panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Protects SPIRE Agent's Chart Against YAML Template Injection (#450)

Browse Source 
* protects agent's chart against template injection

Signed-off-by: Nico Weisenauer <[email protected]>

* removes unnecessary braces and whitespace

Signed-off-by: Nico Weisenauer <[email protected]>

* Removes int type validation via cast

Signed-off-by: Nico Weisenauer <[email protected]>

---------

Signed-off-by: Nico Weisenauer <[email protected]>
This commit is contained in:
nweisenauer
2024-09-16 06:23:01 -07:00
committed by GitHub
parent ea710023f4
commit 8832da39b4
8 changed files with 61 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-agent/templates/_helpers.tpl
+4 -4
View File
@@ -75,20 +75,20 @@ Create chart name and version as used by the chart label.
Common labels Common labels
*/}} */}}
{{- define "spire-agent.labels" -}} {{- define "spire-agent.labels" -}}
helm.sh/chart: {{ include "spire-agent.chart" . }} helm.sh/chart: {{ include "spire-agent.chart" . | quote }}
{{ include "spire-agent.selectorLabels" . }} {{ include "spire-agent.selectorLabels" . }}
{{- if .Chart.AppVersion }} {{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }} {{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }} app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
{{- end }} {{- end }}
{{/* {{/*
Selector labels Selector labels
*/}} */}}
{{- define "spire-agent.selectorLabels" -}} {{- define "spire-agent.selectorLabels" -}}
app.kubernetes.io/name: {{ include "spire-agent.name" . }} app.kubernetes.io/name: {{ include "spire-agent.name" . | quote }}
app.kubernetes.io/instance: {{ .Release.Name }} app.kubernetes.io/instance: {{ .Release.Name | quote }}
{{- end }} {{- end }}
{{/* {{/*
charts/spire/charts/spire-agent/templates/configmap.yaml
+7 -7
View File
@@ -53,7 +53,7 @@ agent:
default_svid_name: {{ .Values.sds.defaultSvidName | quote }} default_svid_name: {{ .Values.sds.defaultSvidName | quote }}
default_bundle_name: {{ .Values.sds.defaultBundleName | quote }} default_bundle_name: {{ .Values.sds.defaultBundleName | quote }}
default_all_bundles_name: {{ .Values.sds.defaultAllBundlesName | quote }} default_all_bundles_name: {{ .Values.sds.defaultAllBundlesName | quote }}
disable_spiffe_cert_validation: {{ .Values.sds.disableSpiffeCertValidation }} disable_spiffe_cert_validation: {{ eq .Values.sds.disableSpiffeCertValidation true }}
{{- end }} {{- end }}
{{- with .Values.experimental }} {{- with .Values.experimental }}
@@ -97,7 +97,7 @@ plugins:
{{- if eq (.enabled | toString) "true" }} {{- if eq (.enabled | toString) "true" }}
tpm: tpm:
plugin_cmd: "/tpm/tpm_attestor_agent" plugin_cmd: "/tpm/tpm_attestor_agent"
plugin_checksum: {{ .plugin.checksum }} plugin_checksum: {{ .plugin.checksum | quote }}
plugin_data: {} plugin_data: {}
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
{{- end }} {{- end }}
@@ -126,9 +126,9 @@ plugins:
kubelet_ca_path: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt kubelet_ca_path: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
{{- end }} {{- end }}
skip_kubelet_verification: {{ eq .Values.workloadAttestors.k8s.verification.type "skip" }} skip_kubelet_verification: {{ eq .Values.workloadAttestors.k8s.verification.type "skip" }}
disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }} disable_container_selectors: {{ eq .Values.workloadAttestors.k8s.disableContainerSelectors true}}
use_new_container_locator: {{ .Values.workloadAttestors.k8s.useNewContainerLocator }} use_new_container_locator: {{ eq .Values.workloadAttestors.k8s.useNewContainerLocator true }}
verbose_container_locator_logs: {{ .Values.workloadAttestors.k8s.verboseContainerLocatorLogs }} verbose_container_locator_logs: {{ eq .Values.workloadAttestors.k8s.verboseContainerLocatorLogs true }}
{{- if eq (include "spire-agent.connect-by-hostname" .) "true" }} {{- if eq (include "spire-agent.connect-by-hostname" .) "true" }}
node_name_env: "MY_NODE_NAME" node_name_env: "MY_NODE_NAME"
{{- end }} {{- end }}
@@ -168,8 +168,8 @@ telemetry:
apiVersion: v1 apiVersion: v1
kind: ConfigMap kind: ConfigMap
metadata: metadata:
name: {{ include "spire-agent.fullname" . }}{{ $nameSuffix }} name: {{ printf "%s%s" (include "spire-agent.fullname" .) $nameSuffix | quote }}
namespace: {{ include "spire-agent.namespace" . }} namespace: {{ include "spire-agent.namespace" . | quote }}
{{- with .Values.configMap.annotations }} {{- with .Values.configMap.annotations }}
annotations: annotations:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
charts/spire/charts/spire-agent/templates/daemonset.yaml
+32 -24
View File
@@ -22,16 +22,16 @@
apiVersion: apps/v1 apiVersion: apps/v1
kind: DaemonSet kind: DaemonSet
metadata: metadata:
name: {{ include "spire-agent.fullname" . }}{{ $nameSuffix }} name: {{ printf "%s%s" (include "spire-agent.fullname" .) $nameSuffix | quote }}
namespace: {{ include "spire-agent.namespace" . }} namespace: {{ include "spire-agent.namespace" . | quote}}
labels: labels:
{{- include "spire-agent.labels" . | nindent 4 }} {{- include "spire-agent.labels" . | nindent 4 }}
app.kubernetes.io/component: {{ $name }} app.kubernetes.io/component: {{ $name | quote }}
spec: spec:
selector: selector:
matchLabels: matchLabels:
{{- include "spire-agent.selectorLabels" . | nindent 6 }} {{- include "spire-agent.selectorLabels" . | nindent 6 }}
app.kubernetes.io/component: {{ $name }} app.kubernetes.io/component: {{ $name | quote }}
{{- with .Values.updateStrategy }} {{- with .Values.updateStrategy }}
updateStrategy: updateStrategy:
{{- if not (has .type (list "RollingUpdate" "OnDelete")) }} {{- if not (has .type (list "RollingUpdate" "OnDelete")) }}
@@ -47,13 +47,13 @@ spec:
metadata: metadata:
annotations: annotations:
kubectl.kubernetes.io/default-container: spire-agent kubectl.kubernetes.io/default-container: spire-agent
checksum/config: {{ $configSum }} checksum/config: {{ $configSum | quote }}
{{- with .Values.podAnnotations }} {{- with .Values.podAnnotations }}
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
labels: labels:
{{- include "spire-agent.selectorLabels" . | nindent 8 }} {{- include "spire-agent.selectorLabels" . | nindent 8 }}
app.kubernetes.io/component: {{ $name }} app.kubernetes.io/component: {{ $name | quote }}
{{- with .Values.podLabels }} {{- with .Values.podLabels }}
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
@@ -65,7 +65,7 @@ spec:
hostPID: true hostPID: true
hostNetwork: true hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet dnsPolicy: ClusterFirstWithHostNet
serviceAccountName: {{ include "spire-agent.serviceAccountName" . }} serviceAccountName: {{ include "spire-agent.serviceAccountName" . | quote }}
securityContext: securityContext:
{{- toYaml $podSecurityContext | nindent 8 }} {{- toYaml $podSecurityContext | nindent 8 }}
{{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }} {{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }}
@@ -79,17 +79,17 @@ spec:
securityContext: securityContext:
{{- $mainSecurityContext | toYaml | nindent 12 }} {{- $mainSecurityContext | toYaml | nindent 12 }}
image: {{ template "spire-lib.image" (dict "image" .Values.hostCert.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.hostCert.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.hostCert.image.pullPolicy }} imagePullPolicy: {{ .Values.hostCert.image.pullPolicy | quote }}
command: ["bash", "-xc"] command: ["bash", "-xc"]
args: args:
- | - |
{{- if ne .Values.workloadAttestors.k8s.verification.hostCert.fileName "" }} {{- if ne .Values.workloadAttestors.k8s.verification.hostCert.fileName "" }}
openssl x509 -in "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/{{ .Values.workloadAttestors.k8s.verification.hostCert.fileName }}" -out /hostCert/kubelet.crt openssl x509 -in {{ printf "%s/%s" .Values.workloadAttestors.k8s.verification.hostCert.basePath .Values.workloadAttestors.k8s.verification.hostCert.fileName | quote }} -out /hostCert/kubelet.crt
{{- else }} {{- else }}
if [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet-server-current.pem" ]; then if [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet-server-current.pem" ]; then
openssl x509 -in "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet-server-current.pem" -out /hostCert/kubelet.crt openssl x509 -in {{ printf "%s/kubelet-server-current.pem" .Values.workloadAttestors.k8s.verification.hostCert.basePath | quote }} -out /hostCert/kubelet.crt
elif [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" ]; then elif [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" ]; then
openssl x509 -in "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" -out /hostCert/kubelet.crt openssl x509 -in {{ printf "%s/kubelet.crt" .Values.workloadAttestors.k8s.verification.hostCert.basePath | quote }} -out /hostCert/kubelet.crt
else else
{{- if eq .Values.workloadAttestors.k8s.verification.type "auto" }} {{- if eq .Values.workloadAttestors.k8s.verification.type "auto" }}
{{- if $cbh }} {{- if $cbh }}
@@ -150,7 +150,7 @@ spec:
readOnly: true readOnly: true
- name: kmsg - name: kmsg
mountPath: /dev/kmsg mountPath: /dev/kmsg
imagePullPolicy: {{ .Values.nodeAttestor.tpmDirect.pubHash.image.pullPolicy }} imagePullPolicy: {{ .Values.nodeAttestor.tpmDirect.pubHash.image.pullPolicy | quote }}
{{- end }} {{- end }}
- name: init-tpm-direct - name: init-tpm-direct
securityContext: securityContext:
@@ -161,16 +161,16 @@ spec:
- -ec - -ec
- | - |
# SPIRE must be able to fork the plugin directly within its container. Copy the plugin into a volume that can be mounted where SPIRE can execute it. # SPIRE must be able to fork the plugin directly within its container. Copy the plugin into a volume that can be mounted where SPIRE can execute it.
cp -a {{ .Values.nodeAttestor.tpmDirect.plugin.path }} /tpm/tpm_attestor_agent cp -a {{ .Values.nodeAttestor.tpmDirect.plugin.path | quote }} /tpm/tpm_attestor_agent
volumeMounts: volumeMounts:
- name: tpm-direct - name: tpm-direct
mountPath: /tpm mountPath: /tpm
imagePullPolicy: {{ .Values.nodeAttestor.tpmDirect.plugin.image.pullPolicy }} imagePullPolicy: {{ .Values.nodeAttestor.tpmDirect.plugin.image.pullPolicy | quote }}
{{- end }} {{- end }}
{{- if gt (len $socketAlternateNames) 0 }} {{- if gt (len $socketAlternateNames) 0 }}
- name: ensure-alternate-names - name: ensure-alternate-names
image: {{ template "spire-lib.image" (dict "image" .Values.socketAlternate.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.socketAlternate.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.socketAlternate.image.pullPolicy }} imagePullPolicy: {{ .Values.socketAlternate.image.pullPolicy | quote }}
command: ["bash", "-xc"] command: ["bash", "-xc"]
{{- /* 1. Look for symlinks pointing at the wrong place and remove them. 2. Make symlinks that don't exist. 3. If new socket is pointing at an existing symlink, remove old symlink. */}} {{- /* 1. Look for symlinks pointing at the wrong place and remove them. 2. Make symlinks that don't exist. 3. If new socket is pointing at an existing symlink, remove old symlink. */}}
args: args:
@@ -195,12 +195,12 @@ spec:
{{- if gt (int (dig "fsGroup" 0 $podSecurityContext)) 0 }} {{- if gt (int (dig "fsGroup" 0 $podSecurityContext)) 0 }}
- name: fsgroupfix - name: fsgroupfix
image: {{ template "spire-lib.image" (dict "image" .Values.fsGroupFix.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.fsGroupFix.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy }} imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy | quote }}
command: ["bash", "-c"] command: ["bash", "-c"]
args: args:
- | - |
chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ $socketPath | dir }} /tmp/spire-agent/private chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} {{ $socketPath | dir }} /tmp/spire-agent/private
chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} /var/lib/spire chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} /var/lib/spire
resources: resources:
{{- toYaml .Values.fsGroupFix.resources | nindent 12 }} {{- toYaml .Values.fsGroupFix.resources | nindent 12 }}
volumeMounts: volumeMounts:
@@ -218,9 +218,9 @@ spec:
{{- toYaml .Values.initContainers | nindent 8 }} {{- toYaml .Values.initContainers | nindent 8 }}
{{- end }} {{- end }}
containers: containers:
- name: {{ .Chart.Name }} - name: {{ .Chart.Name | quote }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.image.pullPolicy }} imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
args: ["-config", "/opt/spire/conf/agent/agent.conf"] args: ["-config", "/opt/spire/conf/agent/agent.conf"]
securityContext: securityContext:
{{- $mainSecurityContext | toYaml | nindent 12 }} {{- $mainSecurityContext | toYaml | nindent 12 }}
@@ -314,7 +314,11 @@ spec:
{{- if .Values.sockets.admin.mountOnHost }} {{- if .Values.sockets.admin.mountOnHost }}
- name: spire-agent-admin-socket-dir - name: spire-agent-admin-socket-dir
hostPath: hostPath:
path: {{ .Values.sockets.hostBasePath }}/{{ if .Values.upstream }}upstream.csi.spiffe.io{{ else }}csi.spiffe.io{{ end }}/admin {{- if .Values.upstream }}
path: {{ printf "%s/upstream.csi.spiffe.io/admin" .Values.sockets.hostBasePath | quote }}
{{- else }}
path: {{ printf "%s/csi.spiffe.io/admin" .Values.sockets.hostBasePath | quote }}
{{- end }}
type: DirectoryOrCreate type: DirectoryOrCreate
{{- else }} {{- else }}
- name: spire-agent-admin-socket-dir - name: spire-agent-admin-socket-dir
@@ -323,7 +327,11 @@ spec:
{{- if eq .Values.persistence.type "hostPath" }} {{- if eq .Values.persistence.type "hostPath" }}
- name: spire-agent-persistence - name: spire-agent-persistence
hostPath: hostPath:
path: {{ .Values.persistence.hostPath }}/{{ if .Values.upstream }}upstream.csi.spiffe.io{{ else }}csi.spiffe.io{{ end }} {{- if .Values.upstream }}
path: {{ printf "%s/upstream.csi.spiffe.io" .Values.persistence.hostPath | quote }}
{{- else }}
path: {{ printf "%s/csi.spiffe.io" .Values.persistence.hostPath | quote }}
{{- end }}
type: DirectoryOrCreate type: DirectoryOrCreate
{{- else }} {{- else }}
- name: spire-agent-persistence - name: spire-agent-persistence
@@ -332,7 +340,7 @@ spec:
{{- if eq (len .Values.trustBundleURL) 0 }} {{- if eq (len .Values.trustBundleURL) 0 }}
- name: spire-bundle - name: spire-bundle
configMap: configMap:
name: {{ include "spire-lib.bundle-configmap" . }}{{ $nameSuffix }} name: {{ printf "%s%s" (include "spire-lib.bundle-configmap" .) $nameSuffix | quote }}
{{- end }} {{- end }}
{{- if .Values.nodeAttestor.tpmDirect.enabled }} {{- if .Values.nodeAttestor.tpmDirect.enabled }}
- name: tpm-direct - name: tpm-direct
@@ -364,7 +372,7 @@ spec:
emptyDir: {} emptyDir: {}
- name: host-cert - name: host-cert
hostPath: hostPath:
path: {{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }} path: {{ .Values.workloadAttestors.k8s.verification.hostCert.basePath | quote }}
{{- end }} {{- end }}
{{- if gt (len .Values.extraVolumes) 0 }} {{- if gt (len .Values.extraVolumes) 0 }}
{{- toYaml .Values.extraVolumes | nindent 8 }} {{- toYaml .Values.extraVolumes | nindent 8 }}
charts/spire/charts/spire-agent/templates/podmonitor.yaml
+2 -2
View File
@@ -5,7 +5,7 @@ apiVersion: monitoring.coreos.com/v1
kind: PodMonitor kind: PodMonitor
metadata: metadata:
name: {{ include "spire-agent.fullname" . }} name: {{ include "spire-agent.fullname" . }}
namespace: {{ $namespace }} namespace: {{ $namespace | quote }}
labels: labels:
{{- include "spire-agent.labels" . | nindent 4 }} {{- include "spire-agent.labels" . | nindent 4 }}
{{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }} {{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }}
@@ -22,6 +22,6 @@ spec:
- port: prom - port: prom
{{- if ne $namespace $podNamespace }} {{- if ne $namespace $podNamespace }}
namespaceSelector: namespaceSelector:
kubernetes.io/metadata.name: {{ $podNamespace }} kubernetes.io/metadata.name: {{ $podNamespace | quote }}
{{- end }} {{- end }}
{{- end }} {{- end }}
charts/spire/charts/spire-agent/templates/roles.yaml
+5 -5
View File
@@ -2,7 +2,7 @@
kind: ClusterRole kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
metadata: metadata:
name: {{ include "spire-agent.fullname" . }} name: {{ include "spire-agent.fullname" . | quote }}
rules: rules:
- apiGroups: [""] - apiGroups: [""]
resources: resources:
@@ -15,12 +15,12 @@ rules:
kind: ClusterRoleBinding kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
metadata: metadata:
name: {{ include "spire-agent.fullname" . }} name: {{ include "spire-agent.fullname" . | quote }}
subjects: subjects:
- kind: ServiceAccount - kind: ServiceAccount
name: {{ include "spire-agent.serviceAccountName" . }} name: {{ include "spire-agent.serviceAccountName" . | quote }}
namespace: {{ include "spire-agent.namespace" . }} namespace: {{ include "spire-agent.namespace" . | quote }}
roleRef: roleRef:
kind: ClusterRole kind: ClusterRole
name: {{ include "spire-agent.fullname" . }} name: {{ include "spire-agent.fullname" . | quote }}
apiGroup: rbac.authorization.k8s.io apiGroup: rbac.authorization.k8s.io
charts/spire/charts/spire-agent/templates/scc-spire-agent.yaml
+2 -2
View File
@@ -2,7 +2,7 @@
apiVersion: security.openshift.io/v1 apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints kind: SecurityContextConstraints
metadata: metadata:
name: {{ include "spire-agent.fullname" . }} name: {{ include "spire-agent.fullname" . | quote }}
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
runAsUser: runAsUser:
type: RunAsAny type: RunAsAny
@@ -11,7 +11,7 @@ seLinuxContext:
supplementalGroups: supplementalGroups:
type: RunAsAny type: RunAsAny
users: users:
- system:serviceaccount:{{ include "spire-agent.namespace" . }}:{{ include "spire-agent.serviceAccountName" . }} - {{ printf "system:serviceaccount:%s:%s" (include "spire-agent.namespace" .) (include "spire-agent.serviceAccountName" .) | quote }}
volumes: volumes:
- configMap - configMap
- hostPath - hostPath
charts/spire/charts/spire-agent/templates/serviceaccount.yaml
+2 -2
View File
@@ -2,8 +2,8 @@
apiVersion: v1 apiVersion: v1
kind: ServiceAccount kind: ServiceAccount
metadata: metadata:
name: {{ include "spire-agent.serviceAccountName" . }} name: {{ include "spire-agent.serviceAccountName" . | quote }}
namespace: {{ include "spire-agent.namespace" . }} namespace: {{ include "spire-agent.namespace" . | quote }}
labels: labels:
{{- include "spire-agent.labels" . | nindent 4 }} {{- include "spire-agent.labels" . | nindent 4 }}
{{- with .Values.serviceAccount.annotations }} {{- with .Values.serviceAccount.annotations }}
charts/spire/charts/spire-lib/templates/_helpers.tpl
+6 -6
View File
@@ -53,17 +53,17 @@
{{- $repo := .image.repository }} {{- $repo := .image.repository }}
{{- $tag := .image.tag | toString }} {{- $tag := .image.tag | toString }}
{{- if eq (substr 0 7 $tag) "sha256:" }} {{- if eq (substr 0 7 $tag) "sha256:" }}
{{- printf "%s/%s@%s" $registry $repo $tag }} {{- printf "%s/%s@%s" $registry $repo $tag | quote }}
{{- else if .appVersion }} {{- else if .appVersion }}
{{- $appVersion := .appVersion }} {{- $appVersion := .appVersion }}
{{- if and (hasKey . "ubi") (dig "openshift" false .global) }} {{- if and (hasKey . "ubi") (dig "openshift" false .global) }}
{{- $appVersion = printf "ubi-%s" $appVersion }} {{- $appVersion = printf "ubi-%s" $appVersion }}
{{- end }} {{- end }}
{{- printf "%s%s:%s" $registry $repo (default $appVersion $tag) }} {{- printf "%s%s:%s" $registry $repo (default $appVersion $tag) | quote }}
{{- else if $tag }} {{- else if $tag }}
{{- printf "%s%s:%s" $registry $repo $tag }} {{- printf "%s%s:%s" $registry $repo $tag | quote }}
{{- else }} {{- else }}
{{- printf "%s%s" $registry $repo }} {{- printf "%s%s" $registry $repo | quote }}
{{- end }} {{- end }}
{{- end }} {{- end }}
@@ -309,7 +309,7 @@ securityContext - the subbranch of values that contains the securityContext to m
{{- define "spire-lib.default_node_priority_class_name" }} {{- define "spire-lib.default_node_priority_class_name" }}
{{- if .Values.priorityClassName }} {{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName | quote }}
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "priorityClassName" true .Values.global) }} {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "priorityClassName" true .Values.global) }}
priorityClassName: system-node-critical priorityClassName: system-node-critical
{{- end }} {{- end }}
@@ -317,7 +317,7 @@ priorityClassName: system-node-critical
{{- define "spire-lib.default_cluster_priority_class_name" }} {{- define "spire-lib.default_cluster_priority_class_name" }}
{{- if .Values.priorityClassName }} {{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName | quote }}
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "priorityClassName" true .Values.global) }} {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "priorityClassName" true .Values.global) }}
priorityClassName: system-cluster-critical priorityClassName: system-cluster-critical
{{- end }} {{- end }}