Apply wildcard for ignoreNamespaces in Controller Manager (#378)
* Apply wildcard for ignoreNamespaces in Controller Manager Signed-off-by: Mariusz Sabath <[email protected]> * Add the doc updates Signed-off-by: Mariusz Sabath <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Edwin Buck <[email protected]> --------- Signed-off-by: Mariusz Sabath <[email protected]> Signed-off-by: Edwin Buck <[email protected]> Co-authored-by: Edwin Buck <[email protected]> Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
Mariusz Sabath
co-authored by
kfox1111
Edwin Buck
kfox1111
Edwin Buck
parent
6c2b5e64cc
commit
1dc650f06e
@@ -109,7 +109,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `autoscaling.enabled` | Flag to enable autoscaling | `false` |
|
||||
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
|
||||
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` |
|
||||
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` |
|
||||
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization that triggers autoscaling | `80` |
|
||||
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` |
|
||||
| `tolerations` | List of tolerations | `[]` |
|
||||
| `affinity` | List of node affinities | `{}` |
|
||||
@@ -166,8 +166,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||
| `federation.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server-federation` |
|
||||
| `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `federation.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `federation.ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
||||
| `federation.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `ca_subject.country` | Country for Spire server CA | `ARPA` |
|
||||
| `ca_subject.organization` | Organization for Spire server CA | `Example` |
|
||||
| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` |
|
||||
@@ -232,7 +232,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
|
||||
| `notifier.k8sbundle.enabled` | Enable local k8s bundle uploader | `true` |
|
||||
| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||
| `notifier.externalK8sBundle.enabled` | Enable exernal k8s bundle uploader | `true` |
|
||||
| `notifier.externalK8sBundle.enabled` | Enable external k8s bundle uploader | `true` |
|
||||
| `notifier.externalK8sBundle.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` |
|
||||
| `notifier.externalK8sBundle.defaults.configMap` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` |
|
||||
| `notifier.externalK8sBundle.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `bundle.crt` |
|
||||
@@ -263,7 +263,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.podSelector` | Selector for pods to issue identity | `{}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector` | Selector for namespacs to issue identity | `{}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector` | Selector for namespaces to issue identity | `{}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.dnsNameTemplates` | DNS name template for issued identities | `[]` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.federatesWith` | Other Spire server URLs for identity federation | `[]` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.workloadSelectorTemplates` | Templates to produce selectors that apply to a given workload before it will receive an ID | `[]` |
|
||||
@@ -316,8 +316,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server` |
|
||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
||||
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `extraEnv` | Extra environment variables to add to the spire server | `[]` |
|
||||
| `extraVolumes` | Extra volumes to be mounted | `[]` |
|
||||
| `extraVolumeMounts` | Extra volume mounts | `[]` |
|
||||
@@ -369,7 +369,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` |
|
||||
| `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` |
|
||||
| `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `tornjak.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `tornjak.ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
||||
| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` |
|
||||
| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` |
|
||||
|
||||
@@ -101,7 +101,7 @@ resources: {}
|
||||
## @param autoscaling.enabled Flag to enable autoscaling
|
||||
## @param autoscaling.minReplicas Minimum replicas for autoscaling
|
||||
## @param autoscaling.maxReplicas Maximum replicas for autoscaling
|
||||
## @param autoscaling.targetCPUUtilizationPercentage Target CPU utlization that triggers autoscaling
|
||||
## @param autoscaling.targetCPUUtilizationPercentage Target CPU utilization that triggers autoscaling
|
||||
##
|
||||
autoscaling:
|
||||
enabled: false
|
||||
@@ -273,14 +273,14 @@ federation:
|
||||
## @param federation.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
|
||||
## @param federation.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||
## @param federation.ingress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
|
||||
hosts: []
|
||||
# - host: spire-server-federation.example.org
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
|
||||
## @param federation.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||
## @param federation.ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
# - hosts:
|
||||
# - spire-server-federation.example.org
|
||||
@@ -446,7 +446,7 @@ notifier:
|
||||
## @param notifier.k8sbundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace
|
||||
namespace: ""
|
||||
externalK8sBundle:
|
||||
## @param notifier.externalK8sBundle.enabled Enable exernal k8s bundle uploader
|
||||
## @param notifier.externalK8sBundle.enabled Enable external k8s bundle uploader
|
||||
enabled: true
|
||||
defaults:
|
||||
## @param notifier.externalK8sBundle.defaults.namespace Namespace to push the bundle into on clusters
|
||||
@@ -540,32 +540,10 @@ controllerManager:
|
||||
- kube-system
|
||||
- kube-public
|
||||
- local-path-storage
|
||||
# openshift related namespaces that should be typically ignored
|
||||
- openshift-cluster-node-tuning-operator
|
||||
- openshift-cluster-samples-operator
|
||||
- openshift-cluster-storage-operator
|
||||
- openshift-console-operator
|
||||
- openshift-console
|
||||
- openshift-dns
|
||||
- openshift-dns-operator
|
||||
- openshift-image-registry
|
||||
- openshift-ingress
|
||||
- openshift-kube-storage-version-migrator
|
||||
- openshift-kube-storage-version-migrator-operator
|
||||
- openshift-kube-proxy
|
||||
- openshift-marketplace
|
||||
- openshift-monitoring
|
||||
- openshift-multus
|
||||
- openshift-network-diagnostics
|
||||
- openshift-network-operator
|
||||
- openshift-operator-lifecycle-manager
|
||||
- openshift-roks-metrics
|
||||
- openshift-service-ca-operator
|
||||
- openshift-service-ca
|
||||
# ibmcloud specific namespaces
|
||||
- ibm-odf-validation-webhook
|
||||
- ibm-system
|
||||
|
||||
# openshift creates many namespaces that should be typically ignored:
|
||||
- openshift-*
|
||||
# ibmcloud specific namespaces:
|
||||
- ibm-*
|
||||
## @param controllerManager.reconcile.clusterSPIFFEIDs Enable reconciliation of clusterSPIFFEIDs from K8s to the SPIRE server
|
||||
## @param controllerManager.reconcile.clusterStaticEntries Enable reconciliation of clusterStaticEntries from K8s to the SPIRE server
|
||||
## @param controllerManager.reconcile.clusterFederatedTrustDomains Enable reconciliation of clusterFederatedTrustDomains from K8s to the SPIRE server
|
||||
@@ -585,7 +563,7 @@ controllerManager:
|
||||
podSelector: {}
|
||||
# matchLabels:
|
||||
# spiffe.io/spiffe-id: "true"
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector [object] Selector for namespacs to issue identity
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector [object] Selector for namespaces to issue identity
|
||||
namespaceSelector: {}
|
||||
# matchLabels:
|
||||
# spiffe.io/spiffe-id: "true"
|
||||
@@ -718,31 +696,10 @@ externalControllerManagers:
|
||||
- kube-system
|
||||
- kube-public
|
||||
- local-path-storage
|
||||
# openshift related namespaces that should be typically ignored
|
||||
- openshift-cluster-node-tuning-operator
|
||||
- openshift-cluster-samples-operator
|
||||
- openshift-cluster-storage-operator
|
||||
- openshift-console-operator
|
||||
- openshift-console
|
||||
- openshift-dns
|
||||
- openshift-dns-operator
|
||||
- openshift-image-registry
|
||||
- openshift-ingress
|
||||
- openshift-kube-storage-version-migrator
|
||||
- openshift-kube-storage-version-migrator-operator
|
||||
- openshift-kube-proxy
|
||||
- openshift-marketplace
|
||||
- openshift-monitoring
|
||||
- openshift-multus
|
||||
- openshift-network-diagnostics
|
||||
- openshift-network-operator
|
||||
- openshift-operator-lifecycle-manager
|
||||
- openshift-roks-metrics
|
||||
- openshift-service-ca-operator
|
||||
- openshift-service-ca
|
||||
# ibmcloud specific namespaces
|
||||
- ibm-odf-validation-webhook
|
||||
- ibm-system
|
||||
# openshift creates many namespaces that should be typically ignored:
|
||||
- openshift-.*
|
||||
# ibmcloud specific namespaces:
|
||||
- ibm-.*
|
||||
## @param externalControllerManagers.defaults.cacheNamespaces [object] If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces.
|
||||
cacheNamespaces: {}
|
||||
|
||||
@@ -800,14 +757,14 @@ ingress:
|
||||
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
|
||||
## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||
## @param ingress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
|
||||
hosts: []
|
||||
# - host: spire-server.example.org
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
|
||||
## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||
## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
# - secretName: spire-server-tls
|
||||
# hosts:
|
||||
@@ -936,7 +893,7 @@ tornjak:
|
||||
## @param tornjak.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
|
||||
## @param tornjak.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||
## @param tornjak.ingress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
|
||||
hosts: []
|
||||
# - host: tornjak-backend.example.org
|
||||
# paths:
|
||||
|
||||
Reference in New Issue
Block a user