kfox1111
03db6bb5fe
This patch makes it possible to install the subcharts in different namespaces as needed. Signed-off-by: Kevin Fox <[email protected]>
116 lines
3.3 KiB
YAML
116 lines
3.3 KiB
YAML
{{- $root := . }}
|
|
{{- $namespace := include "spire-server.namespace" . }}
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ include "spire-server.fullname" . }}
|
|
namespace: {{ include "spire-server.namespace" . }}
|
|
data:
|
|
server.conf: |
|
|
server {
|
|
bind_address = "0.0.0.0"
|
|
bind_port = "8081"
|
|
trust_domain = {{ .Values.trustDomain | quote }}
|
|
data_dir = "/run/spire/data"
|
|
log_level = {{ .Values.logLevel | quote }}
|
|
|
|
jwt_issuer = {{ .Values.jwtIssuer | quote }}
|
|
|
|
ca_key_type = {{ .Values.caKeyType | quote }}
|
|
ca_ttl = {{ .Values.caTTL | quote }}
|
|
|
|
default_x509_svid_ttl = {{ .Values.defaultX509SvidTTL | quote }}
|
|
default_jwt_svid_ttl = {{ .Values.defaultJwtSvidTTL | quote }}
|
|
|
|
ca_subject = {
|
|
{{- with .Values.ca_subject }}
|
|
country = [{{ .country | quote }}],
|
|
organization = [{{ .organization | quote }}],
|
|
common_name = {{ .common_name | quote }},
|
|
{{- end }}
|
|
}
|
|
}
|
|
|
|
plugins {
|
|
DataStore "sql" {
|
|
plugin_data {
|
|
database_type = "sqlite3"
|
|
connection_string = "/run/spire/data/datastore.sqlite3"
|
|
}
|
|
}
|
|
|
|
{{- with .Values.nodeAttestor.k8sPsat }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
NodeAttestor "k8s_psat" {
|
|
plugin_data {
|
|
clusters = {
|
|
{{ $root.Values.clusterName | quote }} = {
|
|
service_account_allow_list = {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
KeyManager "disk" {
|
|
plugin_data {
|
|
keys_path = "/run/spire/data/keys.json"
|
|
}
|
|
}
|
|
|
|
Notifier "k8sbundle" {
|
|
plugin_data {
|
|
namespace = {{ .Values.notifier.k8sbundle.namespace | default $namespace | quote }}
|
|
config_map = {{ .Values.bundleConfigMap | quote }}
|
|
}
|
|
}
|
|
|
|
{{- with .Values.upstreamAuthority.disk }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
UpstreamAuthority "disk" {
|
|
plugin_data {
|
|
cert_file_path = "/run/spire/upstream_ca/tls.crt"
|
|
key_file_path = "/run/spire/upstream_ca/tls.key"
|
|
{{- if ne .secret.data.bundle "" }}
|
|
bundle_file_path = "/run/spire/upstream_ca/bundle.crt"
|
|
{{- end }}
|
|
}
|
|
}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- with .Values.upstreamAuthority.certManager }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
UpstreamAuthority "cert-manager" {
|
|
plugin_data {
|
|
issuer_name = {{ .issuer_name | quote }}
|
|
issuer_kind = {{ .issuer_kind | quote }}
|
|
issuer_group = {{ .issuer_group | quote }}
|
|
namespace = {{ default $root.Release.Namespace .namespace | quote }}
|
|
{{- if ne .kube_config_file "" }}
|
|
kube_config_file = {{ .kube_config_file | quote }}
|
|
{{- end }}
|
|
}
|
|
}
|
|
{{- end }}
|
|
{{- end }}
|
|
}
|
|
|
|
health_checks {
|
|
listener_enabled = true
|
|
bind_address = "0.0.0.0"
|
|
bind_port = "8080"
|
|
live_path = "/live"
|
|
ready_path = "/ready"
|
|
}
|
|
|
|
{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
|
|
telemetry {
|
|
Prometheus {
|
|
host = "0.0.0.0"
|
|
port = 9988
|
|
}
|
|
}
|
|
{{- end }}
|