Helm chart: broken spire setup

[rauanmayemir]

Is there an existing issue for this?

• I have searched the existing issues

What happened?

authentication:
  enabled: true
  mutual:
    spire:
      enabled: true
      install:
        enabled: true
        agent:
          labels:
            k8s-app: cilium-spire-agent
        server:
          labels:
            k8s-app: cilium-spire-server

Setting labels as above will break the helm install with:

Error: YAML parse error on cilium/templates/spire/agent/daemonset.yaml: error converting YAML to JSON: yaml: line 8: mapping values are not allowed in this context

Cilium Version

1.14.2

Kernel Version

Kubernetes Version

Sysdump

No response

Relevant log output

No response

Anything else?

Not setting labels will allow helm install to happen.

Code of Conduct

• I agree to follow this project's Code of Conduct

[rauanmayemir]

@sayboras I'm not sure if it should be filed separately, but there's also an issue with not being able to use my own spire-server instance and setting it up via helm. You can either install both agent and server, or none of them.

[sayboras]

I'm not sure if it should be filed separately, but there's also an issue with not being able to use my own spire-server instance and setting it up via helm. You can either install both agent and server, or none of them.

Sadly, we don't have such support right now. I am not sure how common this use case is. The best thing we can do is to file another issue, and see if other community users are having a same requirement.

[rauanmayemir]

I guess I misunderstood this docs section:

The Cilium Helm chart includes an option to deploy SPIRE server for mutual authentication. You may also deploy your own SPIRE server and configure Cilium to use it.

I'm fine with doing it manually.