Add support for disabling container selectors (#399)

charts/spire/README.md

@@ -284,6 +284,7 @@ Now you can interact with the Spire agent socket from your own application. The
 | spire-agent.waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag |
 | spire-agent.waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | spire-agent.waitForIt.resources | object | `{}` |  |
+| spire-agent.workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio |
 | spire-agent.workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped |
 | spire-agent.workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor |
 | spire-server.affinity | object | `{}` |  |

charts/spire/charts/spire-agent/README.md

@@ -85,6 +85,7 @@ A Helm chart to install the SPIRE agent.
 | waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag |
 | waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | waitForIt.resources | object | `{}` |  |
+| workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio |
 | workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped |
 | workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor |
 

charts/spire/charts/spire-agent/templates/configmap.yaml

@@ -30,6 +30,7 @@ plugins:
           # Minikube does not have a cert in the cluster CA bundle that
           # can authenticate the kubelet cert, so skip validation.
           skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }}
+          disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }}
 
   {{- if .Values.workloadAttestors.unix.enabled }}
     - unix:

charts/spire/charts/spire-agent/values.yaml

@@ -137,6 +137,8 @@ workloadAttestors:
   k8s:
     # -- If true, kubelet certificate verification is skipped
     skipKubeletVerification: true
+    # -- Set to true if using holdApplicationUntilProxyStarts in Istio
+    disableContainerSelectors: false
 
 telemetry:
   prometheus: