panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add missing ClusterSPIFFEID fields

Browse Source 
There are a few options in the CRD not available via the chart.
Sync them to the chart.

Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
Kevin Fox
2023-11-05 23:29:22 -08:00
committed by Faisal Memon
parent 9b31f3d40b
commit 3778597e72
3 changed files with 23 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+4
View File
@@ -235,6 +235,10 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.identities.namespaceSelector` | Selector for namespacs to issue identity | `{}` |
| `controllerManager.identities.dnsNameTemplates` | DNS name template for issued identities | `[]` |
| `controllerManager.identities.federatesWith` | Other Spire server URLs for identity federation | `[]` |
| `controllerManager.identities.workloadSelectorTemplates` | Templates to produce selectors that apply to a given workload before it will receive an ID | `[]` |
| `controllerManager.identities.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` |
| `controllerManager.identities.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` |
| `controllerManager.identities.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml
+11
View File
@@ -24,5 +24,16 @@ spec:
dnsNameTemplates:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .identities.workloadSelectorTemplates }}
workloadTSelectoremplates:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .identities.ttl }}
ttl: {{ . | quote }}
{{- end }}
{{- with .identities.jwtTTL }}
jwtTtl: {{ . | quote }}
{{- end }}
admin: {{ .identities.admin }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/values.yaml
+8
View File
@@ -459,6 +459,14 @@ controllerManager:
federatesWith: []
# - example.io
# - example.ai
## @param controllerManager.identities.workloadSelectorTemplates [array] Templates to produce selectors that apply to a given workload before it will receive an ID
workloadSelectorTemplates: []
## @param controllerManager.identities.ttl Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen.
ttl: ""
## @param controllerManager.identities.jwtTTL Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen.
jwtTTL: ""
## @param controllerManager.identities.admin Indicates any pod matched by this identity will be an admin. Use this with extreme care.
admin: false
validatingWebhookConfiguration:
## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued