# Default configuration for Spire Agent # SPDX-License-Identifier: APACHE-2.0 ## @skip global global: {} ## @section Chart parameters ## ## @param image.registry The OCI registry to pull the image from ## @param image.repository The repository within the registry ## @param image.pullPolicy The image pull policy ## @param image.tag Overrides the image tag whose default is the chart appVersion ## image: registry: ghcr.io repository: spiffe/spire-ha-agent pullPolicy: IfNotPresent tag: "" ## @param mode If the spire-ha-agent will run in delegated or broker mode mode: delegated ## @param trustDomain The trust domain to be used for the SPIFFE identifiers trustDomain: example.org ## @param singleSocket If in singleSocket mode, only one driver is used singleSocket: false ## @param sockets.single.admin.hostPath Where the admin socket is on disk when in single socket mode ## @param sockets.a.admin.hostPath Where the a admin socket is on disk ## @param sockets.b.admin.hostPath Where the b admin sockets is on disk ## @param sockets.single.broker.hostPath Where the broker socket is on disk when in single socket mode ## @param sockets.a.broker.hostPath Where the a broker socket is on disk ## @param sockets.b.broker.hostPath Where the b broker socket is on disk ## @param sockets.single.workload.hostPath Where the broker socket is on disk when in single socket mode ## @param sockets.a.workload.hostPath Where the a workload socket is on disk ## @param sockets.b.workload.hostPath Where the b workload socket is on disk sockets: single: admin: hostPath: /var/run/spire/agent/sockets/main/csi.spiffe.io/admin broker: hostPath: /var/run/spire/agent/sockets/main/csi.spiffe.io/broker workload: hostPath: /var/run/spire/agent-sockets a: admin: hostPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/admin broker: hostPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/broker workload: hostPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/public b: admin: hostPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/admin broker: hostPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/broker workload: hostPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/public ## @param vsock Use a vsockets to expose the service rather then a unix socket vsock: false ## @param port Port number to listen on port: 999 brokerAPI: ## @param brokerAPI.enabled Serve the SPIFFE Broker API to downstream consumers. Only supported when mode is broker. enabled: false socket: ## @param brokerAPI.socket.enabled Serve the broker api on a unix socket enabled: true ## @param brokerAPI.socket.mountOnHost Make the served broker socket visible on the host, so consumers running in other pods on the node can reach it. When false the socket stays in an emptyDir, reachable only from this pod. mountOnHost: true ## @param brokerAPI.socket.hostPath Where the served broker socket is made available on the host when mountOnHost is true hostPath: /run/spire/agent/sockets/csi.spiffe.io/broker tcp: ## @param brokerAPI.tcp.enabled Serve the broker api over tcp enabled: false ## @param brokerAPI.tcp.bindAddress The tcp address to bind to bindAddress: 0.0.0.0:8788 ## Brokers allowed to use the served broker api, keyed by name. At least one ## must be enabled when brokerAPI.enabled is true. Add your own alongside ## these following the same shape. brokers: spiffefs: ## @param brokerAPI.brokers.spiffefs.enabled Enable spiffefs as a broker. This feature is experimental. enabled: false ## @param brokerAPI.brokers.spiffefs.idTemplate The default id template idTemplate: spiffe://{{ .TrustDomain }}/spiffefs allowedReferenceTypes: ## @param brokerAPI.brokers.spiffefs.allowedReferenceTypes[0].typeURL The type of reference allowed ## @param brokerAPI.brokers.spiffefs.allowedReferenceTypes[0].allowOverTCP Allow access over TCP - typeURL: "type.googleapis.com/spiffe.broker.WorkloadPIDReference" allowOverTCP: false upstreamKeepalive: ## @param upstreamKeepalive.time How often to ping an upstream broker to notice a connection that died silently. 0 disables. Do not lower below 5m: a spire-agent that does not configure a keepalive enforcement policy answers more frequent pings with GOAWAY too_many_pings and drops the connection. time: 5m ## @param upstreamKeepalive.timeout How long to wait for a keepalive ping response before considering the connection dead timeout: 20s telemetry: prometheus: ## @param telemetry.prometheus.enabled Flag to enable prometheus monitoring enabled: false ## @param telemetry.prometheus.port Port for prometheus metrics port: 9988 ## @param telemetry.prometheus.host Host for prometheus metrics host: "0.0.0.0" podMonitor: ## @param telemetry.prometheus.podMonitor.enabled Enable podMonitor for prometheus enabled: false ## @param telemetry.prometheus.podMonitor.namespace Override where to install the podMonitor, if not set will use the same namespace as the spire-ha-agent namespace: "" ## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring labels: {} ## @param imagePullSecrets [array] Pull secrets for images imagePullSecrets: [] ## @param nameOverride Name override nameOverride: "" ## @param namespaceOverride Namespace override namespaceOverride: "" ## @param fullnameOverride Fullname override fullnameOverride: "" serviceAccount: ## @param serviceAccount.create Specifies whether a service account should be created create: true ## @param serviceAccount.annotations [object] Annotations to add to the service account annotations: {} ## @param serviceAccount.name The name of the service account to use. ## If not set and create is true, a name is generated using the fullname template name: "" ## @param podAnnotations [object] Annotations to add to pods podAnnotations: {} ## @param podLabels [object] Labels to add to pods podLabels: {} ## @param podSecurityContext [object] Pod security context podSecurityContext: {} # fsGroup: 2000 ## @param securityContext [object] Security context securityContext: {} # capabilities: # drop: # - ALL # readOnlyRootFilesystem: true # runAsNonRoot: true # runAsUser: 1000 ## @param resources [object] Resource requests and limits resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little # resources, such as Minikube. If you do want to specify resources, uncomment the following # lines, adjust them as necessary, and remove the curly braces after 'resources:'. # requests: # cpu: 50m # memory: 64Mi # limits: # cpu: 100m # memory: 128Mi ## @param nodeSelector [object] Node selector nodeSelector: {} ## @param tolerations [array] List of tolerations tolerations: [] ## @param affinity [object] Node affinity affinity: {} ## @param updateStrategy.type The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. ## @param updateStrategy.rollingUpdate.maxUnavailable Max unavailable pods during update. Can be a number or a percentage. updateStrategy: type: RollingUpdate rollingUpdate: maxUnavailable: 1 # When running as non root, needed to ensure the socket path has the correct permissions. # Set runAsUser to a non-zero value in podSecurityContext to run as non-root user. fsGroupFix: ## @param fsGroupFix.image.registry The OCI registry to pull the image from ## @param fsGroupFix.image.repository The repository within the registry ## @param fsGroupFix.image.pullPolicy The image pull policy ## @param fsGroupFix.image.tag Overrides the image tag whose default is the chart appVersion ## image: registry: cgr.dev repository: chainguard/bash pullPolicy: Always tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1 ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} cid2PID: ## @param cid2PID.image.registry The OCI registry to pull the image from ## @param cid2PID.image.repository The repository within the registry ## @param cid2PID.image.pullPolicy The image pull policy ## @param cid2PID.image.tag Overrides the image tag whose default is the chart appVersion ## image: registry: ghcr.io repository: kfox1111/cid2pid pullPolicy: Always tag: v0.0.3 ## @param cid2PID.busybox.image.registry The OCI registry to pull the image from ## @param cid2PID.busybox.image.repository The repository within the registry ## @param cid2PID.busybox.image.pullPolicy The image pull policy ## @param cid2PID.busybox.image.tag Overrides the image tag whose default is the chart appVersion ## busybox: image: registry: docker.io repository: library/busybox pullPolicy: IfNotPresent tag: 1.36.1-uclibc ## @param cid2PID.busybox.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} ## @param socketPath The unix socket path to the spire-agent socketPath: /run/spire/agent-sockets/spire-agent.sock socketAlternate: ## @param socketAlternate.names List of alternate names for the socket that workloads might expect to be able to access in the driver mount. names: - socket - spire-agent.sock - api.sock ## @param socketAlternate.image.registry The OCI registry to pull the image from ## @param socketAlternate.image.repository The repository within the registry ## @param socketAlternate.image.pullPolicy The image pull policy ## @param socketAlternate.image.tag Overrides the image tag whose default is the chart appVersion ## image: registry: cgr.dev repository: chainguard/bash pullPolicy: Always tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1 ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. priorityClassName: "" ## @param extraEnvVars [array] Extra environment variables to be added to the Spire Agent container extraEnvVars: [] ## @param extraVolumes [array] Extra volumes to be mounted on Spire Agent pods extraVolumes: [] ## @param extraVolumeMounts [array] Extra volume mounts for Spire Agent pods extraVolumeMounts: [] ## @param extraContainers [array] Additional containers to create with Spire Agent pods extraContainers: [] ## @param initContainers [array] Additional init containers to create with Spire Agent pods initContainers: [] ## @param hostAliases [array] Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ hostAliases: []