b60c222c78
The spire-config volume (agent.conf) hardcodes
{{ include "spire-agent.fullname" . }} with no $nameSuffix, unlike
every other per-profile resource this chart renders (the ConfigMap
itself, the trust-bundle volume, the DaemonSet name). Any additional
agents.<name> profile's DaemonSet therefore silently mounts the
default profile's agent.conf, regardless of what's configured under
that profile -- workloadAttestors, customPlugins, anything.
Confirmed via a real cluster: an agents.gvisor profile's
disableContainerSelectors never took effect because its DaemonSet was
mounting the default spire-agent ConfigMap the whole time, not
spire-agent-gvisor (which rendered correctly, just was never read).
Verified via `helm template`: additional profiles now get their own
correctly-suffixed ConfigMap reference, matching the DaemonSet's own
name and the trust-bundle volume's existing (correct) behavior.
Signed-off-by: dmorris <[email protected]>
Co-authored-by: dmorris <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
Note
Things to consider:
- We do not support running out of the git main branch. This is where development happens. Please use released versions via the published repo or git tags.
- All the helm charts in this repo are beta. We encourage you to try them out and contribute. The API may change as we move towards a production ready release.
SPIFFE Helm Charts
A suite of Helm Charts for standardized installations of SPIRE components in Kubernetes environments.
How to install or upgrade
You most likely want to do an integrated setup based on the spire chart. See the Instructions.
Contributing
Before contributing ensure to check our CONTRIBUTING guidelines.
LICENSE
This project is licensed under Apache License, Version 2.0.
Reporting a Vulnerability
Vulnerabilities can be reported by sending an email to [email protected]. A confirmation email will be sent to acknowledge the report within 72 hours. A second acknowledgement will be sent within 7 days when the vulnerability has been positively or negatively confirmed.