helm-charts-hardened/charts/spire-identity-exchange

spire-identity-exchange

A Helm chart to install the SPIRE Identity Exchange.

Homepage: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-identity-exchange

Maintainers

Name	Email	Url
marcofranssen	[email protected]	https://marcofranssen.nl
kfox1111	[email protected]
faisal-memon	[email protected]

Source Code

• https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-identity-exchange

Parameters

Chart parameters

Name	Description	Value
agentSocketName	The name of the spire-agent unix socket	spire-agent.sock
csiDriverName	The csi driver to use	csi.spiffe.io
replicaCount	Replica count	1
namespaceOverride	Namespace override	""
annotations	Annotations for the deployment	{}
labels	Labels for the deployment	{}
image.registry	The OCI registry to pull the image from	ghcr.io
image.repository	The repository within the registry	spiffe/spire-identity-exchange-server
image.pullPolicy	The image pull policy	IfNotPresent
image.tag	Overrides the image tag whose default is the chart appVersion	""
spireServerAttestorSPIFFEWorkloadAPI.resources	Resource requests and limits	{}
spireServerAttestorSPIFFEWorkloadAPI.image.registry	The OCI registry to pull the image from	ghcr.io
spireServerAttestorSPIFFEWorkloadAPI.image.repository	The repository within the registry	spiffe/spire-server-attestor-spiffe-workload-api
spireServerAttestorSPIFFEWorkloadAPI.image.pullPolicy	The image pull policy	IfNotPresent
spireServerAttestorSPIFFEWorkloadAPI.image.tag	Overrides the image tag whose default is the chart appVersion	""
spireAgent.resources	Resource requests and limits	{}
spireAgent.image.registry	The OCI registry to pull the image from	ghcr.io
spireAgent.image.repository	The repository within the registry	spiffe/spire-agent
spireAgent.image.pullPolicy	The image pull policy	IfNotPresent
spireAgent.image.tag	Overrides the image tag whose default is the chart appVersion	1.15.2
extraEnv	Extra environment variables to add to the spire identity exchange	[]
resources	Resource requests and limits	{}
configMap.annotations	Annotations to add to the SPIRE Identity Exchange ConfigMap	{}
podSecurityContext	Pod security context for SPIRE Identity Exchange pods	{}
securityContext	Security context for SPIRE Identity Exchange deployment	{}
readinessProbe.initialDelaySeconds	Initial delay seconds for readinessProbe	5
readinessProbe.periodSeconds	Period seconds for readinessProbe	5
livenessProbe.initialDelaySeconds	Initial delay seconds for livenessProbe	5
livenessProbe.periodSeconds	Period seconds for livenessProbe	5
podAnnotations	Pod annotations for SPIRE Identity Exchange	{}
podLabels	Labels to add to pods	{}
tls.externalSecret.enabled	Provide your own certificate/key via tls style Kubernetes Secret	false
tls.externalSecret.secretName	Specify which Secret to use	""
tls.certManager.enabled	Use certificateManager to create the certificate	false
tls.certManager.issuer.create	Create an issuer to use to issue the certificate	true
tls.certManager.issuer.acme.email	Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service	""
tls.certManager.issuer.acme.server	Server to use to get certificate. Defaults to LetsEncrypt	https://acme-v02.api.letsencrypt.org/directory
tls.certManager.issuer.acme.solvers	Configure the issuer solvers. Defaults to http01 via ingress.	{}
tls.certManager.certificate.dnsNames	Override the dnsNames on the certificate request. Defaults to the same settings as Ingress	[]
tls.certManager.certificate.issuerRef.group	If you are using an external plugin, specify the group for it here	""
tls.certManager.certificate.issuerRef.kind	Kind of the issuer reference. Override if you want to use a ClusterIssuer	Issuer
tls.certManager.certificate.issuerRef.name	Name of the issuer to use. If unset, it will use the name of the built in issuer	""
config.logLevel	The log level, valid values are "debug", "info", "warn", and "error"	info
config.logFormat	The log format, valid values are "text" and "json"	text
imagePullSecrets	Image pull secret names	[]
nameOverride	Name override	""
fullnameOverride	Full name override	""
serviceAccount.create	Specifies whether a service account should be created	true
serviceAccount.annotations	Annotations to add to the service account	{}
serviceAccount.name	The name of the service account to use. If not set and create is true, a name is generated.	""
deleteHook.enabled	Enable Helm hooks to autofix common delete issues (should be disabled when using helm template)	true
autoscaling.enabled	Flag to enable autoscaling	false
autoscaling.minReplicas	Minimum replicas for autoscaling	1
autoscaling.maxReplicas	Maximum replicas for autoscaling	5
autoscaling.targetCPUUtilizationPercentage	Target CPU utlization that triggers autoscaling	80
autoscaling.targetMemoryUtilizationPercentage	Target Memory utlization that triggers autoscaling	80
nodeSelector	Node selector	{}
tolerations	iist of tolerations	[]
affinity	Node affinity	{}
trustDomain	Set the trust domain to be used for the SPIFFE identifiers	example.org
clusterDomain	The name of the Kubernetes cluster (kubeadm init --service-dns-domain)	cluster.local
auth.plugins	Plugins to load	{}
auth.stacks	Stacks to load	{}
rest.enabled	Enable the rest service	true
rest.service.type	Service type	ClusterIP
rest.service.port	port for the service	443
rest.service.annotations	Annotations for service resource	{}
rest.service.loadBalancerIP	IP address to assign to load balancer (if supported)	""
rest.ingress.enabled	Flag to enable ingress	false
rest.ingress.className	Ingress class name	""
rest.ingress.controllerType	Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].	""
rest.ingress.annotations	Annotations for ingress object	{}
rest.ingress.host	Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.	spire-identity-exchange-rest
rest.ingress.tlsSecret	Secret that has the certs. If blank will use default certs. Used with host var.	""
rest.ingress.hosts	Host paths for ingress object. If emtpy, rules will be built based on the host var.	[]
rest.ingress.tls	Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.	[]
grpc.enabled	Enable the grpc service	false
grpc.service.type	Service type	ClusterIP
grpc.service.port	port for the service	443
grpc.service.annotations	Annotations for service resource	{}
grpc.service.loadBalancerIP	IP address to assign to load balancer (if supported)	""
grpc.ingress.enabled	Flag to enable ingress	false
grpc.ingress.className	Ingress class name	""
grpc.ingress.controllerType	Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].	""
grpc.ingress.annotations	Annotations for ingress object	{}
grpc.ingress.host	Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The grpc of the rules will be autogenerated. For more customizability, use hosts[] instead.	spire-identity-exchange-grpc
grpc.ingress.tlsSecret	Secret that has the certs. If blank will use default certs. Used with host var.	""
grpc.ingress.hosts	Host paths for ingress object. If emtpy, rules will be built based on the host var.	[]
grpc.ingress.tls	Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.	[]
tools.kubectl.image.registry	The OCI registry to pull the image from	registry.k8s.io
tools.kubectl.image.repository	The repository within the registry	kubectl
tools.kubectl.image.pullPolicy	The image pull policy	IfNotPresent
tools.kubectl.image.tag	Overrides the image tag whose default is the chart appVersion	""
clusterRole.create	create a k8s cluster role to allow access to token reviews and oidc discovery	true
server.address	Address for Spire server	""
server.port	Port number for Spire server	443
server.namespaceOverride	Override the namespace for Spire server	""
server.nameOverride	Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align.	""