Add support for Vault UpstreamAuthority plugin - K8s Auth (#415)
Co-authored-by: Marco Franssen <[email protected]>
This commit is contained in:
LaithLite
co-authored by
Marco Franssen
Marco Franssen
parent
1aac2d483d
commit
38f0af4491
@@ -85,193 +85,205 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
|
|
||||||
### Chart parameters
|
### Chart parameters
|
||||||
|
|
||||||
| Name | Description | Value |
|
| Name | Description | Value |
|
||||||
| ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------- |
|
| ---------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
|
||||||
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
|
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
|
||||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `image.repository` | The repository within the registry | `spiffe/spire-server` |
|
| `image.repository` | The repository within the registry | `spiffe/spire-server` |
|
||||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||||
| `nameOverride` | Name override | `""` |
|
| `nameOverride` | Name override | `""` |
|
||||||
| `namespaceOverride` | Namespace override | `""` |
|
| `namespaceOverride` | Namespace override | `""` |
|
||||||
| `fullnameOverride` | Fullname override | `""` |
|
| `fullnameOverride` | Fullname override | `""` |
|
||||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||||
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
||||||
| `podAnnotations` | Annotations to add to pods | `{}` |
|
| `podAnnotations` | Annotations to add to pods | `{}` |
|
||||||
| `podSecurityContext` | Pod security context | `{}` |
|
| `podSecurityContext` | Pod security context | `{}` |
|
||||||
| `securityContext` | Security context | `{}` |
|
| `securityContext` | Security context | `{}` |
|
||||||
| `priorityClassName` | Priority class assigned to statefulset pods | `""` |
|
| `priorityClassName` | Priority class assigned to statefulset pods | `""` |
|
||||||
| `service.type` | Type of the Spire server service created | `ClusterIP` |
|
| `service.type` | Type of the Spire server service created | `ClusterIP` |
|
||||||
| `service.port` | Port for the created service | `8081` |
|
| `service.port` | Port for the created service | `8081` |
|
||||||
| `service.annotations` | Annotations to add to the service object | `{}` |
|
| `service.annotations` | Annotations to add to the service object | `{}` |
|
||||||
| `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` |
|
| `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` |
|
||||||
| `resources` | Resource requests and limits | `{}` |
|
| `resources` | Resource requests and limits | `{}` |
|
||||||
| `autoscaling.enabled` | Flag to enable autoscaling | `false` |
|
| `autoscaling.enabled` | Flag to enable autoscaling | `false` |
|
||||||
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
|
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
|
||||||
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` |
|
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` |
|
||||||
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` |
|
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` |
|
||||||
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` |
|
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` |
|
||||||
| `tolerations` | List of tolerations | `[]` |
|
| `tolerations` | List of tolerations | `[]` |
|
||||||
| `affinity` | List of node affinities | `{}` |
|
| `affinity` | List of node affinities | `{}` |
|
||||||
| `topologySpreadConstraints` | Topology spread constraints for resilience | `[]` |
|
| `topologySpreadConstraints` | Topology spread constraints for resilience | `[]` |
|
||||||
| `livenessProbe.failureThreshold` | Failure threshold count for livenessProbe | `2` |
|
| `livenessProbe.failureThreshold` | Failure threshold count for livenessProbe | `2` |
|
||||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `15` |
|
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `15` |
|
||||||
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `60` |
|
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `60` |
|
||||||
| `livenessProbe.timeoutSeconds` | Timeout in seconds for livenessProbe | `3` |
|
| `livenessProbe.timeoutSeconds` | Timeout in seconds for livenessProbe | `3` |
|
||||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
||||||
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
||||||
| `persistence.type` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `pvc` |
|
| `persistence.type` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `pvc` |
|
||||||
| `persistence.size` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `1Gi` |
|
| `persistence.size` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `1Gi` |
|
||||||
| `persistence.accessMode` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `ReadWriteOnce` |
|
| `persistence.accessMode` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `ReadWriteOnce` |
|
||||||
| `persistence.storageClass` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `nil` |
|
| `persistence.storageClass` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `nil` |
|
||||||
| `persistence.hostPath` | Which path to use on the host when type = hostPath | `""` |
|
| `persistence.hostPath` | Which path to use on the host when type = hostPath | `""` |
|
||||||
| `dataStore.sql.databaseType` | Other supported databases are "postgres" and "mysql" | `sqlite3` |
|
| `dataStore.sql.databaseType` | Other supported databases are "postgres" and "mysql" | `sqlite3` |
|
||||||
| `dataStore.sql.databaseName` | Only used by "postgres" or "mysql" | `spire` |
|
| `dataStore.sql.databaseName` | Only used by "postgres" or "mysql" | `spire` |
|
||||||
| `dataStore.sql.host` | Only used by "postgres" or "mysql" | `""` |
|
| `dataStore.sql.host` | Only used by "postgres" or "mysql" | `""` |
|
||||||
| `dataStore.sql.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` |
|
| `dataStore.sql.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` |
|
||||||
| `dataStore.sql.username` | Only used by "postgres" or "mysql" | `spire` |
|
| `dataStore.sql.username` | Only used by "postgres" or "mysql" | `spire` |
|
||||||
| `dataStore.sql.password` | Only used by "postgres" or "mysql" | `""` |
|
| `dataStore.sql.password` | Only used by "postgres" or "mysql" | `""` |
|
||||||
| `dataStore.sql.options` | Only used by "postgres" or "mysql" | `[]` |
|
| `dataStore.sql.options` | Only used by "postgres" or "mysql" | `[]` |
|
||||||
| `dataStore.sql.plugin_data` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section | `{}` |
|
| `dataStore.sql.plugin_data` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section | `{}` |
|
||||||
| `dataStore.sql.externalSecret.enabled` | Enable external secret for datastore creds | `false` |
|
| `dataStore.sql.externalSecret.enabled` | Enable external secret for datastore creds | `false` |
|
||||||
| `dataStore.sql.externalSecret.name` | The name of the secret object | `""` |
|
| `dataStore.sql.externalSecret.name` | The name of the secret object | `""` |
|
||||||
| `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
|
| `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
|
||||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||||
| `jwtIssuer` | The JWT issuer domain | `https://oidc-discovery.example.org` |
|
| `jwtIssuer` | The JWT issuer domain | `https://oidc-discovery.example.org` |
|
||||||
| `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` |
|
| `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` |
|
||||||
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
|
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||||
| `bundleConfigMap` | Set the trust domain to be used for the SPIFFE identifiers | `spire-bundle` |
|
| `bundleConfigMap` | Set the trust domain to be used for the SPIFFE identifiers | `spire-bundle` |
|
||||||
| `clusterDomain` | This is the value of your clusters `kubeadm init --service-dns-domain` flag | `cluster.local` |
|
| `clusterDomain` | This is the value of your clusters `kubeadm init --service-dns-domain` flag | `cluster.local` |
|
||||||
| `federation.enabled` | Flag to enable federation | `false` |
|
| `federation.enabled` | Flag to enable federation | `false` |
|
||||||
| `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` |
|
| `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` |
|
||||||
| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` |
|
| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` |
|
||||||
| `federation.ingress.enabled` | Flag to enable ingress for federation | `false` |
|
| `federation.ingress.enabled` | Flag to enable ingress for federation | `false` |
|
||||||
| `federation.ingress.className` | Ingress class name for federation | `""` |
|
| `federation.ingress.className` | Ingress class name for federation | `""` |
|
||||||
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
|
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||||
| `federation.ingress.hosts` | Host paths for ingress object | `[]` |
|
| `federation.ingress.hosts` | Host paths for ingress object | `[]` |
|
||||||
| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
|
| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
|
||||||
| `ca_subject.country` | Country for Spire server CA | `NL` |
|
| `ca_subject.country` | Country for Spire server CA | `NL` |
|
||||||
| `ca_subject.organization` | Organization for Spire server CA | `Example` |
|
| `ca_subject.organization` | Organization for Spire server CA | `Example` |
|
||||||
| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` |
|
| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` |
|
||||||
| `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` |
|
| `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` |
|
||||||
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
|
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
|
||||||
| `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` |
|
| `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` |
|
||||||
| `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` |
|
| `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` |
|
||||||
| `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | |
|
| `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | |
|
||||||
| `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` |
|
| `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` |
|
||||||
| `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` |
|
| `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` |
|
||||||
| `keyManager.awsKMS.accessKeyID` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. | `""` |
|
| `keyManager.awsKMS.accessKeyID` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. | `""` |
|
||||||
| `keyManager.awsKMS.secretAccessKey` | Secret access key for the AWS account. | `""` |
|
| `keyManager.awsKMS.secretAccessKey` | Secret access key for the AWS account. | `""` |
|
||||||
| `upstreamAuthority.disk.enabled` | Flag to enable upstream authority plugin on disk | `false` |
|
| `upstreamAuthority.disk.enabled` | Flag to enable upstream authority plugin on disk | `false` |
|
||||||
| `upstreamAuthority.disk.secret.create` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | `true` |
|
| `upstreamAuthority.disk.secret.create` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | `true` |
|
||||||
| `upstreamAuthority.disk.secret.name` | If secret creation is disabled, the secret with this name will be used. | `spiffe-upstream-ca` |
|
| `upstreamAuthority.disk.secret.name` | If secret creation is disabled, the secret with this name will be used. | `spiffe-upstream-ca` |
|
||||||
| `upstreamAuthority.disk.secret.data` | If secret creation is enabled, will create a secret with following certificate info | |
|
| `upstreamAuthority.disk.secret.data` | If secret creation is enabled, will create a secret with following certificate info | |
|
||||||
| `upstreamAuthority.disk.secret.data.certificate` | Certificate to store within disk upstreamAuthority. | `""` |
|
| `upstreamAuthority.disk.secret.data.certificate` | Certificate to store within disk upstreamAuthority. | `""` |
|
||||||
| `upstreamAuthority.disk.secret.data.key` | Key corresponding to the upstreamAuthority. | `""` |
|
| `upstreamAuthority.disk.secret.data.key` | Key corresponding to the upstreamAuthority. | `""` |
|
||||||
| `upstreamAuthority.disk.secret.data.bundle` | Trust bundle for upstreamAuthority. | `""` |
|
| `upstreamAuthority.disk.secret.data.bundle` | Trust bundle for upstreamAuthority. | `""` |
|
||||||
| `upstreamAuthority.awsPCA.enabled` | Flag to enable upstream authority plugin with AWS PCA | `false` |
|
| `upstreamAuthority.awsPCA.enabled` | Flag to enable upstream authority plugin with AWS PCA | `false` |
|
||||||
| `upstreamAuthority.awsPCA.region` | AWS Region to use | `""` |
|
| `upstreamAuthority.awsPCA.region` | AWS Region to use | `""` |
|
||||||
| `upstreamAuthority.awsPCA.certificateAuthorityARN` | ARN of the "upstream" CA certificate | `""` |
|
| `upstreamAuthority.awsPCA.certificateAuthorityARN` | ARN of the "upstream" CA certificate | `""` |
|
||||||
| `upstreamAuthority.awsPCA.assumeRoleARN` | (Optional) ARN of an IAM role to assume | `""` |
|
| `upstreamAuthority.awsPCA.assumeRoleARN` | (Optional) ARN of an IAM role to assume | `""` |
|
||||||
| `upstreamAuthority.awsPCA.caSigningTemplateARN` | (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. | `""` |
|
| `upstreamAuthority.awsPCA.caSigningTemplateARN` | (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. | `""` |
|
||||||
| `upstreamAuthority.awsPCA.signingAlgorithm` | (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | `""` |
|
| `upstreamAuthority.awsPCA.signingAlgorithm` | (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | `""` |
|
||||||
| `upstreamAuthority.awsPCA.endpoint` | (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | `""` |
|
| `upstreamAuthority.awsPCA.endpoint` | (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | `""` |
|
||||||
| `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` |
|
| `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` |
|
||||||
| `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` |
|
| `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` |
|
||||||
| `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` |
|
| `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` |
|
||||||
| `upstreamAuthority.certManager.issuer_name` | Defaults to the release name, override if CA is provided outside of the chart | `""` |
|
| `upstreamAuthority.certManager.issuer_name` | Defaults to the release name, override if CA is provided outside of the chart | `""` |
|
||||||
| `upstreamAuthority.certManager.issuer_kind` | Defaults to "Issuer", override if CA is provided outside of the chart | `Issuer` |
|
| `upstreamAuthority.certManager.issuer_kind` | Defaults to "Issuer", override if CA is provided outside of the chart | `Issuer` |
|
||||||
| `upstreamAuthority.certManager.issuer_group` | Defaults to "cert-manager.io", override if CA is provided outside of the chart | `cert-manager.io` |
|
| `upstreamAuthority.certManager.issuer_group` | Defaults to "cert-manager.io", override if CA is provided outside of the chart | `cert-manager.io` |
|
||||||
| `upstreamAuthority.certManager.namespace` | Specify to use a namespace other then the one the chart is installed into | `""` |
|
| `upstreamAuthority.certManager.namespace` | Specify to use a namespace other then the one the chart is installed into | `""` |
|
||||||
| `upstreamAuthority.certManager.kube_config_file` | Path to kube_config_file on node to setup cert manager | `""` |
|
| `upstreamAuthority.certManager.kube_config_file` | Path to kube_config_file on node to setup cert manager | `""` |
|
||||||
| `upstreamAuthority.certManager.ca.create` | Creates a Cert-Manager CA | `false` |
|
| `upstreamAuthority.certManager.ca.create` | Creates a Cert-Manager CA | `false` |
|
||||||
| `upstreamAuthority.certManager.ca.duration` | Duration of the CA. Defaults to 10 years | `87600h` |
|
| `upstreamAuthority.certManager.ca.duration` | Duration of the CA. Defaults to 10 years | `87600h` |
|
||||||
| `upstreamAuthority.certManager.ca.privateKey.algorithm` | Algorithm to generate private key for CA | `ECDSA` |
|
| `upstreamAuthority.certManager.ca.privateKey.algorithm` | Algorithm to generate private key for CA | `ECDSA` |
|
||||||
| `upstreamAuthority.certManager.ca.privateKey.size` | Size of generated private key for CA | `256` |
|
| `upstreamAuthority.certManager.ca.privateKey.size` | Size of generated private key for CA | `256` |
|
||||||
| `upstreamAuthority.certManager.ca.privateKey.rotationPolicy` | Rotation policy for generated private key | `""` |
|
| `upstreamAuthority.certManager.ca.privateKey.rotationPolicy` | Rotation policy for generated private key | `""` |
|
||||||
| `upstreamAuthority.certManager.ca.renewBefore` | How long to wait before renewing the CA | `""` |
|
| `upstreamAuthority.certManager.ca.renewBefore` | How long to wait before renewing the CA | `""` |
|
||||||
| `upstreamAuthority.spire.enabled` | Flag to use another Spire install as upstream CA | `false` |
|
| `upstreamAuthority.spire.enabled` | Flag to use another Spire install as upstream CA | `false` |
|
||||||
| `upstreamAuthority.spire.upstreamDriver` | Driver for Spire as upstream CA | `""` |
|
| `upstreamAuthority.spire.upstreamDriver` | Driver for Spire as upstream CA | `""` |
|
||||||
| `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | |
|
| `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | |
|
||||||
| `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` |
|
| `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` |
|
||||||
| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `8081` |
|
| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `8081` |
|
||||||
| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
| `upstreamAuthority.vault.enabled` | Enable Hashicorp Vault as upstream CA | `false` |
|
||||||
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
| `upstreamAuthority.vault.vaultAddr` | The URL of the Vault server. (e.g., https://vault.example.com:8443/) | `""` |
|
||||||
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
| `upstreamAuthority.vault.namespace` | Name of the Vault namespace. This is only available in the Vault Enterprise. | `""` |
|
||||||
| `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
| `upstreamAuthority.vault.pkiMountPoint` | Name of the mount point where PKI secret engine is mounted | `pki` |
|
||||||
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `upstreamAuthority.vault.insecureSkipVerify` | If true, caCert options are ignored and Spire accepts any server certificates claiming to be Vault | `false` |
|
||||||
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
| `upstreamAuthority.vault.caCert.type` | Type of resource representing the Vault server certificate, options are 'Secret' or 'Configmap', the item must be named `ca.crt` | `Secret` |
|
||||||
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `upstreamAuthority.vault.caCert.name` | Name of the Kubernetes resource containing the Vault server certificate | `vault-ca` |
|
||||||
| `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| `upstreamAuthority.vault.k8sAuth.enabled` | Enable k8s authentication to Hashicorp Vault | `false` |
|
||||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.2.3` |
|
| `upstreamAuthority.vault.k8sAuth.k8sAuthMountPoint` | Name of the mount point where the Kubernetes auth method is mounted | `kubernetes` |
|
||||||
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
| `upstreamAuthority.vault.k8sAuth.k8sAuthRoleName` | Required - Name of the Vault role. The plugin authenticates against the named role | `""` |
|
||||||
| `controllerManager.securityContext` | Security context | `{}` |
|
| `upstreamAuthority.vault.k8sAuth.token.audience` | Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info. | `vault` |
|
||||||
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
|
||||||
| `controllerManager.service.port` | Service port for controller manager | `443` |
|
| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||||
| `controllerManager.service.annotations` | Annotations for service resource | `{}` |
|
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
||||||
| `controllerManager.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` |
|
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||||
| `controllerManager.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` |
|
| `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||||
| `controllerManager.identities.enabled` | Flag to enable default identities for controller manager | `true` |
|
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `controllerManager.identities.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` |
|
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
||||||
| `controllerManager.identities.podSelector` | Selector for pods to issue identity | `{}` |
|
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `controllerManager.identities.namespaceSelector` | Selector for namespacs to issue identity | `{}` |
|
| `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
| `controllerManager.identities.dnsNameTemplates` | DNS name template for issued identities | `[]` |
|
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.2.3` |
|
||||||
| `controllerManager.identities.federatesWith` | Other Spire server URLs for identity federation | `[]` |
|
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
||||||
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
|
| `controllerManager.securityContext` | Security context | `{}` |
|
||||||
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
||||||
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
|
| `controllerManager.service.port` | Service port for controller manager | `443` |
|
||||||
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `controllerManager.service.annotations` | Annotations for service resource | `{}` |
|
||||||
| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| `controllerManager.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` |
|
||||||
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
| `controllerManager.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` |
|
||||||
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
| `controllerManager.identities.enabled` | Flag to enable default identities for controller manager | `true` |
|
||||||
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
| `controllerManager.identities.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` |
|
||||||
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
|
| `controllerManager.identities.podSelector` | Selector for pods to issue identity | `{}` |
|
||||||
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
| `controllerManager.identities.namespaceSelector` | Selector for namespacs to issue identity | `{}` |
|
||||||
| `ingress.enabled` | Flag to enable ingress | `false` |
|
| `controllerManager.identities.dnsNameTemplates` | DNS name template for issued identities | `[]` |
|
||||||
| `ingress.className` | Ingress class name | `""` |
|
| `controllerManager.identities.federatesWith` | Other Spire server URLs for identity federation | `[]` |
|
||||||
| `ingress.annotations` | Annotations for the ingress object | `{}` |
|
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
|
||||||
| `ingress.hosts` | Host paths for ingress object | `[]` |
|
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||||
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
|
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
|
||||||
| `extraVolumes` | Extra volumes to be mounted | `[]` |
|
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `extraVolumeMounts` | Extra volume mounts | `[]` |
|
| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
| `extraContainers` | Additional containers to create | `[]` |
|
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
| `initContainers` | Additional init containers to create | `[]` |
|
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
||||||
| `caKeyType` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) | `rsa-2048` |
|
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
||||||
| `caTTL` | TTL for CA | `24h` |
|
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
|
||||||
| `defaultX509SvidTTL` | TTL for X509 Svids | `4h` |
|
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||||
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
|
| `ingress.enabled` | Flag to enable ingress | `false` |
|
||||||
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` |
|
| `ingress.className` | Ingress class name | `""` |
|
||||||
| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` |
|
| `ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||||
| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` |
|
| `ingress.hosts` | Host paths for ingress object | `[]` |
|
||||||
| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
|
||||||
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
|
| `extraVolumes` | Extra volumes to be mounted | `[]` |
|
||||||
| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `extraVolumeMounts` | Extra volume mounts | `[]` |
|
||||||
| `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| `extraContainers` | Additional containers to create | `[]` |
|
||||||
| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.2.2` |
|
| `initContainers` | Additional init containers to create | `[]` |
|
||||||
| `tornjak.service.type` | Type of service resource | `ClusterIP` |
|
| `caKeyType` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) | `rsa-2048` |
|
||||||
| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` |
|
| `caTTL` | TTL for CA | `24h` |
|
||||||
| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` |
|
| `defaultX509SvidTTL` | TTL for X509 Svids | `4h` |
|
||||||
| `tornjak.service.annotations` | Annotations for the service | `{}` |
|
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
|
||||||
| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` |
|
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` |
|
||||||
| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` |
|
| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` |
|
||||||
| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` |
|
| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` |
|
||||||
| `tornjak.startupProbe.successThreshold` | Success threshold count | `1` |
|
| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `tornjak.startupProbe.timeoutSeconds` | Timeout in seconds | `5` |
|
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
|
||||||
| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | |
|
| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` |
|
| `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` |
|
| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.2.2` |
|
||||||
| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` |
|
| `tornjak.service.type` | Type of service resource | `ClusterIP` |
|
||||||
| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` |
|
| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` |
|
||||||
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
|
| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` |
|
||||||
| `tornjak.resources` | Resource requests and limits | `{}` |
|
| `tornjak.service.annotations` | Annotations for the service | `{}` |
|
||||||
| `tests.hostAliases` | List of host aliases for testing | `[]` |
|
| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` |
|
||||||
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
|
| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` |
|
||||||
| `tests.tls.customCA` | Custom CA value for tests | `""` |
|
| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` |
|
||||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
| `tornjak.startupProbe.successThreshold` | Success threshold count | `1` |
|
||||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
| `tornjak.startupProbe.timeoutSeconds` | Timeout in seconds | `5` |
|
||||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | |
|
||||||
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` |
|
||||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` |
|
| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` |
|
||||||
|
| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` |
|
||||||
|
| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` |
|
||||||
|
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
|
||||||
|
| `tornjak.resources` | Resource requests and limits | `{}` |
|
||||||
|
| `tests.hostAliases` | List of host aliases for testing | `[]` |
|
||||||
|
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
|
||||||
|
| `tests.tls.customCA` | Custom CA value for tests | `""` |
|
||||||
|
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||||
|
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||||
|
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
|
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` |
|
||||||
|
|||||||
@@ -157,6 +157,38 @@ plugins:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
|
{{- with .Values.upstreamAuthority.vault }}
|
||||||
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
||||||
|
UpstreamAuthority:
|
||||||
|
vault:
|
||||||
|
plugin_data:
|
||||||
|
vault_addr: {{ .vaultAddr | quote }}
|
||||||
|
pki_mount_point: {{ .pkiMountPoint | quote }}
|
||||||
|
insecure_skip_verify: {{ .insecureSkipVerify }}
|
||||||
|
{{- if ne (.insecureSkipVerify | toString) "true" }}
|
||||||
|
ca_cert_path: "/run/spire/vault-upstream/ca.crt"
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne .namespace "" }}
|
||||||
|
namespace: {{ .namespace | quote }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- $vaultAuthMethodUsed := 0 }}
|
||||||
|
{{- with .k8sAuth }}
|
||||||
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
|
{{- $vaultAuthMethodUsed = add1 $vaultAuthMethodUsed }}
|
||||||
|
k8s_auth:
|
||||||
|
k8s_auth_mount_point: {{ .k8sAuthMountPoint | quote }}
|
||||||
|
k8s_auth_role_name: {{ .k8sAuthRoleName | quote }}
|
||||||
|
token_path: "/var/run/secrets/tokens/spire-server"
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if gt $vaultAuthMethodUsed 1 }}
|
||||||
|
{{- fail "You can only enable a single authentication mechanism to an upstream Vault." }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
{{- with .Values.upstreamAuthority.awsPCA }}
|
{{- with .Values.upstreamAuthority.awsPCA }}
|
||||||
{{- if eq (.enabled | toString) "true" }}
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
||||||
|
|||||||
@@ -170,7 +170,19 @@ spec:
|
|||||||
subPath: policy.json
|
subPath: policy.json
|
||||||
readOnly: true
|
readOnly: true
|
||||||
{{ end }}
|
{{ end }}
|
||||||
{{ end }}
|
{{- end }}
|
||||||
|
{{- with .Values.upstreamAuthority.vault }}
|
||||||
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
|
{{- if eq (.k8sAuth.enabled | toString) "true" }}
|
||||||
|
- name: spire-psat
|
||||||
|
mountPath: /var/run/secrets/tokens
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne (.insecureSkipVerify | toString) "true" }}
|
||||||
|
- name: vault-ca
|
||||||
|
mountPath: /run/spire/vault-upstream
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
{{- if gt (len .Values.extraVolumeMounts) 0 }}
|
{{- if gt (len .Values.extraVolumeMounts) 0 }}
|
||||||
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
|
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
@@ -357,6 +369,33 @@ spec:
|
|||||||
path: {{ .Values.persistence.hostPath }}
|
path: {{ .Values.persistence.hostPath }}
|
||||||
type: Directory
|
type: Directory
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- with .Values.upstreamAuthority.vault }}
|
||||||
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
|
{{- if ne (.insecureSkipVerify | toString) "true" }}
|
||||||
|
{{- if eq (.caCert.type | lower) "configmap" }}
|
||||||
|
- name: vault-ca
|
||||||
|
configMap:
|
||||||
|
name: {{ .caCert.name }}
|
||||||
|
{{- else if eq (.caCert.type | lower) "secret" }}
|
||||||
|
- name: vault-ca
|
||||||
|
secret:
|
||||||
|
secretName: {{ .caCert.name }}
|
||||||
|
optional: false
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if eq (.k8sAuth.enabled | toString) "true" }}
|
||||||
|
- name: spire-psat
|
||||||
|
projected:
|
||||||
|
sources:
|
||||||
|
- serviceAccountToken:
|
||||||
|
path: spire-server
|
||||||
|
expirationSeconds: {{ .k8sAuth.token.expiry }}
|
||||||
|
{{- if ne .k8sAuth.token.audience "" }}
|
||||||
|
audience: {{ .k8sAuth.token.audience }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
{{- if eq .Values.persistence.type "pvc" }}
|
{{- if eq .Values.persistence.type "pvc" }}
|
||||||
volumeClaimTemplates:
|
volumeClaimTemplates:
|
||||||
- metadata:
|
- metadata:
|
||||||
|
|||||||
@@ -330,6 +330,35 @@ upstreamAuthority:
|
|||||||
address: ""
|
address: ""
|
||||||
## @param upstreamAuthority.spire.server.port Port for upstream Spire server
|
## @param upstreamAuthority.spire.server.port Port for upstream Spire server
|
||||||
port: 8081
|
port: 8081
|
||||||
|
vault:
|
||||||
|
## @param upstreamAuthority.vault.enabled Enable Hashicorp Vault as upstream CA
|
||||||
|
enabled: false
|
||||||
|
## @param upstreamAuthority.vault.vaultAddr The URL of the Vault server. (e.g., https://vault.example.com:8443/)
|
||||||
|
vaultAddr: ""
|
||||||
|
## @param upstreamAuthority.vault.namespace Name of the Vault namespace. This is only available in the Vault Enterprise.
|
||||||
|
namespace: ""
|
||||||
|
## @param upstreamAuthority.vault.pkiMountPoint Name of the mount point where PKI secret engine is mounted
|
||||||
|
pkiMountPoint: "pki"
|
||||||
|
## @param upstreamAuthority.vault.insecureSkipVerify If true, caCert options are ignored and Spire accepts any server certificates claiming to be Vault
|
||||||
|
insecureSkipVerify: false
|
||||||
|
caCert:
|
||||||
|
## @param upstreamAuthority.vault.caCert.type Type of resource representing the Vault server certificate, options are 'Secret' or 'Configmap', the item must be named `ca.crt`
|
||||||
|
type: Secret
|
||||||
|
## @param upstreamAuthority.vault.caCert.name Name of the Kubernetes resource containing the Vault server certificate
|
||||||
|
name: vault-ca
|
||||||
|
|
||||||
|
k8sAuth:
|
||||||
|
## @param upstreamAuthority.vault.k8sAuth.enabled Enable k8s authentication to Hashicorp Vault
|
||||||
|
enabled: false
|
||||||
|
## @param upstreamAuthority.vault.k8sAuth.k8sAuthMountPoint Name of the mount point where the Kubernetes auth method is mounted
|
||||||
|
k8sAuthMountPoint: "kubernetes"
|
||||||
|
## @param upstreamAuthority.vault.k8sAuth.k8sAuthRoleName Required - Name of the Vault role. The plugin authenticates against the named role
|
||||||
|
k8sAuthRoleName: ""
|
||||||
|
token:
|
||||||
|
## @param upstreamAuthority.vault.k8sAuth.token.audience Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info.
|
||||||
|
audience: "vault"
|
||||||
|
## @param upstreamAuthority.vault.k8sAuth.token.expiry Expiry time in seconds for the token
|
||||||
|
expiry: 7200
|
||||||
|
|
||||||
notifier:
|
notifier:
|
||||||
k8sbundle:
|
k8sbundle:
|
||||||
|
|||||||
Reference in New Issue
Block a user