kfox1111andMarco Franssen
08f699bdb0
* Add spire-lib chart Make spire-lib bits into its own library chart. Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Marco Franssen <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Move notes back Signed-off-by: Kevin Fox <[email protected]> * Fix NOTES Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Marco Franssen <[email protected]>
30 lines
1.2 KiB
YAML
30 lines
1.2 KiB
YAML
{{- define "spire-lib.namespace.default_system_labels" }}
|
|
"pod-security.kubernetes.io/warn": privileged
|
|
"pod-security.kubernetes.io/audit": privileged
|
|
"pod-security.kubernetes.io/enforce": privileged
|
|
{{- end }}
|
|
{{- define "spire-lib.namespace.system" }}
|
|
{{- if or .Values.global.spire.namespaces.create .Values.global.spire.namespaces.system.create }}
|
|
{{- $labels := dict }}
|
|
{{- if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespacePSS" true .Values.global) }}
|
|
{{- $labels = mergeOverwrite $labels (include "spire-lib.namespace.default_system_labels" . | fromYaml) }}
|
|
{{- if (dig "openshift" false .Values.global) }}
|
|
{{- $_ := set $labels "security.openshift.io/scc.podSecurityLabelSync" "false" }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- $labels = mergeOverwrite $labels .Values.global.spire.namespaces.server.labels }}
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: {{ .Values.global.spire.namespaces.system.name }}
|
|
{{- with $labels }}
|
|
labels:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
{{- with .Values.global.spire.namespaces.system.annotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|