diff --git a/charts/spire/README.md b/charts/spire/README.md index a1be77d..ae6d2fb 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -160,6 +160,7 @@ Now you can interact with the Spire agent socket from your own application. The | `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` | | `global.spire.recommendations.enabled` | Use recommended settings for production deployments. Default is off. | `false` | | `global.spire.recommendations.priorityClassName` | Set to true to use recommended values for Pod Priority Class Names | `true` | +| `global.spire.recommendations.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `true` | | `global.spire.image.registry` | Override all Spire image registries at once | `""` | | `global.spire.namespaces.system.name` | Name of the Spire system Namespace. | `spire-system` | | `global.spire.namespaces.system.create` | Create a Namespace for Spire system resources. | `false` | diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/templates/_spire-lib.tpl index 735e7ac..1641c72 100644 --- a/charts/spire/templates/_spire-lib.tpl +++ b/charts/spire/templates/_spire-lib.tpl @@ -184,7 +184,7 @@ if strictMode is enabled and the boolean is true {{ $root := index . 0 }} {{ $message := index . 1 }} {{ $condition := index . 2 }} -{{- if (dig "spire" "strictMode" false $root.Values.global) }} +{{- if or (dig "spire" "strictMode" false $root.Values.global) (and (dig "spire" "recommendations" "enabled" false $root.Values.global) (dig "spire" "recommendations" "strictMode" true $root.Values.global)) }} {{- if $condition }} {{- fail $message }} {{- end }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 0e45703..59c461e 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -23,9 +23,11 @@ global: ## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off. ## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names + ## @param global.spire.recommendations.strictMode Check values, such as trustDomain, are overridden with a suitable value for production. recommendations: enabled: false priorityClassName: true + strictMode: true image: ## @param global.spire.image.registry Override all Spire image registries at once diff --git a/examples/production/values.yaml b/examples/production/values.yaml index fb5c4cc..ca6b116 100644 --- a/examples/production/values.yaml +++ b/examples/production/values.yaml @@ -3,7 +3,6 @@ global: prometheus: enabled: true spire: - strictMode: true recommendations: enabled: true