From c661d0bc7ee580682459f483d468148cd3a08970 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Mon, 3 Apr 2023 10:52:36 -0700 Subject: [PATCH] Make service dns domain configurable (#164) Co-authored-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 1 + .../spire/charts/spiffe-oidc-discovery-provider/README.md | 1 + .../spiffe-oidc-discovery-provider/templates/_helpers.tpl | 8 ++++++++ .../templates/configmap.yaml | 2 +- .../templates/tests/test-connection.yaml | 2 +- .../charts/spiffe-oidc-discovery-provider/values.yaml | 2 ++ charts/spire/charts/spire-server/README.md | 1 + charts/spire/charts/spire-server/templates/_helpers.tpl | 8 ++++++++ .../spire-server/templates/tests/test-connection.yaml | 2 +- charts/spire/charts/spire-server/values.yaml | 3 +++ charts/spire/values.yaml | 3 +++ 11 files changed, 30 insertions(+), 3 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index d23e402..091fd64 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -105,6 +105,7 @@ Kubernetes: `>=1.21.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| | fullnameOverride | string | `""` | | +| global.k8s.clusterDomain | string | `"cluster.local"` | | | global.spire.bundleConfigMap | string | `""` | Override all instances of bundleConfigMap | | global.spire.clusterName | string | `"example-cluster"` | Set the name of the Kubernetes cluster | | global.spire.trustDomain | string | `"example.org"` | Set the trust domain to use for the spiffe identifiers | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index b5dd649..9ba5d0b 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -21,6 +21,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | autoscaling.minReplicas | int | `1` | | | autoscaling.targetCPUUtilizationPercentage | int | `80` | | | autoscaling.targetMemoryUtilizationPercentage | int | `80` | | +| clusterDomain | string | `"cluster.local"` | | | config.acme.cacheDir | string | `"/run/spire"` | | | config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | | config.acme.emailAddress | string | `"letsencrypt@example.org"` | | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl index bda54f2..fbe6f33 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl @@ -103,3 +103,11 @@ Create the name of the service account to use {{- .Values.trustDomain }} {{- end }} {{- end }} + +{{- define "spiffe-oidc-discovery-provider.cluster-domain" }} +{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }} +{{- .Values.global.k8s.clusterDomain }} +{{- else }} +{{- .Values.clusterDomain }} +{{- end }} +{{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml index 70308ad..a0ec2bf 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml @@ -11,7 +11,7 @@ data: domains = [ "{{ include "spiffe-oidc-discovery-provider.fullname" . }}", "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}", - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.cluster.local", + "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}", {{- if gt (len .Values.config.domains) 0 }} "{{- join "\",\n \"" .Values.config.domains }}" {{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml index b6c09bb..e687868 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml @@ -26,7 +26,7 @@ spec: - name: curl-service-name-namespace-svc-cluster-local image: cgr.dev/chainguard/bash:latest command: ['curl'] - args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.cluster.local:{{ .Values.service.port }}/.well-known/openid-configuration'] + args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration'] securityContext: {{- toYaml .Values.securityContext | nindent 8 }} {{- if .Values.ingress.enabled }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 88f53b0..e4871fb 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -113,6 +113,8 @@ tolerations: [] affinity: {} trustDomain: example.org +# -- This is the value of your clusters `kubeadm init --service-dns-domain` flag +clusterDomain: cluster.local telemetry: prometheus: diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 347c653..108db58 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -28,6 +28,7 @@ A Helm chart to install the SPIRE server. | ca_subject.common_name | string | `"example.org"` | | | ca_subject.country | string | `"NL"` | | | ca_subject.organization | string | `"Example"` | | +| clusterDomain | string | `"cluster.local"` | | | clusterName | string | `"example-cluster"` | | | controllerManager.enabled | bool | `false` | | | controllerManager.identities.dnsNameTemplates | list | `[]` | | diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index 85fe37e..786ef07 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -130,3 +130,11 @@ Create the name of the service account to use {{- .Values.bundleConfigMap }} {{- end }} {{- end }} + +{{- define "spire-server.cluster-domain" -}} +{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }} +{{- .Values.global.k8s.clusterDomain }} +{{- else }} +{{- .Values.clusterDomain }} +{{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml index 392bf1d..ce49605 100644 --- a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml @@ -33,7 +33,7 @@ spec: - name: curl-federation-bundle-endpoint image: cgr.dev/chainguard/bash:latest command: ['curl'] - args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.cluster.local:{{ .Values.federation.bundleEndpoint.port }}'] + args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-server.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}'] securityContext: {{- toYaml .Values.securityContext | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 07ed1e4..61df91c 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -87,6 +87,9 @@ trustDomain: example.org bundleConfigMap: spire-bundle +# -- This is the value of your clusters `kubeadm init --service-dns-domain` flag +clusterDomain: cluster.local + federation: enabled: false bundleEndpoint: diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index fb91ef5..e34b928 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -1,5 +1,8 @@ # You can enable config/features that affect all services here. global: + k8s: + # -- This is the value of your clusters `kubeadm init --service-dns-domain` flag + clusterDomain: "cluster.local" spire: # -- Set the name of the Kubernetes cluster clusterName: "example-cluster"