Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for the new fallback spire-controller-manager feature #471

Merged
merged 10 commits into from
Oct 17, 2024
Merged

Add support for the new fallback spire-controller-manager feature #471

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
6a99e8b
Add support for the new fallback spire-controller-manager feature
kfox1111 Oct 1, 2024
5692ab4
Fix docs
kfox1111 Oct 1, 2024
5091a35
Merge branch 'main' into fallback
kfox1111 Oct 3, 2024
71575e5
Merge branch 'main' into fallback
kfox1111 Oct 3, 2024
0185e5f
Merge branch 'main' into fallback
kfox1111 Oct 7, 2024
6905f38
Merge branch 'main' into fallback
kfox1111 Oct 7, 2024
ad18dea
Merge branch 'main' into fallback
kfox1111 Oct 8, 2024
f1a455c
Merge branch 'main' into fallback
kfox1111 Oct 10, 2024
48fbab6
Merge branch 'main' into fallback
kfox1111 Oct 10, 2024
00b5227
Merge branch 'main' into fallback
kfox1111 Oct 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,11 @@ spec:
description: AutoPopulateDNSNames indicates whether or not to auto
populate service DNS names.
type: boolean
fallback:
description: |-
Apply this ID only if there are no other matching non fallback
ClusterSPIFFEIDs
type: boolean
dnsNameTemplates:
description: DNSNameTemplate represents templates for extra DNS names
that are applicable to SVIDs minted for this ClusterSPIFFEID. The
Expand Down
1 change: 1 addition & 0 deletions charts/spire/charts/spire-server/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,6 +289,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `controllerManager.identities.clusterSPIFFEIDs.default.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
| `controllerManager.identities.clusterSPIFFEIDs.default.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` |
| `controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` |
| `controllerManager.identities.clusterSPIFFEIDs.default.fallback` | Apply this ID only if there are no other matching non fallback ClusterSPIFFEIDs | `true` |
| `controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled` | Enable this identity for controller manager | `false` |
| `controllerManager.identities.clusterSPIFFEIDs.child-servers.type` | The type of rule this is. | `child-servers` |
| `controllerManager.identities.clusterSPIFFEIDs.child-servers.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `true` |
Expand Down
5 changes: 4 additions & 1 deletion charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ matchLabels:
{{ $namespaces := list .Release.Namespace .Values.namespaceOverride (dig "spire" "namespaces" "server" "name" "" .Values.global) (dig "spire" "namespaces" "system" "name" "" .Values.global) | compact | uniq }}
{{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }}
{{- range $skey, $svalue := $value }}
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "type" "admin" "dnsNameTemplates" "downstream" "federatesWith" "jwtTTL" "namespaceSelector" "podSelector" "spiffeIDTemplate" "ttl" "workloadSelectorTemplates" "autoPopulateDNSNames")) }}
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "type" "admin" "dnsNameTemplates" "downstream" "federatesWith" "jwtTTL" "namespaceSelector" "podSelector" "spiffeIDTemplate" "ttl" "workloadSelectorTemplates" "autoPopulateDNSNames" "fallback")) }}
{{- fail (printf "Unsupported property specified: %s" $skey) }}
{{- end }}
{{- end }}
Expand Down Expand Up @@ -103,6 +103,9 @@ spec:
{{- with $value.autoPopulateDNSNames }}
autoPopulateDNSNames: {{ . }}
{{- end }}
{{- with $value.fallback }}
fallback: {{ . }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
2 changes: 2 additions & 0 deletions charts/spire/charts/spire-server/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -628,6 +628,8 @@ controllerManager:
downstream: false
## @param controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames Auto populate DNS names from services attached to pods
autoPopulateDNSNames: false
## @param controllerManager.identities.clusterSPIFFEIDs.default.fallback Apply this ID only if there are no other matching non fallback ClusterSPIFFEIDs
fallback: true

child-servers:
## @param controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable this identity for controller manager
Expand Down
Loading