# Default configuration for Spire Agent
# SPDX-License-Identifier: APACHE-2.0

## @skip global
global: {}

## @section Chart parameters
##
## @param image.registry The OCI registry to pull the image from
## @param image.repository The repository within the registry
## @param image.pullPolicy The image pull policy
## @param image.version This value is deprecated in favor of tag. (Will be removed in a future release)
## @param image.tag Overrides the image tag whose default is the chart appVersion
##
image:
  registry: ghcr.io
  repository: spiffe/spire-agent
  pullPolicy: IfNotPresent
  version: ""
  tag: ""

## @param imagePullSecrets [array] Pull secrets for images
imagePullSecrets: []

## @param nameOverride Name override
nameOverride: ""

## @param namespaceOverride Namespace override
namespaceOverride: ""

## @param fullnameOverride Fullname override
fullnameOverride: ""

serviceAccount:
  ## @param serviceAccount.create Specifies whether a service account should be created
  create: true
  ## @param serviceAccount.annotations [object] Annotations to add to the service account
  annotations: {}
  ## @param serviceAccount.name The name of the service account to use.
  ## If not set and create is true, a name is generated using the fullname template
  name: ""

configMap:
  ## @param configMap.annotations [object] Annotations to add to the SPIRE Agent ConfigMap
  annotations: {}

## @param podAnnotations [object] Annotations to add to pods
podAnnotations: {}

## @param podSecurityContext [object] Pod security context
podSecurityContext: {}
  # fsGroup: 2000

## @param securityContext [object] Security context
securityContext: {}
  # capabilities:
  #   drop:
  #   - ALL
  # readOnlyRootFilesystem: true
  # runAsNonRoot: true
  # runAsUser: 1000

## @param resources [object] Resource requests and limits
resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # requests:
  #   cpu: 50m
  #   memory: 64Mi
  # limits:
  #   cpu: 100m
  #   memory: 128Mi

## @param nodeSelector [object] Node selector
nodeSelector: {}

## @param tolerations [array] List of tolerations
tolerations: []

## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
logLevel: info
## @param clusterName The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)
clusterName: example-cluster
## @param trustDomain The trust domain to be used for the SPIFFE identifiers
trustDomain: example.org
## @param trustBundleURL If set, obtain trust bundle from url instead of Kubernetes ConfigMap
trustBundleURL: ""
## @param trustBundleFormat If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe"
trustBundleFormat: pem
## @param bundleConfigMap Configmap name for Spire bundle
bundleConfigMap: spire-bundle

## @skip upstream
upstream: false

## @param server.address Address for Spire server
## @param server.port Port number for Spire server
## @param server.namespaceOverride Override the namespace for Spire server
##
server:
  address: ""
  port: 8081
  namespaceOverride: ""

healthChecks:
  ## @param healthChecks.port override the host port used for health checking
  port: 9982

## @param livenessProbe.initialDelaySeconds Initial delay seconds for probe
## @param livenessProbe.periodSeconds Period seconds for probe
##
livenessProbe:
  initialDelaySeconds: 15
  periodSeconds: 60

## @param readinessProbe.initialDelaySeconds Initial delay seconds for probe
## @param readinessProbe.periodSeconds Period seconds for probe
##
readinessProbe:
  initialDelaySeconds: 15
  periodSeconds: 60

waitForIt:
  ## @param waitForIt.image.registry The OCI registry to pull the image from
  ## @param waitForIt.image.repository The repository within the registry
  ## @param waitForIt.image.pullPolicy The image pull policy
  ## @param waitForIt.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
  ## @param waitForIt.image.tag Overrides the image tag whose default is the chart appVersion
  ##
  image:
    registry: cgr.dev
    repository: chainguard/wait-for-it
    pullPolicy: IfNotPresent
    version: ""
    tag: latest@sha256:69b2e2d1534cbceddc0d172bf414cd41b9ad341535bc2fc4cd73c96b1a345900

  ## @param waitForIt.resources [object] Resource requests and limits
  resources: {}

# When running as non root, needed to ensure the socket path has the correct permissions.
# Set runAsUser to a non-zero value in podSecurityContext to run as non-root user.
fsGroupFix:
  ## @param fsGroupFix.image.registry The OCI registry to pull the image from
  ## @param fsGroupFix.image.repository The repository within the registry
  ## @param fsGroupFix.image.pullPolicy The image pull policy
  ## @param fsGroupFix.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
  ## @param fsGroupFix.image.tag Overrides the image tag whose default is the chart appVersion
  ##
  image:
    registry: cgr.dev
    repository: chainguard/bash
    pullPolicy: Always
    version: ""
    tag: latest@sha256:0b3904b9ac440671549e2391d4148e129e581fb16d9d98ae2cbf2b135dda82c8

  ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
  resources: {}

# workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
workloadAttestors:
  # unix is a workload attestor which generates unix-based selectors like 'uid' and 'gid'.
  unix:
    ## @param workloadAttestors.unix.enabled Enables the Unix workload attestor
    enabled: false
  k8s:
    ## @param workloadAttestors.k8s.enabled Enables the Kubernetes workload attestor
    enabled: true
    ## @param workloadAttestors.k8s.skipKubeletVerification If true, kubelet certificate verification is skipped
    skipKubeletVerification: true
    ## @param workloadAttestors.k8s.disableContainerSelectors Set to true if using holdApplicationUntilProxyStarts in Istio
    disableContainerSelectors: false

sds:
  ## @param sds.enabled Enables Envoy SDS configuration
  enabled: false
  ## @param sds.defaultSvidName The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS
  defaultSvidName: "default"
  ## @param sds.defaultBundleName The Validation Context resource name to use for the default X.509 bundle with Envoy SDS
  defaultBundleName: "ROOTCA"
  ## @param sds.defaultAllBundlesName The Validation Context resource name to use for all bundles (including federated) with Envoy SDS
  defaultAllBundlesName: "ALL"
  ## @param sds.disableSpiffeCertValidation Disable Envoy SDS custom validation
  disableSpiffeCertValidation: false

telemetry:
  prometheus:
    ## @param telemetry.prometheus.enabled Flag to enable prometheus monitoring
    enabled: false
    ## @param telemetry.prometheus.port Port for prometheus metrics
    port: 9988
    podMonitor:
      ## @param telemetry.prometheus.podMonitor.enabled Enable podMonitor for prometheus
      enabled: false
      ## @param telemetry.prometheus.podMonitor.namespace Override where to install the podMonitor, if not set will use the same namespace as the spire-agent
      namespace: ""
      ## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring
      labels: {}

## @param kubeletConnectByHostname If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise.
kubeletConnectByHostname: ""

## @param socketPath The unix socket path to the spire-agent
socketPath: /run/spire/agent-sockets/spire-agent.sock

## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.
priorityClassName: ""

## @param extraEnvVars [array] Extra environment variables to be added to the Spire Agent container
extraEnvVars: []

## @param extraVolumes [array] Extra volumes to be mounted on Spire Agent pods
extraVolumes: []

## @param extraVolumeMounts [array] Extra volume mounts for Spire Agent pods
extraVolumeMounts: []

## @param extraContainers [array] Additional containers to create with Spire Agent pods
extraContainers: []

## @param initContainers [array] Additional init containers to create with Spire Agent pods
initContainers: []
## @param hostAliases [array] Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/
hostAliases: []

# NOTE: This is unsupported and only to configure currently supported spire built in plugins but plugins unsupported by the chart.
# Upgrades wont be tested for anything under this config. If you need this, please let the chart developers know your needs so we
# can prioritize proper support.
## @skip unsupportedBuiltInPlugins
unsupportedBuiltInPlugins:
  keyManager: {}
  nodeAttestor: {}
  svidStore: {}
  workloadAttestor: {}

## @param customPlugins.keyManager Custom plugins of type KeyManager are configured here
## @param customPlugins.nodeAttestor Custom plugins of type NodeAttestor are configured here
## @param customPlugins.svidStore Custom plugins of type SVIDStore are configured here
## @param customPlugins.workloadAttestor Custom plugins of type WorkloadAttestor are configured here
customPlugins:
  keyManager: {}
  nodeAttestor: {}
  svidStore: {}
  workloadAttestor: {}

experimental:
  ## @param experimental.enabled Allow configuration of experimental features
  enabled: false
  ## @param experimental.syncInterval Sync interval with SPIRE server with exponential backoff
  syncInterval: 5s
  ## @param experimental.featureFlags [array] List of developer feature flags
  featureFlags: []