Add skipKubeletVerification configurable (#243)

charts/spire/charts/spire-agent/README.md

@@ -54,6 +54,7 @@ A Helm chart to install the SPIRE agent.
 | waitForIt.image.repository | string | `"chainguard/wait-for-it"` |  |
 | waitForIt.image.version | string | `"latest-20230113"` |  |
 | waitForIt.resources | object | `{}` |  |
+| workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped |
 | workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor |
 
 ----------------------------------------------

charts/spire/charts/spire-agent/templates/configmap.yaml

@@ -24,7 +24,7 @@ plugins:
           # Defaults to the secure kubelet port by default.
           # Minikube does not have a cert in the cluster CA bundle that
           # can authenticate the kubelet cert, so skip validation.
-          skip_kubelet_verification: true
+          skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }}
 
   {{- if .Values.workloadAttestors.unix.enabled }}
     - unix:

charts/spire/charts/spire-agent/values.yaml

@@ -81,6 +81,9 @@ workloadAttestors:
   unix:
     # -- enables the Unix workload attestor
     enabled: false
+  k8s:
+    # -- If true, kubelet certificate verification is skipped
+    skipKubeletVerification: true
 
 telemetry:
   prometheus: