panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enable CA settings via global (#268)

Browse Source 
Adds a global.spire.caSubject section where you can set the CA
subject information for all spire-server instances.

Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
2024-02-28 11:47:24 -08:00
committed by GitHub
parent ac83694970
commit c57017425e
4 changed files with 36 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+7 -6
View File
@@ -34,12 +34,10 @@ global:
# Update these
clusterName: example-cluster
trustDomain: example.org
spire-server:
ca_subject:
# Update these
country: ARPA
organization: Example
common_name: example.org
caSubject:
country: ARPA
organization: Example
commonName: example.org
```
2. If you need a non default storageClass, append the following to the spire-server section and update:
@@ -214,6 +212,9 @@ Now you can interact with the Spire agent socket from your own application. The
| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset | `""` |
| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` |
| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` |
| `global.spire.caSubject.country` | Country for Spire server CA | `""` |
| `global.spire.caSubject.organization` | Organization for Spire server CA | `""` |
| `global.spire.caSubject.commonName` | Common Name for Spire server CA | `""` |
| `global.spire.recommendations.enabled` | Use recommended settings for production deployments. Default is off. | `false` |
| `global.spire.recommendations.namespaceLayout` | Set to true to use recommended values for installing across namespaces | `true` |
| `global.spire.recommendations.namespacePSS` | When chart namespace creation is enabled, label them with preffered Pod Security Standard labels | `true` |