panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Upgrade to spire-controller-manager 0.4.3 (#258)

Browse Source 
Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
2024-02-22 10:38:58 -08:00
committed by GitHub
parent 020a0b5450
commit a0baace5ea
3 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+4 -1
View File
@@ -233,7 +233,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.2` | | `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.3` |
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
| `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.securityContext` | Security context | `{}` |
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
@@ -241,6 +241,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.service.annotations` | Annotations for service resource | `{}` | | `controllerManager.service.annotations` | Annotations for service resource | `{}` |
| `controllerManager.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` | | `controllerManager.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` |
| `controllerManager.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` | | `controllerManager.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` |
| `controllerManager.reconcile.clusterSPIFFEIDs` | Enable reconciliation of clusterSPIFFEIDs from K8s to the SPIRE server | `true` |
| `controllerManager.reconcile.clusterStaticEntries` | Enable reconciliation of clusterStaticEntries from K8s to the SPIRE server | `true` |
| `controllerManager.reconcile.clusterFederatedTrustDomains` | Enable reconciliation of clusterFederatedTrustDomains from K8s to the SPIRE server | `true` |
| `controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable this identity for controller manager | `true` | | `controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable this identity for controller manager | `true` |
| `controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` | | `controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` |
| `controllerManager.identities.clusterSPIFFEIDs.default.podSelector` | Selector for pods to issue identity | `{}` | | `controllerManager.identities.clusterSPIFFEIDs.default.podSelector` | Selector for pods to issue identity | `{}` |
charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
+4
View File
@@ -42,4 +42,8 @@ data:
className: {{ include "spire-server.controller-manager-class-name" . | quote}} className: {{ include "spire-server.controller-manager-class-name" . | quote}}
watchClassless: {{ .Values.controllerManager.watchClassless | toYaml }} watchClassless: {{ .Values.controllerManager.watchClassless | toYaml }}
parentIDTemplate: {{ .Values.controllerManager.parentIDTemplate | quote }} parentIDTemplate: {{ .Values.controllerManager.parentIDTemplate | quote }}
{{- with .Values.reconcile }}
reconcile:
{{- toYaml . | nindent 6 }}
{{- end }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/values.yaml
+8 -1
View File
@@ -452,7 +452,7 @@ controllerManager:
registry: ghcr.io registry: ghcr.io
repository: spiffe/spire-controller-manager repository: spiffe/spire-controller-manager
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: "0.4.2" tag: "0.4.3"
## @param controllerManager.resources [object] Resource requests and limits for controller manager ## @param controllerManager.resources [object] Resource requests and limits for controller manager
resources: {} resources: {}
@@ -495,6 +495,13 @@ controllerManager:
- kube-public - kube-public
- local-path-storage - local-path-storage
## @param controllerManager.reconcile.clusterSPIFFEIDs Enable reconciliation of clusterSPIFFEIDs from K8s to the SPIRE server
## @param controllerManager.reconcile.clusterStaticEntries Enable reconciliation of clusterStaticEntries from K8s to the SPIRE server
## @param controllerManager.reconcile.clusterFederatedTrustDomains Enable reconciliation of clusterFederatedTrustDomains from K8s to the SPIRE server
reconcile:
clusterSPIFFEIDs: true
clusterStaticEntries: true
clusterFederatedTrustDomains: true
identities: identities:
clusterSPIFFEIDs: clusterSPIFFEIDs:
# NOTE you can add multiple uniquely named entries to create multiple ClusterSPIFFEID objects. See example below. # NOTE you can add multiple uniquely named entries to create multiple ClusterSPIFFEID objects. See example below.