kfox1111
3cfefb72ba
* Gateway api support Signed-off-by: Kevin Fox <[email protected]> * Update readme Signed-off-by: Kevin Fox <[email protected]> * Fix gateway name. a gateway doesnt need to be named gateway Signed-off-by: Kevin Fox <[email protected]> * Fix naming issue Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
323 lines
11 KiB
YAML
323 lines
11 KiB
YAML
# Default values for spiffe-step-ssh.
|
|
# SPDX-License-Identifier: APACHE-2.0
|
|
|
|
global:
|
|
spiffe:
|
|
## @param global.spiffe.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
|
ingressControllerType: ""
|
|
|
|
## @param trustDomain The trust domain for SPIRE
|
|
trustDomain: ""
|
|
## @param caPassword Password securing the SSH CA
|
|
caPassword: ""
|
|
## @param maxTLSCertDuration The maximum duration the X5C traded cert is valid for.
|
|
maxTLSCertDuration: 24h
|
|
## @param defaultTLSCertDuration The default duration the X5C traded cert is valid for.
|
|
defaultTLSCertDuration: 1h
|
|
## @param prefix Prefix where hosts show up that are allowed to get ssh host certs
|
|
prefix: sshd
|
|
## @param csiDriver The csi driver to use
|
|
csiDriver: csi.spiffe.io
|
|
|
|
## @skip inject
|
|
## These will be generated by the step-ca tool
|
|
inject:
|
|
secrets:
|
|
x509:
|
|
root_ca_key: ""
|
|
intermediate_ca_key: ""
|
|
ssh:
|
|
host_ca_key: ""
|
|
user_ca_key: ""
|
|
config:
|
|
files:
|
|
ca.json:
|
|
authority: {}
|
|
certificates:
|
|
root_ca: ""
|
|
intermediate_ca: ""
|
|
ssh_host_ca: ""
|
|
ssh_user_ca: ""
|
|
|
|
stepIngress:
|
|
## @param stepIngress.enabled Flag to enable ingress
|
|
enabled: false
|
|
## @param stepIngress.className Ingress class name
|
|
className: ""
|
|
## @param stepIngress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
|
controllerType: ""
|
|
## @param stepIngress.annotations [object] Annotations for the ingress object
|
|
annotations: {}
|
|
# kubernetes.io/ingress.class: nginx
|
|
# kubernetes.io/tls-acme: "true"
|
|
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
|
# If Profile Type == https_spiffe:
|
|
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
|
|
|
## @param stepIngress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
|
host: "spiffe-step-ssh"
|
|
|
|
## @param stepIngress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
|
tlsSecret: ""
|
|
|
|
## @param stepIngress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
|
|
hosts: []
|
|
# - host: spiffe-step-ssh.example.org
|
|
# paths:
|
|
# - path: /
|
|
# pathType: Prefix
|
|
|
|
## @param stepIngress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
|
|
tls: []
|
|
# - hosts:
|
|
# - spiffe-step-ssh.example.org
|
|
|
|
gatewayAPI:
|
|
## @param gatewayAPI.enabled Flag to expose the step endpoint via Gateway API (TLS passthrough)
|
|
enabled: false
|
|
## @param gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
|
host: "spiffe-step-ssh"
|
|
## @param gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
|
annotations: {}
|
|
listenerSet:
|
|
## @param gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
|
enabled: null
|
|
## @param gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
|
parentRefs: []
|
|
## @param gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
|
sectionName: ""
|
|
|
|
## @skip step
|
|
step:
|
|
service:
|
|
port: 443
|
|
targetPort: 8443
|
|
inject:
|
|
enabled: false
|
|
bootstrap:
|
|
enabled: false
|
|
configmaps: false
|
|
secrets: false
|
|
existingSecrets:
|
|
enabled: true
|
|
ca: true
|
|
issuer: true
|
|
certsAsSecret: false
|
|
configAsSecret: false
|
|
sshHostCa: true
|
|
sshUserCa: true
|
|
|
|
spiffeHelper:
|
|
## @param spiffeHelper.image.registry The OCI registry to pull the image from
|
|
## @param spiffeHelper.image.repository The repository within the registry
|
|
## @param spiffeHelper.image.pullPolicy The image pull policy
|
|
## @param spiffeHelper.image.tag Overrides the image tag whose default is the chart appVersion
|
|
##
|
|
image:
|
|
registry: ghcr.io
|
|
repository: spiffe/spiffe-helper
|
|
pullPolicy: IfNotPresent
|
|
tag: 0.8.0
|
|
|
|
nginx:
|
|
## @param nginx.image.registry The OCI registry to pull the image from
|
|
## @param nginx.image.repository The repository within the registry
|
|
## @param nginx.image.pullPolicy The image pull policy
|
|
## @param nginx.image.tag Overrides the image tag whose default is the chart appVersion
|
|
##
|
|
image:
|
|
registry: docker.io
|
|
repository: nginxinc/nginx-unprivileged
|
|
pullPolicy: IfNotPresent
|
|
tag: 1.25.3-alpine
|
|
|
|
kubectl:
|
|
## @param kubectl.image.registry The OCI registry to pull the image from
|
|
## @param kubectl.image.repository The repository within the registry
|
|
## @param kubectl.image.pullPolicy The image pull policy
|
|
## @param kubectl.image.tag Overrides the image tag whose default is the chart appVersion
|
|
##
|
|
image:
|
|
registry: registry.k8s.io
|
|
repository: kubectl
|
|
pullPolicy: IfNotPresent
|
|
tag: ""
|
|
|
|
yq:
|
|
## @param yq.image.registry The OCI registry to pull the image from
|
|
## @param yq.image.repository The repository within the registry
|
|
## @param yq.image.pullPolicy The image pull policy
|
|
## @param yq.image.tag Overrides the image tag whose default is the chart appVersion
|
|
##
|
|
image:
|
|
registry: docker.io
|
|
repository: mikefarah/yq
|
|
pullPolicy: IfNotPresent
|
|
tag: "4.40.5"
|
|
|
|
busybox:
|
|
## @param busybox.image.registry The OCI registry to pull the image from
|
|
## @param busybox.image.repository The repository within the registry
|
|
## @param busybox.image.pullPolicy The image pull policy
|
|
## @param busybox.image.tag Overrides the image tag whose default is the chart appVersion
|
|
##
|
|
image:
|
|
registry: docker.io
|
|
repository: busybox
|
|
pullPolicy: IfNotPresent
|
|
tag: "1.36.1-uclibc"
|
|
|
|
## @param imagePullSecrets [array] Pull secrets for images
|
|
imagePullSecrets: []
|
|
|
|
## @param nameOverride Name override
|
|
nameOverride: ""
|
|
|
|
## @param fullnameOverride Fullname override
|
|
fullnameOverride: ""
|
|
|
|
## @param serviceAccount.create Specifies whether a service account should be created
|
|
## @param serviceAccount.annotations [object] Annotations to add to the service account
|
|
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
|
|
##
|
|
serviceAccount:
|
|
create: true
|
|
annotations: {}
|
|
name: ""
|
|
|
|
## @param podAnnotations [object] Additional pod annotations to add
|
|
podAnnotations: {}
|
|
## @param podLabels [object] Additional pod labels to add
|
|
podLabels: {}
|
|
|
|
## @param podSecurityContext [object} Specify pod security context settings
|
|
podSecurityContext: {}
|
|
# fsGroup: 2000
|
|
|
|
## @param securityContext [object] Specify container security context settings
|
|
securityContext:
|
|
# capabilities:
|
|
# drop:
|
|
# - ALL
|
|
# readOnlyRootFilesystem: true
|
|
# runAsNonRoot: true
|
|
# runAsUser: 1000
|
|
# FIXME
|
|
runAsUser: 0
|
|
|
|
fetchCA:
|
|
## @param fetchCA.replicaCount Number of replicas to launch
|
|
replicaCount: 1
|
|
|
|
## @param fetchCA.service.type The type of service to deploy
|
|
## @param fetchCA.service.port The port number of the service port
|
|
service:
|
|
type: ClusterIP
|
|
port: 443
|
|
|
|
ingress:
|
|
## @param fetchCA.ingress.enabled Flag to enable ingress
|
|
enabled: false
|
|
## @param fetchCA.ingress.className Ingress class name
|
|
className: ""
|
|
## @param fetchCA.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
|
controllerType: ""
|
|
## @param fetchCA.ingress.annotations [object] Annotations for the ingress object
|
|
annotations: {}
|
|
# kubernetes.io/ingress.class: nginx
|
|
# kubernetes.io/tls-acme: "true"
|
|
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
|
# If Profile Type == https_spiffe:
|
|
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
|
|
|
## @param fetchCA.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
|
host: "spiffe-step-ssh-fetchca"
|
|
|
|
## @param fetchCA.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
|
tlsSecret: ""
|
|
|
|
## @param fetchCA.ingress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
|
|
hosts: []
|
|
# - host: spiffe-step-ssh-fetchca.example.org
|
|
# paths:
|
|
# - path: /
|
|
# pathType: Prefix
|
|
|
|
## @param fetchCA.ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
|
|
tls: []
|
|
# - hosts:
|
|
# - spiffe-step-ssh-fetchca.example.org
|
|
|
|
gatewayAPI:
|
|
## @param fetchCA.gatewayAPI.enabled Flag to expose the fetchCA endpoint via Gateway API (TLS passthrough)
|
|
enabled: false
|
|
## @param fetchCA.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
|
host: "spiffe-step-ssh-fetchca"
|
|
## @param fetchCA.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
|
annotations: {}
|
|
listenerSet:
|
|
## @param fetchCA.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
|
enabled: null
|
|
## @param fetchCA.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
|
parentRefs: []
|
|
## @param fetchCA.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
|
sectionName: ""
|
|
|
|
## @param fetchCA.autoscaling.enabled Enable autoscaling
|
|
## @param fetchCA.autoscaling.minReplicas Minimum number of replicas to deploy
|
|
## @param fetchCA.autoscaling.maxReplicas Maximum number of replicas to deploy
|
|
## @param fetchCA.autoscaling.targetCPUUtilizationPercentage Target CPU utilization to use for autoscaling
|
|
autoscaling:
|
|
enabled: false
|
|
minReplicas: 1
|
|
maxReplicas: 100
|
|
targetCPUUtilizationPercentage: 80
|
|
# targetMemoryUtilizationPercentage: 80
|
|
|
|
## @param fetchCA.resources [object] Specify resources
|
|
resources: {}
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
|
|
spiffeHelper:
|
|
## @param fetchCA.spiffeHelper.resources [object] Specify resources for the SPIFFE helper
|
|
resources: {}
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
|
|
## @param fetchCA.nodeSelector [object] Specify node selector
|
|
nodeSelector: {}
|
|
|
|
## @param fetchCA.tolerations [array] Specify tolerations
|
|
tolerations: []
|
|
|
|
## @param fetchCA.affinity [object] Specify affinity
|
|
affinity: {}
|
|
|
|
config:
|
|
## @param config.resources [object] Specify resources
|
|
resources: {}
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
|
|
## @param config.nodeSelector [object] Specify node selector
|
|
nodeSelector: {}
|
|
|
|
## @param config.tolerations [array] Specify tolerations
|
|
tolerations: []
|
|
|
|
## @param config.affinity [object] Specify affinity
|
|
affinity: {}
|