From a7e8785420ddb41aaf50cd59f1086906a89c8cb3 Mon Sep 17 00:00:00 2001 From: Kevin Fox Date: Sat, 4 Nov 2023 08:27:46 -0700 Subject: [PATCH] Add another missing one Signed-off-by: Kevin Fox --- charts/spire/charts/spire-server/README.md | 1 + .../spire-server/templates/controller-manager-cluster-ids.yaml | 1 + charts/spire/charts/spire-server/values.yaml | 2 ++ 3 files changed, 4 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index b44c2cf..a0860c4 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -239,6 +239,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.identities.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` | | `controllerManager.identities.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` | | `controllerManager.identities.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` | +| `controllerManager.identities.downstream` | | Set if this spire instance is a root server and the workloads are downstream servers. | `false` | | `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml index 02e0648..0535f52 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml @@ -35,5 +35,6 @@ spec: jwtTtl: {{ . | quote }} {{- end }} admin: {{ .identities.admin }} + downstream: {{ .identities.downstream }} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 347bc4f..cf7b96b 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -467,6 +467,8 @@ controllerManager: jwtTTL: "" ## @param controllerManager.identities.admin Indicates any pod matched by this identity will be an admin. Use this with extreme care. admin: false + ## @param controllerManager.identities.downstream | Set if this spire instance is a root server and the workloads are downstream servers. + downstream: false validatingWebhookConfiguration: ## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued