panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make spire-server rollout strategy configurable (#924)

Browse Source 
Signed-off-by: Daniel Schlatter <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
Daniel Schlatter
2026-08-18 11:47:36 -07:00
committed by GitHub
co-authored by kfox1111
parent 07ba722da0
commit e46ad1594a
4 changed files with 60 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+1
View File
@@ -87,6 +87,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `kind` | Define SPIRE server deployment type. Can be statefulset/deployment. Defaults to statefulset if not set. This feature is experimental. | `statefulset` |
| `updateStrategy` | Rollout strategy for the server, mapped to spec.updateStrategy when kind is "statefulset" and to spec.strategy when kind is "deployment". Left empty the Kubernetes default applies, which for a Deployment surges a second server before the old one goes away. Set `{type: Recreate}` to keep at most one server running, as a memory keyManager or an in-memory datastore requires. | `{}` |
| `externalServer` | Deploy only the bundle ConfigMap, RBAC rules, and identity documents but not the server. Use in a nested setup where the server is external. | `false` |
| `externalServerSubject.kind` | RBAC subject kind the external (nested) server's downstream bindings are granted to. One of "User" (client-certificate identity, the historical default), "Group", or "ServiceAccount" (e.g. for a static-token kubeconfig). Only used when externalServer is true. | `User` |
| `externalServerSubject.name` | Name of the subject. For kind "User" it must match the CN of the client certificate the external server presents; for kind "Group" it is the group name (e.g. a certificate O value); for kind "ServiceAccount" it is the name of the (operator-managed, out-of-band) ServiceAccount. | `spire-root` |
charts/spire/charts/spire-server/templates/server-resource.yaml
+8
View File
@@ -90,6 +90,14 @@ spec:
{{- end }}
replicas: {{ .Values.replicaCount }}
{{- end }}
{{- with .Values.updateStrategy }}
{{- if eq $.Values.kind "statefulset" }}
updateStrategy:
{{- else }}
strategy:
{{- end }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- if eq .Values.kind "statefulset" }}
serviceName: {{ include "spire-server.fullname" . }}
{{- end }}
charts/spire/charts/spire-server/values.yaml
+3
View File
@@ -23,6 +23,9 @@ image:
## @param kind Define SPIRE server deployment type. Can be statefulset/deployment. Defaults to statefulset if not set. This feature is experimental.
kind: statefulset
## @param updateStrategy [object] Rollout strategy for the server, mapped to spec.updateStrategy when kind is "statefulset" and to spec.strategy when kind is "deployment". Left empty the Kubernetes default applies, which for a Deployment surges a second server before the old one goes away. Set `{type: Recreate}` to keep at most one server running, as a memory keyManager or an in-memory datastore requires.
updateStrategy: {}
## @param externalServer Deploy only the bundle ConfigMap, RBAC rules, and identity documents but not the server. Use in a nested setup where the server is external.
externalServer: false