | |
|
||||||
| `upstreamAuthority.spire.server.nameOverride` | Override the name for upstream Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
| `upstreamAuthority.spire.server.nameOverride` | Override the name for upstream Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
||||||
| `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` |
|
| `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` |
|
||||||
| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `8081` |
|
| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `443` |
|
||||||
| `upstreamAuthority.vault.enabled` | Enable Hashicorp Vault as upstream CA | `false` |
|
| `upstreamAuthority.vault.enabled` | Enable Hashicorp Vault as upstream CA | `false` |
|
||||||
| `upstreamAuthority.vault.vaultAddr` | The URL of the Vault server. (e.g., https://vault.example.com:8443/) | `""` |
|
| `upstreamAuthority.vault.vaultAddr` | The URL of the Vault server. (e.g., https://vault.example.com:8443/) | `""` |
|
||||||
| `upstreamAuthority.vault.namespace` | Name of the Vault namespace. This is only available in the Vault Enterprise. | `""` |
|
| `upstreamAuthority.vault.namespace` | Name of the Vault namespace. This is only available in the Vault Enterprise. | `""` |
|
||||||
|
|||||||
@@ -75,7 +75,7 @@ priorityClassName: ""
|
|||||||
##
|
##
|
||||||
service:
|
service:
|
||||||
type: ClusterIP
|
type: ClusterIP
|
||||||
port: 8081
|
port: 443
|
||||||
annotations: {}
|
annotations: {}
|
||||||
|
|
||||||
configMap:
|
configMap:
|
||||||
@@ -403,7 +403,7 @@ upstreamAuthority:
|
|||||||
## @param upstreamAuthority.spire.server.address Address for upstream Spire server
|
## @param upstreamAuthority.spire.server.address Address for upstream Spire server
|
||||||
address: ""
|
address: ""
|
||||||
## @param upstreamAuthority.spire.server.port Port for upstream Spire server
|
## @param upstreamAuthority.spire.server.port Port for upstream Spire server
|
||||||
port: 8081
|
port: 443
|
||||||
vault:
|
vault:
|
||||||
## @param upstreamAuthority.vault.enabled Enable Hashicorp Vault as upstream CA
|
## @param upstreamAuthority.vault.enabled Enable Hashicorp Vault as upstream CA
|
||||||
enabled: false
|
enabled: false
|
||||||
|
|||||||
Reference in New Issue
Block a user