Skip to content

ZTWIM GA #85

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mlorenzofr merged 1 commit into from
Dec 18, 2025
Merged

ZTWIM GA #85

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions charts/zero-trust-workload-identity-manager/templates/SpireAgent.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,6 @@ kind: SpireAgent
metadata:
name: cluster
spec:
trustDomain: {{ tpl .Values.spire.trustDomain $ }}
clusterName: {{ .Values.spire.clusterName }}
nodeAttestor:
k8sPSATEnabled: {{ .Values.spire.agent.nodeAttestor.k8sPSATEnabled | quote }}
workloadAttestors:
Expand Down
2 changes: 1 addition & 1 deletion ...ts/zero-trust-workload-identity-manager/templates/SpireOIDCDiscoveryProvider-Ingress.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
{{- if not (eq .Values.spire.oidcDiscoveryProvider.ingress.operatorManaged "true") -}}
{{- if not (eq .Values.spire.oidcDiscoveryProvider.ingress.operatorManaged "true") }}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
Expand Down
4 changes: 1 addition & 3 deletions charts/zero-trust-workload-identity-manager/templates/SpireOIDCDiscoveryProvider.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,5 @@ kind: SpireOIDCDiscoveryProvider
metadata:
name: cluster
spec:
trustDomain: {{ tpl .Values.spire.trustDomain $ }}
agentSocketName: {{ .Values.spire.oidcDiscoveryProvider.agentSocketName }}
jwtIssuer: {{ include "zero-trust-workload-identity-manager.jwtIssuer" . }}
managedRoute: {{ (.Values.spire.oidcDiscoveryProvider.ingress.operatorManaged | default false) | quote }}
managedRoute: {{ (.Values.spire.oidcDiscoveryProvider.ingress.operatorManaged | default true) | quote }}
8 changes: 4 additions & 4 deletions charts/zero-trust-workload-identity-manager/templates/SpireServer-Ingress.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,16 @@
{{- if .Values.spire.server.ingress.enabled -}}
{{- if not (eq .Values.spire.server.federation.ingress.operatorManaged "true") }}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: spire-server
namespace: {{ .Release.Namespace }}
{{- if .Values.spire.server.ingress.annotations }}
{{- if .Values.spire.server.federation.ingress.annotations }}
annotations:
{{- tpl (toYaml .Values.spire.server.ingress.annotations) . | nindent 4 }}
{{- tpl (toYaml .Values.spire.server.federation.ingress.annotations) . | nindent 4 }}
{{- end }}
spec:
rules:
- host: {{ tpl .Values.spire.server.ingress.host $ }}
- host: {{ tpl .Values.spire.server.federation.ingress.host $ }}
http:
paths:
- pathType: ImplementationSpecific
Expand Down
15 changes: 12 additions & 3 deletions charts/zero-trust-workload-identity-manager/templates/SpireServer.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,18 +3,27 @@ kind: SpireServer
metadata:
name: cluster
spec:
trustDomain: {{ tpl .Values.spire.trustDomain $ }}
clusterName: {{ .Values.spire.clusterName }}
caSubject:
commonName: {{ .Values.spire.server.ca.commonName }}
country: {{ .Values.spire.server.ca.country }}
organization: {{ .Values.spire.server.ca.organization }}
persistence:
{{- include "zero-trust-workload-identity-manager.server.persistence" . | nindent 4 }}
size: {{ .Values.spire.server.persistence.size }}
accessMode: {{ .Values.spire.server.persistence.accessMode }}
datastore:
databaseType: {{ .Values.spire.server.datastore.databaseType }}
connectionString: {{ .Values.spire.server.datastore.connectionString }}
maxOpenConns: {{ .Values.spire.server.datastore.maxOpenConns }}
maxIdleConns: {{ .Values.spire.server.datastore.maxIdleConns }}
connMaxLifetime: {{ .Values.spire.server.datastore.connMaxLifetime }}
jwtIssuer: {{ include "zero-trust-workload-identity-manager.jwtIssuer" . }}
{{- if (eq .Values.spire.server.federation.ingress.operatorManaged "true") }}
federation:
bundleEndpoint:
profile: {{ .Values.spire.server.federation.bundleEndpoint.profile }}
{{- if .Values.spire.server.federation.federatesWith }}
federatesWith:
{{- toYaml .Values.spire.server.federation.federatesWith | nindent 6 }}
{{- end }}
managedRoute: {{ (.Values.spire.server.federation.ingress.operatorManaged | default false) | quote }}
Copy link
Collaborator

@mlorenzofr mlorenzofr Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we are inside an if conditional block, where the value of .Values.spire.server.federation.ingress.operatorManaged is equal to "true", does the clause "| default false" clause make sense?

{{- end }}
8 changes: 8 additions & 0 deletions charts/zero-trust-workload-identity-manager/templates/ZeroTrustWorkloadIdentityManager.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
apiVersion: operator.openshift.io/v1alpha1
kind: ZeroTrustWorkloadIdentityManager
metadata:
name: cluster
spec:
trustDomain: {{ tpl .Values.spire.trustDomain $ }}
clusterName: {{ .Values.spire.clusterName }}
bundleConfigMap: {{ .Values.spire.bundleConfigMap }}
15 changes: 0 additions & 15 deletions charts/zero-trust-workload-identity-manager/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,21 +61,6 @@ Create the name of the service account to use
{{- end }}
{{- end }}

{{/*
Create the Spire server persistence configuration.
*/}}
{{- define "zero-trust-workload-identity-manager.server.persistence" -}}
{{- if (eq .Values.spire.server.persistence.type "pvc") }}
size: {{ .Values.spire.server.persistence.size }}
accessMode: {{ .Values.spire.server.persistence.accessMode }}
{{- else if (eq .Values.spire.server.persistence.type "hostPath") }}
hostPath: {{ .Values.spire.server.persistence.hostPath }}
{{- else }}
{{- fail (printf "Unsupported persistence type: '%s'. Valid values are 'pvc' or 'hostPath'" .Values.spire.server.persistence.type) }}
{{- end }}
type: {{ .Values.spire.server.persistence.type }}
{{- end }}

{{/*
Create the name of the service account to use
*/}}
Expand Down
27 changes: 15 additions & 12 deletions charts/zero-trust-workload-identity-manager/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,11 +4,12 @@ global:

spiffe:
csi:
agentSocketPath: "/run/spire/agent-sockets/spire-agent.sock"
agentSocketPath: "/run/spire/agent-sockets"

spire:
trustDomain: "{{ .Values.global.localClusterDomain }}"
clusterName: "cluster"
bundleConfigMap: "spire-bundle"

agent:
nodeAttestor:
Expand All @@ -21,9 +22,8 @@ spire:
hostCertFileName: ""

oidcDiscoveryProvider:
agentSocketName: "spire-agent.sock"
ingress:
operatorManaged: "false"
operatorManaged: "true"
annotations:
route.openshift.io/termination: reencrypt
host: "spire-spiffe-oidc-discovery-provider.{{ .Values.global.localClusterDomain }}"
Expand All @@ -39,20 +39,23 @@ spire:
service:
name: spire-server
port: 443
ingress:
enabled: true
annotations:
route.openshift.io/termination: passthrough
host: "spire-server.{{ .Values.global.localClusterDomain }}"
persistence:
type: pvc
size: 5Gi
accessMode: ReadWriteOnce
storageClass: ""
hostPath: ""
datastore:
databaseType: sqlite3
connectionString: /run/spire/data/datastore.sqlite3
maxOpenConns: 100
maxIdleConns: 2
connMaxLifetime: 3600
maxIdleConns: 10
connMaxLifetime: 0
federation:
enabled: "false"
federatesWith: []
bundleEndpoint:
profile: "https_spiffe"
ingress:
operatorManaged: "true"
annotations:
route.openshift.io/termination: passthrough
host: "spire-server.{{ .Values.global.localClusterDomain }}"
2 changes: 1 addition & 1 deletion values-hub.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@ clusterGroup:
zero-trust-workload-identity-manager:
name: openshift-zero-trust-workload-identity-manager
namespace: zero-trust-workload-identity-manager
channel: tech-preview-v0.2
channel: stable-v1
catalogSource: redhat-marketplace
compliance-operator:
name: compliance-operator
Expand Down