panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Upgrade SPIRE to 1.10.3 (#412)

Browse Source 
* Update SPIRE to 1.10.3

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-agent/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
2024-09-04 13:16:50 -07:00
committed by GitHub
co-authored by Faisal Memon
parent de5ec47613
commit 7df063f8db
15 changed files with 116 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-agent/README.md
+5 -1
View File
@@ -73,6 +73,10 @@ A Helm chart to install the SPIRE agent.
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` |
| `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` |
| `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` |
| `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` |
| `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` |
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-agent` |
@@ -139,4 +143,4 @@ A Helm chart to install the SPIRE agent.
| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` |
| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` |
| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` |
| `persistence.hostPath` | Which path to use on the host when type = hostPath | `/var/lib/spire/k8s/agent` |
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` |