diff --git a/charts/spire-crds/Chart.yaml b/charts/spire-crds/Chart.yaml index 8ac17dc..1dfea97 100644 --- a/charts/spire-crds/Chart.yaml +++ b/charts/spire-crds/Chart.yaml @@ -3,7 +3,7 @@ name: spire-crds description: > A Helm chart for deploying the Spire CRDS type: application -version: 0.3.0 +version: 0.4.0 appVersion: "0.0.1" keywords: ["spire-crds"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire diff --git a/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml b/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml index bfdde50..6754b7e 100644 --- a/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml +++ b/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml @@ -64,6 +64,8 @@ spec: type: array spiffeID: type: string + storeSVID: + type: boolean x509SVIDTTL: type: string required: diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index bc4e958..1901deb 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -4,7 +4,7 @@ description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application version: 0.19.2 -appVersion: "1.9.2" +appVersion: "1.9.4" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index 785c655..22d8879 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.19.2](https://img.shields.io/badge/Version-0.19.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.9.3](https://img.shields.io/badge/AppVersion-1.9.3-informational?style=flat-square) +![Version: 0.19.2](https://img.shields.io/badge/Version-0.19.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.9.4](https://img.shields.io/badge/AppVersion-1.9.4-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. @@ -75,6 +75,16 @@ kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeid We only support upgrading one major version at a time. Version skipping isn't supported. +### 0.20.X + +- The default service port for the spire-server was changed to be port 443 to allow easier switching between internal access and external access through an ingress controller. For most users, this will be a transparent +change. + +- This release configures the entries managed by the spire-controller-manager to move into their own managed space within SPIRE. This should be transparent. In a future release, we will +disable cleanup by default of the old space. This release lays the groundwork for future support for manually created entries in the SPIRE database without the spire-controller-manager +destroying them. It is supported in this release by manually setting spire-server.controllerManager.entryIDPrefixCleanup=false after successfully upgrading to the chart without the +setting and waiting for a spire-controller-manager sync. + ### 0.19.X - The spire-agent daemonset gained a new label. For those disabling the upgrade hooks, you need to delete the spire-agent daemonset before issuing the helm upgrade. diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml index 4efda76..4c99b77 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml @@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider description: A Helm chart to install the SPIFFE OIDC discovery provider. type: application version: 0.1.0 -appVersion: "1.9.1" +appVersion: "1.9.4" keywords: ["spiffe", "oidc"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 86e3cbc..372409d 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -117,9 +117,9 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5921884408efe50b77796675dc109ad2126f54476fe7403c37d8898a5ceb2e76` | | `tests.toolkit.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | +| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:803995505bc612174a9594a85493916a5234b6a8e0fa619763eceaf2d189cd75` | +| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f0369215d5a2c15e469a2a8d993e4db7e83fcda5142c8682f37c197d76f82faa` | | `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` | | `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 5007c17..1e46d49 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -338,9 +338,9 @@ tests: ## image: registry: cgr.dev - repository: chainguard/slim-toolkit-debug + repository: chainguard/min-toolkit-debug pullPolicy: IfNotPresent - tag: latest@sha256:803995505bc612174a9594a85493916a5234b6a8e0fa619763eceaf2d189cd75 + tag: latest@sha256:f0369215d5a2c15e469a2a8d993e4db7e83fcda5142c8682f37c197d76f82faa step: ## @param tests.step.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml index 4c158bc..888df65 100644 --- a/charts/spire/charts/spire-agent/Chart.yaml +++ b/charts/spire/charts/spire-agent/Chart.yaml @@ -3,7 +3,7 @@ name: spire-agent description: A Helm chart to install the SPIRE agent. type: application version: 0.1.0 -appVersion: "1.9.3" +appVersion: "1.9.4" keywords: ["spiffe", "spire-agent"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index bc53a8a..85d87a2 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -57,7 +57,7 @@ A Helm chart to install the SPIRE agent. | `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` | | `disableReattestToRenew` | Deprecated: Allow agent to renew certificate when it expires rather than reattest | `false` | | `server.address` | Address for Spire server | `""` | -| `server.port` | Port number for Spire server | `8081` | +| `server.port` | Port number for Spire server | `443` | | `server.namespaceOverride` | Override the namespace for Spire server | `""` | | `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` | | `healthChecks.port` | override the host port used for health checking | `9982` | @@ -123,7 +123,6 @@ A Helm chart to install the SPIRE agent. | `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` | | `experimental.featureFlags` | List of developer feature flags | `[]` | | `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` | -| `installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | | `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/spire-agent/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-agent/templates/pre-upgrade-hook.yaml deleted file mode 100644 index e28c2bc..0000000 --- a/charts/spire/charts/spire-agent/templates/pre-upgrade-hook.yaml +++ /dev/null @@ -1,77 +0,0 @@ -{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} -{{- $ds := lookup "apps/v1" "DaemonSet" (include "spire-agent.namespace" .) (include "spire-agent.fullname" .) }} -{{- if and $ds (not (hasKey $ds.metadata.labels "app.kubernetes.io/component")) }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "spire-agent.serviceAccountName" . }}-pre-upgrade - namespace: {{ include "spire-agent.namespace" . }} - labels: - {{- include "spire-agent.labels" . | nindent 4 }} - annotations: - "helm.sh/hook": pre-upgrade - "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ include "spire-agent.fullname" . }}-pre-upgrade - namespace: {{ include "spire-agent.namespace" . }} - annotations: - "helm.sh/hook": pre-upgrade - "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed -rules: - - apiGroups: ["apps"] - resources: ["daemonsets"] - resourceNames: [{{ include "spire-agent.fullname" . | quote }}] - verbs: ["get", "delete"] ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ include "spire-agent.fullname" . }}-pre-upgrade - namespace: {{ include "spire-agent.namespace" . }} - annotations: - "helm.sh/hook": pre-upgrade - "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed -subjects: - - kind: ServiceAccount - name: {{ include "spire-agent.serviceAccountName" . }}-pre-upgrade - namespace: {{ include "spire-agent.namespace" . }} -roleRef: - kind: Role - name: {{ include "spire-agent.fullname" . }}-pre-upgrade - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ include "spire-agent.fullname" . }}-pre-upgrade - namespace: {{ include "spire-agent.namespace" . }} - labels: - {{- include "spire-agent.labels" . | nindent 4 }} - annotations: - "helm.sh/hook": pre-upgrade - "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed -spec: - template: - metadata: - name: {{ include "spire-agent.fullname" . }}-pre-upgrade - spec: - restartPolicy: Never - serviceAccountName: {{ include "spire-agent.serviceAccountName" . }}-pre-upgrade - securityContext: - {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} - containers: - - name: pre-upgrade - securityContext: - {{- include "spire-lib.securitycontext" . | nindent 10 }} - image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }} - args: - - delete - - daemonset - - {{ include "spire-agent.fullname" . }} - - -n - - {{ include "spire-agent.namespace" . }} -{{- end }} -{{- end }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 6d7dcf0..be1b1d9 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -113,7 +113,7 @@ upstream: false ## server: address: "" - port: 8081 + port: 443 namespaceOverride: "" nameOverride: "" @@ -329,10 +329,6 @@ agents: {} # tpmDirect: # enabled: true -installAndUpgradeHook: - ## @param installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) - enabled: true - tools: kubectl: ## @param tools.kubectl.image.registry The OCI registry to pull the image from diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml index 955df24..ec4dfc9 100644 --- a/charts/spire/charts/spire-server/Chart.yaml +++ b/charts/spire/charts/spire-server/Chart.yaml @@ -3,7 +3,7 @@ name: spire-server description: A Helm chart to install the SPIRE server. type: application version: 0.1.0 -appVersion: "1.9.3" +appVersion: "1.9.4" keywords: ["spiffe", "spire-server", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 8c4cf4b..5e503cc 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -101,7 +101,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `securityContext` | Security context | `{}` | | `priorityClassName` | Priority class assigned to statefulset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `service.type` | Type of the Spire server service created | `ClusterIP` | -| `service.port` | Port for the created service | `8081` | +| `service.port` | Port for the created service | `443` | | `service.annotations` | Annotations to add to the service object | `{}` | | `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` | | `resources` | Resource requests and limits | `{}` | @@ -174,6 +174,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` | | `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` | | `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` | +| `keyManager.awsKMS.keyIdentifierFile.enabled` | Enable key identifier data to be stored in a file in persistent storage. | `false` | +| `keyManager.awsKMS.keyIdentifierValue.enabled` | Enable specifying a key identifier value for AWS KMS | `false` | +| `keyManager.awsKMS.keyIdentifierValue.identifier` | Static identifier for the SPIRE server instance | `""` | | `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | | | `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` | | `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` | @@ -212,7 +215,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | | | `upstreamAuthority.spire.server.nameOverride` | Override the name for upstream Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` | | `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` | -| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `8081` | +| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `443` | | `upstreamAuthority.vault.enabled` | Enable Hashicorp Vault as upstream CA | `false` | | `upstreamAuthority.vault.vaultAddr` | The URL of the Vault server. (e.g., https://vault.example.com:8443/) | `""` | | `upstreamAuthority.vault.namespace` | Name of the Vault namespace. This is only available in the Vault Enterprise. | `""` | @@ -235,6 +238,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.enabled` | Flag to enable controller manager | `false` | | `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` | | `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` | +| `controllerManager.entryIDPrefixCleanup` | Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `""` | | `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` | | `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` | | `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` | @@ -243,7 +247,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.4` | +| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.5.0` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index a2c7803..2c6e34c 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -35,6 +35,9 @@ {{- if ne $tlsFederationCount 1 }} {{- fail "You must enable one and only one federation TLS configuration" }} {{- end }} +{{- if and (eq (.Values.keyManager.awsKMS.keyIdentifierFile.enabled | toString) "true") (eq (.Values.keyManager.awsKMS.keyIdentifierValue.enabled | toString ) "true") }} +{{- fail "You can only enable one of keyIdentifierFile or keyIdentifierValue at a time" }} +{{- end }} {{- define "spire-server.yaml-config" -}} {{- $upstreamAuthorityUsed := 0 }} {{- $keyManagerUsed := 0 }} @@ -190,7 +193,13 @@ plugins: aws_kms: plugin_data: region: {{ .region | quote }} + {{- if eq (.keyIdentifierFile.enabled | toString) "true" }} + key_identifier_file: "/run/spire/data/aws-kms-key-identifier" + {{- else if eq (.keyIdentifierValue.enabled | toString) "true" }} + key_identifier_value: {{ .keyIdentifierValue.identifier | quote }} + {{- else }} key_metadata_file: "/run/spire/data/aws-kms-key-metadata" + {{- end }} {{- if ne .accessKeyID "" }} access_key_id: "${AWS_KMS_ACCESS_KEY_ID}" {{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml index e5abd92..f019f56 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -32,6 +32,10 @@ data: {{- if .Values.controllerManager.validatingWebhookConfiguration.enabled }} validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook {{- end }} + {{- if typeIs "string" .Values.controllerManager.entryIDPrefixCleanup }} + entryIDPrefixCleanup: {{ .Values.controllerManager.entryIDPrefixCleanup | quote }} + {{- end }} + entryIDPrefix: {{ include "spire-lib.cluster-name" . }} clusterName: {{ include "spire-lib.cluster-name" . }} trustDomain: {{ include "spire-lib.trust-domain" . }} ignoreNamespaces: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 0cc0565..1e38cbd 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -75,7 +75,7 @@ priorityClassName: "" ## service: type: ClusterIP - port: 8081 + port: 443 annotations: {} configMap: @@ -307,6 +307,14 @@ keyManager: enabled: false ## @param keyManager.awsKMS.region Specify the region for AWS KMS region: "" + keyIdentifierFile: + ## @param keyManager.awsKMS.keyIdentifierFile.enabled Enable key identifier data to be stored in a file in persistent storage. + enabled: false + keyIdentifierValue: + ## @param keyManager.awsKMS.keyIdentifierValue.enabled Enable specifying a key identifier value for AWS KMS + enabled: false + ## @param keyManager.awsKMS.keyIdentifierValue.identifier Static identifier for the SPIRE server instance + identifier: "" ## @extra keyManager.awsKMS.keyPolicy Policy to use when creating keys. If no policy is specified, a default policy will be used. keyPolicy: ## @param keyManager.awsKMS.keyPolicy.policy [nullable] Key policy in JSON format. @@ -395,7 +403,7 @@ upstreamAuthority: ## @param upstreamAuthority.spire.server.address Address for upstream Spire server address: "" ## @param upstreamAuthority.spire.server.port Port for upstream Spire server - port: 8081 + port: 443 vault: ## @param upstreamAuthority.vault.enabled Enable Hashicorp Vault as upstream CA enabled: false @@ -457,6 +465,9 @@ controllerManager: ## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. watchClassless: false + ## @param controllerManager.entryIDPrefixCleanup Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. + entryIDPrefixCleanup: "" + ## @param controllerManager.parentIDTemplate The template that is used to register workloads. parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}" @@ -482,7 +493,7 @@ controllerManager: registry: ghcr.io repository: spiffe/spire-controller-manager pullPolicy: IfNotPresent - tag: "0.4.4" + tag: "0.5.0" ## @param controllerManager.resources [object] Resource requests and limits for controller manager resources: {} diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/templates/_spire-lib.tpl index 239efc1..db33cee 100644 --- a/charts/spire/templates/_spire-lib.tpl +++ b/charts/spire/templates/_spire-lib.tpl @@ -94,7 +94,7 @@ */}} {{ define "spire-lib.ingress-calculated-name" }} {{- $host := .ingress.host }} -{{- if not (contains $host ".") }} +{{- if not (contains "." $host) }} {{- $host = printf "%s.%s" $host (include "spire-lib.trust-domain" .) }} {{- end }} {{- $host }}