Add by default k8s workload registrar compatible SPIFFEIDs to controller-manager setup

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml

@@ -0,0 +1,19 @@
+{{- $root := . }}
+{{- with .Values.controllerManager }}
+{{- if and (eq (.enabled | toString) "true") (eq (.identities.enabled | toString) "true") }}
+apiVersion: spire.spiffe.io/v1alpha1
+kind: ClusterSPIFFEID
+metadata:
+  name: {{ include "spire-controller-manager.fullname" $root }}-service-account-based
+spec:
+  spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }}
+  {{- with .identities.podSelector }}
+  podSelector:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .identities.dnsNameTemplates }}
+  dnsNameTemplates:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
+{{- end }}

charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml

@@ -28,5 +28,8 @@ data:
       - kube-public
       - {{ .Release.Namespace }}
       - local-path-storage
+      {{- with .Values.controllerManager.ignoreNamespaces }}
+      {{- toYaml . | nindent 6 }}
+      {{- end }}
     spireServerSocketPath: {{ .Values.socketPath | quote }}
 {{- end }}