Add Tornjak manager CRD#610
Conversation
|
This seems to have overlap with 597. Is there anything left todo since that has merged? |
|
|
||
| > [!IMPORTANT] | ||
| > If audience is set, make sure the Tornjak backend `audience` is set correctly. You can set it using: | ||
| > `--set spire-server.tornjak.config.userManagement.audience=your-audience` | ||
| > | ||
|
|
||
| > [!TIP] |
There was a problem hiding this comment.
These sections were not rendering correctly because there's no separation between them.
|
@kfox1111 I updated the branch. Should be ready for merging now! |
Alan-Cha
requested review from
edwbuck,
faisal-memon,
kfox1111,
marcofranssen and
mrsabath
as code owners
| classname = "{{ .Values.controllerManager.className }}" | ||
| } | ||
| } | ||
|
|
There was a problem hiding this comment.
hmm....
Is the crd manager functionality disable-able? If so, is it leaving this section out?
Does it use the permissions of the k8s service account in order to manage the crds?
There was a problem hiding this comment.
Back when it was under development, Tornjak shared the same pod as the controller manager, and spire server (IIRC). Then, it inherited all of the permissions of the controller manager which is what is necessary. Has this changed?
There was a problem hiding this comment.
We support running the spire-server without the controller-manager, so it may not have crd support (I have a server configured this way)... but maybe you require the controller manager to function properly....
So you probably should either add the permissions if you can work without the crd in case its disabled, or error the chart out if you expect crds to be there and the controller manager is disabled?
There was a problem hiding this comment.
@Alan-Cha @maia-iyer do you have time to address the comment from @kfox1111
Signed-off-by: Alan Cha <Alan.cha1@ibm.com>
Signed-off-by: Alan Cha <Alan.cha1@ibm.com>
Signed-off-by: Alan Cha <Alan.cha1@ibm.com>
Signed-off-by: Alan Cha <Alan.cha1@ibm.com>
Signed-off-by: Alan Cha <Alan.cha1@ibm.com>
Signed-off-by: Alan Cha <Alan.cha1@ibm.com>
Signed-off-by: Alan Cha <Alan.cha1@ibm.com>
4 participants
Built on top of #597