Drew Wells
3b6666016c
DEMO ``` spire-server-0 -- spire-server entry show -spiffeID spiffe://box-4.example.com/ns/dwells/sa/dwells-rc-realm-client Defaulted container "spire-server" out of: spire-server, spire-controller-manager, wait (init) Found 1 entry Entry ID : 09301666-010e-4ba9-9dcb-44370d4e49e4 SPIFFE ID : spiffe://box-4.example.com/ns/dwells/sa/dwells-rc-realm-client Parent ID : spiffe://box-4.example.com/spire/agent/k8s_psat/example-cluster/ff93872d-791f-4bf3-a532-475775d03d3e Revision : 0 X509-SVID TTL : default JWT-SVID TTL : default Selector : k8s:pod-uid:40e0bcad-6ec8-460b-a839-659654549d7a FederatesWith : box-3.example.com ``` Signed-off-by: Drew Wells <[email protected]>
406 lines
11 KiB
YAML
406 lines
11 KiB
YAML
# Default values for spire-server.
|
|
# This is a YAML-formatted file.
|
|
# Declare variables to be passed into your templates.
|
|
|
|
# @ignored
|
|
global: {}
|
|
|
|
# -- SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database.
|
|
replicaCount: 1
|
|
|
|
image:
|
|
# -- The OCI registry to pull the image from
|
|
registry: ghcr.io
|
|
# -- The repository within the registry
|
|
repository: spiffe/spire-server
|
|
# -- The image pull policy
|
|
pullPolicy: IfNotPresent
|
|
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
version: ""
|
|
# -- Overrides the image tag whose default is the chart appVersion.
|
|
tag: ""
|
|
|
|
imagePullSecrets: []
|
|
nameOverride: ""
|
|
namespaceOverride: ""
|
|
fullnameOverride: ""
|
|
|
|
serviceAccount:
|
|
# -- Specifies whether a service account should be created
|
|
create: true
|
|
# -- Annotations to add to the service account
|
|
annotations: {}
|
|
# -- The name of the service account to use.
|
|
# If not set and create is true, a name is generated using the fullname template
|
|
name: ""
|
|
|
|
podAnnotations: {}
|
|
|
|
podSecurityContext: {}
|
|
# fsGroup: 2000
|
|
|
|
securityContext: {}
|
|
# capabilities:
|
|
# drop:
|
|
# - ALL
|
|
# readOnlyRootFilesystem: true
|
|
# runAsNonRoot: true
|
|
# runAsUser: 1000
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 8081
|
|
annotations: {}
|
|
|
|
configMap:
|
|
# -- Annotations to add to the SPIRE Server ConfigMap
|
|
annotations: {}
|
|
|
|
resources: {}
|
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
|
# choice for the user. This also increases chances charts run on environments with little
|
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
|
# requests:
|
|
# cpu: 200m
|
|
# memory: 256Mi
|
|
# limits:
|
|
# cpu: 200m
|
|
# memory: 256Mi
|
|
|
|
autoscaling:
|
|
enabled: false
|
|
minReplicas: 1
|
|
maxReplicas: 100
|
|
targetCPUUtilizationPercentage: 80
|
|
# targetMemoryUtilizationPercentage: 80
|
|
|
|
# -- Select specific nodes to run on (currently only amd64 is supported by Tornjak)
|
|
nodeSelector: {}
|
|
|
|
tolerations: []
|
|
|
|
affinity: {}
|
|
|
|
topologySpreadConstraints: []
|
|
|
|
livenessProbe:
|
|
# -- Failure threshold count for livenessProbe
|
|
failureThreshold: 2
|
|
# -- Initial delay seconds for livenessProbe
|
|
initialDelaySeconds: 15
|
|
# -- Period seconds for livenessProbe
|
|
periodSeconds: 60
|
|
# -- Timeout in seconds for livenessProbe
|
|
timeoutSeconds: 3
|
|
|
|
readinessProbe:
|
|
# -- Initial delay seconds for readinessProbe
|
|
initialDelaySeconds: 5
|
|
# -- Period seconds for readinessProbe
|
|
periodSeconds: 5
|
|
|
|
persistence:
|
|
size: 1Gi
|
|
accessMode: ReadWriteOnce
|
|
storageClass: null
|
|
|
|
dataStore:
|
|
sql:
|
|
# -- Other supported databases are "postgres" and "mysql"
|
|
databaseType: sqlite3
|
|
# -- Only used by "postgres" or "mysql"
|
|
databaseName: spire
|
|
# -- Only used by "postgres" or "mysql"
|
|
host: ""
|
|
# -- If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases.
|
|
port: 0
|
|
# -- Only used by "postgres" or "mysql"
|
|
username: spire
|
|
# -- Only used by "postgres" or "mysql"
|
|
password: ""
|
|
# -- Only used by "postgres" or "mysql"
|
|
options: []
|
|
|
|
# -- Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section
|
|
plugin_data: {}
|
|
|
|
# -- The log level, valid values are "debug", "info", "warn", and "error"
|
|
logLevel: info
|
|
# -- The JWT issuer domain
|
|
jwtIssuer: oidc-discovery.example.org
|
|
|
|
# -- Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`)
|
|
clusterName: example-cluster
|
|
# -- Set the trust domain to be used for the SPIFFE identifiers
|
|
trustDomain: example.org
|
|
|
|
bundleConfigMap: spire-bundle
|
|
|
|
# -- This is the value of your clusters `kubeadm init --service-dns-domain` flag
|
|
clusterDomain: cluster.local
|
|
|
|
federation:
|
|
enabled: false
|
|
bundleEndpoint:
|
|
port: 8443
|
|
address: "0.0.0.0"
|
|
|
|
ingress:
|
|
enabled: false
|
|
className: ""
|
|
annotations: {}
|
|
# kubernetes.io/ingress.class: nginx
|
|
# kubernetes.io/tls-acme: "true"
|
|
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
|
# If Profile Type == https_spiffe:
|
|
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
|
hosts:
|
|
- host: spire-server-federation.example.org
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
tls: []
|
|
# - hosts:
|
|
# - spire-server-federation.example.org
|
|
# If Profile Type == https_web:
|
|
# secretName: spire-server-federation-tls
|
|
|
|
ca_subject:
|
|
country: NL
|
|
organization: Example
|
|
common_name: example.org
|
|
|
|
upstreamAuthority:
|
|
disk:
|
|
enabled: false
|
|
secret:
|
|
# -- If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself.
|
|
create: true
|
|
# -- If secret creation is disabled, the secret with this name will be used.
|
|
name: "spiffe-upstream-ca"
|
|
# -- If secret creation is enabled, will create a secret with following certificate info
|
|
data:
|
|
certificate: ""
|
|
key: ""
|
|
bundle: ""
|
|
certManager:
|
|
enabled: false
|
|
rbac:
|
|
create: true
|
|
# -- Defaults to the release name, override if CA is provided outside of the chart
|
|
issuer_name: ""
|
|
issuer_kind: "Issuer"
|
|
issuer_group: "cert-manager.io"
|
|
# -- Specify to use a namespace other then the one the chart is installed into
|
|
namespace: ""
|
|
kube_config_file: ""
|
|
|
|
ca:
|
|
# -- Creates a Cert-Manager CA
|
|
create: false
|
|
# -- Duration of the CA. Defaults to 10 years.
|
|
duration: 87600h
|
|
privateKey:
|
|
algorithm: ECDSA
|
|
size: 256
|
|
rotationPolicy: ""
|
|
# -- How long to wait before renewing the CA
|
|
renewBefore: ""
|
|
spire:
|
|
enabled: false
|
|
server:
|
|
address: ""
|
|
port: 8081
|
|
|
|
notifier:
|
|
k8sbundle:
|
|
# -- Namespace to push the bundle into, if blank will default to SPIRE Server namespace
|
|
namespace: ""
|
|
|
|
controllerManager:
|
|
enabled: false
|
|
|
|
image:
|
|
# -- The OCI registry to pull the image from
|
|
registry: ghcr.io
|
|
# -- The repository within the registry
|
|
repository: spiffe/spire-controller-manager
|
|
# -- The image pull policy
|
|
pullPolicy: IfNotPresent
|
|
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
version: ""
|
|
# -- Overrides the image tag
|
|
tag: "0.2.2"
|
|
|
|
resources: {}
|
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
|
# choice for the user. This also increases chances charts run on environments with little
|
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
|
|
securityContext: {}
|
|
# capabilities:
|
|
# drop:
|
|
# - ALL
|
|
# readOnlyRootFilesystem: true
|
|
# runAsNonRoot: true
|
|
# runAsUser: 1000
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 443
|
|
annotations: {}
|
|
|
|
configMap:
|
|
# -- Annotations to add to the Controller Manager ConfigMap
|
|
annotations: {}
|
|
|
|
ignoreNamespaces:
|
|
- kube-system
|
|
- kube-public
|
|
- local-path-storage
|
|
|
|
identities:
|
|
enabled: true
|
|
|
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
|
podSelector: {}
|
|
# matchLabels:
|
|
# spiffe.io/spiffe-id: "true"
|
|
namespaceSelector: {}
|
|
# matchLabels:
|
|
# spiffe.io/spiffe-id: "true"
|
|
dnsNameTemplates: []
|
|
# - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local'
|
|
federatesWith: []
|
|
# - example.io
|
|
# - example.ai
|
|
|
|
validatingWebhookConfiguration:
|
|
failurePolicy: Fail
|
|
|
|
tools:
|
|
kubectl:
|
|
image:
|
|
# -- The OCI registry to pull the image from
|
|
registry: docker.io
|
|
# -- The repository within the registry
|
|
repository: rancher/kubectl
|
|
# -- The image pull policy
|
|
pullPolicy: IfNotPresent
|
|
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
version: ""
|
|
# -- Overrides the image tag
|
|
tag: ""
|
|
|
|
telemetry:
|
|
prometheus:
|
|
enabled: false
|
|
podMonitor:
|
|
enabled: false
|
|
# -- Override where to install the podMonitor, if not set will use the same namespace as the spire-server
|
|
namespace: ""
|
|
labels: {}
|
|
|
|
ingress:
|
|
enabled: false
|
|
className: ""
|
|
annotations: {}
|
|
# kubernetes.io/ingress.class: nginx
|
|
# kubernetes.io/tls-acme: "true"
|
|
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
|
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
|
hosts:
|
|
- host: spire-server.example.org
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
tls: []
|
|
# - secretName: spire-server-tls
|
|
# hosts:
|
|
# - spire-server.example.org
|
|
|
|
extraVolumes: []
|
|
extraVolumeMounts: []
|
|
extraContainers: []
|
|
|
|
initContainers: []
|
|
|
|
# -- The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported)
|
|
caKeyType: rsa-2048
|
|
caTTL: 24h
|
|
defaultX509SvidTTL: 4h
|
|
defaultJwtSvidTTL: 1h
|
|
|
|
nodeAttestor:
|
|
k8sPsat:
|
|
enabled: true
|
|
serviceAccountAllowList: []
|
|
|
|
# tornjak - Tornjak specific configuration
|
|
tornjak:
|
|
# -- Deploys Tornjak API (backend) (Not for production)
|
|
enabled: false
|
|
image:
|
|
# -- The OCI registry to pull the Tornjak image from
|
|
registry: ghcr.io
|
|
# -- The repository within the registry
|
|
repository: spiffe/tornjak-backend
|
|
# -- The Tornjak image pull policy
|
|
pullPolicy: IfNotPresent
|
|
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
version: ""
|
|
# -- Overrides the image tag
|
|
tag: "v1.2.2"
|
|
service:
|
|
type: ClusterIP
|
|
port: 10000
|
|
annotations: {}
|
|
|
|
startupProbe:
|
|
failureThreshold: 3
|
|
# -- Initial delay seconds for
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
timeoutSeconds: 5
|
|
|
|
config:
|
|
# -- persistent DB for storing Tornjak specific information
|
|
dataStore:
|
|
driver: "sqlite3"
|
|
file: "/run/spire/data/tornjak.sqlite3"
|
|
resources: {}
|
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
|
# choice for the user. This also increases chances charts run on environments with little
|
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
|
|
# @ignored
|
|
tests:
|
|
bash:
|
|
image:
|
|
# -- The OCI registry to pull the image from
|
|
registry: cgr.dev
|
|
# -- The repository within the registry
|
|
repository: chainguard/bash
|
|
# -- The image pull policy
|
|
pullPolicy: IfNotPresent
|
|
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
version: ""
|
|
# -- Overrides the image tag
|
|
tag: 5.2.15
|