Add support for AWS KMS key tagging (#721)

* Add support for AWS KMS key tagging Signed-off-by: Shubham Hibare <[email protected]> * fix doc Signed-off-by: Shubham Hibare <[email protected]> * Update charts/spire/charts/spire-server/templates/configmap.yaml Co-authored-by: Marco Franssen <[email protected]> Signed-off-by: Shubham Hibare <[email protected]> --------- Signed-off-by: Shubham Hibare <[email protected]> Signed-off-by: Shubham Hibare <[email protected]> Co-authored-by: Marco Franssen <[email protected]>
2026-01-06 12:43:18 +01:00
parent db8f135204
commit 87da80a89a
5 changed files with 450 additions and 351 deletions
@@ -400,6 +400,11 @@ keyManager:
      policy: ""
      ## @param keyManager.awsKMS.keyPolicy.existingConfigMap [nullable] Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format.
      existingConfigMap: ""
+    ## @param keyManager.awsKMS.keyTags [object] Custom tags to apply to KMS keys created by the plugin. Tags are key-value pairs used for resource management and cost allocation. When using key tagging, you must add the `kms:TagResource` permission to your IAM policy. Constraints: keys (1-128 chars), values (0-256 chars), max 50 tags, valid chars (letters, numbers, spaces, + - = . _ : / @), keys cannot start with 'aws:' or 'spire-'.
+    keyTags: {}
+      # Environment: "production"
+      # Team: "security"
+      # Component: "spire"
    ## @param keyManager.awsKMS.accessKeyID [nullable] Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role.
    accessKeyID: ""
    ## @param keyManager.awsKMS.secretAccessKey [nullable] Secret access key for the AWS account.