panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add key experimental.requirePQKEM for spire-server and spire-agent (#755)

Browse Source 
Signed-off-by: Daniel Schlatter <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
Daniel Schlatter
2026-03-03 06:31:44 -08:00
committed by GitHub
co-authored by kfox1111
parent 50afee93c0
commit 0133d4a5a7
6 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-agent/README.md
+1
View File
@@ -143,6 +143,7 @@ A Helm chart to install the SPIRE agent.
| `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` | | `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` |
| `experimental.enabled` | Allow configuration of experimental features | `false` | | `experimental.enabled` | Allow configuration of experimental features | `false` |
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` | | `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
| `experimental.requirePQKEM` | Require use of a post-quantum-safe key exchange method for TLS handshakes. | `false` |
| `experimental.featureFlags` | List of developer feature flags | `[]` | | `experimental.featureFlags` | List of developer feature flags | `[]` |
| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` | | `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
charts/spire/charts/spire-agent/templates/configmap.yaml
+1
View File
@@ -77,6 +77,7 @@ agent:
{{- if eq (.enabled | toString) "true" }} {{- if eq (.enabled | toString) "true" }}
experimental: experimental:
sync_interval: {{ .syncInterval | quote }} sync_interval: {{ .syncInterval | quote }}
require_pq_kem: {{ .requirePQKEM }}
{{- if gt (len .featureFlags) 0 }} {{- if gt (len .featureFlags) 0 }}
feature_flags: feature_flags:
{{- range .featureFlags }} {{- range .featureFlags }}
charts/spire/charts/spire-agent/values.yaml
+2
View File
@@ -376,6 +376,8 @@ experimental:
enabled: false enabled: false
## @param experimental.syncInterval Sync interval with SPIRE server with exponential backoff ## @param experimental.syncInterval Sync interval with SPIRE server with exponential backoff
syncInterval: 5s syncInterval: 5s
## @param experimental.requirePQKEM Require use of a post-quantum-safe key exchange method for TLS handshakes.
requirePQKEM: false
## @param experimental.featureFlags [array] List of developer feature flags ## @param experimental.featureFlags [array] List of developer feature flags
featureFlags: [] featureFlags: []
charts/spire/charts/spire-server/README.md
+1
View File
@@ -499,6 +499,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | | `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` |
| `experimental.eventsBasedCache` | Use events to update the cache with what's changed since the last update. | `false` | | `experimental.eventsBasedCache` | Use events to update the cache with what's changed since the last update. | `false` |
| `experimental.pruneEventsOlderThan` | How old an event can be before being deleted. Used with events based cache. | `12h` | | `experimental.pruneEventsOlderThan` | How old an event can be before being deleted. Used with events based cache. | `12h` |
| `experimental.requirePQKEM` | Require use of a post-quantum-safe key exchange method for TLS handshakes. | `false` |
| `experimental.featureFlags` | List of developer feature flags | `[]` | | `experimental.featureFlags` | List of developer feature flags | `[]` |
| `experimental.authOpaPolicyEngine` | The [auth opa_policy engine](https://github.com/spiffe/spire/blob/main/doc/authorization_policy_engine.md) used for authorization decisions. Defaults to the default SPIRE authorization policy. | `{}` | | `experimental.authOpaPolicyEngine` | The [auth opa_policy engine](https://github.com/spiffe/spire/blob/main/doc/authorization_policy_engine.md) used for authorization decisions. Defaults to the default SPIRE authorization policy. | `{}` |
| `experimental.authOpaPolicyEngine.local.policy_data` | A JSON blob that defines additional data that can be used in the rego policy. | `""` | | `experimental.authOpaPolicyEngine.local.policy_data` | A JSON blob that defines additional data that can be used in the rego policy. | `""` |
charts/spire/charts/spire-server/templates/configmap.yaml
+1
View File
@@ -105,6 +105,7 @@ server:
cache_reload_interval: {{ .cacheReloadInterval | quote }} cache_reload_interval: {{ .cacheReloadInterval | quote }}
events_based_cache: {{ .eventsBasedCache }} events_based_cache: {{ .eventsBasedCache }}
prune_events_older_than: {{ .pruneEventsOlderThan | quote }} prune_events_older_than: {{ .pruneEventsOlderThan | quote }}
require_pq_kem: {{ .requirePQKEM }}
{{- if gt (len .featureFlags) 0 }} {{- if gt (len .featureFlags) 0 }}
feature_flags: feature_flags:
{{- range .featureFlags }} {{- range .featureFlags }}
charts/spire/charts/spire-server/values.yaml
+2
View File
@@ -1271,6 +1271,8 @@ experimental:
eventsBasedCache: false eventsBasedCache: false
## @param experimental.pruneEventsOlderThan How old an event can be before being deleted. Used with events based cache. ## @param experimental.pruneEventsOlderThan How old an event can be before being deleted. Used with events based cache.
pruneEventsOlderThan: 12h pruneEventsOlderThan: 12h
## @param experimental.requirePQKEM Require use of a post-quantum-safe key exchange method for TLS handshakes.
requirePQKEM: false
## @param experimental.featureFlags [array] List of developer feature flags ## @param experimental.featureFlags [array] List of developer feature flags
featureFlags: [] featureFlags: []
## @param experimental.authOpaPolicyEngine [object] The [auth opa_policy engine](https://github.com/spiffe/spire/blob/main/doc/authorization_policy_engine.md) used for authorization decisions. Defaults to the default SPIRE authorization policy. ## @param experimental.authOpaPolicyEngine [object] The [auth opa_policy engine](https://github.com/spiffe/spire/blob/main/doc/authorization_policy_engine.md) used for authorization decisions. Defaults to the default SPIRE authorization policy.