spire-agent:
  nodeAttestor:
    k8sPSAT:
      enabled: false
    tpmDirect:
      enabled: true

spire-server:
  controllerManager:
    # K8s labels have a 63 character limit. TPM hashes are 64 chars. So you need to label the node with two labels with half of the tpm's hash each. The 'node-restriction.kubernetes.io/' prefix is so that the
    # nodes can't update the hash themselves, an important security constraint.
    parentIDTemplate: 'spiffe://{{ .TrustDomain }}/spire/agent/tpm/{{ index .NodeMeta.Labels "node-restriction.kubernetes.io/tpm-pubhash" }}{{ index .NodeMeta.Labels "node-restriction.kubernetes.io/tpm-pubhash2" }}'
  nodeAttestor:
    tpmDirect:
      enabled: true