Update for 1.12.4 (#605)

* Update for 1.12.3 Signed-off-by: Kevin Fox <[email protected]> * Fix typo. Use test image Signed-off-by: Kevin Fox <[email protected]> * Fix lint Signed-off-by: Kevin Fox <[email protected]> * Fix format flag. Update config location for k8s configmap bp Signed-off-by: Kevin Fox <[email protected]> * Fix role Signed-off-by: Kevin Fox <[email protected]> * Update rbac Signed-off-by: Kevin Fox <[email protected]> * Fix key Signed-off-by: Kevin Fox <[email protected]> * Fix format Signed-off-by: Kevin Fox <[email protected]> * Fix the bundle format for the fetchca bits Signed-off-by: Kevin Fox <[email protected]> * Update key Signed-off-by: Kevin Fox <[email protected]> * Fix test rather then reconfigure Signed-off-by: Kevin Fox <[email protected]> * Add namespace Signed-off-by: Kevin Fox <[email protected]> * Update to follow the new patch Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Update filename based on format Signed-off-by: Kevin Fox <[email protected]> * Add upgrade notes Signed-off-by: Kevin Fox <[email protected]> * Switch to testing nightly. Dont manage bundle configmap. Signed-off-by: Kevin Fox <[email protected]> * Update permissions Signed-off-by: Kevin Fox <[email protected]> * Update permissions Signed-off-by: Kevin Fox <[email protected]> * Update permissions Signed-off-by: Kevin Fox <[email protected]> * Update for final release Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
2025-07-01 16:28:57 -07:00
parent b74b10a0f6
commit 892051c466
19 changed files with 146 additions and 25 deletions
@@ -514,7 +514,7 @@ upstreamAuthority:
 notifier:
  k8sBundle:
    ## @param notifier.k8sBundle.enabled Enable local k8s bundle uploader
-    enabled: true
+    enabled: false
    ## @param notifier.k8sBundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace
    namespace: ""
    ## @param notifier.k8sBundle.apiServiceLabel If set, rotate the CA Bundle in API services with this label set to true.
@@ -523,7 +523,7 @@ notifier:
    webhookLabel: ""
  externalK8sBundle:
    ## @param notifier.externalK8sBundle.enabled Enable external k8s bundle uploader
-    enabled: true
+    enabled: false
    defaults:
      ## @param notifier.externalK8sBundle.defaults.namespace Namespace to push the bundle into on clusters
      namespace: "spire-system"
@@ -978,6 +978,30 @@ nodeAttestor:

 # The secrets needed for this plugin are configured in the secrets: section
 bundlePublisher:
+  k8sConfigMap:
+    ## @param bundlePublisher.k8sConfigMap.enabled Enable local k8s bundle uploader
+    enabled: true
+    ## @param bundlePublisher.k8sConfigMap.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace
+    namespace: ""
+    ## @param bundlePublisher.k8sConfigMap.format Format of the trust bundle. Can be pem or spiffe
+    format: spiffe
+  externalK8sConfigMap:
+    ## @param bundlePublisher.externalK8sConfigMap.enabled Enable external k8s bundle uploader
+    enabled: true
+    defaults:
+      ## @param bundlePublisher.externalK8sConfigMap.defaults.namespace Namespace to push the bundle into on clusters
+      namespace: "spire-system"
+      ## @param bundlePublisher.externalK8sConfigMap.defaults.configMapName ConfigMap name to push the bundle into on external clusters
+      configMapName: "spire-bundle-upstream"
+      ## @param bundlePublisher.externalK8sConfigMap.defaults.configMapKey ConfigMap key to push the bundle into on external clusters
+      configMapKey: ""
+      ## @param bundlePublisher.externalK8sConfigMap.defaults.format Format of the trust bundle. Can be pem or spiffe
+      format: spiffe
+    ## @param bundlePublisher.externalK8sConfigMap.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used.
+    clusters: {}
+    # clustera:
+    #   namespace: foo
+    # clusterb: {}
  awsRolesAnywhereTrustAnchor:
    ## @param bundlePublisher.awsRolesAnywhereTrustAnchor.enabled Enable the AWS S3 bundle publisher
    enabled: false