diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index cd6b8ec..65d002a 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -270,6 +270,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` | | `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` | | `controllerManager.entryIDPrefixCleanup` | Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` | +| `controllerManager.addEntryIDPrefix` | If true, prepends the clusterName to the entryID of each entry the controller manager registers. | `true` | +| `controllerManager.gcInterval` | How often the SPIRE state is reconciled when the controller is otherwise idle. This impacts how quickly SPIRE state will converge after CRDs are removed or SPIRE state is mutated underneath the controller. Values are in nanoseconds. | `10000000000` | +| `controllerManager.logLevel` | The log level for the controller manager. Supported values are info, error, warn and debug. | `info` | | `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` | | `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` | | `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml index 57a2f9e..de33c1b 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -47,6 +47,8 @@ metrics: bindAddress: 0.0.0.0:{{ $promPort }} health: healthProbeBindAddress: 0.0.0.0:{{ $healthPort }} +gcInterval: {{ .Values.controllerManager.gcInterval }} +logLevel: {{ .Values.controllerManager.logLevel }} {{- if eq .Values.controllerManager.staticManifestMode "off" }} leaderElection: leaderElect: true @@ -67,7 +69,9 @@ validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-c {{- if typeIs "string" $entryIDPrefixCleanup }} entryIDPrefixCleanup: {{ $entryIDPrefixCleanup | quote }} {{- end }} +{{- if .Values.controllerManager.addEntryIDPrefix }} entryIDPrefix: {{ .clusterName }} +{{- end }} clusterName: {{ .clusterName }} trustDomain: {{ include "spire-lib.trust-domain" . }} {{- $ignoreNamespaces := .defaults.ignoreNamespaces }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index bcef683..88a1871 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -552,6 +552,15 @@ controllerManager: ## @param controllerManager.entryIDPrefixCleanup Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. entryIDPrefixCleanup: false + ## @param controllerManager.addEntryIDPrefix If true, prepends the clusterName to the entryID of each entry the controller manager registers. + addEntryIDPrefix: true + + ## @param controllerManager.gcInterval How often the SPIRE state is reconciled when the controller is otherwise idle. This impacts how quickly SPIRE state will converge after CRDs are removed or SPIRE state is mutated underneath the controller. Values are in nanoseconds. + gcInterval: 10000000000 + + ## @param controllerManager.logLevel The log level for the controller manager. Supported values are info, error, warn and debug. + logLevel: info + ## @param controllerManager.parentIDTemplate The template that is used to register workloads. parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"