Gateway api support (#890)
* Gateway api support Signed-off-by: Kevin Fox <[email protected]> * Update readme Signed-off-by: Kevin Fox <[email protected]> * Fix gateway name. a gateway doesnt need to be named gateway Signed-off-by: Kevin Fox <[email protected]> * Fix naming issue Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
@@ -102,6 +102,14 @@ A Helm chart to install the SPIRE Identity Exchange.
|
||||
| `rest.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `rest.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `rest.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `rest.gatewayAPI.enabled` | Flag to expose the REST endpoint via Gateway API | `false` |
|
||||
| `rest.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-identity-exchange-rest` |
|
||||
| `rest.gatewayAPI.tlsSecret` | Secret with the TLS cert for edge termination. Blank keeps passthrough. | `""` |
|
||||
| `rest.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` |
|
||||
| `rest.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` |
|
||||
| `rest.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` |
|
||||
| `rest.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` |
|
||||
| `rest.gatewayAPI.backendTLS.caCertificateRefs` | ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap. | `[]` |
|
||||
| `grpc.enabled` | Enable the grpc service | `false` |
|
||||
| `grpc.service.type` | Service type | `ClusterIP` |
|
||||
| `grpc.service.port` | port for the service | `443` |
|
||||
@@ -115,6 +123,14 @@ A Helm chart to install the SPIRE Identity Exchange.
|
||||
| `grpc.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `grpc.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `grpc.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `grpc.gatewayAPI.enabled` | Flag to expose the gRPC endpoint via Gateway API | `false` |
|
||||
| `grpc.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-identity-exchange-grpc` |
|
||||
| `grpc.gatewayAPI.tlsSecret` | Secret with the TLS cert for edge termination. Blank keeps passthrough. | `""` |
|
||||
| `grpc.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` |
|
||||
| `grpc.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` |
|
||||
| `grpc.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` |
|
||||
| `grpc.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` |
|
||||
| `grpc.gatewayAPI.backendTLS.caCertificateRefs` | ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap. | `[]` |
|
||||
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
|
||||
| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` |
|
||||
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.grpc.gatewayAPI.enabled -}}
|
||||
{{- $routeKind := include "spire-lib.gateway-route-kind" (dict "gatewayAPI" .Values.grpc.gatewayAPI) -}}
|
||||
{{- include "spire-lib.gateway-routes" (dict
|
||||
"root" .
|
||||
"gatewayAPI" .Values.grpc.gatewayAPI
|
||||
"name" (printf "%s-grpc" (include "spire-identity-exchange.fullname" .))
|
||||
"namespace" (include "spire-identity-exchange.namespace" .)
|
||||
"svcName" (printf "%s-grpc" (include "spire-identity-exchange.fullname" .))
|
||||
"port" .Values.grpc.service.port
|
||||
"labels" (include "spire-identity-exchange.labels" .)
|
||||
"routeKind" $routeKind
|
||||
"backendTLS" (eq $routeKind "HTTPRoute")) }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.rest.gatewayAPI.enabled -}}
|
||||
{{- $routeKind := include "spire-lib.gateway-route-kind" (dict "gatewayAPI" .Values.rest.gatewayAPI) -}}
|
||||
{{- include "spire-lib.gateway-routes" (dict
|
||||
"root" .
|
||||
"gatewayAPI" .Values.rest.gatewayAPI
|
||||
"name" (printf "%s-rest" (include "spire-identity-exchange.fullname" .))
|
||||
"namespace" (include "spire-identity-exchange.namespace" .)
|
||||
"svcName" (printf "%s-rest" (include "spire-identity-exchange.fullname" .))
|
||||
"port" .Values.rest.service.port
|
||||
"labels" (include "spire-identity-exchange.labels" .)
|
||||
"routeKind" $routeKind
|
||||
"backendTLS" (eq $routeKind "HTTPRoute")) }}
|
||||
{{- end }}
|
||||
@@ -284,6 +284,31 @@ rest:
|
||||
# hosts:
|
||||
# - spire-identity-exchange-rest.example.org
|
||||
|
||||
## Gateway API exposure for the REST endpoint. Independent of rest.ingress. The
|
||||
## backend serves HTTPS, so a set tlsSecret => HTTPRoute + BackendTLSPolicy
|
||||
## (reencrypt); blank tlsSecret => TLSRoute (SNI passthrough).
|
||||
gatewayAPI:
|
||||
## @param rest.gatewayAPI.enabled Flag to expose the REST endpoint via Gateway API
|
||||
enabled: false
|
||||
## @param rest.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
||||
host: "spire-identity-exchange-rest"
|
||||
## @param rest.gatewayAPI.tlsSecret Secret with the TLS cert for edge termination. Blank keeps passthrough.
|
||||
tlsSecret: ""
|
||||
## @param rest.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
||||
annotations: {}
|
||||
listenerSet:
|
||||
## @param rest.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
||||
enabled: null
|
||||
## @param rest.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
||||
parentRefs: []
|
||||
## @param rest.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
||||
sectionName: ""
|
||||
# BackendTLSPolicy (reencrypt) is emitted automatically for the terminated
|
||||
# HTTPS backend when gatewayAPI.tlsSecret is set.
|
||||
backendTLS:
|
||||
## @param rest.gatewayAPI.backendTLS.caCertificateRefs [array] ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap.
|
||||
caCertificateRefs: []
|
||||
|
||||
grpc:
|
||||
## @param grpc.enabled Enable the grpc service
|
||||
enabled: false
|
||||
@@ -331,6 +356,31 @@ grpc:
|
||||
# hosts:
|
||||
# - spire-identiy-exchange-grpc.example.org
|
||||
|
||||
## Gateway API exposure for the gRPC endpoint. Independent of grpc.ingress. The
|
||||
## backend serves HTTPS, so a set tlsSecret => HTTPRoute + BackendTLSPolicy
|
||||
## (reencrypt); blank tlsSecret => TLSRoute (SNI passthrough).
|
||||
gatewayAPI:
|
||||
## @param grpc.gatewayAPI.enabled Flag to expose the gRPC endpoint via Gateway API
|
||||
enabled: false
|
||||
## @param grpc.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
||||
host: "spire-identity-exchange-grpc"
|
||||
## @param grpc.gatewayAPI.tlsSecret Secret with the TLS cert for edge termination. Blank keeps passthrough.
|
||||
tlsSecret: ""
|
||||
## @param grpc.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
||||
annotations: {}
|
||||
listenerSet:
|
||||
## @param grpc.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
||||
enabled: null
|
||||
## @param grpc.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
||||
parentRefs: []
|
||||
## @param grpc.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
||||
sectionName: ""
|
||||
# BackendTLSPolicy (reencrypt) is emitted automatically for the terminated
|
||||
# HTTPS backend when gatewayAPI.tlsSecret is set.
|
||||
backendTLS:
|
||||
## @param grpc.gatewayAPI.backendTLS.caCertificateRefs [array] ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap.
|
||||
caCertificateRefs: []
|
||||
|
||||
tools:
|
||||
kubectl:
|
||||
## @param tools.kubectl.image.registry The OCI registry to pull the image from
|
||||
|
||||
Reference in New Issue
Block a user