# Default values for spire.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

replicaCount: 1

workloadRegistrar:
  image:
    repository: gcr.io/spiffe-io/k8s-workload-registrar
    pullPolicy: IfNotPresent
    # Overrides the image tag whose default is the chart appVersion.
    tag: ""

  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # requests:
    #   cpu: 50m
    #   memory: 32Mi
    # limits:
    #   cpu: 100m
    #   memory: 64Mi

server:
  image:
    repository: gcr.io/spiffe-io/spire-server
    pullPolicy: IfNotPresent
    # Overrides the image tag whose default is the chart appVersion.
    tag: ""

  nodeSelector:
    kubernetes.io/arch: amd64

  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # requests:
    #   cpu: 200m
    #   memory: 256Mi
    # limits:
    #   cpu: 200m
    #   memory: 256Mi

  dataStorage:
    enabled: true
    size: 1Gi
    accessMode: ReadWriteOnce
    storageClass: null

  service:
    type: ClusterIP
    port: 8081

csiDriver:
  image:
    repository: ghcr.io/spiffe/spiffe-csi-driver
    pullPolicy: IfNotPresent
    tag: 0.2.0
  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # requests:
    #   cpu: 50m
    #   memory: 32Mi
    # limits:
    #   cpu: 100m
    #   memory: 64Mi

oidc:
  enabled: false

  image:
    repository: gcr.io/spiffe-io/oidc-discovery-provider
    pullPolicy: IfNotPresent
    tag: ""

  nodeSelector:
    kubernetes.io/arch: amd64

  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # requests:
    #   cpu: 50m
    #   memory: 32Mi
    # limits:
    #   cpu: 100m
    #   memory: 64Mi

  logLevel: INFO

  service:
    type: NodePort
    port: 80
    annotations: {}
      # external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org

  jwtIssuer: oidc-discovery.example.org

  domains:
    - localhost
    - spire-oidc.spire
    - spire-oidc.spire.svc.cluster.local
    - oidc-discovery.example.org

  insecureScheme:
    enabled: false

    nginx:
      repository: nginx
      pullPolicy: IfNotPresent
      tag: "alpine"

  acme:
    tosAccepted: false
    cacheDir: /run/spire
    directoryUrl: https://acme-v02.api.letsencrypt.org/directory
    emailAddress: letsencrypt@example.org

agent:
  image:
    repository: gcr.io/spiffe-io/spire-agent
    pullPolicy: IfNotPresent
    # Overrides the image tag whose default is the chart appVersion.
    tag: ""

  nodeSelector:
    kubernetes.io/arch: amd64

  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # requests:
    #   cpu: 50m
    #   memory: 64Mi
    # limits:
    #   cpu: 100m
    #   memory: 128Mi

imagePullSecrets: []
  # - name: my-docker-registry
  #   username: my-docker-user
  #   password: my-docker-password
  #   registryURL: my-private.docker-registry.com

nameOverride: ""
fullnameOverride: ""

serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # Annotations to add to the service account
  annotations: {}
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: ""

podAnnotations: {}

podSecurityContext: {}
  # fsGroup: 2000

securityContext: {}
  # capabilities:
  #   drop:
  #   - ALL
  # readOnlyRootFilesystem: true
  # runAsNonRoot: true
  # runAsUser: 1000

autoscaling:
  enabled: false
  minReplicas: 1
  maxReplicas: 100
  targetCPUUtilizationPercentage: 80
  # targetMemoryUtilizationPercentage: 80

tolerations: []

affinity: {}

# spireSettings

spire:
  clusterName: "example-cluster"
  trustDomain: "example.org"
  agent:
    logLevel: INFO
  server:
    logLevel: INFO