Kevin Fox
0f57f5683a
Update the images to point to the 1.6.3 version of spire. Signed-off-by: Kevin Fox <[email protected]>
114 lines
6.8 KiB
Markdown
114 lines
6.8 KiB
Markdown
# spire-server
|
|
|
|
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
|
|
|
  
|
|
|
|
A Helm chart to install the SPIRE server.
|
|
|
|
> **Note**: Minimum Spire version is `1.5.3`.
|
|
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
|
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
|
>
|
|
> The recommended spire-controller-manager version is `0.2.2` to support arm64 nodes. If running with any
|
|
> prior version to `0.2.2` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
|
|
|
## Values
|
|
|
|
| Key | Type | Default | Description |
|
|
|-----|------|---------|-------------|
|
|
| affinity | object | `{}` | |
|
|
| autoscaling.enabled | bool | `false` | |
|
|
| autoscaling.maxReplicas | int | `100` | |
|
|
| autoscaling.minReplicas | int | `1` | |
|
|
| autoscaling.targetCPUUtilizationPercentage | int | `80` | |
|
|
| bundleConfigMap | string | `"spire-bundle"` | |
|
|
| caKeyType | string | `"rsa-2048"` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) |
|
|
| caTTL | string | `"24h"` | |
|
|
| ca_subject.common_name | string | `"example.org"` | |
|
|
| ca_subject.country | string | `"NL"` | |
|
|
| ca_subject.organization | string | `"Example"` | |
|
|
| clusterDomain | string | `"cluster.local"` | |
|
|
| clusterName | string | `"example-cluster"` | |
|
|
| controllerManager.enabled | bool | `false` | |
|
|
| controllerManager.identities.dnsNameTemplates | list | `[]` | |
|
|
| controllerManager.identities.enabled | bool | `true` | |
|
|
| controllerManager.identities.namespaceSelector | object | `{}` | |
|
|
| controllerManager.identities.podSelector | object | `{}` | |
|
|
| controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | |
|
|
| controllerManager.ignoreNamespaces[0] | string | `"kube-system"` | |
|
|
| controllerManager.ignoreNamespaces[1] | string | `"kube-public"` | |
|
|
| controllerManager.ignoreNamespaces[2] | string | `"local-path-storage"` | |
|
|
| controllerManager.image.pullPolicy | string | `"IfNotPresent"` | |
|
|
| controllerManager.image.registry | string | `"ghcr.io"` | |
|
|
| controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | |
|
|
| controllerManager.image.version | string | `"0.2.2"` | |
|
|
| controllerManager.resources | object | `{}` | |
|
|
| controllerManager.securityContext | object | `{}` | |
|
|
| controllerManager.service.annotations | object | `{}` | |
|
|
| controllerManager.service.port | int | `443` | |
|
|
| controllerManager.service.type | string | `"ClusterIP"` | |
|
|
| controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | |
|
|
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` | |
|
|
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"cgr.dev"` | |
|
|
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"chainguard/kubectl"` | |
|
|
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `"latest"` | |
|
|
| dataStorage.accessMode | string | `"ReadWriteOnce"` | |
|
|
| dataStorage.enabled | bool | `true` | |
|
|
| dataStorage.size | string | `"1Gi"` | |
|
|
| dataStorage.storageClass | string | `nil` | |
|
|
| defaultJwtSvidTTL | string | `"1h"` | |
|
|
| defaultX509SvidTTL | string | `"4h"` | |
|
|
| extraContainers | list | `[]` | |
|
|
| extraVolumeMounts | list | `[]` | |
|
|
| extraVolumes | list | `[]` | |
|
|
| federation.bundleEndpoint.address | string | `"0.0.0.0"` | |
|
|
| federation.bundleEndpoint.port | int | `8443` | |
|
|
| federation.enabled | bool | `false` | |
|
|
| fullnameOverride | string | `""` | |
|
|
| image.pullPolicy | string | `"IfNotPresent"` | |
|
|
| image.registry | string | `"ghcr.io"` | |
|
|
| image.repository | string | `"spiffe/spire-server"` | |
|
|
| image.version | string | `""` | |
|
|
| imagePullSecrets | list | `[]` | |
|
|
| initContainers | list | `[]` | |
|
|
| jwtIssuer | string | `"oidc-discovery.example.org"` | |
|
|
| logLevel | string | `"info"` | |
|
|
| nameOverride | string | `""` | |
|
|
| namespaceOverride | string | `""` | |
|
|
| nodeAttestor.k8sPsat.enabled | bool | `true` | |
|
|
| nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` | |
|
|
| nodeSelector | object | `{}` | |
|
|
| notifier.k8sbundle.namespace | string | `""` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace |
|
|
| podAnnotations | object | `{}` | |
|
|
| podSecurityContext | object | `{}` | |
|
|
| replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. |
|
|
| resources | object | `{}` | |
|
|
| securityContext | object | `{}` | |
|
|
| service.annotations | object | `{}` | |
|
|
| service.port | int | `8081` | |
|
|
| service.type | string | `"ClusterIP"` | |
|
|
| serviceAccount.annotations | object | `{}` | |
|
|
| serviceAccount.create | bool | `true` | |
|
|
| serviceAccount.name | string | `""` | |
|
|
| telemetry.prometheus.enabled | bool | `false` | |
|
|
| telemetry.prometheus.podMonitor.enabled | bool | `false` | |
|
|
| telemetry.prometheus.podMonitor.labels | object | `{}` | |
|
|
| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
|
|
| tolerations | list | `[]` | |
|
|
| topologySpreadConstraints | list | `[]` | |
|
|
| trustDomain | string | `"example.org"` | |
|
|
| upstreamAuthority.certManager.enabled | bool | `false` | |
|
|
| upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` | |
|
|
| upstreamAuthority.certManager.issuer_kind | string | `"Issuer"` | |
|
|
| upstreamAuthority.certManager.issuer_name | string | `"spire-ca"` | |
|
|
| upstreamAuthority.certManager.kube_config_file | string | `""` | |
|
|
| upstreamAuthority.certManager.namespace | string | `""` | Specify to use a namespace other then the one the chart is installed into |
|
|
| upstreamAuthority.certManager.rbac.create | bool | `true` | |
|
|
| upstreamAuthority.disk.enabled | bool | `false` | |
|
|
| upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. |
|
|
| upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info |
|
|
| upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. |
|
|
|
|
----------------------------------------------
|