diff --git a/charts/spire/README.md b/charts/spire/README.md index b079db7..a63b267 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -150,19 +150,27 @@ Now you can interact with the Spire agent socket from your own application. The ### Global parameters -| Name | Description | Value | -| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | -| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` | -| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` | -| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` | -| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset | `""` | -| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` | -| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` | -| `global.spire.image.registry` | Override all Spire image registries at once | `""` | -| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` | -| `global.spire.ingressControllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | -| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | -| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | +| Name | Description | Value | +| -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | +| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` | +| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` | +| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` | +| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset | `""` | +| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` | +| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` | +| `global.spire.image.registry` | Override all Spire image registries at once | `""` | +| `global.spire.namespaces.system.name` | Name of the Spire system Namespace. | `spire-system` | +| `global.spire.namespaces.system.create` | Create a Namespace for Spire system resources. | `false` | +| `global.spire.namespaces.system.annotations` | Annotations to apply to the Spire system Namespace. | `{}` | +| `global.spire.namespaces.system.labels` | Labels to apply to the Spire system Namespace. | `{}` | +| `global.spire.namespaces.server.name` | Name of the Spire server Namespace. | `spire-server` | +| `global.spire.namespaces.server.create` | Create a Namespace for Spire server resources. | `false` | +| `global.spire.namespaces.server.annotations` | Annotations to apply to the Spire server Namespace. | `{}` | +| `global.spire.namespaces.server.labels` | Labels to apply to the Spire server Namespace. | `{}` | +| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` | +| `global.spire.ingressControllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | +| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | +| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | ### Spire server parameters diff --git a/charts/spire/templates/spire-server-namespace.yaml b/charts/spire/templates/spire-server-namespace.yaml new file mode 100644 index 0000000..4eae22d --- /dev/null +++ b/charts/spire/templates/spire-server-namespace.yaml @@ -0,0 +1,14 @@ +{{- if .Values.global.spire.namespaces.server.create }} +apiVersion: v1 +kind: Namespace +metadata: + name: {{ .Values.global.spire.namespaces.server.name }} + {{- if .Values.global.spire.namespaces.server.labels }} + labels: + {{- .Values.global.spire.namespaces.server.labels | toYaml | nindent 4 }} + {{- end }} + {{- if .Values.global.spire.namespaces.server.annotations }} + annotations: + {{- .Values.global.spire.namespaces.server.annotations | toYaml | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/spire/templates/spire-system-namespace.yaml b/charts/spire/templates/spire-system-namespace.yaml new file mode 100644 index 0000000..689038e --- /dev/null +++ b/charts/spire/templates/spire-system-namespace.yaml @@ -0,0 +1,14 @@ +{{- if .Values.global.spire.namespaces.system.create }} +apiVersion: v1 +kind: Namespace +metadata: + name: {{ .Values.global.spire.namespaces.system.name }} + {{- if .Values.global.spire.namespaces.system.labels }} + labels: + {{- .Values.global.spire.namespaces.system.labels | toYaml | nindent 4 }} + {{- end }} + {{- if .Values.global.spire.namespaces.system.annotations }} + annotations: + {{- .Values.global.spire.namespaces.system.annotations | toYaml | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 77e769c..c3145e9 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -8,6 +8,7 @@ global: k8s: ## @param global.k8s.clusterDomain Cluster domain name configured for Spire install clusterDomain: cluster.local + spire: ## @param global.spire.bundleConfigMap A configmap containing the Spire bundle bundleConfigMap: "" @@ -24,6 +25,26 @@ global: ## @param global.spire.image.registry Override all Spire image registries at once registry: "" + namespaces: + system: + ## @param global.spire.namespaces.system.name Name of the Spire system Namespace. + name: "spire-system" + ## @param global.spire.namespaces.system.create Create a Namespace for Spire system resources. + create: false + ## @param global.spire.namespaces.system.annotations [object] Annotations to apply to the Spire system Namespace. + annotations: {} + ## @param global.spire.namespaces.system.labels [object] Labels to apply to the Spire system Namespace. + labels: {} + server: + ## @param global.spire.namespaces.server.name Name of the Spire server Namespace. + name: "spire-server" + ## @param global.spire.namespaces.server.create Create a Namespace for Spire server resources. + create: false + ## @param global.spire.namespaces.server.annotations [object] Annotations to apply to the Spire server Namespace. + annotations: {} + ## @param global.spire.namespaces.server.labels [object] Labels to apply to the Spire server Namespace. + labels: {} + ## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production. strictMode: false diff --git a/examples/openshift/openshift-values.yaml b/examples/openshift/openshift-values.yaml index 6f5dad6..d88641d 100644 --- a/examples/openshift/openshift-values.yaml +++ b/examples/openshift/openshift-values.yaml @@ -3,6 +3,20 @@ global: telemetry: prometheus: enabled: true + spire: + namespaces: + system: + labels: + security.openshift.io/scc.podSecurityLabelSync: "false" + pod-security.kubernetes.io/enforce: privileged + pod-security.kubernetes.io/warn: privileged + pod-security.kubernetes.io/audit: privileged + server: + labels: + security.openshift.io/scc.podSecurityLabelSync: "false" + pod-security.kubernetes.io/enforce: privileged + pod-security.kubernetes.io/warn: privileged + pod-security.kubernetes.io/audit: privileged spire-server: tornjak: