JoelGoh92andJoel Goh
58dab12e55
* Expose filterByClassName setting to restrict the controller manager's ClusterSPIFFEID cache by class name, defaulting to false for backward compatibility. Signed-off-by: Joel Goh <[email protected]> * Shorten filterByClassName param descriptions and regenerate README. Signed-off-by: Joel Goh <[email protected]> --------- Signed-off-by: Joel Goh <[email protected]> Co-authored-by: Joel Goh <[email protected]>
110 lines
5.5 KiB
YAML
110 lines
5.5 KiB
YAML
{{- $root := . }}
|
|
{{- $startPort := 8082 }}
|
|
{{- $clusters := default .Values.kubeConfigs .Values.externalControllerManagers.clusters }}
|
|
{{- $clusterDefaults := .Values.externalControllerManagers.defaults }}
|
|
{{- if not .Values.externalServer }}
|
|
{{- if or (eq (.Values.controllerManager.enabled | toString) "true") (and .Values.externalControllerManagers.enabled (gt (len $clusters) 0)) }}
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ include "spire-controller-manager.fullname" . }}
|
|
namespace: {{ include "spire-server.namespace" . }}
|
|
{{- with .Values.controllerManager.configMap.annotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
data:
|
|
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
|
{{- $clusterName := include "spire-lib.cluster-name" . }}
|
|
controller-manager-config.yaml: |
|
|
{{- include "spire-controller-manager.config" (dict "Values" .Values "Chart" .Chart "Release" .Release "startPort" $startPort "suffix" "" "settings" (dict) "defaults" .Values.controllerManager "webhookEnabled" .Values.controllerManager.validatingWebhookConfiguration.enabled "clusterName" $clusterName) | nindent 4 }}
|
|
{{- end }}
|
|
{{- if .Values.externalControllerManagers.enabled }}
|
|
{{- range $name, $_ := $clusters }}
|
|
{{- $clusterSettings := dict }}
|
|
{{- if hasKey $root.Values.externalControllerManagers.clusters $name }}
|
|
{{- $clusterSettings = index $root.Values.externalControllerManagers.clusters $name }}
|
|
{{- end }}
|
|
{{- $suffix := printf "-%s" $name }}
|
|
{{- $startPort = add $startPort 2 }}
|
|
controller-manager-config{{ $suffix }}.yaml: |
|
|
{{- include "spire-controller-manager.config" (dict "Values" $root.Values "Chart" $root.Chart "Release" $root.Release "startPort" $startPort "suffix" $suffix "settings" $clusterSettings "defaults" $clusterDefaults "webhookEnabled" false "clusterName" $name) | nindent 4 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- define "spire-controller-manager.config" }}
|
|
{{- $promPort := .startPort }}
|
|
{{- $healthPort := add $promPort 1 }}
|
|
apiVersion: spire.spiffe.io/v1alpha1
|
|
kind: ControllerManagerConfig
|
|
metadata:
|
|
name: {{ include "spire-controller-manager.fullname" . }}{{ .suffix }}
|
|
namespace: {{ include "spire-server.namespace" . }}
|
|
labels:
|
|
{{- include "spire-server.labels" . | nindent 4 }}
|
|
metrics:
|
|
bindAddress: 0.0.0.0:{{ $promPort }}
|
|
health:
|
|
healthProbeBindAddress: 0.0.0.0:{{ $healthPort }}
|
|
gcInterval: {{ .Values.controllerManager.gcInterval }}
|
|
logLevel: {{ .Values.controllerManager.logLevel }}
|
|
{{- with .Values.controllerManager.logEncoding }}
|
|
logEncoding: {{ . }}
|
|
{{- end }}
|
|
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
|
leaderElection:
|
|
leaderElect: true
|
|
resourceName: {{ printf "%s-%s%s" .Release.Namespace (default .Release.Name .Values.crNameOverride) .suffix | sha256sum | trunc 8 }}.spiffe.io
|
|
resourceNamespace: {{ include "spire-server.namespace" . }}
|
|
leaseDuration: {{ .defaults.leaderElection.leaseDuration }}
|
|
renewDeadline: {{ .defaults.leaderElection.renewDeadline }}
|
|
retryPeriod: {{ .defaults.leaderElection.retryPeriod }}
|
|
{{- end }}
|
|
{{- with .settings.cacheNamespaces }}
|
|
cacheNamespaces:
|
|
{{- toYaml . | nindent 2 }}
|
|
{{- end }}
|
|
{{- if .webhookEnabled }}
|
|
validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook
|
|
{{- end }}
|
|
{{- $entryIDPrefixCleanup := .defaults.entryIDPrefixCleanup }}
|
|
{{- if hasKey .settings "entryIDPrefixCleanup" }}
|
|
{{- $entryIDPrefixCleanup = .settings.entryIDPrefixCleanup }}
|
|
{{- end }}
|
|
{{- if typeIs "string" $entryIDPrefixCleanup }}
|
|
entryIDPrefixCleanup: {{ $entryIDPrefixCleanup | quote }}
|
|
{{- end }}
|
|
{{- if .Values.controllerManager.addEntryIDPrefix }}
|
|
entryIDPrefix: {{ .clusterName }}
|
|
{{- end }}
|
|
clusterName: {{ .clusterName }}
|
|
trustDomain: {{ include "spire-lib.trust-domain" . }}
|
|
{{- $ignoreNamespaces := .defaults.ignoreNamespaces }}
|
|
{{- if hasKey .settings "ignoreNamespaces" }}
|
|
{{- $ignoreNamespaces = .settings.ignoreNamespaces }}
|
|
{{- end }}
|
|
{{- with $ignoreNamespaces }}
|
|
ignoreNamespaces:
|
|
{{- toYaml . | nindent 2 }}
|
|
{{- end }}
|
|
spireServerSocketPath: "/tmp/spire-server/private/api.sock"
|
|
className: {{ include "spire-server.controller-manager-class-name" . | quote}}
|
|
watchClassless: {{ if hasKey .settings "watchClassless" }}{{ .settings.watchClassless | toYaml }}{{ else }}{{ .defaults.watchClassless | toYaml }}{{ end }}
|
|
filterByClassName: {{ if hasKey .settings "filterByClassName" }}{{ .settings.filterByClassName | toYaml }}{{ else }}{{ .defaults.filterByClassName | toYaml }}{{ end }}
|
|
parentIDTemplate: {{ if hasKey .settings "parentIDTemplate" }}{{ .settings.parentIDTemplate | quote }}{{ else }}{{ .defaults.parentIDTemplate | quote }}{{ end }}
|
|
{{- $reconcile := dict }}
|
|
{{- if hasKey .settings "reconcile" }}
|
|
{{- $reconcile = .settings.reconcile }}
|
|
{{- end }}
|
|
reconcile:
|
|
{{- if eq .Values.controllerManager.staticManifestMode "off" }}
|
|
clusterSPIFFEIDs: {{ if hasKey $reconcile "clusterSPIFFEIDs" }}{{ toYaml $reconcile.clusterSPIFFEIDs }}{{ else }}{{ toYaml .defaults.reconcile.clusterSPIFFEIDs }}{{ end }}
|
|
{{- end }}
|
|
clusterStaticEntries: {{ if hasKey $reconcile "clusterStaticEntries" }}{{ toYaml $reconcile.clusterStaticEntries }}{{ else }}{{ toYaml .defaults.reconcile.clusterStaticEntries }}{{ end }}
|
|
clusterFederatedTrustDomains: {{ if hasKey $reconcile "clusterFederatedTrustDomains" }}{{ toYaml $reconcile.clusterFederatedTrustDomains }}{{ else }}{{ toYaml .defaults.reconcile.clusterFederatedTrustDomains }}{{ end }}
|
|
{{- if ne .Values.controllerManager.staticManifestMode "off" }}
|
|
staticManifestPath: /manifests
|
|
{{- end }}
|
|
{{- end }}
|