diff --git a/charts/spire/templates/crd_role_binding.yaml b/charts/spire/templates/crd_role_binding.yaml index 46a8b770..5573a62c 100644 --- a/charts/spire/templates/crd_role_binding.yaml +++ b/charts/spire/templates/crd_role_binding.yaml @@ -9,4 +9,4 @@ roleRef: subjects: - kind: ServiceAccount name: spire-k8s-registrar - namespace: spire + namespace: {{ .Values.namespace }} diff --git a/charts/tornjak/templates/NOTES.txt b/charts/tornjak/templates/NOTES.txt index 298edbeb..abad2e20 100644 --- a/charts/tornjak/templates/NOTES.txt +++ b/charts/tornjak/templates/NOTES.txt @@ -21,7 +21,7 @@ Universal Trusted Workload Identity Service has completed. {{- end }} {{- if .Values.OIDC.enable }} OIDC enable: true - OIDC image: {{ .Value.OIDC.image }} + OIDC image: {{ .Values.OIDC.image }} OIDC service name: {{ .Values.OIDC.serviceName }} MY_DISCOVERY_DOMAIN: {{ .Values.OIDC.MY_DISCOVERY_DOMAIN }} {{- end }} @@ -33,16 +33,16 @@ Universal Trusted Workload Identity Service has completed. clusters = { "{{ .Values.clustername }}" = { # use_token_review_api_validation = true - service_account_whitelist = ["spire:spire-agent"] + service_account_allow_list = ["spire:spire-agent"] }, - {{- range $k, $v := .Values.k8s_psat.remoteClusters }} + {{- range $k, $v := .Values.k8s_psat.remoteClusters }} "{{ $v.name }}" = { - service_account_whitelist = ["{{ $v.namespace | default "spire" }}:{{ $v.serviceAccount | default "spire-agent" }}"] + service_account_allow_list = ["{{ $v.namespace | default "spire" }}:{{ $v.serviceAccount | default "spire-agent" }}"] kube_config_file = "/run/spire/kubeconfigs/{{ $v.name }}" }, - {{- end }} + {{- end }} + } {{- end }} - } To learn more about the release, try: diff --git a/charts/tornjak/templates/oidc-dp-configmap.tpl b/charts/tornjak/templates/oidc-dp-configmap.tpl index f0d57422..e168cec3 100644 --- a/charts/tornjak/templates/oidc-dp-configmap.tpl +++ b/charts/tornjak/templates/oidc-dp-configmap.tpl @@ -11,7 +11,7 @@ data: listen_socket_path = "/run/oidc-discovery-provider/server.sock" log_level = "info" server_api { - address = "unix:///{{ .Values.spireServerSocket }}" + address = "unix:///{{ .Values.spireServerSocketDir }}/{{ .Values.spireServerSocketFile }}" } nginx.conf: | user root; diff --git a/charts/tornjak/templates/server-statefulset.tpl b/charts/tornjak/templates/server-statefulset.tpl index 186e634e..b69b581f 100644 --- a/charts/tornjak/templates/server-statefulset.tpl +++ b/charts/tornjak/templates/server-statefulset.tpl @@ -55,7 +55,7 @@ spec: - "/opt/spire/bin/spire-server" - "healthcheck" - "-socketPath" - - "{{ .Values.spireServerSocket }}" + - "{{ .Values.spireServerSocketDir }}/{{ .Values.spireServerSocketFile }}" failureThreshold: 2 initialDelaySeconds: 15 periodSeconds: 60 @@ -67,14 +67,14 @@ spec: - "/opt/spire/bin/spire-server" - "healthcheck" - "-socketPath" - - "{{ .Values.spireServerSocket }}" + - "{{ .Values.spireServerSocketDir }}/{{ .Values.spireServerSocketFile }}" - "--shallow" initialDelaySeconds: 5 periodSeconds: 10 {{- end }} {{- if .Values.OIDC.enable }} - name: spire-oidc - image: {{ .Value.OIDC.image }}:{{ .Values.spireVersion }} + image: {{ .Values.OIDC.image }}:{{ .Values.spireVersion }} args: - -config - /run/spire/oidc/config/oidc-discovery-provider.conf