helm-charts-hardened/charts/spire/charts/spire-agent/values.yaml

# Default configuration for Spire Agent
# SPDX-License-Identifier: APACHE-2.0

## @skip global
global: {}

## @section Chart parameters
##
## @param image.registry The OCI registry to pull the image from
## @param image.repository The repository within the registry
## @param image.pullPolicy The image pull policy
## @param image.tag Overrides the image tag whose default is the chart appVersion
##
image:
  registry: ghcr.io
  repository: spiffe/spire-agent
  pullPolicy: IfNotPresent
  tag: ""

## @param imagePullSecrets [array] Pull secrets for images
imagePullSecrets: []

## @param nameOverride Name override
nameOverride: ""

## @param namespaceOverride Namespace override
namespaceOverride: ""

## @param fullnameOverride Fullname override
fullnameOverride: ""

serviceAccount:
  ## @param serviceAccount.create Specifies whether a service account should be created
  create: true
  ## @param serviceAccount.annotations [object] Annotations to add to the service account
  annotations: {}
  ## @param serviceAccount.name The name of the service account to use.
  ## If not set and create is true, a name is generated using the fullname template
  name: ""

configMap:
  ## @param configMap.annotations [object] Annotations to add to the SPIRE Agent ConfigMap
  annotations: {}

## @param podAnnotations [object] Annotations to add to pods
podAnnotations: {}

## @param podLabels [object] Labels to add to pods
podLabels: {}

## @param podSecurityContext [object] Pod security context
podSecurityContext: {}
  # fsGroup: 2000

## @param securityContext [object] Security context
securityContext: {}
  # capabilities:
  #   drop:
  #   - ALL
  # readOnlyRootFilesystem: true
  # runAsNonRoot: true
  # runAsUser: 1000

## @param resources [object] Resource requests and limits
resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # requests:
  #   cpu: 50m
  #   memory: 64Mi
  # limits:
  #   cpu: 100m
  #   memory: 128Mi

## @param nodeSelector [object] Node selector
nodeSelector: {}

## @param tolerations [array] List of tolerations
tolerations: []

## @param affinity [object] Node affinity
affinity: {}

## @param authorizedDelegates A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information.
authorizedDelegates: []
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
logLevel: info
## @param logFormat The log format, valid values are "text" and "json"
logFormat: text
## @param clusterName The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)
clusterName: example-cluster
## @param trustDomain The trust domain to be used for the SPIFFE identifiers
trustDomain: example.org
## @param trustBundleURL If set, obtain trust bundle from url instead of Kubernetes ConfigMap
trustBundleURL: ""
## @param trustBundleFormat If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe"
trustBundleFormat: spiffe
## @param trustBundleHostPath If set, obtain trust bundle from a file on the host instead of from the ConfigMap
trustBundleHostPath: ""
## @param bundleConfigMap Configmap name for Spire bundle
bundleConfigMap: spire-bundle
## @param availabilityTarget The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h.
availabilityTarget: ""
## @param rebootstrapMode How the agent will behave when seeing an unknown x509 cert from the server. It can be set to never, auto, or always
rebootstrapMode: always
## @param rebootstrapDelay The agent will rebootstrap after configured amount of time on unknown x509 cert from the server
rebootstrapDelay: 10m

## @skip upstream
upstream: false

## @param server.address Address for Spire server
## @param server.port Port number for Spire server
## @param server.namespaceOverride Override the namespace for Spire server
## @param server.nameOverride Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align.
##
server:
  address: ""
  port: 443
  namespaceOverride: ""
  nameOverride: ""

healthChecks:
  ## @param healthChecks.port override the host port used for health checking
  port: 9982

## @param updateStrategy.type The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete.
## @param updateStrategy.rollingUpdate.maxUnavailable Max unavailable pods during update. Can be a number or a percentage.
updateStrategy:
  type: RollingUpdate
  rollingUpdate:
    maxUnavailable: 1

## @param livenessProbe.initialDelaySeconds Initial delay seconds for probe
## @param livenessProbe.periodSeconds Period seconds for probe
##
livenessProbe:
  initialDelaySeconds: 15
  periodSeconds: 60

## @param readinessProbe.initialDelaySeconds Initial delay seconds for probe
## @param readinessProbe.periodSeconds Period seconds for probe
##
readinessProbe:
  initialDelaySeconds: 10
  periodSeconds: 30

# When running as non root, needed to ensure the socket path has the correct permissions.
# Set runAsUser to a non-zero value in podSecurityContext to run as non-root user.
fsGroupFix:
  ## @param fsGroupFix.image.registry The OCI registry to pull the image from
  ## @param fsGroupFix.image.repository The repository within the registry
  ## @param fsGroupFix.image.pullPolicy The image pull policy
  ## @param fsGroupFix.image.tag Overrides the image tag whose default is the chart appVersion
  ##
  image:
    registry: cgr.dev
    repository: chainguard/bash
    pullPolicy: IfNotPresent
    tag: latest@sha256:e86de1df7a1fd81185ec64e0c154626ed87537ac390271a3a10f0a54cea9a7b0

  ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
  resources: {}

keyManager:
  memory:
    ## @param keyManager.memory.enabled Enable the memory based Key Manager
    enabled: true
  disk:
    ## @param keyManager.disk.enabled Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled)
    enabled: false

nodeAttestor:
  k8sPSAT:
    ## @param nodeAttestor.k8sPSAT.enabled Enable PSAT k8s Node Attestor
    enabled: true
  httpChallenge:
    ## @param nodeAttestor.httpChallenge.enabled Enable the http challenge Node Attestor
    enabled: false
    ## @param nodeAttestor.httpChallenge.agentname Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port.
    agentname: default
    ## @param nodeAttestor.httpChallenge.port The port to listen on. If 0, a random value will be used.
    port: 0
    ## @param nodeAttestor.httpChallenge.advertisedPort The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting.
    advertisedPort: 0
  tpmDirect:
    ## @param nodeAttestor.tpmDirect.enabled Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental.
    enabled: false
    plugin:
      ## @param nodeAttestor.tpmDirect.plugin.image.registry The OCI registry to pull the image from
      ## @param nodeAttestor.tpmDirect.plugin.image.repository The repository within the registry
      ## @param nodeAttestor.tpmDirect.plugin.image.pullPolicy The image pull policy
      ## @param nodeAttestor.tpmDirect.plugin.image.tag Overrides the image tag
      ##
      image:
        registry: ghcr.io
        repository: spiffe/spire-tpm-plugin-tpm-attestor-agent
        pullPolicy: IfNotPresent
        tag: "v1.9.0"
      ## @param nodeAttestor.tpmDirect.plugin.checksum The sha256 checksum of the plugin binary
      checksum: 22f67063f1699330e70cdedc9b923e517688f5ae71085a26bd9b83b3060ee86e
      ## @param nodeAttestor.tpmDirect.plugin.path The filename in the container of the plugin
      path: /app/tpm_attestor_agent
    pubHash:
      ## @param nodeAttestor.tpmDirect.pubHash.enabled Display pubhash in logs
      enabled: true
      ## @param nodeAttestor.tpmDirect.pubHash.image.registry The OCI registry to pull the image from
      ## @param nodeAttestor.tpmDirect.pubHash.image.repository The repository within the registry
      ## @param nodeAttestor.tpmDirect.pubHash.image.pullPolicy The image pull policy
      ## @param nodeAttestor.tpmDirect.pubHash.image.tag Overrides the image tag
      ##
      image:
        registry: ghcr.io
        repository: spiffe/spire-tpm-plugin-get-tpm-pubhash
        pullPolicy: IfNotPresent
        tag: "v1.9.0"
  awsIID:
    ## @param nodeAttestor.awsIID.enabled Enable the aws_iid Node Attestor
    enabled: false

# workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
workloadAttestors:
  # unix is a workload attestor which generates unix-based selectors like 'uid' and 'gid'.
  unix:
    ## @param workloadAttestors.unix.enabled Enables the Unix workload attestor
    enabled: false
  k8s:
    ## @param workloadAttestors.k8s.enabled Enables the Kubernetes workload attestor
    enabled: true
    verification:
      ## @param workloadAttestors.k8s.verification.type What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip]
      type: skip
      hostCert:
        ## @param workloadAttestors.k8s.verification.hostCert.basePath Path where kubelet places its certificates
        basePath: /var/lib/kubelet/pki
        ## @param workloadAttestors.k8s.verification.hostCert.fileName File name where kubelet places its certificates. If blank, it will be auto detected.
        fileName: ""
    ## @param workloadAttestors.k8s.disableContainerSelectors Set to true if using holdApplicationUntilProxyStarts in Istio
    disableContainerSelectors: false
    ## @param workloadAttestors.k8s.useNewContainerLocator If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true
    useNewContainerLocator: true
    ## @param workloadAttestors.k8s.verboseContainerLocatorLogs If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false
    verboseContainerLocatorLogs: false

sds:
  ## @param sds.enabled Enables Envoy SDS configuration
  enabled: false
  ## @param sds.defaultSVIDName The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS
  defaultSVIDName: "default"
  ## @param sds.defaultBundleName The Validation Context resource name to use for the default X.509 bundle with Envoy SDS
  defaultBundleName: "ROOTCA"
  ## @param sds.defaultAllBundlesName The Validation Context resource name to use for all bundles (including federated) with Envoy SDS
  defaultAllBundlesName: "ALL"
  ## @param sds.disableSPIFFECertValidation Disable Envoy SDS custom validation
  disableSPIFFECertValidation: false

telemetry:
  prometheus:
    ## @param telemetry.prometheus.enabled Flag to enable prometheus monitoring
    enabled: false
    ## @param telemetry.prometheus.port Port for prometheus metrics
    port: 9988
    podMonitor:
      ## @param telemetry.prometheus.podMonitor.enabled Enable podMonitor for prometheus
      enabled: false
      ## @param telemetry.prometheus.podMonitor.namespace Override where to install the podMonitor, if not set will use the same namespace as the spire-agent
      namespace: ""
      ## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring
      labels: {}
  datadog:
    ## @param telemetry.datadog.enabled Flag to enable datadog monitoring
    enabled: false
    ## @param telemetry.datadog.address The address of the datadog service to send metrics to. The default URL for services are `<service-name>.<namespace>.svc`
    address: "datadog.kube-system.svc"
    ## @param telemetry.datadog.port The port of the datadog service to send metrics to
    port: 8125

## @param kubeletConnectByHostname If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise.
kubeletConnectByHostname: ""

## @param socketPath The unix socket path to the spire-agent
socketPath: /run/spire/agent-sockets/spire-agent.sock

socketAlternate:
  ## @param socketAlternate.names List of alternate names for the socket that workloads might expect to be able to access in the driver mount.
  names:
    - socket
    - spire-agent.sock
    - api.sock

  ## @param socketAlternate.image.registry The OCI registry to pull the image from
  ## @param socketAlternate.image.repository The repository within the registry
  ## @param socketAlternate.image.pullPolicy The image pull policy
  ## @param socketAlternate.image.tag Overrides the image tag whose default is the chart appVersion
  ##
  image:
    registry: cgr.dev
    repository: chainguard/bash
    pullPolicy: IfNotPresent
    tag: latest@sha256:e86de1df7a1fd81185ec64e0c154626ed87537ac390271a3a10f0a54cea9a7b0

  ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
  resources: {}

hostCert:
  ## @param hostCert.image.registry The OCI registry to pull the image from
  ## @param hostCert.image.repository The repository within the registry
  ## @param hostCert.image.pullPolicy The image pull policy
  ## @param hostCert.image.tag Overrides the image tag whose default is the chart appVersion
  ##
  image:
    registry: cgr.dev
    repository: chainguard/min-toolkit-debug
    pullPolicy: IfNotPresent
    tag: latest@sha256:d9128194d12271533653ef6b7dc47115bbf3bf85acdaa7b08fda5e714cf30b2b

  ## @param hostCert.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
  resources: {}

## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.
priorityClassName: ""

## @param extraEnvVars [array] Extra environment variables to be added to the Spire Agent container
extraEnvVars: []

## @param extraVolumes [array] Extra volumes to be mounted on Spire Agent pods
extraVolumes: []

## @param extraVolumeMounts [array] Extra volume mounts for Spire Agent pods
extraVolumeMounts: []

## @param extraContainers [array] Additional containers to create with Spire Agent pods
extraContainers: []

## @param initContainers [array] Additional init containers to create with Spire Agent pods
initContainers: []
## @param hostAliases [array] Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/
hostAliases: []

# NOTE: This is unsupported and only to configure currently supported spire built in plugins but plugins unsupported by the chart.
# Upgrades wont be tested for anything under this config. If you need this, please let the chart developers know your needs so we
# can prioritize proper support.
## @skip unsupportedBuiltInPlugins
unsupportedBuiltInPlugins:
  keyManager: {}
  nodeAttestor: {}
  svidStore: {}
  workloadAttestor: {}

## @param customPlugins.keyManager Custom plugins of type KeyManager are configured here
## @param customPlugins.nodeAttestor Custom plugins of type NodeAttestor are configured here
## @param customPlugins.svidStore Custom plugins of type SVIDStore are configured here
## @param customPlugins.workloadAttestor Custom plugins of type WorkloadAttestor are configured here
customPlugins:
  keyManager: {}
  nodeAttestor: {}
  svidStore: {}
  workloadAttestor: {}

experimental:
  ## @param experimental.enabled Allow configuration of experimental features
  enabled: false
  ## @param experimental.syncInterval Sync interval with SPIRE server with exponential backoff
  syncInterval: 5s
  ## @param experimental.featureFlags [array] List of developer feature flags
  featureFlags: []

## @param agents Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors
agents: {}
#  default:
#   nodeSelector:
#     tpm: without
#  tpm:
#    nodeSelector:
#      tpm: with
#    nodeAttestor:
#      k8sPSAT:
#        enabled: false
#      tpmDirect:
#        enabled: true

tools:
  kubectl:
    ## @param tools.kubectl.image.registry The OCI registry to pull the image from
    ## @param tools.kubectl.image.repository The repository within the registry
    ## @param tools.kubectl.image.pullPolicy The image pull policy
    ## @param tools.kubectl.image.tag Overrides the image tag whose default is the chart appVersion
    ##
    image:
      registry: registry.k8s.io
      repository: kubectl
      pullPolicy: IfNotPresent
      tag: ""

sockets:
  ## @param sockets.hostBasePath Path on which the agent socket is made available when admin.mountOnHost is true
  hostBasePath: /run/spire/agent/sockets
  ## @param sockets.admin.enabled Enable the admin socket. Useful for admin tasks or the Delegated Identity API.
  ## @param sockets.admin.mountOnHost Enable the admin socket to be visible on the host.
  admin:
    enabled: false
    mountOnHost: false

## @param persistence.type What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors)
## @param persistence.hostPath Which path to use on the host when persistence.type = hostPath
##
persistence:
  type: emptyDir
  hostPath: /var/lib/spire/k8s/agent