panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add missing bundlePublisher section and extraEnv so settings can be set (#201)

Browse Source 
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
2024-01-23 13:18:49 -08:00
committed by GitHub
co-authored by Faisal Memon
parent d724d1e690
commit 4c307c1be1
4 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+3
View File
@@ -223,6 +223,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` | | `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` | | `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
| `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` | | `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` |
| `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` |
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | | `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
| `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` | | `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` |
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
@@ -274,6 +275,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | | `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | | `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
| `extraEnv` | Extra environment variables to add to the spire server | `[]` |
| `extraVolumes` | Extra volumes to be mounted | `[]` | | `extraVolumes` | Extra volumes to be mounted | `[]` |
| `extraVolumeMounts` | Extra volume mounts | `[]` | | `extraVolumeMounts` | Extra volume mounts | `[]` |
| `extraContainers` | Additional containers to create | `[]` | | `extraContainers` | Additional containers to create | `[]` |
@@ -321,6 +323,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` | | `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
| `tornjak.resources` | Resource requests and limits | `{}` | | `tornjak.resources` | Resource requests and limits | `{}` |
| `tornjak.securityContext` | Security Context to use | `{}` | | `tornjak.securityContext` | Security Context to use | `{}` |
| `customPlugins.bundlePublisher` | Custom plugins of type BundlePublisher are configured here | `{}` |
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` | | `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` | | `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
| `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` | | `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` |
charts/spire/charts/spire-server/templates/configmap.yaml
+1 -1
View File
@@ -5,7 +5,7 @@
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.organization must be set" (eq .Values.ca_subject.organization "Example"))}} {{- include "spire-lib.check-strict-mode" (list . "ca_subject.organization must be set" (eq .Values.ca_subject.organization "Example"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.common_name must be set" (eq .Values.ca_subject.common_name "example.org"))}} {{- include "spire-lib.check-strict-mode" (list . "ca_subject.common_name must be set" (eq .Values.ca_subject.common_name "example.org"))}}
{{- range $type, $tvals := .Values.customPlugins }} {{- range $type, $tvals := .Values.customPlugins }}
{{- if not (has $type (list "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }} {{- if not (has $type (list "bundlePublisher" "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }}
{{- fail (printf "Unknown plugin type specified: %s" $type) }} {{- fail (printf "Unknown plugin type specified: %s" $type) }}
{{- end }} {{- end }}
{{- range $name, $nval := $tvals }} {{- range $name, $nval := $tvals }}
charts/spire/charts/spire-server/templates/statefulset.yaml
+7
View File
@@ -86,6 +86,9 @@ spec:
env: env:
- name: PATH - name: PATH
value: "/opt/spire/bin:/bin" value: "/opt/spire/bin:/bin"
{{- with .Values.extraEnv }}
{{- . | toYaml | nindent 10 }}
{{- end }}
{{- if ne .Values.dataStore.sql.databaseType "sqlite3" }} {{- if ne .Values.dataStore.sql.databaseType "sqlite3" }}
{{- if .Values.dataStore.sql.externalSecret.enabled }} {{- if .Values.dataStore.sql.externalSecret.enabled }}
- name: DBPW - name: DBPW
@@ -198,6 +201,10 @@ spec:
{{- if .Values.controllerManager.expandEnv }} {{- if .Values.controllerManager.expandEnv }}
- --expand-env - --expand-env
{{- end }} {{- end }}
{{- if gt (len .Values.controllerManager.extraEnv) 0 }}
env:
{{- .Values.controllerManager.extraEnv | toYaml | nindent 12 }}
{{- end }}
ports: ports:
- name: https - name: https
containerPort: 9443 containerPort: 9443
charts/spire/charts/spire-server/values.yaml
+9
View File
@@ -423,6 +423,9 @@ controllerManager:
## @param controllerManager.expandEnv Set to true to enable environment variable substitution of config file options ## @param controllerManager.expandEnv Set to true to enable environment variable substitution of config file options
expandEnv: false expandEnv: false
## @param controllerManager.extraEnv [array] Extra environment variables to add to the controller manager
extraEnv: []
installAndUpgradeHook: installAndUpgradeHook:
## @param controllerManager.installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) ## @param controllerManager.installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`)
enabled: true enabled: true
@@ -640,6 +643,9 @@ ingress:
# hosts: # hosts:
# - spire-server.example.org # - spire-server.example.org
## @param extraEnv [array] Extra environment variables to add to the spire server
extraEnv: []
## @param extraVolumes [array] Extra volumes to be mounted ## @param extraVolumes [array] Extra volumes to be mounted
extraVolumes: [] extraVolumes: []
@@ -785,16 +791,19 @@ tornjak:
# can prioritize proper support. # can prioritize proper support.
## @skip unsupportedBuiltInPlugins ## @skip unsupportedBuiltInPlugins
unsupportedBuiltInPlugins: unsupportedBuiltInPlugins:
bundlePublisher: {}
keyManager: {} keyManager: {}
nodeAttestor: {} nodeAttestor: {}
upstreamAuthority: {} upstreamAuthority: {}
notifier: {} notifier: {}
## @param customPlugins.bundlePublisher Custom plugins of type BundlePublisher are configured here
## @param customPlugins.keyManager Custom plugins of type KeyManager are configured here ## @param customPlugins.keyManager Custom plugins of type KeyManager are configured here
## @param customPlugins.nodeAttestor Custom plugins of type NodeAttestor are configured here ## @param customPlugins.nodeAttestor Custom plugins of type NodeAttestor are configured here
## @param customPlugins.upstreamAuthority Custom plugins of type upstreamAuthority are configured here ## @param customPlugins.upstreamAuthority Custom plugins of type upstreamAuthority are configured here
## @param customPlugins.notifier Custom plugins of type notifier are configured here ## @param customPlugins.notifier Custom plugins of type notifier are configured here
customPlugins: customPlugins:
bundlePublisher: {}
keyManager: {} keyManager: {}
nodeAttestor: {} nodeAttestor: {}
upstreamAuthority: {} upstreamAuthority: {}