From 3e8335c0ee7436022e625ca4b7a09c34c13b2615 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Sat, 2 Dec 2023 05:15:32 -0800 Subject: [PATCH] Add a flag to enable recommendations (#121) * Add a flag to enable recommendations Signed-off-by: Kevin Fox * Fix merge issue Signed-off-by: Kevin Fox * Update after reaching consensus. Signed-off-by: Kevin Fox * Apply suggestions from code review Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix docs Signed-off-by: Kevin Fox * Apply suggestions from code review Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix docs Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon --- charts/spire/README.md | 1 + charts/spire/values.yaml | 4 ++++ examples/production/values.yaml | 2 ++ 3 files changed, 7 insertions(+) diff --git a/charts/spire/README.md b/charts/spire/README.md index a63b267..446abf2 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -158,6 +158,7 @@ Now you can interact with the Spire agent socket from your own application. The | `global.spire.jwtIssuer` | The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset | `""` | | `global.spire.trustDomain` | The trust domain for Spire install | `example.org` | | `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` | +| `global.spire.recommendations.enabled` | Use recommended settings for production deployments. Default is off. | `false` | | `global.spire.image.registry` | Override all Spire image registries at once | `""` | | `global.spire.namespaces.system.name` | Name of the Spire system Namespace. | `spire-system` | | `global.spire.namespaces.system.create` | Create a Namespace for Spire system resources. | `false` | diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index c3145e9..788242f 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -21,6 +21,10 @@ global: ## @param global.spire.upstreamServerAddress Set what address to use for the upstream server when using nested spire upstreamServerAddress: "" + ## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off. + recommendations: + enabled: false + image: ## @param global.spire.image.registry Override all Spire image registries at once registry: "" diff --git a/examples/production/values.yaml b/examples/production/values.yaml index dd6fb4e..97797a4 100644 --- a/examples/production/values.yaml +++ b/examples/production/values.yaml @@ -4,6 +4,8 @@ global: enabled: true spire: strictMode: true + recommendations: + enabled: true spire-server: nodeAttestor: