Update for 1.12.4 (#605)
* Update for 1.12.3 Signed-off-by: Kevin Fox <[email protected]> * Fix typo. Use test image Signed-off-by: Kevin Fox <[email protected]> * Fix lint Signed-off-by: Kevin Fox <[email protected]> * Fix format flag. Update config location for k8s configmap bp Signed-off-by: Kevin Fox <[email protected]> * Fix role Signed-off-by: Kevin Fox <[email protected]> * Update rbac Signed-off-by: Kevin Fox <[email protected]> * Fix key Signed-off-by: Kevin Fox <[email protected]> * Fix format Signed-off-by: Kevin Fox <[email protected]> * Fix the bundle format for the fetchca bits Signed-off-by: Kevin Fox <[email protected]> * Update key Signed-off-by: Kevin Fox <[email protected]> * Fix test rather then reconfigure Signed-off-by: Kevin Fox <[email protected]> * Add namespace Signed-off-by: Kevin Fox <[email protected]> * Update to follow the new patch Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Update filename based on format Signed-off-by: Kevin Fox <[email protected]> * Add upgrade notes Signed-off-by: Kevin Fox <[email protected]> * Switch to testing nightly. Dont manage bundle configmap. Signed-off-by: Kevin Fox <[email protected]> * Update permissions Signed-off-by: Kevin Fox <[email protected]> * Update permissions Signed-off-by: Kevin Fox <[email protected]> * Update permissions Signed-off-by: Kevin Fox <[email protected]> * Update for final release Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
@@ -65,7 +65,23 @@ Allow the release namespace to be overridden for multi-namespace deployments in
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "spire-server.bundle-namespace" -}}
|
||||
{{- define "spire-server.bundle-namespace-bundlepublisher" -}}
|
||||
{{- if .Values.bundlePublisher.k8sConfigMap.namespace }}
|
||||
{{- .Values.bundlePublisher.k8sConfigMap.namespace }}
|
||||
{{- else if .Values.namespaceOverride -}}
|
||||
{{- .Values.namespaceOverride -}}
|
||||
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
|
||||
{{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }}
|
||||
{{- .Values.global.spire.namespaces.system.name }}
|
||||
{{- else }}
|
||||
{{- printf "spire-system" }}
|
||||
{{- end }}
|
||||
{{- else -}}
|
||||
{{- .Release.Namespace -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "spire-server.bundle-namespace-notifier" -}}
|
||||
{{- if .Values.notifier.k8sBundle.namespace }}
|
||||
{{- .Values.notifier.k8sBundle.namespace }}
|
||||
{{- else if .Values.namespaceOverride -}}
|
||||
@@ -81,6 +97,14 @@ Allow the release namespace to be overridden for multi-namespace deployments in
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "spire-server.bundle-namespace" -}}
|
||||
{{- if .Values.notifier.k8sBundle.namespace }}
|
||||
{{- .Values.notifier.k8sBundle.namespace }}
|
||||
{{- else }}
|
||||
{{- include "spire-server.bundle-namespace-bundlepublisher" . -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-server.podMonitor.namespace" -}}
|
||||
{{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }}
|
||||
{{- .Values.telemetry.prometheus.podMonitor.namespace }}
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
{{- if and .Values.notifier.k8sBundle.enabled .Values.bundlePublisher.k8sConfigMap.enabled }}
|
||||
{{- fail "You can only enable either notifier.k8sBundle or bundlePublisher.k8sConfigMap." }}
|
||||
{{- end }}
|
||||
{{- if .Values.notifier.k8sBundle.enabled }}
|
||||
{{- $namespace := include "spire-server.bundle-namespace" . }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
@@ -8,3 +12,4 @@ metadata:
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -274,7 +274,7 @@ plugins:
|
||||
k8sbundle:
|
||||
plugin_data:
|
||||
{{- if eq (.Values.notifier.k8sBundle.enabled | toString) "true" }}
|
||||
namespace: {{ include "spire-server.bundle-namespace" . | quote }}
|
||||
namespace: {{ include "spire-server.bundle-namespace-notifier" . | quote }}
|
||||
config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
|
||||
{{- with .Values.notifier.k8sBundle.apiServiceLabel }}
|
||||
api_service_label: {{ . | quote }}
|
||||
@@ -304,8 +304,51 @@ plugins:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if or .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled .Values.bundlePublisher.awsS3.enabled .Values.bundlePublisher.gcpCloudStorage.enabled }}
|
||||
{{- $externalK8sConfigMapClusters := default .Values.kubeConfigs .Values.bundlePublisher.externalK8sConfigMap.clusters }}
|
||||
{{- if or .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled .Values.bundlePublisher.awsS3.enabled .Values.bundlePublisher.gcpCloudStorage.enabled .Values.bundlePublisher.k8sConfigMap.enabled (and .Values.bundlePublisher.externalK8sConfigMap.enabled (ne (len $externalK8sConfigMapClusters) 0)) }}
|
||||
BundlePublisher:
|
||||
{{- if or .Values.bundlePublisher.k8sConfigMap.enabled (and .Values.bundlePublisher.externalK8sConfigMap.enabled (ne (len $externalK8sConfigMapClusters) 0)) }}
|
||||
k8s_configmap:
|
||||
plugin_data:
|
||||
clusters:
|
||||
{{- $prefix := "-" }}
|
||||
{{- if eq (.Values.bundlePublisher.k8sConfigMap.enabled | toString) "true" }}
|
||||
{{ $prefix }} chart-internal:
|
||||
format: {{ .Values.bundlePublisher.k8sConfigMap.format | quote }}
|
||||
namespace: {{ include "spire-server.bundle-namespace-bundlepublisher" . | quote }}
|
||||
configmap_name: {{ include "spire-lib.bundle-configmap" . | quote }}
|
||||
configmap_key: {{ printf "bundle.%s" (include "spire-lib.trust-bundle-ext" (dict "trustBundleFormat" .Values.bundlePublisher.k8sConfigMap.format)) | quote }}
|
||||
{{- $prefix := " " }}
|
||||
{{- end }}
|
||||
{{- if and (eq (.Values.bundlePublisher.externalK8sConfigMap.enabled | toString) "true") (ne (len $externalK8sConfigMapClusters) 0) }}
|
||||
{{- $clusterDefaults := .Values.bundlePublisher.externalK8sConfigMap.defaults }}
|
||||
{{- range $name, $_ := $externalK8sConfigMapClusters }}
|
||||
{{ $prefix }} {{ $name | quote }}:
|
||||
{{- $clusterSettings := dict }}
|
||||
{{- if hasKey $root.Values.bundlePublisher.externalK8sConfigMap.clusters $name }}
|
||||
{{- $clusterSettings = index $root.Values.bundlePublisher.externalK8sConfigMap.clusters $name }}
|
||||
{{- end }}
|
||||
{{- if hasKey $clusterSettings "kubeConfigName" }}
|
||||
kubeconfig_path: /kubeconfigs/{{ $clusterSettings.kubeConfigName }}
|
||||
{{- else }}
|
||||
kubeconfig_path: /kubeconfigs/{{ $name }}
|
||||
{{- end }}
|
||||
{{- $format := $clusterDefaults.format }}
|
||||
{{- if hasKey $clusterSettings "format" }}{{- $format = $clusterSettings.format }}{{- end }}
|
||||
format: {{ $format | quote }}
|
||||
namespace: {{ if hasKey $clusterSettings "namespace" }}{{ $clusterSettings.namespace }}{{ else }}{{ $clusterDefaults.namespace }}{{ end }}
|
||||
configmap_name: {{ if hasKey $clusterSettings "configMapName" }}{{ $clusterSettings.configMapName }}{{ else }}{{ $clusterDefaults.configMapName }}{{ end }}
|
||||
{{- if hasKey $clusterSettings "configMapKey" }}
|
||||
configmap_key: {{ $clusterSettings.configMapKey | quote }}
|
||||
{{- else if ne $clusterDefaults.configMapKey "" }}
|
||||
configmap_key: {{ $clusterDefaults.configMapKey | quote }}
|
||||
{{- else }}
|
||||
configmap_key: {{ printf "bundle.%s" (include "spire-lib.trust-bundle-ext" (dict "trustBundleFormat" $format)) | quote }}
|
||||
{{- end }}
|
||||
{{- $prefix := " " }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled }}
|
||||
aws_rolesanywhere_trustanchor:
|
||||
plugin_data:
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{{- $subject := include "spire-server.subject" . }}
|
||||
{{- $namespace := include "spire-server.namespace" . }}
|
||||
{{- $bundleNamespace := include "spire-server.bundle-namespace" . }}
|
||||
{{- if .Values.notifier.k8sBundle.enabled }}
|
||||
{{- if or .Values.notifier.k8sBundle.enabled .Values.bundlePublisher.k8sConfigMap.enabled }}
|
||||
# Role to be able to push certificate bundles to a configmap
|
||||
kind: Role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
@@ -15,6 +15,9 @@ rules:
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
{{- if .Values.bundlePublisher.k8sConfigMap.enabled }}
|
||||
- create
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.rbac.create }}
|
||||
---
|
||||
@@ -48,7 +51,7 @@ roleRef:
|
||||
name: {{ include "spire-server.fullname" . }}-cm
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
{{- end }}
|
||||
{{- if .Values.notifier.k8sBundle.enabled }}
|
||||
{{- if or .Values.notifier.k8sBundle.enabled .Values.bundlePublisher.k8sConfigMap.enabled }}
|
||||
---
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
||||
Reference in New Issue
Block a user