mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 12:46:18 +01:00
39 lines
1.9 KiB
Plaintext
39 lines
1.9 KiB
Plaintext
// Module included in the following assemblies:
|
|
//
|
|
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-configuration.adoc
|
|
|
|
:_mod-docs-content-type: CONCEPT
|
|
[id="zero-trust-manager-ztwim-cr_{context}"]
|
|
= About the ZeroTrustWorkloadIdentityManager custom resource
|
|
|
|
|
|
[role="_abstract"]
|
|
The `ZeroTrustWorkloadIdentityManager` is the primary custom resource that initializes the SPIRE deployments. This primary resource defines the trust domain and cluster name to help ensure secure workload identity management.
|
|
|
|
Reference the complete YAML specification to correctly structure the `ZeroTrustWorkloadIdentityManager` CR. This example helps you identify required fields and immutable parameters for your configuration.
|
|
|
|
[source,yaml]
|
|
----
|
|
apiVersion: operator.openshift.io/v1alpha1
|
|
kind: ZeroTrustWorkloadIdentityManager
|
|
metadata:
|
|
name: cluster
|
|
labels:
|
|
app.kubernetes.io/name: zero-trust-workload-identity-manager
|
|
app.kubernetes.io/managed-by: zero-trust-workload-identity-manager
|
|
spec:
|
|
trustDomain: "example.com"
|
|
clusterName: "production-cluster"
|
|
bundleConfigMap: "spire-bundle"
|
|
----
|
|
where:
|
|
|
|
trustDomain:: Specifies tThe trust domain to be used for the SPIFFE identifiers. Must be a valid SPIFFE trust domain (lowercase alphanumeric, hyphens, and dots). Maximum length is 255 characters. Once set, this field is immutable.
|
|
|
|
clusterName:: Specifies tThe name that identifies this cluster within the trust domain. Must be a valid DNS-1123 subdomain with a maximum length of 63 characters. Once set, this field is immutable.
|
|
|
|
bundleConfigMap:: Specifies the name of the ConfigMap that stores the SPIRE trust bundle. This ConfigMap contains the root certificates for the trust domain and is created and maintained by the Operator. Must be a valid Kubernetes name with a maximum length of 253 characters. This field is optional (defaults to `spire-bundle`) and once set, is immutable.
|
|
|
|
|
|
|