Add support for externalServer=true (#303)

2024-04-26 19:19:01 +00:00
parent a2494ee45e
commit c132cc481e
19 changed files with 51 additions and 20 deletions
@@ -301,3 +301,16 @@ The code below determines what connection type should be used.
 {{-   $g := dig "spire" "caSubject" "commonName" "" .Values.global }}
 {{-   default .Values.ca_subject.common_name $g }}
 {{- end }}
+
+{{- define "spire-server.subject" }}
+subjects:
+{{-   if .Values.externalServer }}
+- apiGroup: rbac.authorization.k8s.io
+  kind: User
+  name: spire-root
+{{-   else }}
+- kind: ServiceAccount
+  name: {{ include "spire-server.serviceAccountName" . }}
+  namespace: {{ include "spire-server.namespace" . }}
+{{-   end }}
+{{- end }}