panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update to spire-controller-manager 0.4.2 (#195)

Browse Source
This commit is contained in:
kfox1111
2024-01-25 12:07:10 +01:00
committed by GitHub
parent 3e1c5199b7
commit e8d527cd9a
9 changed files with 21 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+3 -1
View File
@@ -223,6 +223,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.enabled` | Flag to enable controller manager | `false` | | `controllerManager.enabled` | Flag to enable controller manager | `false` |
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` | | `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` | | `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
| `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
| `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` | | `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` |
| `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` | | `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` |
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | | `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
@@ -230,7 +231,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.1` | | `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.2` |
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
| `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.securityContext` | Security context | `{}` |
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
@@ -258,6 +259,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.type` | The type of rule this is. | `test-keys` | | `controllerManager.identities.clusterSPIFFEIDs.test-keys.type` | The type of rule this is. | `test-keys` |
| `controllerManager.identities.clusterStaticEntries` | Specify ClusterStaticEntry objects. | `{}` | | `controllerManager.identities.clusterStaticEntries` | Specify ClusterStaticEntry objects. | `{}` |
| `controllerManager.identities.clusterFederatedTrustDomains` | Specify ClusterFederatedTrustDomain objects. | `{}` | | `controllerManager.identities.clusterFederatedTrustDomains` | Specify ClusterFederatedTrustDomain objects. | `{}` |
| `controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another chart instance on the k8s cluster with webhooks enabled. | `true` |
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` | | `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
| `controllerManager.cacheNamespaces` | If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. | `{}` | | `controllerManager.cacheNamespaces` | If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. | `{}` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
+3
View File
@@ -29,7 +29,9 @@ data:
cacheNamespaces: cacheNamespaces:
{{- toYaml . | nindent 6 }} {{- toYaml . | nindent 6 }}
{{- end }} {{- end }}
{{- if .Values.controllerManager.validatingWebhookConfiguration.enabled }}
validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
{{- end }}
clusterName: {{ include "spire-lib.cluster-name" . }} clusterName: {{ include "spire-lib.cluster-name" . }}
trustDomain: {{ include "spire-lib.trust-domain" . }} trustDomain: {{ include "spire-lib.trust-domain" . }}
ignoreNamespaces: ignoreNamespaces:
@@ -39,4 +41,5 @@ data:
spireServerSocketPath: "/tmp/spire-server/private/api.sock" spireServerSocketPath: "/tmp/spire-server/private/api.sock"
className: {{ include "spire-server.controller-manager-class-name" . | quote}} className: {{ include "spire-server.controller-manager-class-name" . | quote}}
watchClassless: {{ .Values.controllerManager.watchClassless | toYaml }} watchClassless: {{ .Values.controllerManager.watchClassless | toYaml }}
parentIDTemplate: {{ .Values.controllerManager.parentIDTemplate | quote }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/templates/controller-manager-roles.yaml
+2
View File
@@ -37,9 +37,11 @@ rules:
- apiGroups: [""] - apiGroups: [""]
resources: ["namespaces"] resources: ["namespaces"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]
{{- if .Values.controllerManager.validatingWebhookConfiguration.enabled }}
- apiGroups: ["admissionregistration.k8s.io"] - apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations"] resources: ["validatingwebhookconfigurations"]
verbs: ["get", "list", "patch", "watch"] verbs: ["get", "list", "patch", "watch"]
{{- end }}
- apiGroups: [""] - apiGroups: [""]
resources: ["nodes"] resources: ["nodes"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]
charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml
+1 -1
View File
@@ -1,4 +1,4 @@
{{- if eq (.Values.controllerManager.enabled | toString) "true" }} {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
apiVersion: admissionregistration.k8s.io/v1 apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration kind: ValidatingWebhookConfiguration
metadata: metadata:
charts/spire/charts/spire-server/templates/post-install-hook.yaml
+1 -1
View File
@@ -1,5 +1,5 @@
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
{{- if eq (.Values.controllerManager.enabled | toString) "true" }} {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
apiVersion: v1 apiVersion: v1
kind: ServiceAccount kind: ServiceAccount
charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+1 -1
View File
@@ -1,5 +1,5 @@
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
{{- if eq (.Values.controllerManager.enabled | toString) "true" }} {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
apiVersion: v1 apiVersion: v1
kind: ServiceAccount kind: ServiceAccount
charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+1 -1
View File
@@ -1,5 +1,5 @@
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
{{- if eq (.Values.controllerManager.enabled | toString) "true" }} {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
apiVersion: v1 apiVersion: v1
kind: ServiceAccount kind: ServiceAccount
charts/spire/charts/spire-server/templates/statefulset.yaml
+3 -1
View File
@@ -202,8 +202,10 @@ spec:
{{- if .Values.controllerManager.expandEnv }} {{- if .Values.controllerManager.expandEnv }}
- --expand-env - --expand-env
{{- end }} {{- end }}
{{- if gt (len .Values.controllerManager.extraEnv) 0 }}
env: env:
- name: ENABLE_WEBHOOKS
value: {{ .Values.controllerManager.validatingWebhookConfiguration.enabled | toString | quote }}
{{- if gt (len .Values.controllerManager.extraEnv) 0 }}
{{- .Values.controllerManager.extraEnv | toYaml | nindent 12 }} {{- .Values.controllerManager.extraEnv | toYaml | nindent 12 }}
{{- end }} {{- end }}
ports: ports:
charts/spire/charts/spire-server/values.yaml
+6 -1
View File
@@ -423,6 +423,9 @@ controllerManager:
## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. ## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.
watchClassless: false watchClassless: false
## @param controllerManager.parentIDTemplate The template that is used to register workloads.
parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"
## @param controllerManager.expandEnv Set to true to enable environment variable substitution of config file options ## @param controllerManager.expandEnv Set to true to enable environment variable substitution of config file options
expandEnv: false expandEnv: false
@@ -445,7 +448,7 @@ controllerManager:
registry: ghcr.io registry: ghcr.io
repository: spiffe/spire-controller-manager repository: spiffe/spire-controller-manager
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: "0.4.1" tag: "0.4.2"
## @param controllerManager.resources [object] Resource requests and limits for controller manager ## @param controllerManager.resources [object] Resource requests and limits for controller manager
resources: {} resources: {}
@@ -570,6 +573,8 @@ controllerManager:
# trustDomain: example.com # trustDomain: example.com
validatingWebhookConfiguration: validatingWebhookConfiguration:
## @param controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another chart instance on the k8s cluster with webhooks enabled.
enabled: true
## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued ## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued
failurePolicy: Fail failurePolicy: Fail