kfox1111
2a8c1b63c4
* Bottom turtle ha registry tests Signed-off-by: Kevin Fox <[email protected]> * Fix test because of spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Fix config options Signed-off-by: Kevin Fox <[email protected]> * Fix yq issue and log better Signed-off-by: Kevin Fox <[email protected]> * Fix some things Signed-off-by: Kevin Fox <[email protected]> * Change timeout and fix image Signed-off-by: Kevin Fox <[email protected]> * Bump up zot version. Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Log less Signed-off-by: Kevin Fox <[email protected]> * Cleanup Signed-off-by: Kevin Fox <[email protected]> * Make test less different then real deployment Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
79 lines
2.5 KiB
YAML
79 lines
2.5 KiB
YAML
internal-spire-server-bottom-turtle-ha-a: &server
|
|
controllerManager:
|
|
identities:
|
|
clusterSPIFFEIDs:
|
|
zot:
|
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/zot
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: zot
|
|
dnsNameTemplates:
|
|
- zot.{{ .TrustDomain }}
|
|
clusterStaticEntries:
|
|
test:
|
|
parentID: spiffe://production.other/spire-identity-exchange
|
|
spiffeID: spiffe://production.other/k8s-psat/test
|
|
selectors:
|
|
- k8s_psat:namespace:default
|
|
- k8s_psat:service_account_name:default
|
|
|
|
image-push:
|
|
parentID: spiffe://production.other/spire-identity-exchange
|
|
spiffeID: spiffe://production.other/image-push
|
|
selectors:
|
|
- k8s_psat:namespace:default
|
|
- k8s_psat:service_account_name:zot-push
|
|
- spiffe:source_path:/ns/default/sa/zot-push
|
|
- spire_identity_exchange:stack:name:image_pull
|
|
|
|
image-pull:
|
|
parentID: spiffe://production.other/spire-identity-exchange
|
|
spiffeID: spiffe://production.other/image-pull
|
|
selectors:
|
|
- k8s_psat:namespace:default
|
|
- k8s_psat:service_account_name:zot-pull
|
|
- spiffe:source_path:/kubelet
|
|
- spire_identity_exchange:stack:name:image_pull
|
|
|
|
image-pull-from-pod:
|
|
parentID: spiffe://production.other/spire-identity-exchange
|
|
spiffeID: spiffe://production.other/image-pull
|
|
selectors:
|
|
- k8s_psat:namespace:default
|
|
- k8s_psat:service_account_name:zot-pull
|
|
- spiffe:source_path:/ns/default/sa/zot-pull
|
|
- spire_identity_exchange:stack:name:image_pull
|
|
spireIdentityExchange:
|
|
enabled: true
|
|
|
|
#Set the same settings on the B side
|
|
internal-spire-server-bottom-turtle-ha-b: *server
|
|
|
|
spire-identity-exchange-bottom-turtle-ha-a: &six
|
|
tls:
|
|
externalSecret:
|
|
enabled: true
|
|
secretName: spire-identity-exchange
|
|
rest:
|
|
enabled: true
|
|
ingress:
|
|
enabled: true
|
|
auth:
|
|
passthroughPlugins: true
|
|
plugins:
|
|
k8s_psat:
|
|
config:
|
|
allowedServiceAccounts:
|
|
- default/default
|
|
- default/zot-push
|
|
- default/zot-pull
|
|
spiffe:
|
|
config:
|
|
pathPatterns:
|
|
- "^/kubelet$"
|
|
- "^/ns/default/sa/zot-push$"
|
|
- "^/ns/default/sa/zot-pull$"
|
|
|
|
#Set the same settings on the B side
|
|
spire-identity-exchange-bottom-turtle-ha-b: *six
|