global:
  telemetry:
    prometheus:
      enabled: true
  spire:
    strictMode: true
    recommendations:
      enabled: true

spire-server:
  nodeAttestor:
    k8sPsat:
      serviceAccountAllowList: ["spire-system:spire-agent"]
  notifier:
    k8sbundle:
      namespace: spire-system
  podSecurityContext:
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  securityContext:
    allowPrivilegeEscalation: false
    runAsNonRoot: true
    readOnlyRootFilesystem: true
    capabilities:
      drop: [ALL]
    seccompProfile:
      type: RuntimeDefault
  priorityClassName: system-cluster-critical

  logLevel: info

  controllerManager:
    securityContext:
      allowPrivilegeEscalation: false
      runAsNonRoot: true
      readOnlyRootFilesystem: true
      capabilities:
        drop: [ALL]
      seccompProfile:
        type: RuntimeDefault

    ignoreNamespaces:
      - kube-system
      - kube-public
      - local-path-storage

spiffe-csi-driver:
  enabled: true
  namespaceOverride: spire-system
  priorityClassName: system-node-critical


upstream-spiffe-csi-driver:
  namespaceOverride: spire-system
  priorityClassName: system-node-critical

spire-agent:
  enabled: true
  namespaceOverride: spire-system
  serviceAccount:
    name: spire-agent
  server:
    namespaceOverride: spire-server
  priorityClassName: system-node-critical
  podSecurityContext:
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
  securityContext:
    allowPrivilegeEscalation: false
    runAsNonRoot: true
    readOnlyRootFilesystem: true
    capabilities:
      drop: [ALL]
    seccompProfile:
      type: RuntimeDefault

  logLevel: info

upstream-spire-agent:
  namespaceOverride: spire-system
  priorityClassName: system-node-critical
  podSecurityContext:
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
  securityContext:
    allowPrivilegeEscalation: false
    runAsNonRoot: true
    readOnlyRootFilesystem: true
    capabilities:
      drop: [ALL]
    seccompProfile:
      type: RuntimeDefault

  logLevel: info

spiffe-oidc-discovery-provider:
  enabled: true
  config:
    additionalDomains: []
  insecureScheme:
    enabled: true
  podSecurityContext:
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  securityContext:
    allowPrivilegeEscalation: false
    runAsNonRoot: true
    readOnlyRootFilesystem: true
    capabilities:
      drop: [ALL]
    seccompProfile:
      type: RuntimeDefault

tornjak-frontend:
  podSecurityContext:
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  securityContext:
    allowPrivilegeEscalation: false
    runAsNonRoot: true
    readOnlyRootFilesystem: true 
    capabilities:
      drop: [ALL]
    seccompProfile:
      type: RuntimeDefault