panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add values to configure apiServiceLabel and webhookLabel (#536)

Browse Source 
Signed-off-by: Tamal Saha <[email protected]>
This commit is contained in:
Tamal Saha
2025-03-18 11:07:59 -07:00
committed by GitHub
parent 385cbb3e3d
commit 1c73035ecb
3 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+2
View File
@@ -249,6 +249,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` | | `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
| `notifier.k8sBundle.enabled` | Enable local k8s bundle uploader | `true` | | `notifier.k8sBundle.enabled` | Enable local k8s bundle uploader | `true` |
| `notifier.k8sBundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` | | `notifier.k8sBundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
| `notifier.k8sBundle.apiServiceLabel` | If set, rotate the CA Bundle in API services with this label set to true. | `""` |
| `notifier.k8sBundle.webhookLabel` | If set, rotate the CA Bundle in validating and mutating webhooks with this label set to true. | `""` |
| `notifier.externalK8sBundle.enabled` | Enable external k8s bundle uploader | `true` | | `notifier.externalK8sBundle.enabled` | Enable external k8s bundle uploader | `true` |
| `notifier.externalK8sBundle.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` | | `notifier.externalK8sBundle.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` |
| `notifier.externalK8sBundle.defaults.configMap` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` | | `notifier.externalK8sBundle.defaults.configMap` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` |
charts/spire/charts/spire-server/templates/configmap.yaml
+6
View File
@@ -264,6 +264,12 @@ plugins:
{{- if eq (.Values.notifier.k8sBundle.enabled | toString) "true" }} {{- if eq (.Values.notifier.k8sBundle.enabled | toString) "true" }}
namespace: {{ include "spire-server.bundle-namespace" . | quote }} namespace: {{ include "spire-server.bundle-namespace" . | quote }}
config_map: {{ include "spire-lib.bundle-configmap" . | quote }} config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
{{- with .Values.notifier.k8sBundle.apiServiceLabel }}
api_service_label: {{ . | quote }}
{{- end }}
{{- with .Values.notifier.k8sBundle.webhookLabel }}
webhook_label: {{ . | quote }}
{{- end }}
{{- end }} {{- end }}
{{- if and (eq (.Values.notifier.externalK8sBundle.enabled | toString) "true") (ne (len $externalK8sBundleClusters) 0) }} {{- if and (eq (.Values.notifier.externalK8sBundle.enabled | toString) "true") (ne (len $externalK8sBundleClusters) 0) }}
clusters: clusters:
charts/spire/charts/spire-server/values.yaml
+4
View File
@@ -487,6 +487,10 @@ notifier:
enabled: true enabled: true
## @param notifier.k8sBundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace ## @param notifier.k8sBundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace
namespace: "" namespace: ""
## @param notifier.k8sBundle.apiServiceLabel If set, rotate the CA Bundle in API services with this label set to true.
apiServiceLabel: ""
## @param notifier.k8sBundle.webhookLabel If set, rotate the CA Bundle in validating and mutating webhooks with this label set to true.
webhookLabel: ""
externalK8sBundle: externalK8sBundle:
## @param notifier.externalK8sBundle.enabled Enable external k8s bundle uploader ## @param notifier.externalK8sBundle.enabled Enable external k8s bundle uploader
enabled: true enabled: true