panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apply wildcard for ignoreNamespaces in Controller Manager (#378)

Browse Source 
* Apply wildcard for ignoreNamespaces in Controller Manager

Signed-off-by: Mariusz Sabath <[email protected]>

* Add the doc updates

Signed-off-by: Mariusz Sabath <[email protected]>

* Update charts/spire/charts/spire-server/values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Edwin Buck <[email protected]>

---------

Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: Edwin Buck <[email protected]>
Co-authored-by: Edwin Buck <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
Mariusz Sabath
2024-06-06 15:56:15 -07:00
committed by GitHub
co-authored by kfox1111 Edwin Buck
parent 6c2b5e64cc
commit 1dc650f06e
2 changed files with 24 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+8 -8
View File
@@ -109,7 +109,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `autoscaling.enabled` | Flag to enable autoscaling | `false` | | `autoscaling.enabled` | Flag to enable autoscaling | `false` |
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` | | `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` | | `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` |
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` | | `autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization that triggers autoscaling | `80` |
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` | | `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` |
| `tolerations` | List of tolerations | `[]` | | `tolerations` | List of tolerations | `[]` |
| `affinity` | List of node affinities | `{}` | | `affinity` | List of node affinities | `{}` |
@@ -166,8 +166,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` | | `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
| `federation.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server-federation` | | `federation.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server-federation` |
| `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | | `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
| `federation.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | | `federation.ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `federation.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
| `ca_subject.country` | Country for Spire server CA | `ARPA` | | `ca_subject.country` | Country for Spire server CA | `ARPA` |
| `ca_subject.organization` | Organization for Spire server CA | `Example` | | `ca_subject.organization` | Organization for Spire server CA | `Example` |
| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` | | `ca_subject.common_name` | Common Name for Spire server CA | `example.org` |
@@ -232,7 +232,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` | | `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
| `notifier.k8sbundle.enabled` | Enable local k8s bundle uploader | `true` | | `notifier.k8sbundle.enabled` | Enable local k8s bundle uploader | `true` |
| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` | | `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
| `notifier.externalK8sBundle.enabled` | Enable exernal k8s bundle uploader | `true` | | `notifier.externalK8sBundle.enabled` | Enable external k8s bundle uploader | `true` |
| `notifier.externalK8sBundle.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` | | `notifier.externalK8sBundle.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` |
| `notifier.externalK8sBundle.defaults.configMap` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` | | `notifier.externalK8sBundle.defaults.configMap` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` |
| `notifier.externalK8sBundle.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `bundle.crt` | | `notifier.externalK8sBundle.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `bundle.crt` |
@@ -263,7 +263,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable this identity for controller manager | `true` | | `controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable this identity for controller manager | `true` |
| `controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` | | `controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` |
| `controllerManager.identities.clusterSPIFFEIDs.default.podSelector` | Selector for pods to issue identity | `{}` | | `controllerManager.identities.clusterSPIFFEIDs.default.podSelector` | Selector for pods to issue identity | `{}` |
| `controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector` | Selector for namespacs to issue identity | `{}` | | `controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector` | Selector for namespaces to issue identity | `{}` |
| `controllerManager.identities.clusterSPIFFEIDs.default.dnsNameTemplates` | DNS name template for issued identities | `[]` | | `controllerManager.identities.clusterSPIFFEIDs.default.dnsNameTemplates` | DNS name template for issued identities | `[]` |
| `controllerManager.identities.clusterSPIFFEIDs.default.federatesWith` | Other Spire server URLs for identity federation | `[]` | | `controllerManager.identities.clusterSPIFFEIDs.default.federatesWith` | Other Spire server URLs for identity federation | `[]` |
| `controllerManager.identities.clusterSPIFFEIDs.default.workloadSelectorTemplates` | Templates to produce selectors that apply to a given workload before it will receive an ID | `[]` | | `controllerManager.identities.clusterSPIFFEIDs.default.workloadSelectorTemplates` | Templates to produce selectors that apply to a given workload before it will receive an ID | `[]` |
@@ -316,8 +316,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `ingress.annotations` | Annotations for the ingress object | `{}` | | `ingress.annotations` | Annotations for the ingress object | `{}` |
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server` | | `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server` |
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | | `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | | `ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
| `extraEnv` | Extra environment variables to add to the spire server | `[]` | | `extraEnv` | Extra environment variables to add to the spire server | `[]` |
| `extraVolumes` | Extra volumes to be mounted | `[]` | | `extraVolumes` | Extra volumes to be mounted | `[]` |
| `extraVolumeMounts` | Extra volume mounts | `[]` | | `extraVolumeMounts` | Extra volume mounts | `[]` |
@@ -369,7 +369,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` | | `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` |
| `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` | | `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` |
| `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | | `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
| `tornjak.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | | `tornjak.ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` | | `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` |
| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` | | `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` |
charts/spire/charts/spire-server/values.yaml
+16 -59
View File
@@ -101,7 +101,7 @@ resources: {}
## @param autoscaling.enabled Flag to enable autoscaling ## @param autoscaling.enabled Flag to enable autoscaling
## @param autoscaling.minReplicas Minimum replicas for autoscaling ## @param autoscaling.minReplicas Minimum replicas for autoscaling
## @param autoscaling.maxReplicas Maximum replicas for autoscaling ## @param autoscaling.maxReplicas Maximum replicas for autoscaling
## @param autoscaling.targetCPUUtilizationPercentage Target CPU utlization that triggers autoscaling ## @param autoscaling.targetCPUUtilizationPercentage Target CPU utilization that triggers autoscaling
## ##
autoscaling: autoscaling:
enabled: false enabled: false
@@ -273,14 +273,14 @@ federation:
## @param federation.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. ## @param federation.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
tlsSecret: "" tlsSecret: ""
## @param federation.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. ## @param federation.ingress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
hosts: [] hosts: []
# - host: spire-server-federation.example.org # - host: spire-server-federation.example.org
# paths: # paths:
# - path: / # - path: /
# pathType: Prefix # pathType: Prefix
## @param federation.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. ## @param federation.ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
tls: [] tls: []
# - hosts: # - hosts:
# - spire-server-federation.example.org # - spire-server-federation.example.org
@@ -446,7 +446,7 @@ notifier:
## @param notifier.k8sbundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace ## @param notifier.k8sbundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace
namespace: "" namespace: ""
externalK8sBundle: externalK8sBundle:
## @param notifier.externalK8sBundle.enabled Enable exernal k8s bundle uploader ## @param notifier.externalK8sBundle.enabled Enable external k8s bundle uploader
enabled: true enabled: true
defaults: defaults:
## @param notifier.externalK8sBundle.defaults.namespace Namespace to push the bundle into on clusters ## @param notifier.externalK8sBundle.defaults.namespace Namespace to push the bundle into on clusters
@@ -540,32 +540,10 @@ controllerManager:
- kube-system - kube-system
- kube-public - kube-public
- local-path-storage - local-path-storage
# openshift related namespaces that should be typically ignored # openshift creates many namespaces that should be typically ignored:
- openshift-cluster-node-tuning-operator - openshift-*
- openshift-cluster-samples-operator # ibmcloud specific namespaces:
- openshift-cluster-storage-operator - ibm-*
- openshift-console-operator
- openshift-console
- openshift-dns
- openshift-dns-operator
- openshift-image-registry
- openshift-ingress
- openshift-kube-storage-version-migrator
- openshift-kube-storage-version-migrator-operator
- openshift-kube-proxy
- openshift-marketplace
- openshift-monitoring
- openshift-multus
- openshift-network-diagnostics
- openshift-network-operator
- openshift-operator-lifecycle-manager
- openshift-roks-metrics
- openshift-service-ca-operator
- openshift-service-ca
# ibmcloud specific namespaces
- ibm-odf-validation-webhook
- ibm-system
## @param controllerManager.reconcile.clusterSPIFFEIDs Enable reconciliation of clusterSPIFFEIDs from K8s to the SPIRE server ## @param controllerManager.reconcile.clusterSPIFFEIDs Enable reconciliation of clusterSPIFFEIDs from K8s to the SPIRE server
## @param controllerManager.reconcile.clusterStaticEntries Enable reconciliation of clusterStaticEntries from K8s to the SPIRE server ## @param controllerManager.reconcile.clusterStaticEntries Enable reconciliation of clusterStaticEntries from K8s to the SPIRE server
## @param controllerManager.reconcile.clusterFederatedTrustDomains Enable reconciliation of clusterFederatedTrustDomains from K8s to the SPIRE server ## @param controllerManager.reconcile.clusterFederatedTrustDomains Enable reconciliation of clusterFederatedTrustDomains from K8s to the SPIRE server
@@ -585,7 +563,7 @@ controllerManager:
podSelector: {} podSelector: {}
# matchLabels: # matchLabels:
# spiffe.io/spiffe-id: "true" # spiffe.io/spiffe-id: "true"
## @param controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector [object] Selector for namespacs to issue identity ## @param controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector [object] Selector for namespaces to issue identity
namespaceSelector: {} namespaceSelector: {}
# matchLabels: # matchLabels:
# spiffe.io/spiffe-id: "true" # spiffe.io/spiffe-id: "true"
@@ -718,31 +696,10 @@ externalControllerManagers:
- kube-system - kube-system
- kube-public - kube-public
- local-path-storage - local-path-storage
# openshift related namespaces that should be typically ignored # openshift creates many namespaces that should be typically ignored:
- openshift-cluster-node-tuning-operator - openshift-.*
- openshift-cluster-samples-operator # ibmcloud specific namespaces:
- openshift-cluster-storage-operator - ibm-.*
- openshift-console-operator
- openshift-console
- openshift-dns
- openshift-dns-operator
- openshift-image-registry
- openshift-ingress
- openshift-kube-storage-version-migrator
- openshift-kube-storage-version-migrator-operator
- openshift-kube-proxy
- openshift-marketplace
- openshift-monitoring
- openshift-multus
- openshift-network-diagnostics
- openshift-network-operator
- openshift-operator-lifecycle-manager
- openshift-roks-metrics
- openshift-service-ca-operator
- openshift-service-ca
# ibmcloud specific namespaces
- ibm-odf-validation-webhook
- ibm-system
## @param externalControllerManagers.defaults.cacheNamespaces [object] If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. ## @param externalControllerManagers.defaults.cacheNamespaces [object] If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces.
cacheNamespaces: {} cacheNamespaces: {}
@@ -800,14 +757,14 @@ ingress:
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
tlsSecret: "" tlsSecret: ""
## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. ## @param ingress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
hosts: [] hosts: []
# - host: spire-server.example.org # - host: spire-server.example.org
# paths: # paths:
# - path: / # - path: /
# pathType: Prefix # pathType: Prefix
## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. ## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
tls: [] tls: []
# - secretName: spire-server-tls # - secretName: spire-server-tls
# hosts: # hosts:
@@ -936,7 +893,7 @@ tornjak:
## @param tornjak.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. ## @param tornjak.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
tlsSecret: "" tlsSecret: ""
## @param tornjak.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. ## @param tornjak.ingress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
hosts: [] hosts: []
# - host: tornjak-backend.example.org # - host: tornjak-backend.example.org
# paths: # paths: