internal-spire-server-bottom-turtle-ha-a: &server
  controllerManager:
    identities:
      clusterSPIFFEIDs:
        zot:
          spiffeIDTemplate: spiffe://{{ .TrustDomain }}/zot
          podSelector:
            matchLabels:
              app.kubernetes.io/name: zot
          dnsNameTemplates:
            - zot.{{ .TrustDomain }}
      clusterStaticEntries:
        test:
          parentID: spiffe://production.other/spire-identity-exchange
          spiffeID: spiffe://production.other/k8s-psat/test
          selectors:
            - k8s_psat:namespace:default
            - k8s_psat:service_account_name:default

        image-push:
          parentID: spiffe://production.other/spire-identity-exchange
          spiffeID: spiffe://production.other/image-push
          selectors:
            - k8s_psat:namespace:default
            - k8s_psat:service_account_name:zot-push
            - spiffe:source_path:/ns/default/sa/zot-push
            - spire_identity_exchange:stack:name:image_pull

        image-pull:
          parentID: spiffe://production.other/spire-identity-exchange
          spiffeID: spiffe://production.other/image-pull
          selectors:
            - k8s_psat:namespace:default
            - k8s_psat:service_account_name:zot-pull
            - spiffe:source_path:/kubelet
            - spire_identity_exchange:stack:name:image_pull

        image-pull-from-pod:
          parentID: spiffe://production.other/spire-identity-exchange
          spiffeID: spiffe://production.other/image-pull
          selectors:
            - k8s_psat:namespace:default
            - k8s_psat:service_account_name:zot-pull
            - spiffe:source_path:/ns/default/sa/zot-pull
            - spire_identity_exchange:stack:name:image_pull
  spireIdentityExchange:
    enabled: true

#Set the same settings on the B side
internal-spire-server-bottom-turtle-ha-b: *server

spire-identity-exchange-bottom-turtle-ha-a: &six
  tls:
    externalSecret:
      enabled: true
      secretName: spire-identity-exchange
    rest:
      enabled: true
      ingress:
        enabled: true
  auth:
    passthroughPlugins: true
    plugins:
      k8s_psat:
        config:
          allowedServiceAccounts:
            - default/default
            - default/zot-push
            - default/zot-pull
      spiffe:
        config:
          pathPatterns:
            - "^/kubelet$"
            - "^/ns/default/sa/zot-push$"
            - "^/ns/default/sa/zot-pull$"

#Set the same settings on the B side
spire-identity-exchange-bottom-turtle-ha-b: *six