Add external spire-controller-managers (#284)
* Complete Server K8S PSAT support Add all the SPIRE Server supported options for the K8S PSAT attestor. This retains the ease of use for configuring local cluster support while adding the ability to configure multiple/external clusters as well. Kubeconfig support is added in its own config block as it will be used/shared with spire-controller-manager support in the future. Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflict Signed-off-by: Kevin Fox <[email protected]> * Add support for integration tests in the tests/integration dir Signed-off-by: Kevin Fox <[email protected]> * Fix split issue and typo Signed-off-by: Kevin Fox <[email protected]> * Add basic psat test Signed-off-by: Kevin Fox <[email protected]> * Fix linter Signed-off-by: Kevin Fox <[email protected]> * Fix up test Signed-off-by: Kevin Fox <[email protected]> * Add missing file Signed-off-by: Kevin Fox <[email protected]> * Better encode config Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Add external k8s bundler Adds support to sync the CA bundle to configmaps in external Kubernetes clusters Signed-off-by: Kevin Fox <[email protected]> * Update default Signed-off-by: Kevin Fox <[email protected]> * Fix config file layout. Incorperate feedback. Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Update based on parent pr feedback Signed-off-by: Kevin Fox <[email protected]> * Reformat config file Signed-off-by: Kevin Fox <[email protected]> * Fix some things Signed-off-by: Kevin Fox <[email protected]> * Reconfigure kind Signed-off-by: Kevin Fox <[email protected]> * More debugging Signed-off-by: Kevin Fox <[email protected]> * Fix up kind Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Add external spire-controller-managers Only one external controller manager is supported at a time until https://github.com/spiffe/spire/issues/4898 is resolved. Signed-off-by: Kevin Fox <[email protected]> * Fix tests Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Upgrade to spire-controller-manager 0.5.0 Signed-off-by: Kevin Fox <[email protected]> * Update for released 0.5.0 Signed-off-by: Kevin Fox <[email protected]> * Merge in some of the id prefix pr Signed-off-by: Kevin Fox <[email protected]> * Entry ID Prefix (#287) * Add Entry ID Prefix support Signed-off-by: Kevin Fox <[email protected]> * Mulitcluster test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Implement cleanup setting too Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Bump up test container Signed-off-by: Kevin Fox <[email protected]> * Swith to testing with nightly Signed-off-by: Kevin Fox <[email protected]> * Fix value name Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix up doc formatting Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflict Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -658,6 +658,53 @@ controllerManager:
|
||||
# fieldSelectors:
|
||||
# fName: f1
|
||||
|
||||
externalControllerManagers:
|
||||
## @param externalControllerManagers.enabled Flag to enable external controller managers
|
||||
enabled: false
|
||||
defaults:
|
||||
## @param externalControllerManagers.defaults.reconcile.clusterSPIFFEIDs Enable reconciliation of clusterSPIFFEIDs from K8s to the SPIRE server
|
||||
## @param externalControllerManagers.defaults.reconcile.clusterStaticEntries Enable reconciliation of clusterStaticEntries from K8s to the SPIRE server
|
||||
## @param externalControllerManagers.defaults.reconcile.clusterFederatedTrustDomains Enable reconciliation of clusterFederatedTrustDomains from K8s to the SPIRE server
|
||||
reconcile:
|
||||
clusterSPIFFEIDs: true
|
||||
clusterStaticEntries: false
|
||||
clusterFederatedTrustDomains: false
|
||||
## @param externalControllerManagers.defaults.className specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs.
|
||||
className: ""
|
||||
## @param externalControllerManagers.defaults.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.
|
||||
watchClassless: false
|
||||
## @param externalControllerManagers.defaults.entryIDPrefixCleanup consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it.
|
||||
entryIDPrefixCleanup: false
|
||||
## @param externalControllerManagers.defaults.parentIDTemplate The template that is used to register workloads.
|
||||
parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"
|
||||
## @param externalControllerManagers.defaults.expandEnv Set to true to enable environment variable substitution of config file options
|
||||
expandEnv: false
|
||||
## @param externalControllerManagers.defaults.extraEnv [array] Extra environment variables to add to the controller manager
|
||||
extraEnv: []
|
||||
## @param externalControllerManagers.defaults.resources [object] Resource requests and limits for controller manager
|
||||
resources: {}
|
||||
## @param externalControllerManagers.defaults.securityContext [object] Security context
|
||||
securityContext: {}
|
||||
configMap:
|
||||
## @param externalControllerManagers.defaults.configMap.annotations [object] Annotations to add to the Controller Manager ConfigMap
|
||||
annotations: {}
|
||||
## @param externalControllerManagers.defaults.ignoreNamespaces [array] These namespaces are ignored by controller manager
|
||||
ignoreNamespaces:
|
||||
- kube-system
|
||||
- kube-public
|
||||
- local-path-storage
|
||||
## @param externalControllerManagers.defaults.cacheNamespaces [object] If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces.
|
||||
cacheNamespaces: {}
|
||||
|
||||
## @param externalControllerManagers.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used.
|
||||
clusters: {}
|
||||
# clustera:
|
||||
# Should match the name of the config in the kubeConfigs section
|
||||
# kubeConfigName: foo
|
||||
# reconcile:
|
||||
# clusterStaticEntries: true
|
||||
# other: {}
|
||||
|
||||
tools:
|
||||
kubectl:
|
||||
## @param tools.kubectl.image.registry The OCI registry to pull the image from
|
||||
|
||||
Reference in New Issue
Block a user