Experimental support for spire-identity-exchange (#860)
* Experimental support for spire-identity-exchange Signed-off-by: Kevin Fox <[email protected]> * Fix image name Signed-off-by: Kevin Fox <[email protected]> * Fix flags Signed-off-by: Kevin Fox <[email protected]> * Fix ghosted section Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Add some missing bits Signed-off-by: Kevin Fox <[email protected]> * Some more implementation Signed-off-by: Kevin Fox <[email protected]> * Update tests Signed-off-by: Kevin Fox <[email protected]> * Add ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Rework x509pop to work shared Signed-off-by: Kevin Fox <[email protected]> * Rework x509pop to work shared Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Fix path Signed-off-by: Kevin Fox <[email protected]> * Fix path Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fix static entry Signed-off-by: Kevin Fox <[email protected]> * Cleanup Signed-off-by: Kevin Fox <[email protected]> * Remove unused change Signed-off-by: Kevin Fox <[email protected]> * Update spire-identity-exchange. Start to test. Signed-off-by: Kevin Fox <[email protected]> * fixes Signed-off-by: Kevin Fox <[email protected]> * Update lock Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Fix broken test. Correct default dns names. Signed-off-by: Kevin Fox <[email protected]> * Fix merge issue Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
This commit is contained in:
kfox1111
@@ -32,5 +32,8 @@ dependencies:
|
||||
- name: spike-pilot
|
||||
repository: file://./charts/spike-pilot
|
||||
version: 0.1.0
|
||||
digest: sha256:c93438bb4c5317a25ffef1ce93dbd6c9dbd07295e101377e9a2bb8320ee14622
|
||||
generated: "2026-06-06T08:13:02.92098-07:00"
|
||||
- name: spire-identity-exchange
|
||||
repository: file://../spire-identity-exchange
|
||||
version: 0.1.0
|
||||
digest: sha256:38b85a4bf147cc86a432ac32dfd3473e27efc6b6a3c1563340444bbe049a4746
|
||||
generated: "2026-06-27T10:53:07.840372246-07:00"
|
||||
|
||||
@@ -68,6 +68,10 @@ dependencies:
|
||||
condition: spike-pilot.enabled
|
||||
repository: file://./charts/spike-pilot
|
||||
version: 0.1.0
|
||||
- name: spire-identity-exchange
|
||||
condition: spire-identity-exchange.enabled
|
||||
repository: file://../spire-identity-exchange
|
||||
version: 0.1.0
|
||||
annotations:
|
||||
org.opencontainers.image.source: https://github.com/spiffe/helm-charts-hardened
|
||||
artifacthub.io/category: security
|
||||
|
||||
+11
-3
@@ -79,6 +79,12 @@ kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeid
|
||||
|
||||
We only support upgrading one major/minor version at a time. Version skipping isn't supported. Please see <https://spiffe.io/docs/latest/spire-helm-charts-hardened-about/upgrading/> for details.
|
||||
|
||||
### 0.31.X
|
||||
|
||||
- The x509POP plugin in spiffe mode has had its defaults changed. It allows easier and more secure setups. If using and upgrading, please review the settings.
|
||||
- To add the spike entries, you now must also specify spire-server.spike.enabled=true.
|
||||
- Experimental support for the spire-identity-exchange has been added.
|
||||
|
||||
### 0.30.X
|
||||
|
||||
- The OIDC discovery issuer is now set automatically. We do not anticipate any negative impact; however, please verify your OIDC provider's integration with other services during your upgrade testing.
|
||||
@@ -389,6 +395,8 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
|
||||
### SPIKE Pilot parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------- | ------------------------------------------------------ | ------- |
|
||||
| `spike-pilot.enabled` | Enables deployment of SPIKE Pilot (Not for production) | `false` |
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------- | ---------------------------------------------------------------------- | ------------------- |
|
||||
| `spike-pilot.enabled` | Enables deployment of SPIKE Pilot (Not for production) | `false` |
|
||||
| `spire-identity-exchange.enabled` | Enables deployment of the SPIRE Identity Exchange (Not for production) | `false` |
|
||||
| `spire-identity-exchange.nameOverride` | Overrides the name of the SPIRE Identity Exchnage | `identity-exchange` |
|
||||
|
||||
@@ -231,7 +231,7 @@ nodeAttestor:
|
||||
|
||||
# workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
|
||||
workloadAttestors:
|
||||
# unix is a workload attestor which generates unix-based selectors like 'uid' and 'gid'.
|
||||
# unix is a workload attestor which generates unix-based selectors like 'uid' and 'gid'.
|
||||
unix:
|
||||
## @param workloadAttestors.unix.enabled Enables the Unix workload attestor
|
||||
enabled: false
|
||||
|
||||
@@ -79,427 +79,439 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
|
||||
### Chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
|
||||
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/spire-server` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `kind` | Define SPIRE server deployment type. Can be statefulset/deployment. Defaults to statefulset if not set. This feature is experimental. | `statefulset` |
|
||||
| `externalServer` | Deploy only the bundle ConfigMap, RBAC rules, and identity documents but not the server. Use in a nested setup where the server is external. | `false` |
|
||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||
| `nameOverride` | Name override | `""` |
|
||||
| `crNameOverride` | Name override for any custom resources | `""` |
|
||||
| `namespaceOverride` | Namespace override | `""` |
|
||||
| `fullnameOverride` | Fullname override | `""` |
|
||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
||||
| `podAnnotations` | Annotations to add to pods | `{}` |
|
||||
| `podLabels` | Labels to add to pods | `{}` |
|
||||
| `podSecurityContext` | Pod security context | `{}` |
|
||||
| `securityContext` | Security context | `{}` |
|
||||
| `priorityClassName` | Priority class assigned to statefulset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||
| `service.type` | Type of the Spire server service created | `ClusterIP` |
|
||||
| `service.port` | Port for the created service | `443` |
|
||||
| `service.annotations` | Annotations to add to the service object | `{}` |
|
||||
| `service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` |
|
||||
| `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` |
|
||||
| `resources` | Resource requests and limits | `{}` |
|
||||
| `autoscaling.enabled` | Flag to enable autoscaling | `false` |
|
||||
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
|
||||
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` |
|
||||
| `autoscaling.scaleOnSPIREServerOnly` | Flag to only consider the main SPIRE container for autoscaling purposes | `false` |
|
||||
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization that triggers autoscaling | `80` |
|
||||
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` |
|
||||
| `tolerations` | List of tolerations | `[]` |
|
||||
| `affinity` | List of node affinities | `{}` |
|
||||
| `topologySpreadConstraints` | Topology spread constraints for resilience | `[]` |
|
||||
| `terminationGracePeriodSeconds` | Override the termination grace period for the pod. Increase to allow time for load balancer target deregistration and in-flight gRPC drain before SIGKILL. | `nil` |
|
||||
| `livenessProbe.failureThreshold` | Failure threshold count for livenessProbe | `2` |
|
||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `15` |
|
||||
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `60` |
|
||||
| `livenessProbe.timeoutSeconds` | Timeout in seconds for livenessProbe | `3` |
|
||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
||||
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
||||
| `persistence.type` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing or nested child only) | `pvc` |
|
||||
| `persistence.size` | What size volume to use for persistence | `1Gi` |
|
||||
| `persistence.accessMode` | What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) | `ReadWriteOnce` |
|
||||
| `persistence.storageClass` | What storage class to use for persistence | `nil` |
|
||||
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `""` |
|
||||
| `dataStore.sql.databaseType` | Other supported databases are ["postgres", "mysql", "aws_postgresql", "aws_mysql", "gcp_mysql_sa_iam"]. Note: aws type databases are still experimental. gcp_mysql_sa_iam uses IAM authentication by default. | `sqlite3` |
|
||||
| `dataStore.sql.databaseName` | Only used when type != "sqlite3" | `spire` |
|
||||
| `dataStore.sql.host` | Only used when type != "sqlite3" | `""` |
|
||||
| `dataStore.sql.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` |
|
||||
| `dataStore.sql.username` | Only used when type != "sqlite3" | `spire` |
|
||||
| `dataStore.sql.password` | Only used when type != "sqlite3" | `""` |
|
||||
| `dataStore.sql.file` | Data source file. Only used when type == "sqlite3" | `/run/spire/data/datastore.sqlite3` |
|
||||
| `dataStore.sql.options` | takes an array of objects of form {<key>: <value>} to use when building the database connection string | `[]` |
|
||||
| `dataStore.sql.rootCAPath` | Path to Root CA bundle (MySQL only) | `""` |
|
||||
| `dataStore.sql.clientCertPath` | Path to client certificate (MySQL only) | `""` |
|
||||
| `dataStore.sql.clientKeyPath` | Path to private key for client certificate (MySQL only) | `""` |
|
||||
| `dataStore.sql.externalSecret.enabled` | Enable external secret for datastore creds | `false` |
|
||||
| `dataStore.sql.externalSecret.name` | The name of the secret object | `""` |
|
||||
| `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
|
||||
| `dataStore.sql.maxOpenConns` | The maximum number of open db connections | `100` |
|
||||
| `dataStore.sql.maxIdleConns` | The maximum number of idle connections in the pool | `2` |
|
||||
| `dataStore.sql.connMaxLifetime` | The maximum amount of time a connection may be reused. Supports duration strings (e.g., "1h", "30m", "3600s") or 0 for unlimited. Duration strings are recommended to prevent connection accumulation. | `0` |
|
||||
| `dataStore.sql.disableMigration` | True to disable auto-migration functionality | `false` |
|
||||
| `dataStore.sql.region` | Region to use when database type is either aws_mysql or aws_postgresql | `""` |
|
||||
| `dataStore.sql.readOnly.enabled` | Set to true to configure a readOnly dartabase connection | `false` |
|
||||
| `dataStore.sql.readOnly.host` | Only used when type != "sqlite3" | `""` |
|
||||
| `dataStore.sql.readOnly.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` |
|
||||
| `dataStore.sql.readOnly.username` | Only used when type != "sqlite3" | `spire` |
|
||||
| `dataStore.sql.readOnly.password` | Only used when type != "sqlite3" | `""` |
|
||||
| `dataStore.sql.readOnly.options` | Only used when type != "sqlite3" | `[]` |
|
||||
| `dataStore.sql.readOnly.externalSecret.enabled` | Enable external secret for datastore creds | `false` |
|
||||
| `dataStore.sql.readOnly.externalSecret.name` | The name of the secret object | `""` |
|
||||
| `dataStore.sql.readOnly.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
|
||||
| `adminIDs` | SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges. | `[]` |
|
||||
| `auditLogEnabled` | If true, enables audit logging | `false` |
|
||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||
| `logFormat` | The log format, valid values are "text" and "json" | `text` |
|
||||
| `jwtIssuer` | The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset | `""` |
|
||||
| `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` |
|
||||
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||
| `bundleConfigMap` | Set the Configmap name for SPIRE bundle | `spire-bundle` |
|
||||
| `clusterDomain` | This is the value of your clusters `kubeadm init --service-dns-domain` flag | `cluster.local` |
|
||||
| `jwtSVIDSupport` | If false, completely disables JWT-SVID functionality. The server will not generate JWT keys, sign JWT-SVIDs, or implement JWT-related API calls. This is useful for deployments that don’t need JWT-SVIDs support. | `true` |
|
||||
| `federation.enabled` | Flag to enable federation | `false` |
|
||||
| `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` |
|
||||
| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` |
|
||||
| `federation.bundleEndpoint.refreshHint` | Hint used by federated servers on how often to refresh the bundle. CA TTL must be 3-5x the duration of this value to ensure public keys are loaded on federated servers prior to private key rotation on remote server. | `5m` |
|
||||
| `federation.bundleEndpoint.profile.httpWeb.fileSyncInterval` | Interval on which to reload the certificate/key from disk | `1h` |
|
||||
| `federation.tls.spire.enabled` | Use spire to secure the federation bundle endpoint | `true` |
|
||||
| `federation.tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` |
|
||||
| `federation.tls.externalSecret.secretName` | Specify which Secret to use | `""` |
|
||||
| `federation.tls.certManager.enabled` | Use certificateManager to create the certificate | `false` |
|
||||
| `federation.tls.certManager.issuer.create` | Create an issuer to use to issue the certificate | `true` |
|
||||
| `federation.tls.certManager.issuer.acme.email` | Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service | `""` |
|
||||
| `federation.tls.certManager.issuer.acme.server` | Server to use to get certificate. Defaults to LetsEncrypt | `https://acme-v02.api.letsencrypt.org/directory` |
|
||||
| `federation.tls.certManager.issuer.acme.solvers` | Configure the issuer solvers. Defaults to http01 via ingress. | `{}` |
|
||||
| `federation.tls.certManager.certificate.dnsNames` | Override the dnsNames on the certificate request. Defaults to the same settings as Ingress | `[]` |
|
||||
| `federation.tls.certManager.certificate.issuerRef.group` | If you are using an external plugin, specify the group for it here | `""` |
|
||||
| `federation.tls.certManager.certificate.issuerRef.kind` | Kind of the issuer reference. Override if you want to use a ClusterIssuer | `Issuer` |
|
||||
| `federation.tls.certManager.certificate.issuerRef.name` | Name of the issuer to use. If unset, it will use the name of the built in issuer | `""` |
|
||||
| `federation.ingress.enabled` | Flag to enable ingress for federation | `false` |
|
||||
| `federation.ingress.className` | Ingress class name for federation | `""` |
|
||||
| `federation.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||
| `federation.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server-federation` |
|
||||
| `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `federation.ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
||||
| `federation.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `caSubject.country` | Country for Spire server CA | `ARPA` |
|
||||
| `caSubject.organization` | Organization for Spire server CA | `Example` |
|
||||
| `caSubject.commonName` | Common Name for Spire server CA | `example.org` |
|
||||
| `credentialComposer.cel.enabled` | Enable the cel based credential composer | `false` |
|
||||
| `credentialComposer.cel.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `credentialComposer.cel.image.repository` | The repository within the registry | `spiffe/spire-credentialcomposer-cel` |
|
||||
| `credentialComposer.cel.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `credentialComposer.cel.image.tag` | Overrides the image tag | `0.0.2` |
|
||||
| `credentialComposer.cel.checksum` | The sha256 checksum of the plugin binary | `23fa1d10f15ad5d5c555930cf82289c664801d7d5609bfd8847f95a0a667e4e4` |
|
||||
| `credentialComposer.cel.pluginPath` | The filename in the container of the plugin | `/ko-app/cmd` |
|
||||
| `credentialComposer.cel.jwt.expression` | The expression to use for jwt token composing | `""` |
|
||||
| `credentialComposer.uniqueID.enabled` | Add the x509UniqueIdentifier attribute to workload X509-SVIDs | `false` |
|
||||
| `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` |
|
||||
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
|
||||
| `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` |
|
||||
| `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` |
|
||||
| `keyManager.awsKMS.keyIdentifierFile.enabled` | Enable key identifier data to be stored in a file in persistent storage. | `false` |
|
||||
| `keyManager.awsKMS.keyIdentifierValue.enabled` | Enable specifying a key identifier value for AWS KMS | `false` |
|
||||
| `keyManager.awsKMS.keyIdentifierValue.identifier` | Static identifier for the SPIRE server instance | `""` |
|
||||
| `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | |
|
||||
| `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` |
|
||||
| `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` |
|
||||
| `keyManager.awsKMS.keyTags` | Custom tags to apply to KMS keys created by the plugin. Tags are key-value pairs used for resource management and cost allocation. When using key tagging, you must add the `kms:TagResource` permission to your IAM policy. Constraints: keys (1-128 chars), values (0-256 chars), max 50 tags, valid chars (letters, numbers, spaces, + - = . _ : / @), keys cannot start with 'aws:' or 'spire-'. | `{}` |
|
||||
| `keyManager.awsKMS.accessKeyID` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. | `""` |
|
||||
| `keyManager.awsKMS.secretAccessKey` | Secret access key for the AWS account. | `""` |
|
||||
| `upstreamAuthority.disk.enabled` | Flag to enable upstream authority plugin on disk | `false` |
|
||||
| `upstreamAuthority.disk.secret.create` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | `true` |
|
||||
| `upstreamAuthority.disk.secret.name` | If secret creation is disabled, the secret with this name will be used. | `spiffe-upstream-ca` |
|
||||
| `upstreamAuthority.disk.secret.data` | If secret creation is enabled, will create a secret with following certificate info | |
|
||||
| `upstreamAuthority.disk.secret.data.certificate` | Certificate to store within disk upstreamAuthority. | `""` |
|
||||
| `upstreamAuthority.disk.secret.data.key` | Key corresponding to the upstreamAuthority. | `""` |
|
||||
| `upstreamAuthority.disk.secret.data.bundle` | Trust bundle for upstreamAuthority. | `""` |
|
||||
| `upstreamAuthority.awsPCA.enabled` | Flag to enable upstream authority plugin with AWS PCA | `false` |
|
||||
| `upstreamAuthority.awsPCA.region` | AWS Region to use | `""` |
|
||||
| `upstreamAuthority.awsPCA.certificateAuthorityARN` | ARN of the "upstream" CA certificate | `""` |
|
||||
| `upstreamAuthority.awsPCA.assumeRoleARN` | (Optional) ARN of an IAM role to assume | `""` |
|
||||
| `upstreamAuthority.awsPCA.caSigningTemplateARN` | (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. | `""` |
|
||||
| `upstreamAuthority.awsPCA.signingAlgorithm` | (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | `""` |
|
||||
| `upstreamAuthority.awsPCA.endpoint` | (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | `""` |
|
||||
| `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` |
|
||||
| `upstreamAuthority.awsSecret.enabled` | Flag to enable upstream authority plugin with AWS Secrets Manager | `false` |
|
||||
| `upstreamAuthority.awsSecret.region` | AWS Region to use | `""` |
|
||||
| `upstreamAuthority.awsSecret.certFileArn` | ARN or name of the secret containing the intermediate CA certificate | `""` |
|
||||
| `upstreamAuthority.awsSecret.keyFileArn` | ARN or name of the secret containing the intermediate CA private key | `""` |
|
||||
| `upstreamAuthority.awsSecret.bundleFileArn` | (Optional) ARN or name of the secret containing the root CA bundle | `""` |
|
||||
| `upstreamAuthority.awsSecret.assumeRoleArn` | (Optional) ARN of an IAM role to assume | `""` |
|
||||
| `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` |
|
||||
| `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` |
|
||||
| `upstreamAuthority.certManager.issuerName` | Defaults to the release name, override if CA is provided outside of the chart | `""` |
|
||||
| `upstreamAuthority.certManager.issuerKind` | Defaults to "Issuer", override if CA is provided outside of the chart | `Issuer` |
|
||||
| `upstreamAuthority.certManager.issuerGroup` | Defaults to "cert-manager.io", override if CA is provided outside of the chart | `cert-manager.io` |
|
||||
| `upstreamAuthority.certManager.namespace` | Specify to use a namespace other then the one the chart is installed into | `""` |
|
||||
| `upstreamAuthority.certManager.kubeConfigFile` | Path to kube config file on node to setup cert manager | `""` |
|
||||
| `upstreamAuthority.certManager.ca.create` | Creates a Cert-Manager CA | `false` |
|
||||
| `upstreamAuthority.certManager.ca.duration` | Duration of the CA. Defaults to 10 years | `87600h` |
|
||||
| `upstreamAuthority.certManager.ca.privateKey.algorithm` | Algorithm to generate private key for CA | `ECDSA` |
|
||||
| `upstreamAuthority.certManager.ca.privateKey.size` | Size of generated private key for CA | `256` |
|
||||
| `upstreamAuthority.certManager.ca.privateKey.rotationPolicy` | Rotation policy for generated private key | `""` |
|
||||
| `upstreamAuthority.certManager.ca.renewBefore` | How long to wait before renewing the CA | `""` |
|
||||
| `upstreamAuthority.spire.enabled` | Flag to use another Spire install as upstream CA | `false` |
|
||||
| `upstreamAuthority.spire.upstreamDriver` | Driver for Spire as upstream CA | `""` |
|
||||
| `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | |
|
||||
| `upstreamAuthority.spire.server.nameOverride` | Override the name for upstream Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
||||
| `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` |
|
||||
| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `443` |
|
||||
| `upstreamAuthority.vault.enabled` | Enable Hashicorp Vault as upstream CA | `false` |
|
||||
| `upstreamAuthority.vault.vaultAddr` | The URL of the Vault server. (e.g., https://vault.example.com:8443/) | `""` |
|
||||
| `upstreamAuthority.vault.namespace` | Name of the Vault namespace. This is only available in the Vault Enterprise. | `""` |
|
||||
| `upstreamAuthority.vault.pkiMountPoint` | Name of the mount point where PKI secret engine is mounted | `pki` |
|
||||
| `upstreamAuthority.vault.insecureSkipVerify` | If true, caCert options are ignored and Spire accepts any server certificates claiming to be Vault | `false` |
|
||||
| `upstreamAuthority.vault.caCert.type` | Type of resource representing the Vault server certificate, options are 'Secret' or 'Configmap', the item must be named `ca.crt` | `Secret` |
|
||||
| `upstreamAuthority.vault.caCert.name` | Name of the Kubernetes resource containing the Vault server certificate | `vault-ca` |
|
||||
| `upstreamAuthority.vault.k8sAuth.enabled` | Enable k8s authentication to Hashicorp Vault | `false` |
|
||||
| `upstreamAuthority.vault.k8sAuth.k8sAuthMountPoint` | Name of the mount point where the Kubernetes auth method is mounted | `kubernetes` |
|
||||
| `upstreamAuthority.vault.k8sAuth.k8sAuthRoleName` | Required - Name of the Vault role. The plugin authenticates against the named role | `""` |
|
||||
| `upstreamAuthority.vault.k8sAuth.token.audience` | Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info. | `vault` |
|
||||
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
|
||||
| `notifier.k8sBundle.enabled` | Enable local k8s bundle uploader | `false` |
|
||||
| `notifier.k8sBundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||
| `notifier.k8sBundle.apiServiceLabel` | If set, rotate the CA Bundle in API services with this label set to true. | `""` |
|
||||
| `notifier.k8sBundle.webhookLabel` | If set, rotate the CA Bundle in validating and mutating webhooks with this label set to true. | `""` |
|
||||
| `notifier.externalK8sBundle.enabled` | Enable external k8s bundle uploader | `false` |
|
||||
| `notifier.externalK8sBundle.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` |
|
||||
| `notifier.externalK8sBundle.defaults.configMap` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` |
|
||||
| `notifier.externalK8sBundle.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `bundle.crt` |
|
||||
| `notifier.externalK8sBundle.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
||||
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
||||
| `controllerManager.staticManifestMode` | Flag to configure static mode. Valid options off, internal, and external. If internal, the identities config options will be rendered to an included configmap | `off` |
|
||||
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
||||
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
||||
| `controllerManager.entryIDPrefixCleanup` | Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` |
|
||||
| `controllerManager.addEntryIDPrefix` | If true, prepends the clusterName to the entryID of each entry the controller manager registers. | `true` |
|
||||
| `controllerManager.gcInterval` | How often the SPIRE state is reconciled when the controller is otherwise idle. This impacts how quickly SPIRE state will converge after CRDs are removed or SPIRE state is mutated underneath the controller. Values are in nanoseconds. | `10000000000` |
|
||||
| `controllerManager.logLevel` | The log level for the controller manager. Supported values are info, error, warn and debug. | `info` |
|
||||
| `controllerManager.logEncoding` | The log encoding for the controller manager. Supported values are console and json. | `console` |
|
||||
| `controllerManager.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` |
|
||||
| `controllerManager.leaderElection.renewDeadline` | Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. | `10s` |
|
||||
| `controllerManager.leaderElection.retryPeriod` | Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. | `2s` |
|
||||
| `controllerManager.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
|
||||
| `controllerManager.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` |
|
||||
| `controllerManager.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` |
|
||||
| `controllerManager.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` |
|
||||
| `controllerManager.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
||||
| `controllerManager.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` |
|
||||
| `controllerManager.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` |
|
||||
| `controllerManager.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
|
||||
| `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
|
||||
| `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` |
|
||||
| `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` |
|
||||
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||
| `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
||||
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.6` |
|
||||
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
||||
| `controllerManager.securityContext` | Security context | `{}` |
|
||||
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
||||
| `controllerManager.service.port` | Service port for controller manager | `443` |
|
||||
| `controllerManager.service.annotations` | Annotations for service resource | `{}` |
|
||||
| `controllerManager.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` |
|
||||
| `controllerManager.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` |
|
||||
| `controllerManager.reconcile.clusterSPIFFEIDs` | Enable reconciliation of clusterSPIFFEIDs from K8s to the SPIRE server | `true` |
|
||||
| `controllerManager.reconcile.clusterStaticEntries` | Enable reconciliation of clusterStaticEntries from K8s to the SPIRE server | `true` |
|
||||
| `controllerManager.reconcile.clusterFederatedTrustDomains` | Enable reconciliation of clusterFederatedTrustDomains from K8s to the SPIRE server | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.podSelector` | Selector for pods to issue identity | `{}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector` | Selector for namespaces to issue identity | `{}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.dnsNameTemplates` | DNS name template for issued identities | `[]` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.federatesWith` | Other Spire server URLs for identity federation | `[]` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.workloadSelectorTemplates` | Templates to produce selectors that apply to a given workload before it will receive an ID | `[]` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.fallback` | Apply this ID only if there are no other matching non fallback ClusterSPIFFEIDs | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled` | Enable this identity for controller manager | `false` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.child-servers.type` | The type of rule this is. | `child-servers` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.child-servers.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type` | The type of rule this is. | `oidc-discovery-provider` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate DNS names to the discovery provider | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.dnsNameTemplates` | DNS name template for issued identities | `[]` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.type` | The type of rule this is. | `test-keys` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type` | The type of rule this is. | `spike-keeper` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/keeper/{{ .PodMeta.Name }}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type` | The type of rule this is. | `spike-nexus` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/nexus/{{ .PodMeta.Name }}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.type` | The type of rule this is. | `spike-bootstrap` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/bootstrap/{{ .PodMeta.Name }}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.type` | The type of rule this is. | `spike-pilot` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/pilot/role/superuser` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled` | Enable this identity for controller manager | `false` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.type` | The type of rule this is. | `spire-ha-agent` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spire-ha-agent` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.federatesWith` | Federated trust domains to pass to the workload | `["spire-ha"]` |
|
||||
| `controllerManager.identities.clusterStaticEntries` | Specify ClusterStaticEntry objects. | `{}` |
|
||||
| `controllerManager.identities.clusterFederatedTrustDomains` | Specify ClusterFederatedTrustDomain objects. | `{}` |
|
||||
| `controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another chart instance on the k8s cluster with webhooks enabled. | `true` |
|
||||
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
|
||||
| `controllerManager.cacheNamespaces` | If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. | `{}` |
|
||||
| `externalControllerManagers.enabled` | Flag to enable external controller managers | `false` |
|
||||
| `externalControllerManagers.defaults.reconcile.clusterSPIFFEIDs` | Enable reconciliation of clusterSPIFFEIDs from K8s to the SPIRE server | `true` |
|
||||
| `externalControllerManagers.defaults.reconcile.clusterStaticEntries` | Enable reconciliation of clusterStaticEntries from K8s to the SPIRE server | `false` |
|
||||
| `externalControllerManagers.defaults.reconcile.clusterFederatedTrustDomains` | Enable reconciliation of clusterFederatedTrustDomains from K8s to the SPIRE server | `false` |
|
||||
| `externalControllerManagers.defaults.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
||||
| `externalControllerManagers.defaults.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
||||
| `externalControllerManagers.defaults.entryIDPrefixCleanup` | consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` |
|
||||
| `externalControllerManagers.defaults.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
|
||||
| `externalControllerManagers.defaults.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` |
|
||||
| `externalControllerManagers.defaults.leaderElection.renewDeadline` | Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. | `10s` |
|
||||
| `externalControllerManagers.defaults.leaderElection.retryPeriod` | Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. | `2s` |
|
||||
| `externalControllerManagers.defaults.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` |
|
||||
| `externalControllerManagers.defaults.extraEnv` | Extra environment variables to add to the controller manager | `[]` |
|
||||
| `externalControllerManagers.defaults.resources` | Resource requests and limits for controller manager | `{}` |
|
||||
| `externalControllerManagers.defaults.securityContext` | Security context | `{}` |
|
||||
| `externalControllerManagers.defaults.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` |
|
||||
| `externalControllerManagers.defaults.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` |
|
||||
| `externalControllerManagers.defaults.cacheNamespaces` | If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. | `{}` |
|
||||
| `externalControllerManagers.clusters` | A dictionary of clusters to add with optional overrides (kubeConfigName, reconcile, healthPortName, prometheusPortName). If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
||||
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
|
||||
| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` |
|
||||
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `tools.busybox.image.registry` | The OCI registry to pull the image from | `""` |
|
||||
| `tools.busybox.image.repository` | The repository within the registry | `busybox` |
|
||||
| `tools.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tools.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` |
|
||||
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
||||
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
||||
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
|
||||
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||
| `telemetry.datadog.enabled` | Flag to enable datadog monitoring | `false` |
|
||||
| `telemetry.datadog.address` | The address of the datadog service to send metrics to. The default URL for services are `<service-name>.<namespace>.svc` | `datadog.kube-system.svc` |
|
||||
| `telemetry.datadog.port` | The port of the datadog service to send metrics to | `8125` |
|
||||
| `ingress.enabled` | Flag to enable ingress | `false` |
|
||||
| `ingress.className` | Ingress class name | `""` |
|
||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server` |
|
||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
||||
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `extraEnv` | Extra environment variables to add to the spire server | `[]` |
|
||||
| `extraVolumes` | Extra volumes to be mounted | `[]` |
|
||||
| `extraVolumeMounts` | Extra volume mounts | `[]` |
|
||||
| `extraContainers` | Additional containers to create | `[]` |
|
||||
| `initContainers` | Additional init containers to create | `[]` |
|
||||
| `caKeyType` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) | `rsa-2048` |
|
||||
| `caTTL` | TTL for CA | `24h` |
|
||||
| `agentTTL` | The TTL to use for agent SVIDs. If unset, the defaultX509SvidTTL will be used. | `""` |
|
||||
| `defaultX509SvidTTL` | TTL for X509 Svids | `4h` |
|
||||
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
|
||||
| `rateLimit.attestation` | Enable rate limiting for node attestation. When true, rate limits node attestation to 1 per second globally. Set to false to disable. | `true` |
|
||||
| `rateLimit.signing` | Enable rate limiting for SVID signing (BatchNewX509SVID, BatchNewJWTSVID). When true, rate limits signing to 500 requests per second per server pod. Set to false to disable. Disabling is appropriate when running many replicas or during thundering-herd recovery. | `true` |
|
||||
| `pruneAttestedNodesExpiredFor` | Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval. | `""` |
|
||||
| `pruneTOFUNodes` | If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned. | `false` |
|
||||
| `maxAttestedNodeInfoStaleness` | How long to trust stale cache information about attested nodes. Set to "" to use the SPIRE default (0s). Increasing this can improve performance under high load by reducing datastore reads, at the cost of acting on slightly stale node state. Accepts Go duration strings (e.g. "10s", "1m"). | `""` |
|
||||
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `true` |
|
||||
| `nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor. If namespace isn't specified, release namespace will be used. | `[]` |
|
||||
| `nodeAttestor.k8sPSAT.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` |
|
||||
| `nodeAttestor.k8sPSAT.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.k8sPSAT.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.externalK8sPSAT.enabled` | Enable PSAT k8s nodeattestor for external Kubernetes clusters | `true` |
|
||||
| `nodeAttestor.externalK8sPSAT.defaults.serviceAccountAllowList` | Allowed service accounts for PSAT node attestor | `[]` |
|
||||
| `nodeAttestor.externalK8sPSAT.defaults.audience` | Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used | `[]` |
|
||||
| `nodeAttestor.externalK8sPSAT.defaults.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.externalK8sPSAT.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.externalK8sPSAT.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
||||
| `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` |
|
||||
| `nodeAttestor.httpChallenge.enabled` | Enable the http_challenge nodeattesto | `false` |
|
||||
| `nodeAttestor.httpChallenge.allowedDNSPatterns` | A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed. | `[]` |
|
||||
| `nodeAttestor.httpChallenge.requiredPort` | Set to a port number to require clients to listen only on that port. If 0, all port numbers are allowed | `0` |
|
||||
| `nodeAttestor.httpChallenge.allowNonRootPorts` | Allow using ports >= 1024 from clients for attestation | `true` |
|
||||
| `nodeAttestor.httpChallenge.tofu` | Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024 | `true` |
|
||||
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
|
||||
| `nodeAttestor.tpmDirect.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `nodeAttestor.tpmDirect.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-server` |
|
||||
| `nodeAttestor.tpmDirect.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeAttestor.tpmDirect.image.tag` | Overrides the image tag | `v1.9.0` |
|
||||
| `nodeAttestor.tpmDirect.checksum` | The sha256 checksum of the plugin binary | `46d0caad8c25a027dd11c93e18b58a8bc6fbd9f1fe2e36fa2a0dd440986de4dc` |
|
||||
| `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` |
|
||||
| `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` |
|
||||
| `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` |
|
||||
| `nodeAttestor.awsIID.enabled` | Enable the aws_iid node attestor | `false` |
|
||||
| `nodeAttestor.awsIID.assumeRole` | AWS IAM Role NAME to use for the attestation | `""` |
|
||||
| `nodeAttestor.awsIID.verifyOrganization` | When enabled, SPIRE verifies the attesting node's AWS account is a member of your AWS Organization ([SPIRE aws_iid server plugin](https://github.com/spiffe/spire/blob/main/doc/plugin_server_nodeattestor_aws_iid.md)). | |
|
||||
| `nodeAttestor.awsIID.verifyOrganization.enabled` | Enable AWS Organizations membership validation (`verify_organization` in plugin config) | `false` |
|
||||
| `nodeAttestor.awsIID.verifyOrganization.managementAccountId` | AWS Organizations management/root account ID (12 digits); SPIRE assumes `arn:aws:iam::<managementAccountId>:role/<assumeOrgRole>` for listing org accounts. | `""` |
|
||||
| `nodeAttestor.awsIID.verifyOrganization.assumeOrgRole` | IAM role **name** in the management account; must allow `organizations:ListAccounts` and trust the IAM identity used by the SPIRE server. | `""` |
|
||||
| `nodeAttestor.awsIID.verifyOrganization.managementAccountRegion` | Optional region SPIRE uses for org validation/cache keying (defaults in SPIRE if unset). | `""` |
|
||||
| `nodeAttestor.awsIID.verifyOrganization.orgAccountMapTTL` | Optional cache TTL for the org account map (SPIRE expects a duration ≥ 1m when set; e.g. `3m`, `5m`). Defaults to 3 minutes. | `3m` |
|
||||
| `nodeAttestor.gcpIIT.enabled` | Enable the gcp_iit node attestor | `false` |
|
||||
| `nodeAttestor.gcpIIT.projectIDAllowList` | List of ProjectIDs from which nodes can be attested | `[]` |
|
||||
| `nodeAttestor.gcpIIT.useInstanceMetadata` | If true, instance metadata is fetched from the Google Compute Engine API and used to augment the node selectors produced by the plugin | `false` |
|
||||
| `nodeAttestor.gcpIIT.allowedLabelKeys` | Instance label keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.gcpIIT.allowedMetadataKeys` | Instance metadata keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.gcpIIT.metadataValueMaxSize` | Sets the maximum metadata value size considered by the plugin for selectors | `0` |
|
||||
| `nodeAttestor.gcpIIT.agentPathTemplate` | A URL path portion format of Agent's SPIFFE ID. Describe in text/template format. | `""` |
|
||||
| `nodeAttestor.x509POP.enabled` | Enable the x509_popg node attestor | `false` |
|
||||
| `nodeAttestor.x509POP.mode` | What mode to set the plugin to. Currently only spiffe mode is supported | `spiffe` |
|
||||
| `nodeAttestor.x509POP.svidPrefix` | What prefix to use when mode is spiffe | `/spire-exchange` |
|
||||
| `nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `""` |
|
||||
| `nodeAttestor.x509POP.maxIntermediates` | Maximum number of intermediate certificates allowed in the certificate chain | `4` |
|
||||
| `nodeAttestor.x509POP.maxRSAKeySize` | Maximum RSA key size in bits allowed in certificates | `8192` |
|
||||
| `nodeAttestor.x509POP.addClusterName.svidPrefix` | Suffix the cluster name onto the svidPrefix | `false` |
|
||||
| `nodeAttestor.x509POP.addClusterName.agentPathTemplate` | Suffix the cluster name onto the agentPathTemplate | `false` |
|
||||
| `bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `true` |
|
||||
| `bundlePublisher.k8sConfigMap.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||
| `bundlePublisher.k8sConfigMap.format` | Format of the trust bundle. Can be pem or spiffe | `spiffe` |
|
||||
| `bundlePublisher.externalK8sConfigMap.enabled` | Enable external k8s bundle uploader | `true` |
|
||||
| `bundlePublisher.externalK8sConfigMap.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` |
|
||||
| `bundlePublisher.externalK8sConfigMap.defaults.configMapName` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` |
|
||||
| `bundlePublisher.externalK8sConfigMap.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `""` |
|
||||
| `bundlePublisher.externalK8sConfigMap.defaults.format` | Format of the trust bundle. Can be pem or spiffe | `spiffe` |
|
||||
| `bundlePublisher.externalK8sConfigMap.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
||||
| `bundlePublisher.awsRolesAnywhereTrustAnchor.enabled` | Enable the AWS S3 bundle publisher | `false` |
|
||||
| `bundlePublisher.awsRolesAnywhereTrustAnchor.region` | AWS region to store the trust bundle | `""` |
|
||||
| `bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID` | AWS trust anchor ID to publish to | `""` |
|
||||
| `bundlePublisher.awsS3.enabled` | Enable the AWS S3 bundle publisher | `false` |
|
||||
| `bundlePublisher.awsS3.endpoint` | A custom S3 endpoint should be set when using third-party object storage providers, such as Minio. | `""` |
|
||||
| `bundlePublisher.awsS3.region` | AWS region to store the trust bundle | `""` |
|
||||
| `bundlePublisher.awsS3.bucket` | AWS S3 bucket name to which the trust bundle is uploaded | `""` |
|
||||
| `bundlePublisher.awsS3.objectKey` | AWS S3 object key inside the bucket | `""` |
|
||||
| `bundlePublisher.awsS3.format` | Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] | `""` |
|
||||
| `bundlePublisher.gcpCloudStorage.enabled` | Enable the Google Cloud Storage bundle publisher | `false` |
|
||||
| `bundlePublisher.gcpCloudStorage.bucketName` | Google Cloud Storage bucket name to which the trust bundle is uploaded | `""` |
|
||||
| `bundlePublisher.gcpCloudStorage.objectName` | Google Cloud Storage object name | `""` |
|
||||
| `bundlePublisher.gcpCloudStorage.format` | Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] | `""` |
|
||||
| `dynamicRegistration.enabled` | Deploys the sidecar helper for dynamic registration | `false` |
|
||||
| `dynamicRegistration.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `dynamicRegistration.image.repository` | The repository within the registry | `spiffe/spire-controller-manager-dynamic-registration/spire-controller-manager-dynamic-registration-server` |
|
||||
| `dynamicRegistration.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `dynamicRegistration.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `0.1.0` |
|
||||
| `dynamicRegistration.serviceAccount` | Which service account to allow to register | `spire-agent` |
|
||||
| `dynamicRegistration.audience` | The expected audience | `spire-controller-manager-dynamic-registration` |
|
||||
| `dynamicRegistration.entryPrefix` | Unique prefix to bind nodes aliases to the server | `scmnr` |
|
||||
| `dynamicRegistration.allowedIDPrefix` | Prefix of agents that are allowed to register | `spire/agent/k8s_psat` |
|
||||
| `dynamicRegistration.registrationPrefix` | prefix to use on all new registration entries | `k8s_psat` |
|
||||
| `dynamicRegistration.addClusterName.registrationPrefix` | suffix the cluster name onto the registrationPrefix | `true` |
|
||||
| `dynamicRegistration.addClusterName.allowedIDPrefix` | suffix the cluster name onto the allowedIDPrefix | `true` |
|
||||
| `dynamicRegistration.securityContext` | Security Context to use | `{}` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
|
||||
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/spire-server` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `kind` | Define SPIRE server deployment type. Can be statefulset/deployment. Defaults to statefulset if not set. This feature is experimental. | `statefulset` |
|
||||
| `externalServer` | Deploy only the bundle ConfigMap, RBAC rules, and identity documents but not the server. Use in a nested setup where the server is external. | `false` |
|
||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||
| `nameOverride` | Name override | `""` |
|
||||
| `crNameOverride` | Name override for any custom resources | `""` |
|
||||
| `namespaceOverride` | Namespace override | `""` |
|
||||
| `fullnameOverride` | Fullname override | `""` |
|
||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
||||
| `podAnnotations` | Annotations to add to pods | `{}` |
|
||||
| `podLabels` | Labels to add to pods | `{}` |
|
||||
| `podSecurityContext` | Pod security context | `{}` |
|
||||
| `securityContext` | Security context | `{}` |
|
||||
| `priorityClassName` | Priority class assigned to statefulset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||
| `service.type` | Type of the Spire server service created | `ClusterIP` |
|
||||
| `service.port` | Port for the created service | `443` |
|
||||
| `service.annotations` | Annotations to add to the service object | `{}` |
|
||||
| `service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` |
|
||||
| `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` |
|
||||
| `resources` | Resource requests and limits | `{}` |
|
||||
| `autoscaling.enabled` | Flag to enable autoscaling | `false` |
|
||||
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
|
||||
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` |
|
||||
| `autoscaling.scaleOnSPIREServerOnly` | Flag to only consider the main SPIRE container for autoscaling purposes | `false` |
|
||||
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization that triggers autoscaling | `80` |
|
||||
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` |
|
||||
| `tolerations` | List of tolerations | `[]` |
|
||||
| `affinity` | List of node affinities | `{}` |
|
||||
| `topologySpreadConstraints` | Topology spread constraints for resilience | `[]` |
|
||||
| `terminationGracePeriodSeconds` | Override the termination grace period for the pod. Increase to allow time for load balancer target deregistration and in-flight gRPC drain before SIGKILL. | `nil` |
|
||||
| `livenessProbe.failureThreshold` | Failure threshold count for livenessProbe | `2` |
|
||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `15` |
|
||||
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `60` |
|
||||
| `livenessProbe.timeoutSeconds` | Timeout in seconds for livenessProbe | `3` |
|
||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
||||
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
||||
| `persistence.type` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing or nested child only) | `pvc` |
|
||||
| `persistence.size` | What size volume to use for persistence | `1Gi` |
|
||||
| `persistence.accessMode` | What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) | `ReadWriteOnce` |
|
||||
| `persistence.storageClass` | What storage class to use for persistence | `nil` |
|
||||
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `""` |
|
||||
| `dataStore.sql.databaseType` | Other supported databases are ["postgres", "mysql", "aws_postgresql", "aws_mysql", "gcp_mysql_sa_iam"]. Note: aws type databases are still experimental. gcp_mysql_sa_iam uses IAM authentication by default. | `sqlite3` |
|
||||
| `dataStore.sql.databaseName` | Only used when type != "sqlite3" | `spire` |
|
||||
| `dataStore.sql.host` | Only used when type != "sqlite3" | `""` |
|
||||
| `dataStore.sql.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` |
|
||||
| `dataStore.sql.username` | Only used when type != "sqlite3" | `spire` |
|
||||
| `dataStore.sql.password` | Only used when type != "sqlite3" | `""` |
|
||||
| `dataStore.sql.file` | Data source file. Only used when type == "sqlite3" | `/run/spire/data/datastore.sqlite3` |
|
||||
| `dataStore.sql.options` | takes an array of objects of form {<key>: <value>} to use when building the database connection string | `[]` |
|
||||
| `dataStore.sql.rootCAPath` | Path to Root CA bundle (MySQL only) | `""` |
|
||||
| `dataStore.sql.clientCertPath` | Path to client certificate (MySQL only) | `""` |
|
||||
| `dataStore.sql.clientKeyPath` | Path to private key for client certificate (MySQL only) | `""` |
|
||||
| `dataStore.sql.externalSecret.enabled` | Enable external secret for datastore creds | `false` |
|
||||
| `dataStore.sql.externalSecret.name` | The name of the secret object | `""` |
|
||||
| `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
|
||||
| `dataStore.sql.maxOpenConns` | The maximum number of open db connections | `100` |
|
||||
| `dataStore.sql.maxIdleConns` | The maximum number of idle connections in the pool | `2` |
|
||||
| `dataStore.sql.connMaxLifetime` | The maximum amount of time a connection may be reused. Supports duration strings (e.g., "1h", "30m", "3600s") or 0 for unlimited. Duration strings are recommended to prevent connection accumulation. | `0` |
|
||||
| `dataStore.sql.disableMigration` | True to disable auto-migration functionality | `false` |
|
||||
| `dataStore.sql.region` | Region to use when database type is either aws_mysql or aws_postgresql | `""` |
|
||||
| `dataStore.sql.readOnly.enabled` | Set to true to configure a readOnly dartabase connection | `false` |
|
||||
| `dataStore.sql.readOnly.host` | Only used when type != "sqlite3" | `""` |
|
||||
| `dataStore.sql.readOnly.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` |
|
||||
| `dataStore.sql.readOnly.username` | Only used when type != "sqlite3" | `spire` |
|
||||
| `dataStore.sql.readOnly.password` | Only used when type != "sqlite3" | `""` |
|
||||
| `dataStore.sql.readOnly.options` | Only used when type != "sqlite3" | `[]` |
|
||||
| `dataStore.sql.readOnly.externalSecret.enabled` | Enable external secret for datastore creds | `false` |
|
||||
| `dataStore.sql.readOnly.externalSecret.name` | The name of the secret object | `""` |
|
||||
| `dataStore.sql.readOnly.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
|
||||
| `adminIDs` | SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges. | `[]` |
|
||||
| `auditLogEnabled` | If true, enables audit logging | `false` |
|
||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||
| `logFormat` | The log format, valid values are "text" and "json" | `text` |
|
||||
| `jwtIssuer` | The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset | `""` |
|
||||
| `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` |
|
||||
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||
| `bundleConfigMap` | Set the Configmap name for SPIRE bundle | `spire-bundle` |
|
||||
| `clusterDomain` | This is the value of your clusters `kubeadm init --service-dns-domain` flag | `cluster.local` |
|
||||
| `jwtSVIDSupport` | If false, completely disables JWT-SVID functionality. The server will not generate JWT keys, sign JWT-SVIDs, or implement JWT-related API calls. This is useful for deployments that don’t need JWT-SVIDs support. | `true` |
|
||||
| `federation.enabled` | Flag to enable federation | `false` |
|
||||
| `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` |
|
||||
| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` |
|
||||
| `federation.bundleEndpoint.refreshHint` | Hint used by federated servers on how often to refresh the bundle. CA TTL must be 3-5x the duration of this value to ensure public keys are loaded on federated servers prior to private key rotation on remote server. | `5m` |
|
||||
| `federation.bundleEndpoint.profile.httpWeb.fileSyncInterval` | Interval on which to reload the certificate/key from disk | `1h` |
|
||||
| `federation.tls.spire.enabled` | Use spire to secure the federation bundle endpoint | `true` |
|
||||
| `federation.tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` |
|
||||
| `federation.tls.externalSecret.secretName` | Specify which Secret to use | `""` |
|
||||
| `federation.tls.certManager.enabled` | Use certificateManager to create the certificate | `false` |
|
||||
| `federation.tls.certManager.issuer.create` | Create an issuer to use to issue the certificate | `true` |
|
||||
| `federation.tls.certManager.issuer.acme.email` | Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service | `""` |
|
||||
| `federation.tls.certManager.issuer.acme.server` | Server to use to get certificate. Defaults to LetsEncrypt | `https://acme-v02.api.letsencrypt.org/directory` |
|
||||
| `federation.tls.certManager.issuer.acme.solvers` | Configure the issuer solvers. Defaults to http01 via ingress. | `{}` |
|
||||
| `federation.tls.certManager.certificate.dnsNames` | Override the dnsNames on the certificate request. Defaults to the same settings as Ingress | `[]` |
|
||||
| `federation.tls.certManager.certificate.issuerRef.group` | If you are using an external plugin, specify the group for it here | `""` |
|
||||
| `federation.tls.certManager.certificate.issuerRef.kind` | Kind of the issuer reference. Override if you want to use a ClusterIssuer | `Issuer` |
|
||||
| `federation.tls.certManager.certificate.issuerRef.name` | Name of the issuer to use. If unset, it will use the name of the built in issuer | `""` |
|
||||
| `federation.ingress.enabled` | Flag to enable ingress for federation | `false` |
|
||||
| `federation.ingress.className` | Ingress class name for federation | `""` |
|
||||
| `federation.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||
| `federation.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server-federation` |
|
||||
| `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `federation.ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
||||
| `federation.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `caSubject.country` | Country for Spire server CA | `ARPA` |
|
||||
| `caSubject.organization` | Organization for Spire server CA | `Example` |
|
||||
| `caSubject.commonName` | Common Name for Spire server CA | `example.org` |
|
||||
| `credentialComposer.cel.enabled` | Enable the cel based credential composer | `false` |
|
||||
| `credentialComposer.cel.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `credentialComposer.cel.image.repository` | The repository within the registry | `spiffe/spire-credentialcomposer-cel` |
|
||||
| `credentialComposer.cel.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `credentialComposer.cel.image.tag` | Overrides the image tag | `0.0.2` |
|
||||
| `credentialComposer.cel.checksum` | The sha256 checksum of the plugin binary | `23fa1d10f15ad5d5c555930cf82289c664801d7d5609bfd8847f95a0a667e4e4` |
|
||||
| `credentialComposer.cel.pluginPath` | The filename in the container of the plugin | `/ko-app/cmd` |
|
||||
| `credentialComposer.cel.jwt.expression` | The expression to use for jwt token composing | `""` |
|
||||
| `credentialComposer.uniqueID.enabled` | Add the x509UniqueIdentifier attribute to workload X509-SVIDs | `false` |
|
||||
| `credentialComposer.spireIdentityExchange.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `credentialComposer.spireIdentityExchange.image.repository` | The repository within the registry | `spiffe/spire-credentialcomposer-identity-exchange` |
|
||||
| `credentialComposer.spireIdentityExchange.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `credentialComposer.spireIdentityExchange.image.tag` | Overrides the image tag | `v0.2.0` |
|
||||
| `credentialComposer.spireIdentityExchange.checksum` | The sha256 checksum of the plugin binary | `198bfed106794a60e565cb804cb6b360d4633e4542981abbea0c0c669ddd6036` |
|
||||
| `credentialComposer.spireIdentityExchange.pluginPath` | The filename in the container of the plugin | `/ko-app/spire-credentialcomposer-identity-exchange` |
|
||||
| `credentialComposer.spireIdentityExchange.prefix` | The prefix to operate on | `""` |
|
||||
| `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` |
|
||||
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
|
||||
| `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` |
|
||||
| `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` |
|
||||
| `keyManager.awsKMS.keyIdentifierFile.enabled` | Enable key identifier data to be stored in a file in persistent storage. | `false` |
|
||||
| `keyManager.awsKMS.keyIdentifierValue.enabled` | Enable specifying a key identifier value for AWS KMS | `false` |
|
||||
| `keyManager.awsKMS.keyIdentifierValue.identifier` | Static identifier for the SPIRE server instance | `""` |
|
||||
| `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | |
|
||||
| `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` |
|
||||
| `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` |
|
||||
| `keyManager.awsKMS.keyTags` | Custom tags to apply to KMS keys created by the plugin. Tags are key-value pairs used for resource management and cost allocation. When using key tagging, you must add the `kms:TagResource` permission to your IAM policy. Constraints: keys (1-128 chars), values (0-256 chars), max 50 tags, valid chars (letters, numbers, spaces, + - = . _ : / @), keys cannot start with 'aws:' or 'spire-'. | `{}` |
|
||||
| `keyManager.awsKMS.accessKeyID` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. | `""` |
|
||||
| `keyManager.awsKMS.secretAccessKey` | Secret access key for the AWS account. | `""` |
|
||||
| `upstreamAuthority.disk.enabled` | Flag to enable upstream authority plugin on disk | `false` |
|
||||
| `upstreamAuthority.disk.secret.create` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | `true` |
|
||||
| `upstreamAuthority.disk.secret.name` | If secret creation is disabled, the secret with this name will be used. | `spiffe-upstream-ca` |
|
||||
| `upstreamAuthority.disk.secret.data` | If secret creation is enabled, will create a secret with following certificate info | |
|
||||
| `upstreamAuthority.disk.secret.data.certificate` | Certificate to store within disk upstreamAuthority. | `""` |
|
||||
| `upstreamAuthority.disk.secret.data.key` | Key corresponding to the upstreamAuthority. | `""` |
|
||||
| `upstreamAuthority.disk.secret.data.bundle` | Trust bundle for upstreamAuthority. | `""` |
|
||||
| `upstreamAuthority.awsPCA.enabled` | Flag to enable upstream authority plugin with AWS PCA | `false` |
|
||||
| `upstreamAuthority.awsPCA.region` | AWS Region to use | `""` |
|
||||
| `upstreamAuthority.awsPCA.certificateAuthorityARN` | ARN of the "upstream" CA certificate | `""` |
|
||||
| `upstreamAuthority.awsPCA.assumeRoleARN` | (Optional) ARN of an IAM role to assume | `""` |
|
||||
| `upstreamAuthority.awsPCA.caSigningTemplateARN` | (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. | `""` |
|
||||
| `upstreamAuthority.awsPCA.signingAlgorithm` | (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | `""` |
|
||||
| `upstreamAuthority.awsPCA.endpoint` | (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | `""` |
|
||||
| `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` |
|
||||
| `upstreamAuthority.awsSecret.enabled` | Flag to enable upstream authority plugin with AWS Secrets Manager | `false` |
|
||||
| `upstreamAuthority.awsSecret.region` | AWS Region to use | `""` |
|
||||
| `upstreamAuthority.awsSecret.certFileArn` | ARN or name of the secret containing the intermediate CA certificate | `""` |
|
||||
| `upstreamAuthority.awsSecret.keyFileArn` | ARN or name of the secret containing the intermediate CA private key | `""` |
|
||||
| `upstreamAuthority.awsSecret.bundleFileArn` | (Optional) ARN or name of the secret containing the root CA bundle | `""` |
|
||||
| `upstreamAuthority.awsSecret.assumeRoleArn` | (Optional) ARN of an IAM role to assume | `""` |
|
||||
| `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` |
|
||||
| `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` |
|
||||
| `upstreamAuthority.certManager.issuerName` | Defaults to the release name, override if CA is provided outside of the chart | `""` |
|
||||
| `upstreamAuthority.certManager.issuerKind` | Defaults to "Issuer", override if CA is provided outside of the chart | `Issuer` |
|
||||
| `upstreamAuthority.certManager.issuerGroup` | Defaults to "cert-manager.io", override if CA is provided outside of the chart | `cert-manager.io` |
|
||||
| `upstreamAuthority.certManager.namespace` | Specify to use a namespace other then the one the chart is installed into | `""` |
|
||||
| `upstreamAuthority.certManager.kubeConfigFile` | Path to kube config file on node to setup cert manager | `""` |
|
||||
| `upstreamAuthority.certManager.ca.create` | Creates a Cert-Manager CA | `false` |
|
||||
| `upstreamAuthority.certManager.ca.duration` | Duration of the CA. Defaults to 10 years | `87600h` |
|
||||
| `upstreamAuthority.certManager.ca.privateKey.algorithm` | Algorithm to generate private key for CA | `ECDSA` |
|
||||
| `upstreamAuthority.certManager.ca.privateKey.size` | Size of generated private key for CA | `256` |
|
||||
| `upstreamAuthority.certManager.ca.privateKey.rotationPolicy` | Rotation policy for generated private key | `""` |
|
||||
| `upstreamAuthority.certManager.ca.renewBefore` | How long to wait before renewing the CA | `""` |
|
||||
| `upstreamAuthority.spire.enabled` | Flag to use another Spire install as upstream CA | `false` |
|
||||
| `upstreamAuthority.spire.upstreamDriver` | Driver for Spire as upstream CA | `""` |
|
||||
| `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | |
|
||||
| `upstreamAuthority.spire.server.nameOverride` | Override the name for upstream Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
||||
| `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` |
|
||||
| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `443` |
|
||||
| `upstreamAuthority.vault.enabled` | Enable Hashicorp Vault as upstream CA | `false` |
|
||||
| `upstreamAuthority.vault.vaultAddr` | The URL of the Vault server. (e.g., https://vault.example.com:8443/) | `""` |
|
||||
| `upstreamAuthority.vault.namespace` | Name of the Vault namespace. This is only available in the Vault Enterprise. | `""` |
|
||||
| `upstreamAuthority.vault.pkiMountPoint` | Name of the mount point where PKI secret engine is mounted | `pki` |
|
||||
| `upstreamAuthority.vault.insecureSkipVerify` | If true, caCert options are ignored and Spire accepts any server certificates claiming to be Vault | `false` |
|
||||
| `upstreamAuthority.vault.caCert.type` | Type of resource representing the Vault server certificate, options are 'Secret' or 'Configmap', the item must be named `ca.crt` | `Secret` |
|
||||
| `upstreamAuthority.vault.caCert.name` | Name of the Kubernetes resource containing the Vault server certificate | `vault-ca` |
|
||||
| `upstreamAuthority.vault.k8sAuth.enabled` | Enable k8s authentication to Hashicorp Vault | `false` |
|
||||
| `upstreamAuthority.vault.k8sAuth.k8sAuthMountPoint` | Name of the mount point where the Kubernetes auth method is mounted | `kubernetes` |
|
||||
| `upstreamAuthority.vault.k8sAuth.k8sAuthRoleName` | Required - Name of the Vault role. The plugin authenticates against the named role | `""` |
|
||||
| `upstreamAuthority.vault.k8sAuth.token.audience` | Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info. | `vault` |
|
||||
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
|
||||
| `notifier.k8sBundle.enabled` | Enable local k8s bundle uploader | `false` |
|
||||
| `notifier.k8sBundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||
| `notifier.k8sBundle.apiServiceLabel` | If set, rotate the CA Bundle in API services with this label set to true. | `""` |
|
||||
| `notifier.k8sBundle.webhookLabel` | If set, rotate the CA Bundle in validating and mutating webhooks with this label set to true. | `""` |
|
||||
| `notifier.externalK8sBundle.enabled` | Enable external k8s bundle uploader | `false` |
|
||||
| `notifier.externalK8sBundle.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` |
|
||||
| `notifier.externalK8sBundle.defaults.configMap` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` |
|
||||
| `notifier.externalK8sBundle.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `bundle.crt` |
|
||||
| `notifier.externalK8sBundle.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
||||
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
||||
| `controllerManager.staticManifestMode` | Flag to configure static mode. Valid options off, internal, and external. If internal, the identities config options will be rendered to an included configmap | `off` |
|
||||
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
||||
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
||||
| `controllerManager.entryIDPrefixCleanup` | Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` |
|
||||
| `controllerManager.addEntryIDPrefix` | If true, prepends the clusterName to the entryID of each entry the controller manager registers. | `true` |
|
||||
| `controllerManager.gcInterval` | How often the SPIRE state is reconciled when the controller is otherwise idle. This impacts how quickly SPIRE state will converge after CRDs are removed or SPIRE state is mutated underneath the controller. Values are in nanoseconds. | `10000000000` |
|
||||
| `controllerManager.logLevel` | The log level for the controller manager. Supported values are info, error, warn and debug. | `info` |
|
||||
| `controllerManager.logEncoding` | The log encoding for the controller manager. Supported values are console and json. | `console` |
|
||||
| `controllerManager.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` |
|
||||
| `controllerManager.leaderElection.renewDeadline` | Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. | `10s` |
|
||||
| `controllerManager.leaderElection.retryPeriod` | Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. | `2s` |
|
||||
| `controllerManager.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
|
||||
| `controllerManager.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` |
|
||||
| `controllerManager.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` |
|
||||
| `controllerManager.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` |
|
||||
| `controllerManager.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
||||
| `controllerManager.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` |
|
||||
| `controllerManager.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` |
|
||||
| `controllerManager.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
|
||||
| `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
|
||||
| `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` |
|
||||
| `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` |
|
||||
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||
| `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
||||
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.6` |
|
||||
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
||||
| `controllerManager.securityContext` | Security context | `{}` |
|
||||
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
||||
| `controllerManager.service.port` | Service port for controller manager | `443` |
|
||||
| `controllerManager.service.annotations` | Annotations for service resource | `{}` |
|
||||
| `controllerManager.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` |
|
||||
| `controllerManager.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` |
|
||||
| `controllerManager.reconcile.clusterSPIFFEIDs` | Enable reconciliation of clusterSPIFFEIDs from K8s to the SPIRE server | `true` |
|
||||
| `controllerManager.reconcile.clusterStaticEntries` | Enable reconciliation of clusterStaticEntries from K8s to the SPIRE server | `true` |
|
||||
| `controllerManager.reconcile.clusterFederatedTrustDomains` | Enable reconciliation of clusterFederatedTrustDomains from K8s to the SPIRE server | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.podSelector` | Selector for pods to issue identity | `{}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector` | Selector for namespaces to issue identity | `{}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.dnsNameTemplates` | DNS name template for issued identities | `[]` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.federatesWith` | Other Spire server URLs for identity federation | `[]` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.workloadSelectorTemplates` | Templates to produce selectors that apply to a given workload before it will receive an ID | `[]` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.fallback` | Apply this ID only if there are no other matching non fallback ClusterSPIFFEIDs | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled` | Enable this identity for controller manager | `false` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.child-servers.type` | The type of rule this is. | `child-servers` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.child-servers.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type` | The type of rule this is. | `oidc-discovery-provider` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate DNS names to the discovery provider | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.dnsNameTemplates` | DNS name template for issued identities | `[]` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.type` | The type of rule this is. | `test-keys` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type` | The type of rule this is. | `spike-keeper` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/keeper/{{ .PodMeta.Name }}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type` | The type of rule this is. | `spike-nexus` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/nexus/{{ .PodMeta.Name }}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.type` | The type of rule this is. | `spike-bootstrap` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/bootstrap/{{ .PodMeta.Name }}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.type` | The type of rule this is. | `spike-pilot` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/pilot/role/superuser` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled` | Enable this identity for controller manager | `false` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.type` | The type of rule this is. | `spire-ha-agent` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spire-ha-agent` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.federatesWith` | Federated trust domains to pass to the workload | `["spire-ha"]` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/service/trustbundle-spire-identity-exchange` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.type` | The type of rule this is. | `spire-identity-exchange` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.workloadSelectorTemplates` | Workload selectors. | `[]` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/service/spire-identity-exchange` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.type` | The type of rule this is. | `spire-identity-exchange` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.workloadSelectorTemplates` | Workload selectors. | `[]` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-agent.type` | The type of rule this is. | `spire-identity-exchange` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-agent.workloadSelectorTemplates` | Workload selectors. | `[]` |
|
||||
| `controllerManager.identities.clusterStaticEntries.spire-identity-exchange` | Settings for the spire-identity-exchnage | `{}` |
|
||||
| `controllerManager.identities.clusterStaticEntries.spire-identity-exchange-agent.selectors` | selector | `[]` |
|
||||
| `controllerManager.identities.clusterFederatedTrustDomains` | Specify ClusterFederatedTrustDomain objects. | `{}` |
|
||||
| `controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another chart instance on the k8s cluster with webhooks enabled. | `true` |
|
||||
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
|
||||
| `controllerManager.cacheNamespaces` | If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. | `{}` |
|
||||
| `externalControllerManagers.enabled` | Flag to enable external controller managers | `false` |
|
||||
| `externalControllerManagers.defaults.reconcile.clusterSPIFFEIDs` | Enable reconciliation of clusterSPIFFEIDs from K8s to the SPIRE server | `true` |
|
||||
| `externalControllerManagers.defaults.reconcile.clusterStaticEntries` | Enable reconciliation of clusterStaticEntries from K8s to the SPIRE server | `false` |
|
||||
| `externalControllerManagers.defaults.reconcile.clusterFederatedTrustDomains` | Enable reconciliation of clusterFederatedTrustDomains from K8s to the SPIRE server | `false` |
|
||||
| `externalControllerManagers.defaults.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
||||
| `externalControllerManagers.defaults.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
||||
| `externalControllerManagers.defaults.entryIDPrefixCleanup` | consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` |
|
||||
| `externalControllerManagers.defaults.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
|
||||
| `externalControllerManagers.defaults.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` |
|
||||
| `externalControllerManagers.defaults.leaderElection.renewDeadline` | Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. | `10s` |
|
||||
| `externalControllerManagers.defaults.leaderElection.retryPeriod` | Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. | `2s` |
|
||||
| `externalControllerManagers.defaults.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` |
|
||||
| `externalControllerManagers.defaults.extraEnv` | Extra environment variables to add to the controller manager | `[]` |
|
||||
| `externalControllerManagers.defaults.resources` | Resource requests and limits for controller manager | `{}` |
|
||||
| `externalControllerManagers.defaults.securityContext` | Security context | `{}` |
|
||||
| `externalControllerManagers.defaults.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` |
|
||||
| `externalControllerManagers.defaults.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` |
|
||||
| `externalControllerManagers.defaults.cacheNamespaces` | If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. | `{}` |
|
||||
| `externalControllerManagers.clusters` | A dictionary of clusters to add with optional overrides (kubeConfigName, reconcile, healthPortName, prometheusPortName). If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
||||
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
|
||||
| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` |
|
||||
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `tools.busybox.image.registry` | The OCI registry to pull the image from | `""` |
|
||||
| `tools.busybox.image.repository` | The repository within the registry | `busybox` |
|
||||
| `tools.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tools.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` |
|
||||
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
||||
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
||||
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
|
||||
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||
| `telemetry.datadog.enabled` | Flag to enable datadog monitoring | `false` |
|
||||
| `telemetry.datadog.address` | The address of the datadog service to send metrics to. The default URL for services are `<service-name>.<namespace>.svc` | `datadog.kube-system.svc` |
|
||||
| `telemetry.datadog.port` | The port of the datadog service to send metrics to | `8125` |
|
||||
| `ingress.enabled` | Flag to enable ingress | `false` |
|
||||
| `ingress.className` | Ingress class name | `""` |
|
||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server` |
|
||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
||||
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `extraEnv` | Extra environment variables to add to the spire server | `[]` |
|
||||
| `extraVolumes` | Extra volumes to be mounted | `[]` |
|
||||
| `extraVolumeMounts` | Extra volume mounts | `[]` |
|
||||
| `extraContainers` | Additional containers to create | `[]` |
|
||||
| `initContainers` | Additional init containers to create | `[]` |
|
||||
| `caKeyType` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) | `rsa-2048` |
|
||||
| `caTTL` | TTL for CA | `24h` |
|
||||
| `agentTTL` | The TTL to use for agent SVIDs. If unset, the defaultX509SvidTTL will be used. | `""` |
|
||||
| `defaultX509SvidTTL` | TTL for X509 Svids | `4h` |
|
||||
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
|
||||
| `rateLimit.attestation` | Enable rate limiting for node attestation. When true, rate limits node attestation to 1 per second globally. Set to false to disable. | `true` |
|
||||
| `rateLimit.signing` | Enable rate limiting for SVID signing (BatchNewX509SVID, BatchNewJWTSVID). When true, rate limits signing to 500 requests per second per server pod. Set to false to disable. Disabling is appropriate when running many replicas or during thundering-herd recovery. | `true` |
|
||||
| `pruneAttestedNodesExpiredFor` | Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval. | `""` |
|
||||
| `pruneTOFUNodes` | If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned. | `false` |
|
||||
| `maxAttestedNodeInfoStaleness` | How long to trust stale cache information about attested nodes. Set to "" to use the SPIRE default (0s). Increasing this can improve performance under high load by reducing datastore reads, at the cost of acting on slightly stale node state. Accepts Go duration strings (e.g. "10s", "1m"). | `""` |
|
||||
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `true` |
|
||||
| `nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor. If namespace isn't specified, release namespace will be used. | `[]` |
|
||||
| `nodeAttestor.k8sPSAT.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` |
|
||||
| `nodeAttestor.k8sPSAT.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.k8sPSAT.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.externalK8sPSAT.enabled` | Enable PSAT k8s nodeattestor for external Kubernetes clusters | `true` |
|
||||
| `nodeAttestor.externalK8sPSAT.defaults.serviceAccountAllowList` | Allowed service accounts for PSAT node attestor | `[]` |
|
||||
| `nodeAttestor.externalK8sPSAT.defaults.audience` | Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used | `[]` |
|
||||
| `nodeAttestor.externalK8sPSAT.defaults.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.externalK8sPSAT.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.externalK8sPSAT.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
||||
| `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` |
|
||||
| `nodeAttestor.httpChallenge.enabled` | Enable the http_challenge nodeattesto | `false` |
|
||||
| `nodeAttestor.httpChallenge.allowedDNSPatterns` | A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed. | `[]` |
|
||||
| `nodeAttestor.httpChallenge.requiredPort` | Set to a port number to require clients to listen only on that port. If 0, all port numbers are allowed | `0` |
|
||||
| `nodeAttestor.httpChallenge.allowNonRootPorts` | Allow using ports >= 1024 from clients for attestation | `true` |
|
||||
| `nodeAttestor.httpChallenge.tofu` | Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024 | `true` |
|
||||
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
|
||||
| `nodeAttestor.tpmDirect.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `nodeAttestor.tpmDirect.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-server` |
|
||||
| `nodeAttestor.tpmDirect.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeAttestor.tpmDirect.image.tag` | Overrides the image tag | `v1.9.0` |
|
||||
| `nodeAttestor.tpmDirect.checksum` | The sha256 checksum of the plugin binary | `46d0caad8c25a027dd11c93e18b58a8bc6fbd9f1fe2e36fa2a0dd440986de4dc` |
|
||||
| `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` |
|
||||
| `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` |
|
||||
| `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` |
|
||||
| `nodeAttestor.awsIID.enabled` | Enable the aws_iid node attestor | `false` |
|
||||
| `nodeAttestor.awsIID.assumeRole` | AWS IAM Role NAME to use for the attestation | `""` |
|
||||
| `nodeAttestor.awsIID.verifyOrganization` | When enabled, SPIRE verifies the attesting node's AWS account is a member of your AWS Organization ([SPIRE aws_iid server plugin](https://github.com/spiffe/spire/blob/main/doc/plugin_server_nodeattestor_aws_iid.md)). | |
|
||||
| `nodeAttestor.awsIID.verifyOrganization.enabled` | Enable AWS Organizations membership validation (`verify_organization` in plugin config) | `false` |
|
||||
| `nodeAttestor.awsIID.verifyOrganization.managementAccountId` | AWS Organizations management/root account ID (12 digits); SPIRE assumes `arn:aws:iam::<managementAccountId>:role/<assumeOrgRole>` for listing org accounts. | `""` |
|
||||
| `nodeAttestor.awsIID.verifyOrganization.assumeOrgRole` | IAM role **name** in the management account; must allow `organizations:ListAccounts` and trust the IAM identity used by the SPIRE server. | `""` |
|
||||
| `nodeAttestor.awsIID.verifyOrganization.managementAccountRegion` | Optional region SPIRE uses for org validation/cache keying (defaults in SPIRE if unset). | `""` |
|
||||
| `nodeAttestor.awsIID.verifyOrganization.orgAccountMapTTL` | Optional cache TTL for the org account map (SPIRE expects a duration ≥ 1m when set; e.g. `3m`, `5m`). Defaults to 3 minutes. | `3m` |
|
||||
| `nodeAttestor.gcpIIT.enabled` | Enable the gcp_iit node attestor | `false` |
|
||||
| `nodeAttestor.gcpIIT.projectIDAllowList` | List of ProjectIDs from which nodes can be attested | `[]` |
|
||||
| `nodeAttestor.gcpIIT.useInstanceMetadata` | If true, instance metadata is fetched from the Google Compute Engine API and used to augment the node selectors produced by the plugin | `false` |
|
||||
| `nodeAttestor.gcpIIT.allowedLabelKeys` | Instance label keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.gcpIIT.allowedMetadataKeys` | Instance metadata keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.gcpIIT.metadataValueMaxSize` | Sets the maximum metadata value size considered by the plugin for selectors | `0` |
|
||||
| `nodeAttestor.gcpIIT.agentPathTemplate` | A URL path portion format of Agent's SPIFFE ID. Describe in text/template format. | `""` |
|
||||
| `nodeAttestor.x509POP.enabled` | Enable the x509_popg node attestor | `false` |
|
||||
| `nodeAttestor.x509POP.mode` | What mode to set the plugin to. Currently only spiffe mode is supported | `spiffe` |
|
||||
| `nodeAttestor.x509POP.spiffePrefix` | What prefix to use when mode is spiffe | `/spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/` |
|
||||
| `nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `""` |
|
||||
| `nodeAttestor.x509POP.maxIntermediates` | Maximum number of intermediate certificates allowed in the certificate chain | `4` |
|
||||
| `nodeAttestor.x509POP.maxRSAKeySize` | Maximum RSA key size in bits allowed in certificates | `8192` |
|
||||
| `nodeAttestor.x509POP.addClusterName.spiffePrefix` | Suffix the cluster name onto the svidPrefix | `true` |
|
||||
| `nodeAttestor.x509POP.addClusterName.agentPathTemplate` | Suffix the cluster name onto the agentPathTemplate | `true` |
|
||||
| `bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `true` |
|
||||
| `bundlePublisher.k8sConfigMap.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||
| `bundlePublisher.k8sConfigMap.format` | Format of the trust bundle. Can be pem or spiffe | `spiffe` |
|
||||
| `bundlePublisher.externalK8sConfigMap.enabled` | Enable external k8s bundle uploader | `true` |
|
||||
| `bundlePublisher.externalK8sConfigMap.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` |
|
||||
| `bundlePublisher.externalK8sConfigMap.defaults.configMapName` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` |
|
||||
| `bundlePublisher.externalK8sConfigMap.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `""` |
|
||||
| `bundlePublisher.externalK8sConfigMap.defaults.format` | Format of the trust bundle. Can be pem or spiffe | `spiffe` |
|
||||
| `bundlePublisher.externalK8sConfigMap.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
||||
| `bundlePublisher.awsRolesAnywhereTrustAnchor.enabled` | Enable the AWS S3 bundle publisher | `false` |
|
||||
| `bundlePublisher.awsRolesAnywhereTrustAnchor.region` | AWS region to store the trust bundle | `""` |
|
||||
| `bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID` | AWS trust anchor ID to publish to | `""` |
|
||||
| `bundlePublisher.awsS3.enabled` | Enable the AWS S3 bundle publisher | `false` |
|
||||
| `bundlePublisher.awsS3.endpoint` | A custom S3 endpoint should be set when using third-party object storage providers, such as Minio. | `""` |
|
||||
| `bundlePublisher.awsS3.region` | AWS region to store the trust bundle | `""` |
|
||||
| `bundlePublisher.awsS3.bucket` | AWS S3 bucket name to which the trust bundle is uploaded | `""` |
|
||||
| `bundlePublisher.awsS3.objectKey` | AWS S3 object key inside the bucket | `""` |
|
||||
| `bundlePublisher.awsS3.format` | Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] | `""` |
|
||||
| `bundlePublisher.gcpCloudStorage.enabled` | Enable the Google Cloud Storage bundle publisher | `false` |
|
||||
| `bundlePublisher.gcpCloudStorage.bucketName` | Google Cloud Storage bucket name to which the trust bundle is uploaded | `""` |
|
||||
| `bundlePublisher.gcpCloudStorage.objectName` | Google Cloud Storage object name | `""` |
|
||||
| `bundlePublisher.gcpCloudStorage.format` | Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] | `""` |
|
||||
| `dynamicRegistration.enabled` | Deploys the sidecar helper for dynamic registration | `false` |
|
||||
| `dynamicRegistration.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `dynamicRegistration.image.repository` | The repository within the registry | `spiffe/spire-controller-manager-dynamic-registration/spire-controller-manager-dynamic-registration-server` |
|
||||
| `dynamicRegistration.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `dynamicRegistration.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `0.1.0` |
|
||||
| `dynamicRegistration.serviceAccount` | Which service account to allow to register | `spire-agent` |
|
||||
| `dynamicRegistration.audience` | The expected audience | `spire-controller-manager-dynamic-registration` |
|
||||
| `dynamicRegistration.entryPrefix` | Unique prefix to bind nodes aliases to the server | `scmnr` |
|
||||
| `dynamicRegistration.allowedIDPrefix` | Prefix of agents that are allowed to register | `spire/agent/k8s_psat` |
|
||||
| `dynamicRegistration.registrationPrefix` | prefix to use on all new registration entries | `k8s_psat` |
|
||||
| `dynamicRegistration.addClusterName.registrationPrefix` | suffix the cluster name onto the registrationPrefix | `true` |
|
||||
| `dynamicRegistration.addClusterName.allowedIDPrefix` | suffix the cluster name onto the allowedIDPrefix | `true` |
|
||||
| `dynamicRegistration.securityContext` | Security Context to use | `{}` |
|
||||
|
||||
### Tornjak
|
||||
|
||||
@@ -578,3 +590,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58` |
|
||||
| `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` |
|
||||
| `spireIdentityExchange.enabled` | Enable the server side of the SPIRE Identity Exchange system | `false` |
|
||||
| `spike.enabled` | Enable the server side of SPIKE | `false` |
|
||||
|
||||
@@ -415,3 +415,11 @@ subjects:
|
||||
{{- end }}
|
||||
{{- toYaml $podSecurityContext }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-server.identity-exchange-spiffe-prefix" -}}
|
||||
{{- $cn := "" }}
|
||||
{{- if .Values.nodeAttestor.x509POP.addClusterName.spiffePrefix }}
|
||||
{{- $cn = printf "/%s" (include "spire-lib.cluster-name" .) }}
|
||||
{{- end }}
|
||||
{{- replace "${HELM_ADD_CLUSTER_NAME}" $cn .Values.nodeAttestor.x509POP.spiffePrefix }}
|
||||
{{- end }}
|
||||
|
||||
@@ -131,7 +131,7 @@ server:
|
||||
{{- end }}
|
||||
|
||||
plugins:
|
||||
{{- if or .Values.credentialComposer.uniqueID.enabled .Values.credentialComposer.cel.enabled }}
|
||||
{{- if or .Values.credentialComposer.uniqueID.enabled .Values.credentialComposer.cel.enabled .Values.spireIdentityExchange.enabled }}
|
||||
CredentialComposer:
|
||||
{{- if or .Values.credentialComposer.uniqueID.enabled }}
|
||||
uniqueid: {}
|
||||
@@ -139,13 +139,34 @@ plugins:
|
||||
{{- with .Values.credentialComposer.cel }}
|
||||
{{- if .enabled }}
|
||||
cel:
|
||||
plugin_cmd: "/cel/credentialcomposer-cel"
|
||||
plugin_cmd: "/plugins/credentialcomposer-cel"
|
||||
plugin_checksum: {{ .checksum }}
|
||||
plugin_data:
|
||||
jwt:
|
||||
expression_string: {{ .jwt.expression | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.credentialComposer.spireIdentityExchange }}
|
||||
{{- if $root.Values.spireIdentityExchange.enabled }}
|
||||
identityexchange:
|
||||
plugin_cmd: "/plugins/credentialcomposer-identity-exchange"
|
||||
plugin_checksum: {{ .checksum }}
|
||||
plugin_data:
|
||||
{{- $spiffePrefix := $root.Values.nodeAttestor.x509POP.spiffePrefix }}
|
||||
{{- if not (hasSuffix "/" $spiffePrefix) }}
|
||||
{{- $spiffePrefix = printf "%s/" $spiffePrefix }}
|
||||
{{- end }}
|
||||
{{- if eq .prefix "" }}
|
||||
{{- if $root.Values.nodeAttestor.x509POP.addClusterName.spiffePrefix }}
|
||||
prefix: {{ printf "%s%s/spire-identity-exchange/" $spiffePrefix (include "spire-lib.cluster-name" $root) | quote }}
|
||||
{{- else }}
|
||||
prefix: {{ printf "%s/spire-identity-exchange/" $spiffePrefix | quote }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
prefix: {{ .prefix | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
DataStore:
|
||||
@@ -176,7 +197,7 @@ plugins:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled .Values.nodeAttestor.awsIID.enabled .Values.nodeAttestor.gcpIIT.enabled .Values.nodeAttestor.x509POP.enabled }}
|
||||
{{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled .Values.nodeAttestor.awsIID.enabled .Values.nodeAttestor.gcpIIT.enabled .Values.nodeAttestor.x509POP.enabled .Values.spireIdentityExchange.enabled }}
|
||||
NodeAttestor:
|
||||
{{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPSAT.clusters }}
|
||||
{{- if or (eq (.Values.nodeAttestor.k8sPSAT.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true") (gt (len $clusters) 0)) }}
|
||||
@@ -257,24 +278,26 @@ plugins:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.x509POP }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
{{- if or (eq (.enabled | toString) "true") $root.Values.spireIdentityExchange.enabled }}
|
||||
x509pop:
|
||||
plugin_data:
|
||||
mode: {{ .mode }}
|
||||
{{- if .addClusterName.svidPrefix }}
|
||||
svid_prefix: {{ printf "%s/%s" .svidPrefix (include "spire-lib.cluster-name" $root) | quote }}
|
||||
{{- else }}
|
||||
svid_prefix: {{ .svidPrefix | quote }}
|
||||
{{- end }}
|
||||
spiffe_prefix: {{ include "spire-server.identity-exchange-spiffe-prefix" $root | quote }}
|
||||
max_intermediates: {{ .maxIntermediates }}
|
||||
max_rsa_key_size: {{ .maxRSAKeySize }}
|
||||
{{- if ne .agentPathTemplate "" }}
|
||||
{{- if .addClusterName.agentPathTemplate }}
|
||||
agent_path_template: {{ printf "%s/%s" .agentPathTemplate (include "spire-lib.cluster-name" $root) | quote }}
|
||||
{{- $cn := "" }}
|
||||
{{- $agentPathTemplate := .agentPathTemplate }}
|
||||
{{- if (eq $agentPathTemplate "") }}
|
||||
{{- if eq .mode "spiffe" }}
|
||||
{{- $agentPathTemplate = "/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}" }}
|
||||
{{- else }}
|
||||
agent_path_template: {{ .agentPathTemplate | quote }}
|
||||
{{- $agentPathTemplate = "/{{ .PluginName }}/{{ .Fingerprint }}" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .addClusterName.agentPathTemplate }}
|
||||
{{- $cn = printf "/%s" (include "spire-lib.cluster-name" $root) }}
|
||||
{{- end }}
|
||||
agent_path_template: {{ replace "${HELM_ADD_CLUSTER_NAME}" $cn $agentPathTemplate | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.awsIID }}
|
||||
|
||||
@@ -20,6 +20,11 @@ matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
release-namespace: {{ .Release.Namespace }}
|
||||
component: oidc-discovery-provider
|
||||
{{- else if eq .type "spire-identity-exchange" }}
|
||||
matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
release-namespace: {{ .Release.Namespace }}
|
||||
component: spire-identity-exchange
|
||||
{{- else if eq .type "spike-keeper" }}
|
||||
matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
@@ -62,10 +67,22 @@ matchLabels:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
|
||||
{{- $process := true }}
|
||||
{{- if not (hasKey $value "enabled") }}
|
||||
{{- if and (hasPrefix "spire-identity-exchange" $key) (not $root.Values.spireIdentityExchange.enabled) }}
|
||||
{{- $process = false }}
|
||||
{{- else if and (hasPrefix "spike" $key) (not $root.Values.spike.enabled) }}
|
||||
{{- $process = false }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if not (eq ($value.enabled | toString) "true") }}
|
||||
{{- $process = false }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $process }}
|
||||
{{- $type := dig "type" "base" $value }}
|
||||
{{- if not (has $type (list "base" "raw" "spire-ha-agent" "child-servers" "oidc-discovery-provider" "oidc-discovery-provider-common" "spike-keeper" "spike-nexus" "spike-bootstrap" "spike-pilot" "test-keys")) }}
|
||||
{{- fail (printf "Type given: %s, must be one of [base, raw, spire-ha-agent, child-servers, oidc-discovery-provider, oidc-discovery-provider-common, spike-keeper, spike-nexus, spike-bootstrap, spike-pilot, test-keys]" $type) }}
|
||||
{{- if not (has $type (list "base" "raw" "spire-ha-agent" "child-servers" "oidc-discovery-provider" "oidc-discovery-provider-common" "spike-keeper" "spike-nexus" "spike-bootstrap" "spike-pilot" "spire-identity-exchange" "test-keys")) }}
|
||||
{{- fail (printf "Type given: %s, must be one of [base, raw, spire-ha-agent, child-servers, oidc-discovery-provider, oidc-discovery-provider-common, spike-keeper, spike-nexus, spike-bootstrap, spike-pilot, spire-identity-exchange, test-keys]" $type) }}
|
||||
{{- end }}
|
||||
{{- $namespaceSelector := deepCopy (dig "namespaceSelector" (dict) $value) }}
|
||||
{{- if ne $type "raw" }}
|
||||
@@ -99,6 +116,9 @@ spec:
|
||||
{{- end }}
|
||||
{{- if and (hasKey $value "spiffeIDTemplate") (ne (len $value.spiffeIDTemplate) 0) }}
|
||||
spiffeIDTemplate: {{ $value.spiffeIDTemplate | quote }}
|
||||
{{- else if eq $key "spire-identity-exchange-agent" }}
|
||||
{{- $iePrefix := include "spire-server.identity-exchange-spiffe-prefix" $root }}
|
||||
spiffeIDTemplate: "spiffe://{{ `{{ .TrustDomain }}` }}{{ $iePrefix }}spire-identity-exchange/{{ `{{ .PodMeta.Name }}` }}"
|
||||
{{- else }}
|
||||
spiffeIDTemplate: {{ $root.Values.controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate | quote }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
{{- define "spire-server.cluster-static-entries" -}}
|
||||
{{- $root := .root }}
|
||||
{{- $trustDomain := include "spire-lib.trust-domain" .root }}
|
||||
{{- $useShortName := .useShortName }}
|
||||
{{- range $key, $value := $root.Values.controllerManager.identities.clusterStaticEntries }}
|
||||
{{- range $skey, $svalue := $value }}
|
||||
@@ -7,13 +8,25 @@
|
||||
{{- fail (printf "Unsupported property specified: %s" $skey) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $rprop := list "spiffeID" "selectors" "parentID" }}
|
||||
{{- if not (hasKey $value $rprop) }}
|
||||
{{- fail (printf "Required property %s was not specified" $rprop) }}
|
||||
{{- if not (hasPrefix "spire-identity-exchange" $key) }}
|
||||
{{- range $rprop := list "spiffeID" "selectors" "parentID" }}
|
||||
{{- if not (hasKey $value $rprop) }}
|
||||
{{- fail (printf "Required property %s was not specified" $rprop) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
|
||||
{{- $process := true }}
|
||||
{{- if not (hasKey $value "enabled") }}
|
||||
{{- if and (hasPrefix "spire-identity-exchange" $key) (not $root.Values.spireIdentityExchange.enabled) }}
|
||||
{{- $process = false }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if not (eq ($value.enabled | toString) "true") }}
|
||||
{{- $process = false }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $process }}
|
||||
- apiVersion: spire.spiffe.io/v1alpha1
|
||||
kind: ClusterStaticEntry
|
||||
metadata:
|
||||
@@ -32,17 +45,29 @@
|
||||
{{- end }}
|
||||
spec:
|
||||
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
|
||||
{{- if eq $key "spire-identity-exchange" }}
|
||||
parentID: "spiffe://{{ $trustDomain }}/spire/server"
|
||||
spiffeID: "spiffe://{{ $trustDomain }}/spire-identity-exchange"
|
||||
{{- else if eq $key "spire-identity-exchange-agent" }}
|
||||
parentID: "spiffe://{{ $trustDomain }}/spire-identity-exchange"
|
||||
spiffeID: "spiffe://{{ $trustDomain }}/service/spire-identity-exchange"
|
||||
{{- else }}
|
||||
parentID: {{ $value.parentID | quote }}
|
||||
spiffeID: {{ $value.spiffeID | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.federatesWith }}
|
||||
federatesWith:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if and (eq $key "spire-identity-exchange") (not (hasKey $value "selectors")) }}
|
||||
{{- $iePrefix := include "spire-server.identity-exchange-spiffe-prefix" $root | trimPrefix "/" }}
|
||||
selectors:
|
||||
- x509pop:subject:cn:{{ $iePrefix }}spire-identity-exchange
|
||||
{{- else }}
|
||||
{{- with $value.selectors }}
|
||||
selectors:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.parentID }}
|
||||
parentID: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.dnsNames }}
|
||||
dnsNames:
|
||||
|
||||
@@ -65,7 +65,7 @@
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- $pluginsToLoad := include "spire-lib.extract_custom_plugin_images" . | fromYamlArray }}
|
||||
{{- $pluginLoaderNeeded := or .Values.credentialComposer.cel.enabled (gt (len $pluginsToLoad) 0) }}
|
||||
{{- $pluginLoaderNeeded := or .Values.credentialComposer.cel.enabled .Values.spireIdentityExchange.enabled (gt (len $pluginsToLoad) 0) }}
|
||||
{{- if not .Values.externalServer }}
|
||||
apiVersion: apps/v1
|
||||
{{- if eq .Values.kind "statefulset" }}
|
||||
@@ -159,6 +159,23 @@ spec:
|
||||
mountPath: /plugins
|
||||
imagePullPolicy: {{ .Values.credentialComposer.cel.image.pullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.spireIdentityExchange.enabled }}
|
||||
- name: init-six
|
||||
securityContext:
|
||||
{{- include "spire-lib.securitycontext" . | nindent 12 }}
|
||||
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.credentialComposer.spireIdentityExchange.image "global" .Values.global) }}
|
||||
# Second, use the previously copied busybox to copy the plugin into a volume that can be mounted where SPIRE can execute it.
|
||||
command:
|
||||
- /plugins/busybox
|
||||
- sh
|
||||
- -ec
|
||||
- |
|
||||
/plugins/busybox cp -a {{ .Values.credentialComposer.spireIdentityExchange.pluginPath }} /plugins/credentialcomposer-identity-exchange
|
||||
volumeMounts:
|
||||
- name: plugins
|
||||
mountPath: /plugins
|
||||
imagePullPolicy: {{ .Values.credentialComposer.spireIdentityExchange.image.pullPolicy }}
|
||||
{{- end }}
|
||||
{{- range $idx, $plugin := $pluginsToLoad }}
|
||||
- name: {{ printf "init-plugin-%d" $idx }}
|
||||
securityContext:
|
||||
|
||||
@@ -383,6 +383,23 @@ credentialComposer:
|
||||
uniqueID:
|
||||
## @param credentialComposer.uniqueID.enabled Add the x509UniqueIdentifier attribute to workload X509-SVIDs
|
||||
enabled: false
|
||||
spireIdentityExchange:
|
||||
## @param credentialComposer.spireIdentityExchange.image.registry The OCI registry to pull the image from
|
||||
## @param credentialComposer.spireIdentityExchange.image.repository The repository within the registry
|
||||
## @param credentialComposer.spireIdentityExchange.image.pullPolicy The image pull policy
|
||||
## @param credentialComposer.spireIdentityExchange.image.tag Overrides the image tag
|
||||
##
|
||||
image:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-credentialcomposer-identity-exchange
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v0.2.0"
|
||||
## @param credentialComposer.spireIdentityExchange.checksum The sha256 checksum of the plugin binary
|
||||
checksum: 198bfed106794a60e565cb804cb6b360d4633e4542981abbea0c0c669ddd6036
|
||||
## @param credentialComposer.spireIdentityExchange.pluginPath The filename in the container of the plugin
|
||||
pluginPath: /ko-app/spire-credentialcomposer-identity-exchange
|
||||
## @param credentialComposer.spireIdentityExchange.prefix The prefix to operate on
|
||||
prefix: ""
|
||||
|
||||
keyManager:
|
||||
disk:
|
||||
@@ -766,29 +783,21 @@ controllerManager:
|
||||
type: test-keys
|
||||
|
||||
spike-keeper:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.enabled Enable this identity for controller manager
|
||||
enabled: true
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type The type of rule this is.
|
||||
type: spike-keeper
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate The template to use for this rule.
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/keeper/{{ .PodMeta.Name }}
|
||||
spike-nexus:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.enabled Enable this identity for controller manager
|
||||
enabled: true
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type The type of rule this is.
|
||||
type: spike-nexus
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate The template to use for this rule.
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/nexus/{{ .PodMeta.Name }}
|
||||
spike-bootstrap:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.enabled Enable this identity for controller manager
|
||||
enabled: true
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.type The type of rule this is.
|
||||
type: spike-bootstrap
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.spiffeIDTemplate The template to use for this rule.
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/bootstrap/{{ .PodMeta.Name }}
|
||||
spike-pilot:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.enabled Enable this identity for controller manager
|
||||
enabled: true
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.type The type of rule this is.
|
||||
type: spike-pilot
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.spiffeIDTemplate The template to use for this rule.
|
||||
@@ -805,6 +814,29 @@ controllerManager:
|
||||
federatesWith:
|
||||
- spire-ha
|
||||
|
||||
spire-identity-exchange-trustbundle:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.spiffeIDTemplate The template to use for this rule.
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/service/trustbundle-spire-identity-exchange
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.type The type of rule this is.
|
||||
type: spire-identity-exchange
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.workloadSelectorTemplates [array] Workload selectors.
|
||||
workloadSelectorTemplates:
|
||||
- "k8s:container-name:spire-server-attestor"
|
||||
spire-identity-exchange-service:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.spiffeIDTemplate The template to use for this rule.
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/service/spire-identity-exchange
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.type The type of rule this is.
|
||||
type: spire-identity-exchange
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.workloadSelectorTemplates [array] Workload selectors.
|
||||
workloadSelectorTemplates:
|
||||
- "k8s:container-name:spire-identity-exchange"
|
||||
spire-identity-exchange-agent:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-agent.type The type of rule this is.
|
||||
type: spire-identity-exchange
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-agent.workloadSelectorTemplates [array] Workload selectors.
|
||||
workloadSelectorTemplates:
|
||||
- "k8s:container-name:spire-agent"
|
||||
|
||||
# You can specify additional ClusterSPIFFEIDs following this example:
|
||||
# foo:
|
||||
# labels:
|
||||
@@ -813,8 +845,14 @@ controllerManager:
|
||||
# namespaceSelector:
|
||||
# matchLabels:
|
||||
# foo: bar
|
||||
## @param controllerManager.identities.clusterStaticEntries Specify ClusterStaticEntry objects.
|
||||
clusterStaticEntries: {}
|
||||
clusterStaticEntries:
|
||||
## @param controllerManager.identities.clusterStaticEntries.spire-identity-exchange [object] Settings for the spire-identity-exchnage
|
||||
spire-identity-exchange: {}
|
||||
#FIXME Only needed for delegated api. Can remove once spire-identity-exchange switched to the broker api.
|
||||
spire-identity-exchange-agent:
|
||||
## @param controllerManager.identities.clusterStaticEntries.spire-identity-exchange-agent.selectors [array] selector
|
||||
selectors:
|
||||
- unix:path:/ko-app/spire-identity-exchange-server
|
||||
# foo:
|
||||
# labels:
|
||||
# foo: bar
|
||||
@@ -1131,8 +1169,8 @@ nodeAttestor:
|
||||
enabled: false
|
||||
## @param nodeAttestor.x509POP.mode What mode to set the plugin to. Currently only spiffe mode is supported
|
||||
mode: spiffe
|
||||
## @param nodeAttestor.x509POP.svidPrefix What prefix to use when mode is spiffe
|
||||
svidPrefix: /spire-exchange
|
||||
## @param nodeAttestor.x509POP.spiffePrefix What prefix to use when mode is spiffe
|
||||
spiffePrefix: "/spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/"
|
||||
## @param nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
|
||||
agentPathTemplate: ""
|
||||
## @param nodeAttestor.x509POP.maxIntermediates Maximum number of intermediate certificates allowed in the certificate chain
|
||||
@@ -1140,10 +1178,10 @@ nodeAttestor:
|
||||
## @param nodeAttestor.x509POP.maxRSAKeySize Maximum RSA key size in bits allowed in certificates
|
||||
maxRSAKeySize: 8192
|
||||
addClusterName:
|
||||
## @param nodeAttestor.x509POP.addClusterName.svidPrefix Suffix the cluster name onto the svidPrefix
|
||||
svidPrefix: false
|
||||
## @param nodeAttestor.x509POP.addClusterName.spiffePrefix Suffix the cluster name onto the svidPrefix
|
||||
spiffePrefix: true
|
||||
## @param nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
|
||||
agentPathTemplate: false
|
||||
agentPathTemplate: true
|
||||
|
||||
# The secrets needed for this plugin are configured in the secrets: section
|
||||
bundlePublisher:
|
||||
@@ -1485,3 +1523,11 @@ kubeConfigs: {}
|
||||
# xxxxx
|
||||
# clusterb:
|
||||
# kubeConfigBase64: eXl5Cnl5eQo=
|
||||
|
||||
spireIdentityExchange:
|
||||
## @param spireIdentityExchange.enabled Enable the server side of the SPIRE Identity Exchange system
|
||||
enabled: false
|
||||
|
||||
spike:
|
||||
## @param spike.enabled Enable the server side of SPIKE
|
||||
enabled: false
|
||||
|
||||
@@ -243,3 +243,9 @@ spike-nexus:
|
||||
spike-pilot:
|
||||
## @param spike-pilot.enabled Enables deployment of SPIKE Pilot (Not for production)
|
||||
enabled: false
|
||||
|
||||
spire-identity-exchange:
|
||||
## @param spire-identity-exchange.enabled Enables deployment of the SPIRE Identity Exchange (Not for production)
|
||||
enabled: false
|
||||
## @param spire-identity-exchange.nameOverride Overrides the name of the SPIRE Identity Exchnage
|
||||
nameOverride: identity-exchange
|
||||
|
||||
Reference in New Issue
Block a user