Update spike to the newest version (#665)
* Update spike bits Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Add trust roots. SPIKE SDK uses the appropriate trust root from the environment which makes SDK usage easier, but it requires additional env vars on the pod meta. Signed-off-by: Volkan Özçelik <[email protected]> * Chart updates to make it work with the new SDK changes of SPIKE. Signed-off-by: Volkan Özçelik <[email protected]> * Making the self-reference more evident. Signed-off-by: Volkan Özçelik <[email protected]> * Documentation update. Signed-off-by: Volkan Özçelik <[email protected]> * Documentation update. Signed-off-by: Volkan Özçelik <[email protected]> * updates to align with recent SPIKE. * SPIKE assumes all trust roots can be arrays (for distributed setups), modified values accordingly. * Added cross-references between bootstrap and keeper job/statefulsets for PoP validation to work. * other possible minor updates. Signed-off-by: Volkan Özçelik <[email protected]> * minor changes. Signed-off-by: Volkan Özçelik <[email protected]> * Update docs --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: Volkan Özçelik <[email protected]> Co-authored-by: Volkan Özçelik <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
co-authored by
Volkan Özçelik
Faisal Memon
Volkan Özçelik
Faisal Memon
parent
97c383b1cb
commit
813203a4d2
@@ -3,7 +3,7 @@ name: spike-keeper
|
||||
description: A Helm chart to deploy SPIKE Keeper
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "0.4.2"
|
||||
appVersion: "0.5.0"
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
- https://github.com/spiffe/spike
|
||||
|
||||
@@ -35,7 +35,9 @@ A Helm chart to deploy spike keepers
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `replicas` | The number of keepers to launch | `3` |
|
||||
| `trustRoot.nexus` | Override which trustRoot Nexus is in | `""` |
|
||||
| `trustRoot.nexus` | Override which trustRoot(s) Nexus is in (array) | `[]` |
|
||||
| `trustRoot.bootstrap` | Override which trustRoot(s) Bootstrap is in (array) | `[]` |
|
||||
| `trustRoot.self` | Override which trustRoot(s) this Keeper instance is in (array) | `[]` |
|
||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `debug` |
|
||||
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
||||
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
||||
|
||||
@@ -43,8 +43,13 @@ spec:
|
||||
value: {{ .Values.logLevel | upper }}
|
||||
- name: SPIKE_TRUST_ROOT
|
||||
value: {{ include "spire-lib.trust-domain" . }}
|
||||
- name: SPIKE_TRUST_ROOT_KEEPER
|
||||
value: {{ if gt (len .Values.trustRoot.self) 0 }}{{ .Values.trustRoot.self | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||
- name: SPIKE_TRUST_ROOT_NEXUS
|
||||
value: {{if eq .Values.trustRoot.nexus "" }}{{ include "spire-lib.trust-domain" . }}{{ else }}{{.Values.trustRoot.nexus }}{{ end }}
|
||||
value: {{ if gt (len .Values.trustRoot.nexus) 0 }}{{ .Values.trustRoot.nexus | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||
- name: SPIKE_TRUST_ROOT_BOOTSTRAP
|
||||
value: {{ if gt (len .Values.trustRoot.bootstrap) 0 }}{{ .Values.trustRoot.bootstrap | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||
|
||||
- name: SPIKE_KEEPER_TLS_PORT
|
||||
value: ":8443"
|
||||
{{- if .Values.startupProbe.enabled }}
|
||||
|
||||
@@ -21,8 +21,12 @@ image:
|
||||
replicas: 3
|
||||
|
||||
trustRoot:
|
||||
## @param trustRoot.nexus Override which trustRoot Nexus is in
|
||||
nexus: ""
|
||||
## @param trustRoot.nexus Override which trustRoot(s) Nexus is in (array)
|
||||
nexus: []
|
||||
## @param trustRoot.bootstrap Override which trustRoot(s) Bootstrap is in (array)
|
||||
bootstrap: []
|
||||
## @param trustRoot.self Override which trustRoot(s) this Keeper instance is in (array)
|
||||
self: []
|
||||
|
||||
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
||||
logLevel: debug
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spike-nexus
|
||||
description: A Helm chart to deploy SPIKE Nexus
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "0.4.2"
|
||||
appVersion: "0.5.0"
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
- https://github.com/spiffe/spike
|
||||
|
||||
@@ -29,19 +29,27 @@ A Helm chart to deploy spike nexus
|
||||
### Chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- |
|
||||
| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/spike-nexus` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `bootstrap.force` | Force bootstrapping | `false` |
|
||||
| `bootstrap.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `bootstrap.image.repository` | The repository within the registry | `spiffe/spike-bootstrap` |
|
||||
| `bootstrap.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `bootstrap.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `installAndUpgradeHook.enabled` | Enable Helm hook to bootstrap | `true` |
|
||||
| `backendStore` | The backend store to use. Must be one of [sqlite, memory, lite] | `sqlite` |
|
||||
| `replicas` | The number of keepers to launch | `1` |
|
||||
| `shamir.shares` | How many shares to configure for shamir secrets | `3` |
|
||||
| `shamir.threshold` | How many shares needed to recover | `2` |
|
||||
| `keeperPeers` | Keeper peer configuration. If blank, it will be autodetected | `[]` |
|
||||
| `trustRoot.nexus` | Override which trustRoot Nexus is in | `""` |
|
||||
| `trustRoot.keepers` | Override which trustRoot Keepers are in | `[]` |
|
||||
| `trustRoot.pilot` | Override which trustRoot Pilot is in | `""` |
|
||||
| `trustRoot.self` | Override which trustRoot(s) this SPIKE Nexus instance is in (array) | `[]` |
|
||||
| `trustRoot.keeper` | Override which trustRoot(s) Keeper is in (array) | `[]` |
|
||||
| `trustRoot.pilot` | Override which trustRoot(s) Pilot is in (array) | `[]` |
|
||||
| `trustRoot.bootstrap` | Override which trustRoot(s) Bootstrap is in (array) | `[]` |
|
||||
| `trustRoot.nexus` | Override which trustRoot(s) Nexus is in (array) | `[]` |
|
||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `debug` |
|
||||
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
||||
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
||||
|
||||
@@ -0,0 +1,125 @@
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spike-nexus.serviceAccountName" . }}-bootstrap
|
||||
namespace: {{ include "spike-nexus.namespace" . }}
|
||||
labels:
|
||||
{{- include "spike-nexus.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": "post-install,post-upgrade"
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "spike-nexus.fullname" . }}-bootstrap
|
||||
namespace: {{ include "spike-nexus.namespace" . }}
|
||||
annotations:
|
||||
"helm.sh/hook": "post-install,post-upgrade"
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["create","list"]
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["get", "update", "patch"]
|
||||
resourceNames:
|
||||
- {{ include "spike-nexus.fullname" . }}-bootstrap
|
||||
---
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "spike-nexus.fullname" . }}-bootstrap
|
||||
namespace: {{ include "spike-nexus.namespace" . }}
|
||||
annotations:
|
||||
"helm.sh/hook": "post-install,post-upgrade"
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spike-nexus.serviceAccountName" . }}-bootstrap
|
||||
namespace: {{ include "spike-nexus.namespace" . }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ include "spike-nexus.fullname" . }}-bootstrap
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ include "spike-nexus.fullname" . }}-bootstrap
|
||||
namespace: {{ include "spike-nexus.namespace" . }}
|
||||
labels:
|
||||
{{- include "spike-nexus.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": "post-install,post-upgrade"
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||
# "helm.sh/hook-delete-policy": before-hook-creation # for debugging.
|
||||
spec:
|
||||
# ttlSecondsAfterFinished: 3600 # 1 hour; useful for debugging
|
||||
template:
|
||||
metadata:
|
||||
name: {{ include "spike-nexus.fullname" . }}-bootstrap
|
||||
labels:
|
||||
{{- include "spike-nexus.labels" . | nindent 8 }}
|
||||
release: {{ .Release.Name }}
|
||||
release-namespace: {{ .Release.Namespace }}
|
||||
component: spike-bootstrap
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
serviceAccountName: {{ include "spike-nexus.serviceAccountName" . }}-bootstrap
|
||||
securityContext:
|
||||
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
|
||||
containers:
|
||||
- name: bootstrap-job
|
||||
securityContext:
|
||||
{{- include "spire-lib.securitycontext" . | nindent 10 }}
|
||||
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.bootstrap.image "global" .Values.global "ubi" false) }}
|
||||
command:
|
||||
- "/bootstrap"
|
||||
- "-init"
|
||||
{{- with (((.Values).global).installAndUpgradeHooks).resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: SPIKE_BOOTSTRAP_CONFIGMAP_NAME
|
||||
value: {{ include "spike-nexus.fullname" . }}-bootstrap
|
||||
- name: SPIKE_TRUST_ROOT
|
||||
value: {{ include "spire-lib.trust-domain" . }}
|
||||
- name: SPIKE_TRUST_ROOT_KEEPER
|
||||
value: {{ if gt (len .Values.trustRoot.keeper) 0 }}{{ .Values.trustRoot.keeper | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||
- name: SPIKE_TRUST_ROOT_BOOTSTRAP
|
||||
value: {{ if gt (len .Values.trustRoot.bootstrap) 0 }}{{ .Values.trustRoot.bootstrap | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||
# This is required for bootstrap to work while calling nexus for a pop validation.
|
||||
- name: SPIKE_TRUST_ROOT_NEXUS
|
||||
value: {{ if gt (len .Values.trustRoot.nexus) 0 }}{{ .Values.trustRoot.nexus | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||
- name: SPIKE_SYSTEM_LOG_LEVEL
|
||||
value: {{ .Values.logLevel | upper }}
|
||||
- name: SPIKE_NEXUS_KEEPER_PEERS
|
||||
{{- if gt (len .Values.keeperPeers) 0 }}
|
||||
value: {{ .Values.keeperPeers | join "," | quote }}
|
||||
{{- else }}
|
||||
value: https://{{ .Release.Name }}-spike-keeper-0.{{ .Release.Name }}-spike-keeper-headless:8443,https://{{ .Release.Name }}-spike-keeper-1.{{ .Release.Name }}-spike-keeper-headless:8443,https://{{ .Release.Name }}-spike-keeper-2.{{ .Release.Name }}-spike-keeper-headless:8443
|
||||
{{- end }}
|
||||
- name: SPIKE_NEXUS_SHAMIR_SHARES
|
||||
value: {{ .Values.shamir.shares | quote }}
|
||||
- name: SPIKE_NEXUS_SHAMIR_THRESHOLD
|
||||
value: {{ .Values.shamir.threshold | quote }}
|
||||
- name: SPIFFE_ENDPOINT_SOCKET
|
||||
value: unix://{{ include "spike-nexus.workload-api-socket-path" . }}
|
||||
- name: SPIKE_NEXUS_API_URL
|
||||
value: https://{{ include "spike-nexus.fullname" . }}:443
|
||||
- name: SPIKE_BOOTSTRAP_FORCE
|
||||
value: {{ .Values.bootstrap.force | toString | quote }}
|
||||
volumeMounts:
|
||||
- name: spiffe-workload-api
|
||||
mountPath: {{ include "spike-nexus.workload-api-socket-path" . | dir }}
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: spiffe-workload-api
|
||||
csi:
|
||||
driver: "{{ .Values.csiDriverName }}"
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
@@ -55,10 +55,15 @@ spec:
|
||||
value: {{ .Values.logLevel | upper }}
|
||||
- name: SPIKE_TRUST_ROOT
|
||||
value: {{ include "spire-lib.trust-domain" . }}
|
||||
- name: SPIKE_TRUST_ROOT_NEXUS
|
||||
value: {{ if gt (len .Values.trustRoot.self) 0 }}{{ .Values.trustRoot.self | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||
# required for nexus-bootstrap pop validation
|
||||
- name: SPIKE_TRUST_ROOT_BOOTSTRAP
|
||||
value: {{ if gt (len .Values.trustRoot.bootstrap) 0 }}{{ .Values.trustRoot.bootstrap | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||
- name: SPIKE_TRUST_ROOT_KEEPER
|
||||
value: {{ if gt (len .Values.trustRoot.keepers) 0 }}{{ .Values.trustRoot.keepers | join "," | quote}}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||
value: {{ if gt (len .Values.trustRoot.keeper) 0 }}{{ .Values.trustRoot.keeper | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||
- name: SPIKE_TRUST_ROOT_PILOT
|
||||
value: {{if eq .Values.trustRoot.pilot "" }}{{ include "spire-lib.trust-domain" . }}{{ else }}{{.Values.trustRoot.pilot }}{{ end }}
|
||||
value: {{ if gt (len .Values.trustRoot.pilot) 0 }}{{ .Values.trustRoot.pilot | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||
- name: SPIKE_NEXUS_TLS_PORT
|
||||
value: ":8443"
|
||||
{{- if .Values.startupProbe.enabled }}
|
||||
|
||||
@@ -17,6 +17,23 @@ image:
|
||||
pullPolicy: IfNotPresent
|
||||
tag: ""
|
||||
|
||||
bootstrap:
|
||||
## @param bootstrap.force Force bootstrapping
|
||||
force: false
|
||||
## @param bootstrap.image.registry The OCI registry to pull the image from
|
||||
## @param bootstrap.image.repository The repository within the registry
|
||||
## @param bootstrap.image.pullPolicy The image pull policy
|
||||
## @param bootstrap.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
image:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spike-bootstrap
|
||||
pullPolicy: IfNotPresent
|
||||
tag: ""
|
||||
|
||||
installAndUpgradeHook:
|
||||
## @param installAndUpgradeHook.enabled Enable Helm hook to bootstrap
|
||||
enabled: true
|
||||
|
||||
## @param backendStore The backend store to use. Must be one of [sqlite, memory, lite]
|
||||
backendStore: sqlite
|
||||
|
||||
@@ -33,12 +50,16 @@ shamir:
|
||||
keeperPeers: []
|
||||
|
||||
trustRoot:
|
||||
## @param trustRoot.nexus Override which trustRoot Nexus is in
|
||||
nexus: ""
|
||||
## @param trustRoot.keepers Override which trustRoot Keepers are in
|
||||
keepers: []
|
||||
## @param trustRoot.pilot Override which trustRoot Pilot is in
|
||||
pilot: ""
|
||||
## @param trustRoot.self Override which trustRoot(s) this SPIKE Nexus instance is in (array)
|
||||
self: []
|
||||
## @param trustRoot.keeper Override which trustRoot(s) Keeper is in (array)
|
||||
keeper: []
|
||||
## @param trustRoot.pilot Override which trustRoot(s) Pilot is in (array)
|
||||
pilot: []
|
||||
## @param trustRoot.bootstrap Override which trustRoot(s) Bootstrap is in (array)
|
||||
bootstrap: []
|
||||
## @param trustRoot.nexus Override which trustRoot(s) Nexus is in (array)
|
||||
nexus: []
|
||||
|
||||
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
||||
logLevel: debug
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spike-pilot
|
||||
description: A Helm chart to deploy SPIKE Pilot
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "0.4.2"
|
||||
appVersion: "0.5.0"
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
- https://github.com/spiffe/spike
|
||||
|
||||
@@ -43,7 +43,8 @@ A Helm chart to deploy spike pilot
|
||||
| `tools.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tools.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` |
|
||||
| `replicas` | The number of keepers to launch | `1` |
|
||||
| `trustRoot.nexus` | Override which trustRoot Nexus is in | `""` |
|
||||
| `trustRoot.nexus` | Override which trustRoot(s) Nexus is in (array) | `[]` |
|
||||
| `trustRoot.pilot` | Override which trustRoot(s) this SPIKE Pilot instance is in (array) | `[]` |
|
||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `debug` |
|
||||
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
||||
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
||||
|
||||
@@ -62,7 +62,9 @@ spec:
|
||||
- name: SPIKE_TRUST_ROOT
|
||||
value: {{ include "spire-lib.trust-domain" . }}
|
||||
- name: SPIKE_TRUST_ROOT_NEXUS
|
||||
value: {{if eq .Values.trustRoot.Nexus "" }}{{ include "spire-lib.trust-domain" . }}{{ else }}{{.Values.trustRoot.Nexus }}{{ end }}
|
||||
value: {{ if gt (len .Values.trustRoot.nexus) 0 }}{{ .Values.trustRoot.nexus | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||
- name: SPIKE_TRUST_ROOT_PILOT
|
||||
value: {{ if gt (len .Values.trustRoot.pilot) 0 }}{{ .Values.trustRoot.pilot | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||
volumeMounts:
|
||||
- name: spiffe-workload-api
|
||||
mountPath: {{ include "spike-pilot.workload-api-socket-path" . | dir }}
|
||||
|
||||
@@ -46,8 +46,10 @@ tools:
|
||||
replicas: 1
|
||||
|
||||
trustRoot:
|
||||
## @param trustRoot.nexus Override which trustRoot Nexus is in
|
||||
nexus: ""
|
||||
## @param trustRoot.nexus Override which trustRoot(s) Nexus is in (array)
|
||||
nexus: []
|
||||
## @param trustRoot.pilot Override which trustRoot(s) this SPIKE Pilot instance is in (array)
|
||||
pilot: []
|
||||
|
||||
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
||||
logLevel: debug
|
||||
|
||||
@@ -318,10 +318,13 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.type` | The type of rule this is. | `test-keys` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type` | The type of rule this is. | `spike-keeper` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/keeper` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/keeper/{{ .PodMeta.Name }}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type` | The type of rule this is. | `spike-nexus` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/nexus` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/nexus/{{ .PodMeta.Name }}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.type` | The type of rule this is. | `spike-bootstrap` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/bootstrap/{{ .PodMeta.Name }}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.type` | The type of rule this is. | `spike-pilot` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/pilot/role/superuser` |
|
||||
|
||||
@@ -27,6 +27,11 @@ matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
release-namespace: {{ .Release.Namespace }}
|
||||
component: spike-nexus
|
||||
{{- else if eq .type "spike-bootstrap" }}
|
||||
matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
release-namespace: {{ .Release.Namespace }}
|
||||
component: spike-bootstrap
|
||||
{{- else if eq .type "spike-pilot" }}
|
||||
matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
@@ -53,8 +58,8 @@ matchLabels:
|
||||
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
|
||||
{{- $type := dig "type" "base" $value }}
|
||||
{{- if not (has $type (list "base" "raw" "child-servers" "oidc-discovery-provider" "spike-keeper" "spike-nexus" "spike-pilot" "test-keys")) }}
|
||||
{{- fail (printf "Type given: %s, must be one of [base, raw, child-servers, oidc-discovery-provider, spike-keeper, spike-nexus, spike-pilot, test-keys]" $type) }}
|
||||
{{- if not (has $type (list "base" "raw" "child-servers" "oidc-discovery-provider" "spike-keeper" "spike-nexus" "spike-bootstrap" "spike-pilot" "test-keys")) }}
|
||||
{{- fail (printf "Type given: %s, must be one of [base, raw, child-servers, oidc-discovery-provider, spike-keeper, spike-nexus, spike-bootstrap, spike-pilot, test-keys]" $type) }}
|
||||
{{- end }}
|
||||
{{- $namespaceSelector := deepCopy (dig "namespaceSelector" (dict) $value) }}
|
||||
{{- if ne $type "raw" }}
|
||||
|
||||
@@ -717,14 +717,21 @@ controllerManager:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type The type of rule this is.
|
||||
type: spike-keeper
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate The template to use for this rule.
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/keeper
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/keeper/{{ .PodMeta.Name }}
|
||||
spike-nexus:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.enabled Enable this identity for controller manager
|
||||
enabled: true
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type The type of rule this is.
|
||||
type: spike-nexus
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate The template to use for this rule.
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/nexus
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/nexus/{{ .PodMeta.Name }}
|
||||
spike-bootstrap:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.enabled Enable this identity for controller manager
|
||||
enabled: true
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.type The type of rule this is.
|
||||
type: spike-bootstrap
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.spiffeIDTemplate The template to use for this rule.
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/bootstrap/{{ .PodMeta.Name }}
|
||||
spike-pilot:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.enabled Enable this identity for controller manager
|
||||
enabled: true
|
||||
|
||||
Reference in New Issue
Block a user