Faisal Memon
9273f11f0a
* Add root-level spire-lib chart Signed-off-by: Faisal Memon <[email protected]> * Make spire consume root-level spire-lib Signed-off-by: Faisal Memon <[email protected]> * Prepare chart dependencies in CI Signed-off-by: Faisal Memon <[email protected]> * Document DCO requirement in CODEX Signed-off-by: Faisal Memon <[email protected]> * Centralize local chart dependency prep Signed-off-by: Faisal Memon <[email protected]> * Exclude spire-lib from chart-testing install Signed-off-by: Faisal Memon <[email protected]> * Rename CODEX guide to AGENTS Signed-off-by: Faisal Memon <[email protected]> * Add make target for chart dependencies Signed-off-by: Faisal Memon <[email protected]> --------- Signed-off-by: Faisal Memon <[email protected]>
33 lines
1.4 KiB
YAML
33 lines
1.4 KiB
YAML
{{- define "spire-lib.namespace.default_server_labels" }}
|
|
"pod-security.kubernetes.io/warn": restricted
|
|
"pod-security.kubernetes.io/audit": restricted
|
|
"pod-security.kubernetes.io/enforce": restricted
|
|
{{- end }}
|
|
{{- define "spire-lib.namespace.server" }}
|
|
{{- if or .Values.global.spire.namespaces.create .Values.global.spire.namespaces.server.create }}
|
|
{{- $labels := dict }}
|
|
{{- if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespacePSS" true .Values.global) }}
|
|
{{- $labels = mergeOverwrite $labels (include "spire-lib.namespace.default_server_labels" . | fromYaml) }}
|
|
{{- if (dig "openshift" false .Values.global) }}
|
|
{{- $_ := set $labels "security.openshift.io/scc.podSecurityLabelSync" "false" }}
|
|
{{- if (index .Values "spiffe-oidc-discovery-provider").enabled }}
|
|
{{- $_ := set $labels "pod-security.kubernetes.io/enforce" "privileged" }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- $labels = mergeOverwrite $labels .Values.global.spire.namespaces.server.labels }}
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: {{ .Values.global.spire.namespaces.server.name }}
|
|
{{- with $labels }}
|
|
labels:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
{{- with .Values.global.spire.namespaces.server.annotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|