Use the correct kubectl for the cluster (#248)

charts/spire/README.md

@@ -291,9 +291,9 @@ Kubernetes: `>=1.21.0-0`
 | spire-server.controllerManager.service.type | string | `"ClusterIP"` |  |
 | spire-server.controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` |  |
 | spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
-| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
+| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
-| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"chainguard/kubectl"` | The repository within the registry |
+| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"rancher/kubectl"` | The repository within the registry |
-| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `"latest"` |  |
+| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `""` |  |
 | spire-server.dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
 | spire-server.dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
 | spire-server.dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |

charts/spire/charts/spire-server/README.md

@@ -52,9 +52,9 @@ A Helm chart to install the SPIRE server.
 | controllerManager.service.type | string | `"ClusterIP"` |  |
 | controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` |  |
 | controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
-| controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
+| controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
-| controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"chainguard/kubectl"` | The repository within the registry |
+| controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"rancher/kubectl"` | The repository within the registry |
-| controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `"latest"` |  |
+| controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `""` |  |
 | dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
 | dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
 | dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |

charts/spire/charts/spire-server/templates/_helpers.tpl

@@ -105,6 +105,14 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
+{{- define "spire-server.kubectl-image" }}
+{{- $root := deepCopy . }}
+{{- if eq (len $root.image.version) 0 }}
+{{- $_ := set $root.image "version" $root.KubeVersion }}
+{{- end }}
+{{- include "spire-lib.image" $root }}
+{{- end }}
+
 {{- define "spire-server.config-mysql-query" }}
 {{- $lst := list }}
 {{- range . }}

charts/spire/charts/spire-server/templates/post-install-hook.yaml

@@ -63,23 +63,25 @@ spec:
       - name: post-install-job
         securityContext:
           {{- toYaml .Values.securityContext | nindent 10 }}
-        image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }}
+        image: {{ template "spire-server.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
-        command:
+        args:
-        - /bin/sh
+          - patch
-        - -c
+          - validatingwebhookconfiguration
-        - |-
+          - {{ include "spire-controller-manager.fullname" . }}-webhook
-          kubectl patch validatingwebhookconfiguration {{ include "spire-controller-manager.fullname" . }}-webhook --type='strategic' -p '
+          - --type=strategic
-          {
+          - -p
-            "webhooks":[
+          - |
-              {
+            {
-                "name":"vclusterspiffeid.kb.io",
+              "webhooks":[
-                "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
+                {
-              },
+                  "name":"vclusterspiffeid.kb.io",
-              {
+                  "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
-                "name":"vclusterfederatedtrustdomain.kb.io",
+                },
-                "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
+                {
-              }
+                  "name":"vclusterfederatedtrustdomain.kb.io",
-            ]
+                  "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
-          }'
+                }
+              ]
+            }
 {{- end }}
 {{- end }}

charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml

@@ -63,23 +63,25 @@ spec:
       - name: post-upgrade-job
         securityContext:
           {{- toYaml .Values.securityContext | nindent 10 }}
-        image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }}
+        image: {{ template "spire-server.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
-        command:
+        args:
-        - /bin/sh
+          - patch
-        - -c
+          - validatingwebhookconfiguration
-        - |-
+          - {{ include "spire-controller-manager.fullname" . }}-webhook
-          kubectl patch validatingwebhookconfiguration {{ include "spire-controller-manager.fullname" . }}-webhook --type='strategic' -p '
+          - --type=strategic
-          {
+          - -p
-            "webhooks":[
+          - |
-              {
+            {
-                "name":"vclusterspiffeid.kb.io",
+              "webhooks":[
-                "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
+                {
-              },
+                  "name":"vclusterspiffeid.kb.io",
-              {
+                  "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
-                "name":"vclusterfederatedtrustdomain.kb.io",
+                },
-                "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
+                {
-              }
+                  "name":"vclusterfederatedtrustdomain.kb.io",
-            ]
+                  "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
-          }'
+                }
+              ]
+            }
 {{- end }}
 {{- end }}

charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml

@@ -63,23 +63,25 @@ spec:
       - name: post-install-job
         securityContext:
           {{- toYaml .Values.securityContext | nindent 10 }}
-        image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }}
+        image: {{ template "spire-server.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
-        command:
+        args:
-        - /bin/sh
+          - patch
-        - -c
+          - validatingwebhookconfiguration
-        - |-
+          - {{ include "spire-controller-manager.fullname" . }}-webhook
-          kubectl patch validatingwebhookconfiguration {{ include "spire-controller-manager.fullname" . }}-webhook --type='strategic' -p '
+          - --type=strategic
-          {
+          - -p
-            "webhooks":[
+          - |
-              {
+            {
-                "name":"vclusterspiffeid.kb.io",
+              "webhooks":[
-                "failurePolicy":"Ignore"
+                {
-              },
+                  "name":"vclusterspiffeid.kb.io",
-              {
+                  "failurePolicy":"Ignore"
-                "name":"vclusterfederatedtrustdomain.kb.io",
+                },
-                "failurePolicy":"Ignore"
+                {
-              }
+                  "name":"vclusterfederatedtrustdomain.kb.io",
-            ]
+                  "failurePolicy":"Ignore"
-          }'
+                }
+              ]
+            }
 {{- end }}
 {{- end }}

charts/spire/charts/spire-server/values.yaml

@@ -224,12 +224,12 @@ controllerManager:
     upgradeHook:
       image:
         # -- The OCI registry to pull the image from
-        registry: cgr.dev
+        registry: docker.io
         # -- The repository within the registry
-        repository: chainguard/kubectl
+        repository: rancher/kubectl
         # -- The image pull policy
         pullPolicy: IfNotPresent
-        version: latest
+        version: ""
 
 telemetry:
   prometheus: