Move spire-server to dedicated subchart

Signed-off-by: Marco Franssen <[email protected]> Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:10 +01:00
parent e312d42350
commit ce9b58e725
24 changed files with 430 additions and 252 deletions
@@ -0,0 +1,107 @@
+# Default values for spire-server.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+replicaCount: 1
+
+image:
+  # registry: gcr.io
+  # repository: spiffe-io/spire-server
+  registry: ghcr.io
+  repository: spiffe/spire-server
+  pullPolicy: IfNotPresent
+  # Overrides the image tag whose default is the chart appVersion.
+  version: ""
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+podAnnotations: {}
+
+podSecurityContext: {}
+  # fsGroup: 2000
+
+securityContext: {}
+  # capabilities:
+  #   drop:
+  #   - ALL
+  # readOnlyRootFilesystem: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
+
+service:
+  type: ClusterIP
+  port: 8081
+  annotations: {}
+
+resources: {}
+  # We usually recommend not to specify default resources and to leave this as a conscious
+  # choice for the user. This also increases chances charts run on environments with little
+  # resources, such as Minikube. If you do want to specify resources, uncomment the following
+  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+  # requests:
+  #   cpu: 200m
+  #   memory: 256Mi
+  # limits:
+  #   cpu: 200m
+  #   memory: 256Mi
+
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 100
+  targetCPUUtilizationPercentage: 80
+  # targetMemoryUtilizationPercentage: 80
+
+nodeSelector:
+  kubernetes.io/arch: amd64
+
+tolerations: []
+
+affinity: {}
+
+topologySpreadConstraints: []
+
+dataStorage:
+  enabled: true
+  size: 1Gi
+  accessMode: ReadWriteOnce
+  storageClass: null
+
+logLevel: info
+socketPath: /run/spire/server-sockets/spire-server.sock
+jwtIssuer: oidc-discovery.example.org
+
+clusterName: example-cluster
+trustDomain: example.org
+
+bundleConfigMap: spire-server
+
+ca_subject:
+  country: NL
+  organization: Example
+  common_name: example.org
+
+upstreamAuthority:
+  disk:
+    enabled: false
+    secret:
+      # -- If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself.
+      create: true
+      # -- If secret creation is disabled, the secret with this name will be used.
+      name: "spiffe-upstream-ca"
+      # -- If secret creation is enabled, will create a secret with following certificate info
+      data:
+        certificate: ""
+        key: ""
+        bundle: ""