From 1c73035ecb21ddf1c0b5f6cda14d2c1d276afebe Mon Sep 17 00:00:00 2001 From: Tamal Saha Date: Tue, 18 Mar 2025 11:07:59 -0700 Subject: [PATCH] Add values to configure apiServiceLabel and webhookLabel (#536) Signed-off-by: Tamal Saha --- charts/spire/charts/spire-server/README.md | 2 ++ charts/spire/charts/spire-server/templates/configmap.yaml | 6 ++++++ charts/spire/charts/spire-server/values.yaml | 4 ++++ 3 files changed, 12 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index d42b5ab..1a79507 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -249,6 +249,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` | | `notifier.k8sBundle.enabled` | Enable local k8s bundle uploader | `true` | | `notifier.k8sBundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` | +| `notifier.k8sBundle.apiServiceLabel` | If set, rotate the CA Bundle in API services with this label set to true. | `""` | +| `notifier.k8sBundle.webhookLabel` | If set, rotate the CA Bundle in validating and mutating webhooks with this label set to true. | `""` | | `notifier.externalK8sBundle.enabled` | Enable external k8s bundle uploader | `true` | | `notifier.externalK8sBundle.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` | | `notifier.externalK8sBundle.defaults.configMap` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 6f25daf..e760277 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -264,6 +264,12 @@ plugins: {{- if eq (.Values.notifier.k8sBundle.enabled | toString) "true" }} namespace: {{ include "spire-server.bundle-namespace" . | quote }} config_map: {{ include "spire-lib.bundle-configmap" . | quote }} + {{- with .Values.notifier.k8sBundle.apiServiceLabel }} + api_service_label: {{ . | quote }} + {{- end }} + {{- with .Values.notifier.k8sBundle.webhookLabel }} + webhook_label: {{ . | quote }} + {{- end }} {{- end }} {{- if and (eq (.Values.notifier.externalK8sBundle.enabled | toString) "true") (ne (len $externalK8sBundleClusters) 0) }} clusters: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index f0ee9fc..8cc08b5 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -487,6 +487,10 @@ notifier: enabled: true ## @param notifier.k8sBundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace namespace: "" + ## @param notifier.k8sBundle.apiServiceLabel If set, rotate the CA Bundle in API services with this label set to true. + apiServiceLabel: "" + ## @param notifier.k8sBundle.webhookLabel If set, rotate the CA Bundle in validating and mutating webhooks with this label set to true. + webhookLabel: "" externalK8sBundle: ## @param notifier.externalK8sBundle.enabled Enable external k8s bundle uploader enabled: true