449 lines
19 KiB
YAML
449 lines
19 KiB
YAML
{{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}}
|
|
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
|
|
{{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}}
|
|
{{- include "spire-lib.check-strict-mode" (list . "caSubject.country must be set" (eq (include "spire-server.ca-subject-country" .) "ARPA"))}}
|
|
{{- include "spire-lib.check-strict-mode" (list . "caSubject.organization must be set" (eq (include "spire-server.ca-subject-organization" .) "Example"))}}
|
|
{{- include "spire-lib.check-strict-mode" (list . "caSubject.commonNname must be set" (eq (include "spire-server.ca-subject-common-name" .) "example.org"))}}
|
|
{{- range $type, $tvals := .Values.customPlugins }}
|
|
{{- if not (has $type (list "bundlePublisher" "credentialComposer" "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }}
|
|
{{- fail (printf "Unknown plugin type specified: %s" $type) }}
|
|
{{- end }}
|
|
{{- range $name, $nval := $tvals }}
|
|
{{- if not (hasKey $nval "plugin_cmd") }}
|
|
{{- fail (printf "plugin_cmd is a required field. %s" $name) }}
|
|
{{- end }}
|
|
{{- if not (hasKey $nval "plugin_checksum") }}
|
|
{{- fail (printf "plugin_checksum is a required field.") }}
|
|
{{- end }}
|
|
{{- range $sname, $svals := $nval }}
|
|
{{- if not (has $sname (list "plugin_cmd" "plugin_checksum" "plugin_data")) }}
|
|
{{- fail (printf "Unknown plugin setting specified: %s" $sname) }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- $tlsFederationCount := 0 }}
|
|
{{- if .Values.federation.tls.spire.enabled }}
|
|
{{- $tlsFederationCount = add $tlsFederationCount 1 }}
|
|
{{- end }}
|
|
{{- if .Values.federation.tls.externalSecret.enabled }}
|
|
{{- $tlsFederationCount = add $tlsFederationCount 1 }}
|
|
{{- end }}
|
|
{{- if .Values.federation.tls.certManager.enabled }}
|
|
{{- $tlsFederationCount = add $tlsFederationCount 1 }}
|
|
{{- end }}
|
|
{{- if ne $tlsFederationCount 1 }}
|
|
{{- fail "You must enable one and only one federation TLS configuration" }}
|
|
{{- end }}
|
|
{{- if and (eq (.Values.keyManager.awsKMS.keyIdentifierFile.enabled | toString) "true") (eq (.Values.keyManager.awsKMS.keyIdentifierValue.enabled | toString ) "true") }}
|
|
{{- fail "You can only enable one of keyIdentifierFile or keyIdentifierValue at a time" }}
|
|
{{- end }}
|
|
{{- define "spire-server.yaml-config" -}}
|
|
{{- $upstreamAuthorityUsed := 0 }}
|
|
{{- $keyManagerUsed := 0 }}
|
|
{{- $root := . }}
|
|
server:
|
|
{{- with .Values.adminIDs }}
|
|
admin_ids:
|
|
{{- toYaml . | nindent 4}}
|
|
{{- end }}
|
|
bind_address: "0.0.0.0"
|
|
bind_port: "8081"
|
|
trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
|
|
data_dir: "/run/spire/data"
|
|
log_level: {{ .Values.logLevel | quote }}
|
|
jwt_issuer: {{ include "spire-lib.jwt-issuer" . | quote }}
|
|
audit_log_enabled: {{ .Values.auditLogEnabled }}
|
|
|
|
ca_key_type: {{ .Values.caKeyType | quote }}
|
|
ca_ttl: {{ .Values.caTTL | quote }}
|
|
|
|
default_x509_svid_ttl: {{ .Values.defaultX509SvidTTL | quote }}
|
|
default_jwt_svid_ttl: {{ .Values.defaultJwtSvidTTL | quote }}
|
|
|
|
ca_subject:
|
|
- country: [{{ include "spire-server.ca-subject-country" . | quote }}]
|
|
organization: [{{ include "spire-server.ca-subject-organization" . | quote }}]
|
|
common_name: {{ include "spire-server.ca-subject-common-name" . | quote }}
|
|
|
|
{{- if eq (.Values.federation.enabled | toString) "true" }}
|
|
federation:
|
|
bundle_endpoint:
|
|
address: {{ .Values.federation.bundleEndpoint.address | quote }}
|
|
port: {{ .Values.federation.bundleEndpoint.port }}
|
|
refresh_hint: {{ .Values.federation.bundleEndpoint.refreshHint | quote }}
|
|
profile:
|
|
{{- if .Values.federation.tls.spire.enabled }}
|
|
- https_spiffe: {}
|
|
{{ else }}
|
|
- https_web:
|
|
serving_cert_file:
|
|
file_sync_interval: {{ .Values.federation.bundleEndpoint.profile.httpWeb.fileSyncInterval }}
|
|
{{- if or .Values.federation.tls.certManager.enabled .Values.federation.tls.externalSecret.enabled }}
|
|
cert_file_path: /bundle-endpoint-tls/tls.crt
|
|
key_file_path: /bundle-endpoint-tls/tls.key
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- with .Values.experimental }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
experimental:
|
|
cache_reload_interval: {{ .cacheReloadInterval | quote }}
|
|
events_based_cache: {{ .eventsBasedCache }}
|
|
prune_events_older_than: {{ .pruneEventsOlderThan | quote }}
|
|
{{- if gt (len .featureFlags) 0 }}
|
|
feature_flags:
|
|
{{- range .featureFlags }}
|
|
- {{ . | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
plugins:
|
|
{{- if .Values.credentialComposer.uniqueID.enabled }}
|
|
CredentialComposer:
|
|
uniqueid: {}
|
|
{{- end }}
|
|
|
|
DataStore:
|
|
sql:
|
|
plugin_data:
|
|
{{ include "spire-server.datastore-config" . | nindent 8 }}
|
|
{{- if ne .Values.dataStore.sql.rootCAPath "" }}
|
|
root_ca_path: {{ .Values.dataStore.sql.rootCAPath }}
|
|
{{- end }}
|
|
{{- if ne .Values.dataStore.sql.clientCertPath "" }}
|
|
client_cert_path: {{ .Values.dataStore.sql.clientCertPath }}
|
|
{{- end }}
|
|
{{- if ne .Values.dataStore.sql.clientKeyPath "" }}
|
|
client_key_path : {{ .Values.dataStore.sql.clientKeyPath }}
|
|
{{- end }}
|
|
max_open_conns: {{ .Values.dataStore.sql.maxOpenConns }}
|
|
max_idle_conns: {{ .Values.dataStore.sql.maxIdleConns }}
|
|
{{- if ne (int .Values.dataStore.sql.connMaxLifetime) 0 }}
|
|
conn_max_lifetime: {{ .Values.dataStore.sql.connMaxLifetime }}
|
|
{{- end }}
|
|
disable_migration: {{ .Values.dataStore.sql.disableMigration }}
|
|
|
|
{{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }}
|
|
NodeAttestor:
|
|
{{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPSAT.clusters }}
|
|
{{- if or (eq (.Values.nodeAttestor.k8sPSAT.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true") (gt (len $clusters) 0)) }}
|
|
k8s_psat:
|
|
plugin_data:
|
|
clusters:
|
|
{{- with .Values.nodeAttestor.k8sPSAT }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
- {{ include "spire-lib.cluster-name" $root }}:
|
|
service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
|
|
audience: {{ .audience }}
|
|
allowed_node_label_keys:
|
|
{{ toYaml .allowedNodeLabelKeys | nindent 14 }}
|
|
allowed_pod_label_keys:
|
|
{{ toYaml .allowedPodLabelKeys | nindent 14 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true" }}
|
|
{{- $clusterDefaults := .Values.nodeAttestor.externalK8sPSAT.defaults }}
|
|
{{- range $name, $_ := $clusters }}
|
|
{{- $clusterSettings := dict }}
|
|
{{- if hasKey $root.Values.nodeAttestor.externalK8sPSAT.clusters $name }}
|
|
{{- $clusterSettings = index $root.Values.nodeAttestor.externalK8sPSAT.clusters $name }}
|
|
{{- end }}
|
|
- {{ $name }}:
|
|
{{- if hasKey $clusterSettings "kubeConfigName" }}
|
|
kube_config_file: /kubeconfigs/{{ $clusterSettings.kubeConfigName }}
|
|
{{- else }}
|
|
kube_config_file: /kubeconfigs/{{ $name }}
|
|
{{- end }}
|
|
service_account_allow_list:
|
|
{{ if hasKey $clusterSettings "serviceAccountAllowList" }}{{ toYaml $clusterSettings.serviceAccountAllowList | nindent 14 }}{{ else }}{{ toYaml $clusterDefaults.serviceAccountAllowList | nindent 14 }}{{ end }}
|
|
audience: {{ if hasKey $clusterSettings "audience" }}{{ $clusterSettings.audience }}{{ else }}{{ $clusterDefaults.audience }}{{ end }}
|
|
allowed_node_label_keys:
|
|
{{ if hasKey $clusterSettings "allowedNodeLabelKeys" }}{{ toYaml $clusterSettings.allowedNodeLabelKeys | nindent 14 }}{{ else }}{{ toYaml $clusterDefaults.allowedNodeLabelKeys | nindent 14 }}{{ end }}
|
|
allowed_pod_label_keys:
|
|
{{ if hasKey $clusterSettings "allowedPodLabelKeys" }}{{ toYaml $clusterSettings.allowedPodLabelKeys | nindent 14 }}{{ else }}{{ toYaml $clusterDefaults.allowedPodLabelKeys | nindent 14 }}{{ end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- with .Values.nodeAttestor.joinToken }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
join_token:
|
|
plugin_data: {}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- with .Values.nodeAttestor.httpChallenge }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
http_challenge:
|
|
plugin_data:
|
|
{{- with .allowedDNSPatterns }}
|
|
allowed_dns_patterns:
|
|
{{ toYaml . | nindent 10 }}
|
|
{{- end }}
|
|
{{- if ne (int .requiredPort) 0 }}
|
|
required_port: {{ .requiredPort }}
|
|
{{- end }}
|
|
allow_non_root_ports: {{ .allowNonRootPorts }}
|
|
tofu: {{ .tofu }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- with .Values.nodeAttestor.tpmDirect }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
tpm:
|
|
plugin_cmd: "/tpm/tpm_attestor_server"
|
|
plugin_checksum: {{ .checksum }}
|
|
plugin_data:
|
|
{{- if ne (len .cas) 0 }}
|
|
ca_path: /tpm-direct-cas
|
|
{{- else }}
|
|
ca_path: /run/spire/data/tpm-direct/certs
|
|
{{- end }}
|
|
{{- if ne (len .hashes) 0 }}
|
|
hash_path: /tmp-direct-hashes
|
|
{{- else }}
|
|
hash_path: /run/spire/data/tpm-direct/hashes
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- with .Values.keyManager.disk }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
{{- $keyManagerUsed = add1 $keyManagerUsed }}
|
|
KeyManager:
|
|
disk:
|
|
plugin_data:
|
|
keys_path: "/run/spire/data/keys.json"
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- with .Values.keyManager.memory }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
{{- $keyManagerUsed = add1 $keyManagerUsed }}
|
|
KeyManager:
|
|
memory:
|
|
plugin_data:
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- with .Values.keyManager.awsKMS }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
{{- $keyManagerUsed = add1 $keyManagerUsed }}
|
|
KeyManager:
|
|
aws_kms:
|
|
plugin_data:
|
|
region: {{ .region | quote }}
|
|
{{- if eq (.keyIdentifierFile.enabled | toString) "true" }}
|
|
key_identifier_file: "/run/spire/data/aws-kms-key-identifier"
|
|
{{- else if eq (.keyIdentifierValue.enabled | toString) "true" }}
|
|
key_identifier_value: {{ .keyIdentifierValue.identifier | quote }}
|
|
{{- end }}
|
|
{{- if ne .accessKeyID "" }}
|
|
access_key_id: "${AWS_KMS_ACCESS_KEY_ID}"
|
|
{{- end }}
|
|
{{- if ne .secretAccessKey "" }}
|
|
secret_access_key: "${AWS_KMS_SECRET_ACCESS_KEY}"
|
|
{{- end }}
|
|
{{- if or (ne .keyPolicy.policy "") (ne .keyPolicy.existingConfigMap "") }}
|
|
key_policy_file: "/run/spire/data/aws-kms-key-policy.json"
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- if ne $keyManagerUsed 1 }}
|
|
{{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }}
|
|
{{- end }}
|
|
|
|
{{- $externalK8sBundleClusters := default .Values.kubeConfigs .Values.notifier.externalK8sBundle.clusters }}
|
|
{{- if or .Values.notifier.k8sBundle.enabled (and .Values.notifier.externalK8sBundle.enabled (ne (len $externalK8sBundleClusters) 0)) }}
|
|
Notifier:
|
|
k8sbundle:
|
|
plugin_data:
|
|
{{- if eq (.Values.notifier.k8sBundle.enabled | toString) "true" }}
|
|
namespace: {{ include "spire-server.bundle-namespace" . | quote }}
|
|
config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
|
|
{{- with .Values.notifier.k8sBundle.apiServiceLabel }}
|
|
api_service_label: {{ . | quote }}
|
|
{{- end }}
|
|
{{- with .Values.notifier.k8sBundle.webhookLabel }}
|
|
webhook_label: {{ . | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if and (eq (.Values.notifier.externalK8sBundle.enabled | toString) "true") (ne (len $externalK8sBundleClusters) 0) }}
|
|
clusters:
|
|
- "":
|
|
{{- $clusterDefaults := .Values.notifier.externalK8sBundle.defaults }}
|
|
{{- range $name, $_ := $externalK8sBundleClusters }}
|
|
{{- $clusterSettings := dict }}
|
|
{{- if hasKey $root.Values.notifier.externalK8sBundle.clusters $name }}
|
|
{{- $clusterSettings = index $root.Values.notifier.externalK8sBundle.clusters $name }}
|
|
{{- end }}
|
|
{{- if hasKey $clusterSettings "kubeConfigName" }}
|
|
- kube_config_file_path: /kubeconfigs/{{ $clusterSettings.kubeConfigName }}
|
|
{{- else }}
|
|
- kube_config_file_path: /kubeconfigs/{{ $name }}
|
|
{{- end }}
|
|
namespace: {{ if hasKey $clusterSettings "namespace" }}{{ $clusterSettings.namespace }}{{ else }}{{ $clusterDefaults.namespace }}{{ end }}
|
|
config_map: {{ if hasKey $clusterSettings "configMap" }}{{ $clusterSettings.configMap }}{{ else }}{{ $clusterDefaults.configMap }}{{ end }}
|
|
config_map_key: {{ if hasKey $clusterSettings "configMapKey" }}{{ $clusterSettings.configMapKey }}{{ else }}{{ $clusterDefaults.configMapKey }}{{ end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- if or .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled .Values.bundlePublisher.awsS3.enabled .Values.bundlePublisher.gcpCloudStorage.enabled }}
|
|
BundlePublisher:
|
|
{{- if .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled }}
|
|
aws_rolesanywhere_trustanchor:
|
|
plugin_data:
|
|
region: {{ .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.region | quote }}
|
|
trust_anchor_id: {{ .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID | quote }}
|
|
{{- end }}
|
|
{{- if .Values.bundlePublisher.awsS3.enabled }}
|
|
aws_s3:
|
|
plugin_data:
|
|
region: {{ .Values.bundlePublisher.awsS3.region | quote }}
|
|
bucket: {{ .Values.bundlePublisher.awsS3.bucket | quote }}
|
|
object_key: {{ .Values.bundlePublisher.awsS3.objectKey | quote }}
|
|
format: {{ .Values.bundlePublisher.awsS3.format | quote }}
|
|
{{- end }}
|
|
{{- if .Values.bundlePublisher.gcpCloudStorage.enabled }}
|
|
gcp_cloudstorage:
|
|
plugin_data:
|
|
bucket_name: {{ .Values.bundlePublisher.gcpCloudStorage.bucketName | quote }}
|
|
object_name: {{ .Values.bundlePublisher.gcpCloudStorage.objectName | quote }}
|
|
format: {{ .Values.bundlePublisher.gcpCloudStorage.format | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- with .Values.upstreamAuthority.disk }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
|
UpstreamAuthority:
|
|
disk:
|
|
plugin_data:
|
|
cert_file_path: "/run/spire/upstream_ca/tls.crt"
|
|
key_file_path: "/run/spire/upstream_ca/tls.key"
|
|
{{- if ne .secret.data.bundle "" }}
|
|
bundle_file_path: "/run/spire/upstream_ca/bundle.crt"
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- with .Values.upstreamAuthority.certManager }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
|
UpstreamAuthority:
|
|
cert-manager:
|
|
plugin_data:
|
|
issuer_name: {{ default (printf "%s-ca" (include "spire-server.fullname" $root)) .issuerName }}
|
|
issuer_kind: {{ .issuerKind | quote }}
|
|
issuer_group: {{ .issuerGroup | quote }}
|
|
namespace: {{ default (include "spire-server.namespace" $) .namespace | quote }}
|
|
{{- if ne .kubeConfigFile "" }}
|
|
kube_config_file: {{ .kubeConfigFile | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- with .Values.upstreamAuthority.spire }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
|
UpstreamAuthority:
|
|
spire:
|
|
plugin_data:
|
|
server_address: {{ include "spire-server.upstream-spire-address" $root | quote }}
|
|
server_port: {{ .server.port }}
|
|
workload_api_socket: "/run/spire/upstream_agent/spire-agent.sock"
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- with .Values.upstreamAuthority.vault }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
|
UpstreamAuthority:
|
|
vault:
|
|
plugin_data:
|
|
vault_addr: {{ .vaultAddr | quote }}
|
|
pki_mount_point: {{ .pkiMountPoint | quote }}
|
|
insecure_skip_verify: {{ .insecureSkipVerify }}
|
|
{{- if ne (.insecureSkipVerify | toString) "true" }}
|
|
ca_cert_path: "/run/spire/vault-upstream/ca.crt"
|
|
{{- end }}
|
|
{{- if ne .namespace "" }}
|
|
namespace: {{ .namespace | quote }}
|
|
{{- end }}
|
|
|
|
{{- $vaultAuthMethodUsed := 0 }}
|
|
{{- with .k8sAuth }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
{{- $vaultAuthMethodUsed = add1 $vaultAuthMethodUsed }}
|
|
k8s_auth:
|
|
k8s_auth_mount_point: {{ .k8sAuthMountPoint | quote }}
|
|
k8s_auth_role_name: {{ .k8sAuthRoleName | quote }}
|
|
token_path: "/var/run/secrets/tokens/spire-server"
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if gt $vaultAuthMethodUsed 1 }}
|
|
{{- fail "You can only enable a single authentication mechanism to an upstream Vault." }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- with .Values.upstreamAuthority.awsPCA }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
|
UpstreamAuthority:
|
|
aws_pca:
|
|
plugin_data:
|
|
region: {{ .region | quote }}
|
|
certificate_authority_arn: {{ .certificateAuthorityARN | quote }}
|
|
ca_signing_template_arn: {{ .caSigningTemplateARN | default "arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen0/V1" | quote }}
|
|
{{- if ne .signingAlgorithm "" }}
|
|
signing_algorithm: {{ .signingAlgorithm | quote }}
|
|
{{- end }}
|
|
{{- if ne .assumeRoleARN "" }}
|
|
assume_role_arn: {{ .assumeRoleARN | quote }}
|
|
{{- end }}
|
|
{{- if ne .endpoint "" }}
|
|
endpoint: {{ .endpoint | quote }}
|
|
{{- end }}
|
|
{{- if ne .supplementalBundlePath "" }}
|
|
supplemental_bundle_path: {{ .supplementalBundlePath | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if gt $upstreamAuthorityUsed 1 }}
|
|
{{- fail "You can only enable a single Upstream Authority." }}
|
|
{{- end }}
|
|
|
|
health_checks:
|
|
listener_enabled: true
|
|
bind_address: "0.0.0.0"
|
|
bind_port: "8080"
|
|
live_path: "/live"
|
|
ready_path: "/ready"
|
|
|
|
{{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }}
|
|
telemetry:
|
|
- Prometheus:
|
|
- host: "0.0.0.0"
|
|
port: 9988
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if not .Values.externalServer }}
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ include "spire-server.fullname" . }}
|
|
namespace: {{ include "spire-server.namespace" . }}
|
|
{{- with .Values.configMap.annotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
data:
|
|
server.conf: |
|
|
{{- include "spire-lib.reformat-and-yaml2json" (dict "config" (include "spire-server.yaml-config" .) "root" .) | nindent 4 }}
|
|
{{- end }}
|