Make service dns domain configurable (#164)

Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/README.md

@@ -105,6 +105,7 @@ Kubernetes: `>=1.21.0-0`
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
 | fullnameOverride | string | `""` |  |
+| global.k8s.clusterDomain | string | `"cluster.local"` |  |
 | global.spire.bundleConfigMap | string | `""` | Override all instances of bundleConfigMap |
 | global.spire.clusterName | string | `"example-cluster"` | Set the name of the Kubernetes cluster |
 | global.spire.trustDomain | string | `"example.org"` | Set the trust domain to use for the spiffe identifiers |

charts/spire/charts/spiffe-oidc-discovery-provider/README.md

@@ -21,6 +21,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
 | autoscaling.minReplicas | int | `1` |  |
 | autoscaling.targetCPUUtilizationPercentage | int | `80` |  |
 | autoscaling.targetMemoryUtilizationPercentage | int | `80` |  |
+| clusterDomain | string | `"cluster.local"` |  |
 | config.acme.cacheDir | string | `"/run/spire"` |  |
 | config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` |  |
 | config.acme.emailAddress | string | `"[email protected]"` |  |

charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl

@@ -103,3 +103,11 @@ Create the name of the service account to use
 {{- .Values.trustDomain }}
 {{- end }}
 {{- end }}
+
+{{- define "spiffe-oidc-discovery-provider.cluster-domain" }}
+{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
+{{- .Values.global.k8s.clusterDomain }}
+{{- else }}
+{{- .Values.clusterDomain }}
+{{- end }}
+{{- end }}

charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml

@@ -11,7 +11,7 @@ data:
     domains = [
       "{{ include "spiffe-oidc-discovery-provider.fullname" . }}",
       "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}",
-      "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.cluster.local",
+      "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}",
     {{- if gt (len .Values.config.domains) 0 }}
       "{{- join "\",\n      \"" .Values.config.domains }}"
     {{- end }}

charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml

@@ -26,7 +26,7 @@ spec:
     - name: curl-service-name-namespace-svc-cluster-local
       image: cgr.dev/chainguard/bash:latest
       command: ['curl']
-      args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.cluster.local:{{ .Values.service.port }}/.well-known/openid-configuration']
+      args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     {{- if .Values.ingress.enabled }}

charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml

@@ -113,6 +113,8 @@ tolerations: []
 affinity: {}
 
 trustDomain: example.org
+# -- This is the value of your clusters `kubeadm init --service-dns-domain` flag
+clusterDomain: cluster.local
 
 telemetry:
   prometheus:

charts/spire/charts/spire-server/README.md

@@ -28,6 +28,7 @@ A Helm chart to install the SPIRE server.
 | ca_subject.common_name | string | `"example.org"` |  |
 | ca_subject.country | string | `"NL"` |  |
 | ca_subject.organization | string | `"Example"` |  |
+| clusterDomain | string | `"cluster.local"` |  |
 | clusterName | string | `"example-cluster"` |  |
 | controllerManager.enabled | bool | `false` |  |
 | controllerManager.identities.dnsNameTemplates | list | `[]` |  |

charts/spire/charts/spire-server/templates/_helpers.tpl

@@ -130,3 +130,11 @@ Create the name of the service account to use
 {{- .Values.bundleConfigMap }}
 {{- end }}
 {{- end }}
+
+{{- define "spire-server.cluster-domain" -}}
+{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
+{{- .Values.global.k8s.clusterDomain }}
+{{- else }}
+{{- .Values.clusterDomain }}
+{{- end }}
+{{- end }}

charts/spire/charts/spire-server/templates/tests/test-connection.yaml

@@ -33,7 +33,7 @@ spec:
     - name: curl-federation-bundle-endpoint
       image: cgr.dev/chainguard/bash:latest
       command: ['curl']
-      args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.cluster.local:{{ .Values.federation.bundleEndpoint.port }}']
+      args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-server.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     {{- end }}

charts/spire/charts/spire-server/values.yaml

@@ -87,6 +87,9 @@ trustDomain: example.org
 
 bundleConfigMap: spire-bundle
 
+# -- This is the value of your clusters `kubeadm init --service-dns-domain` flag
+clusterDomain: cluster.local
+
 federation:
   enabled: false
   bundleEndpoint:

charts/spire/values.yaml

@@ -1,5 +1,8 @@
 # You can enable config/features that affect all services here.
 global:
+  k8s:
+    # -- This is the value of your clusters `kubeadm init --service-dns-domain` flag
+    clusterDomain: "cluster.local"
   spire:
     # -- Set the name of the Kubernetes cluster
     clusterName: "example-cluster"