Specify ingress controller type (#43)
* Specify ingress controller type Signed-off-by: Kevin Fox <[email protected]> * Fix indenting, docs Signed-off-by: Kevin Fox <[email protected]> * Fix spacing Signed-off-by: Kevin Fox <[email protected]> * Fix missing brackets Signed-off-by: Kevin Fox <[email protected]> * Fix missing brackets Signed-off-by: Kevin Fox <[email protected]> * Add ingress-nginx support Signed-off-by: Kevin Fox <[email protected]> * Use the right example values for test version to upgrade from. Signed-off-by: Kevin Fox <[email protected]> * Fix var in wrong location Signed-off-by: Kevin Fox <[email protected]> * Fix missing arg Signed-off-by: Kevin Fox <[email protected]> * Try this to checkout the right version Signed-off-by: Kevin Fox <[email protected]> * Switch to upgrading from 0.14.0 Signed-off-by: Kevin Fox <[email protected]> * Install crds Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Enable unset ingress controller type to use with openshift later Signed-off-by: Kevin Fox <[email protected]> * Fix docs after merge issue Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -124,7 +124,7 @@ helm install -n spire-server spire-crds charts/spire-crds
|
||||
### Global parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ---------------------------- |
|
||||
| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- |
|
||||
| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` |
|
||||
| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` |
|
||||
| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` |
|
||||
@@ -133,6 +133,7 @@ helm install -n spire-server spire-crds charts/spire-crds
|
||||
| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` |
|
||||
| `global.spire.image.registry` | Override all Spire image registries at once | `""` |
|
||||
| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` |
|
||||
| `global.spire.ingressControllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
||||
| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||
| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||
|
||||
|
||||
@@ -30,7 +30,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
### Chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||
| ----------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
||||
| `replicaCount` | Replica count | `1` |
|
||||
| `namespaceOverride` | Namespace override | `""` |
|
||||
@@ -96,6 +96,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `telemetry.prometheus.nginxExporter.resources` | Resource requests and limits | `{}` |
|
||||
| `ingress.enabled` | Flag to enable ingress | `false` |
|
||||
| `ingress.className` | Ingress class name | `""` |
|
||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
||||
| `ingress.annotations` | Annotations for ingress object | `{}` |
|
||||
| `ingress.hosts` | Host paths for ingress object | `[]` |
|
||||
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
|
||||
@@ -127,3 +128,4 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
|
||||
|
||||
@@ -1,5 +1,11 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
|
||||
{{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||
{{- $annotations := deepCopy .Values.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
@@ -7,7 +13,7 @@ metadata:
|
||||
namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
|
||||
labels:
|
||||
{{ include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -241,6 +241,8 @@ ingress:
|
||||
enabled: false
|
||||
## @param ingress.className Ingress class name
|
||||
className: ""
|
||||
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""].
|
||||
controllerType: ""
|
||||
## @param ingress.annotations [object] Annotations for ingress object
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
|
||||
@@ -150,6 +150,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` |
|
||||
| `federation.ingress.enabled` | Flag to enable ingress for federation | `false` |
|
||||
| `federation.ingress.className` | Ingress class name for federation | `""` |
|
||||
| `federation.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
||||
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||
| `federation.ingress.hosts` | Host paths for ingress object | `[]` |
|
||||
| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
|
||||
@@ -244,6 +245,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||
| `ingress.enabled` | Flag to enable ingress | `false` |
|
||||
| `ingress.className` | Ingress class name | `""` |
|
||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
||||
| `ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||
| `ingress.hosts` | Host paths for ingress object | `[]` |
|
||||
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
|
||||
@@ -269,6 +271,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tornjak.service.annotations` | Annotations for the service | `{}` |
|
||||
| `tornjak.ingress.enabled` | Flag to enable ingress for Tornjak backend service | `false` |
|
||||
| `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` |
|
||||
| `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
||||
| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` |
|
||||
| `tornjak.ingress.hosts` | Host paths for ingress Tornjak backend service | `[]` |
|
||||
| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress | `[]` |
|
||||
|
||||
@@ -1,6 +1,13 @@
|
||||
{{- if .Values.federation.enabled }}
|
||||
{{- if .Values.federation.ingress.enabled -}}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.federation.ingress) }}
|
||||
{{- $svcName := include "spire-server.fullname" . }}
|
||||
{{- $annotations := deepCopy .Values.federation.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
@@ -8,7 +15,7 @@ metadata:
|
||||
namespace: {{ include "spire-server.namespace" . }}
|
||||
labels:
|
||||
{{ include "spire-server.labels" . | nindent 4 }}
|
||||
{{- with .Values.federation.ingress.annotations }}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,5 +1,13 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
|
||||
{{- $fullName := include "spire-server.fullname" . -}}
|
||||
{{- $annotations := deepCopy .Values.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
@@ -7,7 +15,7 @@ metadata:
|
||||
namespace: {{ include "spire-server.namespace" . }}
|
||||
labels:
|
||||
{{ include "spire-server.labels" . | nindent 4}}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,5 +1,15 @@
|
||||
{{- if .Values.tornjak.ingress.enabled -}}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.tornjak.ingress) }}
|
||||
{{- $fullName := include "spire-tornjak.fullname" . -}}
|
||||
{{- $annotations := deepCopy .Values.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- if ne (include "spire-tornjak.connectionType" .) "http" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
|
||||
@@ -202,6 +202,8 @@ federation:
|
||||
enabled: false
|
||||
## @param federation.ingress.className Ingress class name for federation
|
||||
className: ""
|
||||
## @param federation.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""].
|
||||
controllerType: ""
|
||||
## @param federation.ingress.annotations [object] Annotations for the ingress object
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
@@ -487,6 +489,8 @@ ingress:
|
||||
enabled: false
|
||||
## @param ingress.className Ingress class name
|
||||
className: ""
|
||||
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""].
|
||||
controllerType: ""
|
||||
## @param ingress.annotations [object] Annotations for the ingress object
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
@@ -564,11 +568,13 @@ tornjak:
|
||||
|
||||
## @param tornjak.ingress.enabled Flag to enable ingress for Tornjak backend service
|
||||
## @param tornjak.ingress.className Ingress class name for Tornjak backend service
|
||||
## @param tornjak.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""].
|
||||
## @param tornjak.ingress.annotations [object] Annotations for Tornjak backend service
|
||||
## @param tornjak.ingress.hosts [array] Host paths for ingress Tornjak backend service
|
||||
ingress:
|
||||
enabled: false
|
||||
className: ""
|
||||
controllerType: ""
|
||||
annotations: {}
|
||||
hosts:
|
||||
- host: tornjak-backend.example.org
|
||||
|
||||
@@ -57,7 +57,7 @@ port forwarding. See the chart NOTES output for more details.
|
||||
### Chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||
| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
@@ -90,6 +90,7 @@ port forwarding. See the chart NOTES output for more details.
|
||||
| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` |
|
||||
| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` |
|
||||
| `ingress.className` | Ingress class name for Tornjak frontend service | `""` |
|
||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
||||
| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` |
|
||||
| `ingress.hosts` | Host paths for ingress Tornjak frontend service | `[]` |
|
||||
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress | `[]` |
|
||||
|
||||
@@ -1,5 +1,11 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
|
||||
{{- $fullName := include "tornjak-frontend.fullname" . -}}
|
||||
{{- $annotations := deepCopy .Values.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
@@ -7,7 +13,7 @@ metadata:
|
||||
namespace: {{ include "tornjak-frontend.namespace" . }}
|
||||
labels:
|
||||
{{ include "tornjak-frontend.labels" . | nindent 4}}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -115,11 +115,13 @@ startupProbe:
|
||||
|
||||
## @param ingress.enabled Flag to enable ingress for Tornjak frontend service
|
||||
## @param ingress.className Ingress class name for Tornjak frontend service
|
||||
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""].
|
||||
## @param ingress.annotations [object] Annotations for Tornjak frontend service
|
||||
## @param ingress.hosts [array] Host paths for ingress Tornjak frontend service
|
||||
ingress:
|
||||
enabled: false
|
||||
className: ""
|
||||
controllerType: ""
|
||||
annotations: {}
|
||||
hosts:
|
||||
- host: tornjak-frontend.example.org
|
||||
|
||||
@@ -61,6 +61,25 @@
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* Takes in a dictionary with keys:
|
||||
* global - the standard global object
|
||||
* ingress - a standard format ingress config object
|
||||
*/}}
|
||||
{{- define "spire-lib.ingress-controller-type" }}
|
||||
{{- $type := "" }}
|
||||
{{- if ne (len (dig "spire" "ingressControllerType" "" .global)) 0 }}
|
||||
{{- $type = .global.spire.ingressControllerType }}
|
||||
{{- else if ne .ingress.controllerType "" }}
|
||||
{{- $type = .ingress.controllerType }}
|
||||
{{- else }}
|
||||
{{- $type = "other" }}
|
||||
{{- end }}
|
||||
{{- if not (has $type (list "other" "ingress-nginx")) }}
|
||||
{{- fail "Unsupported ingress controller type specified. Must be one of [other, ingress-nginx]" }}
|
||||
{{- end }}
|
||||
{{- $type }}
|
||||
{{- end }}
|
||||
|
||||
{{/* Takes in a dictionary with keys:
|
||||
* ingress - the standardized ingress object
|
||||
* svcName - The service to route to
|
||||
|
||||
@@ -27,6 +27,9 @@ global:
|
||||
## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
|
||||
strictMode: false
|
||||
|
||||
## @param global.spire.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""].
|
||||
ingressControllerType: ""
|
||||
|
||||
installAndUpgradeHooks:
|
||||
## @param global.installAndUpgradeHooks.enabled Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`)
|
||||
enabled: true
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
set -xe
|
||||
|
||||
UPGRADE_VERSION=v0.13.0
|
||||
UPGRADE_VERSION=v0.14.0
|
||||
UPGRADE_REPO=https://spiffe.github.io/helm-charts-hardened
|
||||
|
||||
SCRIPT="$(readlink -f "$0")"
|
||||
@@ -48,6 +48,18 @@ teardown() {
|
||||
|
||||
trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
|
||||
|
||||
if [[ -n "$UPGRADE_ARGS" ]]; then
|
||||
pushd "${SCRIPTPATH}"
|
||||
git clone https://github.com/spiffe/helm-charts-hardened "${UPGRADE_VERSION}"
|
||||
pushd "${UPGRADE_VERSION}"
|
||||
git checkout "${UPGRADE_VERSION/v/spire-}"
|
||||
helm install --create-namespace -n spire-system spire-crds charts/spire-crds
|
||||
./examples/production/run-tests.sh -c
|
||||
popd
|
||||
popd
|
||||
# Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.)
|
||||
else
|
||||
|
||||
kubectl create namespace spire-system 2>/dev/null || true
|
||||
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true
|
||||
kubectl create namespace "${ns}" 2>/dev/null || true
|
||||
@@ -91,6 +103,8 @@ spire-server:
|
||||
- "spire-server-federation.production.other"
|
||||
EOF
|
||||
|
||||
fi
|
||||
|
||||
install_and_test() {
|
||||
# Can't pass an array to a function. We completely control the string so its safe.
|
||||
# shellcheck disable=SC2086
|
||||
@@ -110,23 +124,6 @@ install_and_test() {
|
||||
helm test --namespace "${ns}" spire
|
||||
}
|
||||
|
||||
if [[ -n "$UPGRADE_ARGS" ]]; then
|
||||
install_and_test spire "$UPGRADE_ARGS"
|
||||
|
||||
# Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.)
|
||||
kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
|
||||
helm upgrade --install -n spire-server spire-crds charts/spire-crds
|
||||
fi
|
||||
|
||||
install_and_test charts/spire ""
|
||||
|
||||
if helm get manifest -n spire-server spire | grep -i example; then
|
||||
|
||||
@@ -3,16 +3,10 @@ spire-server:
|
||||
enabled: true
|
||||
ingress:
|
||||
enabled: true
|
||||
controllerType: ingress-nginx
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||
|
||||
# Optional settings you may put in your own values.
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
|
||||
# className: nginx
|
||||
|
||||
hosts:
|
||||
|
||||
@@ -6,14 +6,7 @@ spire-server:
|
||||
enabled: true
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
|
||||
# Optional settings you may put in your own values.
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
controllerType: ingress-nginx
|
||||
|
||||
# className: nginx
|
||||
|
||||
|
||||
@@ -4,13 +4,7 @@ spiffe-oidc-discovery-provider:
|
||||
enabled: true
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
|
||||
# Optional settings you may put in your own values.
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
controllerType: ingress-nginx
|
||||
|
||||
# className: nginx
|
||||
|
||||
|
||||
@@ -1,15 +1,7 @@
|
||||
spire-server:
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||
|
||||
# Optional settings you may put in your own values.
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
controllerType: ingress-nginx
|
||||
|
||||
# className: nginx
|
||||
|
||||
|
||||
Reference in New Issue
Block a user