From b54c41aee05056ae09d1a1c7a122119b3e3af4e6 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 16 Mar 2023 17:19:55 +0100 Subject: [PATCH] Enhance the production example Signed-off-by: Marco Franssen --- examples/production/values.yaml | 49 +++++++++++++++++++++------------ 1 file changed, 31 insertions(+), 18 deletions(-) diff --git a/examples/production/values.yaml b/examples/production/values.yaml index b18767e..d81d285 100644 --- a/examples/production/values.yaml +++ b/examples/production/values.yaml @@ -3,24 +3,6 @@ global: prometheus: enabled: true -spiffe-oidc-discovery-provider: - enabled: true - insecureScheme: - enabled: true - podSecurityContext: - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - fsGroupChangePolicy: OnRootMismatch - securityContext: - allowPrivilegeEscalation: false - runAsNonRoot: true - readOnlyRootFilesystem: true - capabilities: - drop: [ALL] - seccompProfile: - type: RuntimeDefault - spire-server: nodeAttestor: k8sPsat: @@ -41,6 +23,12 @@ spire-server: drop: [ALL] seccompProfile: type: RuntimeDefault + + dataStorage: + enabled: true + + logLevel: info + controllerManager: securityContext: allowPrivilegeEscalation: false @@ -51,6 +39,11 @@ spire-server: seccompProfile: type: RuntimeDefault + ignoreNamespaces: + - kube-system + - kube-public + - local-path-storage + spiffe-csi-driver: enabled: true namespaceOverride: spire-system @@ -64,3 +57,23 @@ spire-agent: server: namespaceOverride: spire-server priorityClassName: system-node-critical + + logLevel: info + +spiffe-oidc-discovery-provider: + enabled: true + insecureScheme: + enabled: true + podSecurityContext: + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + fsGroupChangePolicy: OnRootMismatch + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + readOnlyRootFilesystem: true + capabilities: + drop: [ALL] + seccompProfile: + type: RuntimeDefault