global:
  spire:
    upstreamSpireAddress: spire-server.spire-root-server

spire-server:
  enabled: true
  upstreamAuthority:
    spire:
      enabled: true
      upstreamDriver: upstream.csi.spiffe.io
  controllerManager:
    enabled: true
    identities:
      clusterSPIFFEIDs:
        default:
          spiffeIDTemplate: spiffe://{{ .TrustDomain }}/k8s/{{ .ClusterName }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
        oidc-discovery-provider:
          autoPopulateDNSNames: false

upstream:
  enabled: true