From b60c222c78d139a67d9f2bcd81c4a8d0e84c1b08 Mon Sep 17 00:00:00 2001 From: scubadam Date: Fri, 14 Aug 2026 17:20:56 +0100 Subject: [PATCH] fix(spire-agent): suffix spire-config ConfigMap name per agent profile (#913) The spire-config volume (agent.conf) hardcodes {{ include "spire-agent.fullname" . }} with no $nameSuffix, unlike every other per-profile resource this chart renders (the ConfigMap itself, the trust-bundle volume, the DaemonSet name). Any additional agents. profile's DaemonSet therefore silently mounts the default profile's agent.conf, regardless of what's configured under that profile -- workloadAttestors, customPlugins, anything. Confirmed via a real cluster: an agents.gvisor profile's disableContainerSelectors never took effect because its DaemonSet was mounting the default spire-agent ConfigMap the whole time, not spire-agent-gvisor (which rendered correctly, just was never read). Verified via `helm template`: additional profiles now get their own correctly-suffixed ConfigMap reference, matching the DaemonSet's own name and the trust-bundle volume's existing (correct) behavior. Signed-off-by: dmorris Co-authored-by: dmorris Co-authored-by: kfox1111 --- charts/spire/charts/spire-agent/templates/daemonset.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 7b1624d..3af2559 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -473,7 +473,7 @@ spec: volumes: - name: spire-config configMap: - name: {{ include "spire-agent.fullname" . }} + name: {{ printf "%s%s" (include "spire-agent.fullname" .) $nameSuffix | quote }} {{- if .Values.keyManager.disk.enabled }} - name: spire-key-manager {{- if eq .Values.keyManager.disk.mode "hostPath" }}