panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Migrate to readme-generator for helm maintained by bitnami (#431)

Browse Source 
Co-authored-by: Krishnakumar Venkataraman <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
This commit is contained in:
Krishna
2023-09-08 09:39:30 +02:00
committed by GitHub
co-authored by Krishnakumar Venkataraman Marco Franssen
parent dcc60a2896
commit 65d56957de
16 changed files with 1111 additions and 809 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+191 -186
View File
@@ -81,191 +81,196 @@ curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhos
In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above.
## Values
## Parameters
| Key | Type | Default | Description |
|-----|------|---------|-------------|
| affinity | object | `{}` | |
| autoscaling.enabled | bool | `false` | |
| autoscaling.maxReplicas | int | `100` | |
| autoscaling.minReplicas | int | `1` | |
| autoscaling.targetCPUUtilizationPercentage | int | `80` | |
| bundleConfigMap | string | `"spire-bundle"` | |
| caKeyType | string | `"rsa-2048"` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) |
| caTTL | string | `"24h"` | |
| ca_subject.common_name | string | `"example.org"` | |
| ca_subject.country | string | `"NL"` | |
| ca_subject.organization | string | `"Example"` | |
| clusterDomain | string | `"cluster.local"` | |
| clusterName | string | `"example-cluster"` | |
| configMap.annotations | object | `{}` | Annotations to add to the SPIRE Server ConfigMap |
| controllerManager.configMap.annotations | object | `{}` | Annotations to add to the Controller Manager ConfigMap |
| controllerManager.deleteHook.enabled | bool | `true` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) |
| controllerManager.enabled | bool | `false` | |
| controllerManager.identities.dnsNameTemplates | list | `[]` | |
| controllerManager.identities.enabled | bool | `true` | |
| controllerManager.identities.federatesWith | list | `[]` | |
| controllerManager.identities.namespaceSelector | object | `{}` | |
| controllerManager.identities.podSelector | object | `{}` | |
| controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | |
| controllerManager.ignoreNamespaces[0] | string | `"kube-system"` | |
| controllerManager.ignoreNamespaces[1] | string | `"kube-public"` | |
| controllerManager.ignoreNamespaces[2] | string | `"local-path-storage"` | |
| controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry |
| controllerManager.image.tag | string | `"0.2.3"` | Overrides the image tag |
| controllerManager.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
| controllerManager.installAndUpgradeHook.enabled | bool | `true` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) |
| controllerManager.resources | object | `{}` | |
| controllerManager.securityContext | object | `{}` | |
| controllerManager.service.annotations | object | `{}` | |
| controllerManager.service.port | int | `443` | |
| controllerManager.service.type | string | `"ClusterIP"` | |
| controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | |
| customPlugins.keyManager | object | `{}` | |
| customPlugins.nodeAttestor | object | `{}` | |
| customPlugins.notifier | object | `{}` | |
| customPlugins.upstreamAuthority | object | `{}` | |
| dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
| dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
| dataStore.sql.externalSecret | object | `{"enabled":false,"key":"","name":""}` | When an external source creates the secret. The secret should reside in the same namespace as the spire server |
| dataStore.sql.externalSecret.key | string | `""` | The key of the secret object whose value is the dataStore.sql password |
| dataStore.sql.externalSecret.name | string | `""` | The name of the secret object |
| dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |
| dataStore.sql.options | list | `[]` | Only used by "postgres" or "mysql" |
| dataStore.sql.password | string | `""` | Only used by "postgres" or "mysql" |
| dataStore.sql.plugin_data | object | `{}` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section |
| dataStore.sql.port | int | `0` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. |
| dataStore.sql.username | string | `"spire"` | Only used by "postgres" or "mysql" |
| defaultJwtSvidTTL | string | `"1h"` | |
| defaultX509SvidTTL | string | `"4h"` | |
| extraContainers | list | `[]` | |
| extraVolumeMounts | list | `[]` | |
| extraVolumes | list | `[]` | |
| federation.bundleEndpoint.address | string | `"0.0.0.0"` | |
| federation.bundleEndpoint.port | int | `8443` | |
| federation.enabled | bool | `false` | |
| federation.ingress.annotations | object | `{}` | |
| federation.ingress.className | string | `""` | |
| federation.ingress.enabled | bool | `false` | |
| federation.ingress.hosts[0].host | string | `"spire-server-federation.example.org"` | |
| federation.ingress.hosts[0].paths[0].path | string | `"/"` | |
| federation.ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | |
| federation.ingress.tls | list | `[]` | |
| fullnameOverride | string | `""` | |
| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
| image.repository | string | `"spiffe/spire-server"` | The repository within the registry |
| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
| image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
| imagePullSecrets | list | `[]` | |
| ingress.annotations | object | `{}` | |
| ingress.className | string | `""` | |
| ingress.enabled | bool | `false` | |
| ingress.hosts[0].host | string | `"spire-server.example.org"` | |
| ingress.hosts[0].paths[0].path | string | `"/"` | |
| ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | |
| ingress.tls | list | `[]` | |
| initContainers | list | `[]` | |
| jwtIssuer | string | `"https://oidc-discovery.example.org"` | The JWT issuer domain |
| keyManager.awsKMS.accessKeyID | Optional | `""` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. |
| keyManager.awsKMS.enabled | bool | `false` | |
| keyManager.awsKMS.keyPolicy | object | `{"existingConfigMap":"","policy":""}` | Policy to use when creating keys. If no policy is specified, a default policy will be used. |
| keyManager.awsKMS.keyPolicy.existingConfigMap | Optional | `""` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. |
| keyManager.awsKMS.keyPolicy.policy | Optional | `""` | Key policy in JSON format. |
| keyManager.awsKMS.region | string | `""` | |
| keyManager.awsKMS.secretAccessKey | Optional | `""` | Secret access key for the AWS account. |
| keyManager.disk.enabled | bool | `true` | |
| keyManager.memory.enabled | bool | `false` | |
| livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe |
| livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe |
| livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe |
| livenessProbe.timeoutSeconds | int | `3` | Timeout in seconds for livenessProbe |
| logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
| nameOverride | string | `""` | |
| namespaceOverride | string | `""` | |
| nodeAttestor.k8sPsat.enabled | bool | `true` | |
| nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` | |
| nodeSelector | object | `{}` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) |
| notifier.k8sbundle.namespace | string | `""` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace |
| persistence.accessMode | string | `"ReadWriteOnce"` | |
| persistence.hostPath | string | `""` | Which path to use on the host when type = hostPath |
| persistence.size | string | `"1Gi"` | |
| persistence.storageClass | string | `nil` | |
| persistence.type | string | `"pvc"` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) |
| podAnnotations | object | `{}` | |
| podSecurityContext | object | `{}` | |
| readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe |
| readinessProbe.periodSeconds | int | `5` | Period seconds for readinessProbe |
| replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. |
| resources | object | `{}` | |
| securityContext | object | `{}` | |
| service.annotations | object | `{}` | |
| service.port | int | `8081` | |
| service.type | string | `"ClusterIP"` | |
| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
| telemetry.prometheus.enabled | bool | `false` | |
| telemetry.prometheus.podMonitor.enabled | bool | `false` | |
| telemetry.prometheus.podMonitor.labels | object | `{}` | |
| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
| tolerations | list | `[]` | |
| tools.kubectl.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
| tools.kubectl.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
| tools.kubectl.image.repository | string | `"rancher/kubectl"` | The repository within the registry |
| tools.kubectl.image.tag | string | `""` | Overrides the image tag |
| tools.kubectl.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
| topologySpreadConstraints | list | `[]` | |
| tornjak.config.clientCA.name | string | `"tornjak-client-ca"` | |
| tornjak.config.clientCA.type | string | `"Secret"` | Type of delivery for the user CA for mTLS client verification options are `Secret` or `ConfigMap` (required for `mtls` connectionType) |
| tornjak.config.dataStore | object | `{"driver":"sqlite3","file":"/run/spire/data/tornjak.sqlite3"}` | Persistent DB for storing Tornjak specific information |
| tornjak.config.tlsSecret | string | `"tornjak-tls-secret"` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) |
| tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) (Not for production) |
| tornjak.image.pullPolicy | string | `"IfNotPresent"` | The Tornjak image pull policy |
| tornjak.image.registry | string | `"ghcr.io"` | The OCI registry to pull the Tornjak image from |
| tornjak.image.repository | string | `"spiffe/tornjak-backend"` | The repository within the registry |
| tornjak.image.tag | string | `"v1.2.2"` | Overrides the image tag |
| tornjak.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
| tornjak.resources | object | `{}` | |
| tornjak.service.annotations | object | `{}` | |
| tornjak.service.ports | object | `{"http":10000,"https":10443}` | Ports for tornjak |
| tornjak.service.type | string | `"ClusterIP"` | |
| tornjak.startupProbe.failureThreshold | int | `3` | |
| tornjak.startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for |
| tornjak.startupProbe.periodSeconds | int | `10` | |
| tornjak.startupProbe.successThreshold | int | `1` | |
| tornjak.startupProbe.timeoutSeconds | int | `5` | |
| trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
| upstreamAuthority.awsPCA.assumeRoleARN | Optional | `""` | ARN of an IAM role to assume |
| upstreamAuthority.awsPCA.caSigningTemplateARN | string | `""` | See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. |
| upstreamAuthority.awsPCA.certificateAuthorityARN | string | `""` | ARN of the "upstream" CA certificate |
| upstreamAuthority.awsPCA.enabled | bool | `false` | |
| upstreamAuthority.awsPCA.endpoint | string | `""` | See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. |
| upstreamAuthority.awsPCA.region | string | `""` | AWS Region to use |
| upstreamAuthority.awsPCA.signingAlgorithm | string | `""` | See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. |
| upstreamAuthority.awsPCA.supplementalBundlePath | Optional | `""` | Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. |
| upstreamAuthority.certManager.ca.create | bool | `false` | Creates a Cert-Manager CA |
| upstreamAuthority.certManager.ca.duration | string | `"87600h"` | Duration of the CA. Defaults to 10 years. |
| upstreamAuthority.certManager.ca.privateKey.algorithm | string | `"ECDSA"` | |
| upstreamAuthority.certManager.ca.privateKey.rotationPolicy | string | `""` | |
| upstreamAuthority.certManager.ca.privateKey.size | int | `256` | |
| upstreamAuthority.certManager.ca.renewBefore | string | `""` | How long to wait before renewing the CA |
| upstreamAuthority.certManager.enabled | bool | `false` | |
| upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` | |
| upstreamAuthority.certManager.issuer_kind | string | `"Issuer"` | |
| upstreamAuthority.certManager.issuer_name | string | `""` | Defaults to the release name, override if CA is provided outside of the chart |
| upstreamAuthority.certManager.kube_config_file | string | `""` | |
| upstreamAuthority.certManager.namespace | string | `""` | Specify to use a namespace other then the one the chart is installed into |
| upstreamAuthority.certManager.rbac.create | bool | `true` | |
| upstreamAuthority.disk.enabled | bool | `false` | |
| upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. |
| upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info |
| upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. |
| upstreamAuthority.spire.enabled | bool | `false` | |
| upstreamAuthority.spire.server.address | string | `""` | |
| upstreamAuthority.spire.server.port | int | `8081` | |
| upstreamAuthority.spire.upstreamDriver | string | `""` | |
### Chart parameters
----------------------------------------------
| Name | Description | Value |
| ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------- |
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `image.repository` | The repository within the registry | `spiffe/spire-server` |
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `imagePullSecrets` | Pull secrets for images | `[]` |
| `nameOverride` | Name override | `""` |
| `namespaceOverride` | Namespace override | `""` |
| `fullnameOverride` | Fullname override | `""` |
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
| `podAnnotations` | Annotations to add to pods | `{}` |
| `podSecurityContext` | Pod security context | `{}` |
| `securityContext` | Security context | `{}` |
| `service.type` | Type of the Spire server service created | `ClusterIP` |
| `service.port` | Port for the created service | `8081` |
| `service.annotations` | Annotations to add to the service object | `{}` |
| `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` |
| `resources` | Resource requests and limits | `{}` |
| `autoscaling.enabled` | Flag to enable autoscaling | `false` |
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` |
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` |
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` |
| `tolerations` | List of tolerations | `[]` |
| `affinity` | List of node affinities | `{}` |
| `topologySpreadConstraints` | Topology spread constraints for resilience | `[]` |
| `livenessProbe.failureThreshold` | Failure threshold count for livenessProbe | `2` |
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `15` |
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `60` |
| `livenessProbe.timeoutSeconds` | Timeout in seconds for livenessProbe | `3` |
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
| `persistence.type` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `pvc` |
| `persistence.size` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `1Gi` |
| `persistence.accessMode` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `ReadWriteOnce` |
| `persistence.storageClass` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `nil` |
| `persistence.hostPath` | Which path to use on the host when type = hostPath | `""` |
| `dataStore.sql.databaseType` | Other supported databases are "postgres" and "mysql" | `sqlite3` |
| `dataStore.sql.databaseName` | Only used by "postgres" or "mysql" | `spire` |
| `dataStore.sql.host` | Only used by "postgres" or "mysql" | `""` |
| `dataStore.sql.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` |
| `dataStore.sql.username` | Only used by "postgres" or "mysql" | `spire` |
| `dataStore.sql.password` | Only used by "postgres" or "mysql" | `""` |
| `dataStore.sql.options` | Only used by "postgres" or "mysql" | `[]` |
| `dataStore.sql.plugin_data` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section | `{}` |
| `dataStore.sql.externalSecret.enabled` | Enable external secret for datastore creds | `false` |
| `dataStore.sql.externalSecret.name` | The name of the secret object | `""` |
| `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
| `jwtIssuer` | The JWT issuer domain | `https://oidc-discovery.example.org` |
| `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` |
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
| `bundleConfigMap` | Set the trust domain to be used for the SPIFFE identifiers | `spire-bundle` |
| `clusterDomain` | This is the value of your clusters `kubeadm init --service-dns-domain` flag | `cluster.local` |
| `federation.enabled` | Flag to enable federation | `false` |
| `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` |
| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` |
| `federation.ingress.enabled` | Flag to enable ingress for federation | `false` |
| `federation.ingress.className` | Ingress class name for federation | `""` |
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
| `federation.ingress.hosts` | Host paths for ingress object | `[]` |
| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
| `ca_subject.country` | Country for Spire server CA | `NL` |
| `ca_subject.organization` | Organization for Spire server CA | `Example` |
| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` |
| `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` |
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
| `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` |
| `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` |
| `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | |
| `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` |
| `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` |
| `keyManager.awsKMS.accessKeyID` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. | `""` |
| `keyManager.awsKMS.secretAccessKey` | Secret access key for the AWS account. | `""` |
| `upstreamAuthority.disk.enabled` | Flag to enable upstream authority plugin on disk | `false` |
| `upstreamAuthority.disk.secret.create` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | `true` |
| `upstreamAuthority.disk.secret.name` | If secret creation is disabled, the secret with this name will be used. | `spiffe-upstream-ca` |
| `upstreamAuthority.disk.secret.data` | If secret creation is enabled, will create a secret with following certificate info | |
| `upstreamAuthority.disk.secret.data.certificate` | Certificate to store within disk upstreamAuthority. | `""` |
| `upstreamAuthority.disk.secret.data.key` | Key corresponding to the upstreamAuthority. | `""` |
| `upstreamAuthority.disk.secret.data.bundle` | Trust bundle for upstreamAuthority. | `""` |
| `upstreamAuthority.awsPCA.enabled` | Flag to enable upstream authority plugin with AWS PCA | `false` |
| `upstreamAuthority.awsPCA.region` | AWS Region to use | `""` |
| `upstreamAuthority.awsPCA.certificateAuthorityARN` | ARN of the "upstream" CA certificate | `""` |
| `upstreamAuthority.awsPCA.assumeRoleARN` | (Optional) ARN of an IAM role to assume | `""` |
| `upstreamAuthority.awsPCA.caSigningTemplateARN` | (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. | `""` |
| `upstreamAuthority.awsPCA.signingAlgorithm` | (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | `""` |
| `upstreamAuthority.awsPCA.endpoint` | (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | `""` |
| `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` |
| `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` |
| `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` |
| `upstreamAuthority.certManager.issuer_name` | Defaults to the release name, override if CA is provided outside of the chart | `""` |
| `upstreamAuthority.certManager.issuer_kind` | Defaults to "Issuer", override if CA is provided outside of the chart | `Issuer` |
| `upstreamAuthority.certManager.issuer_group` | Defaults to "cert-manager.io", override if CA is provided outside of the chart | `cert-manager.io` |
| `upstreamAuthority.certManager.namespace` | Specify to use a namespace other then the one the chart is installed into | `""` |
| `upstreamAuthority.certManager.kube_config_file` | Path to kube_config_file on node to setup cert manager | `""` |
| `upstreamAuthority.certManager.ca.create` | Creates a Cert-Manager CA | `false` |
| `upstreamAuthority.certManager.ca.duration` | Duration of the CA. Defaults to 10 years | `87600h` |
| `upstreamAuthority.certManager.ca.privateKey.algorithm` | Algorithm to generate private key for CA | `ECDSA` |
| `upstreamAuthority.certManager.ca.privateKey.size` | Size of generated private key for CA | `256` |
| `upstreamAuthority.certManager.ca.privateKey.rotationPolicy` | Rotation policy for generated private key | `""` |
| `upstreamAuthority.certManager.ca.renewBefore` | How long to wait before renewing the CA | `""` |
| `upstreamAuthority.spire.enabled` | Flag to use another Spire install as upstream CA | `false` |
| `upstreamAuthority.spire.upstreamDriver` | Driver for Spire as upstream CA | `""` |
| `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | |
| `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` |
| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `8081` |
| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
| `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` |
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.2.3` |
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
| `controllerManager.securityContext` | Security context | `{}` |
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
| `controllerManager.service.port` | Service port for controller manager | `443` |
| `controllerManager.service.annotations` | Annotations for service resource | `{}` |
| `controllerManager.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` |
| `controllerManager.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` |
| `controllerManager.identities.enabled` | Flag to enable default identities for controller manager | `true` |
| `controllerManager.identities.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` |
| `controllerManager.identities.podSelector` | Selector for pods to issue identity | `{}` |
| `controllerManager.identities.namespaceSelector` | Selector for namespacs to issue identity | `{}` |
| `controllerManager.identities.dnsNameTemplates` | DNS name template for issued identities | `[]` |
| `controllerManager.identities.federatesWith` | Other Spire server URLs for identity federation | `[]` |
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
| `ingress.enabled` | Flag to enable ingress | `false` |
| `ingress.className` | Ingress class name | `""` |
| `ingress.annotations` | Annotations for the ingress object | `{}` |
| `ingress.hosts` | Host paths for ingress object | `[]` |
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
| `extraVolumes` | Extra volumes to be mounted | `[]` |
| `extraVolumeMounts` | Extra volume mounts | `[]` |
| `extraContainers` | Additional containers to create | `[]` |
| `initContainers` | Additional init containers to create | `[]` |
| `caKeyType` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) | `rsa-2048` |
| `caTTL` | TTL for CA | `24h` |
| `defaultX509SvidTTL` | TTL for X509 Svids | `4h` |
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` |
| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` |
| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` |
| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.2.2` |
| `tornjak.service.type` | Type of service resource | `ClusterIP` |
| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` |
| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` |
| `tornjak.service.annotations` | Annotations for the service | `{}` |
| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` |
| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` |
| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` |
| `tornjak.startupProbe.successThreshold` | Success threshold count | `1` |
| `tornjak.startupProbe.timeoutSeconds` | Timeout in seconds | `5` |
| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | |
| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` |
| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` |
| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` |
| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` |
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
| `tornjak.resources` | Resource requests and limits | `{}` |
| `tests.hostAliases` | List of host aliases for testing | `[]` |
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
| `tests.tls.customCA` | Custom CA value for tests | `""` |
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` |
charts/spire/charts/spire-server/README.md.gotmpl
-81
View File
@@ -1,81 +0,0 @@
{{ template "chart.header" . }}
<!-- This README.md is generated. Please edit README.md.gotmpl -->
{{ template "chart.deprecationWarning" . }}
{{ template "chart.badgesSection" . }}
{{ template "chart.description" . }}
{{ template "chart.homepageLine" . }}
> **Note**: Minimum Spire version is `1.5.3`.
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
>
> The recommended spire-controller-manager version is `0.2.2` to support arm64 nodes. If running with any
> prior version to `0.2.2` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
{{ template "chart.maintainersSection" . }}
{{ template "chart.sourcesSection" . }}
{{ template "chart.requirementsSection" . }}
## Tornjak
Tornjak is the UI and Control Plane for SPIRE [https://github.com/spiffe/tornjak](https://github.com/spiffe/tornjak) and it is composed of two components:
* Backend (this chart) - Tornjak APIs that extend SPIRE APIs with Control Plane functionality
* [Frontend](../tornjak-frontend/README.md) - Tornjak UI
When Tornjak is enabled, it is exposed on both http and https (if TLS server certs are configured). Tornjak handles a permanent redirect from `http` to `https` to ensure users always use the https endpoint.
In addition, you can configure a `client certificate authority`, this will make Tornjak backend verify Client certificates signed by this authority to enable mTLS authentication.
**Warning**: For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access.
### Tornjak with TLS Connection Type
TLS connection requires Tornjak to have access to TLS key and certificate.
Complete instruction on creating your own TLS certificate can be found [here](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md).
TLS Certificate and the private key must be provided to Tornjak via *TLS Secret*. Prior to deploying this Helm chart, create TLS Secret in the deployment namespace (e.g. `spire-server`)
```console
kubectl -n spire-server create secret tls tornjak-tls-secret --cert=client.crt --key=client.key
```
Once the charts are deployed, you can test the TLS connection with the following command (assuming localhost):
```console
curl --cacert CA/rootCA.crt https://localhost:10443
```
### Tornjak with mTLS Connection Type
mTLS connection allows Tornjak server validation by client and Tornjak client validation by Tornjak server. The server validation is identical to above TLS. Follow the steps to create
TLS secret with key and the certificate.
Additionally, you must provide the user CA to Tornjak server via `Secret` or `ConfigMap`.
Follow the steps to [create user CA for mTLS](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md), then create a *Secret* (or *ConfigMap*) prior to deploying this Helm chart.
Here is an example using a *Secret* in `spire-server` namespace:
```console
kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt"
```
Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost):
```console
curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhost:10443
```
### Tornjak with HTTP Connection Type
In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above.
{{ template "chart.valuesSection" . }}
----------------------------------------------
charts/spire/charts/spire-server/values.yaml
+215 -100
View File
@@ -1,44 +1,56 @@
# Default values for spire-server.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
# Default configuration for Spire server
# SPDX-License-Identifier: APACHE-2.0
# @ignored
## @skip global
global: {}
# -- SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database.
## @section Chart parameters
##
## @param replicaCount SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database.
replicaCount: 1
## @param image.registry The OCI registry to pull the image from
## @param image.repository The repository within the registry
## @param image.pullPolicy The image pull policy
## @param image.version This value is deprecated in favor of tag. (Will be removed in a future release)
## @param image.tag Overrides the image tag whose default is the chart appVersion
##
image:
# -- The OCI registry to pull the image from
registry: ghcr.io
# -- The repository within the registry
repository: spiffe/spire-server
# -- The image pull policy
pullPolicy: IfNotPresent
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
version: ""
# -- Overrides the image tag whose default is the chart appVersion.
tag: ""
## @param imagePullSecrets [array] Pull secrets for images
imagePullSecrets: []
## @param nameOverride Name override
nameOverride: ""
## @param namespaceOverride Namespace override
namespaceOverride: ""
## @param fullnameOverride Fullname override
fullnameOverride: ""
## @param serviceAccount.create Specifies whether a service account should be created
## @param serviceAccount.annotations [object] Annotations to add to the service account
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
##
serviceAccount:
# -- Specifies whether a service account should be created
create: true
# -- Annotations to add to the service account
annotations: {}
# -- The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
## @param podAnnotations [object] Annotations to add to pods
podAnnotations: {}
## @param podSecurityContext [object] Pod security context
podSecurityContext: {}
# fsGroup: 2000
## @param securityContext [object] Security context
securityContext: {}
# capabilities:
# drop:
@@ -47,15 +59,20 @@ securityContext: {}
# runAsNonRoot: true
# runAsUser: 1000
## @param service.type Type of the Spire server service created
## @param service.port Port for the created service
## @param service.annotations [object] Annotations to add to the service object
##
service:
type: ClusterIP
port: 8081
annotations: {}
configMap:
# -- Annotations to add to the SPIRE Server ConfigMap
## @param configMap.annotations [object] Annotations to add to the SPIRE Server ConfigMap
annotations: {}
## @param resources [object] Resource requests and limits
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
@@ -68,6 +85,11 @@ resources: {}
# cpu: 200m
# memory: 256Mi
## @param autoscaling.enabled Flag to enable autoscaling
## @param autoscaling.minReplicas Minimum replicas for autoscaling
## @param autoscaling.maxReplicas Maximum replicas for autoscaling
## @param autoscaling.targetCPUUtilizationPercentage Target CPU utlization that triggers autoscaling
##
autoscaling:
enabled: false
minReplicas: 1
@@ -75,103 +97,123 @@ autoscaling:
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
# -- Select specific nodes to run on (currently only amd64 is supported by Tornjak)
## @param nodeSelector [object] Select specific nodes to run on (currently only amd64 is supported by Tornjak)
nodeSelector: {}
## @param tolerations [array] List of tolerations
tolerations: []
## @param affinity [object] List of node affinities
affinity: {}
## @param topologySpreadConstraints [array] Topology spread constraints for resilience
topologySpreadConstraints: []
## @param livenessProbe.failureThreshold Failure threshold count for livenessProbe
## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
## @param livenessProbe.periodSeconds Period seconds for livenessProbe
## @param livenessProbe.timeoutSeconds Timeout in seconds for livenessProbe
##
livenessProbe:
# -- Failure threshold count for livenessProbe
failureThreshold: 2
# -- Initial delay seconds for livenessProbe
initialDelaySeconds: 15
# -- Period seconds for livenessProbe
periodSeconds: 60
# -- Timeout in seconds for livenessProbe
timeoutSeconds: 3
## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
## @param readinessProbe.periodSeconds Period seconds for readinessProbe
##
readinessProbe:
# -- Initial delay seconds for readinessProbe
initialDelaySeconds: 5
# -- Period seconds for readinessProbe
periodSeconds: 5
## @param persistence.type What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only)
## @param persistence.size What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only)
## @param persistence.accessMode What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only)
## @param persistence.storageClass What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only)
## @param persistence.hostPath Which path to use on the host when type = hostPath
##
persistence:
# -- What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only)
type: pvc
size: 1Gi
accessMode: ReadWriteOnce
storageClass: null
# -- Which path to use on the host when type = hostPath
hostPath: ""
dataStore:
sql:
# -- Other supported databases are "postgres" and "mysql"
## @param dataStore.sql.databaseType Other supported databases are "postgres" and "mysql"
databaseType: sqlite3
# -- Only used by "postgres" or "mysql"
## @param dataStore.sql.databaseName Only used by "postgres" or "mysql"
databaseName: spire
# -- Only used by "postgres" or "mysql"
## @param dataStore.sql.host Only used by "postgres" or "mysql"
host: ""
# -- If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases.
## @param dataStore.sql.port If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases.
port: 0
# -- Only used by "postgres" or "mysql"
## @param dataStore.sql.username Only used by "postgres" or "mysql"
username: spire
# -- Only used by "postgres" or "mysql"
## @param dataStore.sql.password Only used by "postgres" or "mysql"
password: ""
# -- Only used by "postgres" or "mysql"
## @param dataStore.sql.options [array] Only used by "postgres" or "mysql"
options: []
# -- Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section
## @param dataStore.sql.plugin_data [object] Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section
plugin_data: {}
# -- When an external source creates the secret. The secret should reside in the same namespace as the spire server
## When an external source creates the secret. The secret should reside in the same namespace as the spire server
externalSecret:
## @param dataStore.sql.externalSecret.enabled Enable external secret for datastore creds
enabled: false
# -- The name of the secret object
## @param dataStore.sql.externalSecret.name The name of the secret object
name: ""
# -- The key of the secret object whose value is the dataStore.sql password
## @param dataStore.sql.externalSecret.key The key of the secret object whose value is the dataStore.sql password
key: ""
# -- The log level, valid values are "debug", "info", "warn", and "error"
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
logLevel: info
# -- The JWT issuer domain
## @param jwtIssuer The JWT issuer domain
jwtIssuer: https://oidc-discovery.example.org
# -- Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`)
## @param clusterName Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`)
clusterName: example-cluster
# -- Set the trust domain to be used for the SPIFFE identifiers
## @param trustDomain Set the trust domain to be used for the SPIFFE identifiers
trustDomain: example.org
## @param bundleConfigMap Set the trust domain to be used for the SPIFFE identifiers
bundleConfigMap: spire-bundle
# -- This is the value of your clusters `kubeadm init --service-dns-domain` flag
## @param clusterDomain This is the value of your clusters `kubeadm init --service-dns-domain` flag
clusterDomain: cluster.local
federation:
## @param federation.enabled Flag to enable federation
enabled: false
bundleEndpoint:
## @param federation.bundleEndpoint.port Port value for trust bundle federation
port: 8443
## @param federation.bundleEndpoint.address Address for trust bundle federation
address: "0.0.0.0"
ingress:
## @param federation.ingress.enabled Flag to enable ingress for federation
enabled: false
## @param federation.ingress.className Ingress class name for federation
className: ""
## @param federation.ingress.annotations [object] Annotations for the ingress object
annotations: {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
# If Profile Type == https_spiffe:
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
## @param federation.ingress.hosts [array] Host paths for ingress object
hosts:
- host: spire-server-federation.example.org
paths:
- path: /
pathType: Prefix
## @param federation.ingress.tls [array] Secrets containining TLS certs to enable https on ingress
tls: []
# - hosts:
# - spire-server-federation.example.org
@@ -179,117 +221,142 @@ federation:
# secretName: spire-server-federation-tls
ca_subject:
## @param ca_subject.country Country for Spire server CA
country: NL
## @param ca_subject.organization Organization for Spire server CA
organization: Example
## @param ca_subject.common_name Common Name for Spire server CA
common_name: example.org
keyManager:
disk:
## @param keyManager.disk.enabled Flag to enable keyManager on disk
enabled: true
memory:
## @param keyManager.memory.enabled Flag to enable keyManager in memory
enabled: false
awsKMS:
## @param keyManager.awsKMS.enabled Flag to enable keyManager in memory
enabled: false
## @param keyManager.awsKMS.region Specify the region for AWS KMS
region: ""
# -- Policy to use when creating keys. If no policy is specified, a default policy will be used.
## @extra keyManager.awsKMS.keyPolicy Policy to use when creating keys. If no policy is specified, a default policy will be used.
keyPolicy:
# -- (Optional) Key policy in JSON format.
## @param keyManager.awsKMS.keyPolicy.policy [nullable] Key policy in JSON format.
policy: ""
# -- (Optional) Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format.
## @param keyManager.awsKMS.keyPolicy.existingConfigMap [nullable] Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format.
existingConfigMap: ""
# -- (Optional) Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role.
## @param keyManager.awsKMS.accessKeyID [nullable] Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role.
accessKeyID: ""
# -- (Optional) Secret access key for the AWS account.
## @param keyManager.awsKMS.secretAccessKey [nullable] Secret access key for the AWS account.
secretAccessKey: ""
upstreamAuthority:
disk:
## @param upstreamAuthority.disk.enabled Flag to enable upstream authority plugin on disk
enabled: false
secret:
# -- If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself.
## @param upstreamAuthority.disk.secret.create If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself.
create: true
# -- If secret creation is disabled, the secret with this name will be used.
## @param upstreamAuthority.disk.secret.name If secret creation is disabled, the secret with this name will be used.
name: "spiffe-upstream-ca"
# -- If secret creation is enabled, will create a secret with following certificate info
## @extra upstreamAuthority.disk.secret.data If secret creation is enabled, will create a secret with following certificate info
data:
## @param upstreamAuthority.disk.secret.data.certificate Certificate to store within disk upstreamAuthority.
certificate: ""
## @param upstreamAuthority.disk.secret.data.key Key corresponding to the upstreamAuthority.
key: ""
## @param upstreamAuthority.disk.secret.data.bundle Trust bundle for upstreamAuthority.
bundle: ""
awsPCA:
## @param upstreamAuthority.awsPCA.enabled Flag to enable upstream authority plugin with AWS PCA
enabled: false
# -- AWS Region to use
## @param upstreamAuthority.awsPCA.region AWS Region to use
region: ""
# -- ARN of the "upstream" CA certificate
## @param upstreamAuthority.awsPCA.certificateAuthorityARN ARN of the "upstream" CA certificate
certificateAuthorityARN: ""
# -- (Optional) ARN of an IAM role to assume
## @param upstreamAuthority.awsPCA.assumeRoleARN (Optional) ARN of an IAM role to assume
assumeRoleARN: ""
# -- (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only.
# -- See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values.
## @param upstreamAuthority.awsPCA.caSigningTemplateARN (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values.
caSigningTemplateARN: ""
# -- (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default.
# -- See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values.
## @param upstreamAuthority.awsPCA.signingAlgorithm (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values.
signingAlgorithm: ""
# -- (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint.
# -- See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information.
## @param upstreamAuthority.awsPCA.endpoint (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information.
endpoint: ""
# -- (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle.
## @param upstreamAuthority.awsPCA.supplementalBundlePath (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle.
supplementalBundlePath: ""
certManager:
## @param upstreamAuthority.certManager.enabled Flag to enable upstream authority plugin with cert manager
enabled: false
## @param upstreamAuthority.certManager.rbac.create Flag to create RBAC roles
rbac:
create: true
# -- Defaults to the release name, override if CA is provided outside of the chart
## @param upstreamAuthority.certManager.issuer_name Defaults to the release name, override if CA is provided outside of the chart
issuer_name: ""
## @param upstreamAuthority.certManager.issuer_kind Defaults to "Issuer", override if CA is provided outside of the chart
issuer_kind: "Issuer"
## @param upstreamAuthority.certManager.issuer_group Defaults to "cert-manager.io", override if CA is provided outside of the chart
issuer_group: "cert-manager.io"
# -- Specify to use a namespace other then the one the chart is installed into
## @param upstreamAuthority.certManager.namespace Specify to use a namespace other then the one the chart is installed into
namespace: ""
## @param upstreamAuthority.certManager.kube_config_file Path to kube_config_file on node to setup cert manager
kube_config_file: ""
ca:
# -- Creates a Cert-Manager CA
## @param upstreamAuthority.certManager.ca.create Creates a Cert-Manager CA
create: false
# -- Duration of the CA. Defaults to 10 years.
## @param upstreamAuthority.certManager.ca.duration Duration of the CA. Defaults to 10 years
duration: 87600h
privateKey:
## @param upstreamAuthority.certManager.ca.privateKey.algorithm Algorithm to generate private key for CA
algorithm: ECDSA
## @param upstreamAuthority.certManager.ca.privateKey.size Size of generated private key for CA
size: 256
## @param upstreamAuthority.certManager.ca.privateKey.rotationPolicy Rotation policy for generated private key
rotationPolicy: ""
# -- How long to wait before renewing the CA
## @param upstreamAuthority.certManager.ca.renewBefore How long to wait before renewing the CA
renewBefore: ""
spire:
## @param upstreamAuthority.spire.enabled Flag to use another Spire install as upstream CA
enabled: false
## @param upstreamAuthority.spire.upstreamDriver Driver for Spire as upstream CA
upstreamDriver: ""
## @extra upstreamAuthority.spire.server Server details for the Spire instance use as upstream CA
server:
## @param upstreamAuthority.spire.server.address Address for upstream Spire server
address: ""
## @param upstreamAuthority.spire.server.port Port for upstream Spire server
port: 8081
notifier:
k8sbundle:
# -- Namespace to push the bundle into, if blank will default to SPIRE Server namespace
## @param notifier.k8sbundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace
namespace: ""
controllerManager:
## @param controllerManager.enabled Flag to enable controller manager
enabled: false
installAndUpgradeHook:
# -- Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`)
## @param controllerManager.installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`)
enabled: true
deleteHook:
# -- Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`)
## @param controllerManager.deleteHook.enabled Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`)
enabled: true
## @param controllerManager.image.registry The OCI registry to pull the image from
## @param controllerManager.image.repository The repository within the registry
## @param controllerManager.image.pullPolicy The image pull policy
## @param controllerManager.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
## @param controllerManager.image.tag Overrides the image tag whose default is the chart appVersion
##
image:
# -- The OCI registry to pull the image from
registry: ghcr.io
# -- The repository within the registry
repository: spiffe/spire-controller-manager
# -- The image pull policy
pullPolicy: IfNotPresent
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
version: ""
# -- Overrides the image tag
tag: "0.2.3"
## @param controllerManager.resources [object] Resource requests and limits for controller manager
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
@@ -302,6 +369,7 @@ controllerManager:
# cpu: 100m
# memory: 128Mi
## @param controllerManager.securityContext [object] Security context
securityContext: {}
# capabilities:
# drop:
@@ -310,124 +378,166 @@ controllerManager:
# runAsNonRoot: true
# runAsUser: 1000
## @param controllerManager.service.type Service type for controller manager
## @param controllerManager.service.port Service port for controller manager
## @param controllerManager.service.annotations Annotations for service resource
##
service:
type: ClusterIP
port: 443
annotations: {}
configMap:
# -- Annotations to add to the Controller Manager ConfigMap
## @param controllerManager.configMap.annotations [object] Annotations to add to the Controller Manager ConfigMap
annotations: {}
## @param controllerManager.ignoreNamespaces [array] These namespaces are ignored by controller manager
ignoreNamespaces:
- kube-system
- kube-public
- local-path-storage
identities:
## @param controllerManager.identities.enabled Flag to enable default identities for controller manager
enabled: true
## @param controllerManager.identities.spiffeIDTemplate Spiffe ID template for identities
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
## @param controllerManager.identities.podSelector [object] Selector for pods to issue identity
podSelector: {}
# matchLabels:
# spiffe.io/spiffe-id: "true"
## @param controllerManager.identities.namespaceSelector [object] Selector for namespacs to issue identity
namespaceSelector: {}
# matchLabels:
# spiffe.io/spiffe-id: "true"
## @param controllerManager.identities.dnsNameTemplates [array] DNS name template for issued identities
dnsNameTemplates: []
# - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local'
## @param controllerManager.identities.federatesWith [array] Other Spire server URLs for identity federation
federatesWith: []
# - example.io
# - example.ai
validatingWebhookConfiguration:
## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued
failurePolicy: Fail
tools:
kubectl:
## @param tools.kubectl.image.registry The OCI registry to pull the image from
## @param tools.kubectl.image.repository The repository within the registry
## @param tools.kubectl.image.pullPolicy The image pull policy
## @param tools.kubectl.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
## @param tools.kubectl.image.tag Overrides the image tag whose default is the chart appVersion
##
image:
# -- The OCI registry to pull the image from
registry: docker.io
# -- The repository within the registry
repository: rancher/kubectl
# -- The image pull policy
pullPolicy: IfNotPresent
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
version: ""
# -- Overrides the image tag
tag: ""
telemetry:
prometheus:
## @param telemetry.prometheus.enabled Flag to enable prometheus monitoring
enabled: false
podMonitor:
## @param telemetry.prometheus.podMonitor.enabled Enable podMonitor for prometheus
enabled: false
# -- Override where to install the podMonitor, if not set will use the same namespace as the spire-server
## @param telemetry.prometheus.podMonitor.namespace Override where to install the podMonitor, if not set will use the same namespace as the spire-agent
namespace: ""
## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring
labels: {}
ingress:
## @param ingress.enabled Flag to enable ingress
enabled: false
## @param ingress.className Ingress class name
className: ""
## @param ingress.annotations [object] Annotations for the ingress object
annotations: {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
## @param ingress.hosts [array] Host paths for ingress object
hosts:
- host: spire-server.example.org
paths:
- path: /
pathType: Prefix
## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress
tls: []
# - secretName: spire-server-tls
# hosts:
# - spire-server.example.org
## @param extraVolumes [array] Extra volumes to be mounted
extraVolumes: []
## @param extraVolumeMounts [array] Extra volume mounts
extraVolumeMounts: []
## @param extraContainers [array] Additional containers to create
extraContainers: []
## @param initContainers [array] Additional init containers to create
initContainers: []
# -- The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported)
## @param caKeyType The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported)
caKeyType: rsa-2048
## @param caTTL TTL for CA
caTTL: 24h
## @param defaultX509SvidTTL TTL for X509 Svids
defaultX509SvidTTL: 4h
## @param defaultJwtSvidTTL TTL for JWT Svids
defaultJwtSvidTTL: 1h
nodeAttestor:
k8sPsat:
## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s nodeattestor
enabled: true
## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor
serviceAccountAllowList: []
# tornjak - Tornjak default values
tornjak:
# -- Deploys Tornjak API (backend) (Not for production)
## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production)
enabled: false
## @param tornjak.image.registry The OCI registry to pull the image from
## @param tornjak.image.repository The repository within the registry
## @param tornjak.image.pullPolicy The image pull policy
## @param tornjak.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
## @param tornjak.image.tag Overrides the image tag whose default is the chart appVersion
##
image:
# -- The OCI registry to pull the Tornjak image from
registry: ghcr.io
# -- The repository within the registry
repository: spiffe/tornjak-backend
# -- The Tornjak image pull policy
pullPolicy: IfNotPresent
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
version: ""
# -- Overrides the image tag
tag: "v1.2.2"
service:
## @param tornjak.service.type Type of service resource
type: ClusterIP
# -- Ports for tornjak
ports:
## @param tornjak.service.ports.http Insecure port for tornjak service
http: 10000
## @param tornjak.service.ports.https Secure port for tornjak service
https: 10443
## @param tornjak.service.annotations [object] Annotations for the service
annotations: {}
## @param tornjak.startupProbe.failureThreshold Failure threshold count
## @param tornjak.startupProbe.initialDelaySeconds Initial delay seconds
## @param tornjak.startupProbe.periodSeconds Period seconds
## @param tornjak.startupProbe.successThreshold Success threshold count
## @param tornjak.startupProbe.timeoutSeconds Timeout in seconds
##
startupProbe:
failureThreshold: 3
# -- Initial delay seconds for
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
@@ -435,9 +545,11 @@ tornjak:
# tornjak - Tornjak default values
config:
# -- Persistent DB for storing Tornjak specific information
## @extra tornjak.config.dataStore [object] Persistent DB for storing Tornjak specific information
dataStore:
## @param tornjak.config.dataStore.driver Database driver name
driver: "sqlite3"
## @param tornjak.config.dataStore.file File path for sqlite3 file
file: "/run/spire/data/tornjak.sqlite3"
# Tornjak supports 3 connection types: `http`, `tls`, and `mtls`.
@@ -446,16 +558,15 @@ tornjak:
# When `tlsSecret` and `clientCA.tornjak-client-ca` are created in this chart namespace, the mTLS connection is started
# When none of them are created, Tornjak starts with HTTP connection only
# -- Name of the secret containing server side key and certificate for TLS verification
# (required for `tls` or `mtls` connectionType)
## @param tornjak.config.tlsSecret Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType)
tlsSecret: tornjak-tls-secret
clientCA:
# -- Type of delivery for the user CA for mTLS client verification
# options are `Secret` or `ConfigMap`
# (required for `mtls` connectionType)
## @param tornjak.config.clientCA.type Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType)
type: Secret
## @param tornjak.config.clientCA.name Name of the resource secret or configMap with user CA for TLS
name: tornjak-client-ca
## @param tornjak.resources [object] Resource requests and limits
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
@@ -471,34 +582,38 @@ tornjak:
# NOTE: This is unsupported and only to configure currently supported spire built in plugins but plugins unsupported by the chart.
# Upgrades wont be tested for anything under this config. If you need this, please let the chart developers know your needs so we
# can prioritize proper support.
# @ignored
## @skip unsupportedBuiltInPlugins
unsupportedBuiltInPlugins:
keyManager: {}
nodeAttestor: {}
upstreamAuthority: {}
notifier: {}
## @skip customPlugins
customPlugins:
keyManager: {}
nodeAttestor: {}
upstreamAuthority: {}
notifier: {}
# @ignored
tests:
## @param tests.hostAliases [array] List of host aliases for testing
hostAliases: []
tls:
## @param tests.tls.enabled Flag for enabling tls for tests
enabled: false
## @param tests.tls.customCA Custom CA value for tests
customCA: ""
bash:
## @param tests.bash.image.registry The OCI registry to pull the image from
## @param tests.bash.image.repository The repository within the registry
## @param tests.bash.image.pullPolicy The image pull policy
## @param tests.bash.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
## @param tests.bash.image.tag Overrides the image tag whose default is the chart appVersion
##
image:
# -- The OCI registry to pull the image from
registry: cgr.dev
# -- The repository within the registry
repository: chainguard/bash
# -- The image pull policy
pullPolicy: IfNotPresent
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
version: ""
# -- Overrides the image tag
tag: latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4