panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make webhook fail policy configurable (#124)

Browse Source 
This patch makes the webhook fail policy configurable.

---------

Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
2023-03-15 12:55:07 -07:00
committed by GitHub
parent 9ccbd3c67f
commit 2e3f045826
3 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+1
View File
@@ -47,6 +47,7 @@ A Helm chart to install the SPIRE server.
| controllerManager.service.annotations | object | `{}` | | | controllerManager.service.annotations | object | `{}` | |
| controllerManager.service.port | int | `443` | | | controllerManager.service.port | int | `443` | |
| controllerManager.service.type | string | `"ClusterIP"` | | | controllerManager.service.type | string | `"ClusterIP"` | |
| controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | |
| dataStorage.accessMode | string | `"ReadWriteOnce"` | | | dataStorage.accessMode | string | `"ReadWriteOnce"` | |
| dataStorage.enabled | bool | `true` | | | dataStorage.enabled | bool | `true` | |
| dataStorage.size | string | `"1Gi"` | | | dataStorage.size | string | `"1Gi"` | |
charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml
+2 -2
View File
@@ -10,7 +10,7 @@ webhooks:
name: {{ include "spire-controller-manager.fullname" . }}-webhook name: {{ include "spire-controller-manager.fullname" . }}-webhook
namespace: {{ include "spire-server.namespace" . }} namespace: {{ include "spire-server.namespace" . }}
path: /validate-spire-spiffe-io-v1alpha1-clusterfederatedtrustdomain path: /validate-spire-spiffe-io-v1alpha1-clusterfederatedtrustdomain
failurePolicy: Fail failurePolicy: {{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}
name: vclusterfederatedtrustdomain.kb.io name: vclusterfederatedtrustdomain.kb.io
rules: rules:
- apiGroups: ["spire.spiffe.io"] - apiGroups: ["spire.spiffe.io"]
@@ -24,7 +24,7 @@ webhooks:
name: {{ include "spire-controller-manager.fullname" . }}-webhook name: {{ include "spire-controller-manager.fullname" . }}-webhook
namespace: {{ include "spire-server.namespace" . }} namespace: {{ include "spire-server.namespace" . }}
path: /validate-spire-spiffe-io-v1alpha1-clusterspiffeid path: /validate-spire-spiffe-io-v1alpha1-clusterspiffeid
failurePolicy: Fail failurePolicy: {{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}
name: vclusterspiffeid.kb.io name: vclusterspiffeid.kb.io
rules: rules:
- apiGroups: ["spire.spiffe.io"] - apiGroups: ["spire.spiffe.io"]
charts/spire/charts/spire-server/values.yaml
+3
View File
@@ -174,6 +174,9 @@ controllerManager:
dnsNameTemplates: [] dnsNameTemplates: []
# - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local' # - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local'
validatingWebhookConfiguration:
failurePolicy: Fail
telemetry: telemetry:
prometheus: prometheus:
enabled: false enabled: false