Upgrade to spire-controller-manager 0.5.0 (#316)
* Upgrade to spire-controller-manager 0.5.0 Signed-off-by: Kevin Fox <[email protected]> * Update for released 0.5.0 Signed-off-by: Kevin Fox <[email protected]> * Fix up doc formatting Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
This commit is contained in:
kfox1111
@@ -64,6 +64,8 @@ spec:
|
||||
type: array
|
||||
spiffeID:
|
||||
type: string
|
||||
storeSVID:
|
||||
type: boolean
|
||||
x509SVIDTTL:
|
||||
type: string
|
||||
required:
|
||||
|
||||
@@ -75,6 +75,13 @@ kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeid
|
||||
|
||||
We only support upgrading one major version at a time. Version skipping isn't supported.
|
||||
|
||||
### 0.20.X
|
||||
|
||||
This release configures the entries managed by the spire-controller-manager to move into their own managed space within SPIRE. This should be transparent. In a future release, we will
|
||||
disable cleanup by default of the old space. This release lays the groundwork for future support for manually created entries in the SPIRE database without the spire-controller-manager
|
||||
destroying them. It is supported in this release by manually setting spire-server.controllerManager.entryIDPrefixCleanup=false after successfully upgrading to the chart without the
|
||||
setting and waiting for a spire-controller-manager sync.
|
||||
|
||||
### 0.19.X
|
||||
|
||||
- The spire-agent daemonset gained a new label. For those disabling the upgrade hooks, you need to delete the spire-agent daemonset before issuing the helm upgrade.
|
||||
|
||||
@@ -238,6 +238,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
||||
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
||||
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
||||
| `controllerManager.entryIDPrefixCleanup` | Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `""` |
|
||||
| `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
|
||||
| `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` |
|
||||
| `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` |
|
||||
@@ -246,7 +247,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
||||
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.4` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.5.0` |
|
||||
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
||||
| `controllerManager.securityContext` | Security context | `{}` |
|
||||
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
||||
|
||||
@@ -32,6 +32,10 @@ data:
|
||||
{{- if .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
{{- if typeIs "string" .Values.controllerManager.entryIDPrefixCleanup }}
|
||||
entryIDPrefixCleanup: {{ .Values.controllerManager.entryIDPrefixCleanup | quote }}
|
||||
{{- end }}
|
||||
entryIDPrefix: {{ include "spire-lib.cluster-name" . }}
|
||||
clusterName: {{ include "spire-lib.cluster-name" . }}
|
||||
trustDomain: {{ include "spire-lib.trust-domain" . }}
|
||||
ignoreNamespaces:
|
||||
|
||||
@@ -465,6 +465,9 @@ controllerManager:
|
||||
## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.
|
||||
watchClassless: false
|
||||
|
||||
## @param controllerManager.entryIDPrefixCleanup Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it.
|
||||
entryIDPrefixCleanup: ""
|
||||
|
||||
## @param controllerManager.parentIDTemplate The template that is used to register workloads.
|
||||
parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"
|
||||
|
||||
@@ -490,7 +493,7 @@ controllerManager:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-controller-manager
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "0.4.4"
|
||||
tag: "0.5.0"
|
||||
|
||||
## @param controllerManager.resources [object] Resource requests and limits for controller manager
|
||||
resources: {}
|
||||
|
||||
Reference in New Issue
Block a user