Ingress type openshift (#52)
* Specify ingress controller type Signed-off-by: Kevin Fox <[email protected]> * Fix indenting, docs Signed-off-by: Kevin Fox <[email protected]> * Fix spacing Signed-off-by: Kevin Fox <[email protected]> * Fix missing brackets Signed-off-by: Kevin Fox <[email protected]> * Fix missing brackets Signed-off-by: Kevin Fox <[email protected]> * Add ingress-nginx support Signed-off-by: Kevin Fox <[email protected]> * Use the right example values for test version to upgrade from. Signed-off-by: Kevin Fox <[email protected]> * Fix var in wrong location Signed-off-by: Kevin Fox <[email protected]> * Fix missing arg Signed-off-by: Kevin Fox <[email protected]> * Try this to checkout the right version Signed-off-by: Kevin Fox <[email protected]> * Switch to upgrading from 0.14.0 Signed-off-by: Kevin Fox <[email protected]> * Install crds Signed-off-by: Kevin Fox <[email protected]> * Simple ingress support For a lot of situations, ingress rules can be derived from trustDomain. Change the code to generate rules by default for the user. Signed-off-by: Kevin Fox <[email protected]> * Add upgrade test fix from 43 Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Enable unset ingress controller type to use with openshift later Signed-off-by: Kevin Fox <[email protected]> * Openshift ingress controller type support Signed-off-by: Kevin Fox <[email protected]> * Fix missing end tag Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflicts Signed-off-by: Kevin Fox <[email protected]> * Fix doc merge conflicts Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflicts Signed-off-by: Kevin Fox <[email protected]> * Fix automatically generated rules on openshift Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Fix pathType Signed-off-by: Kevin Fox <[email protected]> * Make openshift edge rules work Signed-off-by: Kevin Fox <[email protected]> * Fix var scoping Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix issue created during merge conflict Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]> Co-authored-by: Mariusz Sabath <[email protected]>
This commit is contained in:
kfox1111
co-authored by
Faisal Memon
Mariusz Sabath
Faisal Memon
Mariusz Sabath
parent
2dce90f44e
commit
81cc2dc573
+13
-13
@@ -133,19 +133,19 @@ Now you can interact with the Spire agent socket from your own application. The
|
|||||||
|
|
||||||
### Global parameters
|
### Global parameters
|
||||||
|
|
||||||
| Name | Description | Value |
|
| Name | Description | Value |
|
||||||
| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- |
|
| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- |
|
||||||
| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` |
|
| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` |
|
||||||
| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` |
|
| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` |
|
||||||
| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` |
|
| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` |
|
||||||
| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens | `oidc-discovery.example.org` |
|
| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens | `oidc-discovery.example.org` |
|
||||||
| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` |
|
| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` |
|
||||||
| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` |
|
| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` |
|
||||||
| `global.spire.image.registry` | Override all Spire image registries at once | `""` |
|
| `global.spire.image.registry` | Override all Spire image registries at once | `""` |
|
||||||
| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` |
|
| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` |
|
||||||
| `global.spire.ingressControllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
| `global.spire.ingressControllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||||
| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||||
| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||||
|
|
||||||
### Spire server parameters
|
### Spire server parameters
|
||||||
|
|
||||||
|
|||||||
@@ -29,104 +29,104 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
|||||||
|
|
||||||
### Chart parameters
|
### Chart parameters
|
||||||
|
|
||||||
| Name | Description | Value |
|
| Name | Description | Value |
|
||||||
| ----------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
| ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||||
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
||||||
| `replicaCount` | Replica count | `1` |
|
| `replicaCount` | Replica count | `1` |
|
||||||
| `namespaceOverride` | Namespace override | `""` |
|
| `namespaceOverride` | Namespace override | `""` |
|
||||||
| `annotations` | Annotations for the deployment | `{}` |
|
| `annotations` | Annotations for the deployment | `{}` |
|
||||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `image.repository` | The repository within the registry | `spiffe/oidc-discovery-provider` |
|
| `image.repository` | The repository within the registry | `spiffe/oidc-discovery-provider` |
|
||||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
| `resources` | Resource requests and limits | `{}` |
|
| `resources` | Resource requests and limits | `{}` |
|
||||||
| `service.type` | Service type | `ClusterIP` |
|
| `service.type` | Service type | `ClusterIP` |
|
||||||
| `service.port` | Service port | `80` |
|
| `service.port` | Service port | `80` |
|
||||||
| `service.annotations` | Annotations for service resource | `{}` |
|
| `service.annotations` | Annotations for service resource | `{}` |
|
||||||
| `configMap.annotations` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | `{}` |
|
| `configMap.annotations` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | `{}` |
|
||||||
| `podSecurityContext` | Pod security context for OIDC discovery provider pods | `{}` |
|
| `podSecurityContext` | Pod security context for OIDC discovery provider pods | `{}` |
|
||||||
| `securityContext` | Security context for OIDC discovery provider deployment | `{}` |
|
| `securityContext` | Security context for OIDC discovery provider deployment | `{}` |
|
||||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
||||||
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
||||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
|
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
|
||||||
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` |
|
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` |
|
||||||
| `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` |
|
| `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` |
|
||||||
| `insecureScheme.enabled` | Flag to enable insecure schema | `false` |
|
| `insecureScheme.enabled` | Flag to enable insecure schema | `false` |
|
||||||
| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||||
| `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` |
|
| `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` |
|
||||||
| `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.2-alpine` |
|
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.2-alpine` |
|
||||||
| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` |
|
| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` |
|
||||||
| `jwtIssuer` | Path to JWT issuer | `https://oidc-discovery.example.org` |
|
| `jwtIssuer` | Path to JWT issuer | `https://oidc-discovery.example.org` |
|
||||||
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||||
| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` |
|
| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` |
|
||||||
| `config.acme.tosAccepted` | Flag for Terms of Service acceptance | `false` |
|
| `config.acme.tosAccepted` | Flag for Terms of Service acceptance | `false` |
|
||||||
| `config.acme.cacheDir` | Path for cache directory | `/run/spire` |
|
| `config.acme.cacheDir` | Path for cache directory | `/run/spire` |
|
||||||
| `config.acme.directoryUrl` | URL for acme directory | `https://acme-v02.api.letsencrypt.org/directory` |
|
| `config.acme.directoryUrl` | URL for acme directory | `https://acme-v02.api.letsencrypt.org/directory` |
|
||||||
| `config.acme.emailAddress` | Email address for registration | `[email protected]` |
|
| `config.acme.emailAddress` | Email address for registration | `[email protected]` |
|
||||||
| `imagePullSecrets` | Image pull secret names | `[]` |
|
| `imagePullSecrets` | Image pull secret names | `[]` |
|
||||||
| `nameOverride` | Name override | `""` |
|
| `nameOverride` | Name override | `""` |
|
||||||
| `fullnameOverride` | Full name override | `""` |
|
| `fullnameOverride` | Full name override | `""` |
|
||||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||||
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
||||||
| `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
| `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||||
| `autoscaling.enabled` | Flag to enable autoscaling | `false` |
|
| `autoscaling.enabled` | Flag to enable autoscaling | `false` |
|
||||||
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
|
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
|
||||||
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` |
|
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` |
|
||||||
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` |
|
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` |
|
||||||
| `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` |
|
| `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` |
|
||||||
| `nodeSelector` | Node selector | `{}` |
|
| `nodeSelector` | Node selector | `{}` |
|
||||||
| `tolerations` | iist of tolerations | `[]` |
|
| `tolerations` | iist of tolerations | `[]` |
|
||||||
| `affinity` | Node affinity | `{}` |
|
| `affinity` | Node affinity | `{}` |
|
||||||
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
|
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||||
| `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` |
|
| `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` |
|
||||||
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
||||||
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
|
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
|
||||||
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
||||||
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the helm release | `""` |
|
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the helm release | `""` |
|
||||||
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||||
| `telemetry.prometheus.nginxExporter.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
| `telemetry.prometheus.nginxExporter.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||||
| `telemetry.prometheus.nginxExporter.image.repository` | The repository within the registry | `nginx/nginx-prometheus-exporter` |
|
| `telemetry.prometheus.nginxExporter.image.repository` | The repository within the registry | `nginx/nginx-prometheus-exporter` |
|
||||||
| `telemetry.prometheus.nginxExporter.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `telemetry.prometheus.nginxExporter.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `telemetry.prometheus.nginxExporter.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| `telemetry.prometheus.nginxExporter.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
| `telemetry.prometheus.nginxExporter.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.11.0` |
|
| `telemetry.prometheus.nginxExporter.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.11.0` |
|
||||||
| `telemetry.prometheus.nginxExporter.resources` | Resource requests and limits | `{}` |
|
| `telemetry.prometheus.nginxExporter.resources` | Resource requests and limits | `{}` |
|
||||||
| `ingress.enabled` | Flag to enable ingress | `false` |
|
| `ingress.enabled` | Flag to enable ingress | `false` |
|
||||||
| `ingress.className` | Ingress class name | `""` |
|
| `ingress.className` | Ingress class name | `""` |
|
||||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||||
| `ingress.annotations` | Annotations for ingress object | `{}` |
|
| `ingress.annotations` | Annotations for ingress object | `{}` |
|
||||||
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `oidc-discovery` |
|
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `oidc-discovery` |
|
||||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||||
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||||
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||||
| `tests.hostAliases` | List of host aliases for testing | `[]` |
|
| `tests.hostAliases` | List of host aliases for testing | `[]` |
|
||||||
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
|
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
|
||||||
| `tests.tls.customCA` | Custom CA value for tests | `""` |
|
| `tests.tls.customCA` | Custom CA value for tests | `""` |
|
||||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c` |
|
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c` |
|
||||||
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
| `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||||
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` |
|
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` |
|
||||||
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c3bb333d1d8a0e6262aa6e0b1e01e2833822ab0a9812d2668a23869888ebf0be` |
|
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:c3bb333d1d8a0e6262aa6e0b1e01e2833822ab0a9812d2668a23869888ebf0be` |
|
||||||
| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` |
|
| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` |
|
||||||
| `tests.busybox.image.repository` | The repository within the registry | `busybox` |
|
| `tests.busybox.image.repository` | The repository within the registry | `busybox` |
|
||||||
| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `tests.busybox.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| `tests.busybox.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
| `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` |
|
| `tests.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` |
|
||||||
| `tests.agent.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `tests.agent.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `tests.agent.image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
| `tests.agent.image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
||||||
| `tests.agent.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `tests.agent.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `tests.agent.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| `tests.agent.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
| `tests.agent.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
| `tests.agent.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||||
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
|
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
|
||||||
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
|
|||||||
@@ -1,10 +1,14 @@
|
|||||||
{{- if .Values.ingress.enabled -}}
|
{{- if .Values.ingress.enabled -}}
|
||||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
|
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
|
||||||
{{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . }}
|
{{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||||
|
{{- $tlsSection := true }}
|
||||||
{{- $annotations := deepCopy .Values.ingress.annotations }}
|
{{- $annotations := deepCopy .Values.ingress.annotations }}
|
||||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||||
|
{{- else if eq $ingressControllerType "openshift" }}
|
||||||
|
{{- $_ := set $annotations "route.openshift.io/termination" "edge" }}
|
||||||
|
{{- $tlsSection = false }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
apiVersion: networking.k8s.io/v1
|
apiVersion: networking.k8s.io/v1
|
||||||
kind: Ingress
|
kind: Ingress
|
||||||
@@ -18,5 +22,5 @@ metadata:
|
|||||||
{{- toYaml . | nindent 4 }}
|
{{- toYaml . | nindent 4 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "Values" .Values) | nindent 2 }}
|
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -241,7 +241,7 @@ ingress:
|
|||||||
enabled: false
|
enabled: false
|
||||||
## @param ingress.className Ingress class name
|
## @param ingress.className Ingress class name
|
||||||
className: ""
|
className: ""
|
||||||
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""].
|
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||||
controllerType: ""
|
controllerType: ""
|
||||||
## @param ingress.annotations [object] Annotations for ingress object
|
## @param ingress.annotations [object] Annotations for ingress object
|
||||||
annotations: {}
|
annotations: {}
|
||||||
|
|||||||
@@ -150,7 +150,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` |
|
| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` |
|
||||||
| `federation.ingress.enabled` | Flag to enable ingress for federation | `false` |
|
| `federation.ingress.enabled` | Flag to enable ingress for federation | `false` |
|
||||||
| `federation.ingress.className` | Ingress class name for federation | `""` |
|
| `federation.ingress.className` | Ingress class name for federation | `""` |
|
||||||
| `federation.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
| `federation.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||||
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
|
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||||
| `federation.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server-federation` |
|
| `federation.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server-federation` |
|
||||||
| `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
| `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||||
@@ -247,7 +247,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||||
| `ingress.enabled` | Flag to enable ingress | `false` |
|
| `ingress.enabled` | Flag to enable ingress | `false` |
|
||||||
| `ingress.className` | Ingress class name | `""` |
|
| `ingress.className` | Ingress class name | `""` |
|
||||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||||
| `ingress.annotations` | Annotations for the ingress object | `{}` |
|
| `ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||||
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server` |
|
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server` |
|
||||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||||
@@ -275,7 +275,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `tornjak.service.annotations` | Annotations for the service | `{}` |
|
| `tornjak.service.annotations` | Annotations for the service | `{}` |
|
||||||
| `tornjak.ingress.enabled` | Flag to enable ingress for Tornjak backend service | `false` |
|
| `tornjak.ingress.enabled` | Flag to enable ingress for Tornjak backend service | `false` |
|
||||||
| `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` |
|
| `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` |
|
||||||
| `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
| `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||||
| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` |
|
| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` |
|
||||||
| `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` |
|
| `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` |
|
||||||
| `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
| `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||||
|
|||||||
@@ -2,11 +2,15 @@
|
|||||||
{{- if .Values.federation.ingress.enabled -}}
|
{{- if .Values.federation.ingress.enabled -}}
|
||||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.federation.ingress) }}
|
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.federation.ingress) }}
|
||||||
{{- $svcName := include "spire-server.fullname" . }}
|
{{- $svcName := include "spire-server.fullname" . }}
|
||||||
|
{{- $tlsSection := true }}
|
||||||
{{- $annotations := deepCopy .Values.federation.ingress.annotations }}
|
{{- $annotations := deepCopy .Values.federation.ingress.annotations }}
|
||||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||||
|
{{- else if eq $ingressControllerType "openshift" }}
|
||||||
|
{{- $_ := set $annotations "route.openshift.io/termination" "edge" }}
|
||||||
|
{{- $tlsSection = false }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
apiVersion: networking.k8s.io/v1
|
apiVersion: networking.k8s.io/v1
|
||||||
kind: Ingress
|
kind: Ingress
|
||||||
@@ -20,6 +24,6 @@ metadata:
|
|||||||
{{- toYaml . | nindent 4 }}
|
{{- toYaml . | nindent 4 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "Values" .Values) | nindent 2 }}
|
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -1,12 +1,20 @@
|
|||||||
{{- if .Values.ingress.enabled -}}
|
{{- if .Values.ingress.enabled -}}
|
||||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
|
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
|
||||||
{{- $fullName := include "spire-server.fullname" . -}}
|
{{- $fullName := include "spire-server.fullname" . -}}
|
||||||
|
{{- $path := "/" }}
|
||||||
|
{{- $pathType := "Prefix" }}
|
||||||
|
{{- $tlsSection := true }}
|
||||||
{{- $annotations := deepCopy .Values.ingress.annotations }}
|
{{- $annotations := deepCopy .Values.ingress.annotations }}
|
||||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||||
|
{{- else if eq $ingressControllerType "openshift" }}
|
||||||
|
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||||
|
{{- $path = "" }}
|
||||||
|
{{- $pathType = "ImplementationSpecific" }}
|
||||||
|
{{- $tlsSection = false }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
apiVersion: networking.k8s.io/v1
|
apiVersion: networking.k8s.io/v1
|
||||||
kind: Ingress
|
kind: Ingress
|
||||||
@@ -20,5 +28,5 @@ metadata:
|
|||||||
{{- toYaml . | nindent 4 }}
|
{{- toYaml . | nindent 4 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "Values" .Values) | nindent 2 }}
|
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -1,6 +1,9 @@
|
|||||||
{{- if .Values.tornjak.ingress.enabled -}}
|
{{- if .Values.tornjak.ingress.enabled -}}
|
||||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.tornjak.ingress) }}
|
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.tornjak.ingress) }}
|
||||||
{{- $fullName := include "spire-tornjak.fullname" . -}}
|
{{- $fullName := include "spire-tornjak.fullname" . -}}
|
||||||
|
{{- $path := "/" }}
|
||||||
|
{{- $pathType := "Prefix" }}
|
||||||
|
{{- $tlsSection := true }}
|
||||||
{{- $annotations := deepCopy .Values.tornjak.ingress.annotations }}
|
{{- $annotations := deepCopy .Values.tornjak.ingress.annotations }}
|
||||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||||
@@ -9,6 +12,15 @@
|
|||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- else if eq $ingressControllerType "openshift" }}
|
||||||
|
{{- $tlsSection = false }}
|
||||||
|
{{- if ne (include "spire-tornjak.connectionType" .) "http" }}
|
||||||
|
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||||
|
{{- $path = "" }}
|
||||||
|
{{- $pathType = "ImplementationSpecific" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- $_ := set $annotations "route.openshift.io/termination" "edge" }}
|
||||||
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
apiVersion: networking.k8s.io/v1
|
apiVersion: networking.k8s.io/v1
|
||||||
kind: Ingress
|
kind: Ingress
|
||||||
@@ -23,8 +35,8 @@ metadata:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
{{- if eq (include "spire-tornjak.connectionType" .) "http" }}
|
{{- if eq (include "spire-tornjak.connectionType" .) "http" }}
|
||||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.http "Values" .Values) | nindent 2 }}
|
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.http "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||||
{{- else -}}
|
{{- else -}}
|
||||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.https "Values" .Values) | nindent 2 }}
|
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.https "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||||
{{- end -}}
|
{{- end -}}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -202,7 +202,7 @@ federation:
|
|||||||
enabled: false
|
enabled: false
|
||||||
## @param federation.ingress.className Ingress class name for federation
|
## @param federation.ingress.className Ingress class name for federation
|
||||||
className: ""
|
className: ""
|
||||||
## @param federation.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""].
|
## @param federation.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||||
controllerType: ""
|
controllerType: ""
|
||||||
## @param federation.ingress.annotations [object] Annotations for the ingress object
|
## @param federation.ingress.annotations [object] Annotations for the ingress object
|
||||||
annotations: {}
|
annotations: {}
|
||||||
@@ -496,7 +496,7 @@ ingress:
|
|||||||
enabled: false
|
enabled: false
|
||||||
## @param ingress.className Ingress class name
|
## @param ingress.className Ingress class name
|
||||||
className: ""
|
className: ""
|
||||||
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""].
|
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||||
controllerType: ""
|
controllerType: ""
|
||||||
## @param ingress.annotations [object] Annotations for the ingress object
|
## @param ingress.annotations [object] Annotations for the ingress object
|
||||||
annotations: {}
|
annotations: {}
|
||||||
@@ -582,7 +582,7 @@ tornjak:
|
|||||||
|
|
||||||
## @param tornjak.ingress.enabled Flag to enable ingress for Tornjak backend service
|
## @param tornjak.ingress.enabled Flag to enable ingress for Tornjak backend service
|
||||||
## @param tornjak.ingress.className Ingress class name for Tornjak backend service
|
## @param tornjak.ingress.className Ingress class name for Tornjak backend service
|
||||||
## @param tornjak.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""].
|
## @param tornjak.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||||
## @param tornjak.ingress.annotations [object] Annotations for Tornjak backend service
|
## @param tornjak.ingress.annotations [object] Annotations for Tornjak backend service
|
||||||
ingress:
|
ingress:
|
||||||
enabled: false
|
enabled: false
|
||||||
|
|||||||
@@ -56,49 +56,49 @@ port forwarding. See the chart NOTES output for more details.
|
|||||||
|
|
||||||
### Chart parameters
|
### Chart parameters
|
||||||
|
|
||||||
| Name | Description | Value |
|
| Name | Description | Value |
|
||||||
| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` |
|
| `image.repository` | The repository within the registry | `spiffe/tornjak-frontend` |
|
||||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||||
| `nameOverride` | Name override | `""` |
|
| `nameOverride` | Name override | `""` |
|
||||||
| `namespaceOverride` | Namespace override | `""` |
|
| `namespaceOverride` | Namespace override | `""` |
|
||||||
| `fullnameOverride` | Fullname override | `""` |
|
| `fullnameOverride` | Fullname override | `""` |
|
||||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||||
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
||||||
| `labels` | Labels for tornjak frontend pods | `{}` |
|
| `labels` | Labels for tornjak frontend pods | `{}` |
|
||||||
| `podSecurityContext` | Pod security context | `{}` |
|
| `podSecurityContext` | Pod security context | `{}` |
|
||||||
| `securityContext` | Security context | `{}` |
|
| `securityContext` | Security context | `{}` |
|
||||||
| `service.type` | Service type | `ClusterIP` |
|
| `service.type` | Service type | `ClusterIP` |
|
||||||
| `service.port` | Service port | `3000` |
|
| `service.port` | Service port | `3000` |
|
||||||
| `service.annotations` | Annotations for service resource | `{}` |
|
| `service.annotations` | Annotations for service resource | `{}` |
|
||||||
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | |
|
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | |
|
||||||
| `affinity` | Affinity rules | `{}` |
|
| `affinity` | Affinity rules | `{}` |
|
||||||
| `tolerations` | List of tolerations | `[]` |
|
| `tolerations` | List of tolerations | `[]` |
|
||||||
| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` |
|
| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` |
|
||||||
| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. | `http://localhost:10000/` |
|
| `apiServerURL` | URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. | `http://localhost:10000/` |
|
||||||
| `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` |
|
| `spireHealthCheck.enabled` | Enables the SPIRE Healthchecker indicator | `true` |
|
||||||
| `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` |
|
| `startupProbe.enabled` | Enable startupProbe on Tornjak frontend container | `true` |
|
||||||
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` |
|
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` |
|
||||||
| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
|
| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
|
||||||
| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
|
| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
|
||||||
| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` |
|
| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` |
|
||||||
| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` |
|
| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` |
|
||||||
| `workingDir` | Path containing the Tornjak frontend within the image | `/usr/src/app` |
|
| `workingDir` | Path containing the Tornjak frontend within the image | `/usr/src/app` |
|
||||||
| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` |
|
| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` |
|
||||||
| `ingress.className` | Ingress class name for Tornjak frontend service | `""` |
|
| `ingress.className` | Ingress class name for Tornjak frontend service | `""` |
|
||||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||||
| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` |
|
| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` |
|
||||||
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-frontend` |
|
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-frontend` |
|
||||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||||
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||||
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c` |
|
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:28d175c9578c85d09fc9242f211324e9c3cc4d073db5bff349e986df76ab0d4c` |
|
||||||
|
|||||||
@@ -1,10 +1,14 @@
|
|||||||
{{- if .Values.ingress.enabled -}}
|
{{- if .Values.ingress.enabled -}}
|
||||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
|
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
|
||||||
{{- $fullName := include "tornjak-frontend.fullname" . -}}
|
{{- $fullName := include "tornjak-frontend.fullname" . -}}
|
||||||
|
{{- $tlsSection := true }}
|
||||||
{{- $annotations := deepCopy .Values.ingress.annotations }}
|
{{- $annotations := deepCopy .Values.ingress.annotations }}
|
||||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||||
|
{{- else if eq $ingressControllerType "openshift" }}
|
||||||
|
{{- $_ := set $annotations "route.openshift.io/termination" "edge" }}
|
||||||
|
{{- $tlsSection = false }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
apiVersion: networking.k8s.io/v1
|
apiVersion: networking.k8s.io/v1
|
||||||
kind: Ingress
|
kind: Ingress
|
||||||
@@ -18,5 +22,5 @@ metadata:
|
|||||||
{{- toYaml . | nindent 4 }}
|
{{- toYaml . | nindent 4 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "Values" .Values) | nindent 2 }}
|
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -118,7 +118,7 @@ workingDir: /usr/src/app
|
|||||||
|
|
||||||
## @param ingress.enabled Flag to enable ingress for Tornjak frontend service
|
## @param ingress.enabled Flag to enable ingress for Tornjak frontend service
|
||||||
## @param ingress.className Ingress class name for Tornjak frontend service
|
## @param ingress.className Ingress class name for Tornjak frontend service
|
||||||
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""].
|
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||||
## @param ingress.annotations [object] Annotations for Tornjak frontend service
|
## @param ingress.annotations [object] Annotations for Tornjak frontend service
|
||||||
ingress:
|
ingress:
|
||||||
enabled: false
|
enabled: false
|
||||||
|
|||||||
@@ -71,11 +71,13 @@
|
|||||||
{{- $type = .global.spire.ingressControllerType }}
|
{{- $type = .global.spire.ingressControllerType }}
|
||||||
{{- else if ne .ingress.controllerType "" }}
|
{{- else if ne .ingress.controllerType "" }}
|
||||||
{{- $type = .ingress.controllerType }}
|
{{- $type = .ingress.controllerType }}
|
||||||
|
{{- else if (dig "openshift" false .global) }}
|
||||||
|
{{- $type = "openshift" }}
|
||||||
{{- else }}
|
{{- else }}
|
||||||
{{- $type = "other" }}
|
{{- $type = "other" }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- if not (has $type (list "other" "ingress-nginx")) }}
|
{{- if not (has $type (list "ingress-nginx" "openshift" "other")) }}
|
||||||
{{- fail "Unsupported ingress controller type specified. Must be one of [other, ingress-nginx]" }}
|
{{- fail "Unsupported ingress controller type specified. Must be one of [ingress-nginx, openshift, other]" }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- $type }}
|
{{- $type }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
@@ -96,6 +98,9 @@
|
|||||||
* ingress - the standardized ingress object
|
* ingress - the standardized ingress object
|
||||||
* svcName - The service to route to
|
* svcName - The service to route to
|
||||||
* port - which port on the service to use
|
* port - which port on the service to use
|
||||||
|
* path - optional path to set on the rules
|
||||||
|
* pathType - typical ingress path type
|
||||||
|
* tlsSection - bool specifying to add by default the tls section to the ingress. Ingress-nginx needs true, openshift needs false.
|
||||||
* Values - Chart values
|
* Values - Chart values
|
||||||
*/}}
|
*/}}
|
||||||
{{ define "spire-lib.ingress-spec" }}
|
{{ define "spire-lib.ingress-spec" }}
|
||||||
@@ -106,18 +111,22 @@
|
|||||||
ingressClassName: {{ . | quote }}
|
ingressClassName: {{ . | quote }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- if eq (add (len .ingress.tls) (len .ingress.hosts)) 0 }}
|
{{- if eq (add (len .ingress.tls) (len .ingress.hosts)) 0 }}
|
||||||
|
{{ if or .tlsSection .ingress.tlsSecret }}
|
||||||
tls:
|
tls:
|
||||||
- hosts:
|
- hosts:
|
||||||
- {{ $host | quote }}
|
- {{ $host | quote }}
|
||||||
{{- with .ingress.tlsSecret }}
|
{{- with .ingress.tlsSecret }}
|
||||||
secretName: {{ . | quote }}
|
secretName: {{ . | quote }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
rules:
|
rules:
|
||||||
- host: {{ $host | quote }}
|
- host: {{ $host | quote }}
|
||||||
http:
|
http:
|
||||||
paths:
|
paths:
|
||||||
- path: "/"
|
- pathType: {{ .pathType }}
|
||||||
pathType: Prefix
|
{{- with .path }}
|
||||||
|
path: {{ . }}
|
||||||
|
{{- end }}
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: {{ $svcName | quote }}
|
name: {{ $svcName | quote }}
|
||||||
|
|||||||
@@ -27,7 +27,7 @@ global:
|
|||||||
## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
|
## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
|
||||||
strictMode: false
|
strictMode: false
|
||||||
|
|
||||||
## @param global.spire.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""].
|
## @param global.spire.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||||
ingressControllerType: ""
|
ingressControllerType: ""
|
||||||
|
|
||||||
installAndUpgradeHooks:
|
installAndUpgradeHooks:
|
||||||
|
|||||||
Reference in New Issue
Block a user