global:
  spire:
    clusterName: production
    trustDomain: production.other

spire-server:
  controllerManager:
    identities:
      clusterSPIFFEIDs:
        default:
          namespaceSelector:
            kubernetes.io/metadata.name: spire-server
          podSelector:
            app.kubernetes.io/component: server
            app.kubernetes.io/instance: spire
            app.kubernetes.io/name: server
          downstream: true
  nodeAttestor:
    k8sPsat:
      serviceAccountAllowList:
        - spire-system:spire-agent-upstream
  bundleConfigMap: spire-bundle-upstream
  notifier:
    k8sbundle:
      namespace: spire-system

spire-agent:
  enabled: false

spiffe-csi-driver:
  enabled: false