From d2361549dbb983ca7db67d3792fdc36d86544c72 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 23 May 2024 09:43:19 -0700 Subject: [PATCH] Fix upstream ca name suffix issue (#361) * Fix upstream ca name suffix issue Signed-off-by: Kevin Fox * Fix quoting Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox --- charts/spire/README.md | 5 +++++ charts/spire/charts/spire-server/templates/configmap.yaml | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index bd0a300..b96d910 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -75,6 +75,11 @@ kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeid We only support upgrading one major version at a time. Version skipping isn't supported. +### 0.21.X + +- In previous versions, spire-server.upstreamAuthority.certManager.issuer_name would incorrectly have '-ca' appended. Starting with this version, that is no longer the case. If you previously set this +value, you likely want to update your value to include the '-ca' suffix in the value to have your deployment continue to function properly. + ### 0.20.X - The default service port for the spire-server was changed to be port 443 to allow easier switching between internal access and external access through an ingress controller. For most users, this will be a transparent diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index dc12108..bdd9d8f 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -269,7 +269,7 @@ plugins: UpstreamAuthority: cert-manager: plugin_data: - issuer_name: {{ default (include "spire-server.fullname" $root) .issuer_name }}-ca + issuer_name: {{ default (printf "%s-ca" (include "spire-server.fullname" $root)) .issuer_name }} issuer_kind: {{ .issuer_kind | quote }} issuer_group: {{ .issuer_group | quote }} namespace: {{ default $root.Release.Namespace .namespace | quote }}