panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enable global config for clusterName, trustDomain, and bundleConfigMap (#156)

Browse Source
This commit is contained in:
kfox1111
2023-04-02 19:28:49 +02:00
committed by GitHub
parent b54c41aee0
commit 87904164ad
13 changed files with 92 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/templates/_helpers.tpl
+24
View File
@@ -110,3 +110,27 @@ Create the name of the service account to use
[{{ printf "%s:%s-agent" .Release.Namespace .Release.Name | quote }}]
{{- end }}
{{- end }}
{{- define "spire-server.cluster-name" }}
{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
{{- .Values.global.spire.clusterName }}
{{- else }}
{{- .Values.clusterName }}
{{- end }}
{{- end }}
{{- define "spire-server.trust-domain" }}
{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
{{- .Values.global.spire.trustDomain }}
{{- else }}
{{- .Values.trustDomain }}
{{- end }}
{{- end }}
{{- define "spire-server.bundle-configmap" }}
{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
{{- .Values.global.spire.bundleConfigMap }}
{{- else }}
{{- .Values.bundleConfigMap }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/bundle-configmap.yaml
+1 -1
View File
@@ -2,5 +2,5 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ .Values.bundleConfigMap }}
name: {{ include "spire-server.bundle-configmap" . }}
namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
charts/spire/charts/spire-server/templates/configmap.yaml
+3 -3
View File
@@ -10,7 +10,7 @@ data:
server {
bind_address = "0.0.0.0"
bind_port = "8081"
trust_domain = {{ .Values.trustDomain | quote }}
trust_domain = {{ include "spire-server.trust-domain" . | quote }}
data_dir = "/run/spire/data"
log_level = {{ .Values.logLevel | quote }}
@@ -55,7 +55,7 @@ data:
NodeAttestor "k8s_psat" {
plugin_data {
clusters = {
{{ $root.Values.clusterName | quote }} = {
{{ include "spire-server.cluster-name" $root | quote }} = {
service_account_allow_list = {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
}
}
@@ -73,7 +73,7 @@ data:
Notifier "k8sbundle" {
plugin_data {
namespace = {{ .Values.notifier.k8sbundle.namespace | default $namespace | quote }}
config_map = {{ .Values.bundleConfigMap | quote }}
config_map = {{ include "spire-server.bundle-configmap" . | quote }}
}
}
charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
+2 -2
View File
@@ -22,8 +22,8 @@ data:
resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
resourceNamespace: {{ include "spire-server.namespace" . }}
validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook
clusterName: {{ .Values.clusterName }}
trustDomain: {{ .Values.trustDomain }}
clusterName: {{ include "spire-server.cluster-name" . }}
trustDomain: {{ include "spire-server.trust-domain" . }}
ignoreNamespaces:
{{- with .Values.controllerManager.ignoreNamespaces }}
{{- toYaml . | nindent 6 }}
charts/spire/charts/spire-server/templates/roles.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ metadata:
rules:
- apiGroups: [""]
resources: [configmaps]
resourceNames: [{{ .Values.bundleConfigMap }}]
resourceNames: [{{ include "spire-server.bundle-configmap" . }}]
verbs:
- get
- patch