panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add config to allow disabling jwt svids (#864)

Browse Source 
Signed-off-by: Daniel Schlatter <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
Daniel Schlatter
2026-07-02 14:57:29 -07:00
committed by GitHub
co-authored by kfox1111
parent 459cf8ff5b
commit 21bcece2ac
3 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+1
View File
@@ -165,6 +165,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | | `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
| `bundleConfigMap` | Set the Configmap name for SPIRE bundle | `spire-bundle` | | `bundleConfigMap` | Set the Configmap name for SPIRE bundle | `spire-bundle` |
| `clusterDomain` | This is the value of your clusters `kubeadm init --service-dns-domain` flag | `cluster.local` | | `clusterDomain` | This is the value of your clusters `kubeadm init --service-dns-domain` flag | `cluster.local` |
| `jwtSVIDSupport` | If false, completely disables JWT-SVID functionality. The server will not generate JWT keys, sign JWT-SVIDs, or implement JWT-related API calls. This is useful for deployments that don’t need JWT-SVIDs support. | `true` |
| `federation.enabled` | Flag to enable federation | `false` | | `federation.enabled` | Flag to enable federation | `false` |
| `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` | | `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` |
| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` | | `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` |
charts/spire/charts/spire-server/templates/configmap.yaml
+1 -1
View File
@@ -57,7 +57,7 @@ server:
{{- end }} {{- end }}
jwt_issuer: {{ include "spire-lib.jwt-issuer" . | quote }} jwt_issuer: {{ include "spire-lib.jwt-issuer" . | quote }}
audit_log_enabled: {{ .Values.auditLogEnabled }} audit_log_enabled: {{ .Values.auditLogEnabled }}
disable_jwt_svids: {{ not .Values.jwtSVIDSupport }}
ca_key_type: {{ .Values.caKeyType | quote }} ca_key_type: {{ .Values.caKeyType | quote }}
ca_ttl: {{ .Values.caTTL | quote }} ca_ttl: {{ .Values.caTTL | quote }}
charts/spire/charts/spire-server/values.yaml
+3
View File
@@ -251,6 +251,9 @@ bundleConfigMap: spire-bundle
## @param clusterDomain This is the value of your clusters `kubeadm init --service-dns-domain` flag ## @param clusterDomain This is the value of your clusters `kubeadm init --service-dns-domain` flag
clusterDomain: cluster.local clusterDomain: cluster.local
## @param jwtSVIDSupport If false, completely disables JWT-SVID functionality. The server will not generate JWT keys, sign JWT-SVIDs, or implement JWT-related API calls. This is useful for deployments that don’t need JWT-SVIDs support.
jwtSVIDSupport: true
federation: federation:
## @param federation.enabled Flag to enable federation ## @param federation.enabled Flag to enable federation
enabled: false enabled: false