nameOverride: ""
fullnameOverride: ""

waitForIt:
  image:
    registry: cgr.dev
    repository: chainguard/wait-for-it
    pullPolicy: IfNotPresent
    version: latest-20221215
  resources: {}

workloadRegistrar:
  image:
    registry: gcr.io
    repository: spiffe-io/k8s-workload-registrar
    pullPolicy: IfNotPresent
    # Overrides the image tag whose default is the chart appVersion.
    version: ""

  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # requests:
    #   cpu: 50m
    #   memory: 32Mi
    # limits:
    #   cpu: 100m
    #   memory: 64Mi

  service:
    annotations: {}

server:
  replicaCount: 1
  image:
    # registry: gcr.io
    # repository: spiffe-io/spire-server
    registry: ghcr.io
    repository: spiffe/spire-server
    pullPolicy: IfNotPresent
    # Overrides the image tag whose default is the chart appVersion.
    version: ""

  nodeSelector:
    kubernetes.io/arch: amd64

  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # requests:
    #   cpu: 200m
    #   memory: 256Mi
    # limits:
    #   cpu: 200m
    #   memory: 256Mi

  dataStorage:
    enabled: true
    size: 1Gi
    accessMode: ReadWriteOnce
    storageClass: null

  service:
    type: ClusterIP
    port: 8081
    annotations: {}

  podAnnotations: {}

  podSecurityContext: {}
    # fsGroup: 2000

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  topologySpreadConstraints: []

  caSecretStorage:
    enabled: false
    path: /conf/server/
    secretName: "csi-driver-spiffe-ca"

  config:
    logLevel: info
    socketPath: /run/spire/server-sockets/spire-server.sock
    jwtIssuer: oidc-discovery.example.org

    ca_subject:
      country: NL
      organization: Example
      common_name: example.org

    upstreamAuthority:
      disk:
        enabled: false
        certFilePath: /conf/server/tls.crt
        keyFilePath: /conf/server/tls.key
        bundleFilePath: ""

agent:
  image:
    # registry: gcr.io
    # repository: spiffe-io/spire-agent
    registry: ghcr.io
    repository: spiffe/spire-agent
    pullPolicy: IfNotPresent
    # Overrides the image tag whose default is the chart appVersion.
    version: ""

  nodeSelector:
    kubernetes.io/arch: amd64

  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # requests:
    #   cpu: 50m
    #   memory: 64Mi
    # limits:
    #   cpu: 100m
    #   memory: 128Mi

  service:
    annotations: {}

  config:
    logLevel: info
    socketPath: /run/spire/agent-sockets/spire-agent.sock

csiDriver:
  image:
    registry: ghcr.io
    repository: spiffe/spiffe-csi-driver
    pullPolicy: IfNotPresent
    version: 0.2.1
  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # requests:
    #   cpu: 50m
    #   memory: 32Mi
    # limits:
    #   cpu: 100m
    #   memory: 64Mi

nodeDriverRegistrar:
  image:
    registry: registry.k8s.io
    repository: sig-storage/csi-node-driver-registrar
    pullPolicy: IfNotPresent
    version: v2.6.2
  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # requests:
    #   cpu: 50m
    #   memory: 32Mi
    # limits:
    #   cpu: 100m
    #   memory: 64Mi

oidc:
  enabled: false
  replicaCount: 1

  image:
    # registry: gcr.io
    # repository: spiffe-io/oidc-discovery-provider
    registry: ghcr.io
    repository: spiffe/oidc-discovery-provider
    pullPolicy: IfNotPresent
    version: ""

  nodeSelector:
    kubernetes.io/arch: amd64

  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # requests:
    #   cpu: 50m
    #   memory: 32Mi
    # limits:
    #   cpu: 100m
    #   memory: 64Mi

  service:
    type: NodePort
    port: 80
    annotations: {}
      # external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org

  podSecurityContext: {}
    # fsGroup: 2000

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  tolerations: []

  affinity: {}
  podAnnotations: {}

  insecureScheme:
    enabled: false

    nginx:
      image:
        registry: docker.io
        repository: nginx
        pullPolicy: IfNotPresent
        version: 1.23.2-alpine
        # chainguard image does not support the templates feature
        # https://github.com/chainguard-images/nginx/issues/43
        # registry: cgr.dev
        # repository: chainguard/nginx
        # pullPolicy: IfNotPresent
        # version: "1.23.2"
      resources: {}
        # We usually recommend not to specify default resources and to leave this as a conscious
        # choice for the user. This also increases chances charts run on environments with little
        # resources, such as Minikube. If you do want to specify resources, uncomment the following
        # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
        # requests:
        #   cpu: 50m
        #   memory: 32Mi
        # limits:
        #   cpu: 100m
        #   memory: 64Mi

  config:
    logLevel: info
    domains:
      - localhost
      - oidc-discovery.example.org

    acme:
      tosAccepted: false
      cacheDir: /run/spire
      directoryUrl: https://acme-v02.api.letsencrypt.org/directory
      emailAddress: letsencrypt@example.org

imagePullSecrets: []
  # - name: my-docker-registry
  #   username: my-docker-user
  #   password: my-docker-password
  #   registryURL: my-private.docker-registry.com

serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # Annotations to add to the service account
  annotations: {}
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: ""

# spireSettings

spire:
  clusterName: "example-cluster"
  trustDomain: "example.org"