diff --git a/charts/spire-nested/Chart.yaml b/charts/spire-nested/Chart.yaml index 18b89f6..6c092ae 100644 --- a/charts/spire-nested/Chart.yaml +++ b/charts/spire-nested/Chart.yaml @@ -105,12 +105,25 @@ dependencies: - nestedRoot - nestedChildFull - nestedChildSecurity + - haAgentCommon repository: file://../spire/charts/spiffe-oidc-discovery-provider version: 0.1.0 - name: tornjak-frontend condition: tornjak-frontend.enabled repository: file://../spire/charts/tornjak-frontend version: 0.1.0 + - name: spiffe-csi-driver + repository: file://../spire/charts/spiffe-csi-driver + version: 0.1.0 + condition: spiffe-csi-driver.enabled + tags: + - haAgentCommon + - name: spire-ha-agent + repository: file://../spire-ha-agent + version: 0.1.0 + condition: spire-ha-agent.enabled + tags: + - haAgentCommon annotations: artifacthub.io/category: security artifacthub.io/license: Apache-2.0 diff --git a/charts/spire-nested/README.md b/charts/spire-nested/README.md index 3e854e8..2475b1e 100644 --- a/charts/spire-nested/README.md +++ b/charts/spire-nested/README.md @@ -233,6 +233,7 @@ Now you can interact with the Spire agent socket from your own application. The | `tags.nestedRoot` | Set the chart architecture to root nested | `false` | | `tags.nestedChildFull` | Set the chart mode to a child cluster with its own nested server | `false` | | `tags.nestedChildSecurity` | Set the chart mode to a child cluster for use with a security cluster | `false` | +| `tags.haAgentCommon` | Set the chart mode to deploy the common portion of a spire-ha-agent setup | `false` | ### Spire agent parameters @@ -328,28 +329,31 @@ Now you can interact with the Spire agent socket from your own application. The ### Spire server parameters -| Name | Description | Value | -| ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- | ---------------------------- | -| `internal-spire-server.nameOverride` | Overrides the name of Spire server pods | `internal-server` | -| `internal-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` | -| `internal-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` | -| `internal-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` | -| `internal-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` | -| `internal-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` | -| `internal-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` | -| `internal-spire-server.bundleConfigMap` | The name of the configmap to store the downstream bundle | `spire-bundle-downstream` | -| `external-spire-server.nameOverride` | Overrides the name of Spire server pods | `external-server` | -| `external-spire-server.crNameOverride` | Custom Resource name override | `external` | -| `external-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` | -| `external-spire-server.controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another instance on the k8s cluster with webhooks enabled. | `false` | -| `external-spire-server.controllerManager.className` | specify to use an explicit class name. | `spire-mgmt-external-server` | -| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable the default identity | `false` | -| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the oidc-discovery-provider identity | `false` | -| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` | -| `external-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` | -| `external-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` | -| `external-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` | -| `external-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` | -| `external-spire-server.bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `false` | -| `external-spire-server.nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `false` | -| `external-spire-server.nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `true` | +| Name | Description | Value | +| ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- | ----------------------------------------------- | +| `internal-spire-server.nameOverride` | Overrides the name of Spire server pods | `internal-server` | +| `internal-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` | +| `internal-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` | +| `internal-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` | +| `internal-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` | +| `internal-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` | +| `internal-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` | +| `internal-spire-server.bundleConfigMap` | The name of the configmap to store the downstream bundle | `spire-bundle-downstream` | +| `external-spire-server.nameOverride` | Overrides the name of Spire server pods | `external-server` | +| `external-spire-server.crNameOverride` | Custom Resource name override | `external` | +| `external-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` | +| `external-spire-server.controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another instance on the k8s cluster with webhooks enabled. | `false` | +| `external-spire-server.controllerManager.className` | specify to use an explicit class name. | `spire-mgmt-external-server` | +| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable the default identity | `false` | +| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the oidc-discovery-provider identity | `false` | +| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` | +| `external-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` | +| `external-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` | +| `external-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` | +| `external-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` | +| `external-spire-server.bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `false` | +| `external-spire-server.nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `false` | +| `external-spire-server.nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `true` | +| `spiffe-csi-driver.agentSocketPath` | The socket path where Spiffe CSI driver mounts agent socket | `/var/run/spire/agent-sockets/spire-agent.sock` | +| `spiffe-csi-driver.healthChecks.port` | Health check port number for upstream Spire agent | `9814` | +| `spire-ha-agent` | The configuration overrides for a spire-ha-agent | `{}` | diff --git a/charts/spire-nested/values.yaml b/charts/spire-nested/values.yaml index 3ef0315..4644702 100644 --- a/charts/spire-nested/values.yaml +++ b/charts/spire-nested/values.yaml @@ -101,6 +101,8 @@ tags: nestedChildFull: false ## @param tags.nestedChildSecurity Set the chart mode to a child cluster for use with a security cluster nestedChildSecurity: false + ## @param tags.haAgentCommon Set the chart mode to deploy the common portion of a spire-ha-agent setup + haAgentCommon: false ## subcharts @@ -197,7 +199,7 @@ upstream-spiffe-csi-driver: ## @section SPIFFE oidc discovery provider parameters ## Parameter values for spiffe-oidc-discovery-provider ## -# Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity] +# Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity, haAgentCommon] spiffe-oidc-discovery-provider: # enabled: true ## @param spiffe-oidc-discovery-provider.fullnameOverride Fullname override @@ -395,3 +397,17 @@ external-spire-server: joinToken: ## @param external-spire-server.nodeAttestor.joinToken.enabled Enable the join_token nodeattestor enabled: true + +# Used with tags [haAgentCommon] +spiffe-csi-driver: + # enabled: true + ## @param spiffe-csi-driver.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket + agentSocketPath: /var/run/spire/agent-sockets/spire-agent.sock + healthChecks: + ## @param spiffe-csi-driver.healthChecks.port Health check port number for upstream Spire agent + port: 9814 + +## @param spire-ha-agent The configuration overrides for a spire-ha-agent +# Used with tags [haAgentCommon] +spire-ha-agent: {} + # enabled: true