Add support for externalServer=true (#303)
This commit is contained in:
kfox1111
@@ -87,6 +87,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `kind` | Define SPIRE server deployment type. Can be statefulset/deployment. Defaults to statefulset if not set. This feature is experimental. | `statefulset` |
|
||||
| `externalServer` | Deploy only the bundle ConfigMap, RBAC rules, and identity documents but not the server. Use in a nested setup where the server is external. | `false` |
|
||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||
| `nameOverride` | Name override | `""` |
|
||||
| `crNameOverride` | Name override for any custom resources | `""` |
|
||||
|
||||
@@ -301,3 +301,16 @@ The code below determines what connection type should be used.
|
||||
{{- $g := dig "spire" "caSubject" "commonName" "" .Values.global }}
|
||||
{{- default .Values.ca_subject.common_name $g }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-server.subject" }}
|
||||
subjects:
|
||||
{{- if .Values.externalServer }}
|
||||
- apiGroup: rbac.authorization.k8s.io
|
||||
kind: User
|
||||
name: spire-root
|
||||
{{- else }}
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire-server.serviceAccountName" . }}
|
||||
namespace: {{ include "spire-server.namespace" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -361,6 +361,7 @@ telemetry:
|
||||
port: 9988
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not .Values.externalServer }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
@@ -373,3 +374,4 @@ metadata:
|
||||
data:
|
||||
server.conf: |
|
||||
{{- include "spire-lib.reformat-and-yaml2json" (dict "config" (include "spire-server.yaml-config" .) "root" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
@@ -51,3 +52,4 @@ data:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -24,10 +24,7 @@ roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-leader-election
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire-server.serviceAccountName" . }}
|
||||
namespace: {{ include "spire-server.namespace" . }}
|
||||
{{ include "spire-server.subject" . }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
@@ -87,8 +84,5 @@ roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ .Release.Namespace}}-{{ include "spire-controller-manager.fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire-server.serviceAccountName" . }}
|
||||
namespace: {{ include "spire-server.namespace" . }}
|
||||
{{ include "spire-server.subject" . }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -20,3 +21,4 @@ spec:
|
||||
selector:
|
||||
{{- include "spire-server.selectorLabels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
@@ -37,3 +38,4 @@ webhooks:
|
||||
resources: ["clusterspiffeids"]
|
||||
sideEffects: None
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if .Values.autoscaling.enabled }}
|
||||
apiVersion: {{ include "spire-lib.autoscalingVersion" . }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
@@ -38,3 +39,4 @@ spec:
|
||||
averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
|
||||
{{- $namespace := include "spire-server.podMonitor.namespace" . }}
|
||||
{{- $podNamespace := ( include "spire-server.namespace" . ) }}
|
||||
@@ -25,3 +26,4 @@ spec:
|
||||
kubernetes.io/metadata.name: {{ $podNamespace }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
|
||||
@@ -87,3 +88,4 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
|
||||
@@ -87,3 +88,4 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq ((dig "deleteHooks" "enabled" .Values.controllerManager.deleteHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- if .Values.upstreamAuthority.spire.enabled }}
|
||||
apiVersion: v1
|
||||
@@ -90,3 +91,4 @@ spec:
|
||||
- {{ include "spire-server.namespace" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||
{{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
|
||||
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
|
||||
@@ -87,3 +88,4 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
{{- $subject := include "spire-server.subject" . }}
|
||||
{{- $namespace := include "spire-server.namespace" . }}
|
||||
{{- $bundleNamespace := include "spire-server.bundle-namespace" . }}
|
||||
# Role to be able to push certificate bundles to a configmap
|
||||
@@ -39,10 +40,7 @@ apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "spire-server.fullname" . }}-cm
|
||||
namespace: {{ $namespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire-server.serviceAccountName" . }}
|
||||
namespace: {{ $namespace }}
|
||||
{{ $subject }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ include "spire-server.fullname" . }}-cm
|
||||
@@ -54,10 +52,7 @@ apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "spire-lib.bundle-configmap" . }}
|
||||
namespace: {{ $bundleNamespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire-server.serviceAccountName" . }}
|
||||
namespace: {{ $namespace }}
|
||||
{{ $subject }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ include "spire-lib.bundle-configmap" . }}
|
||||
@@ -89,10 +84,7 @@ kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ .Release.Namespace}}-{{ include "spire-server.fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire-server.serviceAccountName" . }}
|
||||
namespace: {{ $namespace }}
|
||||
{{ $subject }}
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: {{ .Release.Namespace}}-{{ include "spire-server.fullname" . }}
|
||||
|
||||
@@ -21,6 +21,7 @@
|
||||
{{- else }}
|
||||
{{- fail "Unsupported kind." }}
|
||||
{{- end }}
|
||||
{{- if not .Values.externalServer }}
|
||||
apiVersion: apps/v1
|
||||
{{- if eq .Values.kind "statefulset" }}
|
||||
kind: StatefulSet
|
||||
@@ -514,3 +515,4 @@ spec:
|
||||
storageClassName: {{ $storageClass }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
@@ -26,3 +27,4 @@ spec:
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "spire-server.selectorLabels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
@@ -11,3 +12,4 @@ metadata:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
{{- if not .Values.externalServer }}
|
||||
{{ $values := merge .Values }}
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
@@ -64,3 +65,4 @@ spec:
|
||||
secretName: {{ .Values.tests.tls.customCA }}
|
||||
{{- end }}
|
||||
restartPolicy: Never
|
||||
{{- end }}
|
||||
|
||||
@@ -23,6 +23,9 @@ image:
|
||||
## @param kind Define SPIRE server deployment type. Can be statefulset/deployment. Defaults to statefulset if not set. This feature is experimental.
|
||||
kind: statefulset
|
||||
|
||||
## @param externalServer Deploy only the bundle ConfigMap, RBAC rules, and identity documents but not the server. Use in a nested setup where the server is external.
|
||||
externalServer: false
|
||||
|
||||
## @param imagePullSecrets [array] Pull secrets for images
|
||||
imagePullSecrets: []
|
||||
|
||||
|
||||
Reference in New Issue
Block a user