From dfbbecf077447b37662229d0290bdacf69771d9f Mon Sep 17 00:00:00 2001 From: Oliver Bassett <41191289+obassett@users.noreply.github.com> Date: Fri, 19 Dec 2025 09:47:45 +1100 Subject: [PATCH] Add guard to the validating admission policy to stop errors when there are no volumes in the spec. This fixes errors with HTTP solver pods in cert manager. (#706) Signed-off-by: Oliver Bassett Co-authored-by: kfox1111 --- charts/spire/charts/spiffe-csi-driver/templates/policy.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/charts/spire/charts/spiffe-csi-driver/templates/policy.yaml b/charts/spire/charts/spiffe-csi-driver/templates/policy.yaml index 6c82b45..0b20d8f 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/policy.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/policy.yaml @@ -17,6 +17,7 @@ spec: resources: ["pods"] validations: - expression: | + !has(object.spec.volumes) || !object.spec.volumes.exists(c, has(c.csi) && has(c.csi.driver) && c.csi.driver == {{ .Values.pluginName | quote }}) message: 'you may not use the upstream.csi.spiffe.io csi driver' ---