Skip to content

Commit 629cd00

Browse files
marcofranssenmarcofranssen
committed
Add support for spire-controller-manager
Signed-off-by: Marco Franssen <[email protected]>
1 parent 96ea889 commit 629cd00

14 files changed

+607
-3
lines changed

‎.github/tests/spire-controller-manager/values.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
spire-server:
2+
k8sWorkloadRegistrar:
3+
enabled: false
4+
5+
controllerManager:
6+
enabled: true

‎charts/spire/README.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,5 +70,4 @@ Kubernetes: `>=1.21.0-0`
7070
| spire-server.bundleConfigMap | string | `"spire-bundle"` | |
7171
| spire-server.clusterName | string | `"example-cluster"` | |
7272
| spire-server.nameOverride | string | `"server"` | |
73-
| spire-server.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | |
7473
| spire-server.trustDomain | string | `"example.org"` | |

‎charts/spire/charts/spire-server/README.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,14 @@ A Helm chart to install the SPIRE server.
2020
| ca_subject.country | string | `"NL"` | |
2121
| ca_subject.organization | string | `"Example"` | |
2222
| clusterName | string | `"example-cluster"` | |
23+
| controllerManager.enabled | bool | `false` | |
24+
| controllerManager.image.pullPolicy | string | `"IfNotPresent"` | |
25+
| controllerManager.image.registry | string | `"gcr.io"` | |
26+
| controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | |
27+
| controllerManager.image.version | string | `"0.2.1"` | |
28+
| controllerManager.logLevel | string | `"info"` | |
29+
| controllerManager.resources | object | `{}` | |
30+
| controllerManager.securityContext | object | `{}` | |
2331
| dataStorage.accessMode | string | `"ReadWriteOnce"` | |
2432
| dataStorage.enabled | bool | `true` | |
2533
| dataStorage.size | string | `"1Gi"` | |

‎charts/spire/charts/spire-server/crds/clusterfederatedtrustdomains.yaml

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
controller-gen.kubebuilder.io/version: v0.8.0
7+
creationTimestamp: null
8+
name: clusterfederatedtrustdomains.spire.spiffe.io
9+
spec:
10+
group: spire.spiffe.io
11+
names:
12+
kind: ClusterFederatedTrustDomain
13+
listKind: ClusterFederatedTrustDomainList
14+
plural: clusterfederatedtrustdomains
15+
singular: clusterfederatedtrustdomain
16+
scope: Cluster
17+
versions:
18+
- additionalPrinterColumns:
19+
- jsonPath: .spec.trustDomain
20+
name: Trust Domain
21+
type: string
22+
- jsonPath: .spec.bundleEndpointURL
23+
name: Endpoint URL
24+
type: string
25+
name: v1alpha1
26+
schema:
27+
openAPIV3Schema:
28+
description: ClusterFederatedTrustDomain is the Schema for the clusterfederatedtrustdomains
29+
API
30+
properties:
31+
apiVersion:
32+
description: 'APIVersion defines the versioned schema of this representation
33+
of an object. Servers should convert recognized schemas to the latest
34+
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
35+
type: string
36+
kind:
37+
description: 'Kind is a string value representing the REST resource this
38+
object represents. Servers may infer this from the endpoint the client
39+
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
40+
type: string
41+
metadata:
42+
type: object
43+
spec:
44+
description: ClusterFederatedTrustDomainSpec defines the desired state
45+
of ClusterFederatedTrustDomain
46+
properties:
47+
bundleEndpointProfile:
48+
description: BundleEndpointProfile is the profile for the bundle endpoint.
49+
properties:
50+
endpointSPIFFEID:
51+
description: EndpointSPIFFEID is the SPIFFE ID of the bundle endpoint.
52+
It is required for the "https_spiffe" profile.
53+
type: string
54+
type:
55+
description: Type is the type of the bundle endpoint profile.
56+
enum:
57+
- https_spiffe
58+
- https_web
59+
type: string
60+
required:
61+
- type
62+
type: object
63+
bundleEndpointURL:
64+
description: BundleEndpointURL is the URL of the bundle endpoint.
65+
It must be an HTTPS URL and cannot contain userinfo (i.e. username/password).
66+
type: string
67+
trustDomain:
68+
description: TrustDomain is the name of the trust domain to federate
69+
with (e.g. example.org)
70+
pattern: '[a-z0-9._-]{1,255}'
71+
type: string
72+
trustDomainBundle:
73+
description: TrustDomainBundle is the contents of the bundle for the
74+
referenced trust domain. This field is optional when the resource
75+
is created.
76+
type: string
77+
required:
78+
- bundleEndpointProfile
79+
- bundleEndpointURL
80+
- trustDomain
81+
type: object
82+
status:
83+
description: ClusterFederatedTrustDomainStatus defines the observed state
84+
of ClusterFederatedTrustDomain
85+
type: object
86+
type: object
87+
served: true
88+
storage: true
89+
subresources:
90+
status: {}
91+
status:
92+
acceptedNames:
93+
kind: ""
94+
plural: ""
95+
conditions: []
96+
storedVersions: []

‎charts/spire/charts/spire-server/crds/clusterspiffeids.yaml

Lines changed: 221 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,221 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
controller-gen.kubebuilder.io/version: v0.8.0
7+
creationTimestamp: null
8+
name: clusterspiffeids.spire.spiffe.io
9+
spec:
10+
group: spire.spiffe.io
11+
names:
12+
kind: ClusterSPIFFEID
13+
listKind: ClusterSPIFFEIDList
14+
plural: clusterspiffeids
15+
singular: clusterspiffeid
16+
scope: Cluster
17+
versions:
18+
- name: v1alpha1
19+
schema:
20+
openAPIV3Schema:
21+
description: ClusterSPIFFEID is the Schema for the clusterspiffeids API
22+
properties:
23+
apiVersion:
24+
description: 'APIVersion defines the versioned schema of this representation
25+
of an object. Servers should convert recognized schemas to the latest
26+
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
27+
type: string
28+
kind:
29+
description: 'Kind is a string value representing the REST resource this
30+
object represents. Servers may infer this from the endpoint the client
31+
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
32+
type: string
33+
metadata:
34+
type: object
35+
spec:
36+
description: ClusterSPIFFEIDSpec defines the desired state of ClusterSPIFFEID
37+
properties:
38+
admin:
39+
description: Admin indicates whether or not the SVID can be used to
40+
access the SPIRE administrative APIs. Extra care should be taken
41+
to only apply this SPIFFE ID to admin workloads.
42+
type: boolean
43+
dnsNameTemplates:
44+
description: DNSNameTemplate represents templates for extra DNS names
45+
that are applicable to SVIDs minted for this ClusterSPIFFEID. The
46+
node and pod spec are made available to the template under .NodeSpec,
47+
.PodSpec respectively.
48+
items:
49+
type: string
50+
type: array
51+
federatesWith:
52+
description: FederatesWith is a list of trust domain names that workloads
53+
that obtain this SPIFFE ID will federate with.
54+
items:
55+
type: string
56+
type: array
57+
namespaceSelector:
58+
description: NamespaceSelector selects the namespaces that are targetted
59+
by this CRD.
60+
properties:
61+
matchExpressions:
62+
description: matchExpressions is a list of label selector requirements.
63+
The requirements are ANDed.
64+
items:
65+
description: A label selector requirement is a selector that
66+
contains values, a key, and an operator that relates the key
67+
and values.
68+
properties:
69+
key:
70+
description: key is the label key that the selector applies
71+
to.
72+
type: string
73+
operator:
74+
description: operator represents a key's relationship to
75+
a set of values. Valid operators are In, NotIn, Exists
76+
and DoesNotExist.
77+
type: string
78+
values:
79+
description: values is an array of string values. If the
80+
operator is In or NotIn, the values array must be non-empty.
81+
If the operator is Exists or DoesNotExist, the values
82+
array must be empty. This array is replaced during a strategic
83+
merge patch.
84+
items:
85+
type: string
86+
type: array
87+
required:
88+
- key
89+
- operator
90+
type: object
91+
type: array
92+
matchLabels:
93+
additionalProperties:
94+
type: string
95+
description: matchLabels is a map of {key,value} pairs. A single
96+
{key,value} in the matchLabels map is equivalent to an element
97+
of matchExpressions, whose key field is "key", the operator
98+
is "In", and the values array contains only "value". The requirements
99+
are ANDed.
100+
type: object
101+
type: object
102+
podSelector:
103+
description: PodSelector selects the pods that are targetted by this
104+
CRD.
105+
properties:
106+
matchExpressions:
107+
description: matchExpressions is a list of label selector requirements.
108+
The requirements are ANDed.
109+
items:
110+
description: A label selector requirement is a selector that
111+
contains values, a key, and an operator that relates the key
112+
and values.
113+
properties:
114+
key:
115+
description: key is the label key that the selector applies
116+
to.
117+
type: string
118+
operator:
119+
description: operator represents a key's relationship to
120+
a set of values. Valid operators are In, NotIn, Exists
121+
and DoesNotExist.
122+
type: string
123+
values:
124+
description: values is an array of string values. If the
125+
operator is In or NotIn, the values array must be non-empty.
126+
If the operator is Exists or DoesNotExist, the values
127+
array must be empty. This array is replaced during a strategic
128+
merge patch.
129+
items:
130+
type: string
131+
type: array
132+
required:
133+
- key
134+
- operator
135+
type: object
136+
type: array
137+
matchLabels:
138+
additionalProperties:
139+
type: string
140+
description: matchLabels is a map of {key,value} pairs. A single
141+
{key,value} in the matchLabels map is equivalent to an element
142+
of matchExpressions, whose key field is "key", the operator
143+
is "In", and the values array contains only "value". The requirements
144+
are ANDed.
145+
type: object
146+
type: object
147+
spiffeIDTemplate:
148+
description: SPIFFEID is the SPIFFE ID template. The node and pod
149+
spec are made available to the template under .NodeSpec, .PodSpec
150+
respectively.
151+
type: string
152+
ttl:
153+
description: TTL indicates an upper-bound time-to-live for SVIDs minted
154+
for this ClusterSPIFFEID. If unset, a default will be chosen.
155+
type: string
156+
workloadSelectorTemplates:
157+
description: WorkloadSelectorTemplates are templates to produce arbitrary
158+
workload selectors that apply to a given workload before it will
159+
receive this SPIFFE ID. The rendered value is interpreted by SPIRE
160+
and are of the form type:value, where the value may, and often does,
161+
contain semicolons, .e.g., k8s:container-image:docker/hello-world
162+
The node and pod spec are made available to the template under .NodeSpec,
163+
.PodSpec respectively.
164+
items:
165+
type: string
166+
type: array
167+
required:
168+
- spiffeIDTemplate
169+
type: object
170+
status:
171+
description: ClusterSPIFFEIDStatus defines the observed state of ClusterSPIFFEID
172+
properties:
173+
stats:
174+
description: Stats produced by the last entry reconciliation run
175+
properties:
176+
entriesMasked:
177+
description: How many entries were masked by entries for other
178+
ClusterSPIFFEIDs. This happens when one or more ClusterSPIFFEIDs
179+
produce an entry for the same pod with the same set of workload
180+
selectors.
181+
type: integer
182+
entriesToSet:
183+
description: How many entries are to be set for this ClusterSPIFFEID.
184+
In nominal conditions, this should reflect the number of pods
185+
selected, but not always if there were problems encountered
186+
rendering an entry for the pod (RenderFailures) or entries are
187+
masked (EntriesMasked).
188+
type: integer
189+
entryFailures:
190+
description: How many entries were unable to be set due to failures
191+
to create or update the entries via the SPIRE Server API.
192+
type: integer
193+
namespacesIgnored:
194+
description: How many (selected) namespaces were ignored (based
195+
on configuration).
196+
type: integer
197+
namespacesSelected:
198+
description: How many namespaces were selected.
199+
type: integer
200+
podEntryRenderFailures:
201+
description: How many failures were encountered rendering an entry
202+
selected pods. This could be due to either a bad template in
203+
the ClusterSPIFFEID or Pod metadata that when applied to the
204+
template did not produce valid entry values.
205+
type: integer
206+
podsSelected:
207+
description: How many pods were selected out of the namespaces.
208+
type: integer
209+
type: object
210+
type: object
211+
type: object
212+
served: true
213+
storage: true
214+
subresources:
215+
status: {}
216+
status:
217+
acceptedNames:
218+
kind: ""
219+
plural: ""
220+
conditions: []
221+
storedVersions: []

0 commit comments

Comments
 (0)