From 459cf8ff5b41f3676981acbedb7429f6cac0f607 Mon Sep 17 00:00:00 2001 From: JoelGoh92 <30492251+JoelGoh92@users.noreply.github.com> Date: Fri, 3 Jul 2026 00:41:01 +0800 Subject: [PATCH] Add default labels to child-servers clusterSPIFFEIDs for external-root-spire-server-full (#866) Signed-off-by: Joel Goh Co-authored-by: Joel Goh --- charts/spire-nested/README.md | 1 + charts/spire-nested/values.yaml | 3 +++ 2 files changed, 4 insertions(+) diff --git a/charts/spire-nested/README.md b/charts/spire-nested/README.md index 2405d23..7feae99 100644 --- a/charts/spire-nested/README.md +++ b/charts/spire-nested/README.md @@ -315,6 +315,7 @@ Now you can interact with the Spire agent socket from your own application. The | `external-root-spire-server-full.controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another instance on the k8s cluster with webhooks enabled. | `false` | | `external-root-spire-server-full.controllerManager.className` | specify to use an explicit class name. | `spire-mgmt-external-server` | | `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled` | Enable child servers | `true` | +| `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.child-servers.labels` | Default label spire.spiffe.io/child-server is set to enable label-based informer filtering on the root cluster's external controller manager. | `{}` | | `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable the default cluster spiffe id | `false` | | `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the test-keys identity | `false` | | `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` | diff --git a/charts/spire-nested/values.yaml b/charts/spire-nested/values.yaml index f380094..7785981 100644 --- a/charts/spire-nested/values.yaml +++ b/charts/spire-nested/values.yaml @@ -280,6 +280,9 @@ external-root-spire-server-full: child-servers: ## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable child servers enabled: true + ## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.child-servers.labels [object] Default label spire.spiffe.io/child-server is set to enable label-based informer filtering on the root cluster's external controller manager. + labels: + spire.spiffe.io/child-server: "true" default: ## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable the default cluster spiffe id enabled: false