global:
  openshift: true
  spire:
    namespaces:
      system:
        labels:
          security.openshift.io/scc.podSecurityLabelSync: "false"
          pod-security.kubernetes.io/enforce: privileged
          pod-security.kubernetes.io/warn: privileged
          pod-security.kubernetes.io/audit: privileged
      server:
        labels:
          security.openshift.io/scc.podSecurityLabelSync: "false"
          pod-security.kubernetes.io/enforce: privileged
          pod-security.kubernetes.io/warn: privileged
          pod-security.kubernetes.io/audit: privileged

spire-server:
  podSecurityContext:
    # These are unset so that openshift can automatically assign its own restricted uids to the pods
    runAsUser: null
    runAsGroup: null
    fsGroup: null

spire-agent:
  podSecurityContext:
    runAsUser: null
    runAsGroup: null
    fsGroup: null

upstream-spire-agent:
  podSecurityContext:
    runAsUser: null
    runAsGroup: null
    fsGroup: null

spiffe-oidc-discovery-provider:
  podSecurityContext:
    runAsUser: null
    runAsGroup: null
    fsGroup: null

tornjak-frontend:
  podSecurityContext:
    runAsUser: null
    runAsGroup: null
    fsGroup: null