From 3778597e72f2bfb6270bf52cc36e836daa6be029 Mon Sep 17 00:00:00 2001 From: Kevin Fox Date: Sat, 4 Nov 2023 08:14:09 -0700 Subject: [PATCH] Add missing ClusterSPIFFEID fields There are a few options in the CRD not available via the chart. Sync them to the chart. Signed-off-by: Kevin Fox --- charts/spire/charts/spire-server/README.md | 4 ++++ .../templates/controller-manager-cluster-ids.yaml | 11 +++++++++++ charts/spire/charts/spire-server/values.yaml | 8 ++++++++ 3 files changed, 23 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 6b5e4a7..b44c2cf 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -235,6 +235,10 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.identities.namespaceSelector` | Selector for namespacs to issue identity | `{}` | | `controllerManager.identities.dnsNameTemplates` | DNS name template for issued identities | `[]` | | `controllerManager.identities.federatesWith` | Other Spire server URLs for identity federation | `[]` | +| `controllerManager.identities.workloadSelectorTemplates` | Templates to produce selectors that apply to a given workload before it will receive an ID | `[]` | +| `controllerManager.identities.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` | +| `controllerManager.identities.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` | +| `controllerManager.identities.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` | | `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml index 69c7c6f..02e0648 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml @@ -24,5 +24,16 @@ spec: dnsNameTemplates: {{- toYaml . | nindent 4 }} {{- end }} + {{- with .identities.workloadSelectorTemplates }} + workloadTSelectoremplates: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .identities.ttl }} + ttl: {{ . | quote }} + {{- end }} + {{- with .identities.jwtTTL }} + jwtTtl: {{ . | quote }} + {{- end }} + admin: {{ .identities.admin }} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 5d9a7c2..347bc4f 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -459,6 +459,14 @@ controllerManager: federatesWith: [] # - example.io # - example.ai + ## @param controllerManager.identities.workloadSelectorTemplates [array] Templates to produce selectors that apply to a given workload before it will receive an ID + workloadSelectorTemplates: [] + ## @param controllerManager.identities.ttl Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. + ttl: "" + ## @param controllerManager.identities.jwtTTL Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. + jwtTTL: "" + ## @param controllerManager.identities.admin Indicates any pod matched by this identity will be an admin. Use this with extreme care. + admin: false validatingWebhookConfiguration: ## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued