diff --git a/charts/spire-nested/README.md b/charts/spire-nested/README.md index a4991f4..759a837 100644 --- a/charts/spire-nested/README.md +++ b/charts/spire-nested/README.md @@ -303,7 +303,7 @@ Now you can interact with the Spire agent socket from your own application. The | `root-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the test-keys identity | `false` | | `root-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` | | `root-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` | -| `root-spire-server.nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` | +| `root-spire-server.nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor | `[]` | | `root-spire-server.bundleConfigMap` | The name of the configmap to store the upstream bundle | `spire-bundle-upstream` | | `external-root-spire-server-full.externalServer` | Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers. | `true` | | `external-root-spire-server-full.nameOverride` | Name override | `root-server` | @@ -315,7 +315,7 @@ Now you can interact with the Spire agent socket from your own application. The | `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable the default cluster spiffe id | `false` | | `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the test-keys identity | `false` | | `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` | -| `external-root-spire-server-full.nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` | +| `external-root-spire-server-full.nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor | `[]` | | `external-root-spire-server-full.bundleConfigMap` | The name of the configmap to store the upstream bundle | `spire-bundle-upstream` | | `external-root-spire-server-security.externalServer` | Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers. | `true` | | `external-root-spire-server-security.nameOverride` | Name override | `root-server` | @@ -323,7 +323,7 @@ Now you can interact with the Spire agent socket from your own application. The | `external-root-spire-server-security.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` | | `external-root-spire-server-security.controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another instance on the k8s cluster with webhooks enabled. | `false` | | `external-root-spire-server-security.controllerManager.className` | specify to use an explicit class name. | `spire-mgmt-external-server` | -| `external-root-spire-server-security.nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` | +| `external-root-spire-server-security.nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor | `[]` | | `external-root-spire-server-security.bundleConfigMap` | The name of the configmap to store the upstream bundle | `spire-bundle-upstream` | ### Spire server parameters @@ -350,6 +350,6 @@ Now you can interact with the Spire agent socket from your own application. The | `external-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` | | `external-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` | | `external-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` | -| `external-spire-server.notifier.k8sbundle.enabled` | Enable local k8s bundle uploader | `false` | -| `external-spire-server.nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `false` | +| `external-spire-server.notifier.k8sBundle.enabled` | Enable local k8s bundle uploader | `false` | +| `external-spire-server.nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `false` | | `external-spire-server.nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `true` | diff --git a/charts/spire-nested/values.yaml b/charts/spire-nested/values.yaml index f7c9549..4465ade 100644 --- a/charts/spire-nested/values.yaml +++ b/charts/spire-nested/values.yaml @@ -246,8 +246,8 @@ root-spire-server: ## @param root-spire-server.externalControllerManagers.enabled Flag to enable external controller managers enabled: true nodeAttestor: - k8sPsat: - ## @param root-spire-server.nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor + k8sPSAT: + ## @param root-spire-server.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor serviceAccountAllowList: - spire-agent-upstream ## @param root-spire-server.bundleConfigMap The name of the configmap to store the upstream bundle @@ -284,8 +284,8 @@ external-root-spire-server-full: ## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable the test-keys identity enabled: false nodeAttestor: - k8sPsat: - ## @param external-root-spire-server-full.nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor + k8sPSAT: + ## @param external-root-spire-server-full.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor serviceAccountAllowList: - spire-agent-upstream ## @param external-root-spire-server-full.bundleConfigMap The name of the configmap to store the upstream bundle @@ -308,8 +308,8 @@ external-root-spire-server-security: ## @param external-root-spire-server-security.controllerManager.className specify to use an explicit class name. className: spire-mgmt-external-server nodeAttestor: - k8sPsat: - ## @param external-root-spire-server-security.nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor + k8sPSAT: + ## @param external-root-spire-server-security.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor serviceAccountAllowList: - spire-agent-upstream ## @param external-root-spire-server-security.bundleConfigMap The name of the configmap to store the upstream bundle @@ -385,12 +385,12 @@ external-spire-server: ## @param external-spire-server.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server nameOverride: root-server notifier: - k8sbundle: - ## @param external-spire-server.notifier.k8sbundle.enabled Enable local k8s bundle uploader + k8sBundle: + ## @param external-spire-server.notifier.k8sBundle.enabled Enable local k8s bundle uploader enabled: false nodeAttestor: - k8sPsat: - ## @param external-spire-server.nodeAttestor.k8sPsat.enabled Enable Psat k8s nodeattestor + k8sPSAT: + ## @param external-spire-server.nodeAttestor.k8sPSAT.enabled Enable PSAT k8s nodeattestor enabled: false joinToken: ## @param external-spire-server.nodeAttestor.joinToken.enabled Enable the join_token nodeattestor diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 4b3a0ba..5d83e95 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -72,7 +72,7 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | -| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` | +| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | | `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` | | `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` | | `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` | @@ -84,7 +84,7 @@ A Helm chart to install the SPIRE agent. | `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.8.7` | | `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `1d7c73ccac948ee86cbd78ddde2d30128a1838b403f7bb2100d38d916a252244` | | `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` | -| `nodeAttestor.tpmDirect.pubHash.enabled` | Enable Psat k8s nodeattestor | `true` | +| `nodeAttestor.tpmDirect.pubHash.enabled` | Display pubhash in logs | `true` | | `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `docker.io` | | `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-get-tpm-pubhash` | | `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` | @@ -98,10 +98,10 @@ A Helm chart to install the SPIRE agent. | `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false | `false` | | `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` | | `sds.enabled` | Enables Envoy SDS configuration | `false` | -| `sds.defaultSvidName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` | +| `sds.defaultSVIDName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` | | `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` | | `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` | -| `sds.disableSpiffeCertValidation` | Disable Envoy SDS custom validation | `false` | +| `sds.disableSPIFFECertValidation` | Disable Envoy SDS custom validation | `false` | | `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | | `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | | `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index d46c6b7..fad0255 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -50,10 +50,10 @@ agent: {{- end }} {{- if .Values.sds.enabled }} sds: - default_svid_name: {{ .Values.sds.defaultSvidName | quote }} + default_svid_name: {{ .Values.sds.defaultSVIDName | quote }} default_bundle_name: {{ .Values.sds.defaultBundleName | quote }} default_all_bundles_name: {{ .Values.sds.defaultAllBundlesName | quote }} - disable_spiffe_cert_validation: {{ eq .Values.sds.disableSpiffeCertValidation true }} + disable_spiffe_cert_validation: {{ eq .Values.sds.disableSPIFFECertValidation true }} {{- end }} {{- with .Values.experimental }} @@ -73,7 +73,7 @@ agent: {{- $keyManagerUsed := add (len .Values.customPlugins.keyManager) (len .Values.unsupportedBuiltInPlugins.keyManager) }} plugins: NodeAttestor: - {{- if .Values.nodeAttestor.k8sPsat.enabled }} + {{- if .Values.nodeAttestor.k8sPSAT.enabled }} k8s_psat: plugin_data: cluster: {{ include "spire-lib.cluster-name" . | quote }} diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 66649b4..fd7a985 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -1,5 +1,14 @@ {{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }} {{- $root := . }} +{{- if hasKey .Values.nodeAttestor "k8sPsat" }} +{{- fail "k8sPsat was renamed to k8sPSAT. Please update your config." }} +{{- end }} +{{- if hasKey .Values.sds "defaultSvidName" }} +{{- fail "defaultSvidName was renamed to defaultSVIDName. Please update your config." }} +{{- end }} +{{- if hasKey .Values.sds "disableSpiffeCertValidation" }} +{{- fail "disableSpiffeCertValidation was renamed to disableSPIFFECertValidation. Please update your config." }} +{{- end }} {{- range $name := (concat (list "default") (keys .Values.agents)) | uniq }} {{- with (dict "Release" $root.Release "Chart" $root.Chart "Values" (deepCopy $root.Values)) }} {{- $nameSuffix := "" }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 9a3741d..7475397 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -162,8 +162,8 @@ keyManager: enabled: true nodeAttestor: - k8sPsat: - ## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s Node Attestor + k8sPSAT: + ## @param nodeAttestor.k8sPSAT.enabled Enable PSAT k8s Node Attestor enabled: true httpChallenge: ## @param nodeAttestor.httpChallenge.enabled Enable the http challenge Node Attestor @@ -193,7 +193,7 @@ nodeAttestor: ## @param nodeAttestor.tpmDirect.plugin.path The filename in the container of the plugin path: /app/tpm_attestor_agent pubHash: - ## @param nodeAttestor.tpmDirect.pubHash.enabled Enable Psat k8s nodeattestor + ## @param nodeAttestor.tpmDirect.pubHash.enabled Display pubhash in logs enabled: true ## @param nodeAttestor.tpmDirect.pubHash.image.registry The OCI registry to pull the image from ## @param nodeAttestor.tpmDirect.pubHash.image.repository The repository within the registry @@ -233,14 +233,14 @@ workloadAttestors: sds: ## @param sds.enabled Enables Envoy SDS configuration enabled: false - ## @param sds.defaultSvidName The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS - defaultSvidName: "default" + ## @param sds.defaultSVIDName The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS + defaultSVIDName: "default" ## @param sds.defaultBundleName The Validation Context resource name to use for the default X.509 bundle with Envoy SDS defaultBundleName: "ROOTCA" ## @param sds.defaultAllBundlesName The Validation Context resource name to use for all bundles (including federated) with Envoy SDS defaultAllBundlesName: "ALL" - ## @param sds.disableSpiffeCertValidation Disable Envoy SDS custom validation - disableSpiffeCertValidation: false + ## @param sds.disableSPIFFECertValidation Disable Envoy SDS custom validation + disableSPIFFECertValidation: false telemetry: prometheus: @@ -355,7 +355,7 @@ agents: {} # nodeSelector: # tpm: with # nodeAttestor: -# k8sPsat: +# k8sPSAT: # enabled: false # tpmDirect: # enabled: true diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 9706a8b..ce2bedc 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -168,9 +168,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | | `federation.ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` | | `federation.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` | -| `ca_subject.country` | Country for Spire server CA | `ARPA` | -| `ca_subject.organization` | Organization for Spire server CA | `Example` | -| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` | +| `caSubject.country` | Country for Spire server CA | `ARPA` | +| `caSubject.organization` | Organization for Spire server CA | `Example` | +| `caSubject.commonName` | Common Name for Spire server CA | `example.org` | | `credentialComposer.uniqueID.enabled` | Add the x509UniqueIdentifier attribute to workload X509-SVIDs | `false` | | `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` | | `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` | @@ -201,11 +201,11 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` | | `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` | | `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` | -| `upstreamAuthority.certManager.issuer_name` | Defaults to the release name, override if CA is provided outside of the chart | `""` | -| `upstreamAuthority.certManager.issuer_kind` | Defaults to "Issuer", override if CA is provided outside of the chart | `Issuer` | -| `upstreamAuthority.certManager.issuer_group` | Defaults to "cert-manager.io", override if CA is provided outside of the chart | `cert-manager.io` | +| `upstreamAuthority.certManager.issuerName` | Defaults to the release name, override if CA is provided outside of the chart | `""` | +| `upstreamAuthority.certManager.issuerKind` | Defaults to "Issuer", override if CA is provided outside of the chart | `Issuer` | +| `upstreamAuthority.certManager.issuerGroup` | Defaults to "cert-manager.io", override if CA is provided outside of the chart | `cert-manager.io` | | `upstreamAuthority.certManager.namespace` | Specify to use a namespace other then the one the chart is installed into | `""` | -| `upstreamAuthority.certManager.kube_config_file` | Path to kube_config_file on node to setup cert manager | `""` | +| `upstreamAuthority.certManager.kubeConfigFile` | Path to kube config file on node to setup cert manager | `""` | | `upstreamAuthority.certManager.ca.create` | Creates a Cert-Manager CA | `false` | | `upstreamAuthority.certManager.ca.duration` | Duration of the CA. Defaults to 10 years | `87600h` | | `upstreamAuthority.certManager.ca.privateKey.algorithm` | Algorithm to generate private key for CA | `ECDSA` | @@ -230,8 +230,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `upstreamAuthority.vault.k8sAuth.k8sAuthRoleName` | Required - Name of the Vault role. The plugin authenticates against the named role | `""` | | `upstreamAuthority.vault.k8sAuth.token.audience` | Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info. | `vault` | | `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` | -| `notifier.k8sbundle.enabled` | Enable local k8s bundle uploader | `true` | -| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` | +| `notifier.k8sBundle.enabled` | Enable local k8s bundle uploader | `true` | +| `notifier.k8sBundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` | | `notifier.externalK8sBundle.enabled` | Enable external k8s bundle uploader | `true` | | `notifier.externalK8sBundle.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` | | `notifier.externalK8sBundle.defaults.configMap` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` | @@ -327,17 +327,17 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `caTTL` | TTL for CA | `24h` | | `defaultX509SvidTTL` | TTL for X509 Svids | `4h` | | `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` | -| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` | -| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor. If namespace isn't specified, release namespace will be used. | `[]` | -| `nodeAttestor.k8sPsat.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` | -| `nodeAttestor.k8sPsat.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` | -| `nodeAttestor.k8sPsat.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` | -| `nodeAttestor.externalK8sPsat.enabled` | Enable PSAT k8s nodeattestor for external Kubernetes clusters | `true` | -| `nodeAttestor.externalK8sPsat.defaults.serviceAccountAllowList` | Allowed service accounts for PSAT node attestor | `[]` | -| `nodeAttestor.externalK8sPsat.defaults.audience` | Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used | `[]` | -| `nodeAttestor.externalK8sPsat.defaults.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` | -| `nodeAttestor.externalK8sPsat.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` | -| `nodeAttestor.externalK8sPsat.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` | +| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `true` | +| `nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor. If namespace isn't specified, release namespace will be used. | `[]` | +| `nodeAttestor.k8sPSAT.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` | +| `nodeAttestor.k8sPSAT.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` | +| `nodeAttestor.k8sPSAT.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` | +| `nodeAttestor.externalK8sPSAT.enabled` | Enable PSAT k8s nodeattestor for external Kubernetes clusters | `true` | +| `nodeAttestor.externalK8sPSAT.defaults.serviceAccountAllowList` | Allowed service accounts for PSAT node attestor | `[]` | +| `nodeAttestor.externalK8sPSAT.defaults.audience` | Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used | `[]` | +| `nodeAttestor.externalK8sPSAT.defaults.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` | +| `nodeAttestor.externalK8sPSAT.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` | +| `nodeAttestor.externalK8sPSAT.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` | | `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` | | `nodeAttestor.httpChallenge.enabled` | Enable the http_challenge nodeattesto | `false` | | `nodeAttestor.httpChallenge.allowedDNSPatterns` | A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed. | `[]` | diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index 5674c5c..ce0fb91 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -66,8 +66,8 @@ Allow the release namespace to be overridden for multi-namespace deployments in {{- end -}} {{- define "spire-server.bundle-namespace" -}} - {{- if .Values.notifier.k8sbundle.namespace }} - {{- .Values.notifier.k8sbundle.namespace }} + {{- if .Values.notifier.k8sBundle.namespace }} + {{- .Values.notifier.k8sBundle.namespace }} {{- else if .Values.namespaceOverride -}} {{- .Values.namespaceOverride -}} {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }} @@ -146,9 +146,9 @@ Create the name of the service account to use {{- define "spire-server.serviceAccountAllowedList" }} {{- $releaseNamespace := include "spire-server.agent-namespace" . }} -{{- if ne (len .Values.nodeAttestor.k8sPsat.serviceAccountAllowList) 0 }} +{{- if ne (len .Values.nodeAttestor.k8sPSAT.serviceAccountAllowList) 0 }} {{- $list := list }} -{{- range .Values.nodeAttestor.k8sPsat.serviceAccountAllowList }} +{{- range .Values.nodeAttestor.k8sPSAT.serviceAccountAllowList }} {{- if contains ":" . }} {{- $list = append $list . }} {{- else }} @@ -293,17 +293,17 @@ The code below determines what connection type should be used. {{- define "spire-server.ca-subject-country" }} {{- $g := dig "spire" "caSubject" "country" "" .Values.global }} -{{- default .Values.ca_subject.country $g }} +{{- default .Values.caSubject.country $g }} {{- end }} {{- define "spire-server.ca-subject-organization" }} {{- $g := dig "spire" "caSubject" "organization" "" .Values.global }} -{{- default .Values.ca_subject.organization $g }} +{{- default .Values.caSubject.organization $g }} {{- end }} {{- define "spire-server.ca-subject-common-name" }} {{- $g := dig "spire" "caSubject" "commonName" "" .Values.global }} -{{- default .Values.ca_subject.common_name $g }} +{{- default .Values.caSubject.commonName $g }} {{- end }} {{- define "spire-server.subject" }} diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index c43f358..d5ca253 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -1,9 +1,9 @@ {{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}} {{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}} {{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}} -{{- include "spire-lib.check-strict-mode" (list . "ca_subject.country must be set" (eq (include "spire-server.ca-subject-country" .) "ARPA"))}} -{{- include "spire-lib.check-strict-mode" (list . "ca_subject.organization must be set" (eq (include "spire-server.ca-subject-organization" .) "Example"))}} -{{- include "spire-lib.check-strict-mode" (list . "ca_subject.common_name must be set" (eq (include "spire-server.ca-subject-common-name" .) "example.org"))}} +{{- include "spire-lib.check-strict-mode" (list . "caSubject.country must be set" (eq (include "spire-server.ca-subject-country" .) "ARPA"))}} +{{- include "spire-lib.check-strict-mode" (list . "caSubject.organization must be set" (eq (include "spire-server.ca-subject-organization" .) "Example"))}} +{{- include "spire-lib.check-strict-mode" (list . "caSubject.commonNname must be set" (eq (include "spire-server.ca-subject-common-name" .) "example.org"))}} {{- range $type, $tvals := .Values.customPlugins }} {{- if not (has $type (list "bundlePublisher" "credentialComposer" "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }} {{- fail (printf "Unknown plugin type specified: %s" $type) }} @@ -103,14 +103,14 @@ plugins: plugin_data: {{ include "spire-server.datastore-config" . | nindent 10 }} - {{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.externalK8sPsat.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }} + {{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }} NodeAttestor: - {{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPsat.clusters }} - {{- if or (eq (.Values.nodeAttestor.k8sPsat.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPsat.enabled | toString) "true") (gt (len $clusters) 0)) }} + {{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPSAT.clusters }} + {{- if or (eq (.Values.nodeAttestor.k8sPSAT.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true") (gt (len $clusters) 0)) }} k8s_psat: plugin_data: clusters: - {{- with .Values.nodeAttestor.k8sPsat }} + {{- with .Values.nodeAttestor.k8sPSAT }} {{- if eq (.enabled | toString) "true" }} - {{ include "spire-lib.cluster-name" $root }}: service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }} @@ -121,12 +121,12 @@ plugins: {{ toYaml .allowedPodLabelKeys | nindent 14 }} {{- end }} {{- end }} - {{- if eq (.Values.nodeAttestor.externalK8sPsat.enabled | toString) "true" }} - {{- $clusterDefaults := .Values.nodeAttestor.externalK8sPsat.defaults }} + {{- if eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true" }} + {{- $clusterDefaults := .Values.nodeAttestor.externalK8sPSAT.defaults }} {{- range $name, $_ := $clusters }} {{- $clusterSettings := dict }} - {{- if hasKey $root.Values.nodeAttestor.externalK8sPsat.clusters $name }} - {{- $clusterSettings = index $root.Values.nodeAttestor.externalK8sPsat.clusters $name }} + {{- if hasKey $root.Values.nodeAttestor.externalK8sPSAT.clusters $name }} + {{- $clusterSettings = index $root.Values.nodeAttestor.externalK8sPSAT.clusters $name }} {{- end }} - {{ $name }}: {{- if hasKey $clusterSettings "kubeConfigName" }} @@ -233,11 +233,11 @@ plugins: {{- end }} {{- $externalK8sBundleClusters := default .Values.kubeConfigs .Values.notifier.externalK8sBundle.clusters }} - {{- if or .Values.notifier.k8sbundle.enabled (and .Values.notifier.externalK8sBundle.enabled (ne (len $externalK8sBundleClusters) 0)) }} + {{- if or .Values.notifier.k8sBundle.enabled (and .Values.notifier.externalK8sBundle.enabled (ne (len $externalK8sBundleClusters) 0)) }} Notifier: k8sbundle: plugin_data: - {{- if eq (.Values.notifier.k8sbundle.enabled | toString) "true" }} + {{- if eq (.Values.notifier.k8sBundle.enabled | toString) "true" }} namespace: {{ include "spire-server.bundle-namespace" . | quote }} config_map: {{ include "spire-lib.bundle-configmap" . | quote }} {{- end }} @@ -307,12 +307,12 @@ plugins: UpstreamAuthority: cert-manager: plugin_data: - issuer_name: {{ default (printf "%s-ca" (include "spire-server.fullname" $root)) .issuer_name }} - issuer_kind: {{ .issuer_kind | quote }} - issuer_group: {{ .issuer_group | quote }} + issuer_name: {{ default (printf "%s-ca" (include "spire-server.fullname" $root)) .issuerName }} + issuer_kind: {{ .issuerKind | quote }} + issuer_group: {{ .issuerGroup | quote }} namespace: {{ default $root.Release.Namespace .namespace | quote }} - {{- if ne .kube_config_file "" }} - kube_config_file: {{ .kube_config_file | quote }} + {{- if ne .kubeConfigFile "" }} + kube_config_file: {{ .kubeConfigFile | quote }} {{- end }} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/issuer.yaml b/charts/spire/charts/spire-server/templates/issuer.yaml index 1a9afbd..5894543 100644 --- a/charts/spire/charts/spire-server/templates/issuer.yaml +++ b/charts/spire/charts/spire-server/templates/issuer.yaml @@ -1,6 +1,6 @@ {{- with .Values.upstreamAuthority.certManager }} {{ if and .enabled .ca.create }} -{{ $issuerName := printf "%s-selfsigned" (default (include "spire-server.fullname" $) .issuer_name) }} +{{ $issuerName := printf "%s-selfsigned" (default (include "spire-server.fullname" $) .issuerName) }} {{/* Configuring CA Issuer: https://cert-manager.io/docs/configuration/ca/ */}} @@ -21,14 +21,14 @@ metadata: namespace: {{ include "spire-server.namespace" $ }} spec: isCA: true - commonName: {{ $.Values.ca_subject.common_name }} + commonName: {{ $.Values.caSubject.commonName }} secretName: {{ include "spire-server.fullname" $ }}-ca-keys duration: {{ $.Values.upstreamAuthority.certManager.ca.duration }} subject: countries: - - {{ $.Values.ca_subject.country }} + - {{ $.Values.caSubject.country }} organizations: - - {{ $.Values.ca_subject.organization }} + - {{ $.Values.caSubject.organization }} privateKey: algorithm: {{ $.Values.upstreamAuthority.certManager.ca.privateKey.algorithm }} size: {{ $.Values.upstreamAuthority.certManager.ca.privateKey.size }} diff --git a/charts/spire/charts/spire-server/templates/roles.yaml b/charts/spire/charts/spire-server/templates/roles.yaml index fdf2ac5..197dc02 100644 --- a/charts/spire/charts/spire-server/templates/roles.yaml +++ b/charts/spire/charts/spire-server/templates/roles.yaml @@ -1,7 +1,7 @@ {{- $subject := include "spire-server.subject" . }} {{- $namespace := include "spire-server.namespace" . }} {{- $bundleNamespace := include "spire-server.bundle-namespace" . }} -{{- if .Values.notifier.k8sbundle.enabled }} +{{- if .Values.notifier.k8sBundle.enabled }} # Role to be able to push certificate bundles to a configmap kind: Role apiVersion: rbac.authorization.k8s.io/v1 @@ -48,7 +48,7 @@ roleRef: name: {{ include "spire-server.fullname" . }}-cm apiGroup: rbac.authorization.k8s.io {{- end }} -{{- if .Values.notifier.k8sbundle.enabled }} +{{- if .Values.notifier.k8sBundle.enabled }} --- kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 @@ -61,7 +61,7 @@ roleRef: name: {{ include "spire-lib.bundle-configmap" . }} apiGroup: rbac.authorization.k8s.io {{- end }} -{{- if and .Values.nodeAttestor.k8sPsat.enabled }} +{{- if and .Values.nodeAttestor.k8sPSAT.enabled }} --- # ClusterRole to allow spire-server node attestor to query Token Review API kind: ClusterRole diff --git a/charts/spire/charts/spire-server/templates/server-resource.yaml b/charts/spire/charts/spire-server/templates/server-resource.yaml index 1a52494..e6b5491 100644 --- a/charts/spire/charts/spire-server/templates/server-resource.yaml +++ b/charts/spire/charts/spire-server/templates/server-resource.yaml @@ -6,7 +6,33 @@ {{- $configSum3 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }} {{- $configSumTornjak := (include (print $.Template.BasePath "/tornjak-config.yaml") . | sha256sum) }} {{- $fullname := include "spire-server.fullname" . }} - +{{- if hasKey .Values "ca_subject" }} +{{- fail "ca_subject was renamed to caSubject. Please update your config." }} +{{- end }} +{{- if hasKey .Values.caSubject "common_name" }} +{{- fail "ca_name was renamed to caName. Please update your config." }} +{{- end }} +{{- if hasKey .Values.upstreamAuthority.certManager "issuer_name" }} +{{- fail "issuer_name was renamed to issuerName. Please update your config." }} +{{- end }} +{{- if hasKey .Values.upstreamAuthority.certManager "issuer_group" }} +{{- fail "issuer_group was renamed to issuerGroup. Please update your config." }} +{{- end }} +{{- if hasKey .Values.upstreamAuthority.certManager "issuer_kind" }} +{{- fail "issuer_kind was renamed to issuerKind. Please update your config." }} +{{- end }} +{{- if hasKey .Values.upstreamAuthority.certManager "kube_config_file" }} +{{- fail "kube_config_file was renamed to kubeConfigFile. Please update your config." }} +{{- end }} +{{- if hasKey .Values.nodeAttestor "k8sPsat" }} +{{- fail "k8sPsat was renamed to k8sPSAT. Please update your config." }} +{{- end }} +{{- if hasKey .Values.nodeAttestor "externalK8sPSA" }} +{{- fail "externalK8sPsat was renamed to externalK8sPSAT. Please update your config." }} +{{- end }} +{{- if hasKey .Values.notifier "k8sbundle" }} +{{- fail "k8sbundle was renmaed to k8sBundle. Please update your config." }} +{{- end }} {{- if eq .Values.kind "statefulset" }} {{- if not (has .Values.persistence.type (list "pvc" "hostPath" "emptyDir")) }} {{- fail "persistence.type must be one of [\"pvc\", \"hostPath\", \"emptyDir\"]" }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index d70492f..beab1c7 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -287,13 +287,13 @@ federation: # If Profile Type == https_web: # secretName: spire-server-federation-tls -ca_subject: - ## @param ca_subject.country Country for Spire server CA +caSubject: + ## @param caSubject.country Country for Spire server CA country: ARPA - ## @param ca_subject.organization Organization for Spire server CA + ## @param caSubject.organization Organization for Spire server CA organization: Example - ## @param ca_subject.common_name Common Name for Spire server CA - common_name: example.org + ## @param caSubject.commonName Common Name for Spire server CA + commonName: example.org credentialComposer: uniqueID: @@ -371,16 +371,16 @@ upstreamAuthority: ## @param upstreamAuthority.certManager.rbac.create Flag to create RBAC roles rbac: create: true - ## @param upstreamAuthority.certManager.issuer_name Defaults to the release name, override if CA is provided outside of the chart - issuer_name: "" - ## @param upstreamAuthority.certManager.issuer_kind Defaults to "Issuer", override if CA is provided outside of the chart - issuer_kind: "Issuer" - ## @param upstreamAuthority.certManager.issuer_group Defaults to "cert-manager.io", override if CA is provided outside of the chart - issuer_group: "cert-manager.io" + ## @param upstreamAuthority.certManager.issuerName Defaults to the release name, override if CA is provided outside of the chart + issuerName: "" + ## @param upstreamAuthority.certManager.issuerKind Defaults to "Issuer", override if CA is provided outside of the chart + issuerKind: "Issuer" + ## @param upstreamAuthority.certManager.issuerGroup Defaults to "cert-manager.io", override if CA is provided outside of the chart + issuerGroup: "cert-manager.io" ## @param upstreamAuthority.certManager.namespace Specify to use a namespace other then the one the chart is installed into namespace: "" - ## @param upstreamAuthority.certManager.kube_config_file Path to kube_config_file on node to setup cert manager - kube_config_file: "" + ## @param upstreamAuthority.certManager.kubeConfigFile Path to kube config file on node to setup cert manager + kubeConfigFile: "" ca: ## @param upstreamAuthority.certManager.ca.create Creates a Cert-Manager CA @@ -440,10 +440,10 @@ upstreamAuthority: expiry: 7200 notifier: - k8sbundle: - ## @param notifier.k8sbundle.enabled Enable local k8s bundle uploader + k8sBundle: + ## @param notifier.k8sBundle.enabled Enable local k8s bundle uploader enabled: true - ## @param notifier.k8sbundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace + ## @param notifier.k8sBundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace namespace: "" externalK8sBundle: ## @param notifier.externalK8sBundle.enabled Enable external k8s bundle uploader @@ -795,30 +795,30 @@ defaultX509SvidTTL: 4h defaultJwtSvidTTL: 1h nodeAttestor: - k8sPsat: - ## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s nodeattestor + k8sPSAT: + ## @param nodeAttestor.k8sPSAT.enabled Enable PSAT k8s nodeattestor enabled: true - ## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor. If namespace isn't specified, release namespace will be used. + ## @param nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor. If namespace isn't specified, release namespace will be used. serviceAccountAllowList: [] - ## @param nodeAttestor.k8sPsat.audience [array] Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used + ## @param nodeAttestor.k8sPSAT.audience [array] Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used audience: ["spire-server"] - ## @param nodeAttestor.k8sPsat.allowedNodeLabelKeys [array] Node label keys considered for selectors + ## @param nodeAttestor.k8sPSAT.allowedNodeLabelKeys [array] Node label keys considered for selectors allowedNodeLabelKeys: [] - ## @param nodeAttestor.k8sPsat.allowedPodLabelKeys [array] Pod label keys considered for selectors + ## @param nodeAttestor.k8sPSAT.allowedPodLabelKeys [array] Pod label keys considered for selectors allowedPodLabelKeys: [] - externalK8sPsat: - ## @param nodeAttestor.externalK8sPsat.enabled Enable PSAT k8s nodeattestor for external Kubernetes clusters + externalK8sPSAT: + ## @param nodeAttestor.externalK8sPSAT.enabled Enable PSAT k8s nodeattestor for external Kubernetes clusters enabled: true defaults: - ## @param nodeAttestor.externalK8sPsat.defaults.serviceAccountAllowList [array] Allowed service accounts for PSAT node attestor + ## @param nodeAttestor.externalK8sPSAT.defaults.serviceAccountAllowList [array] Allowed service accounts for PSAT node attestor serviceAccountAllowList: ["spire-system:spire-agent-upstream"] - ## @param nodeAttestor.externalK8sPsat.defaults.audience [array] Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used + ## @param nodeAttestor.externalK8sPSAT.defaults.audience [array] Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used audience: ["spire-server"] - ## @param nodeAttestor.externalK8sPsat.defaults.allowedNodeLabelKeys [array] Node label keys considered for selectors + ## @param nodeAttestor.externalK8sPSAT.defaults.allowedNodeLabelKeys [array] Node label keys considered for selectors allowedNodeLabelKeys: [] - ## @param nodeAttestor.externalK8sPsat.defaults.allowedPodLabelKeys [array] Pod label keys considered for selectors + ## @param nodeAttestor.externalK8sPSAT.defaults.allowedPodLabelKeys [array] Pod label keys considered for selectors allowedPodLabelKeys: [] - ## @param nodeAttestor.externalK8sPsat.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. + ## @param nodeAttestor.externalK8sPSAT.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. clusters: {} # clustera: # kubeConfigName: foo diff --git a/charts/spire/ci/namespace-override-values-skip.yaml b/charts/spire/ci/namespace-override-values-skip.yaml index b91f0c3..8efbaf1 100644 --- a/charts/spire/ci/namespace-override-values-skip.yaml +++ b/charts/spire/ci/namespace-override-values-skip.yaml @@ -8,10 +8,10 @@ spiffe-oidc-discovery-provider: spire-server: namespaceOverride: spire-server nodeAttestor: - k8sPsat: + k8sPSAT: serviceAccountAllowList: ["spire-system:spire-agent"] notifier: - k8sbundle: + k8sBundle: namespace: spire-system spiffe-csi-driver: diff --git a/examples/federation/a-values.yaml b/examples/federation/a-values.yaml index 6ca171f..6dd0f55 100644 --- a/examples/federation/a-values.yaml +++ b/examples/federation/a-values.yaml @@ -9,12 +9,12 @@ global: clusterName: a trustDomain: a-org.local bundleConfigMap: spire-bundle-a + caSubject: + country: US + organization: A + commonName: a.local spire-server: - ca_subject: - country: US - organization: A - common_name: a.local federation: enabled: true ingress: diff --git a/examples/federation/b-values.yaml b/examples/federation/b-values.yaml index b76ec6b..4d295ac 100644 --- a/examples/federation/b-values.yaml +++ b/examples/federation/b-values.yaml @@ -9,12 +9,12 @@ global: clusterName: b trustDomain: b-org.local bundleConfigMap: spire-bundle-b + caSubject: + country: US + organization: B + commonName: b.local spire-server: - ca_subject: - country: US - organization: B - common_name: b.local federation: enabled: true ingress: diff --git a/examples/tpm-direct/different-nodes.yaml b/examples/tpm-direct/different-nodes.yaml index 86d913e..4cc6e20 100644 --- a/examples/tpm-direct/different-nodes.yaml +++ b/examples/tpm-direct/different-nodes.yaml @@ -7,7 +7,7 @@ spire-agent: nodeSelector: tpm: with nodeAttestor: - k8sPsat: + k8sPSAT: enabled: false tpmDirect: enabled: true diff --git a/examples/tpm-direct/same-nodes.yaml b/examples/tpm-direct/same-nodes.yaml index ab53a82..c4cd76c 100644 --- a/examples/tpm-direct/same-nodes.yaml +++ b/examples/tpm-direct/same-nodes.yaml @@ -1,6 +1,6 @@ spire-agent: nodeAttestor: - k8sPsat: + k8sPSAT: enabled: false tpmDirect: enabled: true diff --git a/examples/tpm-direct/values.yaml b/examples/tpm-direct/values.yaml index ab53a82..c4cd76c 100644 --- a/examples/tpm-direct/values.yaml +++ b/examples/tpm-direct/values.yaml @@ -1,6 +1,6 @@ spire-agent: nodeAttestor: - k8sPsat: + k8sPSAT: enabled: false tpmDirect: enabled: true diff --git a/tests/unit/spire_test.go b/tests/unit/spire_test.go index 7e6e1f0..b704d45 100644 --- a/tests/unit/spire_test.go +++ b/tests/unit/spire_test.go @@ -28,13 +28,13 @@ var _ = Describe("Spire", func() { chart, err := helmloader.Load("../../charts/spire") Expect(err).Should(Succeed()) Describe("spire-server.upstream.cert-manager", func() { - It("issuer_name when set is passed through", func() { + It("issuerName when set is passed through", func() { objs, err := ValueStringRender(chart, ` spire-server: upstreamAuthority: certManager: enabled: true - issuer_name: abc123 + issuerName: abc123 `) Expect(err).Should(Succeed()) notes := objs["spire/charts/spire-server/templates/configmap.yaml"] @@ -108,7 +108,7 @@ spire-server: objs, err := ValueStringRender(chart, ` spire-agent: nodeAttestor: - k8sPsat: + k8sPSAT: enabled: false customPlugins: nodeAttestor: @@ -127,7 +127,7 @@ spire-agent: objs, err := ValueStringRender(chart, ` spire-agent: nodeAttestor: - k8sPsat: + k8sPSAT: enabled: false unsupportedBuiltInPlugins: nodeAttestor: