Allow additional CRs to be managed by the chart (#117)
* Add support for the new spire-controller-manager class feature Signed-off-by: Kevin Fox <[email protected]> * Fix docs. Swich nested deployment to use controller manager Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Test with nightly Signed-off-by: Kevin Fox <[email protected]> * Fix global object naming clash Signed-off-by: Kevin Fox <[email protected]> * Fix missing dot Signed-off-by: Kevin Fox <[email protected]> * Fix naming conflict with cluster ids Signed-off-by: Kevin Fox <[email protected]> * Fix scoping issue Signed-off-by: Kevin Fox <[email protected]> * Fix typo Signed-off-by: Kevin Fox <[email protected]> * Fix webhook name collision Signed-off-by: Kevin Fox <[email protected]> * Fix webhook reference and add note to user about className Signed-off-by: Kevin Fox <[email protected]> * Upgrade has to work on the old version of the object before rename Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Remove extra junk from job Signed-off-by: Kevin Fox <[email protected]> * Easier local runs and wait for crds Signed-off-by: Kevin Fox <[email protected]> * Add missing crd upgrade Signed-off-by: Kevin Fox <[email protected]> * Update upgrade notes Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml Co-authored-by: Marco Franssen <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Bump version to the released 0.4.0 Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Merge in crd changes from upstream Signed-off-by: Kevin Fox <[email protected]> * Add auto populate dns Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Add missing ClusterSPIFFEID fields There are a few options in the CRD not available via the chart. Sync them to the chart. Signed-off-by: Kevin Fox <[email protected]> * Add another missing one Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Allow additional CRs to be managed by the chart Sometimes additional ClusterSPIFFEIDs and the other CRs are needed. Add support for the end user to manage those extra CRs via the chart. Signed-off-by: Kevin Fox <[email protected]> * Add validation Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Add className to crs Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Fix readme formatting Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/README.md Signed-off-by: kfox1111 <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Remove dead code Signed-off-by: Kevin Fox <[email protected]> * Fix extra newline Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Marco Franssen <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
co-authored by
Faisal Memon
Marco Franssen
Faisal Memon
Marco Franssen
parent
d936293d50
commit
e030fa171b
@@ -445,38 +445,70 @@ controllerManager:
|
||||
- local-path-storage
|
||||
|
||||
identities:
|
||||
## @param controllerManager.identities.enabled Flag to enable default identities for controller manager
|
||||
enabled: true
|
||||
|
||||
## @param controllerManager.identities.spiffeIDTemplate Spiffe ID template for identities
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
||||
## @param controllerManager.identities.podSelector [object] Selector for pods to issue identity
|
||||
podSelector: {}
|
||||
# matchLabels:
|
||||
# spiffe.io/spiffe-id: "true"
|
||||
## @param controllerManager.identities.namespaceSelector [object] Selector for namespacs to issue identity
|
||||
namespaceSelector: {}
|
||||
# matchLabels:
|
||||
# spiffe.io/spiffe-id: "true"
|
||||
## @param controllerManager.identities.dnsNameTemplates [array] DNS name template for issued identities
|
||||
dnsNameTemplates: []
|
||||
# - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local'
|
||||
## @param controllerManager.identities.federatesWith [array] Other Spire server URLs for identity federation
|
||||
federatesWith: []
|
||||
# - example.io
|
||||
# - example.ai
|
||||
## @param controllerManager.identities.workloadSelectorTemplates [array] Templates to produce selectors that apply to a given workload before it will receive an ID
|
||||
workloadSelectorTemplates: []
|
||||
## @param controllerManager.identities.ttl Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen.
|
||||
ttl: ""
|
||||
## @param controllerManager.identities.jwtTTL Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen.
|
||||
jwtTTL: ""
|
||||
## @param controllerManager.identities.admin Indicates any pod matched by this identity will be an admin. Use this with extreme care.
|
||||
admin: false
|
||||
## @param controllerManager.identities.downstream Set if this spire instance is a root server and the workloads are downstream servers.
|
||||
downstream: false
|
||||
## @param controllerManager.identities.autoPopulateDNSNames Auto populate DNS names from services attached to pods
|
||||
autoPopulateDNSNames: false
|
||||
clusterSPIFFEIDs:
|
||||
# NOTE you can add multiple uniquely named entries to create multiple ClusterSPIFFEID objects. See example below.
|
||||
default:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable this identity for controller manager
|
||||
enabled: true
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate Spiffe ID template for identities
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.default.podSelector [object] Selector for pods to issue identity
|
||||
podSelector: {}
|
||||
# matchLabels:
|
||||
# spiffe.io/spiffe-id: "true"
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector [object] Selector for namespacs to issue identity
|
||||
namespaceSelector: {}
|
||||
# matchLabels:
|
||||
# spiffe.io/spiffe-id: "true"
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.default.dnsNameTemplates [array] DNS name template for issued identities
|
||||
dnsNameTemplates: []
|
||||
# - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local'
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.default.federatesWith [array] Other Spire server URLs for identity federation
|
||||
federatesWith: []
|
||||
# - example.io
|
||||
# - example.ai
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.default.workloadSelectorTemplates [array] Templates to produce selectors that apply to a given workload before it will receive an ID
|
||||
workloadSelectorTemplates: []
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.default.ttl Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen.
|
||||
ttl: ""
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.default.jwtTTL Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen.
|
||||
jwtTTL: ""
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.default.admin Indicates any pod matched by this identity will be an admin. Use this with extreme care.
|
||||
admin: false
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.default.downstream Set if this spire instance is a root server and the workloads are downstream servers.
|
||||
downstream: false
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames Auto populate DNS names from services attached to pods
|
||||
autoPopulateDNSNames: false
|
||||
|
||||
# You can specify additional ClusterSPIFFEIDs following this example:
|
||||
# foo:
|
||||
# labels:
|
||||
# foo: bar
|
||||
# spiffeIDTemplate: spiffe://{{ .TrustDomain }}/foo
|
||||
# namespaceSelector:
|
||||
# matchLabels:
|
||||
# foo: bar
|
||||
|
||||
## @param controllerManager.identities.clusterStaticEntries Specify ClusterStaticEntry objects.
|
||||
clusterStaticEntries: {}
|
||||
# foo:
|
||||
# labels:
|
||||
# foo: bar
|
||||
# parentID: spiffe://example.com/bar
|
||||
# spiffeID: spiffe://example.com/foo
|
||||
# selectors:
|
||||
# - k8s:pod-label:app.kubernetes.io/name:server
|
||||
|
||||
## @param controllerManager.identities.clusterFederatedTrustDomains Specify ClusterFederatedTrustDomain objects.
|
||||
clusterFederatedTrustDomains: {}
|
||||
# foo:
|
||||
# labels:
|
||||
# foo: bar
|
||||
# bundleEndpointProfile:
|
||||
# endpointSPIFFEID: spiffe://example.com/foo
|
||||
# type: https_spiffe
|
||||
# bundleEndpointURL: https://rootserver.example.com:1234
|
||||
# trustDomain: example.com
|
||||
|
||||
validatingWebhookConfiguration:
|
||||
## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued
|
||||
|
||||
Reference in New Issue
Block a user