panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add support to create a issuer and CA via cert-manager (#342)

Browse Source 
Co-authored-by: Kevin Fox <[email protected]>
This commit is contained in:
Drew Wells
2023-06-16 21:04:11 +00:00
committed by GitHub
co-authored by Kevin Fox
parent 9d504de05b
commit 020bde8561
13 changed files with 130 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+12 -6
View File
@@ -306,11 +306,6 @@ Now you can interact with the Spire agent socket from your own application. The
| spire-server.controllerManager.service.port | int | `443` | |
| spire-server.controllerManager.service.type | string | `"ClusterIP"` | |
| spire-server.controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"rancher/kubectl"` | The repository within the registry |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.tag | string | `""` | Overrides the image tag |
| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
| spire-server.dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
| spire-server.dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
| spire-server.dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |
@@ -382,6 +377,11 @@ Now you can interact with the Spire agent socket from your own application. The
| spire-server.telemetry.prometheus.podMonitor.labels | object | `{}` | |
| spire-server.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
| spire-server.tolerations | list | `[]` | |
| spire-server.tools.kubectl.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| spire-server.tools.kubectl.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
| spire-server.tools.kubectl.image.repository | string | `"rancher/kubectl"` | The repository within the registry |
| spire-server.tools.kubectl.image.tag | string | `""` | Overrides the image tag |
| spire-server.tools.kubectl.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
| spire-server.topologySpreadConstraints | list | `[]` | |
| spire-server.tornjak.config.dataStore | object | `{"driver":"sqlite3","file":"/run/spire/data/tornjak.sqlite3"}` | persistent DB for storing Tornjak specific information |
| spire-server.tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) (Not for production) |
@@ -400,10 +400,16 @@ Now you can interact with the Spire agent socket from your own application. The
| spire-server.tornjak.startupProbe.successThreshold | int | `1` | |
| spire-server.tornjak.startupProbe.timeoutSeconds | int | `5` | |
| spire-server.trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
| spire-server.upstreamAuthority.certManager.ca.create | bool | `false` | Creates a Cert-Manager CA |
| spire-server.upstreamAuthority.certManager.ca.duration | string | `"87600h"` | Duration of the CA. Defaults to 10 years. |
| spire-server.upstreamAuthority.certManager.ca.privateKey.algorithm | string | `"ECDSA"` | |
| spire-server.upstreamAuthority.certManager.ca.privateKey.rotationPolicy | string | `""` | |
| spire-server.upstreamAuthority.certManager.ca.privateKey.size | int | `256` | |
| spire-server.upstreamAuthority.certManager.ca.renewBefore | string | `""` | How long to wait before renewing the CA |
| spire-server.upstreamAuthority.certManager.enabled | bool | `false` | |
| spire-server.upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` | |
| spire-server.upstreamAuthority.certManager.issuer_kind | string | `"Issuer"` | |
| spire-server.upstreamAuthority.certManager.issuer_name | string | `"spire-ca"` | |
| spire-server.upstreamAuthority.certManager.issuer_name | string | `""` | Defaults to the release name, override if CA is provided outside of the chart |
| spire-server.upstreamAuthority.certManager.kube_config_file | string | `""` | |
| spire-server.upstreamAuthority.certManager.namespace | string | `""` | Specify to use a namespace other then the one the chart is installed into |
| spire-server.upstreamAuthority.certManager.rbac.create | bool | `true` | |