spire-controller-manager 0.4.0 support (#60)
Co-authored-by: Marco Franssen <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
co-authored by
Marco Franssen
Faisal Memon
Marco Franssen
Faisal Memon
parent
edf2381aad
commit
805d8696d0
@@ -215,13 +215,15 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
|
||||
| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
||||
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
||||
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
||||
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||
| `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
||||
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.3.0` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.0` |
|
||||
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
||||
| `controllerManager.securityContext` | Security context | `{}` |
|
||||
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
||||
@@ -240,6 +242,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.identities.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` |
|
||||
| `controllerManager.identities.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
|
||||
| `controllerManager.identities.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` |
|
||||
| `controllerManager.identities.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` |
|
||||
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
|
||||
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
|
||||
|
||||
@@ -220,3 +220,11 @@ The code below determines what connection type should be used.
|
||||
{{- end }}
|
||||
{{ $args | toYaml }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "spire-server.controller-manager-class-name" -}}
|
||||
{{- if .Values.controllerManager.className }}
|
||||
{{- .Values.controllerManager.className }}
|
||||
{{- else }}
|
||||
{{- .Release.Namespace }}-{{ .Release.Name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
apiVersion: spire.spiffe.io/v1alpha1
|
||||
kind: ClusterSPIFFEID
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" $root }}-service-account-based
|
||||
name: {{ $root.Release.Namespace }}-{{ include "spire-controller-manager.fullname" $root }}-service-account-based
|
||||
namespace: {{ include "spire-server.namespace" $root }}
|
||||
spec:
|
||||
spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }}
|
||||
@@ -36,5 +36,7 @@ spec:
|
||||
{{- end }}
|
||||
admin: {{ .identities.admin }}
|
||||
downstream: {{ .identities.downstream }}
|
||||
autoPopulateDNSNames: {{ .identities.autoPopulateDNSNames }}
|
||||
className: {{ include "spire-server.controller-manager-class-name" $root | quote}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -25,7 +25,7 @@ data:
|
||||
leaderElect: true
|
||||
resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
|
||||
resourceNamespace: {{ include "spire-server.namespace" . }}
|
||||
validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
clusterName: {{ include "spire-lib.cluster-name" . }}
|
||||
trustDomain: {{ include "spire-lib.trust-domain" . }}
|
||||
ignoreNamespaces:
|
||||
@@ -33,4 +33,6 @@ data:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
spireServerSocketPath: "/tmp/spire-server/private/api.sock"
|
||||
className: {{ include "spire-server.controller-manager-class-name" . | quote}}
|
||||
watchClassless: {{ .Values.controllerManager.watchClassless | toYaml }}
|
||||
{{- end }}
|
||||
|
||||
@@ -32,7 +32,7 @@ subjects:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["namespaces"]
|
||||
@@ -43,6 +43,9 @@ rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["endpoints"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
@@ -77,11 +80,11 @@ rules:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
name: {{ .Release.Namespace}}-{{ include "spire-controller-manager.fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire-server.serviceAccountName" . }}
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
webhooks:
|
||||
- admissionReviewVersions: ["v1"]
|
||||
clientConfig:
|
||||
|
||||
@@ -22,7 +22,7 @@ metadata:
|
||||
rules:
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}]
|
||||
resourceNames: [{{ printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) | quote }}]
|
||||
verbs: ["get", "patch"]
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
@@ -68,7 +68,7 @@ spec:
|
||||
args:
|
||||
- patch
|
||||
- validatingwebhookconfiguration
|
||||
- {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
- {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
- --type=strategic
|
||||
- -p
|
||||
- |
|
||||
|
||||
@@ -22,7 +22,7 @@ metadata:
|
||||
rules:
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}]
|
||||
resourceNames: [{{ printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) | quote }}]
|
||||
verbs: ["get", "patch"]
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
@@ -68,7 +68,7 @@ spec:
|
||||
args:
|
||||
- patch
|
||||
- validatingwebhookconfiguration
|
||||
- {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
- {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
- --type=strategic
|
||||
- -p
|
||||
- |
|
||||
|
||||
@@ -1,4 +1,9 @@
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- $webhookname := printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) }}
|
||||
{{- $oldwebhookname := printf "%s-webhook" (include "spire-controller-manager.fullname" .) }}
|
||||
{{- if not (lookup "admissionregistration.k8s.io/v1" "ValidatingWebhookConfiguration" "" $webhookname) }}
|
||||
{{- $webhookname = $oldwebhookname }}
|
||||
{{- end }}
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
|
||||
apiVersion: v1
|
||||
@@ -22,7 +27,7 @@ metadata:
|
||||
rules:
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}]
|
||||
resourceNames: [{{ $webhookname | quote }}]
|
||||
verbs: ["get", "patch"]
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
@@ -68,7 +73,7 @@ spec:
|
||||
args:
|
||||
- patch
|
||||
- validatingwebhookconfiguration
|
||||
- {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
- {{ $webhookname }}
|
||||
- --type=strategic
|
||||
- -p
|
||||
- |
|
||||
|
||||
@@ -377,6 +377,12 @@ notifier:
|
||||
controllerManager:
|
||||
## @param controllerManager.enabled Flag to enable controller manager
|
||||
enabled: false
|
||||
|
||||
## @param controllerManager.className specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs.
|
||||
className: ""
|
||||
## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.
|
||||
watchClassless: false
|
||||
|
||||
installAndUpgradeHook:
|
||||
## @param controllerManager.installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`)
|
||||
enabled: true
|
||||
@@ -395,7 +401,7 @@ controllerManager:
|
||||
repository: spiffe/spire-controller-manager
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: "0.3.0"
|
||||
tag: "0.4.0"
|
||||
|
||||
## @param controllerManager.resources [object] Resource requests and limits for controller manager
|
||||
resources: {}
|
||||
@@ -469,6 +475,8 @@ controllerManager:
|
||||
admin: false
|
||||
## @param controllerManager.identities.downstream Set if this spire instance is a root server and the workloads are downstream servers.
|
||||
downstream: false
|
||||
## @param controllerManager.identities.autoPopulateDNSNames Auto populate DNS names from services attached to pods
|
||||
autoPopulateDNSNames: false
|
||||
|
||||
validatingWebhookConfiguration:
|
||||
## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued
|
||||
|
||||
Reference in New Issue
Block a user