kfox1111
1169dd5692
* Update spire-controller-manager to 0.6.2 and add its staticManifest support Signed-off-by: Kevin Fox <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> * Fix indent Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
99 lines
4.9 KiB
YAML
99 lines
4.9 KiB
YAML
{{- $root := . }}
|
|
{{- $startPort := 8082 }}
|
|
{{- $clusters := default .Values.kubeConfigs .Values.externalControllerManagers.clusters }}
|
|
{{- $clusterDefaults := .Values.externalControllerManagers.defaults }}
|
|
{{- if not .Values.externalServer }}
|
|
{{- if or (eq (.Values.controllerManager.enabled | toString) "true") (and .Values.externalControllerManagers.enabled (gt (len $clusters) 0)) }}
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ include "spire-controller-manager.fullname" . }}
|
|
namespace: {{ include "spire-server.namespace" . }}
|
|
{{- with .Values.controllerManager.configMap.annotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
data:
|
|
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
|
{{- $clusterName := include "spire-lib.cluster-name" . }}
|
|
controller-manager-config.yaml: |
|
|
{{- include "spire-controller-manager.config" (dict "Values" .Values "Chart" .Chart "Release" .Release "startPort" $startPort "suffix" "" "settings" (dict) "defaults" .Values.controllerManager "webhookEnabled" .Values.controllerManager.validatingWebhookConfiguration.enabled "clusterName" $clusterName) | nindent 4 }}
|
|
{{- end }}
|
|
{{- if .Values.externalControllerManagers.enabled }}
|
|
{{- range $name, $_ := $clusters }}
|
|
{{- $clusterSettings := dict }}
|
|
{{- if hasKey $root.Values.externalControllerManagers.clusters $name }}
|
|
{{- $clusterSettings = index $root.Values.externalControllerManagers.clusters $name }}
|
|
{{- end }}
|
|
{{- $suffix := printf "-%s" $name }}
|
|
{{- $startPort = add $startPort 2 }}
|
|
controller-manager-config{{ $suffix }}.yaml: |
|
|
{{- include "spire-controller-manager.config" (dict "Values" $root.Values "Chart" $root.Chart "Release" $root.Release "startPort" $startPort "suffix" $suffix "settings" $clusterSettings "defaults" $clusterDefaults "webhookEnabled" false "clusterName" $name) | nindent 4 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- define "spire-controller-manager.config" }}
|
|
{{- $promPort := .startPort }}
|
|
{{- $healthPort := add $promPort 1 }}
|
|
apiVersion: spire.spiffe.io/v1alpha1
|
|
kind: ControllerManagerConfig
|
|
metadata:
|
|
name: {{ include "spire-controller-manager.fullname" . }}{{ .suffix }}
|
|
namespace: {{ include "spire-server.namespace" . }}
|
|
labels:
|
|
{{- include "spire-server.labels" . | nindent 4 }}
|
|
metrics:
|
|
bindAddress: 0.0.0.0:{{ $promPort }}
|
|
health:
|
|
healthProbeBindAddress: 0.0.0.0:{{ $healthPort }}
|
|
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
|
leaderElection:
|
|
leaderElect: true
|
|
resourceName: {{ printf "%s-%s%s" .Release.Namespace (default .Release.Name .Values.crNameOverride) .suffix | sha256sum | trunc 8 }}.spiffe.io
|
|
resourceNamespace: {{ include "spire-server.namespace" . }}
|
|
{{- end }}
|
|
{{- with .settings.cacheNamespaces }}
|
|
cacheNamespaces:
|
|
{{- toYaml . | nindent 2 }}
|
|
{{- end }}
|
|
{{- if .webhookEnabled }}
|
|
validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
|
|
{{- end }}
|
|
{{- $entryIDPrefixCleanup := .defaults.entryIDPrefixCleanup }}
|
|
{{- if hasKey .settings "entryIDPrefixCleanup" }}
|
|
{{- $entryIDPrefixCleanup = .settings.entryIDPrefixCleanup }}
|
|
{{- end }}
|
|
{{- if typeIs "string" $entryIDPrefixCleanup }}
|
|
entryIDPrefixCleanup: {{ $entryIDPrefixCleanup | quote }}
|
|
{{- end }}
|
|
entryIDPrefix: {{ .clusterName }}
|
|
clusterName: {{ .clusterName }}
|
|
trustDomain: {{ include "spire-lib.trust-domain" . }}
|
|
{{- $ignoreNamespaces := .defaults.ignoreNamespaces }}
|
|
{{- if hasKey .settings "ignoreNamespaces" }}
|
|
{{- $ignoreNamespaces = .settings.ignoreNamespaces }}
|
|
{{- end }}
|
|
{{- with $ignoreNamespaces }}
|
|
ignoreNamespaces:
|
|
{{- toYaml . | nindent 2 }}
|
|
{{- end }}
|
|
spireServerSocketPath: "/tmp/spire-server/private/api.sock"
|
|
className: {{ include "spire-server.controller-manager-class-name" . | quote}}
|
|
watchClassless: {{ if hasKey .settings "watchClassless" }}{{ .settings.watchClassless | toYaml }}{{ else }}{{ .defaults.watchClassless | toYaml }}{{ end }}
|
|
parentIDTemplate: {{ if hasKey .settings "parentIDTemplate" }}{{ .settings.parentIDTemplate | quote }}{{ else }}{{ .defaults.parentIDTemplate | quote }}{{ end }}
|
|
{{- $reconcile := dict }}
|
|
{{- if hasKey .settings "reconcile" }}
|
|
{{- $reconcile = .settings.reconcile }}
|
|
{{- end }}
|
|
reconcile:
|
|
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
|
clusterSPIFFEIDs: {{ if hasKey $reconcile "clusterSPIFFEIDs" }}{{ toYaml $reconcile.clusterSPIFFEIDs }}{{ else }}{{ toYaml .defaults.reconcile.clusterSPIFFEIDs }}{{ end }}
|
|
{{- end }}
|
|
clusterStaticEntries: {{ if hasKey $reconcile "clusterStaticEntries" }}{{ toYaml $reconcile.clusterStaticEntries }}{{ else }}{{ toYaml .defaults.reconcile.clusterStaticEntries }}{{ end }}
|
|
clusterFederatedTrustDomains: {{ if hasKey $reconcile "clusterFederatedTrustDomains" }}{{ toYaml $reconcile.clusterFederatedTrustDomains }}{{ else }}{{ toYaml .defaults.reconcile.clusterFederatedTrustDomains }}{{ end }}
|
|
{{- if ne .Values.controllerManager.staticManifestMode "off" }}
|
|
staticManifestPath: /manifests
|
|
{{- end }}
|
|
{{- end }}
|