panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add recommendation for strictMode (#143)

Browse Source
This commit is contained in:
kfox1111
2023-12-19 12:12:53 +01:00
committed by GitHub
parent 4fb9d18f50
commit 50c4ac35b0
4 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+1
View File
@@ -160,6 +160,7 @@ Now you can interact with the Spire agent socket from your own application. The
| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` | | `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` |
| `global.spire.recommendations.enabled` | Use recommended settings for production deployments. Default is off. | `false` | | `global.spire.recommendations.enabled` | Use recommended settings for production deployments. Default is off. | `false` |
| `global.spire.recommendations.priorityClassName` | Set to true to use recommended values for Pod Priority Class Names | `true` | | `global.spire.recommendations.priorityClassName` | Set to true to use recommended values for Pod Priority Class Names | `true` |
| `global.spire.recommendations.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `true` |
| `global.spire.image.registry` | Override all Spire image registries at once | `""` | | `global.spire.image.registry` | Override all Spire image registries at once | `""` |
| `global.spire.namespaces.system.name` | Name of the Spire system Namespace. | `spire-system` | | `global.spire.namespaces.system.name` | Name of the Spire system Namespace. | `spire-system` |
| `global.spire.namespaces.system.create` | Create a Namespace for Spire system resources. | `false` | | `global.spire.namespaces.system.create` | Create a Namespace for Spire system resources. | `false` |
charts/spire/templates/_spire-lib.tpl
+1 -1
View File
@@ -184,7 +184,7 @@ if strictMode is enabled and the boolean is true
{{ $root := index . 0 }} {{ $root := index . 0 }}
{{ $message := index . 1 }} {{ $message := index . 1 }}
{{ $condition := index . 2 }} {{ $condition := index . 2 }}
{{- if (dig "spire" "strictMode" false $root.Values.global) }} {{- if or (dig "spire" "strictMode" false $root.Values.global) (and (dig "spire" "recommendations" "enabled" false $root.Values.global) (dig "spire" "recommendations" "strictMode" true $root.Values.global)) }}
{{- if $condition }} {{- if $condition }}
{{- fail $message }} {{- fail $message }}
{{- end }} {{- end }}
charts/spire/values.yaml
+2
View File
@@ -23,9 +23,11 @@ global:
## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off. ## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off.
## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names ## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names
## @param global.spire.recommendations.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
recommendations: recommendations:
enabled: false enabled: false
priorityClassName: true priorityClassName: true
strictMode: true
image: image:
## @param global.spire.image.registry Override all Spire image registries at once ## @param global.spire.image.registry Override all Spire image registries at once
examples/production/values.yaml
-1
View File
@@ -3,7 +3,6 @@ global:
prometheus: prometheus:
enabled: true enabled: true
spire: spire:
strictMode: true
recommendations: recommendations:
enabled: true enabled: true