The spire-config volume (agent.conf) hardcodes
{{ include "spire-agent.fullname" . }} with no $nameSuffix, unlike
every other per-profile resource this chart renders (the ConfigMap
itself, the trust-bundle volume, the DaemonSet name). Any additional
agents.<name> profile's DaemonSet therefore silently mounts the
default profile's agent.conf, regardless of what's configured under
that profile -- workloadAttestors, customPlugins, anything.
Confirmed via a real cluster: an agents.gvisor profile's
disableContainerSelectors never took effect because its DaemonSet was
mounting the default spire-agent ConfigMap the whole time, not
spire-agent-gvisor (which rendered correctly, just was never read).
Verified via `helm template`: additional profiles now get their own
correctly-suffixed ConfigMap reference, matching the DaemonSet's own
name and the trust-bundle volume's existing (correct) behavior.
Signed-off-by: dmorris <[email protected]>
Co-authored-by: dmorris <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
