panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow sqlite3 in memory when kind is deployment (#923)

Browse Source 
* Allow sqlite3 in memory when kind is deployment

Signed-off-by: Daniel Schlatter <[email protected]>

* Warn on unsafe in-memory datastore combinations

Signed-off-by: Daniel Schlatter <[email protected]>

---------

Signed-off-by: Daniel Schlatter <[email protected]>
This commit is contained in:
Daniel Schlatter
2026-08-18 14:22:50 -07:00
committed by GitHub
parent e46ad1594a
commit 59bb8a774c
6 changed files with 236 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/templates/NOTES.txt
+18
View File
@@ -22,6 +22,24 @@ Warning: You're using an unsupported plugin. Functionality of this release and f
Warning: You're using an experimental config. Functionality of this release and future upgrades aren't guaranteed to work smoothly.
{{- end }}
{{- if (index .Values "spire-server").enabled }}
{{- $ss := index .Values "spire-server" }}
{{- if and (eq $ss.dataStore.sql.databaseType "sqlite3") $ss.dataStore.sql.inMemory }}
{{- $upstream := false }}
{{- range $name, $cfg := $ss.upstreamAuthority }}
{{- if kindIs "map" $cfg }}{{ if eq ($cfg.enabled | toString) "true" }}{{ $upstream = true }}{{ end }}{{ end }}
{{- end }}
{{- $reconciled := and $ss.controllerManager.enabled (or $ss.controllerManager.reconcile.clusterSPIFFEIDs $ss.controllerManager.reconcile.clusterStaticEntries) }}
{{- if not $reconciled }}
Warning: dataStore.sql.inMemory is set, but no controller manager reconciler is enabled. Registration entries live only in memory and nothing recreates them, so every entry is lost when the server restarts. Enable controllerManager with reconcile.clusterSPIFFEIDs or reconcile.clusterStaticEntries.
{{- end }}
{{- if and $ss.keyManager.memory.enabled (not $upstream) }}
Warning: dataStore.sql.inMemory is set with keyManager.memory and no upstreamAuthority. The server mints a new CA on every restart, so the whole trust domain has to re-attest and previously issued SVIDs stop verifying. Suitable for testing only; configure a KMS key manager or an upstream authority for anything else.
{{- end }}
{{- end }}
{{- end }}
{{- if (index .Values "spire-server").enabled }}
{{- $className := include "spire-server.controller-manager-class-name" (dict "Values" (index .Values "spire-server") "Release" .Release) }}
{{- if (index .Values "spire-server").controllerManager.enabled }}
{{- if (index .Values "spire-server").controllerManager.watchClassless }}