Add namespaceSelector for spire-controller-manager (#112)

Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/charts/spire-server/README.md

@@ -21,6 +21,7 @@ A Helm chart to install the SPIRE server.
 | controllerManager.enabled | bool | `false` |  |
 | controllerManager.identities.dnsNameTemplates | list | `[]` |  |
 | controllerManager.identities.enabled | bool | `true` |  |
+| controllerManager.identities.namespaceSelector | object | `{}` |  |
 | controllerManager.identities.podSelector | object | `{}` |  |
 | controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` |  |
 | controllerManager.ignoreNamespaces[0] | string | `"kube-system"` |  |

charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml

@@ -11,6 +11,10 @@ spec:
   podSelector:
     {{- toYaml . | nindent 4 }}
   {{- end }}
+  {{- with .identities.namespaceSelector }}
+  namespaceSelector:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   {{- with .identities.dnsNameTemplates }}
   dnsNameTemplates:
     {{- toYaml . | nindent 4 }}

charts/spire/charts/spire-server/values.yaml

@@ -154,6 +154,9 @@ controllerManager:
     podSelector: {}
       # matchLabels:
       #   spiffe.io/spiffe-id: "true"
+    namespaceSelector: {}
+      # matchLabels:
+      #   spiffe.io/spiffe-id: "true"
     dnsNameTemplates: []
       # - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local'