Added ability to create namespaces (#103)
* Added ability to create namespaces Signed-off-by: Andrew Block <[email protected]> * Add openshift labels Signed-off-by: Mariusz Sabath <[email protected]> --------- Signed-off-by: Andrew Block <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> Co-authored-by: Mariusz Sabath <[email protected]> Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
Andrew Block
co-authored by
Mariusz Sabath
kfox1111
Mariusz Sabath
kfox1111
parent
78bb95ba35
commit
8422b8d141
+21
-13
@@ -150,19 +150,27 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
|
||||
### Global parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- |
|
||||
| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` |
|
||||
| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` |
|
||||
| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` |
|
||||
| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset | `""` |
|
||||
| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` |
|
||||
| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` |
|
||||
| `global.spire.image.registry` | Override all Spire image registries at once | `""` |
|
||||
| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` |
|
||||
| `global.spire.ingressControllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||
| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- |
|
||||
| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` |
|
||||
| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` |
|
||||
| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` |
|
||||
| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset | `""` |
|
||||
| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` |
|
||||
| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` |
|
||||
| `global.spire.image.registry` | Override all Spire image registries at once | `""` |
|
||||
| `global.spire.namespaces.system.name` | Name of the Spire system Namespace. | `spire-system` |
|
||||
| `global.spire.namespaces.system.create` | Create a Namespace for Spire system resources. | `false` |
|
||||
| `global.spire.namespaces.system.annotations` | Annotations to apply to the Spire system Namespace. | `{}` |
|
||||
| `global.spire.namespaces.system.labels` | Labels to apply to the Spire system Namespace. | `{}` |
|
||||
| `global.spire.namespaces.server.name` | Name of the Spire server Namespace. | `spire-server` |
|
||||
| `global.spire.namespaces.server.create` | Create a Namespace for Spire server resources. | `false` |
|
||||
| `global.spire.namespaces.server.annotations` | Annotations to apply to the Spire server Namespace. | `{}` |
|
||||
| `global.spire.namespaces.server.labels` | Labels to apply to the Spire server Namespace. | `{}` |
|
||||
| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` |
|
||||
| `global.spire.ingressControllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||
| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||
|
||||
### Spire server parameters
|
||||
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
{{- if .Values.global.spire.namespaces.server.create }}
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: {{ .Values.global.spire.namespaces.server.name }}
|
||||
{{- if .Values.global.spire.namespaces.server.labels }}
|
||||
labels:
|
||||
{{- .Values.global.spire.namespaces.server.labels | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.spire.namespaces.server.annotations }}
|
||||
annotations:
|
||||
{{- .Values.global.spire.namespaces.server.annotations | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,14 @@
|
||||
{{- if .Values.global.spire.namespaces.system.create }}
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: {{ .Values.global.spire.namespaces.system.name }}
|
||||
{{- if .Values.global.spire.namespaces.system.labels }}
|
||||
labels:
|
||||
{{- .Values.global.spire.namespaces.system.labels | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.global.spire.namespaces.system.annotations }}
|
||||
annotations:
|
||||
{{- .Values.global.spire.namespaces.system.annotations | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -8,6 +8,7 @@ global:
|
||||
k8s:
|
||||
## @param global.k8s.clusterDomain Cluster domain name configured for Spire install
|
||||
clusterDomain: cluster.local
|
||||
|
||||
spire:
|
||||
## @param global.spire.bundleConfigMap A configmap containing the Spire bundle
|
||||
bundleConfigMap: ""
|
||||
@@ -24,6 +25,26 @@ global:
|
||||
## @param global.spire.image.registry Override all Spire image registries at once
|
||||
registry: ""
|
||||
|
||||
namespaces:
|
||||
system:
|
||||
## @param global.spire.namespaces.system.name Name of the Spire system Namespace.
|
||||
name: "spire-system"
|
||||
## @param global.spire.namespaces.system.create Create a Namespace for Spire system resources.
|
||||
create: false
|
||||
## @param global.spire.namespaces.system.annotations [object] Annotations to apply to the Spire system Namespace.
|
||||
annotations: {}
|
||||
## @param global.spire.namespaces.system.labels [object] Labels to apply to the Spire system Namespace.
|
||||
labels: {}
|
||||
server:
|
||||
## @param global.spire.namespaces.server.name Name of the Spire server Namespace.
|
||||
name: "spire-server"
|
||||
## @param global.spire.namespaces.server.create Create a Namespace for Spire server resources.
|
||||
create: false
|
||||
## @param global.spire.namespaces.server.annotations [object] Annotations to apply to the Spire server Namespace.
|
||||
annotations: {}
|
||||
## @param global.spire.namespaces.server.labels [object] Labels to apply to the Spire server Namespace.
|
||||
labels: {}
|
||||
|
||||
## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
|
||||
strictMode: false
|
||||
|
||||
|
||||
@@ -3,6 +3,20 @@ global:
|
||||
telemetry:
|
||||
prometheus:
|
||||
enabled: true
|
||||
spire:
|
||||
namespaces:
|
||||
system:
|
||||
labels:
|
||||
security.openshift.io/scc.podSecurityLabelSync: "false"
|
||||
pod-security.kubernetes.io/enforce: privileged
|
||||
pod-security.kubernetes.io/warn: privileged
|
||||
pod-security.kubernetes.io/audit: privileged
|
||||
server:
|
||||
labels:
|
||||
security.openshift.io/scc.podSecurityLabelSync: "false"
|
||||
pod-security.kubernetes.io/enforce: privileged
|
||||
pod-security.kubernetes.io/warn: privileged
|
||||
pod-security.kubernetes.io/audit: privileged
|
||||
|
||||
spire-server:
|
||||
tornjak:
|
||||
|
||||
Reference in New Issue
Block a user