global:
  spire:
    clusterName: production
    trustDomain: production.other

spire-server:
  controllerManager:
    identities:
      clusterSPIFFEIDs:
        default:
          type: raw
          spiffeIDTemplate: spiffe://{{ .TrustDomain }}/k8s/{{ .ClusterName }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
          namespaceSelector:
            matchExpressions:
            - key: "kubernetes.io/metadata.name"
              operator: In
              values: [spire-server]
          podSelector:
            matchLabels:
              release: spire
              release-namespace: spire-server
              component: server
          downstream: true
        oidc-discovery-provider:
          enabled: false
        test-keys:
          enabled: false
  nodeAttestor:
    k8sPsat:
      serviceAccountAllowList:
        - spire-system:spire-agent-upstream
  bundleConfigMap: spire-bundle-upstream
  notifier:
    k8sbundle:
      namespace: spire-system

spiffe-oidc-discovery-provider:
  enabled: false

spire-agent:
  enabled: false

spiffe-csi-driver:
  enabled: false