Added ClusterStaticEntry support #174
Conversation
Signed-off-by: Andrew Harding <[email protected]>
azdagron
force-pushed
the
azdagron/clusterstaticentry
branch
from
ddfeb88
to
fb9bcf5
Compare
| The SPIRE APIs used by the SPIRE Controller Manager are generally stable and | ||
| supported since at least SPIRE v1.0. However, the API has gained support for | ||
| additional entry fields beyond what was supported in SPIRE v1.0. Notably, these | ||
| include both the `jwt_svid_ttl` and the `hint` fields. The ClusterStaticEntry |
There was a problem hiding this comment.
I know there is an issue to add jwt_svid_ttl to regular reconciler, and we may add another one for hint,
are you worried about adding those fields there too?
There was a problem hiding this comment.
jwt_svid_ttl makes sense but hint is harder to reason about. I'd probably side with waiting until somebody has a use case for it before adding it to the ClusterSPIFFEID CRD.
| @@ -0,0 +1,76 @@ | |||
| /* | |||
| Copyright 2021 SPIRE Authors. | |||
There was a problem hiding this comment.
since it is a new crd, may we update year to 2023? and what happens with another crds that got updates?
There was a problem hiding this comment.
I think we'd only bump the year if there were significant updates. I'll change the year for this CRD.
| x509SVIDTTL: | ||
| type: string | ||
| required: | ||
| - dnsNames |
There was a problem hiding this comment.
is it intntional to make dns, federatesWith, hint and ttls required?
There was a problem hiding this comment.
Good catch. I've updated the json tags and regenerated manifests.
Signed-off-by: Andrew Harding <[email protected]>
azdagron
force-pushed
the
azdagron/clusterstaticentry
branch
from
00b00f8
to
2a0b383
Compare
There was a problem hiding this comment.
we should complete the sample here no? else what would users have to anchor on?
|
Nice! This is definitely needed - what about the |
|
The -node flag doesn't actually have a first class field on the entry. Instead it sets the parent ID to the SPIFFE ID of the spire server (i.e., |
|
@azdagron when do you think will we see this in a release? |
|
This will be released in 0.3.0. There are currently two outstanding issues that have to be fixed before we can release the ClusterStaticEntry CRD. https://github.com/spiffe/spire-controller-manager/milestone/1 I'm personally slammed this week but may have some cycles next week to wrap this up. Unless @MarcosDY has some cycles, it will probably be at least then. |
|
We should probably also create a migration guide. |
|
Yeah.... upgrading the chart will likely have some issues with the crds. |
Resolves #149