panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(spire): preserve webhook order in patch hooks (#918)

Browse Source 
* fix(spire-server): preserve webhook order in patch hooks

Signed-off-by: Christoph Manns <[email protected]>

* test(spire): cover webhook patch order

Signed-off-by: Christoph Manns <[email protected]>

* fix(spire-server): honor effective hook setting

Signed-off-by: Christoph Manns <[email protected]>

* Apply suggestion from @kfox1111

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Christoph Manns <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
RuriRyan
2026-08-20 12:15:55 -07:00
committed by GitHub
co-authored by kfox1111 kfox1111
parent 1ce42d587a
commit 27026e4657
5 changed files with 159 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml
+6 -1
View File
@@ -1,3 +1,4 @@
{{- $installAndUpgradeHooksEnabled := dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global }}
{{- if not .Values.externalServer }}
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
@@ -12,7 +13,7 @@ webhooks:
name: {{ include "spire-controller-manager.fullname" . }}-webhook
namespace: {{ include "spire-server.namespace" . }}
path: /validate-spire-spiffe-io-v1alpha1-clusterfederatedtrustdomain
{{- if eq (.Values.controllerManager.installAndUpgradeHook.enabled | toString) "true" }}
{{- if eq ($installAndUpgradeHooksEnabled | toString) "true" }}
failurePolicy: Ignore # Actual value to be set by post install/upgrade hooks
{{- else }}
failurePolicy: {{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}
@@ -30,7 +31,11 @@ webhooks:
name: {{ include "spire-controller-manager.fullname" . }}-webhook
namespace: {{ include "spire-server.namespace" . }}
path: /validate-spire-spiffe-io-v1alpha1-clusterspiffeid
{{- if eq ($installAndUpgradeHooksEnabled | toString) "true" }}
failurePolicy: Ignore # Actual value to be set by post install/upgrade hooks
{{- else }}
failurePolicy: {{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}
{{- end }}
name: vclusterspiffeid.kb.io
rules:
- apiGroups: ["spire.spiffe.io"]
charts/spire/charts/spire-server/templates/post-install-hook.yaml
+2 -2
View File
@@ -85,11 +85,11 @@ spec:
{
"webhooks":[
{
"name":"vclusterspiffeid.kb.io",
"name":"vclusterfederatedtrustdomain.kb.io",
"failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
},
{
"name":"vclusterfederatedtrustdomain.kb.io",
"name":"vclusterspiffeid.kb.io",
"failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
}
]
charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+2 -2
View File
@@ -85,11 +85,11 @@ spec:
{
"webhooks":[
{
"name":"vclusterspiffeid.kb.io",
"name":"vclusterfederatedtrustdomain.kb.io",
"failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
},
{
"name":"vclusterfederatedtrustdomain.kb.io",
"name":"vclusterspiffeid.kb.io",
"failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
}
]
charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+2 -2
View File
@@ -85,11 +85,11 @@ spec:
{
"webhooks":[
{
"name":"vclusterspiffeid.kb.io",
"name":"vclusterfederatedtrustdomain.kb.io",
"failurePolicy":"Ignore"
},
{
"name":"vclusterfederatedtrustdomain.kb.io",
"name":"vclusterspiffeid.kb.io",
"failurePolicy":"Ignore"
}
]