Bump up spire to 1.9.6 (#356)
Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
@@ -4,7 +4,7 @@ description: >
|
|||||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||||
type: application
|
type: application
|
||||||
version: 0.20.0
|
version: 0.20.0
|
||||||
appVersion: "1.9.5"
|
appVersion: "1.9.6"
|
||||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||||
sources:
|
sources:
|
||||||
|
|||||||
@@ -1,6 +1,6 @@
|
|||||||
# spire
|
# spire
|
||||||
|
|
||||||
  
|
  
|
||||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||||
|
|
||||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider
|
|||||||
description: A Helm chart to install the SPIFFE OIDC discovery provider.
|
description: A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||||
type: application
|
type: application
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
appVersion: "1.9.5"
|
appVersion: "1.9.6"
|
||||||
keywords: ["spiffe", "oidc"]
|
keywords: ["spiffe", "oidc"]
|
||||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||||
sources:
|
sources:
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ name: spire-agent
|
|||||||
description: A Helm chart to install the SPIRE agent.
|
description: A Helm chart to install the SPIRE agent.
|
||||||
type: application
|
type: application
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
appVersion: "1.9.5"
|
appVersion: "1.9.6"
|
||||||
keywords: ["spiffe", "spire-agent"]
|
keywords: ["spiffe", "spire-agent"]
|
||||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||||
sources:
|
sources:
|
||||||
|
|||||||
@@ -25,108 +25,110 @@ A Helm chart to install the SPIRE agent.
|
|||||||
|
|
||||||
### Chart parameters
|
### Chart parameters
|
||||||
|
|
||||||
| Name | Description | Value |
|
| Name | Description | Value |
|
||||||
| ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
| --------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
| `image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
||||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||||
| `nameOverride` | Name override | `""` |
|
| `nameOverride` | Name override | `""` |
|
||||||
| `namespaceOverride` | Namespace override | `""` |
|
| `namespaceOverride` | Namespace override | `""` |
|
||||||
| `fullnameOverride` | Fullname override | `""` |
|
| `fullnameOverride` | Fullname override | `""` |
|
||||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||||
| `serviceAccount.name` | The name of the service account to use. | `""` |
|
| `serviceAccount.name` | The name of the service account to use. | `""` |
|
||||||
| `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` |
|
| `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` |
|
||||||
| `podAnnotations` | Annotations to add to pods | `{}` |
|
| `podAnnotations` | Annotations to add to pods | `{}` |
|
||||||
| `podLabels` | Labels to add to pods | `{}` |
|
| `podLabels` | Labels to add to pods | `{}` |
|
||||||
| `podSecurityContext` | Pod security context | `{}` |
|
| `podSecurityContext` | Pod security context | `{}` |
|
||||||
| `securityContext` | Security context | `{}` |
|
| `securityContext` | Security context | `{}` |
|
||||||
| `resources` | Resource requests and limits | `{}` |
|
| `resources` | Resource requests and limits | `{}` |
|
||||||
| `nodeSelector` | Node selector | `{}` |
|
| `nodeSelector` | Node selector | `{}` |
|
||||||
| `tolerations` | List of tolerations | `[]` |
|
| `tolerations` | List of tolerations | `[]` |
|
||||||
| `affinity` | Node affinity | `{}` |
|
| `affinity` | Node affinity | `{}` |
|
||||||
| `authorizedDelegates` | A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information. | `[]` |
|
| `authorizedDelegates` | A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information. | `[]` |
|
||||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||||
| `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` |
|
| `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` |
|
||||||
| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` |
|
| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||||
| `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` |
|
| `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` |
|
||||||
| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `pem` |
|
| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `pem` |
|
||||||
| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` |
|
| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` |
|
||||||
| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` |
|
| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` |
|
||||||
| `disableReattestToRenew` | Deprecated: Allow agent to renew certificate when it expires rather than reattest | `false` |
|
| `disableReattestToRenew` | Deprecated: Allow agent to renew certificate when it expires rather than reattest | `false` |
|
||||||
| `server.address` | Address for Spire server | `""` |
|
| `server.address` | Address for Spire server | `""` |
|
||||||
| `server.port` | Port number for Spire server | `443` |
|
| `server.port` | Port number for Spire server | `443` |
|
||||||
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
||||||
| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
||||||
| `healthChecks.port` | override the host port used for health checking | `9982` |
|
| `healthChecks.port` | override the host port used for health checking | `9982` |
|
||||||
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
|
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
|
||||||
| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` |
|
| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` |
|
||||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
|
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
|
||||||
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
|
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
|
||||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` |
|
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` |
|
||||||
| `readinessProbe.periodSeconds` | Period seconds for probe | `30` |
|
| `readinessProbe.periodSeconds` | Period seconds for probe | `30` |
|
||||||
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||||
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||||
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
|
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
|
||||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0aaead0a1bfc92e8d5888b7cb7b77be321fb2aed52526168b107ce26cf0ecfda` |
|
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0aaead0a1bfc92e8d5888b7cb7b77be321fb2aed52526168b107ce26cf0ecfda` |
|
||||||
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||||
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
|
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
|
||||||
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` |
|
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` |
|
||||||
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
|
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
|
||||||
| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||||
| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-agent` |
|
| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-agent` |
|
||||||
| `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.8.7` |
|
| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.8.7` |
|
||||||
| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `1d7c73ccac948ee86cbd78ddde2d30128a1838b403f7bb2100d38d916a252244` |
|
| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `1d7c73ccac948ee86cbd78ddde2d30128a1838b403f7bb2100d38d916a252244` |
|
||||||
| `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` |
|
| `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` |
|
||||||
| `nodeAttestor.tpmDirect.pubHash.enabled` | Enable Psat k8s nodeattestor | `true` |
|
| `nodeAttestor.tpmDirect.pubHash.enabled` | Enable Psat k8s nodeattestor | `true` |
|
||||||
| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||||
| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-get-tpm-pubhash` |
|
| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-get-tpm-pubhash` |
|
||||||
| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.8.7` |
|
| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.8.7` |
|
||||||
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
|
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
|
||||||
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
|
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
|
||||||
| `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` |
|
| `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` |
|
||||||
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
|
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
|
||||||
| `sds.enabled` | Enables Envoy SDS configuration | `false` |
|
| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false | `false` |
|
||||||
| `sds.defaultSvidName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` |
|
| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` |
|
||||||
| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` |
|
| `sds.enabled` | Enables Envoy SDS configuration | `false` |
|
||||||
| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` |
|
| `sds.defaultSvidName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` |
|
||||||
| `sds.disableSpiffeCertValidation` | Disable Envoy SDS custom validation | `false` |
|
| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` |
|
||||||
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` |
|
||||||
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
|
| `sds.disableSpiffeCertValidation` | Disable Envoy SDS custom validation | `false` |
|
||||||
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
||||||
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
|
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
|
||||||
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
||||||
| `kubeletConnectByHostname` | If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
|
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
|
||||||
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||||
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` |
|
| `kubeletConnectByHostname` | If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
|
||||||
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||||
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
|
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` |
|
||||||
| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` |
|
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||||
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0aaead0a1bfc92e8d5888b7cb7b77be321fb2aed52526168b107ce26cf0ecfda` |
|
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||||
| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` |
|
||||||
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:0aaead0a1bfc92e8d5888b7cb7b77be321fb2aed52526168b107ce26cf0ecfda` |
|
||||||
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
|
| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||||
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
|
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||||
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` |
|
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
|
||||||
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
|
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
|
||||||
| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` |
|
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` |
|
||||||
| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` |
|
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
|
||||||
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
|
| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` |
|
||||||
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
|
| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` |
|
||||||
| `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` |
|
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
|
||||||
| `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` |
|
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
|
||||||
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
| `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` |
|
||||||
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
|
| `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` |
|
||||||
| `experimental.featureFlags` | List of developer feature flags | `[]` |
|
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
||||||
| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` |
|
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
|
||||||
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
| `experimental.featureFlags` | List of developer feature flags | `[]` |
|
||||||
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
|
| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` |
|
||||||
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||||
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
|
||||||
| `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` |
|
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` |
|
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` |
|
| `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` |
|
||||||
|
| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` |
|
||||||
|
| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` |
|
||||||
|
|||||||
@@ -114,6 +114,8 @@ plugins:
|
|||||||
# can authenticate the kubelet cert, so skip validation.
|
# can authenticate the kubelet cert, so skip validation.
|
||||||
skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }}
|
skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }}
|
||||||
disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }}
|
disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }}
|
||||||
|
use_new_container_locator: {{ .Values.workloadAttestors.k8s.useNewContainerLocator }}
|
||||||
|
verbose_container_locator_logs: {{ .Values.workloadAttestors.k8s.verboseContainerLocatorLogs }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
{{- if .Values.workloadAttestors.unix.enabled }}
|
{{- if .Values.workloadAttestors.unix.enabled }}
|
||||||
|
|||||||
@@ -213,6 +213,10 @@ workloadAttestors:
|
|||||||
skipKubeletVerification: true
|
skipKubeletVerification: true
|
||||||
## @param workloadAttestors.k8s.disableContainerSelectors Set to true if using holdApplicationUntilProxyStarts in Istio
|
## @param workloadAttestors.k8s.disableContainerSelectors Set to true if using holdApplicationUntilProxyStarts in Istio
|
||||||
disableContainerSelectors: false
|
disableContainerSelectors: false
|
||||||
|
## @param workloadAttestors.k8s.useNewContainerLocator If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false
|
||||||
|
useNewContainerLocator: false
|
||||||
|
## @param workloadAttestors.k8s.verboseContainerLocatorLogs If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false
|
||||||
|
verboseContainerLocatorLogs: false
|
||||||
|
|
||||||
sds:
|
sds:
|
||||||
## @param sds.enabled Enables Envoy SDS configuration
|
## @param sds.enabled Enables Envoy SDS configuration
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ name: spire-server
|
|||||||
description: A Helm chart to install the SPIRE server.
|
description: A Helm chart to install the SPIRE server.
|
||||||
type: application
|
type: application
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
appVersion: "1.9.5"
|
appVersion: "1.9.6"
|
||||||
keywords: ["spiffe", "spire-server", "spire-controller-manager"]
|
keywords: ["spiffe", "spire-server", "spire-controller-manager"]
|
||||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||||
sources:
|
sources:
|
||||||
|
|||||||
Reference in New Issue
Block a user