Set CA name + disable kubelet validation in SPIRE

This sets a CN on the CA to be valid. It also disables the kubelet validation by default as this breaks many installations such as on kind. Signed-off-by: Maartje Eyskens <maartje.eyskens@isovalent.com>
cilium · Apr 27, 2023 · dbafe52 · dbafe52
1 parent 2ec713e
commit dbafe52
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 14 deletions.
diff --git a/Documentation/helm-values.rst b/Documentation/helm-values.rst
diff --git a/install/kubernetes/cilium/README.md b/install/kubernetes/cilium/README.md
diff --git a/install/kubernetes/cilium/values.yaml b/install/kubernetes/cilium/values.yaml
diff --git a/install/kubernetes/cilium/values.yaml.tmpl b/install/kubernetes/cilium/values.yaml.tmpl
@@ -2669,7 +2669,7 @@ auth:
           # -- SPIRE agent labels
           labels: { }
           # -- SPIRE Workload Attestor kubelet verification.
-          skipKubeletVerification: false
+          skipKubeletVerification: true
         server:
           # -- SPIRE server image
           image: ghcr.io/spiffe/spire-server:1.5.1@sha256:4851ec8c71a8fbe230d87be78dfed0e908800c2342cf192289c7885bb2f7a870
@@ -2703,7 +2703,7 @@ auth:
             subject:
               country: "US"
               organization: "SPIRE"
-              commonName: ""
+              commonName: "Cilium SPIRE CA"
       # -- SPIRE server address
       serverAddress: spire-server.cilium-spire.svc.cluster.local:8081
       # -- SPIFFE trust domain to use for fetching certificates