helm-charts-hardened/charts/spire/charts/spire-agent

spire-agent

A Helm chart to install the SPIRE agent.

Homepage: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire

Maintainers

Name	Email	Url
marcofranssen	[email protected]	https://marcofranssen.nl
kfox1111	[email protected]
faisal-memon	[email protected]
edwbuck	[email protected]

Source Code

• https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire

Parameters

Chart parameters

Name	Description	Value
image.registry	The OCI registry to pull the image from	ghcr.io
image.repository	The repository within the registry	spiffe/spire-agent
image.pullPolicy	The image pull policy	IfNotPresent
image.tag	Overrides the image tag whose default is the chart appVersion	""
imagePullSecrets	Pull secrets for images	[]
nameOverride	Name override	""
namespaceOverride	Namespace override	""
fullnameOverride	Fullname override	""
serviceAccount.create	Specifies whether a service account should be created	true
serviceAccount.annotations	Annotations to add to the service account	{}
serviceAccount.name	The name of the service account to use.	""
configMap.annotations	Annotations to add to the SPIRE Agent ConfigMap	{}
podAnnotations	Annotations to add to pods	{}
podLabels	Labels to add to pods	{}
podSecurityContext	Pod security context	{}
securityContext	Security context	{}
resources	Resource requests and limits	{}
nodeSelector	Node selector	{}
tolerations	List of tolerations	[]
affinity	Node affinity	{}
authorizedDelegates	A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information.	[]
logLevel	The log level, valid values are "debug", "info", "warn", and "error"	info
clusterName	The name of the Kubernetes cluster (kubeadm init --service-dns-domain)	example-cluster
trustDomain	The trust domain to be used for the SPIFFE identifiers	example.org
trustBundleURL	If set, obtain trust bundle from url instead of Kubernetes ConfigMap	""
trustBundleFormat	If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe"	pem
trustBundleHostPath	If set, obtain trust bundle from a file on the host instead of from the ConfigMap	""
bundleConfigMap	Configmap name for Spire bundle	spire-bundle
availabilityTarget	The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h.	""
server.address	Address for Spire server	""
server.port	Port number for Spire server	443
server.namespaceOverride	Override the namespace for Spire server	""
server.nameOverride	Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align.	""
healthChecks.port	override the host port used for health checking	9982
updateStrategy.type	The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete.	RollingUpdate
updateStrategy.rollingUpdate.maxUnavailable	Max unavailable pods during update. Can be a number or a percentage.	1
livenessProbe.initialDelaySeconds	Initial delay seconds for probe	15
livenessProbe.periodSeconds	Period seconds for probe	60
readinessProbe.initialDelaySeconds	Initial delay seconds for probe	10
readinessProbe.periodSeconds	Period seconds for probe	30
fsGroupFix.image.registry	The OCI registry to pull the image from	cgr.dev
fsGroupFix.image.repository	The repository within the registry	chainguard/bash
fsGroupFix.image.pullPolicy	The image pull policy	Always
fsGroupFix.image.tag	Overrides the image tag whose default is the chart appVersion	latest@sha256:f7d0921b1b57304b847eef057cf171313ab3131cecc9778ca58dee866894ae2d
fsGroupFix.resources	Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	{}
keyManager.memory.enabled	Enable the memory based Key Manager	true
nodeAttestor.k8sPSAT.enabled	Enable PSAT k8s Node Attestor	true
nodeAttestor.httpChallenge.enabled	Enable the http challenge Node Attestor	false
nodeAttestor.httpChallenge.agentname	Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port.	default
nodeAttestor.httpChallenge.port	The port to listen on. If 0, a random value will be used.	0
nodeAttestor.httpChallenge.advertisedPort	The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting.	0
nodeAttestor.tpmDirect.enabled	Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental.	false
nodeAttestor.tpmDirect.plugin.image.registry	The OCI registry to pull the image from	docker.io
nodeAttestor.tpmDirect.plugin.image.repository	The repository within the registry	boxboat/spire-tpm-plugin-tpm-attestor-agent
nodeAttestor.tpmDirect.plugin.image.pullPolicy	The image pull policy	IfNotPresent
nodeAttestor.tpmDirect.plugin.image.tag	Overrides the image tag	v1.8.7
nodeAttestor.tpmDirect.plugin.checksum	The sha256 checksum of the plugin binary	1d7c73ccac948ee86cbd78ddde2d30128a1838b403f7bb2100d38d916a252244
nodeAttestor.tpmDirect.plugin.path	The filename in the container of the plugin	/app/tpm_attestor_agent
nodeAttestor.tpmDirect.pubHash.enabled	Display pubhash in logs	true
nodeAttestor.tpmDirect.pubHash.image.registry	The OCI registry to pull the image from	docker.io
nodeAttestor.tpmDirect.pubHash.image.repository	The repository within the registry	boxboat/spire-tpm-plugin-get-tpm-pubhash
nodeAttestor.tpmDirect.pubHash.image.pullPolicy	The image pull policy	IfNotPresent
nodeAttestor.tpmDirect.pubHash.image.tag	Overrides the image tag	v1.8.7
workloadAttestors.unix.enabled	Enables the Unix workload attestor	false
workloadAttestors.k8s.enabled	Enables the Kubernetes workload attestor	true
workloadAttestors.k8s.verification.type	What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip]	skip
workloadAttestors.k8s.verification.hostCert.basePath	Path where kubelet places its certificates	/var/lib/kubelet/pki
workloadAttestors.k8s.verification.hostCert.fileName	File name where kubelet places its certificates. If blank, it will be auto detected.	""
workloadAttestors.k8s.disableContainerSelectors	Set to true if using holdApplicationUntilProxyStarts in Istio	false
workloadAttestors.k8s.useNewContainerLocator	If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true	true
workloadAttestors.k8s.verboseContainerLocatorLogs	If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false	false
sds.enabled	Enables Envoy SDS configuration	false
sds.defaultSVIDName	The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS	default
sds.defaultBundleName	The Validation Context resource name to use for the default X.509 bundle with Envoy SDS	ROOTCA
sds.defaultAllBundlesName	The Validation Context resource name to use for all bundles (including federated) with Envoy SDS	ALL
sds.disableSPIFFECertValidation	Disable Envoy SDS custom validation	false
telemetry.prometheus.enabled	Flag to enable prometheus monitoring	false
telemetry.prometheus.port	Port for prometheus metrics	9988
telemetry.prometheus.podMonitor.enabled	Enable podMonitor for prometheus	false
telemetry.prometheus.podMonitor.namespace	Override where to install the podMonitor, if not set will use the same namespace as the spire-agent	""
telemetry.prometheus.podMonitor.labels	Pod labels to filter for prometheus monitoring	{}
kubeletConnectByHostname	If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise.	""
socketPath	The unix socket path to the spire-agent	/run/spire/agent-sockets/spire-agent.sock
socketAlternate.names	List of alternate names for the socket that workloads might expect to be able to access in the driver mount.	["socket","spire-agent.sock","api.sock"]
socketAlternate.image.registry	The OCI registry to pull the image from	cgr.dev
socketAlternate.image.repository	The repository within the registry	chainguard/bash
socketAlternate.image.pullPolicy	The image pull policy	Always
socketAlternate.image.tag	Overrides the image tag whose default is the chart appVersion	latest@sha256:f7d0921b1b57304b847eef057cf171313ab3131cecc9778ca58dee866894ae2d
socketAlternate.resources	Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	{}
hostCert.image.registry	The OCI registry to pull the image from	cgr.dev
hostCert.image.repository	The repository within the registry	chainguard/min-toolkit-debug
hostCert.image.pullPolicy	The image pull policy	IfNotPresent
hostCert.image.tag	Overrides the image tag whose default is the chart appVersion	latest@sha256:2f8ac6547029ed217bb40167bf39883b4bc606b3b747ecaf710fab9779ef786f
hostCert.resources	Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	{}
priorityClassName	Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.	""
extraEnvVars	Extra environment variables to be added to the Spire Agent container	[]
extraVolumes	Extra volumes to be mounted on Spire Agent pods	[]
extraVolumeMounts	Extra volume mounts for Spire Agent pods	[]
extraContainers	Additional containers to create with Spire Agent pods	[]
initContainers	Additional init containers to create with Spire Agent pods	[]
hostAliases	Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/	[]
customPlugins.keyManager	Custom plugins of type KeyManager are configured here	{}
customPlugins.nodeAttestor	Custom plugins of type NodeAttestor are configured here	{}
customPlugins.svidStore	Custom plugins of type SVIDStore are configured here	{}
customPlugins.workloadAttestor	Custom plugins of type WorkloadAttestor are configured here	{}
experimental.enabled	Allow configuration of experimental features	false
experimental.syncInterval	Sync interval with SPIRE server with exponential backoff	5s
experimental.featureFlags	List of developer feature flags	[]
agents	Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors	{}
tools.kubectl.image.registry	The OCI registry to pull the image from	docker.io
tools.kubectl.image.repository	The repository within the registry	rancher/kubectl
tools.kubectl.image.pullPolicy	The image pull policy	IfNotPresent
tools.kubectl.image.tag	Overrides the image tag whose default is the chart appVersion	""
sockets.hostBasePath	Path on which the agent socket is made available when admin.mountOnHost is true	/run/spire/agent/sockets
sockets.admin.enabled	Enable the admin socket. Useful for admin tasks or the Delegated Identity API.	false
sockets.admin.mountOnHost	Enable the admin socket to be visible on the host.	false
persistence.type	What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors)	emptyDir
persistence.hostPath	Which path to use on the host when persistence.type = hostPath	/var/lib/spire/k8s/agent