Move spire-server to dedicated subchart

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/charts/spire-agent/README.md

@@ -10,6 +10,7 @@ A Helm chart to install the SPIRE agent.
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
+| bundleConfigMap | string | `"spire-bundle"` |  |
 | clusterName | string | `"example-cluster"` |  |
 | fullnameOverride | string | `""` |  |
 | image.pullPolicy | string | `"IfNotPresent"` |  |

charts/spire/charts/spire-agent/templates/daemonset.yaml

@@ -79,7 +79,7 @@ spec:
             name: {{ include "spire-agent.fullname" . }}
         - name: spire-bundle
           configMap:
-            name: spire-bundle
+            name: {{ .Values.bundleConfigMap }}
         - name: spire-token
           projected:
             sources:

charts/spire/charts/spire-agent/values.yaml

@@ -57,6 +57,8 @@ socketPath: /run/spire/agent-sockets/spire-agent.sock
 clusterName: example-cluster
 trustDomain: example.org
 
+bundleConfigMap: spire-bundle
+
 server:
   host: spire-server
   port: 8081

charts/spire/charts/spire-server/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/spire/charts/spire-server/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: spire-server
+description: A Helm chart to install the SPIRE server.
+type: application
+version: 0.1.0
+appVersion: "1.5.3"

charts/spire/charts/spire-server/README.md

@@ -0,0 +1,55 @@
+# spire-server
+
+<!-- This README.md is generated. -->
+
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.3](https://img.shields.io/badge/AppVersion-1.5.3-informational?style=flat-square)
+
+A Helm chart to install the SPIRE server.
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| affinity | object | `{}` |  |
+| autoscaling.enabled | bool | `false` |  |
+| autoscaling.maxReplicas | int | `100` |  |
+| autoscaling.minReplicas | int | `1` |  |
+| autoscaling.targetCPUUtilizationPercentage | int | `80` |  |
+| bundleConfigMap | string | `"spire-server"` |  |
+| ca_subject.common_name | string | `"example.org"` |  |
+| ca_subject.country | string | `"NL"` |  |
+| ca_subject.organization | string | `"Example"` |  |
+| clusterName | string | `"example-cluster"` |  |
+| dataStorage.accessMode | string | `"ReadWriteOnce"` |  |
+| dataStorage.enabled | bool | `true` |  |
+| dataStorage.size | string | `"1Gi"` |  |
+| dataStorage.storageClass | string | `nil` |  |
+| fullnameOverride | string | `""` |  |
+| image.pullPolicy | string | `"IfNotPresent"` |  |
+| image.registry | string | `"ghcr.io"` |  |
+| image.repository | string | `"spiffe/spire-server"` |  |
+| image.version | string | `""` |  |
+| imagePullSecrets | list | `[]` |  |
+| jwtIssuer | string | `"oidc-discovery.example.org"` |  |
+| logLevel | string | `"info"` |  |
+| nameOverride | string | `""` |  |
+| nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |
+| podAnnotations | object | `{}` |  |
+| podSecurityContext | object | `{}` |  |
+| replicaCount | int | `1` |  |
+| resources | object | `{}` |  |
+| securityContext | object | `{}` |  |
+| service.annotations | object | `{}` |  |
+| service.port | int | `8081` |  |
+| service.type | string | `"ClusterIP"` |  |
+| serviceAccount.annotations | object | `{}` |  |
+| serviceAccount.create | bool | `true` |  |
+| serviceAccount.name | string | `""` |  |
+| socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` |  |
+| tolerations | list | `[]` |  |
+| topologySpreadConstraints | list | `[]` |  |
+| trustDomain | string | `"example.org"` |  |
+| upstreamAuthority.disk.enabled | bool | `false` |  |
+| upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. |
+| upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info |
+| upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. |

charts/spire/charts/spire-server/templates/NOTES.txt

@@ -0,0 +1,6 @@
+Installed {{ .Chart.Name }}…
+
+1. Get the currently registered SPIFFE entries from the server:
+
+  kubectl exec -n {{ .Release.Namespace }} {{ include "spire-server.fullname" . }}-0 -c spire-server -- \
+    bin/spire-server entry show -socketPath {{ .Values.socketPath }}

charts/spire/charts/spire-server/templates/_helpers.tpl

@@ -0,0 +1,86 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "spire-server.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "spire-server.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "spire-server.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "spire-server.labels" -}}
+helm.sh/chart: {{ include "spire-server.chart" . }}
+{{ include "spire-server.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "spire-server.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "spire-server.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "spire-server.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "spire-server.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-server.image" -}}
+{{- if eq (substr 0 7 .image.version) "sha256:" -}}
+{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
+{{- else if .appVersion -}}
+{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
+{{- else if .image.version -}}
+{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
+{{- else -}}
+{{- printf "%s/%s" .image.registry .image.repository -}}
+{{- end -}}
+{{- end }}
+
+
+{{- define "spire-server.upstream-ca-secret" -}}
+{{- $root := . }}
+{{- with .Values.upstreamAuthority.disk -}}
+{{- if eq (.secret.create | toString) "true" -}}
+{{ include "spire.fullname" $root }}-upstream-ca
+{{- else -}}
+{{ default (include "spire.fullname" $root) .secret.name }}
+{{- end -}}
+{{- end -}}
+{{- end }}

charts/spire/charts/spire-server/templates/bundle-configmap.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Values.bundleConfigMap }}
+  namespace: {{ .Release.Namespace }}

charts/spire/charts/spire-server/templates/configmap.yaml

@@ -0,0 +1,83 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "spire-server.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+data:
+  server.conf: |
+    server {
+      bind_address = "0.0.0.0"
+      bind_port = "8081"
+      socket_path = {{ .Values.socketPath | quote }}
+      trust_domain = {{ .Values.trustDomain | quote }}
+      data_dir = "/run/spire/data"
+      log_level = "{{ .Values.logLevel }}"
+      # AWS requires the use of RSA.  EC cryptography is not supported
+      ca_key_type = "rsa-2048"
+
+      jwt_issuer = "{{ .Values.jwtIssuer }}"
+
+      default_x509_svid_ttl = "1h"
+      default_jwt_svid_ttl = "1h"
+      ca_subject = {
+        {{- with .Values.ca_subject }}
+        country = [{{ .country | quote }}],
+        organization = [{{ .organization | quote }}],
+        common_name = {{ .common_name | quote }},
+        {{- end }}
+      }
+    }
+
+    plugins {
+      DataStore "sql" {
+        plugin_data {
+          database_type = "sqlite3"
+          connection_string = "/run/spire/data/datastore.sqlite3"
+        }
+      }
+
+      NodeAttestor "k8s_psat" {
+        plugin_data {
+          clusters = {
+            {{ .Values.clusterName | quote }} = {
+              service_account_allow_list = ["{{ .Release.Namespace }}:spire-agent"]
+            }
+          }
+        }
+      }
+
+      KeyManager "disk" {
+        plugin_data {
+          keys_path = "/run/spire/data/keys.json"
+        }
+      }
+
+      Notifier "k8sbundle" {
+        plugin_data {
+          namespace = "{{ .Release.Namespace }}"
+          config_map = {{ .Values.bundleConfigMap | quote }}
+        }
+      }
+
+      {{- with .Values.upstreamAuthority.disk }}
+      {{- if eq (.enabled | toString) "true" }}
+      UpstreamAuthority "disk" {
+        plugin_data {
+          cert_file_path = "/run/spire/upstream_ca/tls.crt"
+          key_file_path = "/run/spire/upstream_ca/tls.key"
+          {{- if ne .secret.data.bundle "" }}
+          bundle_file_path = "/run/spire/upstream_ca/bundle.crt"
+          {{- end }}
+        }
+      }
+      {{- end }}
+      {{- end }}
+    }
+
+    health_checks {
+      listener_enabled = true
+      bind_address = "0.0.0.0"
+      bind_port = "8080"
+      live_path = "/live"
+      ready_path = "/ready"
+    }

charts/spire/charts/spire-server/templates/hpa.yaml

@@ -0,0 +1,28 @@
+{{- if .Values.autoscaling.enabled }}
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "spire-server.fullname" . }}
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "spire-server.fullname" . }}
+  minReplicas: {{ .Values.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+    {{- end }}
+    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    {{- end }}
+{{- end }}

charts/spire/charts/spire-server/templates/roles.yaml

@@ -0,0 +1,68 @@
+# ClusterRole to allow spire-server node attestor to query Token Review API
+# and to be able to push certificate bundles to a configmap
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire-server.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+rules:
+  # allow "get" access to pods (to resolve selectors for PSAT attestation)
+  - apiGroups: [""]
+    resources: [pods]
+    verbs: [get]
+    # allow access to "get" and "patch" the spire-bundle ConfigMap (for SPIRE
+    # agent bootstrapping, see the spire-bundle ConfigMap below)
+  - apiGroups: [""]
+    resources: [configmaps]
+    resourceNames: [{{ .Values.bundleConfigMap }}]
+    verbs:
+      - get
+      - patch
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire-server.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "spire-server.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: {{ include "spire-server.fullname" . }}
+  apiGroup: rbac.authorization.k8s.io
+---
+# ClusterRole to allow spire-server node attestor to query Token Review API
+# and to be able to push certificate bundles to a configmap
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire-server.fullname" . }}
+rules:
+    # allow TokenReview requests (to verify service account tokens for PSAT
+    # attestation)
+  - apiGroups: [authentication.k8s.io]
+    resources: [tokenreviews]
+    verbs:
+      - get
+      - create
+  - apiGroups: [""]
+    resources: [nodes]
+    verbs:
+      - get
+---
+# Binds above cluster role to spire-server service account
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire-server.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "spire-server.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "spire-server.fullname" . }}
+  apiGroup: rbac.authorization.k8s.io

charts/spire/charts/spire-server/templates/service.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "spire-server.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 8 }}
+  {{- end }}
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - name: grpc
+      port: {{ .Values.service.port }}
+      targetPort: grpc
+      protocol: TCP
+  selector:
+    {{- include "spire-server.selectorLabels" . | nindent 4 }}

charts/spire/charts/spire-server/templates/serviceaccount.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "spire-server.serviceAccountName" . }}
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

charts/spire/charts/spire-server/templates/statefulset.yaml

@@ -0,0 +1,121 @@
+{{- $fullname := include "spire-server.fullname" . }}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "spire-server.fullname" . }}
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  serviceName: {{ include "spire-server.fullname" . }}
+  selector:
+    matchLabels:
+      {{- include "spire-server.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "spire-server.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "spire-server.serviceAccountName" . }}
+      shareProcessNamespace: true
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args:
+            - -config
+            - /run/spire/config/server.conf
+          ports:
+            - name: grpc
+              containerPort: 8081
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /live
+              port: 8080
+            failureThreshold: 2
+            initialDelaySeconds: 15
+            periodSeconds: 60
+            timeoutSeconds: 3
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: spire-server-socket
+              mountPath: /run/spire/server-sockets
+              readOnly: false
+            - name: spire-config
+              mountPath: /run/spire/config
+              readOnly: true
+            {{- if eq (.Values.dataStorage.enabled | toString) "true" }}
+            - name: spire-data
+              mountPath: /run/spire/data
+              readOnly: false
+            {{- end }}
+            {{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
+            - name: upstream-ca
+              mountPath: /run/spire/upstream_ca
+              readOnly: false
+            {{ end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+        - name: spire-config
+          configMap:
+            name: {{ include "spire-server.fullname" . }}
+        - name: spire-server-socket
+          hostPath:
+            path: /run/spire/server-sockets
+            type: DirectoryOrCreate
+        {{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
+        - name: upstream-ca
+          secret:
+            secretName: {{ include "spire-server.upstream-ca-secret" . }}
+        {{- end }}
+  volumeClaimTemplates:
+    {{- if eq (.Values.dataStorage.enabled | toString) "true" }}
+    - metadata:
+        name: spire-data
+      spec:
+        accessModes:
+          - {{ .Values.dataStorage.accessMode | default "ReadWriteOnce" }}
+        resources:
+          requests:
+            storage: {{ .Values.dataStorage.size }}
+        {{- if .Values.dataStorage.storageClass }}
+        storageClassName: {{ .Values.dataStorage.storageClass }}
+        {{- end }}
+    {{ end }}

charts/spire/charts/spire-server/templates/tests/test-connection.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "spire-server.fullname" . }}-test-connection"
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+spec:
+  containers:
+    - name: wget
+      image: busybox
+      command: ['nc']
+      args: ['-zvw3', '{{ include "spire-server.fullname" . }}', '{{ .Values.service.port }}']
+  restartPolicy: Never

charts/spire/charts/spire-server/templates/upstream-ca-secret.yaml

@@ -0,0 +1,20 @@
+{{- $root := . }}
+{{- with .Values.upstreamAuthority.disk }}
+{{- if and (eq (.enabled | toString) "true") (eq (.secret.create | toString) "true") }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "spire-server.upstream-ca-secret" $root }}
+  namespace: {{ $root.Release.Namespace }}
+  labels:
+    {{- include "spire-server.labels" $root | nindent 4 }}
+data:
+  {{- with .secret.data }}
+  tls.crt: {{ .certificate | b64enc }}
+  tls.key: {{ .key | b64enc }}
+  {{- if ne .bundle ""}}
+  bundle.crt: {{ .bundle | b64enc }}
+  {{- end }}
+  {{- end }}
+{{- end }}
+{{- end }}

charts/spire/charts/spire-server/values.yaml

@@ -0,0 +1,107 @@
+# Default values for spire-server.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+replicaCount: 1
+
+image:
+  # registry: gcr.io
+  # repository: spiffe-io/spire-server
+  registry: ghcr.io
+  repository: spiffe/spire-server
+  pullPolicy: IfNotPresent
+  # Overrides the image tag whose default is the chart appVersion.
+  version: ""
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+podAnnotations: {}
+
+podSecurityContext: {}
+  # fsGroup: 2000
+
+securityContext: {}
+  # capabilities:
+  #   drop:
+  #   - ALL
+  # readOnlyRootFilesystem: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
+
+service:
+  type: ClusterIP
+  port: 8081
+  annotations: {}
+
+resources: {}
+  # We usually recommend not to specify default resources and to leave this as a conscious
+  # choice for the user. This also increases chances charts run on environments with little
+  # resources, such as Minikube. If you do want to specify resources, uncomment the following
+  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+  # requests:
+  #   cpu: 200m
+  #   memory: 256Mi
+  # limits:
+  #   cpu: 200m
+  #   memory: 256Mi
+
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 100
+  targetCPUUtilizationPercentage: 80
+  # targetMemoryUtilizationPercentage: 80
+
+nodeSelector:
+  kubernetes.io/arch: amd64
+
+tolerations: []
+
+affinity: {}
+
+topologySpreadConstraints: []
+
+dataStorage:
+  enabled: true
+  size: 1Gi
+  accessMode: ReadWriteOnce
+  storageClass: null
+
+logLevel: info
+socketPath: /run/spire/server-sockets/spire-server.sock
+jwtIssuer: oidc-discovery.example.org
+
+clusterName: example-cluster
+trustDomain: example.org
+
+bundleConfigMap: spire-server
+
+ca_subject:
+  country: NL
+  organization: Example
+  common_name: example.org
+
+upstreamAuthority:
+  disk:
+    enabled: false
+    secret:
+      # -- If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself.
+      create: true
+      # -- If secret creation is disabled, the secret with this name will be used.
+      name: "spiffe-upstream-ca"
+      # -- If secret creation is enabled, will create a secret with following certificate info
+      data:
+        certificate: ""
+        key: ""
+        bundle: ""