From 3d81928ff8e04be29a07454c05852c159be4be25 Mon Sep 17 00:00:00 2001
From: Faisal Memon <fymemon@yahoo.com>
Date: Wed, 26 Apr 2023 12:38:14 -0700
Subject: [PATCH] Add skipKubeletVerification configurable (#243)

---
 charts/spire/charts/spire-agent/README.md                | 1 +
 charts/spire/charts/spire-agent/templates/configmap.yaml | 2 +-
 charts/spire/charts/spire-agent/values.yaml              | 3 +++
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md
index 744e311..66b052e 100644
--- a/charts/spire/charts/spire-agent/README.md
+++ b/charts/spire/charts/spire-agent/README.md
@@ -54,6 +54,7 @@ A Helm chart to install the SPIRE agent.
 | waitForIt.image.repository | string | `"chainguard/wait-for-it"` |  |
 | waitForIt.image.version | string | `"latest-20230113"` |  |
 | waitForIt.resources | object | `{}` |  |
+| workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped |
 | workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor |
 
 ----------------------------------------------
diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml
index 9f8d70d..b04cb88 100644
--- a/charts/spire/charts/spire-agent/templates/configmap.yaml
+++ b/charts/spire/charts/spire-agent/templates/configmap.yaml
@@ -24,7 +24,7 @@ plugins:
           # Defaults to the secure kubelet port by default.
           # Minikube does not have a cert in the cluster CA bundle that
           # can authenticate the kubelet cert, so skip validation.
-          skip_kubelet_verification: true
+          skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }}
 
   {{- if .Values.workloadAttestors.unix.enabled }}
     - unix:
diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml
index e5bca41..68e6b8a 100644
--- a/charts/spire/charts/spire-agent/values.yaml
+++ b/charts/spire/charts/spire-agent/values.yaml
@@ -81,6 +81,9 @@ workloadAttestors:
   unix:
     # -- enables the Unix workload attestor
     enabled: false
+  k8s:
+    # -- If true, kubelet certificate verification is skipped
+    skipKubeletVerification: true
 
 telemetry:
   prometheus: