panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SPIFFE OIDC Discovery Provider Rework (#152)

Browse Source 
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
2024-01-03 11:40:14 +01:00
committed by GitHub
co-authored by Faisal Memon
parent 8f1aba8ad3
commit 183e9aa534
23 changed files with 512 additions and 264 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/tests/dependencies/spire-root-server-values.yaml
+17 -4
View File
@@ -8,13 +8,23 @@ spire-server:
identities: identities:
clusterSPIFFEIDs: clusterSPIFFEIDs:
default: default:
type: raw
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/k8s/{{ .ClusterName }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
namespaceSelector: namespaceSelector:
kubernetes.io/metadata.name: spire-server matchExpressions:
- key: "kubernetes.io/metadata.name"
operator: In
values: [spire-server]
podSelector: podSelector:
app.kubernetes.io/component: server matchLabels:
app.kubernetes.io/instance: spire release: spire
app.kubernetes.io/name: server release-namespace: spire-server
component: server
downstream: true downstream: true
oidc-discovery-provider:
enabled: false
test-keys:
enabled: false
nodeAttestor: nodeAttestor:
k8sPsat: k8sPsat:
serviceAccountAllowList: serviceAccountAllowList:
@@ -24,6 +34,9 @@ spire-server:
k8sbundle: k8sbundle:
namespace: spire-system namespace: spire-system
spiffe-oidc-discovery-provider:
enabled: false
spire-agent: spire-agent:
enabled: false enabled: false
charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+19 -11
View File
@@ -28,6 +28,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| Name | Description | Value | | Name | Description | Value |
| ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | | ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | | `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
| `replicaCount` | Replica count | `1` | | `replicaCount` | Replica count | `1` |
| `namespaceOverride` | Namespace override | `""` | | `namespaceOverride` | Namespace override | `""` |
| `annotations` | Annotations for the deployment | `{}` | | `annotations` | Annotations for the deployment | `{}` |
@@ -38,7 +39,8 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `resources` | Resource requests and limits | `{}` | | `resources` | Resource requests and limits | `{}` |
| `service.type` | Service type | `ClusterIP` | | `service.type` | Service type | `ClusterIP` |
| `service.port` | Service port | `80` | | `service.ports.http` | Insecure port for the service | `80` |
| `service.ports.https` | Secure port for the service | `443` |
| `service.annotations` | Annotations for service resource | `{}` | | `service.annotations` | Annotations for service resource | `{}` |
| `configMap.annotations` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | `{}` | | `configMap.annotations` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | `{}` |
| `podSecurityContext` | Pod security context for OIDC discovery provider pods | `{}` | | `podSecurityContext` | Pod security context for OIDC discovery provider pods | `{}` |
@@ -48,20 +50,26 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | | `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | | `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` |
| `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` | | `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` |
| `insecureScheme.enabled` | Flag to enable insecure schema | `false` | | `tls.spire.enabled` | Use spire to secure the oidc-discovery-provider | `true` |
| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` |
| `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` | | `tls.externalSecret.secretName` | Specify which Secret to use | `""` |
| `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tls.certManager.enabled` | Use certificateManager to create the certificate | `false` |
| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `tls.certManager.issuer.create` | Create an issuer to use to issue the certificate | `true` |
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.3-alpine` | | `tls.certManager.issuer.acme.email` | Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service | `""` |
| `tls.certManager.issuer.acme.server` | Server to use to get certificate. Defaults to LetsEncrypt | `https://acme-v02.api.letsencrypt.org/directory` |
| `tls.certManager.issuer.acme.solvers` | Configure the issuer solvers. Defaults to http01 via ingress. | `{}` |
| `tls.certManager.certificate.dnsNames` | Override the dnsNames on the certificate request. Defaults to the same settings as Ingress | `[]` |
| `tls.certManager.certificate.issuerRef.group` | If you are using an external plugin, specify the group for it here | `""` |
| `tls.certManager.certificate.issuerRef.kind` | Kind of the issuer reference. Override if you want to use a ClusterIssuer | `Issuer` |
| `tls.certManager.certificate.issuerRef.name` | Name of the issuer to use. If unset, it will use the name of the built in issuer | `""` |
| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from. Only used when TLS is disabled. | `docker.io` |
| `insecureScheme.nginx.image.repository` | The repository within the registry. Only used when TLS is disabled. | `nginxinc/nginx-unprivileged` |
| `insecureScheme.nginx.image.pullPolicy` | The image pull policy. Only used when TLS is disabled. | `IfNotPresent` |
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.25.3-alpine` |
| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | | `insecureScheme.nginx.resources` | Resource requests and limits | `{}` |
| `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` | | `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` |
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | | `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` | | `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` |
| `config.acme.tosAccepted` | Flag for Terms of Service acceptance | `false` |
| `config.acme.cacheDir` | Path for cache directory | `/run/spire` |
| `config.acme.directoryUrl` | URL for acme directory | `https://acme-v02.api.letsencrypt.org/directory` |
| `config.acme.emailAddress` | Email address for registration | `[email protected]` |
| `imagePullSecrets` | Image pull secret names | `[]` | | `imagePullSecrets` | Image pull secret names | `[]` |
| `nameOverride` | Name override | `""` | | `nameOverride` | Name override | `""` |
| `fullnameOverride` | Full name override | `""` | | `fullnameOverride` | Full name override | `""` |
charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
+8
View File
@@ -91,3 +91,11 @@ Create the name of the service account to use
{{- define "spiffe-oidc-discovery-provider.workload-api-socket-path" -}} {{- define "spiffe-oidc-discovery-provider.workload-api-socket-path" -}}
{{- printf "/spiffe-workload-api/%s" .Values.agentSocketName }} {{- printf "/spiffe-workload-api/%s" .Values.agentSocketName }}
{{- end }} {{- end }}
{{- define "spiffe-oidc-discovery-provider.tls-enabled" -}}
{{- if and .Values.enabled (or .Values.tls.spire.enabled .Values.tls.externalSecret.enabled .Values.tls.certManager.enabled) }}
{{- true }}
{{- else }}
{{- false }}
{{- end }}
{{- end }}
charts/spire/charts/spiffe-oidc-discovery-provider/templates/certificate.yaml
+26
View File
@@ -0,0 +1,26 @@
{{- define "spiffe-oidc-discovery-provider.cert-manager-default-cert" }}
{{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . }}
dnsNames:
{{- if ne (len .Values.tls.certManager.certificate.dnsNames) 0 }}
{{- toYaml .Values.tls.certManager.certificate.dnsNames | nindent 4 }}
{{- else }}
- {{ include "spire-lib.ingress-calculated-name" (dict "ingress" .Values.ingress "Values" .Values) }}
{{- end }}
issuerRef:
{{- with .Values.tls.certManager.certificate.issuerRef.group }}
group: {{ . }}
{{- end }}
kind: {{ default "Issuer" .Values.tls.certManager.certificate.issuerRef.kind }}
name: {{ default $fullName .Values.tls.certManager.certificate.issuerRef.name }}
secretName: {{ $fullName }}-cert
{{- end }}
{{- if .Values.tls.certManager.enabled }}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
spec:
{{ merge (include "spiffe-oidc-discovery-provider.cert-manager-default-cert" . | fromYaml) .Values.tls.certManager.certificate | toYaml | nindent 2 }}
{{- end }}
charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml
+21 -8
View File
@@ -1,3 +1,17 @@
{{- $tlsCount := 0 }}
{{- if and .Values.enabled .Values.tls.spire.enabled }}
{{- fail "Built in SPIRE support is not yet supported." }}
{{- $tlsCount = add $tlsCount 1 }}
{{- end }}
{{- if and .Values.enabled .Values.tls.externalSecret.enabled }}
{{- $tlsCount = add $tlsCount 1 }}
{{- end }}
{{- if and .Values.enabled .Values.tls.certManager.enabled }}
{{- $tlsCount = add $tlsCount 1 }}
{{- end }}
{{- if gt $tlsCount 1 }}
{{- fail "You can only have one TLS configuration enabled" }}
{{- end }}
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}} {{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}} {{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}}
{{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }} {{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }}
@@ -14,15 +28,14 @@ domains:
{{- $jwtIssuer := (default $uri.path $uri.host) }} {{- $jwtIssuer := (default $uri.path $uri.host) }}
{{- uniq (concat (list $jwtIssuer) .Values.config.additionalDomains) | toYaml | nindent 2 }} {{- uniq (concat (list $jwtIssuer) .Values.config.additionalDomains) | toYaml | nindent 2 }}
{{- if .Values.insecureScheme.enabled }} {{- if eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "false" }}
allow_insecure_scheme: {{ .Values.insecureScheme.enabled }} allow_insecure_scheme: true
listen_socket_path: {{ $oidcSocket | quote }} listen_socket_path: {{ $oidcSocket | quote }}
{{- else }} {{- else }}
acme: serving_cert_file:
directory_url: {{ .Values.config.acme.directoryUrl | quote }} cert_file_path: /certs/tls.crt
cache_dir: {{ .Values.config.acme.cacheDir | quote }} key_file_path: /certs/tls.key
tos_accepted: {{ .Values.config.acme.tosAccepted }} addr: ':8443'
email: {{ .Values.config.acme.emailAddress | quote }}
{{- end }} {{- end }}
workload_api: workload_api:
@@ -47,7 +60,7 @@ metadata:
data: data:
oidc-discovery-provider.conf: | oidc-discovery-provider.conf: |
{{- include "spiffe-oidc-discovery-provider.yaml-config" (dict "oidcSocket" $oidcSocket "root" .) | fromYaml | toPrettyJson | nindent 4 }} {{- include "spiffe-oidc-discovery-provider.yaml-config" (dict "oidcSocket" $oidcSocket "root" .) | fromYaml | toPrettyJson | nindent 4 }}
{{- if .Values.insecureScheme.enabled }} {{- if eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "false" }}
default.conf: | default.conf: |
upstream oidc { upstream oidc {
server unix:{{ $oidcSocket }}; server unix:{{ $oidcSocket }};
charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml
+21 -4
View File
@@ -1,3 +1,4 @@
{{- $tlsEnabled := eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "true" }}
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }} {{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
apiVersion: apps/v1 apiVersion: apps/v1
kind: Deployment kind: Deployment
@@ -26,6 +27,9 @@ spec:
{{- end }} {{- end }}
labels: labels:
{{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 8 }} {{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 8 }}
release: {{ .Release.Name }}
release-namespace: {{ .Release.Namespace }}
component: oidc-discovery-provider
spec: spec:
{{- with .Values.imagePullSecrets }} {{- with .Values.imagePullSecrets }}
imagePullSecrets: imagePullSecrets:
@@ -46,8 +50,8 @@ spec:
ports: ports:
- containerPort: 8008 - containerPort: 8008
name: healthz name: healthz
{{- if not .Values.insecureScheme.enabled }} {{- if $tlsEnabled }}
- containerPort: 443 - containerPort: 8443
name: https name: https
{{- end }} {{- end }}
volumeMounts: volumeMounts:
@@ -61,6 +65,9 @@ spec:
mountPath: /run/spire/oidc/config/oidc-discovery-provider.conf mountPath: /run/spire/oidc/config/oidc-discovery-provider.conf
subPath: oidc-discovery-provider.conf subPath: oidc-discovery-provider.conf
readOnly: true readOnly: true
- name: certdir
mountPath: /certs
readOnly: true
readinessProbe: readinessProbe:
httpGet: httpGet:
path: /ready path: /ready
@@ -73,7 +80,7 @@ spec:
{{- toYaml .Values.livenessProbe | nindent 12 }} {{- toYaml .Values.livenessProbe | nindent 12 }}
resources: resources:
{{- toYaml .Values.resources | nindent 12 }} {{- toYaml .Values.resources | nindent 12 }}
{{- if .Values.insecureScheme.enabled }} {{- if not $tlsEnabled }}
- name: nginx - name: nginx
securityContext: securityContext:
{{- include "spire-lib.securitycontext" . | nindent 12 }} {{- include "spire-lib.securitycontext" . | nindent 12 }}
@@ -113,7 +120,7 @@ spec:
volumes: volumes:
- name: spiffe-workload-api - name: spiffe-workload-api
csi: csi:
driver: "csi.spiffe.io" driver: "{{ .Values.csiDriverName }}"
readOnly: true readOnly: true
- name: spire-oidc-sockets - name: spire-oidc-sockets
emptyDir: {} emptyDir: {}
@@ -122,6 +129,16 @@ spec:
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
- name: nginx-tmp - name: nginx-tmp
emptyDir: {} emptyDir: {}
- name: certdir
{{- if .Values.tls.externalSecret.enabled }}
secret:
secretName: {{ .Values.tls.externalSecret.secretName }}
{{- else if .Values.tls.certManager.enabled }}
secret:
secretName: {{ include "spiffe-oidc-discovery-provider.fullname" . }}-cert
{{- else }}
emptyDir: {}
{{- end }}
{{- with .Values.nodeSelector }} {{- with .Values.nodeSelector }}
nodeSelector: nodeSelector:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml
+25 -2
View File
@@ -1,13 +1,36 @@
{{- if .Values.ingress.enabled -}} {{- if .Values.ingress.enabled -}}
{{- $tlsEnabled := eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "true" }}
{{- $port := .Values.service.ports.https }}
{{- if not $tlsEnabled }}
{{- $port = .Values.service.ports.http }}
{{- end }}
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }} {{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
{{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . }} {{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . }}
{{- $path := "/" }}
{{- $pathType := "Prefix" }}
{{- $tlsSection := true }} {{- $tlsSection := true }}
{{- $annotations := deepCopy .Values.ingress.annotations }} {{- $annotations := deepCopy .Values.ingress.annotations }}
{{- if eq $ingressControllerType "ingress-nginx" }} {{- if eq $ingressControllerType "ingress-nginx" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }} {{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
{{- if $tlsEnabled }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
{{- if not (and .Values.ingress.enabled .Values.ingress.tlsSecret) }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
{{- end }}
{{- end }}
{{- else if eq $ingressControllerType "openshift" }} {{- else if eq $ingressControllerType "openshift" }}
{{- $_ := set $annotations "route.openshift.io/termination" "edge" }} {{- if not $tlsEnabled }}
{{- $_ := set $annotations "route.openshift.io/termination" "edge" }}
{{- else }}
{{- if and .Values.ingress.enabled .Values.ingress.tlsSecret }}
{{- $_ := set $annotations "route.openshift.io/termination" "reencrypt" }}
{{- else }}
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
{{- end }}
{{- end }}
{{- $path = "" }}
{{- $pathType = "ImplementationSpecific" }}
{{- $tlsSection = false }} {{- $tlsSection = false }}
{{- end }} {{- end }}
apiVersion: networking.k8s.io/v1 apiVersion: networking.k8s.io/v1
@@ -22,5 +45,5 @@ metadata:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
spec: spec:
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }} {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" $port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
{{- end }} {{- end }}
charts/spire/charts/spiffe-oidc-discovery-provider/templates/issuer.yaml
+22
View File
@@ -0,0 +1,22 @@
{{- define "spiffe-oidc-discovery-provider.cert-manager-default-issuer" }}
{{- if not .Values.tls.certManager.issuer.acme.email }}
{{- fail "You must specify an email address via certManager.issuer.acme.email" }}
{{- end }}
email: {{ .Values.tls.certManager.issuer.acme.email | quote}}
server: {{ .Values.tls.certManager.issuer.acme.server | quote}}
privateKeySecretRef:
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}-issuer
solvers:
- http01:
ingress: {}
{{- end }}
{{- if and .Values.tls.certManager.enabled .Values.tls.certManager.issuer.create }}
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
spec:
acme:
{{ mergeOverwrite (include "spiffe-oidc-discovery-provider.cert-manager-default-issuer" . | fromYaml) .Values.tls.certManager.issuer.acme | toYaml | nindent 4 }}
{{- end }}
charts/spire/charts/spiffe-oidc-discovery-provider/templates/podmonitor.yaml
+1 -1
View File
@@ -1,4 +1,4 @@
{{- if .Values.insecureScheme.enabled }} {{- if eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "false" }}
{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }} {{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
{{- $namespace := include "spiffe-oidc-discovery-provider.podMonitor.namespace" . }} {{- $namespace := include "spiffe-oidc-discovery-provider.podMonitor.namespace" . }}
{{- $podNamespace := ( include "spiffe-oidc-discovery-provider.namespace" . ) }} {{- $podNamespace := ( include "spiffe-oidc-discovery-provider.namespace" . ) }}
charts/spire/charts/spiffe-oidc-discovery-provider/templates/service.yaml
+3 -3
View File
@@ -10,14 +10,14 @@ metadata:
spec: spec:
type: {{ .Values.service.type }} type: {{ .Values.service.type }}
ports: ports:
{{- if .Values.insecureScheme.enabled }} {{- if eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "false" }}
- name: http - name: http
port: {{ .Values.service.port }} port: {{ .Values.service.ports.http }}
targetPort: http targetPort: http
protocol: TCP protocol: TCP
{{- else }} {{- else }}
- name: https - name: https
port: 443 port: {{ .Values.service.ports.https }}
targetPort: https targetPort: https
protocol: TCP protocol: TCP
{{- end }} {{- end }}
charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
+9 -3
View File
@@ -1,5 +1,11 @@
{{- $values := merge .Values }} {{- $values := merge .Values }}
{{- $host := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.ingress) }} {{- $host := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.ingress) }}
{{- $protocol := "https" }}
{{- $port := .Values.service.ports.https }}
{{- if eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "false" }}
{{- $protocol = "http" }}
{{- $port = .Values.service.ports.http }}
{{- end }}
{{- if gt (len .Values.ingress.hosts) 0 }} {{- if gt (len .Values.ingress.hosts) 0 }}
{{- $host = (index .Values.ingress.hosts 0).host }} {{- $host = (index .Values.ingress.hosts 0).host }}
{{- end }} {{- end }}
@@ -19,19 +25,19 @@ spec:
- name: curl-service-name - name: curl-service-name
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
command: ['curl'] command: ['curl']
args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}:{{ .Values.service.port }}/.well-known/openid-configuration'] args: ['-s', '-f', '-k', '{{ $protocol }}://{{ include "spiffe-oidc-discovery-provider.fullname" . }}:{{ $port }}/.well-known/openid-configuration']
securityContext: securityContext:
{{- include "spire-lib.securitycontext" . | nindent 8 }} {{- include "spire-lib.securitycontext" . | nindent 8 }}
- name: curl-service-name-namespace - name: curl-service-name-namespace
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
command: ['curl'] command: ['curl']
args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ .Values.service.port }}/.well-known/openid-configuration'] args: ['-s', '-f', '-k', '{{ $protocol }}://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ $port }}/.well-known/openid-configuration']
securityContext: securityContext:
{{- include "spire-lib.securitycontext" . | nindent 8 }} {{- include "spire-lib.securitycontext" . | nindent 8 }}
- name: curl-service-name-namespace-svc-cluster-local - name: curl-service-name-namespace-svc-cluster-local
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
command: ['curl'] command: ['curl']
args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration'] args: ['-s', '-f', '-k', '{{ $protocol }}://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ $port }}/.well-known/openid-configuration']
securityContext: securityContext:
{{- include "spire-lib.securitycontext" . | nindent 8 }} {{- include "spire-lib.securitycontext" . | nindent 8 }}
{{- if .Values.ingress.enabled }} {{- if .Values.ingress.enabled }}
charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-keys.yaml
+10 -1
View File
@@ -1,3 +1,9 @@
{{- $protocol := "https" }}
{{- $port := .Values.service.ports.https }}
{{- if eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "false" }}
{{- $protocol = "http" }}
{{- $port = .Values.service.ports.http }}
{{- end }}
apiVersion: v1 apiVersion: v1
kind: Pod kind: Pod
metadata: metadata:
@@ -5,6 +11,9 @@ metadata:
namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }} namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
labels: labels:
{{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
release: {{ .Release.Name }}
release-namespace: {{ .Release.Namespace }}
component: test-keys
annotations: annotations:
"helm.sh/hook": test "helm.sh/hook": test
spec: spec:
@@ -70,7 +79,7 @@ spec:
args: args:
- -cx - -cx
- | - |
URL=http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }} URL={{ $protocol }}://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ $port }}
cat /data/token.svid cat /data/token.svid
JWT=$(cat /data/token.svid | jq -r '.[] | select(.svids) | .svids[0].svid' | xargs) JWT=$(cat /data/token.svid | jq -r '.[] | select(.svids) | .svids[0].svid' | xargs)
charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+52 -21
View File
@@ -8,6 +8,8 @@ global: {}
## ##
## @param agentSocketName The name of the spire-agent unix socket ## @param agentSocketName The name of the spire-agent unix socket
agentSocketName: spire-agent.sock agentSocketName: spire-agent.sock
## @param csiDriverName The csi driver to use
csiDriverName: csi.spiffe.io
## @param replicaCount Replica count ## @param replicaCount Replica count
replicaCount: 1 replicaCount: 1
@@ -45,12 +47,15 @@ resources: {}
# memory: 64Mi # memory: 64Mi
## @param service.type Service type ## @param service.type Service type
## @param service.port Service port ## @param service.ports.http Insecure port for the service
## @param service.ports.https Secure port for the service
## @param service.annotations Annotations for service resource ## @param service.annotations Annotations for service resource
## ##
service: service:
type: ClusterIP type: ClusterIP
port: 80 ports:
http: 80
https: 443
annotations: {} annotations: {}
# external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org # external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org
@@ -88,16 +93,53 @@ livenessProbe:
## @param podAnnotations [object] Pod annotations for Spire OIDC discovery provider ## @param podAnnotations [object] Pod annotations for Spire OIDC discovery provider
podAnnotations: {} podAnnotations: {}
insecureScheme: # Select from one of the options below to be the source of certificates for OIDC Discovery Provider.
## @param insecureScheme.enabled Flag to enable insecure schema # If none are enabled, connections won't be TLS encrypted.
enabled: false tls:
spire:
## @param tls.spire.enabled Use spire to secure the oidc-discovery-provider
enabled: true
externalSecret:
## @param tls.externalSecret.enabled Provide your own certificate/key via tls style Kubernetes Secret
enabled: false
## @param tls.externalSecret.secretName Specify which Secret to use
secretName: ""
certManager:
## @param tls.certManager.enabled Use certificateManager to create the certificate
enabled: false
issuer:
## @param tls.certManager.issuer.create Create an issuer to use to issue the certificate
create: true
acme:
## @param tls.certManager.issuer.acme.email Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service
email: ""
## @param tls.certManager.issuer.acme.server Server to use to get certificate. Defaults to LetsEncrypt
server: https://acme-v02.api.letsencrypt.org/directory
# Testing server: https://acme-staging-v02.api.letsencrypt.org/directory
## @param tls.certManager.issuer.acme.solvers [object] Configure the issuer solvers. Defaults to http01 via ingress.
solvers: {}
# - http01:
# ingress:
# ingressClassName: nginx
certificate:
## @param tls.certManager.certificate.dnsNames Override the dnsNames on the certificate request. Defaults to the same settings as Ingress
dnsNames: []
## @param tls.certManager.certificate.issuerRef.group If you are using an external plugin, specify the group for it here
## @param tls.certManager.certificate.issuerRef.kind Kind of the issuer reference. Override if you want to use a ClusterIssuer
## @param tls.certManager.certificate.issuerRef.name Name of the issuer to use. If unset, it will use the name of the built in issuer
issuerRef:
group: ""
kind: Issuer
name: ""
insecureScheme:
nginx: nginx:
## @param insecureScheme.nginx.image.registry The OCI registry to pull the image from ## @param insecureScheme.nginx.image.registry The OCI registry to pull the image from. Only used when TLS is disabled.
## @param insecureScheme.nginx.image.repository The repository within the registry ## @param insecureScheme.nginx.image.repository The repository within the registry. Only used when TLS is disabled.
## @param insecureScheme.nginx.image.pullPolicy The image pull policy ## @param insecureScheme.nginx.image.pullPolicy The image pull policy. Only used when TLS is disabled.
## @param insecureScheme.nginx.image.version This value is deprecated in favor of tag. (Will be removed in a future release) ## @param insecureScheme.nginx.image.tag Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled.
## @param insecureScheme.nginx.image.tag Overrides the image tag whose default is the chart appVersion
## Example: ## Example:
## chainguard image does not support the templates feature ## chainguard image does not support the templates feature
## https://github.com/chainguard-images/nginx/issues/43 ## https://github.com/chainguard-images/nginx/issues/43
@@ -110,7 +152,6 @@ insecureScheme:
registry: docker.io registry: docker.io
repository: nginxinc/nginx-unprivileged repository: nginxinc/nginx-unprivileged
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
version: ""
tag: 1.25.3-alpine tag: 1.25.3-alpine
## @param insecureScheme.nginx.resources Resource requests and limits ## @param insecureScheme.nginx.resources Resource requests and limits
resources: {} resources: {}
@@ -135,16 +176,6 @@ config:
additionalDomains: [] additionalDomains: []
# - localhost # - localhost
acme:
## @param config.acme.tosAccepted Flag for Terms of Service acceptance
tosAccepted: false
## @param config.acme.cacheDir Path for cache directory
cacheDir: /run/spire
## @param config.acme.directoryUrl URL for acme directory
directoryUrl: https://acme-v02.api.letsencrypt.org/directory
## @param config.acme.emailAddress Email address for registration
emailAddress: [email protected]
## @param imagePullSecrets [array] Image pull secret names ## @param imagePullSecrets [array] Image pull secret names
imagePullSecrets: [] imagePullSecrets: []
charts/spire/charts/spire-server/README.md
+194 -188
View File
@@ -79,194 +79,200 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
### Chart parameters ### Chart parameters
| Name | Description | Value | | Name | Description | Value |
| --------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | | -------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` | | `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `image.repository` | The repository within the registry | `spiffe/spire-server` | | `image.repository` | The repository within the registry | `spiffe/spire-server` |
| `image.pullPolicy` | The image pull policy | `IfNotPresent` | | `image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `imagePullSecrets` | Pull secrets for images | `[]` | | `imagePullSecrets` | Pull secrets for images | `[]` |
| `nameOverride` | Name override | `""` | | `nameOverride` | Name override | `""` |
| `namespaceOverride` | Namespace override | `""` | | `namespaceOverride` | Namespace override | `""` |
| `fullnameOverride` | Fullname override | `""` | | `fullnameOverride` | Fullname override | `""` |
| `serviceAccount.create` | Specifies whether a service account should be created | `true` | | `serviceAccount.create` | Specifies whether a service account should be created | `true` |
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | | `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | | `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
| `podAnnotations` | Annotations to add to pods | `{}` | | `podAnnotations` | Annotations to add to pods | `{}` |
| `podSecurityContext` | Pod security context | `{}` | | `podSecurityContext` | Pod security context | `{}` |
| `securityContext` | Security context | `{}` | | `securityContext` | Security context | `{}` |
| `priorityClassName` | Priority class assigned to statefulset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `priorityClassName` | Priority class assigned to statefulset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
| `service.type` | Type of the Spire server service created | `ClusterIP` | | `service.type` | Type of the Spire server service created | `ClusterIP` |
| `service.port` | Port for the created service | `8081` | | `service.port` | Port for the created service | `8081` |
| `service.annotations` | Annotations to add to the service object | `{}` | | `service.annotations` | Annotations to add to the service object | `{}` |
| `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` | | `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` |
| `resources` | Resource requests and limits | `{}` | | `resources` | Resource requests and limits | `{}` |
| `autoscaling.enabled` | Flag to enable autoscaling | `false` | | `autoscaling.enabled` | Flag to enable autoscaling | `false` |
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` | | `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` | | `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` |
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` | | `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` |
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` | | `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` |
| `tolerations` | List of tolerations | `[]` | | `tolerations` | List of tolerations | `[]` |
| `affinity` | List of node affinities | `{}` | | `affinity` | List of node affinities | `{}` |
| `topologySpreadConstraints` | Topology spread constraints for resilience | `[]` | | `topologySpreadConstraints` | Topology spread constraints for resilience | `[]` |
| `livenessProbe.failureThreshold` | Failure threshold count for livenessProbe | `2` | | `livenessProbe.failureThreshold` | Failure threshold count for livenessProbe | `2` |
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `15` | | `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `15` |
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `60` | | `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `60` |
| `livenessProbe.timeoutSeconds` | Timeout in seconds for livenessProbe | `3` | | `livenessProbe.timeoutSeconds` | Timeout in seconds for livenessProbe | `3` |
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | | `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | | `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
| `persistence.type` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `pvc` | | `persistence.type` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `pvc` |
| `persistence.size` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `1Gi` | | `persistence.size` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `1Gi` |
| `persistence.accessMode` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `ReadWriteOnce` | | `persistence.accessMode` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `ReadWriteOnce` |
| `persistence.storageClass` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `nil` | | `persistence.storageClass` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `nil` |
| `persistence.hostPath` | Which path to use on the host when type = hostPath | `""` | | `persistence.hostPath` | Which path to use on the host when type = hostPath | `""` |
| `dataStore.sql.databaseType` | Other supported databases are "postgres" and "mysql" | `sqlite3` | | `dataStore.sql.databaseType` | Other supported databases are "postgres" and "mysql" | `sqlite3` |
| `dataStore.sql.databaseName` | Only used by "postgres" or "mysql" | `spire` | | `dataStore.sql.databaseName` | Only used by "postgres" or "mysql" | `spire` |
| `dataStore.sql.host` | Only used by "postgres" or "mysql" | `""` | | `dataStore.sql.host` | Only used by "postgres" or "mysql" | `""` |
| `dataStore.sql.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` | | `dataStore.sql.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` |
| `dataStore.sql.username` | Only used by "postgres" or "mysql" | `spire` | | `dataStore.sql.username` | Only used by "postgres" or "mysql" | `spire` |
| `dataStore.sql.password` | Only used by "postgres" or "mysql" | `""` | | `dataStore.sql.password` | Only used by "postgres" or "mysql" | `""` |
| `dataStore.sql.options` | Only used by "postgres" or "mysql" | `[]` | | `dataStore.sql.options` | Only used by "postgres" or "mysql" | `[]` |
| `dataStore.sql.plugin_data` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section | `{}` | | `dataStore.sql.plugin_data` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section | `{}` |
| `dataStore.sql.externalSecret.enabled` | Enable external secret for datastore creds | `false` | | `dataStore.sql.externalSecret.enabled` | Enable external secret for datastore creds | `false` |
| `dataStore.sql.externalSecret.name` | The name of the secret object | `""` | | `dataStore.sql.externalSecret.name` | The name of the secret object | `""` |
| `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` | | `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | | `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
| `jwtIssuer` | The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset | `""` | | `jwtIssuer` | The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset | `""` |
| `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` | | `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` |
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | | `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
| `bundleConfigMap` | Set the trust domain to be used for the SPIFFE identifiers | `spire-bundle` | | `bundleConfigMap` | Set the trust domain to be used for the SPIFFE identifiers | `spire-bundle` |
| `clusterDomain` | This is the value of your clusters `kubeadm init --service-dns-domain` flag | `cluster.local` | | `clusterDomain` | This is the value of your clusters `kubeadm init --service-dns-domain` flag | `cluster.local` |
| `federation.enabled` | Flag to enable federation | `false` | | `federation.enabled` | Flag to enable federation | `false` |
| `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` | | `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` |
| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` | | `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` |
| `federation.ingress.enabled` | Flag to enable ingress for federation | `false` | | `federation.ingress.enabled` | Flag to enable ingress for federation | `false` |
| `federation.ingress.className` | Ingress class name for federation | `""` | | `federation.ingress.className` | Ingress class name for federation | `""` |
| `federation.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | | `federation.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` | | `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
| `federation.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server-federation` | | `federation.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server-federation` |
| `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | | `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
| `federation.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | | `federation.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
| `ca_subject.country` | Country for Spire server CA | `ARPA` | | `ca_subject.country` | Country for Spire server CA | `ARPA` |
| `ca_subject.organization` | Organization for Spire server CA | `Example` | | `ca_subject.organization` | Organization for Spire server CA | `Example` |
| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` | | `ca_subject.common_name` | Common Name for Spire server CA | `example.org` |
| `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` | | `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` |
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` | | `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
| `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` | | `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` |
| `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` | | `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` |
| `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | | | `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | |
| `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` | | `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` |
| `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` | | `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` |
| `keyManager.awsKMS.accessKeyID` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. | `""` | | `keyManager.awsKMS.accessKeyID` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. | `""` |
| `keyManager.awsKMS.secretAccessKey` | Secret access key for the AWS account. | `""` | | `keyManager.awsKMS.secretAccessKey` | Secret access key for the AWS account. | `""` |
| `upstreamAuthority.disk.enabled` | Flag to enable upstream authority plugin on disk | `false` | | `upstreamAuthority.disk.enabled` | Flag to enable upstream authority plugin on disk | `false` |
| `upstreamAuthority.disk.secret.create` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | `true` | | `upstreamAuthority.disk.secret.create` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | `true` |
| `upstreamAuthority.disk.secret.name` | If secret creation is disabled, the secret with this name will be used. | `spiffe-upstream-ca` | | `upstreamAuthority.disk.secret.name` | If secret creation is disabled, the secret with this name will be used. | `spiffe-upstream-ca` |
| `upstreamAuthority.disk.secret.data` | If secret creation is enabled, will create a secret with following certificate info | | | `upstreamAuthority.disk.secret.data` | If secret creation is enabled, will create a secret with following certificate info | |
| `upstreamAuthority.disk.secret.data.certificate` | Certificate to store within disk upstreamAuthority. | `""` | | `upstreamAuthority.disk.secret.data.certificate` | Certificate to store within disk upstreamAuthority. | `""` |
| `upstreamAuthority.disk.secret.data.key` | Key corresponding to the upstreamAuthority. | `""` | | `upstreamAuthority.disk.secret.data.key` | Key corresponding to the upstreamAuthority. | `""` |
| `upstreamAuthority.disk.secret.data.bundle` | Trust bundle for upstreamAuthority. | `""` | | `upstreamAuthority.disk.secret.data.bundle` | Trust bundle for upstreamAuthority. | `""` |
| `upstreamAuthority.awsPCA.enabled` | Flag to enable upstream authority plugin with AWS PCA | `false` | | `upstreamAuthority.awsPCA.enabled` | Flag to enable upstream authority plugin with AWS PCA | `false` |
| `upstreamAuthority.awsPCA.region` | AWS Region to use | `""` | | `upstreamAuthority.awsPCA.region` | AWS Region to use | `""` |
| `upstreamAuthority.awsPCA.certificateAuthorityARN` | ARN of the "upstream" CA certificate | `""` | | `upstreamAuthority.awsPCA.certificateAuthorityARN` | ARN of the "upstream" CA certificate | `""` |
| `upstreamAuthority.awsPCA.assumeRoleARN` | (Optional) ARN of an IAM role to assume | `""` | | `upstreamAuthority.awsPCA.assumeRoleARN` | (Optional) ARN of an IAM role to assume | `""` |
| `upstreamAuthority.awsPCA.caSigningTemplateARN` | (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. | `""` | | `upstreamAuthority.awsPCA.caSigningTemplateARN` | (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. | `""` |
| `upstreamAuthority.awsPCA.signingAlgorithm` | (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | `""` | | `upstreamAuthority.awsPCA.signingAlgorithm` | (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | `""` |
| `upstreamAuthority.awsPCA.endpoint` | (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | `""` | | `upstreamAuthority.awsPCA.endpoint` | (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | `""` |
| `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` | | `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` |
| `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` | | `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` |
| `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` | | `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` |
| `upstreamAuthority.certManager.issuer_name` | Defaults to the release name, override if CA is provided outside of the chart | `""` | | `upstreamAuthority.certManager.issuer_name` | Defaults to the release name, override if CA is provided outside of the chart | `""` |
| `upstreamAuthority.certManager.issuer_kind` | Defaults to "Issuer", override if CA is provided outside of the chart | `Issuer` | | `upstreamAuthority.certManager.issuer_kind` | Defaults to "Issuer", override if CA is provided outside of the chart | `Issuer` |
| `upstreamAuthority.certManager.issuer_group` | Defaults to "cert-manager.io", override if CA is provided outside of the chart | `cert-manager.io` | | `upstreamAuthority.certManager.issuer_group` | Defaults to "cert-manager.io", override if CA is provided outside of the chart | `cert-manager.io` |
| `upstreamAuthority.certManager.namespace` | Specify to use a namespace other then the one the chart is installed into | `""` | | `upstreamAuthority.certManager.namespace` | Specify to use a namespace other then the one the chart is installed into | `""` |
| `upstreamAuthority.certManager.kube_config_file` | Path to kube_config_file on node to setup cert manager | `""` | | `upstreamAuthority.certManager.kube_config_file` | Path to kube_config_file on node to setup cert manager | `""` |
| `upstreamAuthority.certManager.ca.create` | Creates a Cert-Manager CA | `false` | | `upstreamAuthority.certManager.ca.create` | Creates a Cert-Manager CA | `false` |
| `upstreamAuthority.certManager.ca.duration` | Duration of the CA. Defaults to 10 years | `87600h` | | `upstreamAuthority.certManager.ca.duration` | Duration of the CA. Defaults to 10 years | `87600h` |
| `upstreamAuthority.certManager.ca.privateKey.algorithm` | Algorithm to generate private key for CA | `ECDSA` | | `upstreamAuthority.certManager.ca.privateKey.algorithm` | Algorithm to generate private key for CA | `ECDSA` |
| `upstreamAuthority.certManager.ca.privateKey.size` | Size of generated private key for CA | `256` | | `upstreamAuthority.certManager.ca.privateKey.size` | Size of generated private key for CA | `256` |
| `upstreamAuthority.certManager.ca.privateKey.rotationPolicy` | Rotation policy for generated private key | `""` | | `upstreamAuthority.certManager.ca.privateKey.rotationPolicy` | Rotation policy for generated private key | `""` |
| `upstreamAuthority.certManager.ca.renewBefore` | How long to wait before renewing the CA | `""` | | `upstreamAuthority.certManager.ca.renewBefore` | How long to wait before renewing the CA | `""` |
| `upstreamAuthority.spire.enabled` | Flag to use another Spire install as upstream CA | `false` | | `upstreamAuthority.spire.enabled` | Flag to use another Spire install as upstream CA | `false` |
| `upstreamAuthority.spire.upstreamDriver` | Driver for Spire as upstream CA | `""` | | `upstreamAuthority.spire.upstreamDriver` | Driver for Spire as upstream CA | `""` |
| `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | | | `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | |
| `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` | | `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` |
| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `8081` | | `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `8081` |
| `upstreamAuthority.vault.enabled` | Enable Hashicorp Vault as upstream CA | `false` | | `upstreamAuthority.vault.enabled` | Enable Hashicorp Vault as upstream CA | `false` |
| `upstreamAuthority.vault.vaultAddr` | The URL of the Vault server. (e.g., https://vault.example.com:8443/) | `""` | | `upstreamAuthority.vault.vaultAddr` | The URL of the Vault server. (e.g., https://vault.example.com:8443/) | `""` |
| `upstreamAuthority.vault.namespace` | Name of the Vault namespace. This is only available in the Vault Enterprise. | `""` | | `upstreamAuthority.vault.namespace` | Name of the Vault namespace. This is only available in the Vault Enterprise. | `""` |
| `upstreamAuthority.vault.pkiMountPoint` | Name of the mount point where PKI secret engine is mounted | `pki` | | `upstreamAuthority.vault.pkiMountPoint` | Name of the mount point where PKI secret engine is mounted | `pki` |
| `upstreamAuthority.vault.insecureSkipVerify` | If true, caCert options are ignored and Spire accepts any server certificates claiming to be Vault | `false` | | `upstreamAuthority.vault.insecureSkipVerify` | If true, caCert options are ignored and Spire accepts any server certificates claiming to be Vault | `false` |
| `upstreamAuthority.vault.caCert.type` | Type of resource representing the Vault server certificate, options are 'Secret' or 'Configmap', the item must be named `ca.crt` | `Secret` | | `upstreamAuthority.vault.caCert.type` | Type of resource representing the Vault server certificate, options are 'Secret' or 'Configmap', the item must be named `ca.crt` | `Secret` |
| `upstreamAuthority.vault.caCert.name` | Name of the Kubernetes resource containing the Vault server certificate | `vault-ca` | | `upstreamAuthority.vault.caCert.name` | Name of the Kubernetes resource containing the Vault server certificate | `vault-ca` |
| `upstreamAuthority.vault.k8sAuth.enabled` | Enable k8s authentication to Hashicorp Vault | `false` | | `upstreamAuthority.vault.k8sAuth.enabled` | Enable k8s authentication to Hashicorp Vault | `false` |
| `upstreamAuthority.vault.k8sAuth.k8sAuthMountPoint` | Name of the mount point where the Kubernetes auth method is mounted | `kubernetes` | | `upstreamAuthority.vault.k8sAuth.k8sAuthMountPoint` | Name of the mount point where the Kubernetes auth method is mounted | `kubernetes` |
| `upstreamAuthority.vault.k8sAuth.k8sAuthRoleName` | Required - Name of the Vault role. The plugin authenticates against the named role | `""` | | `upstreamAuthority.vault.k8sAuth.k8sAuthRoleName` | Required - Name of the Vault role. The plugin authenticates against the named role | `""` |
| `upstreamAuthority.vault.k8sAuth.token.audience` | Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info. | `vault` | | `upstreamAuthority.vault.k8sAuth.token.audience` | Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info. | `vault` |
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` | | `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` | | `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
| `controllerManager.enabled` | Flag to enable controller manager | `false` | | `controllerManager.enabled` | Flag to enable controller manager | `false` |
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` | | `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` | | `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | | `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
| `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` | | `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` |
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.0` | | `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.0` |
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
| `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.securityContext` | Security context | `{}` |
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
| `controllerManager.service.port` | Service port for controller manager | `443` | | `controllerManager.service.port` | Service port for controller manager | `443` |
| `controllerManager.service.annotations` | Annotations for service resource | `{}` | | `controllerManager.service.annotations` | Annotations for service resource | `{}` |
| `controllerManager.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` | | `controllerManager.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` |
| `controllerManager.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` | | `controllerManager.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` |
| `controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable this identity for controller manager | `true` | | `controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable this identity for controller manager | `true` |
| `controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` | | `controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` |
| `controllerManager.identities.clusterSPIFFEIDs.default.podSelector` | Selector for pods to issue identity | `{}` | | `controllerManager.identities.clusterSPIFFEIDs.default.podSelector` | Selector for pods to issue identity | `{}` |
| `controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector` | Selector for namespacs to issue identity | `{}` | | `controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector` | Selector for namespacs to issue identity | `{}` |
| `controllerManager.identities.clusterSPIFFEIDs.default.dnsNameTemplates` | DNS name template for issued identities | `[]` | | `controllerManager.identities.clusterSPIFFEIDs.default.dnsNameTemplates` | DNS name template for issued identities | `[]` |
| `controllerManager.identities.clusterSPIFFEIDs.default.federatesWith` | Other Spire server URLs for identity federation | `[]` | | `controllerManager.identities.clusterSPIFFEIDs.default.federatesWith` | Other Spire server URLs for identity federation | `[]` |
| `controllerManager.identities.clusterSPIFFEIDs.default.workloadSelectorTemplates` | Templates to produce selectors that apply to a given workload before it will receive an ID | `[]` | | `controllerManager.identities.clusterSPIFFEIDs.default.workloadSelectorTemplates` | Templates to produce selectors that apply to a given workload before it will receive an ID | `[]` |
| `controllerManager.identities.clusterSPIFFEIDs.default.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` | | `controllerManager.identities.clusterSPIFFEIDs.default.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` |
| `controllerManager.identities.clusterSPIFFEIDs.default.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` | | `controllerManager.identities.clusterSPIFFEIDs.default.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` |
| `controllerManager.identities.clusterSPIFFEIDs.default.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` | | `controllerManager.identities.clusterSPIFFEIDs.default.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
| `controllerManager.identities.clusterSPIFFEIDs.default.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` | | `controllerManager.identities.clusterSPIFFEIDs.default.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` |
| `controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` | | `controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` |
| `controllerManager.identities.clusterStaticEntries` | Specify ClusterStaticEntry objects. | `{}` | | `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable this identity for controller manager | `true` |
| `controllerManager.identities.clusterFederatedTrustDomains` | Specify ClusterFederatedTrustDomain objects. | `{}` | | `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type` | The type of rule this is. | `oidc-discovery-provider` |
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` | | `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate DNS names to the discovery provider | `true` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | | `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.dnsNameTemplates` | DNS name template for issued identities | `[]` |
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | | `controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable this identity for controller manager | `true` |
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `controllerManager.identities.clusterSPIFFEIDs.test-keys.type` | The type of rule this is. | `test-keys` |
| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `controllerManager.identities.clusterStaticEntries` | Specify ClusterStaticEntry objects. | `{}` |
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `controllerManager.identities.clusterFederatedTrustDomains` | Specify ClusterFederatedTrustDomain objects. | `{}` |
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | | `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` | | `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | | `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `ingress.enabled` | Flag to enable ingress | `false` | | `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `ingress.className` | Ingress class name | `""` | | `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | | `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
| `ingress.annotations` | Annotations for the ingress object | `{}` | | `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server` | | `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | | `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | | `ingress.enabled` | Flag to enable ingress | `false` |
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `ingress.className` | Ingress class name | `""` |
| `extraVolumes` | Extra volumes to be mounted | `[]` | | `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
| `extraVolumeMounts` | Extra volume mounts | `[]` | | `ingress.annotations` | Annotations for the ingress object | `{}` |
| `extraContainers` | Additional containers to create | `[]` | | `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server` |
| `initContainers` | Additional init containers to create | `[]` | | `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
| `caKeyType` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) | `rsa-2048` | | `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
| `caTTL` | TTL for CA | `24h` | | `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
| `defaultX509SvidTTL` | TTL for X509 Svids | `4h` | | `extraVolumes` | Extra volumes to be mounted | `[]` |
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` | | `extraVolumeMounts` | Extra volume mounts | `[]` |
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` | | `extraContainers` | Additional containers to create | `[]` |
| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` | | `initContainers` | Additional init containers to create | `[]` |
| `caKeyType` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) | `rsa-2048` |
| `caTTL` | TTL for CA | `24h` |
| `defaultX509SvidTTL` | TTL for X509 Svids | `4h` |
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` |
| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` |
### Tornjak ### Tornjak
charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml
+45 -8
View File
@@ -1,17 +1,50 @@
{{- define "spire-controller-manager-identity-nsselector" }}
key: "kubernetes.io/metadata.name"
{{- if eq .type "base" }}
operator: NotIn
{{- else }}
operator: In
{{- end }}
values:
{{ .namespaces | toYaml | nindent 2 }}
{{- end }}
{{- define "spire-controller-manager-identity-podselector" }}
{{- if eq .type "oidc-discovery-provider" }}
matchLabels:
release: {{ .Release.Name }}
release-namespace: {{ .Release.Namespace }}
component: oidc-discovery-provider
{{- else if eq .type "test-keys" }}
matchLabels:
release: {{ .Release.Name }}
release-namespace: {{ .Release.Namespace }}
component: test-keys
{{- else }}
{}
{{- end }}
{{- end }}
{{- $root := . }} {{- $root := . }}
{{ $namespaces := list .Release.Namespace .Values.namespaceOverride (dig "spire" "namespaces" "server" "name" "" .Values.global) (dig "spire" "namespaces" "system" "name" "" .Values.global) | compact | uniq }}
{{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }} {{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }}
{{- range $skey, $svalue := $value }} {{- range $skey, $svalue := $value }}
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "admin" "dnsNameTemplates" "downstream" "federatesWith" "jwtTTL" "namespaceSelector" "podSelector" "spiffeIDTemplate" "ttl" "workloadSelectorTemplates" "autoPopulateDNSNames")) }} {{- if not (has $skey (list "name" "annotations" "labels" "enabled" "type" "admin" "dnsNameTemplates" "downstream" "federatesWith" "jwtTTL" "namespaceSelector" "podSelector" "spiffeIDTemplate" "ttl" "workloadSelectorTemplates" "autoPopulateDNSNames")) }}
{{- fail (printf "Unsupported property specified: %s" $skey) }} {{- fail (printf "Unsupported property specified: %s" $skey) }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- range $rprop := list "spiffeIDTemplate" }}
{{- if not (hasKey $value $rprop) }}
{{- fail (printf "Required property %s was not specified" $rprop) }}
{{- end }}
{{- end }}
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }} {{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }} {{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
{{- $type := dig "type" "base" $value }}
{{- if not (has $type (list "base" "raw" "oidc-discovery-provider" "test-keys")) }}
{{- fail (printf "Type given: %s, must be one of [base, raw, oidc-discovery-provider, test-keys]" $type) }}
{{- end }}
{{- $namespaceSelector := deepCopy (dig "namespaceSelector" (dict) $value) }}
{{- if ne $type "raw" }}
{{- $namespaceSelector := merge $namespaceSelector (dict "matchExpressions" (list)) }}
{{- $namespaceSelectorToAdd := include "spire-controller-manager-identity-nsselector" (dict "type" $type "namespaces" $namespaces) | fromYaml }}
{{- $_ := set $namespaceSelector "matchExpressions" (append $namespaceSelector.matchExpressions $namespaceSelectorToAdd) }}
{{- end }}
{{- $podSelector := deepCopy (dig "podSelector" (dict) $value) }}
{{- $podSelector := merge $podSelector (include "spire-controller-manager-identity-podselector" (dict "type" $type "Release" $root.Release) | fromYaml ) }}
--- ---
apiVersion: spire.spiffe.io/v1alpha1 apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterSPIFFEID kind: ClusterSPIFFEID
@@ -27,16 +60,20 @@ metadata:
{{- end }} {{- end }}
spec: spec:
className: {{ include "spire-server.controller-manager-class-name" $root | quote }} className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
{{- if and (hasKey $value "spiffeIDTemplate") (ne (len $value.spiffeIDTemplate) 0) }}
spiffeIDTemplate: {{ $value.spiffeIDTemplate | quote }} spiffeIDTemplate: {{ $value.spiffeIDTemplate | quote }}
{{- else }}
spiffeIDTemplate: {{ $root.Values.controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate | quote }}
{{- end }}
{{- with $value.federatesWith }} {{- with $value.federatesWith }}
federatesWith: federatesWith:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
{{- with $value.podSelector }} {{- with $podSelector }}
podSelector: podSelector:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
{{- with $value.namespaceSelector }} {{- with $namespaceSelector }}
namespaceSelector: namespaceSelector:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/templates/statefulset.yaml
+3
View File
@@ -39,6 +39,9 @@ spec:
labels: labels:
{{- include "spire-server.selectorLabels" . | nindent 8 }} {{- include "spire-server.selectorLabels" . | nindent 8 }}
app.kubernetes.io/component: server app.kubernetes.io/component: server
component: server
release: {{ .Release.Name }}
release-namespace: {{ .Release.Namespace }}
spec: spec:
{{- with .Values.imagePullSecrets }} {{- with .Values.imagePullSecrets }}
imagePullSecrets: imagePullSecrets:
charts/spire/charts/spire-server/values.yaml
+17
View File
@@ -480,6 +480,23 @@ controllerManager:
## @param controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames Auto populate DNS names from services attached to pods ## @param controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames Auto populate DNS names from services attached to pods
autoPopulateDNSNames: false autoPopulateDNSNames: false
oidc-discovery-provider:
## @param controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled Enable this identity for controller manager
enabled: true
## @param controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type The type of rule this is.
type: oidc-discovery-provider
## @param controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames Auto populate DNS names to the discovery provider
autoPopulateDNSNames: true
## @param controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.dnsNameTemplates [array] DNS name template for issued identities
dnsNameTemplates:
- oidc-discovery.{{ .TrustDomain }}
test-keys:
## @param controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable this identity for controller manager
enabled: true
## @param controllerManager.identities.clusterSPIFFEIDs.test-keys.type The type of rule this is.
type: test-keys
# You can specify additional ClusterSPIFFEIDs following this example: # You can specify additional ClusterSPIFFEIDs following this example:
# foo: # foo:
# labels: # labels:
charts/spire/ci/namespace-override-values-skip.yaml
+3 -2
View File
@@ -1,8 +1,9 @@
spiffe-oidc-discovery-provider: spiffe-oidc-discovery-provider:
enabled: true enabled: true
namespaceOverride: spire-server namespaceOverride: spire-server
insecureScheme: tls:
enabled: true spire:
enabled: false
spire-server: spire-server:
namespaceOverride: spire-server namespaceOverride: spire-server
charts/spire/ci/no-spire-controller-manager-values.yaml
+2
View File
@@ -1,3 +1,5 @@
spire-server: spire-server:
controllerManager: controllerManager:
enabled: false enabled: false
spiffe-oidc-discovery-provider:
enabled: false
charts/spire/ci/oidc-values.yaml
+3 -2
View File
@@ -21,8 +21,9 @@ spire-agent:
spiffe-oidc-discovery-provider: spiffe-oidc-discovery-provider:
enabled: true enabled: true
insecureScheme: tls:
enabled: true spire:
enabled: false
config: config:
additionalDomains: additionalDomains:
charts/spire/ci/prometheus-values.yaml
+3 -2
View File
@@ -9,5 +9,6 @@ global:
spiffe-oidc-discovery-provider: spiffe-oidc-discovery-provider:
enabled: true enabled: true
insecureScheme: tls:
enabled: true spire:
enabled: false
examples/nested/values.yaml
+5 -2
View File
@@ -14,11 +14,14 @@ spire-server:
clusterSPIFFEIDs: clusterSPIFFEIDs:
default: default:
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/k8s/{{ .ClusterName }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }} spiffeIDTemplate: spiffe://{{ .TrustDomain }}/k8s/{{ .ClusterName }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
oidc-discovery-provider:
autoPopulateDNSNames: false
spiffe-oidc-discovery-provider: spiffe-oidc-discovery-provider:
enabled: true enabled: true
insecureScheme: tls:
enabled: true spire:
enabled: false
upstream: upstream:
enabled: true enabled: true
examples/production/values.yaml
+3 -2
View File
@@ -5,5 +5,6 @@ global:
spiffe-oidc-discovery-provider: spiffe-oidc-discovery-provider:
enabled: true enabled: true
insecureScheme: tls:
enabled: true spire:
enabled: false