Gateway api support (#890)
* Gateway api support Signed-off-by: Kevin Fox <[email protected]> * Update readme Signed-off-by: Kevin Fox <[email protected]> * Fix gateway name. a gateway doesnt need to be named gateway Signed-off-by: Kevin Fox <[email protected]> * Fix naming issue Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
@@ -311,12 +311,27 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| `global.spire.namespaces.server.labels` | Labels to apply to the Spire server Namespace. | `{}` |
|
||||
| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` |
|
||||
| `global.spire.ingressControllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `global.spire.gatewayAPI.manageListenerSets` | Default policy for whether services render a ListenerSet for their SNI listener. Each service may override via its gatewayAPI.listenerSet.enabled. | `true` |
|
||||
| `global.spire.gatewayAPI.gateway.name` | Name of the shared Gateway object that routes and ListenerSets attach to | `spire` |
|
||||
| `global.spire.gatewayAPI.gateway.namespace` | Namespace of the shared Gateway object. Defaults to the release namespace if blank. | `""` |
|
||||
| `global.spire.gatewayAPI.gateway.port` | Port the shared Gateway listens on. ListenerSet listeners must match this. | `443` |
|
||||
| `global.spire.tools.kubectl.tag` | Set to force the tag to use for all kubectl instances | `""` |
|
||||
| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||
| `global.installAndUpgradeHooks.resources` | Resource requests and limits for installAndUpgradeHooks | `{}` |
|
||||
| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||
| `global.deleteHooks.resources` | Resource requests and limits for deleteHooks | `{}` |
|
||||
|
||||
### Gateway API parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
|
||||
| `gatewayAPI.gateway.enabled` | Render the shared Gateway object | `false` |
|
||||
| `gatewayAPI.gateway.className` | gatewayClassName for the shared Gateway (e.g. "eg"). Required when enabled. | `""` |
|
||||
| `gatewayAPI.gateway.annotations` | Annotations for the Gateway object | `{}` |
|
||||
| `gatewayAPI.gateway.allowedListenersNamespaces` | From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector. | `All` |
|
||||
| `gatewayAPI.gateway.allowedRoutesNamespaces` | From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector. | `All` |
|
||||
| `gatewayAPI.gateway.extraListeners` | Additional listeners to add to the Gateway | `[]` |
|
||||
|
||||
### Spire server parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|
||||
@@ -122,6 +122,14 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `gatewayAPI.enabled` | Flag to expose the OIDC discovery provider via Gateway API | `false` |
|
||||
| `gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `oidc-discovery` |
|
||||
| `gatewayAPI.tlsSecret` | Secret with the TLS cert for edge termination. Blank keeps passthrough when TLS is enabled. | `""` |
|
||||
| `gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` |
|
||||
| `gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` |
|
||||
| `gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` |
|
||||
| `gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` |
|
||||
| `gatewayAPI.backendTLS.caCertificateRefs` | ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap. | `[]` |
|
||||
| `tests.hostAliases` | List of host aliases for testing | `[]` |
|
||||
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
|
||||
| `tests.tls.customCA` | Custom CA value for tests | `""` |
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
{{- if .Values.gatewayAPI.enabled -}}
|
||||
{{- $tlsEnabled := eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "true" -}}
|
||||
{{- $hasSecret := ne (default "" .Values.gatewayAPI.tlsSecret) "" -}}
|
||||
{{- $port := $tlsEnabled | ternary .Values.service.ports.https .Values.service.ports.http -}}
|
||||
{{- $routeKind := (or (not $tlsEnabled) $hasSecret) | ternary "HTTPRoute" "TLSRoute" -}}
|
||||
{{- $backendTLS := and $tlsEnabled $hasSecret -}}
|
||||
{{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . -}}
|
||||
{{- include "spire-lib.gateway-routes" (dict
|
||||
"root" .
|
||||
"gatewayAPI" .Values.gatewayAPI
|
||||
"name" $fullName
|
||||
"namespace" (include "spiffe-oidc-discovery-provider.namespace" .)
|
||||
"svcName" $fullName
|
||||
"port" $port
|
||||
"labels" (include "spiffe-oidc-discovery-provider.labels" .)
|
||||
"routeKind" $routeKind
|
||||
"backendTLS" $backendTLS) }}
|
||||
{{- end }}
|
||||
+4
-1
@@ -9,6 +9,9 @@
|
||||
{{- if gt (len .Values.ingress.hosts) 0 }}
|
||||
{{- $host = (index .Values.ingress.hosts 0).host }}
|
||||
{{- end }}
|
||||
{{- if .Values.gatewayAPI.enabled }}
|
||||
{{- $host = include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" (dict "host" .Values.gatewayAPI.host)) | trim }}
|
||||
{{- end }}
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
@@ -40,7 +43,7 @@ spec:
|
||||
args: ['-s', '-f', '-k', '{{ $protocol }}://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ $port }}/.well-known/openid-configuration']
|
||||
securityContext:
|
||||
{{- include "spire-lib.securitycontext" . | nindent 8 }}
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- if or .Values.ingress.enabled .Values.gatewayAPI.enabled }}
|
||||
- name: curl-ingress
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
|
||||
command: ['curl']
|
||||
|
||||
@@ -345,6 +345,33 @@ ingress:
|
||||
# hosts:
|
||||
# - oidc-discovery.example.org
|
||||
|
||||
## Gateway API exposure for the OIDC discovery provider. Independent of `ingress`.
|
||||
## Route kind follows the provider's TLS setting: TLS disabled => HTTPRoute (edge,
|
||||
## plaintext backend); TLS enabled + tlsSecret => HTTPRoute + BackendTLSPolicy
|
||||
## (reencrypt to the HTTPS backend); TLS enabled + no tlsSecret => TLSRoute
|
||||
## (SNI passthrough).
|
||||
gatewayAPI:
|
||||
## @param gatewayAPI.enabled Flag to expose the OIDC discovery provider via Gateway API
|
||||
enabled: false
|
||||
## @param gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
||||
host: "oidc-discovery"
|
||||
## @param gatewayAPI.tlsSecret Secret with the TLS cert for edge termination. Blank keeps passthrough when TLS is enabled.
|
||||
tlsSecret: ""
|
||||
## @param gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
||||
annotations: {}
|
||||
listenerSet:
|
||||
## @param gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
||||
enabled: null
|
||||
## @param gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
||||
parentRefs: []
|
||||
## @param gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
||||
sectionName: ""
|
||||
# BackendTLSPolicy (reencrypt) is emitted automatically when this service
|
||||
# terminates TLS at the gateway while the backend serves HTTPS.
|
||||
backendTLS:
|
||||
## @param gatewayAPI.backendTLS.caCertificateRefs [array] ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap.
|
||||
caCertificateRefs: []
|
||||
|
||||
tests:
|
||||
## @param tests.hostAliases [array] List of host aliases for testing
|
||||
hostAliases: []
|
||||
|
||||
@@ -72,3 +72,9 @@ A Helm chart to deploy spike keepers
|
||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
||||
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `gatewayAPI.enabled` | Flag to expose spike-keeper via Gateway API (TLS passthrough) | `false` |
|
||||
| `gatewayAPI.host` | Host name for the routes. A `-<index>` suffix is added per replica. If no '.' in host, trustDomain is automatically appended. | `keeper` |
|
||||
| `gatewayAPI.annotations` | Annotations for the routes (and their ListenerSets) | `{}` |
|
||||
| `gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for each replica's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` |
|
||||
| `gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` |
|
||||
| `gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` |
|
||||
|
||||
@@ -0,0 +1,28 @@
|
||||
{{- if .Values.gatewayAPI.enabled -}}
|
||||
{{- $root := . -}}
|
||||
{{- $g := .Values.gatewayAPI -}}
|
||||
{{- $fullName := include "spike-keeper.fullname" . -}}
|
||||
{{- $last := sub (.Values.replicas | int) 1 | int -}}
|
||||
{{- range (seq 0 $last | toString | split " ") }}
|
||||
{{- $i := . }}
|
||||
{{- $host := $g.host }}
|
||||
{{- if contains "." $host }}
|
||||
{{- $hostParts := regexSplit "[.]" $host 2 }}
|
||||
{{- $host = printf "%s-%s.%s" (index $hostParts 0) $i (index $hostParts 1) }}
|
||||
{{- else }}
|
||||
{{- $host = printf "%s-%s" $host $i }}
|
||||
{{- end }}
|
||||
{{- $gi := deepCopy $g }}
|
||||
{{- $_ := set $gi "host" $host }}
|
||||
---
|
||||
{{ include "spire-lib.gateway-routes" (dict
|
||||
"root" $root
|
||||
"gatewayAPI" $gi
|
||||
"name" (printf "%s-%s" $fullName $i)
|
||||
"namespace" (include "spike-keeper.namespace" $root)
|
||||
"svcName" (printf "%s-%s" $fullName $i)
|
||||
"port" $root.Values.service.port
|
||||
"labels" (include "spike-keeper.labels" $root)
|
||||
"routeKind" "TLSRoute") }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -141,3 +141,21 @@ ingress:
|
||||
|
||||
## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
|
||||
## Gateway API exposure for spike-keeper. One route + ListenerSet per replica
|
||||
## (host suffixed with the replica index, like the ingress). Independent of
|
||||
## `ingress`. Empty tlsSecret => TLSRoute (SNI passthrough).
|
||||
gatewayAPI:
|
||||
## @param gatewayAPI.enabled Flag to expose spike-keeper via Gateway API (TLS passthrough)
|
||||
enabled: false
|
||||
## @param gatewayAPI.host Host name for the routes. A `-<index>` suffix is added per replica. If no '.' in host, trustDomain is automatically appended.
|
||||
host: "keeper"
|
||||
## @param gatewayAPI.annotations [object] Annotations for the routes (and their ListenerSets)
|
||||
annotations: {}
|
||||
listenerSet:
|
||||
## @param gatewayAPI.listenerSet.enabled Manage a ListenerSet for each replica's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
||||
enabled: null
|
||||
## @param gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
||||
parentRefs: []
|
||||
## @param gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
||||
sectionName: ""
|
||||
|
||||
@@ -84,6 +84,12 @@ A Helm chart to deploy spike nexus
|
||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
||||
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `gatewayAPI.enabled` | Flag to expose spike-nexus via Gateway API (TLS passthrough) | `false` |
|
||||
| `gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `nexus` |
|
||||
| `gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` |
|
||||
| `gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` |
|
||||
| `gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` |
|
||||
| `gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` |
|
||||
| `persistence.type` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `pvc` |
|
||||
| `persistence.size` | What size volume to use for persistence | `1Gi` |
|
||||
| `persistence.accessMode` | What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) | `ReadWriteOnce` |
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if .Values.gatewayAPI.enabled -}}
|
||||
{{- $fullName := include "spike-nexus.fullname" . -}}
|
||||
{{- include "spire-lib.gateway-routes" (dict
|
||||
"root" .
|
||||
"gatewayAPI" .Values.gatewayAPI
|
||||
"name" $fullName
|
||||
"namespace" (include "spike-nexus.namespace" .)
|
||||
"svcName" $fullName
|
||||
"port" .Values.service.port
|
||||
"labels" (include "spike-nexus.labels" .)
|
||||
"routeKind" "TLSRoute") }}
|
||||
{{- end }}
|
||||
@@ -182,6 +182,23 @@ ingress:
|
||||
# hosts:
|
||||
# - nexus.example.org
|
||||
|
||||
## Gateway API exposure for spike-nexus. Independent of `ingress`. Empty tlsSecret
|
||||
## => TLSRoute (SNI passthrough); set tlsSecret => HTTPRoute (edge terminate).
|
||||
gatewayAPI:
|
||||
## @param gatewayAPI.enabled Flag to expose spike-nexus via Gateway API (TLS passthrough)
|
||||
enabled: false
|
||||
## @param gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
||||
host: "nexus"
|
||||
## @param gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
||||
annotations: {}
|
||||
listenerSet:
|
||||
## @param gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
||||
enabled: null
|
||||
## @param gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
||||
parentRefs: []
|
||||
## @param gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
||||
sectionName: ""
|
||||
|
||||
## @param persistence.type What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only)
|
||||
## @param persistence.size What size volume to use for persistence
|
||||
## @param persistence.accessMode What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended)
|
||||
|
||||
@@ -191,6 +191,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `federation.ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
||||
| `federation.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `federation.gatewayAPI.enabled` | Flag to expose the federation endpoint via Gateway API (TLS passthrough) | `false` |
|
||||
| `federation.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-server-federation` |
|
||||
| `federation.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` |
|
||||
| `federation.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` |
|
||||
| `federation.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` |
|
||||
| `federation.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` |
|
||||
| `caSubject.country` | Country for Spire server CA | `ARPA` |
|
||||
| `caSubject.organization` | Organization for Spire server CA | `Example` |
|
||||
| `caSubject.commonName` | Common Name for Spire server CA | `example.org` |
|
||||
@@ -426,6 +432,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
||||
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `gatewayAPI.enabled` | Flag to expose spire-server via Gateway API (TLS passthrough) | `false` |
|
||||
| `gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-server` |
|
||||
| `gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` |
|
||||
| `gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` |
|
||||
| `gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` |
|
||||
| `gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` |
|
||||
| `extraEnv` | Extra environment variables to add to the spire server | `[]` |
|
||||
| `extraVolumes` | Extra volumes to be mounted | `[]` |
|
||||
| `extraVolumeMounts` | Extra volume mounts | `[]` |
|
||||
@@ -548,6 +560,13 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `tornjak.ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
||||
| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `tornjak.gatewayAPI.enabled` | Flag to expose the Tornjak backend via Gateway API | `false` |
|
||||
| `tornjak.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `tornjak-backend` |
|
||||
| `tornjak.gatewayAPI.tlsSecret` | Secret with the TLS cert for edge termination (used when connectionType is http). Blank keeps passthrough. | `""` |
|
||||
| `tornjak.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` |
|
||||
| `tornjak.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` |
|
||||
| `tornjak.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` |
|
||||
| `tornjak.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` |
|
||||
| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` |
|
||||
| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` |
|
||||
| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` |
|
||||
|
||||
@@ -364,9 +364,14 @@ The code below determines what connection type should be used.
|
||||
|
||||
{{- define "spire-server.test.federation-ingress-args" }}
|
||||
{{- $args := list }}
|
||||
{{- $host := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.federation.ingress) }}
|
||||
{{- if gt (len .Values.federation.ingress.tls) 0 }}
|
||||
{{- $host = index (index (index .Values.federation.ingress.tls 0) "hosts") 0 }}
|
||||
{{- $host := "" }}
|
||||
{{- if .host }}
|
||||
{{- $host = .host }}
|
||||
{{- else }}
|
||||
{{- $host = include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.federation.ingress) }}
|
||||
{{- if gt (len .Values.federation.ingress.tls) 0 }}
|
||||
{{- $host = index (index (index .Values.federation.ingress.tls 0) "hosts") 0 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if dig "tests" "tls" "enabled" false .Values }}
|
||||
{{- if ne (len (dig "tests" "tls" "customCA" "" .Values)) 0 }}
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
{{- if .Values.federation.enabled -}}
|
||||
{{- if .Values.federation.gatewayAPI.enabled -}}
|
||||
{{- $fullName := include "spire-server.fullname" . -}}
|
||||
{{- include "spire-lib.gateway-routes" (dict
|
||||
"root" .
|
||||
"gatewayAPI" .Values.federation.gatewayAPI
|
||||
"name" (printf "%s-federation" $fullName)
|
||||
"namespace" (include "spire-server.namespace" .)
|
||||
"svcName" $fullName
|
||||
"port" .Values.federation.bundleEndpoint.port
|
||||
"labels" (include "spire-server.labels" .)
|
||||
"routeKind" "TLSRoute") }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if .Values.gatewayAPI.enabled -}}
|
||||
{{- $fullName := include "spire-server.fullname" . -}}
|
||||
{{- include "spire-lib.gateway-routes" (dict
|
||||
"root" .
|
||||
"gatewayAPI" .Values.gatewayAPI
|
||||
"name" $fullName
|
||||
"namespace" (include "spire-server.namespace" .)
|
||||
"svcName" $fullName
|
||||
"port" .Values.service.port
|
||||
"labels" (include "spire-server.labels" .)
|
||||
"routeKind" "TLSRoute") }}
|
||||
{{- end }}
|
||||
@@ -56,6 +56,21 @@ spec:
|
||||
securityContext:
|
||||
{{- include "spire-lib.securitycontext" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.federation.gatewayAPI.enabled }}
|
||||
{{- $gwHost := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" (dict "host" .Values.federation.gatewayAPI.host)) | trim }}
|
||||
- name: federation-gateway
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
|
||||
command: ['curl']
|
||||
args:
|
||||
{{ include "spire-server.test.federation-ingress-args" (dict "Values" $values "host" $gwHost) | nindent 8 }}
|
||||
{{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
|
||||
volumeMounts:
|
||||
- name: custom-ca
|
||||
mountPath: /ca
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- include "spire-lib.securitycontext" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if ne (len (dig "tests" "hostAliases" "" $values)) 0 }}
|
||||
hostAliases:
|
||||
{{- toYaml .Values.tests.hostAliases | nindent 4 }}
|
||||
|
||||
@@ -0,0 +1,15 @@
|
||||
{{- if .Values.tornjak.gatewayAPI.enabled -}}
|
||||
{{- $isHttp := eq (include "spire-tornjak.connectionType" .) "http" -}}
|
||||
{{- $routeKind := $isHttp | ternary "HTTPRoute" "TLSRoute" -}}
|
||||
{{- $port := $isHttp | ternary .Values.tornjak.service.ports.http .Values.tornjak.service.ports.https -}}
|
||||
{{- include "spire-lib.gateway-routes" (dict
|
||||
"root" .
|
||||
"gatewayAPI" .Values.tornjak.gatewayAPI
|
||||
"name" (include "spire-tornjak.fullname" .)
|
||||
"namespace" (include "spire-server.namespace" .)
|
||||
"svcName" (include "spire-tornjak.servicename" .)
|
||||
"port" $port
|
||||
"labels" (include "spire-server.labels" .)
|
||||
"routeKind" $routeKind
|
||||
"backendTLS" false) }}
|
||||
{{- end }}
|
||||
@@ -343,6 +343,21 @@ federation:
|
||||
# If Profile Type == https_web:
|
||||
# secretName: spire-server-federation-tls
|
||||
|
||||
gatewayAPI:
|
||||
## @param federation.gatewayAPI.enabled Flag to expose the federation endpoint via Gateway API (TLS passthrough)
|
||||
enabled: false
|
||||
## @param federation.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
||||
host: "spire-server-federation"
|
||||
## @param federation.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
||||
annotations: {}
|
||||
listenerSet:
|
||||
## @param federation.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
||||
enabled: null
|
||||
## @param federation.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
||||
parentRefs: []
|
||||
## @param federation.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
||||
sectionName: ""
|
||||
|
||||
caSubject:
|
||||
## @param caSubject.country Country for Spire server CA
|
||||
country: ARPA
|
||||
@@ -1056,6 +1071,21 @@ ingress:
|
||||
# hosts:
|
||||
# - spire-server.example.org
|
||||
|
||||
gatewayAPI:
|
||||
## @param gatewayAPI.enabled Flag to expose spire-server via Gateway API (TLS passthrough)
|
||||
enabled: false
|
||||
## @param gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
||||
host: "spire-server"
|
||||
## @param gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
||||
annotations: {}
|
||||
listenerSet:
|
||||
## @param gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
||||
enabled: null
|
||||
## @param gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
||||
parentRefs: []
|
||||
## @param gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
||||
sectionName: ""
|
||||
|
||||
## @param extraEnv [array] Extra environment variables to add to the spire server
|
||||
extraEnv: []
|
||||
|
||||
@@ -1358,6 +1388,25 @@ tornjak:
|
||||
# hosts:
|
||||
# - tornjak-backend.example.org
|
||||
|
||||
## Gateway API exposure for the Tornjak backend. Route kind follows the tornjak
|
||||
## connectionType: non-http => TLSRoute (passthrough), http => HTTPRoute (edge).
|
||||
gatewayAPI:
|
||||
## @param tornjak.gatewayAPI.enabled Flag to expose the Tornjak backend via Gateway API
|
||||
enabled: false
|
||||
## @param tornjak.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
||||
host: "tornjak-backend"
|
||||
## @param tornjak.gatewayAPI.tlsSecret Secret with the TLS cert for edge termination (used when connectionType is http). Blank keeps passthrough.
|
||||
tlsSecret: ""
|
||||
## @param tornjak.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
||||
annotations: {}
|
||||
listenerSet:
|
||||
## @param tornjak.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
||||
enabled: null
|
||||
## @param tornjak.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
||||
parentRefs: []
|
||||
## @param tornjak.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
||||
sectionName: ""
|
||||
|
||||
## @param tornjak.startupProbe.failureThreshold Failure threshold count
|
||||
## @param tornjak.startupProbe.initialDelaySeconds Initial delay seconds
|
||||
## @param tornjak.startupProbe.periodSeconds Period seconds
|
||||
|
||||
@@ -98,6 +98,13 @@ port forwarding. See the chart NOTES output for more details.
|
||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
||||
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `gatewayAPI.enabled` | Flag to expose the Tornjak frontend via Gateway API | `false` |
|
||||
| `gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `tornjak-frontend` |
|
||||
| `gatewayAPI.tlsSecret` | Secret with the TLS cert for edge termination | `""` |
|
||||
| `gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` |
|
||||
| `gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` |
|
||||
| `gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` |
|
||||
| `gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` |
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.gatewayAPI.enabled -}}
|
||||
{{- $fullName := include "tornjak-frontend.fullname" . -}}
|
||||
{{- include "spire-lib.gateway-routes" (dict
|
||||
"root" .
|
||||
"gatewayAPI" .Values.gatewayAPI
|
||||
"name" $fullName
|
||||
"namespace" (include "tornjak-frontend.namespace" .)
|
||||
"svcName" $fullName
|
||||
"port" .Values.service.port
|
||||
"labels" (include "tornjak-frontend.labels" .)
|
||||
"routeKind" "HTTPRoute"
|
||||
"backendTLS" false) }}
|
||||
{{- end }}
|
||||
@@ -151,6 +151,26 @@ ingress:
|
||||
# hosts:
|
||||
# - tornjak-frontend.example.org
|
||||
|
||||
## Gateway API exposure for the Tornjak frontend UI. Independent of `ingress`.
|
||||
## The frontend serves plaintext HTTP, so this is always an HTTPRoute with edge
|
||||
## TLS termination at the Gateway; set tlsSecret to supply the listener cert.
|
||||
gatewayAPI:
|
||||
## @param gatewayAPI.enabled Flag to expose the Tornjak frontend via Gateway API
|
||||
enabled: false
|
||||
## @param gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
||||
host: "tornjak-frontend"
|
||||
## @param gatewayAPI.tlsSecret Secret with the TLS cert for edge termination
|
||||
tlsSecret: ""
|
||||
## @param gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
||||
annotations: {}
|
||||
listenerSet:
|
||||
## @param gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
||||
enabled: null
|
||||
## @param gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
||||
parentRefs: []
|
||||
## @param gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
||||
sectionName: ""
|
||||
|
||||
tests:
|
||||
bash:
|
||||
## @param tests.bash.image.registry The OCI registry to pull the image from
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
{{- if .Values.gatewayAPI.gateway.enabled }}
|
||||
{{- include "spire-lib.gateway-resource" (dict "root" . "gatewayObject" .Values.gatewayAPI.gateway) }}
|
||||
{{- end }}
|
||||
@@ -84,6 +84,22 @@ global:
|
||||
## @param global.spire.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
ingressControllerType: ""
|
||||
|
||||
## Gateway API reference settings shared across charts. Only the values needed
|
||||
## by other charts to attach their routes/ListenerSets to the shared Gateway
|
||||
## live here; the Gateway object itself is configured under the top-level
|
||||
## `gatewayAPI.gateway` block of this (umbrella) chart. Gateway API support is
|
||||
## independent of ingress and can be enabled alongside it.
|
||||
gatewayAPI:
|
||||
## @param global.spire.gatewayAPI.manageListenerSets Default policy for whether services render a ListenerSet for their SNI listener. Each service may override via its gatewayAPI.listenerSet.enabled.
|
||||
manageListenerSets: true
|
||||
gateway:
|
||||
## @param global.spire.gatewayAPI.gateway.name Name of the shared Gateway object that routes and ListenerSets attach to
|
||||
name: spire
|
||||
## @param global.spire.gatewayAPI.gateway.namespace Namespace of the shared Gateway object. Defaults to the release namespace if blank.
|
||||
namespace: ""
|
||||
## @param global.spire.gatewayAPI.gateway.port Port the shared Gateway listens on. ListenerSet listeners must match this.
|
||||
port: 443
|
||||
|
||||
tools:
|
||||
kubectl:
|
||||
## @param global.spire.tools.kubectl.tag Set to force the tag to use for all kubectl instances
|
||||
@@ -129,6 +145,27 @@ global:
|
||||
# namespace: "kube-prometheus-system"
|
||||
# labels: {}
|
||||
|
||||
## @section Gateway API parameters
|
||||
## Configuration for the optional shared Gateway object managed by this umbrella
|
||||
## chart. The Gateway is rendered here (rather than in a subchart) so it exists
|
||||
## even when spire-server is disabled. name/namespace/port come from
|
||||
## global.spire.gatewayAPI.gateway; className and listener policy are local.
|
||||
##
|
||||
gatewayAPI:
|
||||
gateway:
|
||||
## @param gatewayAPI.gateway.enabled Render the shared Gateway object
|
||||
enabled: false
|
||||
## @param gatewayAPI.gateway.className gatewayClassName for the shared Gateway (e.g. "eg"). Required when enabled.
|
||||
className: ""
|
||||
## @param gatewayAPI.gateway.annotations [object] Annotations for the Gateway object
|
||||
annotations: {}
|
||||
## @param gatewayAPI.gateway.allowedListenersNamespaces From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector.
|
||||
allowedListenersNamespaces: All
|
||||
## @param gatewayAPI.gateway.allowedRoutesNamespaces From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector.
|
||||
allowedRoutesNamespaces: All
|
||||
## @param gatewayAPI.gateway.extraListeners [array] Additional listeners to add to the Gateway
|
||||
extraListeners: []
|
||||
|
||||
## subcharts
|
||||
|
||||
## @section Spire server parameters
|
||||
|
||||
Reference in New Issue
Block a user