Add another missing one

Signed-off-by: Kevin Fox <[email protected]>

Author: kfox1111

charts/spire/charts/spire-server/README.md

@@ -239,6 +239,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
 | `controllerManager.identities.ttl`                               | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen.                                                                                                                                                                                                                                                                  | `""`                                                                                           |
 | `controllerManager.identities.jwtTTL`                            | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen.                                                                                                                                                                                                                                                                   | `""`                                                                                           |
 | `controllerManager.identities.admin`                             | Indicates any pod matched by this identity will be an admin. Use this with extreme care.                                                                                                                                                                                                                                                                             | `false`                                                                                        |
+| `controllerManager.identities.downstream`                        | | Set if this spire instance is a root server and the workloads are downstream servers.                                                                                                                                                                                                                                                                              | `false`                                                                                        |
 | `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued                                                                                                                                                                                                                                                                                                                                   | `Fail`                                                                                         |
 | `tools.kubectl.image.registry`                                   | The OCI registry to pull the image from                                                                                                                                                                                                                                                                                                                              | `docker.io`                                                                                    |
 | `tools.kubectl.image.repository`                                 | The repository within the registry                                                                                                                                                                                                                                                                                                                                   | `rancher/kubectl`                                                                              |

charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml

@@ -35,5 +35,6 @@ spec:
   jwtTtl: {{ . | quote }}
   {{- end }}
   admin: {{ .identities.admin }}
+  downstream: {{ .identities.downstream }}
 {{- end }}
 {{- end }}

charts/spire/charts/spire-server/values.yaml

@@ -467,6 +467,8 @@ controllerManager:
     jwtTTL: ""
     ## @param controllerManager.identities.admin Indicates any pod matched by this identity will be an admin. Use this with extreme care.
     admin: false
+    ## @param controllerManager.identities.downstream | Set if this spire instance is a root server and the workloads are downstream servers.
+    downstream: false
 
   validatingWebhookConfiguration:
     ## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued