From 3b6666016c63d1bfc73a505d27f7c745cc5b05d6 Mon Sep 17 00:00:00 2001 From: Drew Wells Date: Thu, 22 Jun 2023 10:45:37 -0500 Subject: [PATCH] add missing federatesWith option (#361) DEMO ``` spire-server-0 -- spire-server entry show -spiffeID spiffe://box-4.example.com/ns/dwells/sa/dwells-rc-realm-client Defaulted container "spire-server" out of: spire-server, spire-controller-manager, wait (init) Found 1 entry Entry ID : 09301666-010e-4ba9-9dcb-44370d4e49e4 SPIFFE ID : spiffe://box-4.example.com/ns/dwells/sa/dwells-rc-realm-client Parent ID : spiffe://box-4.example.com/spire/agent/k8s_psat/example-cluster/ff93872d-791f-4bf3-a532-475775d03d3e Revision : 0 X509-SVID TTL : default JWT-SVID TTL : default Selector : k8s:pod-uid:40e0bcad-6ec8-460b-a839-659654549d7a FederatesWith : box-3.example.com ``` Signed-off-by: Drew Wells --- charts/spire/README.md | 1 + charts/spire/charts/spire-server/README.md | 1 + .../templates/controller-manager-cluster-ids.yaml | 4 ++++ charts/spire/charts/spire-server/values.yaml | 3 +++ 4 files changed, 9 insertions(+) diff --git a/charts/spire/README.md b/charts/spire/README.md index 1dc8d53..ce6c591 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -300,6 +300,7 @@ Now you can interact with the Spire agent socket from your own application. The | spire-server.controllerManager.enabled | bool | `false` | | | spire-server.controllerManager.identities.dnsNameTemplates | list | `[]` | | | spire-server.controllerManager.identities.enabled | bool | `true` | | +| spire-server.controllerManager.identities.federatesWith | list | `[]` | | | spire-server.controllerManager.identities.namespaceSelector | object | `{}` | | | spire-server.controllerManager.identities.podSelector | object | `{}` | | | spire-server.controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | | diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 36bcbe4..810aea8 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -50,6 +50,7 @@ A Helm chart to install the SPIRE server. | controllerManager.enabled | bool | `false` | | | controllerManager.identities.dnsNameTemplates | list | `[]` | | | controllerManager.identities.enabled | bool | `true` | | +| controllerManager.identities.federatesWith | list | `[]` | | | controllerManager.identities.namespaceSelector | object | `{}` | | | controllerManager.identities.podSelector | object | `{}` | | | controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml index 5967d31..69c7c6f 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml @@ -8,6 +8,10 @@ metadata: namespace: {{ include "spire-server.namespace" $root }} spec: spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }} + {{- with .identities.federatesWith }} + federatesWith: + {{- toYaml . | nindent 4 }} + {{- end }} {{- with .identities.podSelector }} podSelector: {{- toYaml . | nindent 4 }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 17095b0..789824e 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -279,6 +279,9 @@ controllerManager: # spiffe.io/spiffe-id: "true" dnsNameTemplates: [] # - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local' + federatesWith: [] + # - example.io + # - example.ai validatingWebhookConfiguration: failurePolicy: Fail