Experimental support for spire-identity-exchange (#860)
* Experimental support for spire-identity-exchange Signed-off-by: Kevin Fox <[email protected]> * Fix image name Signed-off-by: Kevin Fox <[email protected]> * Fix flags Signed-off-by: Kevin Fox <[email protected]> * Fix ghosted section Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Add some missing bits Signed-off-by: Kevin Fox <[email protected]> * Some more implementation Signed-off-by: Kevin Fox <[email protected]> * Update tests Signed-off-by: Kevin Fox <[email protected]> * Add ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Rework x509pop to work shared Signed-off-by: Kevin Fox <[email protected]> * Rework x509pop to work shared Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Fix path Signed-off-by: Kevin Fox <[email protected]> * Fix path Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fix static entry Signed-off-by: Kevin Fox <[email protected]> * Cleanup Signed-off-by: Kevin Fox <[email protected]> * Remove unused change Signed-off-by: Kevin Fox <[email protected]> * Update spire-identity-exchange. Start to test. Signed-off-by: Kevin Fox <[email protected]> * fixes Signed-off-by: Kevin Fox <[email protected]> * Update lock Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Fix broken test. Correct default dns names. Signed-off-by: Kevin Fox <[email protected]> * Fix merge issue Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
This commit is contained in:
kfox1111
@@ -187,7 +187,7 @@ jobs:
|
|||||||
- name: Run chart-testing (install)
|
- name: Run chart-testing (install)
|
||||||
run: |
|
run: |
|
||||||
helm install -n spire-server spire-crds charts/spire-crds
|
helm install -n spire-server spire-crds charts/spire-crds
|
||||||
ct install --config ct.yaml --excluded-charts spire-crds,spiffe-step-ssh,spire-ha-agent,spire-lib \
|
ct install --config ct.yaml --excluded-charts spire-crds,spiffe-step-ssh,spire-ha-agent,spire-lib,spire-identity-exchange \
|
||||||
--target-branch ${{ github.base_ref || inputs.target_branch }}
|
--target-branch ${{ github.base_ref || inputs.target_branch }}
|
||||||
|
|
||||||
- name: Test summary
|
- name: Test summary
|
||||||
|
|||||||
@@ -0,0 +1,23 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: spire-identity-exchange
|
||||||
|
description: A Helm chart to install the SPIRE Identity Exchange.
|
||||||
|
type: application
|
||||||
|
version: 0.1.0
|
||||||
|
appVersion: "v0.2.0"
|
||||||
|
keywords: ["spiffe", "spire", "identity exchange"]
|
||||||
|
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-identity-exchange
|
||||||
|
sources:
|
||||||
|
- https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-identity-exchange
|
||||||
|
icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
|
||||||
|
maintainers:
|
||||||
|
- name: marcofranssen
|
||||||
|
email: [email protected]
|
||||||
|
url: https://marcofranssen.nl
|
||||||
|
- name: kfox1111
|
||||||
|
email: [email protected]
|
||||||
|
- name: faisal-memon
|
||||||
|
email: [email protected]
|
||||||
|
dependencies:
|
||||||
|
- name: spire-lib
|
||||||
|
repository: file://../spire-lib
|
||||||
|
version: 0.2.0
|
||||||
@@ -0,0 +1,126 @@
|
|||||||
|
# spire-identity-exchange
|
||||||
|
|
||||||
|
  
|
||||||
|
|
||||||
|
A Helm chart to install the SPIRE Identity Exchange.
|
||||||
|
|
||||||
|
**Homepage:** <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-identity-exchange>
|
||||||
|
|
||||||
|
## Maintainers
|
||||||
|
|
||||||
|
| Name | Email | Url |
|
||||||
|
| ---- | ------ | --- |
|
||||||
|
| marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
|
||||||
|
| kfox1111 | <Kevin.Fox@pnnl.gov> | |
|
||||||
|
| faisal-memon | <fymemon@yahoo.com> | |
|
||||||
|
|
||||||
|
## Source Code
|
||||||
|
|
||||||
|
* <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-identity-exchange>
|
||||||
|
|
||||||
|
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||||
|
|
||||||
|
## Parameters
|
||||||
|
|
||||||
|
### Chart parameters
|
||||||
|
|
||||||
|
| Name | Description | Value |
|
||||||
|
| ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- |
|
||||||
|
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
||||||
|
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
||||||
|
| `replicaCount` | Replica count | `1` |
|
||||||
|
| `namespaceOverride` | Namespace override | `""` |
|
||||||
|
| `annotations` | Annotations for the deployment | `{}` |
|
||||||
|
| `labels` | Labels for the deployment | `{}` |
|
||||||
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
|
| `image.repository` | The repository within the registry | `spiffe/spire-identity-exchange-server` |
|
||||||
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
|
| `spireServerAttestorSPIFFEWorkloadAPI.resources` | Resource requests and limits | `{}` |
|
||||||
|
| `spireServerAttestorSPIFFEWorkloadAPI.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
|
| `spireServerAttestorSPIFFEWorkloadAPI.image.repository` | The repository within the registry | `spiffe/spire-server-attestor-spiffe-workload-api` |
|
||||||
|
| `spireServerAttestorSPIFFEWorkloadAPI.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `spireServerAttestorSPIFFEWorkloadAPI.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
|
| `spireAgent.resources` | Resource requests and limits | `{}` |
|
||||||
|
| `spireAgent.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
|
| `spireAgent.image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
||||||
|
| `spireAgent.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `spireAgent.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.15.1` |
|
||||||
|
| `extraEnv` | Extra environment variables to add to the spire identity exchange | `[]` |
|
||||||
|
| `resources` | Resource requests and limits | `{}` |
|
||||||
|
| `configMap.annotations` | Annotations to add to the SPIRE Identity Exchange ConfigMap | `{}` |
|
||||||
|
| `podSecurityContext` | Pod security context for SPIRE Identity Exchange pods | `{}` |
|
||||||
|
| `securityContext` | Security context for SPIRE Identity Exchange deployment | `{}` |
|
||||||
|
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
||||||
|
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
||||||
|
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
|
||||||
|
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` |
|
||||||
|
| `podAnnotations` | Pod annotations for SPIRE Identity Exchange | `{}` |
|
||||||
|
| `podLabels` | Labels to add to pods | `{}` |
|
||||||
|
| `tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` |
|
||||||
|
| `tls.externalSecret.secretName` | Specify which Secret to use | `""` |
|
||||||
|
| `tls.certManager.enabled` | Use certificateManager to create the certificate | `false` |
|
||||||
|
| `tls.certManager.issuer.create` | Create an issuer to use to issue the certificate | `true` |
|
||||||
|
| `tls.certManager.issuer.acme.email` | Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service | `""` |
|
||||||
|
| `tls.certManager.issuer.acme.server` | Server to use to get certificate. Defaults to LetsEncrypt | `https://acme-v02.api.letsencrypt.org/directory` |
|
||||||
|
| `tls.certManager.issuer.acme.solvers` | Configure the issuer solvers. Defaults to http01 via ingress. | `{}` |
|
||||||
|
| `tls.certManager.certificate.dnsNames` | Override the dnsNames on the certificate request. Defaults to the same settings as Ingress | `[]` |
|
||||||
|
| `tls.certManager.certificate.issuerRef.group` | If you are using an external plugin, specify the group for it here | `""` |
|
||||||
|
| `tls.certManager.certificate.issuerRef.kind` | Kind of the issuer reference. Override if you want to use a ClusterIssuer | `Issuer` |
|
||||||
|
| `tls.certManager.certificate.issuerRef.name` | Name of the issuer to use. If unset, it will use the name of the built in issuer | `""` |
|
||||||
|
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||||
|
| `config.logFormat` | The log format, valid values are "text" and "json" | `text` |
|
||||||
|
| `imagePullSecrets` | Image pull secret names | `[]` |
|
||||||
|
| `nameOverride` | Name override | `""` |
|
||||||
|
| `fullnameOverride` | Full name override | `""` |
|
||||||
|
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||||
|
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||||
|
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
||||||
|
| `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||||
|
| `autoscaling.enabled` | Flag to enable autoscaling | `false` |
|
||||||
|
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
|
||||||
|
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` |
|
||||||
|
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` |
|
||||||
|
| `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` |
|
||||||
|
| `nodeSelector` | Node selector | `{}` |
|
||||||
|
| `tolerations` | iist of tolerations | `[]` |
|
||||||
|
| `affinity` | Node affinity | `{}` |
|
||||||
|
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||||
|
| `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` |
|
||||||
|
| `auth.plugins` | Plugins to load | `{}` |
|
||||||
|
| `auth.stacks` | Stacks to load | `{}` |
|
||||||
|
| `rest.enabled` | Enable the rest service | `true` |
|
||||||
|
| `rest.service.type` | Service type | `ClusterIP` |
|
||||||
|
| `rest.service.port` | port for the service | `443` |
|
||||||
|
| `rest.service.annotations` | Annotations for service resource | `{}` |
|
||||||
|
| `rest.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` |
|
||||||
|
| `rest.ingress.enabled` | Flag to enable ingress | `false` |
|
||||||
|
| `rest.ingress.className` | Ingress class name | `""` |
|
||||||
|
| `rest.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||||
|
| `rest.ingress.annotations` | Annotations for ingress object | `{}` |
|
||||||
|
| `rest.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-identity-exchange-rest` |
|
||||||
|
| `rest.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||||
|
| `rest.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||||
|
| `rest.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||||
|
| `grpc.enabled` | Enable the grpc service | `false` |
|
||||||
|
| `grpc.service.type` | Service type | `ClusterIP` |
|
||||||
|
| `grpc.service.port` | port for the service | `443` |
|
||||||
|
| `grpc.service.annotations` | Annotations for service resource | `{}` |
|
||||||
|
| `grpc.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` |
|
||||||
|
| `grpc.ingress.enabled` | Flag to enable ingress | `false` |
|
||||||
|
| `grpc.ingress.className` | Ingress class name | `""` |
|
||||||
|
| `grpc.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||||
|
| `grpc.ingress.annotations` | Annotations for ingress object | `{}` |
|
||||||
|
| `grpc.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The grpc of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-identity-exchange-grpc` |
|
||||||
|
| `grpc.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||||
|
| `grpc.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||||
|
| `grpc.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||||
|
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
|
||||||
|
| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` |
|
||||||
|
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
|
| `clusterRole.create` | create a k8s cluster role to allow access to token reviews and oidc discovery | `true` |
|
||||||
|
| `server.address` | Address for Spire server | `""` |
|
||||||
|
| `server.port` | Port number for Spire server | `443` |
|
||||||
|
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
||||||
|
| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
||||||
@@ -0,0 +1,14 @@
|
|||||||
|
spire-identity-exchange:
|
||||||
|
enabled: true
|
||||||
|
tls:
|
||||||
|
externalSecret:
|
||||||
|
enabled: true
|
||||||
|
secretName: spire-identity-exchange
|
||||||
|
auth:
|
||||||
|
plugins:
|
||||||
|
- plugin: k8s_psat
|
||||||
|
config:
|
||||||
|
audiences:
|
||||||
|
- spire-identity-exchange
|
||||||
|
allowedServiceAccounts:
|
||||||
|
- default/default
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
SPIRE Identity Exchange installed…
|
||||||
@@ -0,0 +1,133 @@
|
|||||||
|
{{/*
|
||||||
|
Expand the name of the chart.
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-identity-exchange.name" -}}
|
||||||
|
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default fully qualified app name.
|
||||||
|
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||||
|
If release name contains chart name it will be used as a full name.
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-identity-exchange.fullname" -}}
|
||||||
|
{{- if .Values.fullnameOverride }}
|
||||||
|
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||||
|
{{- if contains $name .Release.Name }}
|
||||||
|
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Allow the release namespace to be overridden for multi-namespace deployments in combined charts
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-identity-exchange.namespace" -}}
|
||||||
|
{{- if .Values.namespaceOverride -}}
|
||||||
|
{{- .Values.namespaceOverride -}}
|
||||||
|
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
|
||||||
|
{{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }}
|
||||||
|
{{- .Values.global.spire.namespaces.server.name }}
|
||||||
|
{{- else }}
|
||||||
|
{{- printf "spire-server" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- else -}}
|
||||||
|
{{- .Release.Namespace -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- define "spire-identity-exchange.podMonitor.namespace" -}}
|
||||||
|
{{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }}
|
||||||
|
{{- .Values.telemetry.prometheus.podMonitor.namespace }}
|
||||||
|
{{- else if ne (len (dig "telemetry" "prometheus" "podMonitor" "namespace" "" .Values.global)) 0 }}
|
||||||
|
{{- .Values.global.telemetry.prometheus.podMonitor.namespace }}
|
||||||
|
{{- else }}
|
||||||
|
{{- include "spire-identity-exchange.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create chart name and version as used by the chart label.
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-identity-exchange.chart" -}}
|
||||||
|
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Common labels
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-identity-exchange.labels" -}}
|
||||||
|
helm.sh/chart: {{ include "spire-identity-exchange.chart" . }}
|
||||||
|
{{ include "spire-identity-exchange.selectorLabels" . }}
|
||||||
|
{{- if .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||||
|
{{- end }}
|
||||||
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Selector labels
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-identity-exchange.selectorLabels" -}}
|
||||||
|
app.kubernetes.io/name: {{ include "spire-identity-exchange.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create the name of the service account to use
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-identity-exchange.serviceAccountName" -}}
|
||||||
|
{{- if .Values.serviceAccount.create }}
|
||||||
|
{{- default (include "spire-identity-exchange.fullname" .) .Values.serviceAccount.name }}
|
||||||
|
{{- else }}
|
||||||
|
{{- default "default" .Values.serviceAccount.name }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- define "spire-identity-exchange.workload-api-socket-path" -}}
|
||||||
|
{{- printf "/spiffe-workload-api/%s" .Values.agentSocketName }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- define "spire-identity-exchange.podSecurityContext" -}}
|
||||||
|
{{- $podSecurityContext := include "spire-lib.podsecuritycontext" . | fromYaml }}
|
||||||
|
{{- $openshift := ((.Values).global).openshift | default false }}
|
||||||
|
{{- if not $openshift }}
|
||||||
|
{{- if not (hasKey $podSecurityContext "runAsUser") }}
|
||||||
|
{{- $_ := set $podSecurityContext "runAsUser" 1000 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if not (hasKey $podSecurityContext "runAsGroup") }}
|
||||||
|
{{- $_ := set $podSecurityContext "runAsGroup" 1000 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- toYaml $podSecurityContext }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- define "spire-identity-exchange.server.namespace" -}}
|
||||||
|
{{- if .Values.server.namespaceOverride -}}
|
||||||
|
{{- .Values.server.namespaceOverride -}}
|
||||||
|
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
|
||||||
|
{{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }}
|
||||||
|
{{- .Values.global.spire.namespaces.server.name }}
|
||||||
|
{{- else }}
|
||||||
|
{{- printf "spire-server" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- else -}}
|
||||||
|
{{- .Release.Namespace -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- define "spire-identity-exchange.server-address" }}
|
||||||
|
{{- if and (ne (len (dig "spire" "upstreamSpireAddress" "" .Values.global)) 0) .Values.upstream }}
|
||||||
|
{{- print .Values.global.spire.upstreamSpireAddress }}
|
||||||
|
{{- else if .Values.server.address }}
|
||||||
|
{{- .Values.server.address }}
|
||||||
|
{{- else if .Values.server.nameOverride }}
|
||||||
|
{{ .Release.Name }}-{{ .Values.server.nameOverride }}.{{ include "spire-identity-exchange.server.namespace" . }}
|
||||||
|
{{- else }}
|
||||||
|
{{ .Release.Name }}-server.{{ include "spire-identity-exchange.server.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,31 @@
|
|||||||
|
{{- define "spire-identity-exchange.cert-manager-default-cert" }}
|
||||||
|
{{- $fullName := include "spire-identity-exchange.fullname" . }}
|
||||||
|
dnsNames:
|
||||||
|
{{- if ne (len .Values.tls.certManager.certificate.dnsNames) 0 }}
|
||||||
|
{{- toYaml .Values.tls.certManager.certificate.dnsNames | nindent 4 }}
|
||||||
|
{{- else }}
|
||||||
|
{{- if .Values.rest.enabled }}
|
||||||
|
- {{ include "spire-lib.ingress-calculated-name" (dict "ingress" .Values.rest.ingress "Values" .Values) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.grpc.enabled }}
|
||||||
|
- {{ include "spire-lib.ingress-calculated-name" (dict "ingress" .Values.grpc.ingress "Values" .Values) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
issuerRef:
|
||||||
|
{{- with .Values.tls.certManager.certificate.issuerRef.group }}
|
||||||
|
group: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
kind: {{ default "Issuer" .Values.tls.certManager.certificate.issuerRef.kind }}
|
||||||
|
name: {{ default $fullName .Values.tls.certManager.certificate.issuerRef.name }}
|
||||||
|
secretName: {{ $fullName }}-cert
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tls.certManager.enabled }}
|
||||||
|
---
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: Certificate
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-identity-exchange.fullname" . }}
|
||||||
|
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||||
|
spec:
|
||||||
|
{{ merge (include "spire-identity-exchange.cert-manager-default-cert" . | fromYaml) .Values.tls.certManager.certificate | toYaml | nindent 2 }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,95 @@
|
|||||||
|
{{- $tlsCount := 0 }}
|
||||||
|
{{- if .Values.tls.externalSecret.enabled }}
|
||||||
|
{{- $tlsCount = add $tlsCount 1 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tls.certManager.enabled }}
|
||||||
|
{{- $tlsCount = add $tlsCount 1 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne $tlsCount 1 }}
|
||||||
|
{{- fail "You must have one and only one TLS configuration enabled" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if lt (len .Values.auth.plugins) 1 }}
|
||||||
|
{{- fail "You must have at least one auth plugin defined" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if not (or .Values.rest.enabled .Values.grpc.enabled) }}
|
||||||
|
{{- fail "You must have rest and/or grpc enabled" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $trustDomain := include "spire-lib.trust-domain" . }}
|
||||||
|
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq $trustDomain "example.org"))}}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-identity-exchange.fullname" . }}
|
||||||
|
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||||
|
{{- with .Values.configMap.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
data:
|
||||||
|
six.conf: |
|
||||||
|
name: spire-identity-exchange
|
||||||
|
logLevel: info
|
||||||
|
server:
|
||||||
|
port: 8443
|
||||||
|
restPort: 8444
|
||||||
|
metricsPort: 4950
|
||||||
|
tls:
|
||||||
|
certFile: /secret/tls.crt
|
||||||
|
keyFile: /secret/tls.key
|
||||||
|
spire:
|
||||||
|
agentWorkloadSocketPath: /spiffe-workload-api/spire-agent.sock
|
||||||
|
agentDelegatedSocketPath: /agent/admin.sock
|
||||||
|
trustDomain: {{ $trustDomain }}
|
||||||
|
svidTTL: 1h
|
||||||
|
auth:
|
||||||
|
plugins:
|
||||||
|
{{- toYaml .Values.auth.plugins | nindent 8 }}
|
||||||
|
{{ with .Values.auth.stacks }}
|
||||||
|
stacks:
|
||||||
|
{{- toYaml .Values.auth.stacks | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
six-agent.conf: |
|
||||||
|
agent {
|
||||||
|
log_level = "DEBUG"
|
||||||
|
trust_domain = {{ $trustDomain | quote }}
|
||||||
|
server_address = {{ include "spire-identity-exchange.server-address" . | trim | quote }}
|
||||||
|
server_port = {{ .Values.server.port }}
|
||||||
|
trust_bundle_url = "http://localhost/trustbundle"
|
||||||
|
trust_bundle_unix_socket = "/trustbundle/socket"
|
||||||
|
rebootstrap_mode = "always"
|
||||||
|
rebootstrap_delay = "5m"
|
||||||
|
|
||||||
|
data_dir = "/agent-data"
|
||||||
|
admin_socket_path = "/agent/admin.sock"
|
||||||
|
authorized_delegates = ["spiffe://{{ $trustDomain }}/service/spire-identity-exchange"]
|
||||||
|
}
|
||||||
|
|
||||||
|
health_checks {
|
||||||
|
listener_enabled = true
|
||||||
|
bind_address = "0.0.0.0"
|
||||||
|
bind_port = 8182
|
||||||
|
live_path = "/live"
|
||||||
|
ready_path = "/ready"
|
||||||
|
}
|
||||||
|
|
||||||
|
plugins {
|
||||||
|
KeyManager "memory" {
|
||||||
|
plugin_data {}
|
||||||
|
}
|
||||||
|
|
||||||
|
NodeAttestor "x509pop" {
|
||||||
|
plugin_data {
|
||||||
|
spiffe_endpoint_socket = "unix:///spiffe-workload-api/spire-agent.sock"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
WorkloadAttestor "unix" {
|
||||||
|
plugin_data {
|
||||||
|
# Only used for delegated api. Can be removed for the broker api in the future.
|
||||||
|
discover_workload_path = true
|
||||||
|
workload_size_limit = -1
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
@@ -0,0 +1,199 @@
|
|||||||
|
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
|
||||||
|
{{- $trustDomain := include "spire-lib.trust-domain" . }}
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-identity-exchange.fullname" . }}
|
||||||
|
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "spire-identity-exchange.labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{- if not .Values.autoscaling.enabled }}
|
||||||
|
replicas: {{ .Values.replicaCount }}
|
||||||
|
{{- end }}
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
{{- include "spire-identity-exchange.selectorLabels" . | nindent 6 }}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
checksum/config: {{ $configSum }}
|
||||||
|
{{- with .Values.podAnnotations }}
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
labels:
|
||||||
|
{{- include "spire-identity-exchange.selectorLabels" . | nindent 8 }}
|
||||||
|
release: {{ .Release.Name }}
|
||||||
|
release-namespace: {{ .Release.Namespace }}
|
||||||
|
component: spire-identity-exchange
|
||||||
|
{{- with .Values.podLabels }}
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
shareProcessNamespace: true
|
||||||
|
{{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
serviceAccountName: {{ include "spire-identity-exchange.serviceAccountName" . }}
|
||||||
|
securityContext:
|
||||||
|
{{- include "spire-identity-exchange.podSecurityContext" . | nindent 8 }}
|
||||||
|
initContainers:
|
||||||
|
- name: spire-server-attestor
|
||||||
|
securityContext:
|
||||||
|
{{- include "spire-lib.securitycontext" . | nindent 12 }}
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.spireServerAttestorSPIFFEWorkloadAPI.resources | nindent 12 }}
|
||||||
|
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.spireServerAttestorSPIFFEWorkloadAPI.image "global" .Values.global) }}
|
||||||
|
imagePullPolicy: {{ .Values.spireServerAttestorSPIFFEWorkloadAPI.image.pullPolicy }}
|
||||||
|
restartPolicy: Always
|
||||||
|
args:
|
||||||
|
- /trustbundle/socket
|
||||||
|
env:
|
||||||
|
- name: SPIFFE_ENDPOINT_SOCKET
|
||||||
|
value: "unix:///spiffe-workload-api/spire-agent.sock"
|
||||||
|
- name: SPIFFE_TRUST_DOMAIN
|
||||||
|
value: {{ $trustDomain }}
|
||||||
|
readinessProbe:
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /ko-app/spire-server-attestor-spiffe-workload-api
|
||||||
|
- --healthcheck
|
||||||
|
- /trustbundle/socket
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 30
|
||||||
|
timeoutSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
failureThreshold: 3
|
||||||
|
volumeMounts:
|
||||||
|
- name: spiffe-workload-api
|
||||||
|
mountPath: /spiffe-workload-api
|
||||||
|
readOnly: true
|
||||||
|
- name: trustbundle
|
||||||
|
mountPath: /trustbundle
|
||||||
|
- name: spire-agent
|
||||||
|
securityContext:
|
||||||
|
{{- include "spire-lib.securitycontext" . | nindent 12 }}
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.spireAgent.resources | nindent 12 }}
|
||||||
|
image: {{ template "spire-lib.image" (dict "image" .Values.spireAgent.image "global" .Values.global) }}
|
||||||
|
imagePullPolicy: {{ .Values.spireAgent.image.pullPolicy }}
|
||||||
|
restartPolicy: Always
|
||||||
|
args:
|
||||||
|
- -config
|
||||||
|
- /etc/spire/agent/six-agent.conf
|
||||||
|
- -socketPath
|
||||||
|
- /agent-data/api.sock
|
||||||
|
ports:
|
||||||
|
- containerPort: 8182
|
||||||
|
name: healthz
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /live
|
||||||
|
port: healthz
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /ready
|
||||||
|
port: healthz
|
||||||
|
volumeMounts:
|
||||||
|
- name: spiffe-workload-api
|
||||||
|
mountPath: /spiffe-workload-api
|
||||||
|
readOnly: true
|
||||||
|
- name: spire-identity-exchange-config
|
||||||
|
mountPath: /etc/spire/agent/six-agent.conf
|
||||||
|
subPath: six-agent.conf
|
||||||
|
readOnly: true
|
||||||
|
- name: spire-agent-socket
|
||||||
|
mountPath: /agent
|
||||||
|
- name: trustbundle
|
||||||
|
mountPath: /trustbundle
|
||||||
|
readOnly: true
|
||||||
|
- name: spire-agent-data
|
||||||
|
mountPath: /agent-data
|
||||||
|
containers:
|
||||||
|
- name: spire-identity-exchange
|
||||||
|
securityContext:
|
||||||
|
{{- include "spire-lib.securitycontext" . | nindent 12 }}
|
||||||
|
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||||
|
args:
|
||||||
|
- -config
|
||||||
|
- /etc/spire/identity-exchange/six.conf
|
||||||
|
- -expand-env
|
||||||
|
{{- with .Values.extraEnv }}
|
||||||
|
env:
|
||||||
|
{{- . | toYaml | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
{{- if .Values.rest.enabled }}
|
||||||
|
- containerPort: 8444
|
||||||
|
name: rest
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.grpc.enabled }}
|
||||||
|
- containerPort: 8443
|
||||||
|
name: grpc
|
||||||
|
{{- end }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: spiffe-workload-api
|
||||||
|
mountPath: {{ include "spire-identity-exchange.workload-api-socket-path" . | dir }}
|
||||||
|
readOnly: true
|
||||||
|
- name: certdir
|
||||||
|
mountPath: /secret
|
||||||
|
readOnly: true
|
||||||
|
- name: spire-identity-exchange-config
|
||||||
|
mountPath: /etc/spire/identity-exchange/six.conf
|
||||||
|
subPath: six.conf
|
||||||
|
readOnly: true
|
||||||
|
- name: spire-agent-socket
|
||||||
|
mountPath: /agent
|
||||||
|
readOnly: true
|
||||||
|
#readinessProbe:
|
||||||
|
# httpGet:
|
||||||
|
# path: /ready
|
||||||
|
# port: healthz
|
||||||
|
# {- toYaml .Values.readinessProbe | nindent 12 }}
|
||||||
|
#livenessProbe:
|
||||||
|
# httpGet:
|
||||||
|
# path: /live
|
||||||
|
# port: healthz
|
||||||
|
# {- toYaml .Values.livenessProbe | nindent 12 }}
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.resources | nindent 12 }}
|
||||||
|
volumes:
|
||||||
|
- name: spiffe-workload-api
|
||||||
|
csi:
|
||||||
|
driver: "{{ .Values.csiDriverName }}"
|
||||||
|
readOnly: true
|
||||||
|
- name: certdir
|
||||||
|
{{- if .Values.tls.externalSecret.enabled }}
|
||||||
|
secret:
|
||||||
|
secretName: {{ .Values.tls.externalSecret.secretName }}
|
||||||
|
{{- else if .Values.tls.certManager.enabled }}
|
||||||
|
secret:
|
||||||
|
secretName: {{ include "spire-identity-exchange.fullname" . }}-cert
|
||||||
|
{{- end }}
|
||||||
|
- name: spire-agent-socket
|
||||||
|
emptyDir: {}
|
||||||
|
- name: spire-agent-data
|
||||||
|
emptyDir: {}
|
||||||
|
- name: trustbundle
|
||||||
|
emptyDir: {}
|
||||||
|
- name: spire-identity-exchange-config
|
||||||
|
configMap:
|
||||||
|
name: {{ include "spire-identity-exchange.fullname" . }}
|
||||||
|
{{- with .Values.nodeSelector }}
|
||||||
|
nodeSelector:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.affinity }}
|
||||||
|
affinity:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.tolerations }}
|
||||||
|
tolerations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,39 @@
|
|||||||
|
{{- if .Values.grpc.ingress.enabled -}}
|
||||||
|
{{- $port := .Values.grpc.service.port }}
|
||||||
|
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.grpc.ingress) }}
|
||||||
|
{{- $fullName := printf "%s-grpc" (include "spire-identity-exchange.fullname" .) }}
|
||||||
|
{{- $path := "/" }}
|
||||||
|
{{- $pathType := "Prefix" }}
|
||||||
|
{{- $tlsSection := true }}
|
||||||
|
{{- $annotations := deepCopy .Values.grpc.ingress.annotations }}
|
||||||
|
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||||
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||||
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||||
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||||
|
{{- if not (and .Values.grpc.ingress.enabled .Values.grpc.ingress.tlsSecret) }}
|
||||||
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- else if eq $ingressControllerType "openshift" }}
|
||||||
|
{{- if and .Values.grpc.ingress.enabled .Values.grpc.ingress.tlsSecret }}
|
||||||
|
{{- $_ := set $annotations "route.openshift.io/termination" "reencrypt" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $path = "" }}
|
||||||
|
{{- $pathType = "ImplementationSpecific" }}
|
||||||
|
{{- $tlsSection = false }}
|
||||||
|
{{- end }}
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
name: {{ $fullName }}
|
||||||
|
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{ include "spire-identity-exchange.labels" . | nindent 4 }}
|
||||||
|
{{- with $annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.grpc.ingress "svcName" $fullName "port" $port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
{{- if .Values.grpc.enabled }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-identity-exchange.fullname" . }}-grpc
|
||||||
|
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||||
|
{{- with .Values.service.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
type: {{ .Values.grpc.service.type }}
|
||||||
|
{{- if and (eq .Values.grpc.service.type "LoadBalancer") .Values.grpc.service.loadBalancerIP }}
|
||||||
|
loadBalancerIP: {{ .Values.grpc.service.loadBalancerIP }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- name: https
|
||||||
|
port: {{ .Values.grpc.service.port }}
|
||||||
|
targetPort: grpc
|
||||||
|
protocol: TCP
|
||||||
|
selector:
|
||||||
|
{{- include "spire-identity-exchange.selectorLabels" . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,33 @@
|
|||||||
|
{{- if .Values.autoscaling.enabled }}
|
||||||
|
apiVersion: {{ include "spire-lib.autoscalingVersion" . }}
|
||||||
|
kind: HorizontalPodAutoscaler
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-identity-exchange.fullname" . }}
|
||||||
|
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "spire-identity-exchange.labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
scaleTargetRef:
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
name: {{ include "spire-identity-exchange.fullname" . }}
|
||||||
|
minReplicas: {{ .Values.autoscaling.minReplicas }}
|
||||||
|
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
|
||||||
|
metrics:
|
||||||
|
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||||
|
- type: Resource
|
||||||
|
resource:
|
||||||
|
name: memory
|
||||||
|
target:
|
||||||
|
type: Utilization
|
||||||
|
averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||||
|
- type: Resource
|
||||||
|
resource:
|
||||||
|
name: cpu
|
||||||
|
target:
|
||||||
|
type: Utilization
|
||||||
|
averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,22 @@
|
|||||||
|
{{- define "spire-identity-exchange.cert-manager-default-issuer" }}
|
||||||
|
{{- if not .Values.tls.certManager.issuer.acme.email }}
|
||||||
|
{{- fail "You must specify an email address via certManager.issuer.acme.email" }}
|
||||||
|
{{- end }}
|
||||||
|
email: {{ .Values.tls.certManager.issuer.acme.email | quote}}
|
||||||
|
server: {{ .Values.tls.certManager.issuer.acme.server | quote}}
|
||||||
|
privateKeySecretRef:
|
||||||
|
name: {{ include "spire-identity-exchange.fullname" . }}-issuer
|
||||||
|
solvers:
|
||||||
|
- http01:
|
||||||
|
ingress: {}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.tls.certManager.enabled .Values.tls.certManager.issuer.create }}
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: Issuer
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-identity-exchange.fullname" . }}
|
||||||
|
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||||
|
spec:
|
||||||
|
acme:
|
||||||
|
{{ mergeOverwrite (include "spire-identity-exchange.cert-manager-default-issuer" . | fromYaml) .Values.tls.certManager.issuer.acme | toYaml | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,83 @@
|
|||||||
|
{{- if eq ((dig "deleteHooks" "enabled" .Values.deleteHook.enabled .Values.global) | toString) "true" }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-identity-exchange.serviceAccountName" . }}-pre-delete
|
||||||
|
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "spire-identity-exchange.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": pre-delete
|
||||||
|
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-identity-exchange.fullname" . }}-pre-delete
|
||||||
|
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": pre-delete
|
||||||
|
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["apps"]
|
||||||
|
resources: ["deployments"]
|
||||||
|
resourceNames: [{{ include "spire-identity-exchange.fullname" . | quote }}]
|
||||||
|
verbs: ["get", "delete"]
|
||||||
|
---
|
||||||
|
kind: RoleBinding
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-identity-exchange.fullname" . }}-pre-delete
|
||||||
|
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": pre-delete
|
||||||
|
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ include "spire-identity-exchange.serviceAccountName" . }}-pre-delete
|
||||||
|
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||||
|
roleRef:
|
||||||
|
kind: Role
|
||||||
|
name: {{ include "spire-identity-exchange.fullname" . }}-pre-delete
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
---
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-identity-exchange.fullname" . }}-pre-delete
|
||||||
|
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "spire-identity-exchange.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": pre-delete
|
||||||
|
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-identity-exchange.fullname" . }}-pre-delete
|
||||||
|
spec:
|
||||||
|
restartPolicy: Never
|
||||||
|
{{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
serviceAccountName: {{ include "spire-identity-exchange.serviceAccountName" . }}-pre-delete
|
||||||
|
securityContext:
|
||||||
|
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
|
||||||
|
containers:
|
||||||
|
- name: pre-delete-job
|
||||||
|
securityContext:
|
||||||
|
{{- include "spire-lib.securitycontext" . | nindent 10 }}
|
||||||
|
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
|
||||||
|
args:
|
||||||
|
- delete
|
||||||
|
- -n
|
||||||
|
- {{ include "spire-identity-exchange.namespace" . }}
|
||||||
|
- deployment
|
||||||
|
- {{ include "spire-identity-exchange.fullname" . }}
|
||||||
|
- --wait
|
||||||
|
{{- with (((.Values).global).deleteHooks).resources }}
|
||||||
|
resources:
|
||||||
|
{{- toYaml . | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,39 @@
|
|||||||
|
{{- if .Values.rest.ingress.enabled -}}
|
||||||
|
{{- $port := .Values.rest.service.port }}
|
||||||
|
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.rest.ingress) }}
|
||||||
|
{{- $fullName := printf "%s-rest" (include "spire-identity-exchange.fullname" .) }}
|
||||||
|
{{- $path := "/" }}
|
||||||
|
{{- $pathType := "Prefix" }}
|
||||||
|
{{- $tlsSection := true }}
|
||||||
|
{{- $annotations := deepCopy .Values.rest.ingress.annotations }}
|
||||||
|
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||||
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||||
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||||
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||||
|
{{- if not (and .Values.rest.ingress.enabled .Values.rest.ingress.tlsSecret) }}
|
||||||
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- else if eq $ingressControllerType "openshift" }}
|
||||||
|
{{- if and .Values.rest.ingress.enabled .Values.rest.ingress.tlsSecret }}
|
||||||
|
{{- $_ := set $annotations "route.openshift.io/termination" "reencrypt" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $path = "" }}
|
||||||
|
{{- $pathType = "ImplementationSpecific" }}
|
||||||
|
{{- $tlsSection = false }}
|
||||||
|
{{- end }}
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
name: {{ $fullName }}
|
||||||
|
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{ include "spire-identity-exchange.labels" . | nindent 4 }}
|
||||||
|
{{- with $annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.rest.ingress "svcName" $fullName "port" $port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
{{- if .Values.rest.enabled }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-identity-exchange.fullname" . }}-rest
|
||||||
|
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||||
|
{{- with .Values.rest.service.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
type: {{ .Values.rest.service.type }}
|
||||||
|
{{- if and (eq .Values.rest.service.type "LoadBalancer") .Values.rest.service.loadBalancerIP }}
|
||||||
|
loadBalancerIP: {{ .Values.rest.service.loadBalancerIP }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- name: https
|
||||||
|
port: {{ .Values.rest.service.port }}
|
||||||
|
targetPort: rest
|
||||||
|
protocol: TCP
|
||||||
|
selector:
|
||||||
|
{{- include "spire-identity-exchange.selectorLabels" . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,27 @@
|
|||||||
|
{{- if .Values.clusterRole.create -}}
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ .Release.Namespace}}-{{ include "spire-identity-exchange.fullname" . }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["authentication.k8s.io"]
|
||||||
|
resources: ["tokenreviews"]
|
||||||
|
verbs: ["create"]
|
||||||
|
- nonResourceURLs:
|
||||||
|
- /.well-known/openid-configuration
|
||||||
|
- /openid/v1/jwks
|
||||||
|
verbs: ["get"]
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ .Release.Namespace}}-{{ include "spire-identity-exchange.fullname" . }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ .Release.Namespace}}-{{ include "spire-identity-exchange.fullname" . }}
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ include "spire-identity-exchange.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
{{- if .Values.serviceAccount.create -}}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-identity-exchange.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "spire-identity-exchange.labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.serviceAccount.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,359 @@
|
|||||||
|
# Default configuration for SPIRE Identity Exchange chart
|
||||||
|
# SPDX-License-Identifier: APACHE-2.0
|
||||||
|
|
||||||
|
## @skip global
|
||||||
|
global: {}
|
||||||
|
|
||||||
|
## @section Chart parameters
|
||||||
|
##
|
||||||
|
## @param agentSocketName The name of the spire-agent unix socket
|
||||||
|
agentSocketName: spire-agent.sock
|
||||||
|
## @param csiDriverName The csi driver to use
|
||||||
|
csiDriverName: csi.spiffe.io
|
||||||
|
|
||||||
|
## @param replicaCount Replica count
|
||||||
|
replicaCount: 1
|
||||||
|
|
||||||
|
## @param namespaceOverride Namespace override
|
||||||
|
namespaceOverride: ""
|
||||||
|
|
||||||
|
## @param annotations [object] Annotations for the deployment
|
||||||
|
annotations: {}
|
||||||
|
|
||||||
|
## @param labels [object] Labels for the deployment
|
||||||
|
labels: {}
|
||||||
|
# if you configured your controller manager to register pods based on labels, you need to add these labels here too
|
||||||
|
# For instance:
|
||||||
|
# spiffe.io/spiffe-id: "true"
|
||||||
|
|
||||||
|
image:
|
||||||
|
## @param image.registry The OCI registry to pull the image from
|
||||||
|
## @param image.repository The repository within the registry
|
||||||
|
## @param image.pullPolicy The image pull policy
|
||||||
|
## @param image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
|
registry: ghcr.io
|
||||||
|
repository: spiffe/spire-identity-exchange-server
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
tag: ""
|
||||||
|
|
||||||
|
spireServerAttestorSPIFFEWorkloadAPI:
|
||||||
|
## @param spireServerAttestorSPIFFEWorkloadAPI.resources [object] Resource requests and limits
|
||||||
|
resources: {}
|
||||||
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
|
# choice for the user. This also increases chances charts run on environments with little
|
||||||
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||||
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||||
|
# requests:
|
||||||
|
# cpu: 50m
|
||||||
|
# memory: 32Mi
|
||||||
|
# limits:
|
||||||
|
# cpu: 100m
|
||||||
|
# memory: 64Mi
|
||||||
|
image:
|
||||||
|
## @param spireServerAttestorSPIFFEWorkloadAPI.image.registry The OCI registry to pull the image from
|
||||||
|
## @param spireServerAttestorSPIFFEWorkloadAPI.image.repository The repository within the registry
|
||||||
|
## @param spireServerAttestorSPIFFEWorkloadAPI.image.pullPolicy The image pull policy
|
||||||
|
## @param spireServerAttestorSPIFFEWorkloadAPI.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
|
registry: ghcr.io
|
||||||
|
repository: spiffe/spire-server-attestor-spiffe-workload-api
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
tag: ""
|
||||||
|
|
||||||
|
spireAgent:
|
||||||
|
## @param spireAgent.resources [object] Resource requests and limits
|
||||||
|
resources: {}
|
||||||
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
|
# choice for the user. This also increases chances charts run on environments with little
|
||||||
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||||
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||||
|
# requests:
|
||||||
|
# cpu: 50m
|
||||||
|
# memory: 32Mi
|
||||||
|
# limits:
|
||||||
|
# cpu: 100m
|
||||||
|
# memory: 64Mi
|
||||||
|
image:
|
||||||
|
## @param spireAgent.image.registry The OCI registry to pull the image from
|
||||||
|
## @param spireAgent.image.repository The repository within the registry
|
||||||
|
## @param spireAgent.image.pullPolicy The image pull policy
|
||||||
|
## @param spireAgent.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
|
registry: ghcr.io
|
||||||
|
repository: spiffe/spire-agent
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
tag: "1.15.1"
|
||||||
|
|
||||||
|
## @param extraEnv [array] Extra environment variables to add to the spire identity exchange
|
||||||
|
extraEnv: []
|
||||||
|
|
||||||
|
## @param resources [object] Resource requests and limits
|
||||||
|
resources: {}
|
||||||
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
|
# choice for the user. This also increases chances charts run on environments with little
|
||||||
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||||
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||||
|
# requests:
|
||||||
|
# cpu: 50m
|
||||||
|
# memory: 32Mi
|
||||||
|
# limits:
|
||||||
|
# cpu: 100m
|
||||||
|
# memory: 64Mi
|
||||||
|
|
||||||
|
configMap:
|
||||||
|
## @param configMap.annotations [object] Annotations to add to the SPIRE Identity Exchange ConfigMap
|
||||||
|
annotations: {}
|
||||||
|
|
||||||
|
## @param podSecurityContext [object] Pod security context for SPIRE Identity Exchange pods
|
||||||
|
podSecurityContext: {}
|
||||||
|
# fsGroup: 2000
|
||||||
|
|
||||||
|
## @param securityContext [object] Security context for SPIRE Identity Exchange deployment
|
||||||
|
securityContext: {}
|
||||||
|
# capabilities:
|
||||||
|
# drop:
|
||||||
|
# - ALL
|
||||||
|
# readOnlyRootFilesystem: true
|
||||||
|
# runAsNonRoot: true
|
||||||
|
# runAsUser: 1000
|
||||||
|
|
||||||
|
## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
|
||||||
|
## @param readinessProbe.periodSeconds Period seconds for readinessProbe
|
||||||
|
##
|
||||||
|
readinessProbe:
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 5
|
||||||
|
|
||||||
|
## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
|
||||||
|
## @param livenessProbe.periodSeconds Period seconds for livenessProbe
|
||||||
|
##
|
||||||
|
livenessProbe:
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 5
|
||||||
|
|
||||||
|
## @param podAnnotations [object] Pod annotations for SPIRE Identity Exchange
|
||||||
|
podAnnotations: {}
|
||||||
|
|
||||||
|
## @param podLabels [object] Labels to add to pods
|
||||||
|
podLabels: {}
|
||||||
|
|
||||||
|
# Select one of the options below to be the source of certificates for SPIRE Identity Exchange
|
||||||
|
tls:
|
||||||
|
|
||||||
|
externalSecret:
|
||||||
|
## @param tls.externalSecret.enabled Provide your own certificate/key via tls style Kubernetes Secret
|
||||||
|
enabled: false
|
||||||
|
## @param tls.externalSecret.secretName Specify which Secret to use
|
||||||
|
secretName: ""
|
||||||
|
|
||||||
|
certManager:
|
||||||
|
## @param tls.certManager.enabled Use certificateManager to create the certificate
|
||||||
|
enabled: false
|
||||||
|
issuer:
|
||||||
|
## @param tls.certManager.issuer.create Create an issuer to use to issue the certificate
|
||||||
|
create: true
|
||||||
|
acme:
|
||||||
|
## @param tls.certManager.issuer.acme.email Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service
|
||||||
|
email: ""
|
||||||
|
## @param tls.certManager.issuer.acme.server Server to use to get certificate. Defaults to LetsEncrypt
|
||||||
|
server: https://acme-v02.api.letsencrypt.org/directory
|
||||||
|
# Testing server: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||||
|
## @param tls.certManager.issuer.acme.solvers [object] Configure the issuer solvers. Defaults to http01 via ingress.
|
||||||
|
solvers: {}
|
||||||
|
# - http01:
|
||||||
|
# ingress:
|
||||||
|
# ingressClassName: nginx
|
||||||
|
certificate:
|
||||||
|
## @param tls.certManager.certificate.dnsNames Override the dnsNames on the certificate request. Defaults to the same settings as Ingress
|
||||||
|
dnsNames: []
|
||||||
|
## @param tls.certManager.certificate.issuerRef.group If you are using an external plugin, specify the group for it here
|
||||||
|
## @param tls.certManager.certificate.issuerRef.kind Kind of the issuer reference. Override if you want to use a ClusterIssuer
|
||||||
|
## @param tls.certManager.certificate.issuerRef.name Name of the issuer to use. If unset, it will use the name of the built in issuer
|
||||||
|
issuerRef:
|
||||||
|
group: ""
|
||||||
|
kind: Issuer
|
||||||
|
name: ""
|
||||||
|
|
||||||
|
config:
|
||||||
|
## @param config.logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
||||||
|
logLevel: info
|
||||||
|
## @param config.logFormat The log format, valid values are "text" and "json"
|
||||||
|
logFormat: text
|
||||||
|
|
||||||
|
## @param imagePullSecrets [array] Image pull secret names
|
||||||
|
imagePullSecrets: []
|
||||||
|
|
||||||
|
## @param nameOverride Name override
|
||||||
|
nameOverride: ""
|
||||||
|
|
||||||
|
## @param fullnameOverride Full name override
|
||||||
|
fullnameOverride: ""
|
||||||
|
|
||||||
|
## @param serviceAccount.create Specifies whether a service account should be created
|
||||||
|
## @param serviceAccount.annotations Annotations to add to the service account
|
||||||
|
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
|
||||||
|
##
|
||||||
|
serviceAccount:
|
||||||
|
create: true
|
||||||
|
annotations: {}
|
||||||
|
name: ""
|
||||||
|
|
||||||
|
deleteHook:
|
||||||
|
## @param deleteHook.enabled Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`)
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
## @param autoscaling.enabled Flag to enable autoscaling
|
||||||
|
## @param autoscaling.minReplicas Minimum replicas for autoscaling
|
||||||
|
## @param autoscaling.maxReplicas Maximum replicas for autoscaling
|
||||||
|
## @param autoscaling.targetCPUUtilizationPercentage Target CPU utlization that triggers autoscaling
|
||||||
|
## @param autoscaling.targetMemoryUtilizationPercentage Target Memory utlization that triggers autoscaling
|
||||||
|
##
|
||||||
|
autoscaling:
|
||||||
|
enabled: false
|
||||||
|
minReplicas: 1
|
||||||
|
maxReplicas: 5
|
||||||
|
targetCPUUtilizationPercentage: 80
|
||||||
|
targetMemoryUtilizationPercentage: 80
|
||||||
|
|
||||||
|
## @param nodeSelector [object] Node selector
|
||||||
|
nodeSelector: {}
|
||||||
|
|
||||||
|
## @param tolerations [array] iist of tolerations
|
||||||
|
tolerations: []
|
||||||
|
|
||||||
|
## @param affinity [object] Node affinity
|
||||||
|
affinity: {}
|
||||||
|
|
||||||
|
## @param trustDomain Set the trust domain to be used for the SPIFFE identifiers
|
||||||
|
trustDomain: example.org
|
||||||
|
|
||||||
|
## @param clusterDomain The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)
|
||||||
|
clusterDomain: cluster.local
|
||||||
|
|
||||||
|
auth:
|
||||||
|
## @param auth.plugins [object] Plugins to load
|
||||||
|
plugins: []
|
||||||
|
## @param auth.stacks [object] Stacks to load
|
||||||
|
stacks: []
|
||||||
|
|
||||||
|
rest:
|
||||||
|
## @param rest.enabled Enable the rest service
|
||||||
|
enabled: true
|
||||||
|
## @param rest.service.type Service type
|
||||||
|
## @param rest.service.port port for the service
|
||||||
|
## @param rest.service.annotations Annotations for service resource
|
||||||
|
##
|
||||||
|
service:
|
||||||
|
type: ClusterIP
|
||||||
|
port: 443
|
||||||
|
annotations: {}
|
||||||
|
# external-dns.alpha.kubernetes.io/hostname: spire-identity-exchange-rest.example.org
|
||||||
|
## @param rest.service.loadBalancerIP IP address to assign to load balancer (if supported)
|
||||||
|
loadBalancerIP: ""
|
||||||
|
ingress:
|
||||||
|
## @param rest.ingress.enabled Flag to enable ingress
|
||||||
|
enabled: false
|
||||||
|
## @param rest.ingress.className Ingress class name
|
||||||
|
className: ""
|
||||||
|
## @param rest.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||||
|
controllerType: ""
|
||||||
|
## @param rest.ingress.annotations [object] Annotations for ingress object
|
||||||
|
annotations: {}
|
||||||
|
# kubernetes.io/ingress.class: nginx
|
||||||
|
# kubernetes.io/tls-acme: "true"
|
||||||
|
# nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||||
|
# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||||
|
|
||||||
|
## @param rest.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||||
|
host: "spire-identity-exchange-rest"
|
||||||
|
|
||||||
|
## @param rest.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||||
|
tlsSecret: ""
|
||||||
|
|
||||||
|
## @param rest.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||||
|
hosts: []
|
||||||
|
# - host: spire-identity-exchange-rest.example.org
|
||||||
|
# paths:
|
||||||
|
# - path: /
|
||||||
|
# pathType: Prefix
|
||||||
|
|
||||||
|
## @param rest.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||||
|
tls: []
|
||||||
|
# - secretName: chart-example-tls
|
||||||
|
# hosts:
|
||||||
|
# - spire-identity-exchange-rest.example.org
|
||||||
|
|
||||||
|
grpc:
|
||||||
|
## @param grpc.enabled Enable the grpc service
|
||||||
|
enabled: false
|
||||||
|
## @param grpc.service.type Service type
|
||||||
|
## @param grpc.service.port port for the service
|
||||||
|
## @param grpc.service.annotations Annotations for service resource
|
||||||
|
##
|
||||||
|
service:
|
||||||
|
type: ClusterIP
|
||||||
|
port: 443
|
||||||
|
annotations: {}
|
||||||
|
# external-dns.alpha.kubernetes.io/hostname: spire-identity-exchange-grpc.example.org
|
||||||
|
## @param grpc.service.loadBalancerIP IP address to assign to load balancer (if supported)
|
||||||
|
loadBalancerIP: ""
|
||||||
|
ingress:
|
||||||
|
## @param grpc.ingress.enabled Flag to enable ingress
|
||||||
|
enabled: false
|
||||||
|
## @param grpc.ingress.className Ingress class name
|
||||||
|
className: ""
|
||||||
|
## @param grpc.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||||
|
controllerType: ""
|
||||||
|
## @param grpc.ingress.annotations [object] Annotations for ingress object
|
||||||
|
annotations: {}
|
||||||
|
# kubernetes.io/ingress.class: nginx
|
||||||
|
# kubernetes.io/tls-acme: "true"
|
||||||
|
# nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||||
|
# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||||
|
|
||||||
|
## @param grpc.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The grpc of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||||
|
host: "spire-identity-exchange-grpc"
|
||||||
|
|
||||||
|
## @param grpc.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||||
|
tlsSecret: ""
|
||||||
|
|
||||||
|
## @param grpc.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||||
|
hosts: []
|
||||||
|
# - host: spire-identity-exchange-grpc.example.org
|
||||||
|
# paths:
|
||||||
|
# - path: /
|
||||||
|
# pathType: Prefix
|
||||||
|
|
||||||
|
## @param grpc.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||||
|
tls: []
|
||||||
|
# - secretName: chart-example-tls
|
||||||
|
# hosts:
|
||||||
|
# - spire-identiy-exchange-grpc.example.org
|
||||||
|
|
||||||
|
tools:
|
||||||
|
kubectl:
|
||||||
|
## @param tools.kubectl.image.registry The OCI registry to pull the image from
|
||||||
|
## @param tools.kubectl.image.repository The repository within the registry
|
||||||
|
## @param tools.kubectl.image.pullPolicy The image pull policy
|
||||||
|
## @param tools.kubectl.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
|
image:
|
||||||
|
registry: registry.k8s.io
|
||||||
|
repository: kubectl
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
tag: ""
|
||||||
|
clusterRole:
|
||||||
|
## @param clusterRole.create create a k8s cluster role to allow access to token reviews and oidc discovery
|
||||||
|
create: true
|
||||||
|
|
||||||
|
## @param server.address Address for Spire server
|
||||||
|
## @param server.port Port number for Spire server
|
||||||
|
## @param server.namespaceOverride Override the namespace for Spire server
|
||||||
|
## @param server.nameOverride Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align.
|
||||||
|
##
|
||||||
|
server:
|
||||||
|
address: ""
|
||||||
|
port: 443
|
||||||
|
namespaceOverride: ""
|
||||||
|
nameOverride: ""
|
||||||
@@ -56,6 +56,9 @@ dependencies:
|
|||||||
- name: spiffe-csi-driver
|
- name: spiffe-csi-driver
|
||||||
repository: file://../spire/charts/spiffe-csi-driver
|
repository: file://../spire/charts/spiffe-csi-driver
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
|
- name: spire-identity-exchange
|
||||||
|
repository: file://../spire-identity-exchange
|
||||||
|
version: 0.1.0
|
||||||
- name: spire-server
|
- name: spire-server
|
||||||
repository: file://../spire/charts/spire-server
|
repository: file://../spire/charts/spire-server
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
@@ -68,5 +71,8 @@ dependencies:
|
|||||||
- name: spiffe-csi-driver
|
- name: spiffe-csi-driver
|
||||||
repository: file://../spire/charts/spiffe-csi-driver
|
repository: file://../spire/charts/spiffe-csi-driver
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
digest: sha256:31c9c0410c08f27c65d38dc78967699b65ed289aa9064b7167673abfe6d219d6
|
- name: spire-identity-exchange
|
||||||
generated: "2026-06-06T08:13:06.564494-07:00"
|
repository: file://../spire-identity-exchange
|
||||||
|
version: 0.1.0
|
||||||
|
digest: sha256:418e807bf7ff9504d000e3d1bc581faf83c91e0792e05ec7c11aaaa2cb54caf4
|
||||||
|
generated: "2026-06-30T07:46:43.45713065-07:00"
|
||||||
|
|||||||
@@ -153,6 +153,13 @@ dependencies:
|
|||||||
- bottomTurtleHAA
|
- bottomTurtleHAA
|
||||||
repository: file://../spire/charts/spiffe-csi-driver
|
repository: file://../spire/charts/spiffe-csi-driver
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
|
- name: spire-identity-exchange
|
||||||
|
alias: spire-identity-exchange-bottom-turtle-ha-a
|
||||||
|
condition: spire-identity-exchange-bottom-turtle-ha-a.enabled
|
||||||
|
repository: file://../spire-identity-exchange
|
||||||
|
version: 0.1.0
|
||||||
|
tags:
|
||||||
|
- bottomTurtleHAA
|
||||||
- name: spire-server
|
- name: spire-server
|
||||||
alias: internal-spire-server-bottom-turtle-ha-b
|
alias: internal-spire-server-bottom-turtle-ha-b
|
||||||
condition: internal-spire-server-bottom-turtle-ha-b.enabled
|
condition: internal-spire-server-bottom-turtle-ha-b.enabled
|
||||||
@@ -181,6 +188,13 @@ dependencies:
|
|||||||
- bottomTurtleHAB
|
- bottomTurtleHAB
|
||||||
repository: file://../spire/charts/spiffe-csi-driver
|
repository: file://../spire/charts/spiffe-csi-driver
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
|
- name: spire-identity-exchange
|
||||||
|
alias: spire-identity-exchange-bottom-turtle-ha-b
|
||||||
|
condition: spire-identity-exchange-bottom-turtle-ha-b.enabled
|
||||||
|
repository: file://../spire-identity-exchange
|
||||||
|
version: 0.1.0
|
||||||
|
tags:
|
||||||
|
- bottomTurtleHAB
|
||||||
annotations:
|
annotations:
|
||||||
artifacthub.io/category: security
|
artifacthub.io/category: security
|
||||||
artifacthub.io/license: Apache-2.0
|
artifacthub.io/license: Apache-2.0
|
||||||
|
|||||||
@@ -398,12 +398,13 @@ Now you can interact with the Spire agent socket from your own application. The
|
|||||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` |
|
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type` | The type of the entry | `oidc-discovery-provider-common` |
|
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type` | The type of the entry | `oidc-discovery-provider-common` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled` | Enables the spire-ha-agent identity | `true` |
|
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled` | Enables the spire-ha-agent identity | `true` |
|
||||||
|
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.spire-identity-exchange-service.federatesWith` | List of trust domains to federate with | `[]` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-a.persistence.type` | What type to use for peristence | `emptyDir` |
|
| `internal-spire-server-bottom-turtle-ha-a.persistence.type` | What type to use for peristence | `emptyDir` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.k8sPSAT.enabled` | Enable the k8s projected access token node attestor | `false` |
|
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.k8sPSAT.enabled` | Enable the k8s projected access token node attestor | `false` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled` | Enable the x509 pop node attestor | `true` |
|
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled` | Enable the x509 pop node attestor | `true` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.svidPrefix` | What prefix to use when mode is spiffe | `/spire-exchange/k8s` |
|
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.spiffePrefix` | What prefix to use when mode is spiffe | `/spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `/{{ .PluginName }}/{{ .SVIDPathTrimmed }}/k8s` |
|
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.svidPrefix` | Suffix the cluster name onto the svidPrefix | `true` |
|
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.spiffePrefix` | Suffix the cluster name onto the spiffePrefix | `true` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.agentPathTemplate` | Suffix the cluster name onto the agentPathTemplate | `true` |
|
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.agentPathTemplate` | Suffix the cluster name onto the agentPathTemplate | `true` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
|
| `internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream-a.csi.spiffe.io` |
|
| `internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream-a.csi.spiffe.io` |
|
||||||
@@ -430,12 +431,13 @@ Now you can interact with the Spire agent socket from your own application. The
|
|||||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` |
|
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type` | The type of the entry | `oidc-discovery-provider-common` |
|
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type` | The type of the entry | `oidc-discovery-provider-common` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled` | Enables the spire-ha-agent identity | `true` |
|
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled` | Enables the spire-ha-agent identity | `true` |
|
||||||
|
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.spire-identity-exchange-service.federatesWith` | List of trust domains to federate with | `[]` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-b.persistence.type` | What type to use for peristence | `emptyDir` |
|
| `internal-spire-server-bottom-turtle-ha-b.persistence.type` | What type to use for peristence | `emptyDir` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.k8sPSAT.enabled` | Enable the k8s projected access token node attestor | `false` |
|
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.k8sPSAT.enabled` | Enable the k8s projected access token node attestor | `false` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled` | Enable the x509 pop node attestor | `true` |
|
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled` | Enable the x509 pop node attestor | `true` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.svidPrefix` | What prefix to use when mode is spiffe | `/spire-exchange/k8s` |
|
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.spiffePrefix` | What prefix to use when mode is spiffe | `/spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `/{{ .PluginName }}/{{ .SVIDPathTrimmed }}/k8s` |
|
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.svidPrefix` | Suffix the cluster name onto the svidPrefix | `true` |
|
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.spiffePrefix` | Suffix the cluster name onto the spiffePrefix | `true` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.agentPathTemplate` | Suffix the cluster name onto the agentPathTemplate | `true` |
|
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.agentPathTemplate` | Suffix the cluster name onto the agentPathTemplate | `true` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
|
| `internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
|
||||||
| `internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream-b.csi.spiffe.io` |
|
| `internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream-b.csi.spiffe.io` |
|
||||||
@@ -491,3 +493,15 @@ Now you can interact with the Spire agent socket from your own application. The
|
|||||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.agentSocketPath` | path to agent socket | `/var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock` |
|
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.agentSocketPath` | path to agent socket | `/var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock` |
|
||||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.pluginName` | The name of the plugin instance | `b.csi.spiffe.io` |
|
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.pluginName` | The name of the plugin instance | `b.csi.spiffe.io` |
|
||||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.healthChecks.port` | The health check port | `9816` |
|
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.healthChecks.port` | The health check port | `9816` |
|
||||||
|
| `spire-identity-exchange-bottom-turtle-ha-a.enabled` | Enable the spire-identity-exchange | `false` |
|
||||||
|
| `spire-identity-exchange-bottom-turtle-ha-a.nameOverride` | name override | `identity-exchange` |
|
||||||
|
| `spire-identity-exchange-bottom-turtle-ha-a.csiDriverName` | CSI driver name to use | `a.csi.spiffe.io` |
|
||||||
|
| `spire-identity-exchange-bottom-turtle-ha-a.rest.ingress.host` | Hostname override for the rest ingress service | `spire-identity-exchange-a-rest` |
|
||||||
|
| `spire-identity-exchange-bottom-turtle-ha-a.grpc.ingress.host` | Hostname override for the rest ingress service | `spire-identity-exchange-a-grpc` |
|
||||||
|
| `spire-identity-exchange-bottom-turtle-ha-a.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
|
||||||
|
| `spire-identity-exchange-bottom-turtle-ha-b.enabled` | Enable the spire-identity-exchange | `false` |
|
||||||
|
| `spire-identity-exchange-bottom-turtle-ha-b.nameOverride` | name override | `identity-exchange` |
|
||||||
|
| `spire-identity-exchange-bottom-turtle-ha-b.csiDriverName` | CSI driver name to use | `b.csi.spiffe.io` |
|
||||||
|
| `spire-identity-exchange-bottom-turtle-ha-b.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
|
||||||
|
| `spire-identity-exchange-bottom-turtle-ha-b.rest.ingress.host` | Hostname override for the rest ingress service | `spire-identity-exchange-b-rest` |
|
||||||
|
| `spire-identity-exchange-bottom-turtle-ha-b.grpc.ingress.host` | Hostname override for the rest ingress service | `spire-identity-exchange-b-grpc` |
|
||||||
|
|||||||
@@ -497,6 +497,10 @@ internal-spire-server-bottom-turtle-ha-a:
|
|||||||
spire-ha-agent:
|
spire-ha-agent:
|
||||||
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled Enables the spire-ha-agent identity
|
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled Enables the spire-ha-agent identity
|
||||||
enabled: true
|
enabled: true
|
||||||
|
spire-identity-exchange-service:
|
||||||
|
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.spire-identity-exchange-service.federatesWith [array] List of trust domains to federate with
|
||||||
|
federatesWith:
|
||||||
|
- spire-ha
|
||||||
persistence:
|
persistence:
|
||||||
## @param internal-spire-server-bottom-turtle-ha-a.persistence.type What type to use for peristence
|
## @param internal-spire-server-bottom-turtle-ha-a.persistence.type What type to use for peristence
|
||||||
type: emptyDir
|
type: emptyDir
|
||||||
@@ -507,13 +511,13 @@ internal-spire-server-bottom-turtle-ha-a:
|
|||||||
x509POP:
|
x509POP:
|
||||||
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
|
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
|
||||||
enabled: true
|
enabled: true
|
||||||
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.svidPrefix What prefix to use when mode is spiffe
|
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.spiffePrefix What prefix to use when mode is spiffe
|
||||||
svidPrefix: /spire-exchange/k8s
|
spiffePrefix: /spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/
|
||||||
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
|
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
|
||||||
agentPathTemplate: "/{{ .PluginName }}/{{ .SVIDPathTrimmed }}/k8s"
|
agentPathTemplate: "/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}"
|
||||||
addClusterName:
|
addClusterName:
|
||||||
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.svidPrefix Suffix the cluster name onto the svidPrefix
|
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.spiffePrefix Suffix the cluster name onto the spiffePrefix
|
||||||
svidPrefix: true
|
spiffePrefix: true
|
||||||
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
|
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
|
||||||
agentPathTemplate: true
|
agentPathTemplate: true
|
||||||
upstreamAuthority:
|
upstreamAuthority:
|
||||||
@@ -575,6 +579,10 @@ internal-spire-server-bottom-turtle-ha-b:
|
|||||||
spire-ha-agent:
|
spire-ha-agent:
|
||||||
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled Enables the spire-ha-agent identity
|
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled Enables the spire-ha-agent identity
|
||||||
enabled: true
|
enabled: true
|
||||||
|
spire-identity-exchange-service:
|
||||||
|
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.spire-identity-exchange-service.federatesWith [array] List of trust domains to federate with
|
||||||
|
federatesWith:
|
||||||
|
- spire-ha
|
||||||
persistence:
|
persistence:
|
||||||
## @param internal-spire-server-bottom-turtle-ha-b.persistence.type What type to use for peristence
|
## @param internal-spire-server-bottom-turtle-ha-b.persistence.type What type to use for peristence
|
||||||
type: emptyDir
|
type: emptyDir
|
||||||
@@ -585,13 +593,13 @@ internal-spire-server-bottom-turtle-ha-b:
|
|||||||
x509POP:
|
x509POP:
|
||||||
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
|
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
|
||||||
enabled: true
|
enabled: true
|
||||||
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.svidPrefix What prefix to use when mode is spiffe
|
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.spiffePrefix What prefix to use when mode is spiffe
|
||||||
svidPrefix: /spire-exchange/k8s
|
spiffePrefix: /spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/
|
||||||
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
|
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
|
||||||
agentPathTemplate: "/{{ .PluginName }}/{{ .SVIDPathTrimmed }}/k8s"
|
agentPathTemplate: "/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}"
|
||||||
addClusterName:
|
addClusterName:
|
||||||
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.svidPrefix Suffix the cluster name onto the svidPrefix
|
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.spiffePrefix Suffix the cluster name onto the spiffePrefix
|
||||||
svidPrefix: true
|
spiffePrefix: true
|
||||||
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
|
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
|
||||||
agentPathTemplate: true
|
agentPathTemplate: true
|
||||||
upstreamAuthority:
|
upstreamAuthority:
|
||||||
@@ -755,3 +763,41 @@ downstream-spiffe-csi-driver-bottom-turtle-ha-b:
|
|||||||
healthChecks:
|
healthChecks:
|
||||||
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.healthChecks.port The health check port
|
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.healthChecks.port The health check port
|
||||||
port: 9816
|
port: 9816
|
||||||
|
|
||||||
|
spire-identity-exchange-bottom-turtle-ha-a:
|
||||||
|
## @param spire-identity-exchange-bottom-turtle-ha-a.enabled Enable the spire-identity-exchange
|
||||||
|
enabled: false
|
||||||
|
## @param spire-identity-exchange-bottom-turtle-ha-a.nameOverride name override
|
||||||
|
nameOverride: identity-exchange
|
||||||
|
## @param spire-identity-exchange-bottom-turtle-ha-a.csiDriverName CSI driver name to use
|
||||||
|
csiDriverName: a.csi.spiffe.io
|
||||||
|
rest:
|
||||||
|
ingress:
|
||||||
|
## @param spire-identity-exchange-bottom-turtle-ha-a.rest.ingress.host Hostname override for the rest ingress service
|
||||||
|
host: "spire-identity-exchange-a-rest"
|
||||||
|
grpc:
|
||||||
|
ingress:
|
||||||
|
## @param spire-identity-exchange-bottom-turtle-ha-a.grpc.ingress.host Hostname override for the rest ingress service
|
||||||
|
host: "spire-identity-exchange-a-grpc"
|
||||||
|
server:
|
||||||
|
## @param spire-identity-exchange-bottom-turtle-ha-a.server.nameOverride The name override setting of the internal SPIRE server
|
||||||
|
nameOverride: internal-server
|
||||||
|
|
||||||
|
spire-identity-exchange-bottom-turtle-ha-b:
|
||||||
|
## @param spire-identity-exchange-bottom-turtle-ha-b.enabled Enable the spire-identity-exchange
|
||||||
|
enabled: false
|
||||||
|
## @param spire-identity-exchange-bottom-turtle-ha-b.nameOverride name override
|
||||||
|
nameOverride: identity-exchange
|
||||||
|
## @param spire-identity-exchange-bottom-turtle-ha-b.csiDriverName CSI driver name to use
|
||||||
|
csiDriverName: b.csi.spiffe.io
|
||||||
|
server:
|
||||||
|
## @param spire-identity-exchange-bottom-turtle-ha-b.server.nameOverride The name override setting of the internal SPIRE server
|
||||||
|
nameOverride: internal-server
|
||||||
|
rest:
|
||||||
|
ingress:
|
||||||
|
## @param spire-identity-exchange-bottom-turtle-ha-b.rest.ingress.host Hostname override for the rest ingress service
|
||||||
|
host: "spire-identity-exchange-b-rest"
|
||||||
|
grpc:
|
||||||
|
ingress:
|
||||||
|
## @param spire-identity-exchange-bottom-turtle-ha-b.grpc.ingress.host Hostname override for the rest ingress service
|
||||||
|
host: "spire-identity-exchange-b-grpc"
|
||||||
|
|||||||
@@ -32,5 +32,8 @@ dependencies:
|
|||||||
- name: spike-pilot
|
- name: spike-pilot
|
||||||
repository: file://./charts/spike-pilot
|
repository: file://./charts/spike-pilot
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
digest: sha256:c93438bb4c5317a25ffef1ce93dbd6c9dbd07295e101377e9a2bb8320ee14622
|
- name: spire-identity-exchange
|
||||||
generated: "2026-06-06T08:13:02.92098-07:00"
|
repository: file://../spire-identity-exchange
|
||||||
|
version: 0.1.0
|
||||||
|
digest: sha256:38b85a4bf147cc86a432ac32dfd3473e27efc6b6a3c1563340444bbe049a4746
|
||||||
|
generated: "2026-06-27T10:53:07.840372246-07:00"
|
||||||
|
|||||||
@@ -68,6 +68,10 @@ dependencies:
|
|||||||
condition: spike-pilot.enabled
|
condition: spike-pilot.enabled
|
||||||
repository: file://./charts/spike-pilot
|
repository: file://./charts/spike-pilot
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
|
- name: spire-identity-exchange
|
||||||
|
condition: spire-identity-exchange.enabled
|
||||||
|
repository: file://../spire-identity-exchange
|
||||||
|
version: 0.1.0
|
||||||
annotations:
|
annotations:
|
||||||
org.opencontainers.image.source: https://github.com/spiffe/helm-charts-hardened
|
org.opencontainers.image.source: https://github.com/spiffe/helm-charts-hardened
|
||||||
artifacthub.io/category: security
|
artifacthub.io/category: security
|
||||||
|
|||||||
+11
-3
@@ -79,6 +79,12 @@ kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeid
|
|||||||
|
|
||||||
We only support upgrading one major/minor version at a time. Version skipping isn't supported. Please see <https://spiffe.io/docs/latest/spire-helm-charts-hardened-about/upgrading/> for details.
|
We only support upgrading one major/minor version at a time. Version skipping isn't supported. Please see <https://spiffe.io/docs/latest/spire-helm-charts-hardened-about/upgrading/> for details.
|
||||||
|
|
||||||
|
### 0.31.X
|
||||||
|
|
||||||
|
- The x509POP plugin in spiffe mode has had its defaults changed. It allows easier and more secure setups. If using and upgrading, please review the settings.
|
||||||
|
- To add the spike entries, you now must also specify spire-server.spike.enabled=true.
|
||||||
|
- Experimental support for the spire-identity-exchange has been added.
|
||||||
|
|
||||||
### 0.30.X
|
### 0.30.X
|
||||||
|
|
||||||
- The OIDC discovery issuer is now set automatically. We do not anticipate any negative impact; however, please verify your OIDC provider's integration with other services during your upgrade testing.
|
- The OIDC discovery issuer is now set automatically. We do not anticipate any negative impact; however, please verify your OIDC provider's integration with other services during your upgrade testing.
|
||||||
@@ -389,6 +395,8 @@ Now you can interact with the Spire agent socket from your own application. The
|
|||||||
|
|
||||||
### SPIKE Pilot parameters
|
### SPIKE Pilot parameters
|
||||||
|
|
||||||
| Name | Description | Value |
|
| Name | Description | Value |
|
||||||
| --------------------- | ------------------------------------------------------ | ------- |
|
| -------------------------------------- | ---------------------------------------------------------------------- | ------------------- |
|
||||||
| `spike-pilot.enabled` | Enables deployment of SPIKE Pilot (Not for production) | `false` |
|
| `spike-pilot.enabled` | Enables deployment of SPIKE Pilot (Not for production) | `false` |
|
||||||
|
| `spire-identity-exchange.enabled` | Enables deployment of the SPIRE Identity Exchange (Not for production) | `false` |
|
||||||
|
| `spire-identity-exchange.nameOverride` | Overrides the name of the SPIRE Identity Exchnage | `identity-exchange` |
|
||||||
|
|||||||
@@ -231,7 +231,7 @@ nodeAttestor:
|
|||||||
|
|
||||||
# workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
|
# workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
|
||||||
workloadAttestors:
|
workloadAttestors:
|
||||||
# unix is a workload attestor which generates unix-based selectors like 'uid' and 'gid'.
|
# unix is a workload attestor which generates unix-based selectors like 'uid' and 'gid'.
|
||||||
unix:
|
unix:
|
||||||
## @param workloadAttestors.unix.enabled Enables the Unix workload attestor
|
## @param workloadAttestors.unix.enabled Enables the Unix workload attestor
|
||||||
enabled: false
|
enabled: false
|
||||||
|
|||||||
@@ -79,427 +79,439 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
|
|
||||||
### Chart parameters
|
### Chart parameters
|
||||||
|
|
||||||
| Name | Description | Value |
|
| Name | Description | Value |
|
||||||
| -------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
|
| ------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
|
||||||
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
|
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
|
||||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `image.repository` | The repository within the registry | `spiffe/spire-server` |
|
| `image.repository` | The repository within the registry | `spiffe/spire-server` |
|
||||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
| `kind` | Define SPIRE server deployment type. Can be statefulset/deployment. Defaults to statefulset if not set. This feature is experimental. | `statefulset` |
|
| `kind` | Define SPIRE server deployment type. Can be statefulset/deployment. Defaults to statefulset if not set. This feature is experimental. | `statefulset` |
|
||||||
| `externalServer` | Deploy only the bundle ConfigMap, RBAC rules, and identity documents but not the server. Use in a nested setup where the server is external. | `false` |
|
| `externalServer` | Deploy only the bundle ConfigMap, RBAC rules, and identity documents but not the server. Use in a nested setup where the server is external. | `false` |
|
||||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||||
| `nameOverride` | Name override | `""` |
|
| `nameOverride` | Name override | `""` |
|
||||||
| `crNameOverride` | Name override for any custom resources | `""` |
|
| `crNameOverride` | Name override for any custom resources | `""` |
|
||||||
| `namespaceOverride` | Namespace override | `""` |
|
| `namespaceOverride` | Namespace override | `""` |
|
||||||
| `fullnameOverride` | Fullname override | `""` |
|
| `fullnameOverride` | Fullname override | `""` |
|
||||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||||
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
||||||
| `podAnnotations` | Annotations to add to pods | `{}` |
|
| `podAnnotations` | Annotations to add to pods | `{}` |
|
||||||
| `podLabels` | Labels to add to pods | `{}` |
|
| `podLabels` | Labels to add to pods | `{}` |
|
||||||
| `podSecurityContext` | Pod security context | `{}` |
|
| `podSecurityContext` | Pod security context | `{}` |
|
||||||
| `securityContext` | Security context | `{}` |
|
| `securityContext` | Security context | `{}` |
|
||||||
| `priorityClassName` | Priority class assigned to statefulset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
| `priorityClassName` | Priority class assigned to statefulset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||||
| `service.type` | Type of the Spire server service created | `ClusterIP` |
|
| `service.type` | Type of the Spire server service created | `ClusterIP` |
|
||||||
| `service.port` | Port for the created service | `443` |
|
| `service.port` | Port for the created service | `443` |
|
||||||
| `service.annotations` | Annotations to add to the service object | `{}` |
|
| `service.annotations` | Annotations to add to the service object | `{}` |
|
||||||
| `service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` |
|
| `service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` |
|
||||||
| `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` |
|
| `configMap.annotations` | Annotations to add to the SPIRE Server ConfigMap | `{}` |
|
||||||
| `resources` | Resource requests and limits | `{}` |
|
| `resources` | Resource requests and limits | `{}` |
|
||||||
| `autoscaling.enabled` | Flag to enable autoscaling | `false` |
|
| `autoscaling.enabled` | Flag to enable autoscaling | `false` |
|
||||||
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
|
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
|
||||||
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` |
|
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` |
|
||||||
| `autoscaling.scaleOnSPIREServerOnly` | Flag to only consider the main SPIRE container for autoscaling purposes | `false` |
|
| `autoscaling.scaleOnSPIREServerOnly` | Flag to only consider the main SPIRE container for autoscaling purposes | `false` |
|
||||||
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization that triggers autoscaling | `80` |
|
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization that triggers autoscaling | `80` |
|
||||||
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` |
|
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` |
|
||||||
| `tolerations` | List of tolerations | `[]` |
|
| `tolerations` | List of tolerations | `[]` |
|
||||||
| `affinity` | List of node affinities | `{}` |
|
| `affinity` | List of node affinities | `{}` |
|
||||||
| `topologySpreadConstraints` | Topology spread constraints for resilience | `[]` |
|
| `topologySpreadConstraints` | Topology spread constraints for resilience | `[]` |
|
||||||
| `terminationGracePeriodSeconds` | Override the termination grace period for the pod. Increase to allow time for load balancer target deregistration and in-flight gRPC drain before SIGKILL. | `nil` |
|
| `terminationGracePeriodSeconds` | Override the termination grace period for the pod. Increase to allow time for load balancer target deregistration and in-flight gRPC drain before SIGKILL. | `nil` |
|
||||||
| `livenessProbe.failureThreshold` | Failure threshold count for livenessProbe | `2` |
|
| `livenessProbe.failureThreshold` | Failure threshold count for livenessProbe | `2` |
|
||||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `15` |
|
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `15` |
|
||||||
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `60` |
|
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `60` |
|
||||||
| `livenessProbe.timeoutSeconds` | Timeout in seconds for livenessProbe | `3` |
|
| `livenessProbe.timeoutSeconds` | Timeout in seconds for livenessProbe | `3` |
|
||||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
||||||
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
||||||
| `persistence.type` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing or nested child only) | `pvc` |
|
| `persistence.type` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing or nested child only) | `pvc` |
|
||||||
| `persistence.size` | What size volume to use for persistence | `1Gi` |
|
| `persistence.size` | What size volume to use for persistence | `1Gi` |
|
||||||
| `persistence.accessMode` | What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) | `ReadWriteOnce` |
|
| `persistence.accessMode` | What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) | `ReadWriteOnce` |
|
||||||
| `persistence.storageClass` | What storage class to use for persistence | `nil` |
|
| `persistence.storageClass` | What storage class to use for persistence | `nil` |
|
||||||
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `""` |
|
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `""` |
|
||||||
| `dataStore.sql.databaseType` | Other supported databases are ["postgres", "mysql", "aws_postgresql", "aws_mysql", "gcp_mysql_sa_iam"]. Note: aws type databases are still experimental. gcp_mysql_sa_iam uses IAM authentication by default. | `sqlite3` |
|
| `dataStore.sql.databaseType` | Other supported databases are ["postgres", "mysql", "aws_postgresql", "aws_mysql", "gcp_mysql_sa_iam"]. Note: aws type databases are still experimental. gcp_mysql_sa_iam uses IAM authentication by default. | `sqlite3` |
|
||||||
| `dataStore.sql.databaseName` | Only used when type != "sqlite3" | `spire` |
|
| `dataStore.sql.databaseName` | Only used when type != "sqlite3" | `spire` |
|
||||||
| `dataStore.sql.host` | Only used when type != "sqlite3" | `""` |
|
| `dataStore.sql.host` | Only used when type != "sqlite3" | `""` |
|
||||||
| `dataStore.sql.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` |
|
| `dataStore.sql.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` |
|
||||||
| `dataStore.sql.username` | Only used when type != "sqlite3" | `spire` |
|
| `dataStore.sql.username` | Only used when type != "sqlite3" | `spire` |
|
||||||
| `dataStore.sql.password` | Only used when type != "sqlite3" | `""` |
|
| `dataStore.sql.password` | Only used when type != "sqlite3" | `""` |
|
||||||
| `dataStore.sql.file` | Data source file. Only used when type == "sqlite3" | `/run/spire/data/datastore.sqlite3` |
|
| `dataStore.sql.file` | Data source file. Only used when type == "sqlite3" | `/run/spire/data/datastore.sqlite3` |
|
||||||
| `dataStore.sql.options` | takes an array of objects of form {<key>: <value>} to use when building the database connection string | `[]` |
|
| `dataStore.sql.options` | takes an array of objects of form {<key>: <value>} to use when building the database connection string | `[]` |
|
||||||
| `dataStore.sql.rootCAPath` | Path to Root CA bundle (MySQL only) | `""` |
|
| `dataStore.sql.rootCAPath` | Path to Root CA bundle (MySQL only) | `""` |
|
||||||
| `dataStore.sql.clientCertPath` | Path to client certificate (MySQL only) | `""` |
|
| `dataStore.sql.clientCertPath` | Path to client certificate (MySQL only) | `""` |
|
||||||
| `dataStore.sql.clientKeyPath` | Path to private key for client certificate (MySQL only) | `""` |
|
| `dataStore.sql.clientKeyPath` | Path to private key for client certificate (MySQL only) | `""` |
|
||||||
| `dataStore.sql.externalSecret.enabled` | Enable external secret for datastore creds | `false` |
|
| `dataStore.sql.externalSecret.enabled` | Enable external secret for datastore creds | `false` |
|
||||||
| `dataStore.sql.externalSecret.name` | The name of the secret object | `""` |
|
| `dataStore.sql.externalSecret.name` | The name of the secret object | `""` |
|
||||||
| `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
|
| `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
|
||||||
| `dataStore.sql.maxOpenConns` | The maximum number of open db connections | `100` |
|
| `dataStore.sql.maxOpenConns` | The maximum number of open db connections | `100` |
|
||||||
| `dataStore.sql.maxIdleConns` | The maximum number of idle connections in the pool | `2` |
|
| `dataStore.sql.maxIdleConns` | The maximum number of idle connections in the pool | `2` |
|
||||||
| `dataStore.sql.connMaxLifetime` | The maximum amount of time a connection may be reused. Supports duration strings (e.g., "1h", "30m", "3600s") or 0 for unlimited. Duration strings are recommended to prevent connection accumulation. | `0` |
|
| `dataStore.sql.connMaxLifetime` | The maximum amount of time a connection may be reused. Supports duration strings (e.g., "1h", "30m", "3600s") or 0 for unlimited. Duration strings are recommended to prevent connection accumulation. | `0` |
|
||||||
| `dataStore.sql.disableMigration` | True to disable auto-migration functionality | `false` |
|
| `dataStore.sql.disableMigration` | True to disable auto-migration functionality | `false` |
|
||||||
| `dataStore.sql.region` | Region to use when database type is either aws_mysql or aws_postgresql | `""` |
|
| `dataStore.sql.region` | Region to use when database type is either aws_mysql or aws_postgresql | `""` |
|
||||||
| `dataStore.sql.readOnly.enabled` | Set to true to configure a readOnly dartabase connection | `false` |
|
| `dataStore.sql.readOnly.enabled` | Set to true to configure a readOnly dartabase connection | `false` |
|
||||||
| `dataStore.sql.readOnly.host` | Only used when type != "sqlite3" | `""` |
|
| `dataStore.sql.readOnly.host` | Only used when type != "sqlite3" | `""` |
|
||||||
| `dataStore.sql.readOnly.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` |
|
| `dataStore.sql.readOnly.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` |
|
||||||
| `dataStore.sql.readOnly.username` | Only used when type != "sqlite3" | `spire` |
|
| `dataStore.sql.readOnly.username` | Only used when type != "sqlite3" | `spire` |
|
||||||
| `dataStore.sql.readOnly.password` | Only used when type != "sqlite3" | `""` |
|
| `dataStore.sql.readOnly.password` | Only used when type != "sqlite3" | `""` |
|
||||||
| `dataStore.sql.readOnly.options` | Only used when type != "sqlite3" | `[]` |
|
| `dataStore.sql.readOnly.options` | Only used when type != "sqlite3" | `[]` |
|
||||||
| `dataStore.sql.readOnly.externalSecret.enabled` | Enable external secret for datastore creds | `false` |
|
| `dataStore.sql.readOnly.externalSecret.enabled` | Enable external secret for datastore creds | `false` |
|
||||||
| `dataStore.sql.readOnly.externalSecret.name` | The name of the secret object | `""` |
|
| `dataStore.sql.readOnly.externalSecret.name` | The name of the secret object | `""` |
|
||||||
| `dataStore.sql.readOnly.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
|
| `dataStore.sql.readOnly.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
|
||||||
| `adminIDs` | SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges. | `[]` |
|
| `adminIDs` | SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges. | `[]` |
|
||||||
| `auditLogEnabled` | If true, enables audit logging | `false` |
|
| `auditLogEnabled` | If true, enables audit logging | `false` |
|
||||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||||
| `logFormat` | The log format, valid values are "text" and "json" | `text` |
|
| `logFormat` | The log format, valid values are "text" and "json" | `text` |
|
||||||
| `jwtIssuer` | The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset | `""` |
|
| `jwtIssuer` | The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset | `""` |
|
||||||
| `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` |
|
| `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` |
|
||||||
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
|
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||||
| `bundleConfigMap` | Set the Configmap name for SPIRE bundle | `spire-bundle` |
|
| `bundleConfigMap` | Set the Configmap name for SPIRE bundle | `spire-bundle` |
|
||||||
| `clusterDomain` | This is the value of your clusters `kubeadm init --service-dns-domain` flag | `cluster.local` |
|
| `clusterDomain` | This is the value of your clusters `kubeadm init --service-dns-domain` flag | `cluster.local` |
|
||||||
| `jwtSVIDSupport` | If false, completely disables JWT-SVID functionality. The server will not generate JWT keys, sign JWT-SVIDs, or implement JWT-related API calls. This is useful for deployments that don’t need JWT-SVIDs support. | `true` |
|
| `jwtSVIDSupport` | If false, completely disables JWT-SVID functionality. The server will not generate JWT keys, sign JWT-SVIDs, or implement JWT-related API calls. This is useful for deployments that don’t need JWT-SVIDs support. | `true` |
|
||||||
| `federation.enabled` | Flag to enable federation | `false` |
|
| `federation.enabled` | Flag to enable federation | `false` |
|
||||||
| `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` |
|
| `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` |
|
||||||
| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` |
|
| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` |
|
||||||
| `federation.bundleEndpoint.refreshHint` | Hint used by federated servers on how often to refresh the bundle. CA TTL must be 3-5x the duration of this value to ensure public keys are loaded on federated servers prior to private key rotation on remote server. | `5m` |
|
| `federation.bundleEndpoint.refreshHint` | Hint used by federated servers on how often to refresh the bundle. CA TTL must be 3-5x the duration of this value to ensure public keys are loaded on federated servers prior to private key rotation on remote server. | `5m` |
|
||||||
| `federation.bundleEndpoint.profile.httpWeb.fileSyncInterval` | Interval on which to reload the certificate/key from disk | `1h` |
|
| `federation.bundleEndpoint.profile.httpWeb.fileSyncInterval` | Interval on which to reload the certificate/key from disk | `1h` |
|
||||||
| `federation.tls.spire.enabled` | Use spire to secure the federation bundle endpoint | `true` |
|
| `federation.tls.spire.enabled` | Use spire to secure the federation bundle endpoint | `true` |
|
||||||
| `federation.tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` |
|
| `federation.tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` |
|
||||||
| `federation.tls.externalSecret.secretName` | Specify which Secret to use | `""` |
|
| `federation.tls.externalSecret.secretName` | Specify which Secret to use | `""` |
|
||||||
| `federation.tls.certManager.enabled` | Use certificateManager to create the certificate | `false` |
|
| `federation.tls.certManager.enabled` | Use certificateManager to create the certificate | `false` |
|
||||||
| `federation.tls.certManager.issuer.create` | Create an issuer to use to issue the certificate | `true` |
|
| `federation.tls.certManager.issuer.create` | Create an issuer to use to issue the certificate | `true` |
|
||||||
| `federation.tls.certManager.issuer.acme.email` | Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service | `""` |
|
| `federation.tls.certManager.issuer.acme.email` | Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service | `""` |
|
||||||
| `federation.tls.certManager.issuer.acme.server` | Server to use to get certificate. Defaults to LetsEncrypt | `https://acme-v02.api.letsencrypt.org/directory` |
|
| `federation.tls.certManager.issuer.acme.server` | Server to use to get certificate. Defaults to LetsEncrypt | `https://acme-v02.api.letsencrypt.org/directory` |
|
||||||
| `federation.tls.certManager.issuer.acme.solvers` | Configure the issuer solvers. Defaults to http01 via ingress. | `{}` |
|
| `federation.tls.certManager.issuer.acme.solvers` | Configure the issuer solvers. Defaults to http01 via ingress. | `{}` |
|
||||||
| `federation.tls.certManager.certificate.dnsNames` | Override the dnsNames on the certificate request. Defaults to the same settings as Ingress | `[]` |
|
| `federation.tls.certManager.certificate.dnsNames` | Override the dnsNames on the certificate request. Defaults to the same settings as Ingress | `[]` |
|
||||||
| `federation.tls.certManager.certificate.issuerRef.group` | If you are using an external plugin, specify the group for it here | `""` |
|
| `federation.tls.certManager.certificate.issuerRef.group` | If you are using an external plugin, specify the group for it here | `""` |
|
||||||
| `federation.tls.certManager.certificate.issuerRef.kind` | Kind of the issuer reference. Override if you want to use a ClusterIssuer | `Issuer` |
|
| `federation.tls.certManager.certificate.issuerRef.kind` | Kind of the issuer reference. Override if you want to use a ClusterIssuer | `Issuer` |
|
||||||
| `federation.tls.certManager.certificate.issuerRef.name` | Name of the issuer to use. If unset, it will use the name of the built in issuer | `""` |
|
| `federation.tls.certManager.certificate.issuerRef.name` | Name of the issuer to use. If unset, it will use the name of the built in issuer | `""` |
|
||||||
| `federation.ingress.enabled` | Flag to enable ingress for federation | `false` |
|
| `federation.ingress.enabled` | Flag to enable ingress for federation | `false` |
|
||||||
| `federation.ingress.className` | Ingress class name for federation | `""` |
|
| `federation.ingress.className` | Ingress class name for federation | `""` |
|
||||||
| `federation.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
| `federation.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||||
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
|
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||||
| `federation.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server-federation` |
|
| `federation.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server-federation` |
|
||||||
| `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
| `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||||
| `federation.ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
| `federation.ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
||||||
| `federation.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
| `federation.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||||
| `caSubject.country` | Country for Spire server CA | `ARPA` |
|
| `caSubject.country` | Country for Spire server CA | `ARPA` |
|
||||||
| `caSubject.organization` | Organization for Spire server CA | `Example` |
|
| `caSubject.organization` | Organization for Spire server CA | `Example` |
|
||||||
| `caSubject.commonName` | Common Name for Spire server CA | `example.org` |
|
| `caSubject.commonName` | Common Name for Spire server CA | `example.org` |
|
||||||
| `credentialComposer.cel.enabled` | Enable the cel based credential composer | `false` |
|
| `credentialComposer.cel.enabled` | Enable the cel based credential composer | `false` |
|
||||||
| `credentialComposer.cel.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `credentialComposer.cel.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `credentialComposer.cel.image.repository` | The repository within the registry | `spiffe/spire-credentialcomposer-cel` |
|
| `credentialComposer.cel.image.repository` | The repository within the registry | `spiffe/spire-credentialcomposer-cel` |
|
||||||
| `credentialComposer.cel.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `credentialComposer.cel.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `credentialComposer.cel.image.tag` | Overrides the image tag | `0.0.2` |
|
| `credentialComposer.cel.image.tag` | Overrides the image tag | `0.0.2` |
|
||||||
| `credentialComposer.cel.checksum` | The sha256 checksum of the plugin binary | `23fa1d10f15ad5d5c555930cf82289c664801d7d5609bfd8847f95a0a667e4e4` |
|
| `credentialComposer.cel.checksum` | The sha256 checksum of the plugin binary | `23fa1d10f15ad5d5c555930cf82289c664801d7d5609bfd8847f95a0a667e4e4` |
|
||||||
| `credentialComposer.cel.pluginPath` | The filename in the container of the plugin | `/ko-app/cmd` |
|
| `credentialComposer.cel.pluginPath` | The filename in the container of the plugin | `/ko-app/cmd` |
|
||||||
| `credentialComposer.cel.jwt.expression` | The expression to use for jwt token composing | `""` |
|
| `credentialComposer.cel.jwt.expression` | The expression to use for jwt token composing | `""` |
|
||||||
| `credentialComposer.uniqueID.enabled` | Add the x509UniqueIdentifier attribute to workload X509-SVIDs | `false` |
|
| `credentialComposer.uniqueID.enabled` | Add the x509UniqueIdentifier attribute to workload X509-SVIDs | `false` |
|
||||||
| `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` |
|
| `credentialComposer.spireIdentityExchange.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
|
| `credentialComposer.spireIdentityExchange.image.repository` | The repository within the registry | `spiffe/spire-credentialcomposer-identity-exchange` |
|
||||||
| `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` |
|
| `credentialComposer.spireIdentityExchange.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` |
|
| `credentialComposer.spireIdentityExchange.image.tag` | Overrides the image tag | `v0.2.0` |
|
||||||
| `keyManager.awsKMS.keyIdentifierFile.enabled` | Enable key identifier data to be stored in a file in persistent storage. | `false` |
|
| `credentialComposer.spireIdentityExchange.checksum` | The sha256 checksum of the plugin binary | `198bfed106794a60e565cb804cb6b360d4633e4542981abbea0c0c669ddd6036` |
|
||||||
| `keyManager.awsKMS.keyIdentifierValue.enabled` | Enable specifying a key identifier value for AWS KMS | `false` |
|
| `credentialComposer.spireIdentityExchange.pluginPath` | The filename in the container of the plugin | `/ko-app/spire-credentialcomposer-identity-exchange` |
|
||||||
| `keyManager.awsKMS.keyIdentifierValue.identifier` | Static identifier for the SPIRE server instance | `""` |
|
| `credentialComposer.spireIdentityExchange.prefix` | The prefix to operate on | `""` |
|
||||||
| `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | |
|
| `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` |
|
||||||
| `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` |
|
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
|
||||||
| `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` |
|
| `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` |
|
||||||
| `keyManager.awsKMS.keyTags` | Custom tags to apply to KMS keys created by the plugin. Tags are key-value pairs used for resource management and cost allocation. When using key tagging, you must add the `kms:TagResource` permission to your IAM policy. Constraints: keys (1-128 chars), values (0-256 chars), max 50 tags, valid chars (letters, numbers, spaces, + - = . _ : / @), keys cannot start with 'aws:' or 'spire-'. | `{}` |
|
| `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` |
|
||||||
| `keyManager.awsKMS.accessKeyID` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. | `""` |
|
| `keyManager.awsKMS.keyIdentifierFile.enabled` | Enable key identifier data to be stored in a file in persistent storage. | `false` |
|
||||||
| `keyManager.awsKMS.secretAccessKey` | Secret access key for the AWS account. | `""` |
|
| `keyManager.awsKMS.keyIdentifierValue.enabled` | Enable specifying a key identifier value for AWS KMS | `false` |
|
||||||
| `upstreamAuthority.disk.enabled` | Flag to enable upstream authority plugin on disk | `false` |
|
| `keyManager.awsKMS.keyIdentifierValue.identifier` | Static identifier for the SPIRE server instance | `""` |
|
||||||
| `upstreamAuthority.disk.secret.create` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | `true` |
|
| `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | |
|
||||||
| `upstreamAuthority.disk.secret.name` | If secret creation is disabled, the secret with this name will be used. | `spiffe-upstream-ca` |
|
| `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` |
|
||||||
| `upstreamAuthority.disk.secret.data` | If secret creation is enabled, will create a secret with following certificate info | |
|
| `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` |
|
||||||
| `upstreamAuthority.disk.secret.data.certificate` | Certificate to store within disk upstreamAuthority. | `""` |
|
| `keyManager.awsKMS.keyTags` | Custom tags to apply to KMS keys created by the plugin. Tags are key-value pairs used for resource management and cost allocation. When using key tagging, you must add the `kms:TagResource` permission to your IAM policy. Constraints: keys (1-128 chars), values (0-256 chars), max 50 tags, valid chars (letters, numbers, spaces, + - = . _ : / @), keys cannot start with 'aws:' or 'spire-'. | `{}` |
|
||||||
| `upstreamAuthority.disk.secret.data.key` | Key corresponding to the upstreamAuthority. | `""` |
|
| `keyManager.awsKMS.accessKeyID` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. | `""` |
|
||||||
| `upstreamAuthority.disk.secret.data.bundle` | Trust bundle for upstreamAuthority. | `""` |
|
| `keyManager.awsKMS.secretAccessKey` | Secret access key for the AWS account. | `""` |
|
||||||
| `upstreamAuthority.awsPCA.enabled` | Flag to enable upstream authority plugin with AWS PCA | `false` |
|
| `upstreamAuthority.disk.enabled` | Flag to enable upstream authority plugin on disk | `false` |
|
||||||
| `upstreamAuthority.awsPCA.region` | AWS Region to use | `""` |
|
| `upstreamAuthority.disk.secret.create` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | `true` |
|
||||||
| `upstreamAuthority.awsPCA.certificateAuthorityARN` | ARN of the "upstream" CA certificate | `""` |
|
| `upstreamAuthority.disk.secret.name` | If secret creation is disabled, the secret with this name will be used. | `spiffe-upstream-ca` |
|
||||||
| `upstreamAuthority.awsPCA.assumeRoleARN` | (Optional) ARN of an IAM role to assume | `""` |
|
| `upstreamAuthority.disk.secret.data` | If secret creation is enabled, will create a secret with following certificate info | |
|
||||||
| `upstreamAuthority.awsPCA.caSigningTemplateARN` | (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. | `""` |
|
| `upstreamAuthority.disk.secret.data.certificate` | Certificate to store within disk upstreamAuthority. | `""` |
|
||||||
| `upstreamAuthority.awsPCA.signingAlgorithm` | (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | `""` |
|
| `upstreamAuthority.disk.secret.data.key` | Key corresponding to the upstreamAuthority. | `""` |
|
||||||
| `upstreamAuthority.awsPCA.endpoint` | (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | `""` |
|
| `upstreamAuthority.disk.secret.data.bundle` | Trust bundle for upstreamAuthority. | `""` |
|
||||||
| `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` |
|
| `upstreamAuthority.awsPCA.enabled` | Flag to enable upstream authority plugin with AWS PCA | `false` |
|
||||||
| `upstreamAuthority.awsSecret.enabled` | Flag to enable upstream authority plugin with AWS Secrets Manager | `false` |
|
| `upstreamAuthority.awsPCA.region` | AWS Region to use | `""` |
|
||||||
| `upstreamAuthority.awsSecret.region` | AWS Region to use | `""` |
|
| `upstreamAuthority.awsPCA.certificateAuthorityARN` | ARN of the "upstream" CA certificate | `""` |
|
||||||
| `upstreamAuthority.awsSecret.certFileArn` | ARN or name of the secret containing the intermediate CA certificate | `""` |
|
| `upstreamAuthority.awsPCA.assumeRoleARN` | (Optional) ARN of an IAM role to assume | `""` |
|
||||||
| `upstreamAuthority.awsSecret.keyFileArn` | ARN or name of the secret containing the intermediate CA private key | `""` |
|
| `upstreamAuthority.awsPCA.caSigningTemplateARN` | (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. | `""` |
|
||||||
| `upstreamAuthority.awsSecret.bundleFileArn` | (Optional) ARN or name of the secret containing the root CA bundle | `""` |
|
| `upstreamAuthority.awsPCA.signingAlgorithm` | (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | `""` |
|
||||||
| `upstreamAuthority.awsSecret.assumeRoleArn` | (Optional) ARN of an IAM role to assume | `""` |
|
| `upstreamAuthority.awsPCA.endpoint` | (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | `""` |
|
||||||
| `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` |
|
| `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` |
|
||||||
| `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` |
|
| `upstreamAuthority.awsSecret.enabled` | Flag to enable upstream authority plugin with AWS Secrets Manager | `false` |
|
||||||
| `upstreamAuthority.certManager.issuerName` | Defaults to the release name, override if CA is provided outside of the chart | `""` |
|
| `upstreamAuthority.awsSecret.region` | AWS Region to use | `""` |
|
||||||
| `upstreamAuthority.certManager.issuerKind` | Defaults to "Issuer", override if CA is provided outside of the chart | `Issuer` |
|
| `upstreamAuthority.awsSecret.certFileArn` | ARN or name of the secret containing the intermediate CA certificate | `""` |
|
||||||
| `upstreamAuthority.certManager.issuerGroup` | Defaults to "cert-manager.io", override if CA is provided outside of the chart | `cert-manager.io` |
|
| `upstreamAuthority.awsSecret.keyFileArn` | ARN or name of the secret containing the intermediate CA private key | `""` |
|
||||||
| `upstreamAuthority.certManager.namespace` | Specify to use a namespace other then the one the chart is installed into | `""` |
|
| `upstreamAuthority.awsSecret.bundleFileArn` | (Optional) ARN or name of the secret containing the root CA bundle | `""` |
|
||||||
| `upstreamAuthority.certManager.kubeConfigFile` | Path to kube config file on node to setup cert manager | `""` |
|
| `upstreamAuthority.awsSecret.assumeRoleArn` | (Optional) ARN of an IAM role to assume | `""` |
|
||||||
| `upstreamAuthority.certManager.ca.create` | Creates a Cert-Manager CA | `false` |
|
| `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` |
|
||||||
| `upstreamAuthority.certManager.ca.duration` | Duration of the CA. Defaults to 10 years | `87600h` |
|
| `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` |
|
||||||
| `upstreamAuthority.certManager.ca.privateKey.algorithm` | Algorithm to generate private key for CA | `ECDSA` |
|
| `upstreamAuthority.certManager.issuerName` | Defaults to the release name, override if CA is provided outside of the chart | `""` |
|
||||||
| `upstreamAuthority.certManager.ca.privateKey.size` | Size of generated private key for CA | `256` |
|
| `upstreamAuthority.certManager.issuerKind` | Defaults to "Issuer", override if CA is provided outside of the chart | `Issuer` |
|
||||||
| `upstreamAuthority.certManager.ca.privateKey.rotationPolicy` | Rotation policy for generated private key | `""` |
|
| `upstreamAuthority.certManager.issuerGroup` | Defaults to "cert-manager.io", override if CA is provided outside of the chart | `cert-manager.io` |
|
||||||
| `upstreamAuthority.certManager.ca.renewBefore` | How long to wait before renewing the CA | `""` |
|
| `upstreamAuthority.certManager.namespace` | Specify to use a namespace other then the one the chart is installed into | `""` |
|
||||||
| `upstreamAuthority.spire.enabled` | Flag to use another Spire install as upstream CA | `false` |
|
| `upstreamAuthority.certManager.kubeConfigFile` | Path to kube config file on node to setup cert manager | `""` |
|
||||||
| `upstreamAuthority.spire.upstreamDriver` | Driver for Spire as upstream CA | `""` |
|
| `upstreamAuthority.certManager.ca.create` | Creates a Cert-Manager CA | `false` |
|
||||||
| `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | |
|
| `upstreamAuthority.certManager.ca.duration` | Duration of the CA. Defaults to 10 years | `87600h` |
|
||||||
| `upstreamAuthority.spire.server.nameOverride` | Override the name for upstream Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
| `upstreamAuthority.certManager.ca.privateKey.algorithm` | Algorithm to generate private key for CA | `ECDSA` |
|
||||||
| `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` |
|
| `upstreamAuthority.certManager.ca.privateKey.size` | Size of generated private key for CA | `256` |
|
||||||
| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `443` |
|
| `upstreamAuthority.certManager.ca.privateKey.rotationPolicy` | Rotation policy for generated private key | `""` |
|
||||||
| `upstreamAuthority.vault.enabled` | Enable Hashicorp Vault as upstream CA | `false` |
|
| `upstreamAuthority.certManager.ca.renewBefore` | How long to wait before renewing the CA | `""` |
|
||||||
| `upstreamAuthority.vault.vaultAddr` | The URL of the Vault server. (e.g., https://vault.example.com:8443/) | `""` |
|
| `upstreamAuthority.spire.enabled` | Flag to use another Spire install as upstream CA | `false` |
|
||||||
| `upstreamAuthority.vault.namespace` | Name of the Vault namespace. This is only available in the Vault Enterprise. | `""` |
|
| `upstreamAuthority.spire.upstreamDriver` | Driver for Spire as upstream CA | `""` |
|
||||||
| `upstreamAuthority.vault.pkiMountPoint` | Name of the mount point where PKI secret engine is mounted | `pki` |
|
| `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | |
|
||||||
| `upstreamAuthority.vault.insecureSkipVerify` | If true, caCert options are ignored and Spire accepts any server certificates claiming to be Vault | `false` |
|
| `upstreamAuthority.spire.server.nameOverride` | Override the name for upstream Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
||||||
| `upstreamAuthority.vault.caCert.type` | Type of resource representing the Vault server certificate, options are 'Secret' or 'Configmap', the item must be named `ca.crt` | `Secret` |
|
| `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` |
|
||||||
| `upstreamAuthority.vault.caCert.name` | Name of the Kubernetes resource containing the Vault server certificate | `vault-ca` |
|
| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `443` |
|
||||||
| `upstreamAuthority.vault.k8sAuth.enabled` | Enable k8s authentication to Hashicorp Vault | `false` |
|
| `upstreamAuthority.vault.enabled` | Enable Hashicorp Vault as upstream CA | `false` |
|
||||||
| `upstreamAuthority.vault.k8sAuth.k8sAuthMountPoint` | Name of the mount point where the Kubernetes auth method is mounted | `kubernetes` |
|
| `upstreamAuthority.vault.vaultAddr` | The URL of the Vault server. (e.g., https://vault.example.com:8443/) | `""` |
|
||||||
| `upstreamAuthority.vault.k8sAuth.k8sAuthRoleName` | Required - Name of the Vault role. The plugin authenticates against the named role | `""` |
|
| `upstreamAuthority.vault.namespace` | Name of the Vault namespace. This is only available in the Vault Enterprise. | `""` |
|
||||||
| `upstreamAuthority.vault.k8sAuth.token.audience` | Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info. | `vault` |
|
| `upstreamAuthority.vault.pkiMountPoint` | Name of the mount point where PKI secret engine is mounted | `pki` |
|
||||||
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
|
| `upstreamAuthority.vault.insecureSkipVerify` | If true, caCert options are ignored and Spire accepts any server certificates claiming to be Vault | `false` |
|
||||||
| `notifier.k8sBundle.enabled` | Enable local k8s bundle uploader | `false` |
|
| `upstreamAuthority.vault.caCert.type` | Type of resource representing the Vault server certificate, options are 'Secret' or 'Configmap', the item must be named `ca.crt` | `Secret` |
|
||||||
| `notifier.k8sBundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
| `upstreamAuthority.vault.caCert.name` | Name of the Kubernetes resource containing the Vault server certificate | `vault-ca` |
|
||||||
| `notifier.k8sBundle.apiServiceLabel` | If set, rotate the CA Bundle in API services with this label set to true. | `""` |
|
| `upstreamAuthority.vault.k8sAuth.enabled` | Enable k8s authentication to Hashicorp Vault | `false` |
|
||||||
| `notifier.k8sBundle.webhookLabel` | If set, rotate the CA Bundle in validating and mutating webhooks with this label set to true. | `""` |
|
| `upstreamAuthority.vault.k8sAuth.k8sAuthMountPoint` | Name of the mount point where the Kubernetes auth method is mounted | `kubernetes` |
|
||||||
| `notifier.externalK8sBundle.enabled` | Enable external k8s bundle uploader | `false` |
|
| `upstreamAuthority.vault.k8sAuth.k8sAuthRoleName` | Required - Name of the Vault role. The plugin authenticates against the named role | `""` |
|
||||||
| `notifier.externalK8sBundle.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` |
|
| `upstreamAuthority.vault.k8sAuth.token.audience` | Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info. | `vault` |
|
||||||
| `notifier.externalK8sBundle.defaults.configMap` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` |
|
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
|
||||||
| `notifier.externalK8sBundle.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `bundle.crt` |
|
| `notifier.k8sBundle.enabled` | Enable local k8s bundle uploader | `false` |
|
||||||
| `notifier.externalK8sBundle.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
| `notifier.k8sBundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||||
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
| `notifier.k8sBundle.apiServiceLabel` | If set, rotate the CA Bundle in API services with this label set to true. | `""` |
|
||||||
| `controllerManager.staticManifestMode` | Flag to configure static mode. Valid options off, internal, and external. If internal, the identities config options will be rendered to an included configmap | `off` |
|
| `notifier.k8sBundle.webhookLabel` | If set, rotate the CA Bundle in validating and mutating webhooks with this label set to true. | `""` |
|
||||||
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
| `notifier.externalK8sBundle.enabled` | Enable external k8s bundle uploader | `false` |
|
||||||
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
| `notifier.externalK8sBundle.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` |
|
||||||
| `controllerManager.entryIDPrefixCleanup` | Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` |
|
| `notifier.externalK8sBundle.defaults.configMap` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` |
|
||||||
| `controllerManager.addEntryIDPrefix` | If true, prepends the clusterName to the entryID of each entry the controller manager registers. | `true` |
|
| `notifier.externalK8sBundle.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `bundle.crt` |
|
||||||
| `controllerManager.gcInterval` | How often the SPIRE state is reconciled when the controller is otherwise idle. This impacts how quickly SPIRE state will converge after CRDs are removed or SPIRE state is mutated underneath the controller. Values are in nanoseconds. | `10000000000` |
|
| `notifier.externalK8sBundle.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
||||||
| `controllerManager.logLevel` | The log level for the controller manager. Supported values are info, error, warn and debug. | `info` |
|
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
||||||
| `controllerManager.logEncoding` | The log encoding for the controller manager. Supported values are console and json. | `console` |
|
| `controllerManager.staticManifestMode` | Flag to configure static mode. Valid options off, internal, and external. If internal, the identities config options will be rendered to an included configmap | `off` |
|
||||||
| `controllerManager.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` |
|
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
||||||
| `controllerManager.leaderElection.renewDeadline` | Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. | `10s` |
|
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
||||||
| `controllerManager.leaderElection.retryPeriod` | Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. | `2s` |
|
| `controllerManager.entryIDPrefixCleanup` | Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` |
|
||||||
| `controllerManager.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
|
| `controllerManager.addEntryIDPrefix` | If true, prepends the clusterName to the entryID of each entry the controller manager registers. | `true` |
|
||||||
| `controllerManager.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` |
|
| `controllerManager.gcInterval` | How often the SPIRE state is reconciled when the controller is otherwise idle. This impacts how quickly SPIRE state will converge after CRDs are removed or SPIRE state is mutated underneath the controller. Values are in nanoseconds. | `10000000000` |
|
||||||
| `controllerManager.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` |
|
| `controllerManager.logLevel` | The log level for the controller manager. Supported values are info, error, warn and debug. | `info` |
|
||||||
| `controllerManager.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` |
|
| `controllerManager.logEncoding` | The log encoding for the controller manager. Supported values are console and json. | `console` |
|
||||||
| `controllerManager.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
| `controllerManager.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` |
|
||||||
| `controllerManager.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` |
|
| `controllerManager.leaderElection.renewDeadline` | Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. | `10s` |
|
||||||
| `controllerManager.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` |
|
| `controllerManager.leaderElection.retryPeriod` | Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. | `2s` |
|
||||||
| `controllerManager.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
|
| `controllerManager.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
|
||||||
| `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
|
| `controllerManager.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` |
|
||||||
| `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` |
|
| `controllerManager.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` |
|
||||||
| `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` |
|
| `controllerManager.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` |
|
||||||
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
| `controllerManager.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
||||||
| `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
| `controllerManager.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` |
|
||||||
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `controllerManager.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` |
|
||||||
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
| `controllerManager.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
|
||||||
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
|
||||||
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.6` |
|
| `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` |
|
||||||
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
| `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` |
|
||||||
| `controllerManager.securityContext` | Security context | `{}` |
|
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||||
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
| `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||||
| `controllerManager.service.port` | Service port for controller manager | `443` |
|
| `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `controllerManager.service.annotations` | Annotations for service resource | `{}` |
|
| `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` |
|
||||||
| `controllerManager.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` |
|
| `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `controllerManager.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` |
|
| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.6.6` |
|
||||||
| `controllerManager.reconcile.clusterSPIFFEIDs` | Enable reconciliation of clusterSPIFFEIDs from K8s to the SPIRE server | `true` |
|
| `controllerManager.resources` | Resource requests and limits for controller manager | `{}` |
|
||||||
| `controllerManager.reconcile.clusterStaticEntries` | Enable reconciliation of clusterStaticEntries from K8s to the SPIRE server | `true` |
|
| `controllerManager.securityContext` | Security context | `{}` |
|
||||||
| `controllerManager.reconcile.clusterFederatedTrustDomains` | Enable reconciliation of clusterFederatedTrustDomains from K8s to the SPIRE server | `true` |
|
| `controllerManager.service.type` | Service type for controller manager | `ClusterIP` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable this identity for controller manager | `true` |
|
| `controllerManager.service.port` | Service port for controller manager | `443` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` |
|
| `controllerManager.service.annotations` | Annotations for service resource | `{}` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.default.podSelector` | Selector for pods to issue identity | `{}` |
|
| `controllerManager.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector` | Selector for namespaces to issue identity | `{}` |
|
| `controllerManager.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.default.dnsNameTemplates` | DNS name template for issued identities | `[]` |
|
| `controllerManager.reconcile.clusterSPIFFEIDs` | Enable reconciliation of clusterSPIFFEIDs from K8s to the SPIRE server | `true` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.default.federatesWith` | Other Spire server URLs for identity federation | `[]` |
|
| `controllerManager.reconcile.clusterStaticEntries` | Enable reconciliation of clusterStaticEntries from K8s to the SPIRE server | `true` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.default.workloadSelectorTemplates` | Templates to produce selectors that apply to a given workload before it will receive an ID | `[]` |
|
| `controllerManager.reconcile.clusterFederatedTrustDomains` | Enable reconciliation of clusterFederatedTrustDomains from K8s to the SPIRE server | `true` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.default.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` |
|
| `controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable this identity for controller manager | `true` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.default.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` |
|
| `controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate` | Spiffe ID template for identities | `spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.default.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
|
| `controllerManager.identities.clusterSPIFFEIDs.default.podSelector` | Selector for pods to issue identity | `{}` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.default.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` |
|
| `controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector` | Selector for namespaces to issue identity | `{}` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` |
|
| `controllerManager.identities.clusterSPIFFEIDs.default.dnsNameTemplates` | DNS name template for issued identities | `[]` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.default.fallback` | Apply this ID only if there are no other matching non fallback ClusterSPIFFEIDs | `true` |
|
| `controllerManager.identities.clusterSPIFFEIDs.default.federatesWith` | Other Spire server URLs for identity federation | `[]` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled` | Enable this identity for controller manager | `false` |
|
| `controllerManager.identities.clusterSPIFFEIDs.default.workloadSelectorTemplates` | Templates to produce selectors that apply to a given workload before it will receive an ID | `[]` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.child-servers.type` | The type of rule this is. | `child-servers` |
|
| `controllerManager.identities.clusterSPIFFEIDs.default.ttl` | Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen. | `""` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.child-servers.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `true` |
|
| `controllerManager.identities.clusterSPIFFEIDs.default.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable this identity for controller manager | `true` |
|
| `controllerManager.identities.clusterSPIFFEIDs.default.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type` | The type of rule this is. | `oidc-discovery-provider` |
|
| `controllerManager.identities.clusterSPIFFEIDs.default.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate DNS names to the discovery provider | `true` |
|
| `controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.dnsNameTemplates` | DNS name template for issued identities | `[]` |
|
| `controllerManager.identities.clusterSPIFFEIDs.default.fallback` | Apply this ID only if there are no other matching non fallback ClusterSPIFFEIDs | `true` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable this identity for controller manager | `true` |
|
| `controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled` | Enable this identity for controller manager | `false` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.type` | The type of rule this is. | `test-keys` |
|
| `controllerManager.identities.clusterSPIFFEIDs.child-servers.type` | The type of rule this is. | `child-servers` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.enabled` | Enable this identity for controller manager | `true` |
|
| `controllerManager.identities.clusterSPIFFEIDs.child-servers.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `true` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type` | The type of rule this is. | `spike-keeper` |
|
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable this identity for controller manager | `true` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/keeper/{{ .PodMeta.Name }}` |
|
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type` | The type of rule this is. | `oidc-discovery-provider` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.enabled` | Enable this identity for controller manager | `true` |
|
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate DNS names to the discovery provider | `true` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type` | The type of rule this is. | `spike-nexus` |
|
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.dnsNameTemplates` | DNS name template for issued identities | `[]` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/nexus/{{ .PodMeta.Name }}` |
|
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable this identity for controller manager | `true` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.enabled` | Enable this identity for controller manager | `true` |
|
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.type` | The type of rule this is. | `test-keys` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.type` | The type of rule this is. | `spike-bootstrap` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type` | The type of rule this is. | `spike-keeper` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/bootstrap/{{ .PodMeta.Name }}` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/keeper/{{ .PodMeta.Name }}` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.enabled` | Enable this identity for controller manager | `true` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type` | The type of rule this is. | `spike-nexus` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.type` | The type of rule this is. | `spike-pilot` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/nexus/{{ .PodMeta.Name }}` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/pilot/role/superuser` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.type` | The type of rule this is. | `spike-bootstrap` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled` | Enable this identity for controller manager | `false` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/bootstrap/{{ .PodMeta.Name }}` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.type` | The type of rule this is. | `spire-ha-agent` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.type` | The type of rule this is. | `spike-pilot` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spire-ha-agent` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/pilot/role/superuser` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.federatesWith` | Federated trust domains to pass to the workload | `["spire-ha"]` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled` | Enable this identity for controller manager | `false` |
|
||||||
| `controllerManager.identities.clusterStaticEntries` | Specify ClusterStaticEntry objects. | `{}` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.type` | The type of rule this is. | `spire-ha-agent` |
|
||||||
| `controllerManager.identities.clusterFederatedTrustDomains` | Specify ClusterFederatedTrustDomain objects. | `{}` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spire-ha-agent` |
|
||||||
| `controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another chart instance on the k8s cluster with webhooks enabled. | `true` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.federatesWith` | Federated trust domains to pass to the workload | `["spire-ha"]` |
|
||||||
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/service/trustbundle-spire-identity-exchange` |
|
||||||
| `controllerManager.cacheNamespaces` | If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. | `{}` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.type` | The type of rule this is. | `spire-identity-exchange` |
|
||||||
| `externalControllerManagers.enabled` | Flag to enable external controller managers | `false` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.workloadSelectorTemplates` | Workload selectors. | `[]` |
|
||||||
| `externalControllerManagers.defaults.reconcile.clusterSPIFFEIDs` | Enable reconciliation of clusterSPIFFEIDs from K8s to the SPIRE server | `true` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/service/spire-identity-exchange` |
|
||||||
| `externalControllerManagers.defaults.reconcile.clusterStaticEntries` | Enable reconciliation of clusterStaticEntries from K8s to the SPIRE server | `false` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.type` | The type of rule this is. | `spire-identity-exchange` |
|
||||||
| `externalControllerManagers.defaults.reconcile.clusterFederatedTrustDomains` | Enable reconciliation of clusterFederatedTrustDomains from K8s to the SPIRE server | `false` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.workloadSelectorTemplates` | Workload selectors. | `[]` |
|
||||||
| `externalControllerManagers.defaults.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-agent.type` | The type of rule this is. | `spire-identity-exchange` |
|
||||||
| `externalControllerManagers.defaults.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-agent.workloadSelectorTemplates` | Workload selectors. | `[]` |
|
||||||
| `externalControllerManagers.defaults.entryIDPrefixCleanup` | consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` |
|
| `controllerManager.identities.clusterStaticEntries.spire-identity-exchange` | Settings for the spire-identity-exchnage | `{}` |
|
||||||
| `externalControllerManagers.defaults.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
|
| `controllerManager.identities.clusterStaticEntries.spire-identity-exchange-agent.selectors` | selector | `[]` |
|
||||||
| `externalControllerManagers.defaults.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` |
|
| `controllerManager.identities.clusterFederatedTrustDomains` | Specify ClusterFederatedTrustDomain objects. | `{}` |
|
||||||
| `externalControllerManagers.defaults.leaderElection.renewDeadline` | Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. | `10s` |
|
| `controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another chart instance on the k8s cluster with webhooks enabled. | `true` |
|
||||||
| `externalControllerManagers.defaults.leaderElection.retryPeriod` | Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. | `2s` |
|
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
|
||||||
| `externalControllerManagers.defaults.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` |
|
| `controllerManager.cacheNamespaces` | If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. | `{}` |
|
||||||
| `externalControllerManagers.defaults.extraEnv` | Extra environment variables to add to the controller manager | `[]` |
|
| `externalControllerManagers.enabled` | Flag to enable external controller managers | `false` |
|
||||||
| `externalControllerManagers.defaults.resources` | Resource requests and limits for controller manager | `{}` |
|
| `externalControllerManagers.defaults.reconcile.clusterSPIFFEIDs` | Enable reconciliation of clusterSPIFFEIDs from K8s to the SPIRE server | `true` |
|
||||||
| `externalControllerManagers.defaults.securityContext` | Security context | `{}` |
|
| `externalControllerManagers.defaults.reconcile.clusterStaticEntries` | Enable reconciliation of clusterStaticEntries from K8s to the SPIRE server | `false` |
|
||||||
| `externalControllerManagers.defaults.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` |
|
| `externalControllerManagers.defaults.reconcile.clusterFederatedTrustDomains` | Enable reconciliation of clusterFederatedTrustDomains from K8s to the SPIRE server | `false` |
|
||||||
| `externalControllerManagers.defaults.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` |
|
| `externalControllerManagers.defaults.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
||||||
| `externalControllerManagers.defaults.cacheNamespaces` | If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. | `{}` |
|
| `externalControllerManagers.defaults.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
||||||
| `externalControllerManagers.clusters` | A dictionary of clusters to add with optional overrides (kubeConfigName, reconcile, healthPortName, prometheusPortName). If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
| `externalControllerManagers.defaults.entryIDPrefixCleanup` | consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` |
|
||||||
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
|
| `externalControllerManagers.defaults.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` |
|
||||||
| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` |
|
| `externalControllerManagers.defaults.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` |
|
||||||
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `externalControllerManagers.defaults.leaderElection.renewDeadline` | Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. | `10s` |
|
||||||
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
| `externalControllerManagers.defaults.leaderElection.retryPeriod` | Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. | `2s` |
|
||||||
| `tools.busybox.image.registry` | The OCI registry to pull the image from | `""` |
|
| `externalControllerManagers.defaults.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` |
|
||||||
| `tools.busybox.image.repository` | The repository within the registry | `busybox` |
|
| `externalControllerManagers.defaults.extraEnv` | Extra environment variables to add to the controller manager | `[]` |
|
||||||
| `tools.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `externalControllerManagers.defaults.resources` | Resource requests and limits for controller manager | `{}` |
|
||||||
| `tools.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` |
|
| `externalControllerManagers.defaults.securityContext` | Security context | `{}` |
|
||||||
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
| `externalControllerManagers.defaults.configMap.annotations` | Annotations to add to the Controller Manager ConfigMap | `{}` |
|
||||||
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
| `externalControllerManagers.defaults.ignoreNamespaces` | These namespaces are ignored by controller manager | `[]` |
|
||||||
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
|
| `externalControllerManagers.defaults.cacheNamespaces` | If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces. | `{}` |
|
||||||
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
| `externalControllerManagers.clusters` | A dictionary of clusters to add with optional overrides (kubeConfigName, reconcile, healthPortName, prometheusPortName). If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
||||||
| `telemetry.datadog.enabled` | Flag to enable datadog monitoring | `false` |
|
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
|
||||||
| `telemetry.datadog.address` | The address of the datadog service to send metrics to. The default URL for services are `<service-name>.<namespace>.svc` | `datadog.kube-system.svc` |
|
| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` |
|
||||||
| `telemetry.datadog.port` | The port of the datadog service to send metrics to | `8125` |
|
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `ingress.enabled` | Flag to enable ingress | `false` |
|
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
| `ingress.className` | Ingress class name | `""` |
|
| `tools.busybox.image.registry` | The OCI registry to pull the image from | `""` |
|
||||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
| `tools.busybox.image.repository` | The repository within the registry | `busybox` |
|
||||||
| `ingress.annotations` | Annotations for the ingress object | `{}` |
|
| `tools.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server` |
|
| `tools.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` |
|
||||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
||||||
| `ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
||||||
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
|
||||||
| `extraEnv` | Extra environment variables to add to the spire server | `[]` |
|
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||||
| `extraVolumes` | Extra volumes to be mounted | `[]` |
|
| `telemetry.datadog.enabled` | Flag to enable datadog monitoring | `false` |
|
||||||
| `extraVolumeMounts` | Extra volume mounts | `[]` |
|
| `telemetry.datadog.address` | The address of the datadog service to send metrics to. The default URL for services are `<service-name>.<namespace>.svc` | `datadog.kube-system.svc` |
|
||||||
| `extraContainers` | Additional containers to create | `[]` |
|
| `telemetry.datadog.port` | The port of the datadog service to send metrics to | `8125` |
|
||||||
| `initContainers` | Additional init containers to create | `[]` |
|
| `ingress.enabled` | Flag to enable ingress | `false` |
|
||||||
| `caKeyType` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) | `rsa-2048` |
|
| `ingress.className` | Ingress class name | `""` |
|
||||||
| `caTTL` | TTL for CA | `24h` |
|
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||||
| `agentTTL` | The TTL to use for agent SVIDs. If unset, the defaultX509SvidTTL will be used. | `""` |
|
| `ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||||
| `defaultX509SvidTTL` | TTL for X509 Svids | `4h` |
|
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server` |
|
||||||
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
|
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||||
| `rateLimit.attestation` | Enable rate limiting for node attestation. When true, rate limits node attestation to 1 per second globally. Set to false to disable. | `true` |
|
| `ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
||||||
| `rateLimit.signing` | Enable rate limiting for SVID signing (BatchNewX509SVID, BatchNewJWTSVID). When true, rate limits signing to 500 requests per second per server pod. Set to false to disable. Disabling is appropriate when running many replicas or during thundering-herd recovery. | `true` |
|
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||||
| `pruneAttestedNodesExpiredFor` | Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval. | `""` |
|
| `extraEnv` | Extra environment variables to add to the spire server | `[]` |
|
||||||
| `pruneTOFUNodes` | If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned. | `false` |
|
| `extraVolumes` | Extra volumes to be mounted | `[]` |
|
||||||
| `maxAttestedNodeInfoStaleness` | How long to trust stale cache information about attested nodes. Set to "" to use the SPIRE default (0s). Increasing this can improve performance under high load by reducing datastore reads, at the cost of acting on slightly stale node state. Accepts Go duration strings (e.g. "10s", "1m"). | `""` |
|
| `extraVolumeMounts` | Extra volume mounts | `[]` |
|
||||||
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `true` |
|
| `extraContainers` | Additional containers to create | `[]` |
|
||||||
| `nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor. If namespace isn't specified, release namespace will be used. | `[]` |
|
| `initContainers` | Additional init containers to create | `[]` |
|
||||||
| `nodeAttestor.k8sPSAT.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` |
|
| `caKeyType` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) | `rsa-2048` |
|
||||||
| `nodeAttestor.k8sPSAT.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` |
|
| `caTTL` | TTL for CA | `24h` |
|
||||||
| `nodeAttestor.k8sPSAT.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` |
|
| `agentTTL` | The TTL to use for agent SVIDs. If unset, the defaultX509SvidTTL will be used. | `""` |
|
||||||
| `nodeAttestor.externalK8sPSAT.enabled` | Enable PSAT k8s nodeattestor for external Kubernetes clusters | `true` |
|
| `defaultX509SvidTTL` | TTL for X509 Svids | `4h` |
|
||||||
| `nodeAttestor.externalK8sPSAT.defaults.serviceAccountAllowList` | Allowed service accounts for PSAT node attestor | `[]` |
|
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
|
||||||
| `nodeAttestor.externalK8sPSAT.defaults.audience` | Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used | `[]` |
|
| `rateLimit.attestation` | Enable rate limiting for node attestation. When true, rate limits node attestation to 1 per second globally. Set to false to disable. | `true` |
|
||||||
| `nodeAttestor.externalK8sPSAT.defaults.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` |
|
| `rateLimit.signing` | Enable rate limiting for SVID signing (BatchNewX509SVID, BatchNewJWTSVID). When true, rate limits signing to 500 requests per second per server pod. Set to false to disable. Disabling is appropriate when running many replicas or during thundering-herd recovery. | `true` |
|
||||||
| `nodeAttestor.externalK8sPSAT.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` |
|
| `pruneAttestedNodesExpiredFor` | Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval. | `""` |
|
||||||
| `nodeAttestor.externalK8sPSAT.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
| `pruneTOFUNodes` | If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned. | `false` |
|
||||||
| `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` |
|
| `maxAttestedNodeInfoStaleness` | How long to trust stale cache information about attested nodes. Set to "" to use the SPIRE default (0s). Increasing this can improve performance under high load by reducing datastore reads, at the cost of acting on slightly stale node state. Accepts Go duration strings (e.g. "10s", "1m"). | `""` |
|
||||||
| `nodeAttestor.httpChallenge.enabled` | Enable the http_challenge nodeattesto | `false` |
|
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `true` |
|
||||||
| `nodeAttestor.httpChallenge.allowedDNSPatterns` | A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed. | `[]` |
|
| `nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor. If namespace isn't specified, release namespace will be used. | `[]` |
|
||||||
| `nodeAttestor.httpChallenge.requiredPort` | Set to a port number to require clients to listen only on that port. If 0, all port numbers are allowed | `0` |
|
| `nodeAttestor.k8sPSAT.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` |
|
||||||
| `nodeAttestor.httpChallenge.allowNonRootPorts` | Allow using ports >= 1024 from clients for attestation | `true` |
|
| `nodeAttestor.k8sPSAT.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` |
|
||||||
| `nodeAttestor.httpChallenge.tofu` | Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024 | `true` |
|
| `nodeAttestor.k8sPSAT.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` |
|
||||||
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
|
| `nodeAttestor.externalK8sPSAT.enabled` | Enable PSAT k8s nodeattestor for external Kubernetes clusters | `true` |
|
||||||
| `nodeAttestor.tpmDirect.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `nodeAttestor.externalK8sPSAT.defaults.serviceAccountAllowList` | Allowed service accounts for PSAT node attestor | `[]` |
|
||||||
| `nodeAttestor.tpmDirect.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-server` |
|
| `nodeAttestor.externalK8sPSAT.defaults.audience` | Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used | `[]` |
|
||||||
| `nodeAttestor.tpmDirect.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `nodeAttestor.externalK8sPSAT.defaults.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` |
|
||||||
| `nodeAttestor.tpmDirect.image.tag` | Overrides the image tag | `v1.9.0` |
|
| `nodeAttestor.externalK8sPSAT.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` |
|
||||||
| `nodeAttestor.tpmDirect.checksum` | The sha256 checksum of the plugin binary | `46d0caad8c25a027dd11c93e18b58a8bc6fbd9f1fe2e36fa2a0dd440986de4dc` |
|
| `nodeAttestor.externalK8sPSAT.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
||||||
| `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` |
|
| `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` |
|
||||||
| `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` |
|
| `nodeAttestor.httpChallenge.enabled` | Enable the http_challenge nodeattesto | `false` |
|
||||||
| `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` |
|
| `nodeAttestor.httpChallenge.allowedDNSPatterns` | A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed. | `[]` |
|
||||||
| `nodeAttestor.awsIID.enabled` | Enable the aws_iid node attestor | `false` |
|
| `nodeAttestor.httpChallenge.requiredPort` | Set to a port number to require clients to listen only on that port. If 0, all port numbers are allowed | `0` |
|
||||||
| `nodeAttestor.awsIID.assumeRole` | AWS IAM Role NAME to use for the attestation | `""` |
|
| `nodeAttestor.httpChallenge.allowNonRootPorts` | Allow using ports >= 1024 from clients for attestation | `true` |
|
||||||
| `nodeAttestor.awsIID.verifyOrganization` | When enabled, SPIRE verifies the attesting node's AWS account is a member of your AWS Organization ([SPIRE aws_iid server plugin](https://github.com/spiffe/spire/blob/main/doc/plugin_server_nodeattestor_aws_iid.md)). | |
|
| `nodeAttestor.httpChallenge.tofu` | Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024 | `true` |
|
||||||
| `nodeAttestor.awsIID.verifyOrganization.enabled` | Enable AWS Organizations membership validation (`verify_organization` in plugin config) | `false` |
|
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
|
||||||
| `nodeAttestor.awsIID.verifyOrganization.managementAccountId` | AWS Organizations management/root account ID (12 digits); SPIRE assumes `arn:aws:iam::<managementAccountId>:role/<assumeOrgRole>` for listing org accounts. | `""` |
|
| `nodeAttestor.tpmDirect.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `nodeAttestor.awsIID.verifyOrganization.assumeOrgRole` | IAM role **name** in the management account; must allow `organizations:ListAccounts` and trust the IAM identity used by the SPIRE server. | `""` |
|
| `nodeAttestor.tpmDirect.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-server` |
|
||||||
| `nodeAttestor.awsIID.verifyOrganization.managementAccountRegion` | Optional region SPIRE uses for org validation/cache keying (defaults in SPIRE if unset). | `""` |
|
| `nodeAttestor.tpmDirect.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `nodeAttestor.awsIID.verifyOrganization.orgAccountMapTTL` | Optional cache TTL for the org account map (SPIRE expects a duration ≥ 1m when set; e.g. `3m`, `5m`). Defaults to 3 minutes. | `3m` |
|
| `nodeAttestor.tpmDirect.image.tag` | Overrides the image tag | `v1.9.0` |
|
||||||
| `nodeAttestor.gcpIIT.enabled` | Enable the gcp_iit node attestor | `false` |
|
| `nodeAttestor.tpmDirect.checksum` | The sha256 checksum of the plugin binary | `46d0caad8c25a027dd11c93e18b58a8bc6fbd9f1fe2e36fa2a0dd440986de4dc` |
|
||||||
| `nodeAttestor.gcpIIT.projectIDAllowList` | List of ProjectIDs from which nodes can be attested | `[]` |
|
| `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` |
|
||||||
| `nodeAttestor.gcpIIT.useInstanceMetadata` | If true, instance metadata is fetched from the Google Compute Engine API and used to augment the node selectors produced by the plugin | `false` |
|
| `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` |
|
||||||
| `nodeAttestor.gcpIIT.allowedLabelKeys` | Instance label keys considered for selectors | `[]` |
|
| `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` |
|
||||||
| `nodeAttestor.gcpIIT.allowedMetadataKeys` | Instance metadata keys considered for selectors | `[]` |
|
| `nodeAttestor.awsIID.enabled` | Enable the aws_iid node attestor | `false` |
|
||||||
| `nodeAttestor.gcpIIT.metadataValueMaxSize` | Sets the maximum metadata value size considered by the plugin for selectors | `0` |
|
| `nodeAttestor.awsIID.assumeRole` | AWS IAM Role NAME to use for the attestation | `""` |
|
||||||
| `nodeAttestor.gcpIIT.agentPathTemplate` | A URL path portion format of Agent's SPIFFE ID. Describe in text/template format. | `""` |
|
| `nodeAttestor.awsIID.verifyOrganization` | When enabled, SPIRE verifies the attesting node's AWS account is a member of your AWS Organization ([SPIRE aws_iid server plugin](https://github.com/spiffe/spire/blob/main/doc/plugin_server_nodeattestor_aws_iid.md)). | |
|
||||||
| `nodeAttestor.x509POP.enabled` | Enable the x509_popg node attestor | `false` |
|
| `nodeAttestor.awsIID.verifyOrganization.enabled` | Enable AWS Organizations membership validation (`verify_organization` in plugin config) | `false` |
|
||||||
| `nodeAttestor.x509POP.mode` | What mode to set the plugin to. Currently only spiffe mode is supported | `spiffe` |
|
| `nodeAttestor.awsIID.verifyOrganization.managementAccountId` | AWS Organizations management/root account ID (12 digits); SPIRE assumes `arn:aws:iam::<managementAccountId>:role/<assumeOrgRole>` for listing org accounts. | `""` |
|
||||||
| `nodeAttestor.x509POP.svidPrefix` | What prefix to use when mode is spiffe | `/spire-exchange` |
|
| `nodeAttestor.awsIID.verifyOrganization.assumeOrgRole` | IAM role **name** in the management account; must allow `organizations:ListAccounts` and trust the IAM identity used by the SPIRE server. | `""` |
|
||||||
| `nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `""` |
|
| `nodeAttestor.awsIID.verifyOrganization.managementAccountRegion` | Optional region SPIRE uses for org validation/cache keying (defaults in SPIRE if unset). | `""` |
|
||||||
| `nodeAttestor.x509POP.maxIntermediates` | Maximum number of intermediate certificates allowed in the certificate chain | `4` |
|
| `nodeAttestor.awsIID.verifyOrganization.orgAccountMapTTL` | Optional cache TTL for the org account map (SPIRE expects a duration ≥ 1m when set; e.g. `3m`, `5m`). Defaults to 3 minutes. | `3m` |
|
||||||
| `nodeAttestor.x509POP.maxRSAKeySize` | Maximum RSA key size in bits allowed in certificates | `8192` |
|
| `nodeAttestor.gcpIIT.enabled` | Enable the gcp_iit node attestor | `false` |
|
||||||
| `nodeAttestor.x509POP.addClusterName.svidPrefix` | Suffix the cluster name onto the svidPrefix | `false` |
|
| `nodeAttestor.gcpIIT.projectIDAllowList` | List of ProjectIDs from which nodes can be attested | `[]` |
|
||||||
| `nodeAttestor.x509POP.addClusterName.agentPathTemplate` | Suffix the cluster name onto the agentPathTemplate | `false` |
|
| `nodeAttestor.gcpIIT.useInstanceMetadata` | If true, instance metadata is fetched from the Google Compute Engine API and used to augment the node selectors produced by the plugin | `false` |
|
||||||
| `bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `true` |
|
| `nodeAttestor.gcpIIT.allowedLabelKeys` | Instance label keys considered for selectors | `[]` |
|
||||||
| `bundlePublisher.k8sConfigMap.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
| `nodeAttestor.gcpIIT.allowedMetadataKeys` | Instance metadata keys considered for selectors | `[]` |
|
||||||
| `bundlePublisher.k8sConfigMap.format` | Format of the trust bundle. Can be pem or spiffe | `spiffe` |
|
| `nodeAttestor.gcpIIT.metadataValueMaxSize` | Sets the maximum metadata value size considered by the plugin for selectors | `0` |
|
||||||
| `bundlePublisher.externalK8sConfigMap.enabled` | Enable external k8s bundle uploader | `true` |
|
| `nodeAttestor.gcpIIT.agentPathTemplate` | A URL path portion format of Agent's SPIFFE ID. Describe in text/template format. | `""` |
|
||||||
| `bundlePublisher.externalK8sConfigMap.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` |
|
| `nodeAttestor.x509POP.enabled` | Enable the x509_popg node attestor | `false` |
|
||||||
| `bundlePublisher.externalK8sConfigMap.defaults.configMapName` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` |
|
| `nodeAttestor.x509POP.mode` | What mode to set the plugin to. Currently only spiffe mode is supported | `spiffe` |
|
||||||
| `bundlePublisher.externalK8sConfigMap.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `""` |
|
| `nodeAttestor.x509POP.spiffePrefix` | What prefix to use when mode is spiffe | `/spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/` |
|
||||||
| `bundlePublisher.externalK8sConfigMap.defaults.format` | Format of the trust bundle. Can be pem or spiffe | `spiffe` |
|
| `nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `""` |
|
||||||
| `bundlePublisher.externalK8sConfigMap.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
| `nodeAttestor.x509POP.maxIntermediates` | Maximum number of intermediate certificates allowed in the certificate chain | `4` |
|
||||||
| `bundlePublisher.awsRolesAnywhereTrustAnchor.enabled` | Enable the AWS S3 bundle publisher | `false` |
|
| `nodeAttestor.x509POP.maxRSAKeySize` | Maximum RSA key size in bits allowed in certificates | `8192` |
|
||||||
| `bundlePublisher.awsRolesAnywhereTrustAnchor.region` | AWS region to store the trust bundle | `""` |
|
| `nodeAttestor.x509POP.addClusterName.spiffePrefix` | Suffix the cluster name onto the svidPrefix | `true` |
|
||||||
| `bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID` | AWS trust anchor ID to publish to | `""` |
|
| `nodeAttestor.x509POP.addClusterName.agentPathTemplate` | Suffix the cluster name onto the agentPathTemplate | `true` |
|
||||||
| `bundlePublisher.awsS3.enabled` | Enable the AWS S3 bundle publisher | `false` |
|
| `bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `true` |
|
||||||
| `bundlePublisher.awsS3.endpoint` | A custom S3 endpoint should be set when using third-party object storage providers, such as Minio. | `""` |
|
| `bundlePublisher.k8sConfigMap.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||||
| `bundlePublisher.awsS3.region` | AWS region to store the trust bundle | `""` |
|
| `bundlePublisher.k8sConfigMap.format` | Format of the trust bundle. Can be pem or spiffe | `spiffe` |
|
||||||
| `bundlePublisher.awsS3.bucket` | AWS S3 bucket name to which the trust bundle is uploaded | `""` |
|
| `bundlePublisher.externalK8sConfigMap.enabled` | Enable external k8s bundle uploader | `true` |
|
||||||
| `bundlePublisher.awsS3.objectKey` | AWS S3 object key inside the bucket | `""` |
|
| `bundlePublisher.externalK8sConfigMap.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` |
|
||||||
| `bundlePublisher.awsS3.format` | Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] | `""` |
|
| `bundlePublisher.externalK8sConfigMap.defaults.configMapName` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` |
|
||||||
| `bundlePublisher.gcpCloudStorage.enabled` | Enable the Google Cloud Storage bundle publisher | `false` |
|
| `bundlePublisher.externalK8sConfigMap.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `""` |
|
||||||
| `bundlePublisher.gcpCloudStorage.bucketName` | Google Cloud Storage bucket name to which the trust bundle is uploaded | `""` |
|
| `bundlePublisher.externalK8sConfigMap.defaults.format` | Format of the trust bundle. Can be pem or spiffe | `spiffe` |
|
||||||
| `bundlePublisher.gcpCloudStorage.objectName` | Google Cloud Storage object name | `""` |
|
| `bundlePublisher.externalK8sConfigMap.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
||||||
| `bundlePublisher.gcpCloudStorage.format` | Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] | `""` |
|
| `bundlePublisher.awsRolesAnywhereTrustAnchor.enabled` | Enable the AWS S3 bundle publisher | `false` |
|
||||||
| `dynamicRegistration.enabled` | Deploys the sidecar helper for dynamic registration | `false` |
|
| `bundlePublisher.awsRolesAnywhereTrustAnchor.region` | AWS region to store the trust bundle | `""` |
|
||||||
| `dynamicRegistration.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID` | AWS trust anchor ID to publish to | `""` |
|
||||||
| `dynamicRegistration.image.repository` | The repository within the registry | `spiffe/spire-controller-manager-dynamic-registration/spire-controller-manager-dynamic-registration-server` |
|
| `bundlePublisher.awsS3.enabled` | Enable the AWS S3 bundle publisher | `false` |
|
||||||
| `dynamicRegistration.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `bundlePublisher.awsS3.endpoint` | A custom S3 endpoint should be set when using third-party object storage providers, such as Minio. | `""` |
|
||||||
| `dynamicRegistration.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `0.1.0` |
|
| `bundlePublisher.awsS3.region` | AWS region to store the trust bundle | `""` |
|
||||||
| `dynamicRegistration.serviceAccount` | Which service account to allow to register | `spire-agent` |
|
| `bundlePublisher.awsS3.bucket` | AWS S3 bucket name to which the trust bundle is uploaded | `""` |
|
||||||
| `dynamicRegistration.audience` | The expected audience | `spire-controller-manager-dynamic-registration` |
|
| `bundlePublisher.awsS3.objectKey` | AWS S3 object key inside the bucket | `""` |
|
||||||
| `dynamicRegistration.entryPrefix` | Unique prefix to bind nodes aliases to the server | `scmnr` |
|
| `bundlePublisher.awsS3.format` | Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] | `""` |
|
||||||
| `dynamicRegistration.allowedIDPrefix` | Prefix of agents that are allowed to register | `spire/agent/k8s_psat` |
|
| `bundlePublisher.gcpCloudStorage.enabled` | Enable the Google Cloud Storage bundle publisher | `false` |
|
||||||
| `dynamicRegistration.registrationPrefix` | prefix to use on all new registration entries | `k8s_psat` |
|
| `bundlePublisher.gcpCloudStorage.bucketName` | Google Cloud Storage bucket name to which the trust bundle is uploaded | `""` |
|
||||||
| `dynamicRegistration.addClusterName.registrationPrefix` | suffix the cluster name onto the registrationPrefix | `true` |
|
| `bundlePublisher.gcpCloudStorage.objectName` | Google Cloud Storage object name | `""` |
|
||||||
| `dynamicRegistration.addClusterName.allowedIDPrefix` | suffix the cluster name onto the allowedIDPrefix | `true` |
|
| `bundlePublisher.gcpCloudStorage.format` | Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] | `""` |
|
||||||
| `dynamicRegistration.securityContext` | Security Context to use | `{}` |
|
| `dynamicRegistration.enabled` | Deploys the sidecar helper for dynamic registration | `false` |
|
||||||
|
| `dynamicRegistration.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
|
| `dynamicRegistration.image.repository` | The repository within the registry | `spiffe/spire-controller-manager-dynamic-registration/spire-controller-manager-dynamic-registration-server` |
|
||||||
|
| `dynamicRegistration.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `dynamicRegistration.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `0.1.0` |
|
||||||
|
| `dynamicRegistration.serviceAccount` | Which service account to allow to register | `spire-agent` |
|
||||||
|
| `dynamicRegistration.audience` | The expected audience | `spire-controller-manager-dynamic-registration` |
|
||||||
|
| `dynamicRegistration.entryPrefix` | Unique prefix to bind nodes aliases to the server | `scmnr` |
|
||||||
|
| `dynamicRegistration.allowedIDPrefix` | Prefix of agents that are allowed to register | `spire/agent/k8s_psat` |
|
||||||
|
| `dynamicRegistration.registrationPrefix` | prefix to use on all new registration entries | `k8s_psat` |
|
||||||
|
| `dynamicRegistration.addClusterName.registrationPrefix` | suffix the cluster name onto the registrationPrefix | `true` |
|
||||||
|
| `dynamicRegistration.addClusterName.allowedIDPrefix` | suffix the cluster name onto the allowedIDPrefix | `true` |
|
||||||
|
| `dynamicRegistration.securityContext` | Security Context to use | `{}` |
|
||||||
|
|
||||||
### Tornjak
|
### Tornjak
|
||||||
|
|
||||||
@@ -578,3 +590,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58` |
|
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58` |
|
||||||
| `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` |
|
| `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` |
|
||||||
|
| `spireIdentityExchange.enabled` | Enable the server side of the SPIRE Identity Exchange system | `false` |
|
||||||
|
| `spike.enabled` | Enable the server side of SPIKE | `false` |
|
||||||
|
|||||||
@@ -415,3 +415,11 @@ subjects:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
{{- toYaml $podSecurityContext }}
|
{{- toYaml $podSecurityContext }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
|
{{- define "spire-server.identity-exchange-spiffe-prefix" -}}
|
||||||
|
{{- $cn := "" }}
|
||||||
|
{{- if .Values.nodeAttestor.x509POP.addClusterName.spiffePrefix }}
|
||||||
|
{{- $cn = printf "/%s" (include "spire-lib.cluster-name" .) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- replace "${HELM_ADD_CLUSTER_NAME}" $cn .Values.nodeAttestor.x509POP.spiffePrefix }}
|
||||||
|
{{- end }}
|
||||||
|
|||||||
@@ -131,7 +131,7 @@ server:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
plugins:
|
plugins:
|
||||||
{{- if or .Values.credentialComposer.uniqueID.enabled .Values.credentialComposer.cel.enabled }}
|
{{- if or .Values.credentialComposer.uniqueID.enabled .Values.credentialComposer.cel.enabled .Values.spireIdentityExchange.enabled }}
|
||||||
CredentialComposer:
|
CredentialComposer:
|
||||||
{{- if or .Values.credentialComposer.uniqueID.enabled }}
|
{{- if or .Values.credentialComposer.uniqueID.enabled }}
|
||||||
uniqueid: {}
|
uniqueid: {}
|
||||||
@@ -139,13 +139,34 @@ plugins:
|
|||||||
{{- with .Values.credentialComposer.cel }}
|
{{- with .Values.credentialComposer.cel }}
|
||||||
{{- if .enabled }}
|
{{- if .enabled }}
|
||||||
cel:
|
cel:
|
||||||
plugin_cmd: "/cel/credentialcomposer-cel"
|
plugin_cmd: "/plugins/credentialcomposer-cel"
|
||||||
plugin_checksum: {{ .checksum }}
|
plugin_checksum: {{ .checksum }}
|
||||||
plugin_data:
|
plugin_data:
|
||||||
jwt:
|
jwt:
|
||||||
expression_string: {{ .jwt.expression | quote }}
|
expression_string: {{ .jwt.expression | quote }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- with .Values.credentialComposer.spireIdentityExchange }}
|
||||||
|
{{- if $root.Values.spireIdentityExchange.enabled }}
|
||||||
|
identityexchange:
|
||||||
|
plugin_cmd: "/plugins/credentialcomposer-identity-exchange"
|
||||||
|
plugin_checksum: {{ .checksum }}
|
||||||
|
plugin_data:
|
||||||
|
{{- $spiffePrefix := $root.Values.nodeAttestor.x509POP.spiffePrefix }}
|
||||||
|
{{- if not (hasSuffix "/" $spiffePrefix) }}
|
||||||
|
{{- $spiffePrefix = printf "%s/" $spiffePrefix }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if eq .prefix "" }}
|
||||||
|
{{- if $root.Values.nodeAttestor.x509POP.addClusterName.spiffePrefix }}
|
||||||
|
prefix: {{ printf "%s%s/spire-identity-exchange/" $spiffePrefix (include "spire-lib.cluster-name" $root) | quote }}
|
||||||
|
{{- else }}
|
||||||
|
prefix: {{ printf "%s/spire-identity-exchange/" $spiffePrefix | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- else }}
|
||||||
|
prefix: {{ .prefix | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
DataStore:
|
DataStore:
|
||||||
@@ -176,7 +197,7 @@ plugins:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
{{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled .Values.nodeAttestor.awsIID.enabled .Values.nodeAttestor.gcpIIT.enabled .Values.nodeAttestor.x509POP.enabled }}
|
{{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled .Values.nodeAttestor.awsIID.enabled .Values.nodeAttestor.gcpIIT.enabled .Values.nodeAttestor.x509POP.enabled .Values.spireIdentityExchange.enabled }}
|
||||||
NodeAttestor:
|
NodeAttestor:
|
||||||
{{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPSAT.clusters }}
|
{{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPSAT.clusters }}
|
||||||
{{- if or (eq (.Values.nodeAttestor.k8sPSAT.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true") (gt (len $clusters) 0)) }}
|
{{- if or (eq (.Values.nodeAttestor.k8sPSAT.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true") (gt (len $clusters) 0)) }}
|
||||||
@@ -257,24 +278,26 @@ plugins:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- with .Values.nodeAttestor.x509POP }}
|
{{- with .Values.nodeAttestor.x509POP }}
|
||||||
{{- if eq (.enabled | toString) "true" }}
|
{{- if or (eq (.enabled | toString) "true") $root.Values.spireIdentityExchange.enabled }}
|
||||||
x509pop:
|
x509pop:
|
||||||
plugin_data:
|
plugin_data:
|
||||||
mode: {{ .mode }}
|
mode: {{ .mode }}
|
||||||
{{- if .addClusterName.svidPrefix }}
|
spiffe_prefix: {{ include "spire-server.identity-exchange-spiffe-prefix" $root | quote }}
|
||||||
svid_prefix: {{ printf "%s/%s" .svidPrefix (include "spire-lib.cluster-name" $root) | quote }}
|
|
||||||
{{- else }}
|
|
||||||
svid_prefix: {{ .svidPrefix | quote }}
|
|
||||||
{{- end }}
|
|
||||||
max_intermediates: {{ .maxIntermediates }}
|
max_intermediates: {{ .maxIntermediates }}
|
||||||
max_rsa_key_size: {{ .maxRSAKeySize }}
|
max_rsa_key_size: {{ .maxRSAKeySize }}
|
||||||
{{- if ne .agentPathTemplate "" }}
|
{{- $cn := "" }}
|
||||||
{{- if .addClusterName.agentPathTemplate }}
|
{{- $agentPathTemplate := .agentPathTemplate }}
|
||||||
agent_path_template: {{ printf "%s/%s" .agentPathTemplate (include "spire-lib.cluster-name" $root) | quote }}
|
{{- if (eq $agentPathTemplate "") }}
|
||||||
|
{{- if eq .mode "spiffe" }}
|
||||||
|
{{- $agentPathTemplate = "/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}" }}
|
||||||
{{- else }}
|
{{- else }}
|
||||||
agent_path_template: {{ .agentPathTemplate | quote }}
|
{{- $agentPathTemplate = "/{{ .PluginName }}/{{ .Fingerprint }}" }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if .addClusterName.agentPathTemplate }}
|
||||||
|
{{- $cn = printf "/%s" (include "spire-lib.cluster-name" $root) }}
|
||||||
|
{{- end }}
|
||||||
|
agent_path_template: {{ replace "${HELM_ADD_CLUSTER_NAME}" $cn $agentPathTemplate | quote }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- with .Values.nodeAttestor.awsIID }}
|
{{- with .Values.nodeAttestor.awsIID }}
|
||||||
|
|||||||
@@ -20,6 +20,11 @@ matchLabels:
|
|||||||
release: {{ .Release.Name }}
|
release: {{ .Release.Name }}
|
||||||
release-namespace: {{ .Release.Namespace }}
|
release-namespace: {{ .Release.Namespace }}
|
||||||
component: oidc-discovery-provider
|
component: oidc-discovery-provider
|
||||||
|
{{- else if eq .type "spire-identity-exchange" }}
|
||||||
|
matchLabels:
|
||||||
|
release: {{ .Release.Name }}
|
||||||
|
release-namespace: {{ .Release.Namespace }}
|
||||||
|
component: spire-identity-exchange
|
||||||
{{- else if eq .type "spike-keeper" }}
|
{{- else if eq .type "spike-keeper" }}
|
||||||
matchLabels:
|
matchLabels:
|
||||||
release: {{ .Release.Name }}
|
release: {{ .Release.Name }}
|
||||||
@@ -62,10 +67,22 @@ matchLabels:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
||||||
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
|
{{- $process := true }}
|
||||||
|
{{- if not (hasKey $value "enabled") }}
|
||||||
|
{{- if and (hasPrefix "spire-identity-exchange" $key) (not $root.Values.spireIdentityExchange.enabled) }}
|
||||||
|
{{- $process = false }}
|
||||||
|
{{- else if and (hasPrefix "spike" $key) (not $root.Values.spike.enabled) }}
|
||||||
|
{{- $process = false }}
|
||||||
|
{{- end }}
|
||||||
|
{{- else }}
|
||||||
|
{{- if not (eq ($value.enabled | toString) "true") }}
|
||||||
|
{{- $process = false }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $process }}
|
||||||
{{- $type := dig "type" "base" $value }}
|
{{- $type := dig "type" "base" $value }}
|
||||||
{{- if not (has $type (list "base" "raw" "spire-ha-agent" "child-servers" "oidc-discovery-provider" "oidc-discovery-provider-common" "spike-keeper" "spike-nexus" "spike-bootstrap" "spike-pilot" "test-keys")) }}
|
{{- if not (has $type (list "base" "raw" "spire-ha-agent" "child-servers" "oidc-discovery-provider" "oidc-discovery-provider-common" "spike-keeper" "spike-nexus" "spike-bootstrap" "spike-pilot" "spire-identity-exchange" "test-keys")) }}
|
||||||
{{- fail (printf "Type given: %s, must be one of [base, raw, spire-ha-agent, child-servers, oidc-discovery-provider, oidc-discovery-provider-common, spike-keeper, spike-nexus, spike-bootstrap, spike-pilot, test-keys]" $type) }}
|
{{- fail (printf "Type given: %s, must be one of [base, raw, spire-ha-agent, child-servers, oidc-discovery-provider, oidc-discovery-provider-common, spike-keeper, spike-nexus, spike-bootstrap, spike-pilot, spire-identity-exchange, test-keys]" $type) }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- $namespaceSelector := deepCopy (dig "namespaceSelector" (dict) $value) }}
|
{{- $namespaceSelector := deepCopy (dig "namespaceSelector" (dict) $value) }}
|
||||||
{{- if ne $type "raw" }}
|
{{- if ne $type "raw" }}
|
||||||
@@ -99,6 +116,9 @@ spec:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
{{- if and (hasKey $value "spiffeIDTemplate") (ne (len $value.spiffeIDTemplate) 0) }}
|
{{- if and (hasKey $value "spiffeIDTemplate") (ne (len $value.spiffeIDTemplate) 0) }}
|
||||||
spiffeIDTemplate: {{ $value.spiffeIDTemplate | quote }}
|
spiffeIDTemplate: {{ $value.spiffeIDTemplate | quote }}
|
||||||
|
{{- else if eq $key "spire-identity-exchange-agent" }}
|
||||||
|
{{- $iePrefix := include "spire-server.identity-exchange-spiffe-prefix" $root }}
|
||||||
|
spiffeIDTemplate: "spiffe://{{ `{{ .TrustDomain }}` }}{{ $iePrefix }}spire-identity-exchange/{{ `{{ .PodMeta.Name }}` }}"
|
||||||
{{- else }}
|
{{- else }}
|
||||||
spiffeIDTemplate: {{ $root.Values.controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate | quote }}
|
spiffeIDTemplate: {{ $root.Values.controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate | quote }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -1,5 +1,6 @@
|
|||||||
{{- define "spire-server.cluster-static-entries" -}}
|
{{- define "spire-server.cluster-static-entries" -}}
|
||||||
{{- $root := .root }}
|
{{- $root := .root }}
|
||||||
|
{{- $trustDomain := include "spire-lib.trust-domain" .root }}
|
||||||
{{- $useShortName := .useShortName }}
|
{{- $useShortName := .useShortName }}
|
||||||
{{- range $key, $value := $root.Values.controllerManager.identities.clusterStaticEntries }}
|
{{- range $key, $value := $root.Values.controllerManager.identities.clusterStaticEntries }}
|
||||||
{{- range $skey, $svalue := $value }}
|
{{- range $skey, $svalue := $value }}
|
||||||
@@ -7,13 +8,25 @@
|
|||||||
{{- fail (printf "Unsupported property specified: %s" $skey) }}
|
{{- fail (printf "Unsupported property specified: %s" $skey) }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- range $rprop := list "spiffeID" "selectors" "parentID" }}
|
{{- if not (hasPrefix "spire-identity-exchange" $key) }}
|
||||||
{{- if not (hasKey $value $rprop) }}
|
{{- range $rprop := list "spiffeID" "selectors" "parentID" }}
|
||||||
{{- fail (printf "Required property %s was not specified" $rprop) }}
|
{{- if not (hasKey $value $rprop) }}
|
||||||
|
{{- fail (printf "Required property %s was not specified" $rprop) }}
|
||||||
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
||||||
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
|
{{- $process := true }}
|
||||||
|
{{- if not (hasKey $value "enabled") }}
|
||||||
|
{{- if and (hasPrefix "spire-identity-exchange" $key) (not $root.Values.spireIdentityExchange.enabled) }}
|
||||||
|
{{- $process = false }}
|
||||||
|
{{- end }}
|
||||||
|
{{- else }}
|
||||||
|
{{- if not (eq ($value.enabled | toString) "true") }}
|
||||||
|
{{- $process = false }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if $process }}
|
||||||
- apiVersion: spire.spiffe.io/v1alpha1
|
- apiVersion: spire.spiffe.io/v1alpha1
|
||||||
kind: ClusterStaticEntry
|
kind: ClusterStaticEntry
|
||||||
metadata:
|
metadata:
|
||||||
@@ -32,17 +45,29 @@
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
|
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
|
||||||
|
{{- if eq $key "spire-identity-exchange" }}
|
||||||
|
parentID: "spiffe://{{ $trustDomain }}/spire/server"
|
||||||
|
spiffeID: "spiffe://{{ $trustDomain }}/spire-identity-exchange"
|
||||||
|
{{- else if eq $key "spire-identity-exchange-agent" }}
|
||||||
|
parentID: "spiffe://{{ $trustDomain }}/spire-identity-exchange"
|
||||||
|
spiffeID: "spiffe://{{ $trustDomain }}/service/spire-identity-exchange"
|
||||||
|
{{- else }}
|
||||||
|
parentID: {{ $value.parentID | quote }}
|
||||||
spiffeID: {{ $value.spiffeID | quote }}
|
spiffeID: {{ $value.spiffeID | quote }}
|
||||||
|
{{- end }}
|
||||||
{{- with $value.federatesWith }}
|
{{- with $value.federatesWith }}
|
||||||
federatesWith:
|
federatesWith:
|
||||||
{{- toYaml . | nindent 6 }}
|
{{- toYaml . | nindent 6 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if and (eq $key "spire-identity-exchange") (not (hasKey $value "selectors")) }}
|
||||||
|
{{- $iePrefix := include "spire-server.identity-exchange-spiffe-prefix" $root | trimPrefix "/" }}
|
||||||
|
selectors:
|
||||||
|
- x509pop:subject:cn:{{ $iePrefix }}spire-identity-exchange
|
||||||
|
{{- else }}
|
||||||
{{- with $value.selectors }}
|
{{- with $value.selectors }}
|
||||||
selectors:
|
selectors:
|
||||||
{{- toYaml . | nindent 6 }}
|
{{- toYaml . | nindent 6 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- with $value.parentID }}
|
|
||||||
parentID: {{ . | quote }}
|
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- with $value.dnsNames }}
|
{{- with $value.dnsNames }}
|
||||||
dnsNames:
|
dnsNames:
|
||||||
|
|||||||
@@ -65,7 +65,7 @@
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- $pluginsToLoad := include "spire-lib.extract_custom_plugin_images" . | fromYamlArray }}
|
{{- $pluginsToLoad := include "spire-lib.extract_custom_plugin_images" . | fromYamlArray }}
|
||||||
{{- $pluginLoaderNeeded := or .Values.credentialComposer.cel.enabled (gt (len $pluginsToLoad) 0) }}
|
{{- $pluginLoaderNeeded := or .Values.credentialComposer.cel.enabled .Values.spireIdentityExchange.enabled (gt (len $pluginsToLoad) 0) }}
|
||||||
{{- if not .Values.externalServer }}
|
{{- if not .Values.externalServer }}
|
||||||
apiVersion: apps/v1
|
apiVersion: apps/v1
|
||||||
{{- if eq .Values.kind "statefulset" }}
|
{{- if eq .Values.kind "statefulset" }}
|
||||||
@@ -159,6 +159,23 @@ spec:
|
|||||||
mountPath: /plugins
|
mountPath: /plugins
|
||||||
imagePullPolicy: {{ .Values.credentialComposer.cel.image.pullPolicy }}
|
imagePullPolicy: {{ .Values.credentialComposer.cel.image.pullPolicy }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if .Values.spireIdentityExchange.enabled }}
|
||||||
|
- name: init-six
|
||||||
|
securityContext:
|
||||||
|
{{- include "spire-lib.securitycontext" . | nindent 12 }}
|
||||||
|
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.credentialComposer.spireIdentityExchange.image "global" .Values.global) }}
|
||||||
|
# Second, use the previously copied busybox to copy the plugin into a volume that can be mounted where SPIRE can execute it.
|
||||||
|
command:
|
||||||
|
- /plugins/busybox
|
||||||
|
- sh
|
||||||
|
- -ec
|
||||||
|
- |
|
||||||
|
/plugins/busybox cp -a {{ .Values.credentialComposer.spireIdentityExchange.pluginPath }} /plugins/credentialcomposer-identity-exchange
|
||||||
|
volumeMounts:
|
||||||
|
- name: plugins
|
||||||
|
mountPath: /plugins
|
||||||
|
imagePullPolicy: {{ .Values.credentialComposer.spireIdentityExchange.image.pullPolicy }}
|
||||||
|
{{- end }}
|
||||||
{{- range $idx, $plugin := $pluginsToLoad }}
|
{{- range $idx, $plugin := $pluginsToLoad }}
|
||||||
- name: {{ printf "init-plugin-%d" $idx }}
|
- name: {{ printf "init-plugin-%d" $idx }}
|
||||||
securityContext:
|
securityContext:
|
||||||
|
|||||||
@@ -383,6 +383,23 @@ credentialComposer:
|
|||||||
uniqueID:
|
uniqueID:
|
||||||
## @param credentialComposer.uniqueID.enabled Add the x509UniqueIdentifier attribute to workload X509-SVIDs
|
## @param credentialComposer.uniqueID.enabled Add the x509UniqueIdentifier attribute to workload X509-SVIDs
|
||||||
enabled: false
|
enabled: false
|
||||||
|
spireIdentityExchange:
|
||||||
|
## @param credentialComposer.spireIdentityExchange.image.registry The OCI registry to pull the image from
|
||||||
|
## @param credentialComposer.spireIdentityExchange.image.repository The repository within the registry
|
||||||
|
## @param credentialComposer.spireIdentityExchange.image.pullPolicy The image pull policy
|
||||||
|
## @param credentialComposer.spireIdentityExchange.image.tag Overrides the image tag
|
||||||
|
##
|
||||||
|
image:
|
||||||
|
registry: ghcr.io
|
||||||
|
repository: spiffe/spire-credentialcomposer-identity-exchange
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
tag: "v0.2.0"
|
||||||
|
## @param credentialComposer.spireIdentityExchange.checksum The sha256 checksum of the plugin binary
|
||||||
|
checksum: 198bfed106794a60e565cb804cb6b360d4633e4542981abbea0c0c669ddd6036
|
||||||
|
## @param credentialComposer.spireIdentityExchange.pluginPath The filename in the container of the plugin
|
||||||
|
pluginPath: /ko-app/spire-credentialcomposer-identity-exchange
|
||||||
|
## @param credentialComposer.spireIdentityExchange.prefix The prefix to operate on
|
||||||
|
prefix: ""
|
||||||
|
|
||||||
keyManager:
|
keyManager:
|
||||||
disk:
|
disk:
|
||||||
@@ -766,29 +783,21 @@ controllerManager:
|
|||||||
type: test-keys
|
type: test-keys
|
||||||
|
|
||||||
spike-keeper:
|
spike-keeper:
|
||||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.enabled Enable this identity for controller manager
|
|
||||||
enabled: true
|
|
||||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type The type of rule this is.
|
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type The type of rule this is.
|
||||||
type: spike-keeper
|
type: spike-keeper
|
||||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate The template to use for this rule.
|
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate The template to use for this rule.
|
||||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/keeper/{{ .PodMeta.Name }}
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/keeper/{{ .PodMeta.Name }}
|
||||||
spike-nexus:
|
spike-nexus:
|
||||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.enabled Enable this identity for controller manager
|
|
||||||
enabled: true
|
|
||||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type The type of rule this is.
|
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type The type of rule this is.
|
||||||
type: spike-nexus
|
type: spike-nexus
|
||||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate The template to use for this rule.
|
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate The template to use for this rule.
|
||||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/nexus/{{ .PodMeta.Name }}
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/nexus/{{ .PodMeta.Name }}
|
||||||
spike-bootstrap:
|
spike-bootstrap:
|
||||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.enabled Enable this identity for controller manager
|
|
||||||
enabled: true
|
|
||||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.type The type of rule this is.
|
## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.type The type of rule this is.
|
||||||
type: spike-bootstrap
|
type: spike-bootstrap
|
||||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.spiffeIDTemplate The template to use for this rule.
|
## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.spiffeIDTemplate The template to use for this rule.
|
||||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/bootstrap/{{ .PodMeta.Name }}
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/bootstrap/{{ .PodMeta.Name }}
|
||||||
spike-pilot:
|
spike-pilot:
|
||||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.enabled Enable this identity for controller manager
|
|
||||||
enabled: true
|
|
||||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.type The type of rule this is.
|
## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.type The type of rule this is.
|
||||||
type: spike-pilot
|
type: spike-pilot
|
||||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.spiffeIDTemplate The template to use for this rule.
|
## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.spiffeIDTemplate The template to use for this rule.
|
||||||
@@ -805,6 +814,29 @@ controllerManager:
|
|||||||
federatesWith:
|
federatesWith:
|
||||||
- spire-ha
|
- spire-ha
|
||||||
|
|
||||||
|
spire-identity-exchange-trustbundle:
|
||||||
|
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.spiffeIDTemplate The template to use for this rule.
|
||||||
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/service/trustbundle-spire-identity-exchange
|
||||||
|
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.type The type of rule this is.
|
||||||
|
type: spire-identity-exchange
|
||||||
|
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.workloadSelectorTemplates [array] Workload selectors.
|
||||||
|
workloadSelectorTemplates:
|
||||||
|
- "k8s:container-name:spire-server-attestor"
|
||||||
|
spire-identity-exchange-service:
|
||||||
|
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.spiffeIDTemplate The template to use for this rule.
|
||||||
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/service/spire-identity-exchange
|
||||||
|
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.type The type of rule this is.
|
||||||
|
type: spire-identity-exchange
|
||||||
|
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.workloadSelectorTemplates [array] Workload selectors.
|
||||||
|
workloadSelectorTemplates:
|
||||||
|
- "k8s:container-name:spire-identity-exchange"
|
||||||
|
spire-identity-exchange-agent:
|
||||||
|
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-agent.type The type of rule this is.
|
||||||
|
type: spire-identity-exchange
|
||||||
|
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-agent.workloadSelectorTemplates [array] Workload selectors.
|
||||||
|
workloadSelectorTemplates:
|
||||||
|
- "k8s:container-name:spire-agent"
|
||||||
|
|
||||||
# You can specify additional ClusterSPIFFEIDs following this example:
|
# You can specify additional ClusterSPIFFEIDs following this example:
|
||||||
# foo:
|
# foo:
|
||||||
# labels:
|
# labels:
|
||||||
@@ -813,8 +845,14 @@ controllerManager:
|
|||||||
# namespaceSelector:
|
# namespaceSelector:
|
||||||
# matchLabels:
|
# matchLabels:
|
||||||
# foo: bar
|
# foo: bar
|
||||||
## @param controllerManager.identities.clusterStaticEntries Specify ClusterStaticEntry objects.
|
clusterStaticEntries:
|
||||||
clusterStaticEntries: {}
|
## @param controllerManager.identities.clusterStaticEntries.spire-identity-exchange [object] Settings for the spire-identity-exchnage
|
||||||
|
spire-identity-exchange: {}
|
||||||
|
#FIXME Only needed for delegated api. Can remove once spire-identity-exchange switched to the broker api.
|
||||||
|
spire-identity-exchange-agent:
|
||||||
|
## @param controllerManager.identities.clusterStaticEntries.spire-identity-exchange-agent.selectors [array] selector
|
||||||
|
selectors:
|
||||||
|
- unix:path:/ko-app/spire-identity-exchange-server
|
||||||
# foo:
|
# foo:
|
||||||
# labels:
|
# labels:
|
||||||
# foo: bar
|
# foo: bar
|
||||||
@@ -1131,8 +1169,8 @@ nodeAttestor:
|
|||||||
enabled: false
|
enabled: false
|
||||||
## @param nodeAttestor.x509POP.mode What mode to set the plugin to. Currently only spiffe mode is supported
|
## @param nodeAttestor.x509POP.mode What mode to set the plugin to. Currently only spiffe mode is supported
|
||||||
mode: spiffe
|
mode: spiffe
|
||||||
## @param nodeAttestor.x509POP.svidPrefix What prefix to use when mode is spiffe
|
## @param nodeAttestor.x509POP.spiffePrefix What prefix to use when mode is spiffe
|
||||||
svidPrefix: /spire-exchange
|
spiffePrefix: "/spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/"
|
||||||
## @param nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
|
## @param nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
|
||||||
agentPathTemplate: ""
|
agentPathTemplate: ""
|
||||||
## @param nodeAttestor.x509POP.maxIntermediates Maximum number of intermediate certificates allowed in the certificate chain
|
## @param nodeAttestor.x509POP.maxIntermediates Maximum number of intermediate certificates allowed in the certificate chain
|
||||||
@@ -1140,10 +1178,10 @@ nodeAttestor:
|
|||||||
## @param nodeAttestor.x509POP.maxRSAKeySize Maximum RSA key size in bits allowed in certificates
|
## @param nodeAttestor.x509POP.maxRSAKeySize Maximum RSA key size in bits allowed in certificates
|
||||||
maxRSAKeySize: 8192
|
maxRSAKeySize: 8192
|
||||||
addClusterName:
|
addClusterName:
|
||||||
## @param nodeAttestor.x509POP.addClusterName.svidPrefix Suffix the cluster name onto the svidPrefix
|
## @param nodeAttestor.x509POP.addClusterName.spiffePrefix Suffix the cluster name onto the svidPrefix
|
||||||
svidPrefix: false
|
spiffePrefix: true
|
||||||
## @param nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
|
## @param nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
|
||||||
agentPathTemplate: false
|
agentPathTemplate: true
|
||||||
|
|
||||||
# The secrets needed for this plugin are configured in the secrets: section
|
# The secrets needed for this plugin are configured in the secrets: section
|
||||||
bundlePublisher:
|
bundlePublisher:
|
||||||
@@ -1485,3 +1523,11 @@ kubeConfigs: {}
|
|||||||
# xxxxx
|
# xxxxx
|
||||||
# clusterb:
|
# clusterb:
|
||||||
# kubeConfigBase64: eXl5Cnl5eQo=
|
# kubeConfigBase64: eXl5Cnl5eQo=
|
||||||
|
|
||||||
|
spireIdentityExchange:
|
||||||
|
## @param spireIdentityExchange.enabled Enable the server side of the SPIRE Identity Exchange system
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
spike:
|
||||||
|
## @param spike.enabled Enable the server side of SPIKE
|
||||||
|
enabled: false
|
||||||
|
|||||||
@@ -243,3 +243,9 @@ spike-nexus:
|
|||||||
spike-pilot:
|
spike-pilot:
|
||||||
## @param spike-pilot.enabled Enables deployment of SPIKE Pilot (Not for production)
|
## @param spike-pilot.enabled Enables deployment of SPIKE Pilot (Not for production)
|
||||||
enabled: false
|
enabled: false
|
||||||
|
|
||||||
|
spire-identity-exchange:
|
||||||
|
## @param spire-identity-exchange.enabled Enables deployment of the SPIRE Identity Exchange (Not for production)
|
||||||
|
enabled: false
|
||||||
|
## @param spire-identity-exchange.nameOverride Overrides the name of the SPIRE Identity Exchnage
|
||||||
|
nameOverride: identity-exchange
|
||||||
|
|||||||
@@ -58,6 +58,7 @@ teardown() {
|
|||||||
kubectl exec -i -n spire-server spire-b-internal-server-0 -- spire-server entry show || true
|
kubectl exec -i -n spire-server spire-b-internal-server-0 -- spire-server entry show || true
|
||||||
kubectl exec -i -n spire-server spire-a-internal-server-0 -- spire-server agent list -output json | yq e . - -P || true
|
kubectl exec -i -n spire-server spire-a-internal-server-0 -- spire-server agent list -output json | yq e . - -P || true
|
||||||
kubectl exec -i -n spire-server spire-b-internal-server-0 -- spire-server agent list -output json | yq e . - -P || true
|
kubectl exec -i -n spire-server spire-b-internal-server-0 -- spire-server agent list -output json | yq e . - -P || true
|
||||||
|
kubectl get pods -A -o wide || true
|
||||||
|
|
||||||
print_helm_releases
|
print_helm_releases
|
||||||
|
|
||||||
@@ -236,10 +237,22 @@ helm upgrade --install --create-namespace --namespace spire-mgmt --values "${COM
|
|||||||
--set "global.spire.ingressControllerType=ingress-nginx" \
|
--set "global.spire.ingressControllerType=ingress-nginx" \
|
||||||
--set "spiffe-oidc-discovery-provider.ingress.enabled=true"
|
--set "spiffe-oidc-discovery-provider.ingress.enabled=true"
|
||||||
|
|
||||||
|
# Create spire-identity-exchange cert for testing.
|
||||||
|
mkdir -p certs
|
||||||
|
openssl req -x509 -newkey rsa:2048 \
|
||||||
|
-keyout certs/server.key \
|
||||||
|
-out certs/server.pem -sha256 -days 365 -nodes \
|
||||||
|
-subj "/CN=localhost" \
|
||||||
|
-addext "basicConstraints=critical,CA:TRUE" \
|
||||||
|
-addext "subjectAltName=DNS:spire-identity-exchange.production.other,DNS:spire-identity-exchange-a.production.other,DNS:spire-identity-exchange-b.production.other"
|
||||||
|
kubectl create secret tls -n spire-server spire-identity-exchange --key=certs/server.key --cert=certs/server.pem
|
||||||
|
|
||||||
# Install server side a
|
# Install server side a
|
||||||
helm upgrade --install --namespace spire-mgmt --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/spire-values.yaml" \
|
helm upgrade --install --namespace spire-mgmt --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/spire-values.yaml" \
|
||||||
--wait spire-a charts/spire-nested \
|
--wait spire-a charts/spire-nested \
|
||||||
--set tags.bottomTurtleHAA=true \
|
--set tags.bottomTurtleHAA=true \
|
||||||
|
--values "${SCRIPTPATH}/spire-identity-exchange-values.yaml" \
|
||||||
|
--set "spire-identity-exchange-bottom-turtle-ha-a.enabled=true" \
|
||||||
--set "global.spire.ingressControllerType=ingress-nginx"
|
--set "global.spire.ingressControllerType=ingress-nginx"
|
||||||
|
|
||||||
docker exec -i chart-testing-worker /bin/bash -c "more /var/lib/kubelet/pods/*/volumes/kubernetes.io~empty-dir/disk-keymanager/keys.json /var/lib/kubelet/pods/*/volumes/kubernetes.io~empty-dir/spire-agent-persistence/agent-data.json | cat"
|
docker exec -i chart-testing-worker /bin/bash -c "more /var/lib/kubelet/pods/*/volumes/kubernetes.io~empty-dir/disk-keymanager/keys.json /var/lib/kubelet/pods/*/volumes/kubernetes.io~empty-dir/spire-agent-persistence/agent-data.json | cat"
|
||||||
@@ -258,6 +271,8 @@ helm upgrade --install --namespace spire-mgmt --values "${COMMON_TEST_YOUR_VALUE
|
|||||||
--wait spire-b charts/spire-nested \
|
--wait spire-b charts/spire-nested \
|
||||||
--set tags.bottomTurtleHAB=true \
|
--set tags.bottomTurtleHAB=true \
|
||||||
--set internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.port=8082 \
|
--set internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.port=8082 \
|
||||||
|
--values "${SCRIPTPATH}/spire-identity-exchange-values.yaml" \
|
||||||
|
--set "spire-identity-exchange-bottom-turtle-ha-b.enabled=true" \
|
||||||
--set "global.spire.ingressControllerType=ingress-nginx"
|
--set "global.spire.ingressControllerType=ingress-nginx"
|
||||||
|
|
||||||
docker ps
|
docker ps
|
||||||
@@ -278,11 +293,18 @@ if [[ "${ENTRIES}" == "Found 0 entries" ]]; then
|
|||||||
fi
|
fi
|
||||||
|
|
||||||
kubectl get pods -A -o wide
|
kubectl get pods -A -o wide
|
||||||
|
kubectl get ingress -A
|
||||||
|
|
||||||
helm test --namespace spire-mgmt spire-a
|
helm test --namespace spire-mgmt spire-a
|
||||||
helm test --namespace spire-mgmt spire-b
|
helm test --namespace spire-mgmt spire-b
|
||||||
curl -k --resolve "oidc-discovery.production.other:443:$IP" "https://oidc-discovery.production.other/.well-known/openid-configuration" -s --fail
|
curl -k --resolve "oidc-discovery.production.other:443:$IP" "https://oidc-discovery.production.other/.well-known/openid-configuration" -s --fail
|
||||||
|
|
||||||
|
kubectl apply -f "${SCRIPTPATH}/test-job.yaml"
|
||||||
|
kubectl wait --for=condition=complete --timeout=60s job/test && \
|
||||||
|
TOKEN=$(kubectl logs job/test)
|
||||||
|
curl -f -H "Authorization: Bearer ${TOKEN}" -X POST --resolve "spire-identity-exchange-a-rest.production.other:443:$IP" "https://spire-identity-exchange-a-rest.production.other/api/v1/svid/k8s_psat/x509" -k -sS -q
|
||||||
|
curl -f -H "Authorization: Bearer ${TOKEN}" -X POST --resolve "spire-identity-exchange-b-rest.production.other:443:$IP" "https://spire-identity-exchange-b-rest.production.other/api/v1/svid/k8s_psat/x509" -k -sS -q
|
||||||
|
|
||||||
#Test out running only on side b since we know already only both servers work together, and that only side a works if we made it this far.
|
#Test out running only on side b since we know already only both servers work together, and that only side a works if we made it this far.
|
||||||
helm delete -n spire-mgmt spire-a
|
helm delete -n spire-mgmt spire-a
|
||||||
kubectl rollout restart daemonset -n spire-system spire-ha-agent
|
kubectl rollout restart daemonset -n spire-system spire-ha-agent
|
||||||
|
|||||||
@@ -0,0 +1,59 @@
|
|||||||
|
internal-spire-server-bottom-turtle-ha-a:
|
||||||
|
controllerManager:
|
||||||
|
identities:
|
||||||
|
clusterStaticEntries:
|
||||||
|
test:
|
||||||
|
parentID: spiffe://production.other/spire-identity-exchange
|
||||||
|
spiffeID: spiffe://production.other/k8s-psat/test
|
||||||
|
selectors:
|
||||||
|
- k8s_psat:namespace:default
|
||||||
|
- k8s_psat:service_account_name:default
|
||||||
|
spireIdentityExchange:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
internal-spire-server-bottom-turtle-ha-b:
|
||||||
|
controllerManager:
|
||||||
|
identities:
|
||||||
|
clusterStaticEntries:
|
||||||
|
test:
|
||||||
|
parentID: spiffe://production.other/spire-identity-exchange
|
||||||
|
spiffeID: spiffe://production.other/k8s-psat/test
|
||||||
|
selectors:
|
||||||
|
- k8s_psat:namespace:default
|
||||||
|
- k8s_psat:service_account_name:default
|
||||||
|
spireIdentityExchange:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
spire-identity-exchange-bottom-turtle-ha-a:
|
||||||
|
rest:
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
tls:
|
||||||
|
externalSecret:
|
||||||
|
enabled: true
|
||||||
|
secretName: spire-identity-exchange
|
||||||
|
auth:
|
||||||
|
plugins:
|
||||||
|
- plugin: k8s_psat
|
||||||
|
config:
|
||||||
|
audiences:
|
||||||
|
- spire-identity-exchange
|
||||||
|
allowedServiceAccounts:
|
||||||
|
- default/default
|
||||||
|
|
||||||
|
spire-identity-exchange-bottom-turtle-ha-b:
|
||||||
|
rest:
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
tls:
|
||||||
|
externalSecret:
|
||||||
|
enabled: true
|
||||||
|
secretName: spire-identity-exchange
|
||||||
|
auth:
|
||||||
|
plugins:
|
||||||
|
- plugin: k8s_psat
|
||||||
|
config:
|
||||||
|
audiences:
|
||||||
|
- spire-identity-exchange
|
||||||
|
allowedServiceAccounts:
|
||||||
|
- default/default
|
||||||
@@ -0,0 +1,28 @@
|
|||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
name: test
|
||||||
|
spec:
|
||||||
|
backoffLimit: 0
|
||||||
|
template:
|
||||||
|
spec:
|
||||||
|
restartPolicy: Never
|
||||||
|
hostAliases:
|
||||||
|
volumes:
|
||||||
|
- name: token-volume
|
||||||
|
projected:
|
||||||
|
sources:
|
||||||
|
- serviceAccountToken:
|
||||||
|
path: token
|
||||||
|
audience: spire-identity-exchange
|
||||||
|
expirationSeconds: 3600
|
||||||
|
containers:
|
||||||
|
- name: main
|
||||||
|
image: curlimages/curl:latest
|
||||||
|
command: ["/bin/sh", "-c"]
|
||||||
|
args:
|
||||||
|
- |
|
||||||
|
cat /var/run/secrets/tokens/token
|
||||||
|
volumeMounts:
|
||||||
|
- name: token-volume
|
||||||
|
mountPath: /var/run/secrets/tokens
|
||||||
@@ -15,12 +15,27 @@ func ValueStringRender(chart *helmchart.Chart, values string) (map[string]string
|
|||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, err
|
return nil, err
|
||||||
}
|
}
|
||||||
ro := helmutil.ReleaseOptions{Name: "spire", Namespace: "spire-server", Revision: 1, IsUpgrade: false, IsInstall: true}
|
merged, err := helmutil.CoalesceValues(chart, v)
|
||||||
v, err = helmutil.ToRenderValues(chart, v, ro, helmutil.DefaultCapabilities)
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, err
|
return nil, err
|
||||||
}
|
}
|
||||||
objs, err := helmengine.Render(chart, v)
|
testChart := *chart
|
||||||
|
testChart.Values = merged
|
||||||
|
|
||||||
|
var activeDeps []*helmchart.Chart
|
||||||
|
for _, dep := range testChart.Dependencies() {
|
||||||
|
if dep.Name() != "spire-identity-exchange" {
|
||||||
|
activeDeps = append(activeDeps, dep)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
testChart.SetDependencies(activeDeps...)
|
||||||
|
|
||||||
|
ro := helmutil.ReleaseOptions{Name: "spire", Namespace: "spire-server", Revision: 1, IsUpgrade: false, IsInstall: true}
|
||||||
|
v, err = helmutil.ToRenderValues(&testChart, merged, ro, helmutil.DefaultCapabilities)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
objs, err := helmengine.Render(&testChart, v)
|
||||||
return objs, err
|
return objs, err
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user