# spire-identity-exchange ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.3.0](https://img.shields.io/badge/AppVersion-0.3.0-informational?style=flat-square) A Helm chart to install the SPIRE Identity Exchange. **Homepage:** ## Maintainers | Name | Email | Url | | ---- | ------ | --- | | marcofranssen | | | | kfox1111 | | | | faisal-memon | | | ## Source Code * ## Parameters ### Chart parameters | Name | Description | Value | | ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- | | `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | | `csiDriverName` | The csi driver to use | `csi.spiffe.io` | | `replicaCount` | Replica count | `1` | | `namespaceOverride` | Namespace override | `""` | | `annotations` | Annotations for the deployment | `{}` | | `labels` | Labels for the deployment | `{}` | | `image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `image.repository` | The repository within the registry | `spiffe/spire-identity-exchange-server` | | `image.pullPolicy` | The image pull policy | `IfNotPresent` | | `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `spireServerAttestorSPIFFEWorkloadAPI.resources` | Resource requests and limits | `{}` | | `spireServerAttestorSPIFFEWorkloadAPI.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `spireServerAttestorSPIFFEWorkloadAPI.image.repository` | The repository within the registry | `spiffe/spire-server-attestor-spiffe-workload-api` | | `spireServerAttestorSPIFFEWorkloadAPI.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `spireServerAttestorSPIFFEWorkloadAPI.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `spireAgent.resources` | Resource requests and limits | `{}` | | `spireAgent.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `spireAgent.image.repository` | The repository within the registry | `spiffe/spire-agent` | | `spireAgent.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `spireAgent.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.15.2` | | `extraEnv` | Extra environment variables to add to the spire identity exchange | `[]` | | `resources` | Resource requests and limits | `{}` | | `configMap.annotations` | Annotations to add to the SPIRE Identity Exchange ConfigMap | `{}` | | `podSecurityContext` | Pod security context for SPIRE Identity Exchange pods | `{}` | | `securityContext` | Security context for SPIRE Identity Exchange deployment | `{}` | | `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | | `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | | `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | | `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | | `podAnnotations` | Pod annotations for SPIRE Identity Exchange | `{}` | | `podLabels` | Labels to add to pods | `{}` | | `tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` | | `tls.externalSecret.secretName` | Specify which Secret to use | `""` | | `tls.certManager.enabled` | Use certificateManager to create the certificate | `false` | | `tls.certManager.issuer.create` | Create an issuer to use to issue the certificate | `true` | | `tls.certManager.issuer.acme.email` | Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service | `""` | | `tls.certManager.issuer.acme.server` | Server to use to get certificate. Defaults to LetsEncrypt | `https://acme-v02.api.letsencrypt.org/directory` | | `tls.certManager.issuer.acme.solvers` | Configure the issuer solvers. Defaults to http01 via ingress. | `{}` | | `tls.certManager.certificate.dnsNames` | Override the dnsNames on the certificate request. Defaults to the same settings as Ingress | `[]` | | `tls.certManager.certificate.issuerRef.group` | If you are using an external plugin, specify the group for it here | `""` | | `tls.certManager.certificate.issuerRef.kind` | Kind of the issuer reference. Override if you want to use a ClusterIssuer | `Issuer` | | `tls.certManager.certificate.issuerRef.name` | Name of the issuer to use. If unset, it will use the name of the built in issuer | `""` | | `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | | `config.logFormat` | The log format, valid values are "text" and "json" | `text` | | `imagePullSecrets` | Image pull secret names | `[]` | | `nameOverride` | Name override | `""` | | `fullnameOverride` | Full name override | `""` | | `serviceAccount.create` | Specifies whether a service account should be created | `true` | | `serviceAccount.annotations` | Annotations to add to the service account | `{}` | | `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | | `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` | | `autoscaling.enabled` | Flag to enable autoscaling | `false` | | `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` | | `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` | | `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` | | `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` | | `nodeSelector` | Node selector | `{}` | | `tolerations` | iist of tolerations | `[]` | | `affinity` | Node affinity | `{}` | | `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | | `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` | | `auth.plugins` | Plugins to load | `{}` | | `auth.stacks` | Stacks to load | `{}` | | `rest.enabled` | Enable the rest service | `true` | | `rest.service.type` | Service type | `ClusterIP` | | `rest.service.port` | port for the service | `443` | | `rest.service.annotations` | Annotations for service resource | `{}` | | `rest.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` | | `rest.ingress.enabled` | Flag to enable ingress | `false` | | `rest.ingress.className` | Ingress class name | `""` | | `rest.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | | `rest.ingress.annotations` | Annotations for ingress object | `{}` | | `rest.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-identity-exchange-rest` | | `rest.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | | `rest.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | | `rest.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `grpc.enabled` | Enable the grpc service | `false` | | `grpc.service.type` | Service type | `ClusterIP` | | `grpc.service.port` | port for the service | `443` | | `grpc.service.annotations` | Annotations for service resource | `{}` | | `grpc.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` | | `grpc.ingress.enabled` | Flag to enable ingress | `false` | | `grpc.ingress.className` | Ingress class name | `""` | | `grpc.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | | `grpc.ingress.annotations` | Annotations for ingress object | `{}` | | `grpc.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The grpc of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-identity-exchange-grpc` | | `grpc.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | | `grpc.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | | `grpc.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | | `tools.kubectl.image.repository` | The repository within the registry | `kubectl` | | `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `clusterRole.create` | create a k8s cluster role to allow access to token reviews and oidc discovery | `true` | | `server.address` | Address for Spire server | `""` | | `server.port` | Port number for Spire server | `443` | | `server.namespaceOverride` | Override the namespace for Spire server | `""` | | `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |