Align more settings to convention (#467)
* Align more settings to convention Signed-off-by: Kevin Fox <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
@@ -72,7 +72,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4` |
|
||||
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
|
||||
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` |
|
||||
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` |
|
||||
| `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` |
|
||||
| `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` |
|
||||
| `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` |
|
||||
@@ -84,7 +84,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.8.7` |
|
||||
| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `1d7c73ccac948ee86cbd78ddde2d30128a1838b403f7bb2100d38d916a252244` |
|
||||
| `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.enabled` | Enable Psat k8s nodeattestor | `true` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.enabled` | Display pubhash in logs | `true` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-get-tpm-pubhash` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
@@ -98,10 +98,10 @@ A Helm chart to install the SPIRE agent.
|
||||
| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false | `false` |
|
||||
| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` |
|
||||
| `sds.enabled` | Enables Envoy SDS configuration | `false` |
|
||||
| `sds.defaultSvidName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` |
|
||||
| `sds.defaultSVIDName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` |
|
||||
| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` |
|
||||
| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` |
|
||||
| `sds.disableSpiffeCertValidation` | Disable Envoy SDS custom validation | `false` |
|
||||
| `sds.disableSPIFFECertValidation` | Disable Envoy SDS custom validation | `false` |
|
||||
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
||||
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
|
||||
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
||||
|
||||
@@ -50,10 +50,10 @@ agent:
|
||||
{{- end }}
|
||||
{{- if .Values.sds.enabled }}
|
||||
sds:
|
||||
default_svid_name: {{ .Values.sds.defaultSvidName | quote }}
|
||||
default_svid_name: {{ .Values.sds.defaultSVIDName | quote }}
|
||||
default_bundle_name: {{ .Values.sds.defaultBundleName | quote }}
|
||||
default_all_bundles_name: {{ .Values.sds.defaultAllBundlesName | quote }}
|
||||
disable_spiffe_cert_validation: {{ eq .Values.sds.disableSpiffeCertValidation true }}
|
||||
disable_spiffe_cert_validation: {{ eq .Values.sds.disableSPIFFECertValidation true }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.experimental }}
|
||||
@@ -73,7 +73,7 @@ agent:
|
||||
{{- $keyManagerUsed := add (len .Values.customPlugins.keyManager) (len .Values.unsupportedBuiltInPlugins.keyManager) }}
|
||||
plugins:
|
||||
NodeAttestor:
|
||||
{{- if .Values.nodeAttestor.k8sPsat.enabled }}
|
||||
{{- if .Values.nodeAttestor.k8sPSAT.enabled }}
|
||||
k8s_psat:
|
||||
plugin_data:
|
||||
cluster: {{ include "spire-lib.cluster-name" . | quote }}
|
||||
|
||||
@@ -1,5 +1,14 @@
|
||||
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
|
||||
{{- $root := . }}
|
||||
{{- if hasKey .Values.nodeAttestor "k8sPsat" }}
|
||||
{{- fail "k8sPsat was renamed to k8sPSAT. Please update your config." }}
|
||||
{{- end }}
|
||||
{{- if hasKey .Values.sds "defaultSvidName" }}
|
||||
{{- fail "defaultSvidName was renamed to defaultSVIDName. Please update your config." }}
|
||||
{{- end }}
|
||||
{{- if hasKey .Values.sds "disableSpiffeCertValidation" }}
|
||||
{{- fail "disableSpiffeCertValidation was renamed to disableSPIFFECertValidation. Please update your config." }}
|
||||
{{- end }}
|
||||
{{- range $name := (concat (list "default") (keys .Values.agents)) | uniq }}
|
||||
{{- with (dict "Release" $root.Release "Chart" $root.Chart "Values" (deepCopy $root.Values)) }}
|
||||
{{- $nameSuffix := "" }}
|
||||
|
||||
@@ -162,8 +162,8 @@ keyManager:
|
||||
enabled: true
|
||||
|
||||
nodeAttestor:
|
||||
k8sPsat:
|
||||
## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s Node Attestor
|
||||
k8sPSAT:
|
||||
## @param nodeAttestor.k8sPSAT.enabled Enable PSAT k8s Node Attestor
|
||||
enabled: true
|
||||
httpChallenge:
|
||||
## @param nodeAttestor.httpChallenge.enabled Enable the http challenge Node Attestor
|
||||
@@ -193,7 +193,7 @@ nodeAttestor:
|
||||
## @param nodeAttestor.tpmDirect.plugin.path The filename in the container of the plugin
|
||||
path: /app/tpm_attestor_agent
|
||||
pubHash:
|
||||
## @param nodeAttestor.tpmDirect.pubHash.enabled Enable Psat k8s nodeattestor
|
||||
## @param nodeAttestor.tpmDirect.pubHash.enabled Display pubhash in logs
|
||||
enabled: true
|
||||
## @param nodeAttestor.tpmDirect.pubHash.image.registry The OCI registry to pull the image from
|
||||
## @param nodeAttestor.tpmDirect.pubHash.image.repository The repository within the registry
|
||||
@@ -233,14 +233,14 @@ workloadAttestors:
|
||||
sds:
|
||||
## @param sds.enabled Enables Envoy SDS configuration
|
||||
enabled: false
|
||||
## @param sds.defaultSvidName The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS
|
||||
defaultSvidName: "default"
|
||||
## @param sds.defaultSVIDName The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS
|
||||
defaultSVIDName: "default"
|
||||
## @param sds.defaultBundleName The Validation Context resource name to use for the default X.509 bundle with Envoy SDS
|
||||
defaultBundleName: "ROOTCA"
|
||||
## @param sds.defaultAllBundlesName The Validation Context resource name to use for all bundles (including federated) with Envoy SDS
|
||||
defaultAllBundlesName: "ALL"
|
||||
## @param sds.disableSpiffeCertValidation Disable Envoy SDS custom validation
|
||||
disableSpiffeCertValidation: false
|
||||
## @param sds.disableSPIFFECertValidation Disable Envoy SDS custom validation
|
||||
disableSPIFFECertValidation: false
|
||||
|
||||
telemetry:
|
||||
prometheus:
|
||||
@@ -355,7 +355,7 @@ agents: {}
|
||||
# nodeSelector:
|
||||
# tpm: with
|
||||
# nodeAttestor:
|
||||
# k8sPsat:
|
||||
# k8sPSAT:
|
||||
# enabled: false
|
||||
# tpmDirect:
|
||||
# enabled: true
|
||||
|
||||
Reference in New Issue
Block a user