spire-controller-manager 0.4.0 support (#60)

Co-authored-by: Marco Franssen <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
2023-11-08 10:43:19 +00:00
parent edf2381aad
commit 805d8696d0
19 changed files with 105 additions and 19 deletions
@@ -220,3 +220,11 @@ The code below determines what connection type should be used.
 {{-   end }}
 {{ $args | toYaml }}
 {{- end -}}
+
+{{- define "spire-server.controller-manager-class-name" -}}
+{{-   if .Values.controllerManager.className }}
+{{-     .Values.controllerManager.className }}
+{{-   else }}
+{{-     .Release.Namespace }}-{{ .Release.Name }}
+{{-   end -}}
+{{- end -}}
@@ -4,7 +4,7 @@
 apiVersion: spire.spiffe.io/v1alpha1
 kind: ClusterSPIFFEID
 metadata:
-  name: {{ include "spire-controller-manager.fullname" $root }}-service-account-based
+  name: {{ $root.Release.Namespace }}-{{ include "spire-controller-manager.fullname" $root }}-service-account-based
  namespace: {{ include "spire-server.namespace" $root }}
 spec:
  spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }}
@@ -36,5 +36,7 @@ spec:
  {{- end }}
  admin: {{ .identities.admin }}
  downstream: {{ .identities.downstream }}
+  autoPopulateDNSNames: {{ .identities.autoPopulateDNSNames }}
+  className: {{ include "spire-server.controller-manager-class-name" $root | quote}}
 {{- end }}
 {{- end }}
@@ -25,7 +25,7 @@ data:
      leaderElect: true
      resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
      resourceNamespace: {{ include "spire-server.namespace" . }}
-    validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook
+    validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
    clusterName: {{ include "spire-lib.cluster-name" . }}
    trustDomain: {{ include "spire-lib.trust-domain" . }}
    ignoreNamespaces:
@@ -33,4 +33,6 @@ data:
      {{- toYaml . | nindent 6 }}
      {{- end }}
    spireServerSocketPath: "/tmp/spire-server/private/api.sock"
+    className: {{ include "spire-server.controller-manager-class-name" . | quote}}
+    watchClassless: {{ .Values.controllerManager.watchClassless | toYaml }}
 {{- end }}
@@ -32,7 +32,7 @@ subjects:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ include "spire-controller-manager.fullname" . }}
+  name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}
 rules:
  - apiGroups: [""]
    resources: ["namespaces"]
@@ -43,6 +43,9 @@ rules:
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["endpoints"]
+    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]
@@ -77,11 +80,11 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ include "spire-controller-manager.fullname" . }}
+  name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
-  name: {{ include "spire-controller-manager.fullname" . }}
+  name: {{ .Release.Namespace}}-{{ include "spire-controller-manager.fullname" . }}
 subjects:
 - kind: ServiceAccount
  name: {{ include "spire-server.serviceAccountName" . }}
@@ -2,7 +2,7 @@
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
-  name: {{ include "spire-controller-manager.fullname" . }}-webhook
+  name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
 webhooks:
  - admissionReviewVersions: ["v1"]
    clientConfig:
@@ -22,7 +22,7 @@ metadata:
 rules:
  - apiGroups: ["admissionregistration.k8s.io"]
    resources: ["validatingwebhookconfigurations"]
-    resourceNames: [{{ printf "%s-webhook"  (include "spire-controller-manager.fullname" .) | quote }}]
+    resourceNames: [{{ printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) | quote }}]
    verbs: ["get", "patch"]
 ---
 kind: ClusterRoleBinding
@@ -68,7 +68,7 @@ spec:
        args:
          - patch
          - validatingwebhookconfiguration
-          - {{ include "spire-controller-manager.fullname" . }}-webhook
+          - {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
          - --type=strategic
          - -p
          - |
@@ -22,7 +22,7 @@ metadata:
 rules:
  - apiGroups: ["admissionregistration.k8s.io"]
    resources: ["validatingwebhookconfigurations"]
-    resourceNames: [{{ printf "%s-webhook"  (include "spire-controller-manager.fullname" .) | quote }}]
+    resourceNames: [{{ printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) | quote }}]
    verbs: ["get", "patch"]
 ---
 kind: ClusterRoleBinding
@@ -68,7 +68,7 @@ spec:
        args:
          - patch
          - validatingwebhookconfiguration
-          - {{ include "spire-controller-manager.fullname" . }}-webhook
+          - {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
          - --type=strategic
          - -p
          - |
@@ -1,4 +1,9 @@
 {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
+{{- $webhookname := printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) }}
+{{- $oldwebhookname := printf "%s-webhook" (include "spire-controller-manager.fullname" .) }}
+{{- if not (lookup "admissionregistration.k8s.io/v1" "ValidatingWebhookConfiguration" "" $webhookname) }}
+{{- $webhookname = $oldwebhookname }}
+{{- end }}
 {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
 {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
 apiVersion: v1
@@ -22,7 +27,7 @@ metadata:
 rules:
  - apiGroups: ["admissionregistration.k8s.io"]
    resources: ["validatingwebhookconfigurations"]
-    resourceNames: [{{ printf "%s-webhook"  (include "spire-controller-manager.fullname" .) | quote }}]
+    resourceNames: [{{ $webhookname | quote }}]
    verbs: ["get", "patch"]
 ---
 kind: ClusterRoleBinding
@@ -68,7 +73,7 @@ spec:
        args:
          - patch
          - validatingwebhookconfiguration
-          - {{ include "spire-controller-manager.fullname" . }}-webhook
+          - {{ $webhookname }}
          - --type=strategic
          - -p
          - |