Add initial spire-ha-agent support to the spire-nested chart (#790)
* Add initial spire-ha-agent support to the spire-nested chart Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix lint issue Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
@@ -105,12 +105,25 @@ dependencies:
|
||||
- nestedRoot
|
||||
- nestedChildFull
|
||||
- nestedChildSecurity
|
||||
- haAgentCommon
|
||||
repository: file://../spire/charts/spiffe-oidc-discovery-provider
|
||||
version: 0.1.0
|
||||
- name: tornjak-frontend
|
||||
condition: tornjak-frontend.enabled
|
||||
repository: file://../spire/charts/tornjak-frontend
|
||||
version: 0.1.0
|
||||
- name: spiffe-csi-driver
|
||||
repository: file://../spire/charts/spiffe-csi-driver
|
||||
version: 0.1.0
|
||||
condition: spiffe-csi-driver.enabled
|
||||
tags:
|
||||
- haAgentCommon
|
||||
- name: spire-ha-agent
|
||||
repository: file://../spire-ha-agent
|
||||
version: 0.1.0
|
||||
condition: spire-ha-agent.enabled
|
||||
tags:
|
||||
- haAgentCommon
|
||||
annotations:
|
||||
artifacthub.io/category: security
|
||||
artifacthub.io/license: Apache-2.0
|
||||
|
||||
@@ -233,6 +233,7 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| `tags.nestedRoot` | Set the chart architecture to root nested | `false` |
|
||||
| `tags.nestedChildFull` | Set the chart mode to a child cluster with its own nested server | `false` |
|
||||
| `tags.nestedChildSecurity` | Set the chart mode to a child cluster for use with a security cluster | `false` |
|
||||
| `tags.haAgentCommon` | Set the chart mode to deploy the common portion of a spire-ha-agent setup | `false` |
|
||||
|
||||
### Spire agent parameters
|
||||
|
||||
@@ -328,28 +329,31 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
|
||||
### Spire server parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- | ---------------------------- |
|
||||
| `internal-spire-server.nameOverride` | Overrides the name of Spire server pods | `internal-server` |
|
||||
| `internal-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
|
||||
| `internal-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` |
|
||||
| `internal-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` |
|
||||
| `internal-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
|
||||
| `internal-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` |
|
||||
| `internal-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` |
|
||||
| `internal-spire-server.bundleConfigMap` | The name of the configmap to store the downstream bundle | `spire-bundle-downstream` |
|
||||
| `external-spire-server.nameOverride` | Overrides the name of Spire server pods | `external-server` |
|
||||
| `external-spire-server.crNameOverride` | Custom Resource name override | `external` |
|
||||
| `external-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
|
||||
| `external-spire-server.controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another instance on the k8s cluster with webhooks enabled. | `false` |
|
||||
| `external-spire-server.controllerManager.className` | specify to use an explicit class name. | `spire-mgmt-external-server` |
|
||||
| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable the default identity | `false` |
|
||||
| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the oidc-discovery-provider identity | `false` |
|
||||
| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` |
|
||||
| `external-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` |
|
||||
| `external-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
|
||||
| `external-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` |
|
||||
| `external-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` |
|
||||
| `external-spire-server.bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `false` |
|
||||
| `external-spire-server.nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `false` |
|
||||
| `external-spire-server.nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `true` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- | ----------------------------------------------- |
|
||||
| `internal-spire-server.nameOverride` | Overrides the name of Spire server pods | `internal-server` |
|
||||
| `internal-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
|
||||
| `internal-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` |
|
||||
| `internal-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` |
|
||||
| `internal-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
|
||||
| `internal-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` |
|
||||
| `internal-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` |
|
||||
| `internal-spire-server.bundleConfigMap` | The name of the configmap to store the downstream bundle | `spire-bundle-downstream` |
|
||||
| `external-spire-server.nameOverride` | Overrides the name of Spire server pods | `external-server` |
|
||||
| `external-spire-server.crNameOverride` | Custom Resource name override | `external` |
|
||||
| `external-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
|
||||
| `external-spire-server.controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another instance on the k8s cluster with webhooks enabled. | `false` |
|
||||
| `external-spire-server.controllerManager.className` | specify to use an explicit class name. | `spire-mgmt-external-server` |
|
||||
| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable the default identity | `false` |
|
||||
| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the oidc-discovery-provider identity | `false` |
|
||||
| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` |
|
||||
| `external-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` |
|
||||
| `external-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
|
||||
| `external-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` |
|
||||
| `external-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` |
|
||||
| `external-spire-server.bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `false` |
|
||||
| `external-spire-server.nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `false` |
|
||||
| `external-spire-server.nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `true` |
|
||||
| `spiffe-csi-driver.agentSocketPath` | The socket path where Spiffe CSI driver mounts agent socket | `/var/run/spire/agent-sockets/spire-agent.sock` |
|
||||
| `spiffe-csi-driver.healthChecks.port` | Health check port number for upstream Spire agent | `9814` |
|
||||
| `spire-ha-agent` | The configuration overrides for a spire-ha-agent | `{}` |
|
||||
|
||||
@@ -101,6 +101,8 @@ tags:
|
||||
nestedChildFull: false
|
||||
## @param tags.nestedChildSecurity Set the chart mode to a child cluster for use with a security cluster
|
||||
nestedChildSecurity: false
|
||||
## @param tags.haAgentCommon Set the chart mode to deploy the common portion of a spire-ha-agent setup
|
||||
haAgentCommon: false
|
||||
|
||||
## subcharts
|
||||
|
||||
@@ -197,7 +199,7 @@ upstream-spiffe-csi-driver:
|
||||
## @section SPIFFE oidc discovery provider parameters
|
||||
## Parameter values for spiffe-oidc-discovery-provider
|
||||
##
|
||||
# Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity]
|
||||
# Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity, haAgentCommon]
|
||||
spiffe-oidc-discovery-provider:
|
||||
# enabled: true
|
||||
## @param spiffe-oidc-discovery-provider.fullnameOverride Fullname override
|
||||
@@ -395,3 +397,17 @@ external-spire-server:
|
||||
joinToken:
|
||||
## @param external-spire-server.nodeAttestor.joinToken.enabled Enable the join_token nodeattestor
|
||||
enabled: true
|
||||
|
||||
# Used with tags [haAgentCommon]
|
||||
spiffe-csi-driver:
|
||||
# enabled: true
|
||||
## @param spiffe-csi-driver.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
|
||||
agentSocketPath: /var/run/spire/agent-sockets/spire-agent.sock
|
||||
healthChecks:
|
||||
## @param spiffe-csi-driver.healthChecks.port Health check port number for upstream Spire agent
|
||||
port: 9814
|
||||
|
||||
## @param spire-ha-agent The configuration overrides for a spire-ha-agent
|
||||
# Used with tags [haAgentCommon]
|
||||
spire-ha-agent: {}
|
||||
# enabled: true
|
||||
|
||||
Reference in New Issue
Block a user