Migrate to readme-generator for helm maintained by bitnami (#431)
Co-authored-by: Krishnakumar Venkataraman <[email protected]> Co-authored-by: Marco Franssen <[email protected]>
This commit is contained in:
Krishna
co-authored by
Krishnakumar Venkataraman
Marco Franssen
Krishnakumar Venkataraman
Marco Franssen
parent
dcc60a2896
commit
65d56957de
@@ -81,191 +81,196 @@ curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhos
|
||||
|
||||
In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above.
|
||||
|
||||
## Values
|
||||
## Parameters
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| affinity | object | `{}` | |
|
||||
| autoscaling.enabled | bool | `false` | |
|
||||
| autoscaling.maxReplicas | int | `100` | |
|
||||
| autoscaling.minReplicas | int | `1` | |
|
||||
| autoscaling.targetCPUUtilizationPercentage | int | `80` | |
|
||||
| bundleConfigMap | string | `"spire-bundle"` | |
|
||||
| caKeyType | string | `"rsa-2048"` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) |
|
||||
| caTTL | string | `"24h"` | |
|
||||
| ca_subject.common_name | string | `"example.org"` | |
|
||||
| ca_subject.country | string | `"NL"` | |
|
||||
| ca_subject.organization | string | `"Example"` | |
|
||||
| clusterDomain | string | `"cluster.local"` | |
|
||||
| clusterName | string | `"example-cluster"` | |
|
||||
| configMap.annotations | object | `{}` | Annotations to add to the SPIRE Server ConfigMap |
|
||||
| controllerManager.configMap.annotations | object | `{}` | Annotations to add to the Controller Manager ConfigMap |
|
||||
| controllerManager.deleteHook.enabled | bool | `true` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) |
|
||||
| controllerManager.enabled | bool | `false` | |
|
||||
| controllerManager.identities.dnsNameTemplates | list | `[]` | |
|
||||
| controllerManager.identities.enabled | bool | `true` | |
|
||||
| controllerManager.identities.federatesWith | list | `[]` | |
|
||||
| controllerManager.identities.namespaceSelector | object | `{}` | |
|
||||
| controllerManager.identities.podSelector | object | `{}` | |
|
||||
| controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | |
|
||||
| controllerManager.ignoreNamespaces[0] | string | `"kube-system"` | |
|
||||
| controllerManager.ignoreNamespaces[1] | string | `"kube-public"` | |
|
||||
| controllerManager.ignoreNamespaces[2] | string | `"local-path-storage"` | |
|
||||
| controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
||||
| controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
|
||||
| controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry |
|
||||
| controllerManager.image.tag | string | `"0.2.3"` | Overrides the image tag |
|
||||
| controllerManager.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
||||
| controllerManager.installAndUpgradeHook.enabled | bool | `true` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) |
|
||||
| controllerManager.resources | object | `{}` | |
|
||||
| controllerManager.securityContext | object | `{}` | |
|
||||
| controllerManager.service.annotations | object | `{}` | |
|
||||
| controllerManager.service.port | int | `443` | |
|
||||
| controllerManager.service.type | string | `"ClusterIP"` | |
|
||||
| controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | |
|
||||
| customPlugins.keyManager | object | `{}` | |
|
||||
| customPlugins.nodeAttestor | object | `{}` | |
|
||||
| customPlugins.notifier | object | `{}` | |
|
||||
| customPlugins.upstreamAuthority | object | `{}` | |
|
||||
| dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
|
||||
| dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
|
||||
| dataStore.sql.externalSecret | object | `{"enabled":false,"key":"","name":""}` | When an external source creates the secret. The secret should reside in the same namespace as the spire server |
|
||||
| dataStore.sql.externalSecret.key | string | `""` | The key of the secret object whose value is the dataStore.sql password |
|
||||
| dataStore.sql.externalSecret.name | string | `""` | The name of the secret object |
|
||||
| dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |
|
||||
| dataStore.sql.options | list | `[]` | Only used by "postgres" or "mysql" |
|
||||
| dataStore.sql.password | string | `""` | Only used by "postgres" or "mysql" |
|
||||
| dataStore.sql.plugin_data | object | `{}` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section |
|
||||
| dataStore.sql.port | int | `0` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. |
|
||||
| dataStore.sql.username | string | `"spire"` | Only used by "postgres" or "mysql" |
|
||||
| defaultJwtSvidTTL | string | `"1h"` | |
|
||||
| defaultX509SvidTTL | string | `"4h"` | |
|
||||
| extraContainers | list | `[]` | |
|
||||
| extraVolumeMounts | list | `[]` | |
|
||||
| extraVolumes | list | `[]` | |
|
||||
| federation.bundleEndpoint.address | string | `"0.0.0.0"` | |
|
||||
| federation.bundleEndpoint.port | int | `8443` | |
|
||||
| federation.enabled | bool | `false` | |
|
||||
| federation.ingress.annotations | object | `{}` | |
|
||||
| federation.ingress.className | string | `""` | |
|
||||
| federation.ingress.enabled | bool | `false` | |
|
||||
| federation.ingress.hosts[0].host | string | `"spire-server-federation.example.org"` | |
|
||||
| federation.ingress.hosts[0].paths[0].path | string | `"/"` | |
|
||||
| federation.ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | |
|
||||
| federation.ingress.tls | list | `[]` | |
|
||||
| fullnameOverride | string | `""` | |
|
||||
| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
||||
| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
|
||||
| image.repository | string | `"spiffe/spire-server"` | The repository within the registry |
|
||||
| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
|
||||
| image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
||||
| imagePullSecrets | list | `[]` | |
|
||||
| ingress.annotations | object | `{}` | |
|
||||
| ingress.className | string | `""` | |
|
||||
| ingress.enabled | bool | `false` | |
|
||||
| ingress.hosts[0].host | string | `"spire-server.example.org"` | |
|
||||
| ingress.hosts[0].paths[0].path | string | `"/"` | |
|
||||
| ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | |
|
||||
| ingress.tls | list | `[]` | |
|
||||
| initContainers | list | `[]` | |
|
||||
| jwtIssuer | string | `"https://oidc-discovery.example.org"` | The JWT issuer domain |
|
||||
| keyManager.awsKMS.accessKeyID | Optional | `""` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. |
|
||||
| keyManager.awsKMS.enabled | bool | `false` | |
|
||||
| keyManager.awsKMS.keyPolicy | object | `{"existingConfigMap":"","policy":""}` | Policy to use when creating keys. If no policy is specified, a default policy will be used. |
|
||||
| keyManager.awsKMS.keyPolicy.existingConfigMap | Optional | `""` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. |
|
||||
| keyManager.awsKMS.keyPolicy.policy | Optional | `""` | Key policy in JSON format. |
|
||||
| keyManager.awsKMS.region | string | `""` | |
|
||||
| keyManager.awsKMS.secretAccessKey | Optional | `""` | Secret access key for the AWS account. |
|
||||
| keyManager.disk.enabled | bool | `true` | |
|
||||
| keyManager.memory.enabled | bool | `false` | |
|
||||
| livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe |
|
||||
| livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe |
|
||||
| livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe |
|
||||
| livenessProbe.timeoutSeconds | int | `3` | Timeout in seconds for livenessProbe |
|
||||
| logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
|
||||
| nameOverride | string | `""` | |
|
||||
| namespaceOverride | string | `""` | |
|
||||
| nodeAttestor.k8sPsat.enabled | bool | `true` | |
|
||||
| nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` | |
|
||||
| nodeSelector | object | `{}` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) |
|
||||
| notifier.k8sbundle.namespace | string | `""` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace |
|
||||
| persistence.accessMode | string | `"ReadWriteOnce"` | |
|
||||
| persistence.hostPath | string | `""` | Which path to use on the host when type = hostPath |
|
||||
| persistence.size | string | `"1Gi"` | |
|
||||
| persistence.storageClass | string | `nil` | |
|
||||
| persistence.type | string | `"pvc"` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) |
|
||||
| podAnnotations | object | `{}` | |
|
||||
| podSecurityContext | object | `{}` | |
|
||||
| readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe |
|
||||
| readinessProbe.periodSeconds | int | `5` | Period seconds for readinessProbe |
|
||||
| replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. |
|
||||
| resources | object | `{}` | |
|
||||
| securityContext | object | `{}` | |
|
||||
| service.annotations | object | `{}` | |
|
||||
| service.port | int | `8081` | |
|
||||
| service.type | string | `"ClusterIP"` | |
|
||||
| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
|
||||
| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
|
||||
| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
|
||||
| telemetry.prometheus.enabled | bool | `false` | |
|
||||
| telemetry.prometheus.podMonitor.enabled | bool | `false` | |
|
||||
| telemetry.prometheus.podMonitor.labels | object | `{}` | |
|
||||
| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
|
||||
| tolerations | list | `[]` | |
|
||||
| tools.kubectl.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
|
||||
| tools.kubectl.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
|
||||
| tools.kubectl.image.repository | string | `"rancher/kubectl"` | The repository within the registry |
|
||||
| tools.kubectl.image.tag | string | `""` | Overrides the image tag |
|
||||
| tools.kubectl.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
||||
| topologySpreadConstraints | list | `[]` | |
|
||||
| tornjak.config.clientCA.name | string | `"tornjak-client-ca"` | |
|
||||
| tornjak.config.clientCA.type | string | `"Secret"` | Type of delivery for the user CA for mTLS client verification options are `Secret` or `ConfigMap` (required for `mtls` connectionType) |
|
||||
| tornjak.config.dataStore | object | `{"driver":"sqlite3","file":"/run/spire/data/tornjak.sqlite3"}` | Persistent DB for storing Tornjak specific information |
|
||||
| tornjak.config.tlsSecret | string | `"tornjak-tls-secret"` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) |
|
||||
| tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) (Not for production) |
|
||||
| tornjak.image.pullPolicy | string | `"IfNotPresent"` | The Tornjak image pull policy |
|
||||
| tornjak.image.registry | string | `"ghcr.io"` | The OCI registry to pull the Tornjak image from |
|
||||
| tornjak.image.repository | string | `"spiffe/tornjak-backend"` | The repository within the registry |
|
||||
| tornjak.image.tag | string | `"v1.2.2"` | Overrides the image tag |
|
||||
| tornjak.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
|
||||
| tornjak.resources | object | `{}` | |
|
||||
| tornjak.service.annotations | object | `{}` | |
|
||||
| tornjak.service.ports | object | `{"http":10000,"https":10443}` | Ports for tornjak |
|
||||
| tornjak.service.type | string | `"ClusterIP"` | |
|
||||
| tornjak.startupProbe.failureThreshold | int | `3` | |
|
||||
| tornjak.startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for |
|
||||
| tornjak.startupProbe.periodSeconds | int | `10` | |
|
||||
| tornjak.startupProbe.successThreshold | int | `1` | |
|
||||
| tornjak.startupProbe.timeoutSeconds | int | `5` | |
|
||||
| trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
|
||||
| upstreamAuthority.awsPCA.assumeRoleARN | Optional | `""` | ARN of an IAM role to assume |
|
||||
| upstreamAuthority.awsPCA.caSigningTemplateARN | string | `""` | See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. |
|
||||
| upstreamAuthority.awsPCA.certificateAuthorityARN | string | `""` | ARN of the "upstream" CA certificate |
|
||||
| upstreamAuthority.awsPCA.enabled | bool | `false` | |
|
||||
| upstreamAuthority.awsPCA.endpoint | string | `""` | See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. |
|
||||
| upstreamAuthority.awsPCA.region | string | `""` | AWS Region to use |
|
||||
| upstreamAuthority.awsPCA.signingAlgorithm | string | `""` | See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. |
|
||||
| upstreamAuthority.awsPCA.supplementalBundlePath | Optional | `""` | Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. |
|
||||
| upstreamAuthority.certManager.ca.create | bool | `false` | Creates a Cert-Manager CA |
|
||||
| upstreamAuthority.certManager.ca.duration | string | `"87600h"` | Duration of the CA. Defaults to 10 years. |
|
||||
| upstreamAuthority.certManager.ca.privateKey.algorithm | string | `"ECDSA"` | |
|
||||
| upstreamAuthority.certManager.ca.privateKey.rotationPolicy | string | `""` | |
|
||||
| upstreamAuthority.certManager.ca.privateKey.size | int | `256` | |
|
||||
| upstreamAuthority.certManager.ca.renewBefore | string | `""` | How long to wait before renewing the CA |
|
||||
| upstreamAuthority.certManager.enabled | bool | `false` | |
|
||||
| upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` | |
|
||||
| upstreamAuthority.certManager.issuer_kind | string | `"Issuer"` | |
|
||||
| upstreamAuthority.certManager.issuer_name | string | `""` | Defaults to the release name, override if CA is provided outside of the chart |
|
||||
| upstreamAuthority.certManager.kube_config_file | string | `""` | |
|
||||
| upstreamAuthority.certManager.namespace | string | `""` | Specify to use a namespace other then the one the chart is installed into |
|
||||
| upstreamAuthority.certManager.rbac.create | bool | `true` | |
|
||||
| upstreamAuthority.disk.enabled | bool | `false` | |
|
||||
| upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. |
|
||||
| upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info |
|
||||
| upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. |
|
||||
| upstreamAuthority.spire.enabled | bool | `false` | |
|
||||
| upstreamAuthority.spire.server.address | string | `""` | |
|
||||
| upstreamAuthority.spire.server.port | int | `8081` | |
|
||||
| upstreamAuthority.spire.upstreamDriver | string | `""` | |
|
||||
### Chart parameters
|
||||
|
||||
----------------------------------------------
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------- |
|
||||
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/spire-server` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||
| `nameOverride` | Name override | `""` |
|
||||
| `namespaceOverride` | Namespace override | `""` |
|
||||
| `fullnameOverride` | Fullname override | `""` |
|
||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
||||
| `podAnnotations` | Annotations to add to pods | `{}` |
|
||||
| `podSecurityContext` | Pod security context | `{}` |
|
||||
| `securityContext` | Security context | `{}` |
|
||||
| `service.type` | Type of the Spire server service created | `ClusterIP` |
|
||||
| `service.port` | Port for the created service | `8081` |
|
||||
| `service.annotations` | Annotations to add to the service object | `{}` |
|
||||
| `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` |
|
||||
| `resources` | Resource requests and limits | `{}` |
|
||||
| `autoscaling.enabled` | Flag to enable autoscaling | `false` |
|
||||
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
|
||||
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` |
|
||||
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` |
|
||||
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` |
|
||||
| `tolerations` | List of tolerations | `[]` |
|
||||
| `affinity` | List of node affinities | `{}` |
|
||||
| `topologySpreadConstraints` | Topology spread constraints for resilience | `[]` |
|
||||
| `livenessProbe.failureThreshold` | Failure threshold count for livenessProbe | `2` |
|
||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `15` |
|
||||
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `60` |
|
||||
| `livenessProbe.timeoutSeconds` | Timeout in seconds for livenessProbe | `3` |
|
||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
||||
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
||||
| `persistence.type` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `pvc` |
|
||||
| `persistence.size` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `1Gi` |
|
||||
| `persistence.accessMode` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `ReadWriteOnce` |
|
||||
| `persistence.storageClass` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `nil` |
|
||||
| `persistence.hostPath` | Which path to use on the host when type = hostPath | `""` |
|
||||
| `dataStore.sql.databaseType` | Other supported databases are "postgres" and "mysql" | `sqlite3` |
|
||||
| `dataStore.sql.databaseName` | Only used by "postgres" or "mysql" | `spire` |
|
||||
| `dataStore.sql.host` | Only used by "postgres" or "mysql" | `""` |
|
||||
| `dataStore.sql.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` |
|
||||
| `dataStore.sql.username` | Only used by "postgres" or "mysql" | `spire` |
|
||||
| `dataStore.sql.password` | Only used by "postgres" or "mysql" | `""` |
|
||||
| `dataStore.sql.options` | Only used by "postgres" or "mysql" | `[]` |
|
||||
| `dataStore.sql.plugin_data` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section | `{}` |
|
||||
| `dataStore.sql.externalSecret.enabled` | Enable external secret for datastore creds | `false` |
|
||||
| `dataStore.sql.externalSecret.name` | The name of the secret object | `""` |
|
||||
| `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
|
||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||
| `jwtIssuer` | The JWT issuer domain | `https://oidc-discovery.example.org` |
|
||||
| `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` |
|
||||
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||
| `bundleConfigMap` | Set the trust domain to be used for the SPIFFE identifiers | `spire-bundle` |
|
||||
| `clusterDomain` | This is the value of your clusters `kubeadm init --service-dns-domain` flag | `cluster.local` |
|
||||
| `federation.enabled` | Flag to enable federation | `false` |
|
||||
| `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` |
|
||||
| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` |
|
||||
| `federation.ingress.enabled` | Flag to enable ingress for federation | `false` |
|
||||
| `federation.ingress.className` | Ingress class name for federation | `""` |
|
||||
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||
| `federation.ingress.hosts` | Host paths for ingress object | `[]` |
|
||||
| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
|
||||
| `ca_subject.country` | Country for Spire server CA | `NL` |
|
||||
| `ca_subject.organization` | Organization for Spire server CA | `Example` |
|
||||
| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` |
|
||||
| `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` |
|
||||
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
|
||||
| `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` |
|
||||
| `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` |
|
||||
| `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | |
|
||||
| `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` |
|
||||
| `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` |
|
||||
| `keyManager.awsKMS.accessKeyID` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. | `""` |
|
||||
| `keyManager.awsKMS.secretAccessKey` | Secret access key for the AWS account. | `""` |
|
||||
| `upstreamAuthority.disk.enabled` | Flag to enable upstream authority plugin on disk | `false` |
|
||||
| `upstreamAuthority.disk.secret.create` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | `true` |
|
||||
| `upstreamAuthority.disk.secret.name` | If secret creation is disabled, the secret with this name will be used. | `spiffe-upstream-ca` |
|
||||
| `upstreamAuthority.disk.secret.data` | If secret creation is enabled, will create a secret with following certificate info | |
|
||||
| `upstreamAuthority.disk.secret.data.certificate` | Certificate to store within disk upstreamAuthority. | `""` |
|
||||
| `upstreamAuthority.disk.secret.data.key` | Key corresponding to the upstreamAuthority. | `""` |
|
||||
| `upstreamAuthority.disk.secret.data.bundle` | Trust bundle for upstreamAuthority. | `""` |
|
||||
| `upstreamAuthority.awsPCA.enabled` | Flag to enable upstream authority plugin with AWS PCA | `false` |
|
||||
| `upstreamAuthority.awsPCA.region` | AWS Region to use | `""` |
|
||||
| `upstreamAuthority.awsPCA.certificateAuthorityARN` | ARN of the "upstream" CA certificate | `""` |
|
||||
| `upstreamAuthority.awsPCA.assumeRoleARN` | (Optional) ARN of an IAM role to assume | `""` |
|
||||
| `upstreamAuthority.awsPCA.caSigningTemplateARN` | (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. | `""` |
|
||||
| `upstreamAuthority.awsPCA.signingAlgorithm` | (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | `""` |
|
||||
| `upstreamAuthority.awsPCA.endpoint` | (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | `""` |
|
||||
| `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` |
|
||||
| `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` |
|
||||
| `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` |
|
||||
| `upstreamAuthority.certManager.issuer_name` | Defaults to the release name, override if CA is provided outside of the chart | `""` |
|
||||
| `upstreamAuthority.certManager.issuer_kind` | Defaults to "Issuer", override if CA is provided outside of the chart | `Issuer` |
|
||||
| `upstreamAuthority.certManager.issuer_group` | Defaults to "cert-manager.io", override if CA is provided outside of the chart | `cert-manager.io` |
|
||||
| `upstreamAuthority.certManager.namespace` | Specify to use a namespace other then the one the chart is installed into | `""` |
|
||||
| `upstreamAuthority.certManager.kube_config_file` | Path to kube_config_file on node to setup cert manager | `""` |
|
||||
| `upstreamAuthority.certManager.ca.create` | Creates a Cert-Manager CA | `false` |
|
||||
| `upstreamAuthority.certManager.ca.duration` | Duration of the CA. Defaults to 10 years | `87600h` |
|
||||
| `upstreamAuthority.certManager.ca.privateKey.algorithm` | Algorithm to generate private key for CA | `ECDSA` |
|
||||
| `upstreamAuthority.certManager.ca.privateKey.size` | Size of generated private key for CA | `256` |
|
||||
| `upstreamAuthority.certManager.ca.privateKey.rotationPolicy` | Rotation policy for generated private key | `""` |
|
||||
| `upstreamAuthority.certManager.ca.renewBefore` | How long to wait before renewing the CA | `""` |
|
||||
| `upstreamAuthority.spire.enabled` | Flag to use another Spire install as upstream CA | `false` |
|
||||
| `upstreamAuthority.spire.upstreamDriver` | Driver for Spire as upstream CA | `""` |
|
||||
| `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | |
|
||||
| `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` |
|
||||
| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `8081` |
|
||||
| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
||||
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||
| `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
||||
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.2.3` |
|
||||
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
||||
| `controllerManager.securityContext` | Security context | `{}` |
|
||||
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
||||
| `controllerManager.service.port` | Service port for controller manager | `443` |
|
||||
| `controllerManager.service.annotations` | Annotations for service resource | `{}` |
|
||||
| `controllerManager.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` |
|
||||
| `controllerManager.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` |
|
||||
| `controllerManager.identities.enabled` | Flag to enable default identities for controller manager | `true` |
|
||||
| `controllerManager.identities.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` |
|
||||
| `controllerManager.identities.podSelector` | Selector for pods to issue identity | `{}` |
|
||||
| `controllerManager.identities.namespaceSelector` | Selector for namespacs to issue identity | `{}` |
|
||||
| `controllerManager.identities.dnsNameTemplates` | DNS name template for issued identities | `[]` |
|
||||
| `controllerManager.identities.federatesWith` | Other Spire server URLs for identity federation | `[]` |
|
||||
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
|
||||
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
|
||||
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
||||
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
||||
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
|
||||
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||
| `ingress.enabled` | Flag to enable ingress | `false` |
|
||||
| `ingress.className` | Ingress class name | `""` |
|
||||
| `ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||
| `ingress.hosts` | Host paths for ingress object | `[]` |
|
||||
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
|
||||
| `extraVolumes` | Extra volumes to be mounted | `[]` |
|
||||
| `extraVolumeMounts` | Extra volume mounts | `[]` |
|
||||
| `extraContainers` | Additional containers to create | `[]` |
|
||||
| `initContainers` | Additional init containers to create | `[]` |
|
||||
| `caKeyType` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) | `rsa-2048` |
|
||||
| `caTTL` | TTL for CA | `24h` |
|
||||
| `defaultX509SvidTTL` | TTL for X509 Svids | `4h` |
|
||||
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
|
||||
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` |
|
||||
| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` |
|
||||
| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` |
|
||||
| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
|
||||
| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.2.2` |
|
||||
| `tornjak.service.type` | Type of service resource | `ClusterIP` |
|
||||
| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` |
|
||||
| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` |
|
||||
| `tornjak.service.annotations` | Annotations for the service | `{}` |
|
||||
| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` |
|
||||
| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` |
|
||||
| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` |
|
||||
| `tornjak.startupProbe.successThreshold` | Success threshold count | `1` |
|
||||
| `tornjak.startupProbe.timeoutSeconds` | Timeout in seconds | `5` |
|
||||
| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | |
|
||||
| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` |
|
||||
| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` |
|
||||
| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` |
|
||||
| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` |
|
||||
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
|
||||
| `tornjak.resources` | Resource requests and limits | `{}` |
|
||||
| `tests.hostAliases` | List of host aliases for testing | `[]` |
|
||||
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
|
||||
| `tests.tls.customCA` | Custom CA value for tests | `""` |
|
||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:96ab1600d945b4a99c8610b5c8b31e346da63dc20573a26bb0777dd0190db5d4` |
|
||||
|
||||
Reference in New Issue
Block a user