Include filterByClassName setting for controller manager (#905)
* Expose filterByClassName setting to restrict the controller manager's ClusterSPIFFEID cache by class name, defaulting to false for backward compatibility. Signed-off-by: Joel Goh <[email protected]> * Shorten filterByClassName param descriptions and regenerate README. Signed-off-by: Joel Goh <[email protected]> --------- Signed-off-by: Joel Goh <[email protected]> Co-authored-by: Joel Goh <[email protected]>
This commit is contained in:
JoelGoh92
@@ -310,6 +310,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.staticManifestMode` | Flag to configure static mode. Valid options off, internal, and external. If internal, the identities config options will be rendered to an included configmap | `off` |
|
||||
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
||||
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
||||
| `controllerManager.filterByClassName` | Restrict the ClusterSPIFFEID cache to this controller's className. Only enable after confirming target ClusterSPIFFEIDs already carry the className label, or existing registrations will be deleted. | `false` |
|
||||
| `controllerManager.entryIDPrefixCleanup` | Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` |
|
||||
| `controllerManager.addEntryIDPrefix` | If true, prepends the clusterName to the entryID of each entry the controller manager registers. | `true` |
|
||||
| `controllerManager.gcInterval` | How often the SPIRE state is reconciled when the controller is otherwise idle. This impacts how quickly SPIRE state will converge after CRDs are removed or SPIRE state is mutated underneath the controller. Values are in nanoseconds. | `10000000000` |
|
||||
@@ -399,6 +400,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `externalControllerManagers.defaults.reconcile.clusterFederatedTrustDomains` | Enable reconciliation of clusterFederatedTrustDomains from K8s to the SPIRE server | `false` |
|
||||
| `externalControllerManagers.defaults.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
||||
| `externalControllerManagers.defaults.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
||||
| `externalControllerManagers.defaults.filterByClassName` | Restrict the ClusterSPIFFEID cache to this controller's className. Only enable after confirming target ClusterSPIFFEIDs already carry the className label, or existing registrations will be deleted. | `false` |
|
||||
| `externalControllerManagers.defaults.entryIDPrefixCleanup` | consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` |
|
||||
| `externalControllerManagers.defaults.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
|
||||
| `externalControllerManagers.defaults.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` |
|
||||
|
||||
@@ -91,6 +91,7 @@ ignoreNamespaces:
|
||||
spireServerSocketPath: "/tmp/spire-server/private/api.sock"
|
||||
className: {{ include "spire-server.controller-manager-class-name" . | quote}}
|
||||
watchClassless: {{ if hasKey .settings "watchClassless" }}{{ .settings.watchClassless | toYaml }}{{ else }}{{ .defaults.watchClassless | toYaml }}{{ end }}
|
||||
filterByClassName: {{ if hasKey .settings "filterByClassName" }}{{ .settings.filterByClassName | toYaml }}{{ else }}{{ .defaults.filterByClassName | toYaml }}{{ end }}
|
||||
parentIDTemplate: {{ if hasKey .settings "parentIDTemplate" }}{{ .settings.parentIDTemplate | quote }}{{ else }}{{ .defaults.parentIDTemplate | quote }}{{ end }}
|
||||
{{- $reconcile := dict }}
|
||||
{{- if hasKey .settings "reconcile" }}
|
||||
|
||||
@@ -646,6 +646,8 @@ controllerManager:
|
||||
className: ""
|
||||
## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.
|
||||
watchClassless: false
|
||||
## @param controllerManager.filterByClassName Restrict the ClusterSPIFFEID cache to this controller's className. Only enable after confirming target ClusterSPIFFEIDs already carry the className label, or existing registrations will be deleted.
|
||||
filterByClassName: false
|
||||
|
||||
## @param controllerManager.entryIDPrefixCleanup Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it.
|
||||
entryIDPrefixCleanup: false
|
||||
@@ -958,6 +960,8 @@ externalControllerManagers:
|
||||
className: ""
|
||||
## @param externalControllerManagers.defaults.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.
|
||||
watchClassless: false
|
||||
## @param externalControllerManagers.defaults.filterByClassName Restrict the ClusterSPIFFEID cache to this controller's className. Only enable after confirming target ClusterSPIFFEIDs already carry the className label, or existing registrations will be deleted.
|
||||
filterByClassName: false
|
||||
## @param externalControllerManagers.defaults.entryIDPrefixCleanup consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it.
|
||||
entryIDPrefixCleanup: false
|
||||
## @param externalControllerManagers.defaults.parentIDTemplate The template that is used to register workloads.
|
||||
|
||||
Reference in New Issue
Block a user