spire-controller-manager 0.4.0 support (#60)
Co-authored-by: Marco Franssen <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
co-authored by
Marco Franssen
Faisal Memon
Marco Franssen
Faisal Memon
parent
edf2381aad
commit
805d8696d0
@@ -32,6 +32,14 @@ For production installs, please see [the production example](https://github.com/
|
||||
|
||||
## Upgrade notes
|
||||
|
||||
### 0.15.X
|
||||
|
||||
The spire-crds chart has been updated. Please ensure you have upgraded spire-crds before upgrading the spire chart.
|
||||
|
||||
The chart now supports multiple parallel installs of spire-controller-manager. Each install will handle all custom resources with a matching `className` field. By default this is set to `Release.Namespace-Release.Name` and the controller manager will only pick up custom resources with this `className`.
|
||||
|
||||
If you have not loaded any SPIRE custom resources yourself, the upgrade process will be transparent. If you have loaded your own SPIRE custom resources, set `spire-server.controllerManager.watchClassless=true` until you can update your SPIRE custom resources to have the `className` for the instance specified.
|
||||
|
||||
### 0.14.X
|
||||
|
||||
If coming from a chart version before 0.14.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart
|
||||
|
||||
@@ -215,13 +215,15 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
|
||||
| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
||||
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
||||
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
||||
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||
| `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
||||
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.3.0` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.0` |
|
||||
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
||||
| `controllerManager.securityContext` | Security context | `{}` |
|
||||
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
||||
@@ -240,6 +242,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.identities.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` |
|
||||
| `controllerManager.identities.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
|
||||
| `controllerManager.identities.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` |
|
||||
| `controllerManager.identities.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` |
|
||||
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
|
||||
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
|
||||
|
||||
@@ -220,3 +220,11 @@ The code below determines what connection type should be used.
|
||||
{{- end }}
|
||||
{{ $args | toYaml }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "spire-server.controller-manager-class-name" -}}
|
||||
{{- if .Values.controllerManager.className }}
|
||||
{{- .Values.controllerManager.className }}
|
||||
{{- else }}
|
||||
{{- .Release.Namespace }}-{{ .Release.Name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
apiVersion: spire.spiffe.io/v1alpha1
|
||||
kind: ClusterSPIFFEID
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" $root }}-service-account-based
|
||||
name: {{ $root.Release.Namespace }}-{{ include "spire-controller-manager.fullname" $root }}-service-account-based
|
||||
namespace: {{ include "spire-server.namespace" $root }}
|
||||
spec:
|
||||
spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }}
|
||||
@@ -36,5 +36,7 @@ spec:
|
||||
{{- end }}
|
||||
admin: {{ .identities.admin }}
|
||||
downstream: {{ .identities.downstream }}
|
||||
autoPopulateDNSNames: {{ .identities.autoPopulateDNSNames }}
|
||||
className: {{ include "spire-server.controller-manager-class-name" $root | quote}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -25,7 +25,7 @@ data:
|
||||
leaderElect: true
|
||||
resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
|
||||
resourceNamespace: {{ include "spire-server.namespace" . }}
|
||||
validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
clusterName: {{ include "spire-lib.cluster-name" . }}
|
||||
trustDomain: {{ include "spire-lib.trust-domain" . }}
|
||||
ignoreNamespaces:
|
||||
@@ -33,4 +33,6 @@ data:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
spireServerSocketPath: "/tmp/spire-server/private/api.sock"
|
||||
className: {{ include "spire-server.controller-manager-class-name" . | quote}}
|
||||
watchClassless: {{ .Values.controllerManager.watchClassless | toYaml }}
|
||||
{{- end }}
|
||||
|
||||
@@ -32,7 +32,7 @@ subjects:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["namespaces"]
|
||||
@@ -43,6 +43,9 @@ rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["endpoints"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
@@ -77,11 +80,11 @@ rules:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
name: {{ .Release.Namespace}}-{{ include "spire-controller-manager.fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire-server.serviceAccountName" . }}
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
webhooks:
|
||||
- admissionReviewVersions: ["v1"]
|
||||
clientConfig:
|
||||
|
||||
@@ -22,7 +22,7 @@ metadata:
|
||||
rules:
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}]
|
||||
resourceNames: [{{ printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) | quote }}]
|
||||
verbs: ["get", "patch"]
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
@@ -68,7 +68,7 @@ spec:
|
||||
args:
|
||||
- patch
|
||||
- validatingwebhookconfiguration
|
||||
- {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
- {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
- --type=strategic
|
||||
- -p
|
||||
- |
|
||||
|
||||
@@ -22,7 +22,7 @@ metadata:
|
||||
rules:
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}]
|
||||
resourceNames: [{{ printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) | quote }}]
|
||||
verbs: ["get", "patch"]
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
@@ -68,7 +68,7 @@ spec:
|
||||
args:
|
||||
- patch
|
||||
- validatingwebhookconfiguration
|
||||
- {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
- {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
- --type=strategic
|
||||
- -p
|
||||
- |
|
||||
|
||||
@@ -1,4 +1,9 @@
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- $webhookname := printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) }}
|
||||
{{- $oldwebhookname := printf "%s-webhook" (include "spire-controller-manager.fullname" .) }}
|
||||
{{- if not (lookup "admissionregistration.k8s.io/v1" "ValidatingWebhookConfiguration" "" $webhookname) }}
|
||||
{{- $webhookname = $oldwebhookname }}
|
||||
{{- end }}
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
|
||||
apiVersion: v1
|
||||
@@ -22,7 +27,7 @@ metadata:
|
||||
rules:
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}]
|
||||
resourceNames: [{{ $webhookname | quote }}]
|
||||
verbs: ["get", "patch"]
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
@@ -68,7 +73,7 @@ spec:
|
||||
args:
|
||||
- patch
|
||||
- validatingwebhookconfiguration
|
||||
- {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
- {{ $webhookname }}
|
||||
- --type=strategic
|
||||
- -p
|
||||
- |
|
||||
|
||||
@@ -377,6 +377,12 @@ notifier:
|
||||
controllerManager:
|
||||
## @param controllerManager.enabled Flag to enable controller manager
|
||||
enabled: false
|
||||
|
||||
## @param controllerManager.className specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs.
|
||||
className: ""
|
||||
## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.
|
||||
watchClassless: false
|
||||
|
||||
installAndUpgradeHook:
|
||||
## @param controllerManager.installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`)
|
||||
enabled: true
|
||||
@@ -395,7 +401,7 @@ controllerManager:
|
||||
repository: spiffe/spire-controller-manager
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: "0.3.0"
|
||||
tag: "0.4.0"
|
||||
|
||||
## @param controllerManager.resources [object] Resource requests and limits for controller manager
|
||||
resources: {}
|
||||
@@ -469,6 +475,8 @@ controllerManager:
|
||||
admin: false
|
||||
## @param controllerManager.identities.downstream Set if this spire instance is a root server and the workloads are downstream servers.
|
||||
downstream: false
|
||||
## @param controllerManager.identities.autoPopulateDNSNames Auto populate DNS names from services attached to pods
|
||||
autoPopulateDNSNames: false
|
||||
|
||||
validatingWebhookConfiguration:
|
||||
## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued
|
||||
|
||||
@@ -21,3 +21,13 @@ Warning: You're using an unsupported plugin. Functionality of this release and f
|
||||
|
||||
Warning: You're using an experimental config. Functionality of this release and future upgrades aren't guaranteed to work smoothly.
|
||||
{{- end }}
|
||||
{{- $className := include "spire-server.controller-manager-class-name" (dict "Values" (index .Values "spire-server") "Release" .Release) }}
|
||||
{{- if (index .Values "spire-server").controllerManager.enabled }}
|
||||
{{- if (index .Values "spire-server").controllerManager.watchClassless }}
|
||||
|
||||
Spire CR's will be handled if no className is specified or if className is set to "{{ $className }}"
|
||||
{{- else }}
|
||||
|
||||
Spire CR's will be handled only if className is set to "{{ $className }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
Reference in New Issue
Block a user