panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add another missing one

Browse Source 
Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
Kevin Fox
2023-11-05 23:29:22 -08:00
committed by Faisal Memon
parent 3778597e72
commit a7e8785420
3 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+1
View File
@@ -239,6 +239,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.identities.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` | | `controllerManager.identities.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` |
| `controllerManager.identities.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` | | `controllerManager.identities.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` |
| `controllerManager.identities.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` | | `controllerManager.identities.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
| `controllerManager.identities.downstream` | | Set if this spire instance is a root server and the workloads are downstream servers. | `false` |
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` | | `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | | `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml
+1
View File
@@ -35,5 +35,6 @@ spec:
jwtTtl: {{ . | quote }} jwtTtl: {{ . | quote }}
{{- end }} {{- end }}
admin: {{ .identities.admin }} admin: {{ .identities.admin }}
downstream: {{ .identities.downstream }}
{{- end }} {{- end }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/values.yaml
+2
View File
@@ -467,6 +467,8 @@ controllerManager:
jwtTTL: "" jwtTTL: ""
## @param controllerManager.identities.admin Indicates any pod matched by this identity will be an admin. Use this with extreme care. ## @param controllerManager.identities.admin Indicates any pod matched by this identity will be an admin. Use this with extreme care.
admin: false admin: false
## @param controllerManager.identities.downstream | Set if this spire instance is a root server and the workloads are downstream servers.
downstream: false
validatingWebhookConfiguration: validatingWebhookConfiguration:
## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued ## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued