kfox1111
3cfefb72ba
* Gateway api support Signed-off-by: Kevin Fox <[email protected]> * Update readme Signed-off-by: Kevin Fox <[email protected]> * Fix gateway name. a gateway doesnt need to be named gateway Signed-off-by: Kevin Fox <[email protected]> * Fix naming issue Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
410 lines
17 KiB
YAML
410 lines
17 KiB
YAML
# Default configuration for SPIRE Identity Exchange chart
|
|
# SPDX-License-Identifier: APACHE-2.0
|
|
|
|
## @skip global
|
|
global: {}
|
|
|
|
## @section Chart parameters
|
|
##
|
|
## @param agentSocketName The name of the spire-agent unix socket
|
|
agentSocketName: spire-agent.sock
|
|
## @param csiDriverName The csi driver to use
|
|
csiDriverName: csi.spiffe.io
|
|
|
|
## @param replicaCount Replica count
|
|
replicaCount: 1
|
|
|
|
## @param namespaceOverride Namespace override
|
|
namespaceOverride: ""
|
|
|
|
## @param annotations [object] Annotations for the deployment
|
|
annotations: {}
|
|
|
|
## @param labels [object] Labels for the deployment
|
|
labels: {}
|
|
# if you configured your controller manager to register pods based on labels, you need to add these labels here too
|
|
# For instance:
|
|
# spiffe.io/spiffe-id: "true"
|
|
|
|
image:
|
|
## @param image.registry The OCI registry to pull the image from
|
|
## @param image.repository The repository within the registry
|
|
## @param image.pullPolicy The image pull policy
|
|
## @param image.tag Overrides the image tag whose default is the chart appVersion
|
|
##
|
|
registry: ghcr.io
|
|
repository: spiffe/spire-identity-exchange-server
|
|
pullPolicy: IfNotPresent
|
|
tag: ""
|
|
|
|
spireServerAttestorSPIFFEWorkloadAPI:
|
|
## @param spireServerAttestorSPIFFEWorkloadAPI.resources [object] Resource requests and limits
|
|
resources: {}
|
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
|
# choice for the user. This also increases chances charts run on environments with little
|
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
|
# requests:
|
|
# cpu: 50m
|
|
# memory: 32Mi
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 64Mi
|
|
image:
|
|
## @param spireServerAttestorSPIFFEWorkloadAPI.image.registry The OCI registry to pull the image from
|
|
## @param spireServerAttestorSPIFFEWorkloadAPI.image.repository The repository within the registry
|
|
## @param spireServerAttestorSPIFFEWorkloadAPI.image.pullPolicy The image pull policy
|
|
## @param spireServerAttestorSPIFFEWorkloadAPI.image.tag Overrides the image tag whose default is the chart appVersion
|
|
##
|
|
registry: ghcr.io
|
|
repository: spiffe/spire-server-attestor-spiffe-workload-api
|
|
pullPolicy: IfNotPresent
|
|
tag: ""
|
|
|
|
spireAgent:
|
|
## @param spireAgent.resources [object] Resource requests and limits
|
|
resources: {}
|
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
|
# choice for the user. This also increases chances charts run on environments with little
|
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
|
# requests:
|
|
# cpu: 50m
|
|
# memory: 32Mi
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 64Mi
|
|
image:
|
|
## @param spireAgent.image.registry The OCI registry to pull the image from
|
|
## @param spireAgent.image.repository The repository within the registry
|
|
## @param spireAgent.image.pullPolicy The image pull policy
|
|
## @param spireAgent.image.tag Overrides the image tag whose default is the chart appVersion
|
|
##
|
|
registry: ghcr.io
|
|
repository: spiffe/spire-agent
|
|
pullPolicy: IfNotPresent
|
|
tag: "1.15.2"
|
|
|
|
## @param extraEnv [array] Extra environment variables to add to the spire identity exchange
|
|
extraEnv: []
|
|
|
|
## @param resources [object] Resource requests and limits
|
|
resources: {}
|
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
|
# choice for the user. This also increases chances charts run on environments with little
|
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
|
# requests:
|
|
# cpu: 50m
|
|
# memory: 32Mi
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 64Mi
|
|
|
|
configMap:
|
|
## @param configMap.annotations [object] Annotations to add to the SPIRE Identity Exchange ConfigMap
|
|
annotations: {}
|
|
|
|
## @param podSecurityContext [object] Pod security context for SPIRE Identity Exchange pods
|
|
podSecurityContext: {}
|
|
# fsGroup: 2000
|
|
|
|
## @param securityContext [object] Security context for SPIRE Identity Exchange deployment
|
|
securityContext: {}
|
|
# capabilities:
|
|
# drop:
|
|
# - ALL
|
|
# readOnlyRootFilesystem: true
|
|
# runAsNonRoot: true
|
|
# runAsUser: 1000
|
|
|
|
## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
|
|
## @param readinessProbe.periodSeconds Period seconds for readinessProbe
|
|
##
|
|
readinessProbe:
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
|
|
## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
|
|
## @param livenessProbe.periodSeconds Period seconds for livenessProbe
|
|
##
|
|
livenessProbe:
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
|
|
## @param podAnnotations [object] Pod annotations for SPIRE Identity Exchange
|
|
podAnnotations: {}
|
|
|
|
## @param podLabels [object] Labels to add to pods
|
|
podLabels: {}
|
|
|
|
# Select one of the options below to be the source of certificates for SPIRE Identity Exchange
|
|
tls:
|
|
|
|
externalSecret:
|
|
## @param tls.externalSecret.enabled Provide your own certificate/key via tls style Kubernetes Secret
|
|
enabled: false
|
|
## @param tls.externalSecret.secretName Specify which Secret to use
|
|
secretName: ""
|
|
|
|
certManager:
|
|
## @param tls.certManager.enabled Use certificateManager to create the certificate
|
|
enabled: false
|
|
issuer:
|
|
## @param tls.certManager.issuer.create Create an issuer to use to issue the certificate
|
|
create: true
|
|
acme:
|
|
## @param tls.certManager.issuer.acme.email Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service
|
|
email: ""
|
|
## @param tls.certManager.issuer.acme.server Server to use to get certificate. Defaults to LetsEncrypt
|
|
server: https://acme-v02.api.letsencrypt.org/directory
|
|
# Testing server: https://acme-staging-v02.api.letsencrypt.org/directory
|
|
## @param tls.certManager.issuer.acme.solvers [object] Configure the issuer solvers. Defaults to http01 via ingress.
|
|
solvers: {}
|
|
# - http01:
|
|
# ingress:
|
|
# ingressClassName: nginx
|
|
certificate:
|
|
## @param tls.certManager.certificate.dnsNames Override the dnsNames on the certificate request. Defaults to the same settings as Ingress
|
|
dnsNames: []
|
|
## @param tls.certManager.certificate.issuerRef.group If you are using an external plugin, specify the group for it here
|
|
## @param tls.certManager.certificate.issuerRef.kind Kind of the issuer reference. Override if you want to use a ClusterIssuer
|
|
## @param tls.certManager.certificate.issuerRef.name Name of the issuer to use. If unset, it will use the name of the built in issuer
|
|
issuerRef:
|
|
group: ""
|
|
kind: Issuer
|
|
name: ""
|
|
|
|
config:
|
|
## @param config.logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
|
logLevel: info
|
|
## @param config.logFormat The log format, valid values are "text" and "json"
|
|
logFormat: text
|
|
|
|
## @param imagePullSecrets [array] Image pull secret names
|
|
imagePullSecrets: []
|
|
|
|
## @param nameOverride Name override
|
|
nameOverride: ""
|
|
|
|
## @param fullnameOverride Full name override
|
|
fullnameOverride: ""
|
|
|
|
## @param serviceAccount.create Specifies whether a service account should be created
|
|
## @param serviceAccount.annotations Annotations to add to the service account
|
|
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
|
|
##
|
|
serviceAccount:
|
|
create: true
|
|
annotations: {}
|
|
name: ""
|
|
|
|
deleteHook:
|
|
## @param deleteHook.enabled Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`)
|
|
enabled: true
|
|
|
|
## @param autoscaling.enabled Flag to enable autoscaling
|
|
## @param autoscaling.minReplicas Minimum replicas for autoscaling
|
|
## @param autoscaling.maxReplicas Maximum replicas for autoscaling
|
|
## @param autoscaling.targetCPUUtilizationPercentage Target CPU utlization that triggers autoscaling
|
|
## @param autoscaling.targetMemoryUtilizationPercentage Target Memory utlization that triggers autoscaling
|
|
##
|
|
autoscaling:
|
|
enabled: false
|
|
minReplicas: 1
|
|
maxReplicas: 5
|
|
targetCPUUtilizationPercentage: 80
|
|
targetMemoryUtilizationPercentage: 80
|
|
|
|
## @param nodeSelector [object] Node selector
|
|
nodeSelector: {}
|
|
|
|
## @param tolerations [array] iist of tolerations
|
|
tolerations: []
|
|
|
|
## @param affinity [object] Node affinity
|
|
affinity: {}
|
|
|
|
## @param trustDomain Set the trust domain to be used for the SPIFFE identifiers
|
|
trustDomain: example.org
|
|
|
|
## @param clusterDomain The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)
|
|
clusterDomain: cluster.local
|
|
|
|
auth:
|
|
## @param auth.plugins [object] Plugins to load
|
|
plugins: []
|
|
## @param auth.stacks [object] Stacks to load
|
|
stacks: []
|
|
|
|
rest:
|
|
## @param rest.enabled Enable the rest service
|
|
enabled: true
|
|
## @param rest.service.type Service type
|
|
## @param rest.service.port port for the service
|
|
## @param rest.service.annotations Annotations for service resource
|
|
##
|
|
service:
|
|
type: ClusterIP
|
|
port: 443
|
|
annotations: {}
|
|
# external-dns.alpha.kubernetes.io/hostname: spire-identity-exchange-rest.example.org
|
|
## @param rest.service.loadBalancerIP IP address to assign to load balancer (if supported)
|
|
loadBalancerIP: ""
|
|
ingress:
|
|
## @param rest.ingress.enabled Flag to enable ingress
|
|
enabled: false
|
|
## @param rest.ingress.className Ingress class name
|
|
className: ""
|
|
## @param rest.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
|
controllerType: ""
|
|
## @param rest.ingress.annotations [object] Annotations for ingress object
|
|
annotations: {}
|
|
# kubernetes.io/ingress.class: nginx
|
|
# kubernetes.io/tls-acme: "true"
|
|
# nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
|
# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
|
|
|
## @param rest.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
|
host: "spire-identity-exchange-rest"
|
|
|
|
## @param rest.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
|
tlsSecret: ""
|
|
|
|
## @param rest.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
|
hosts: []
|
|
# - host: spire-identity-exchange-rest.example.org
|
|
# paths:
|
|
# - path: /
|
|
# pathType: Prefix
|
|
|
|
## @param rest.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
|
tls: []
|
|
# - secretName: chart-example-tls
|
|
# hosts:
|
|
# - spire-identity-exchange-rest.example.org
|
|
|
|
## Gateway API exposure for the REST endpoint. Independent of rest.ingress. The
|
|
## backend serves HTTPS, so a set tlsSecret => HTTPRoute + BackendTLSPolicy
|
|
## (reencrypt); blank tlsSecret => TLSRoute (SNI passthrough).
|
|
gatewayAPI:
|
|
## @param rest.gatewayAPI.enabled Flag to expose the REST endpoint via Gateway API
|
|
enabled: false
|
|
## @param rest.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
|
host: "spire-identity-exchange-rest"
|
|
## @param rest.gatewayAPI.tlsSecret Secret with the TLS cert for edge termination. Blank keeps passthrough.
|
|
tlsSecret: ""
|
|
## @param rest.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
|
annotations: {}
|
|
listenerSet:
|
|
## @param rest.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
|
enabled: null
|
|
## @param rest.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
|
parentRefs: []
|
|
## @param rest.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
|
sectionName: ""
|
|
# BackendTLSPolicy (reencrypt) is emitted automatically for the terminated
|
|
# HTTPS backend when gatewayAPI.tlsSecret is set.
|
|
backendTLS:
|
|
## @param rest.gatewayAPI.backendTLS.caCertificateRefs [array] ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap.
|
|
caCertificateRefs: []
|
|
|
|
grpc:
|
|
## @param grpc.enabled Enable the grpc service
|
|
enabled: false
|
|
## @param grpc.service.type Service type
|
|
## @param grpc.service.port port for the service
|
|
## @param grpc.service.annotations Annotations for service resource
|
|
##
|
|
service:
|
|
type: ClusterIP
|
|
port: 443
|
|
annotations: {}
|
|
# external-dns.alpha.kubernetes.io/hostname: spire-identity-exchange-grpc.example.org
|
|
## @param grpc.service.loadBalancerIP IP address to assign to load balancer (if supported)
|
|
loadBalancerIP: ""
|
|
ingress:
|
|
## @param grpc.ingress.enabled Flag to enable ingress
|
|
enabled: false
|
|
## @param grpc.ingress.className Ingress class name
|
|
className: ""
|
|
## @param grpc.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
|
controllerType: ""
|
|
## @param grpc.ingress.annotations [object] Annotations for ingress object
|
|
annotations: {}
|
|
# kubernetes.io/ingress.class: nginx
|
|
# kubernetes.io/tls-acme: "true"
|
|
# nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
|
# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
|
|
|
## @param grpc.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The grpc of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
|
host: "spire-identity-exchange-grpc"
|
|
|
|
## @param grpc.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
|
tlsSecret: ""
|
|
|
|
## @param grpc.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
|
hosts: []
|
|
# - host: spire-identity-exchange-grpc.example.org
|
|
# paths:
|
|
# - path: /
|
|
# pathType: Prefix
|
|
|
|
## @param grpc.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
|
tls: []
|
|
# - secretName: chart-example-tls
|
|
# hosts:
|
|
# - spire-identiy-exchange-grpc.example.org
|
|
|
|
## Gateway API exposure for the gRPC endpoint. Independent of grpc.ingress. The
|
|
## backend serves HTTPS, so a set tlsSecret => HTTPRoute + BackendTLSPolicy
|
|
## (reencrypt); blank tlsSecret => TLSRoute (SNI passthrough).
|
|
gatewayAPI:
|
|
## @param grpc.gatewayAPI.enabled Flag to expose the gRPC endpoint via Gateway API
|
|
enabled: false
|
|
## @param grpc.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
|
host: "spire-identity-exchange-grpc"
|
|
## @param grpc.gatewayAPI.tlsSecret Secret with the TLS cert for edge termination. Blank keeps passthrough.
|
|
tlsSecret: ""
|
|
## @param grpc.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
|
annotations: {}
|
|
listenerSet:
|
|
## @param grpc.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
|
enabled: null
|
|
## @param grpc.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
|
parentRefs: []
|
|
## @param grpc.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
|
sectionName: ""
|
|
# BackendTLSPolicy (reencrypt) is emitted automatically for the terminated
|
|
# HTTPS backend when gatewayAPI.tlsSecret is set.
|
|
backendTLS:
|
|
## @param grpc.gatewayAPI.backendTLS.caCertificateRefs [array] ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap.
|
|
caCertificateRefs: []
|
|
|
|
tools:
|
|
kubectl:
|
|
## @param tools.kubectl.image.registry The OCI registry to pull the image from
|
|
## @param tools.kubectl.image.repository The repository within the registry
|
|
## @param tools.kubectl.image.pullPolicy The image pull policy
|
|
## @param tools.kubectl.image.tag Overrides the image tag whose default is the chart appVersion
|
|
##
|
|
image:
|
|
registry: registry.k8s.io
|
|
repository: kubectl
|
|
pullPolicy: IfNotPresent
|
|
tag: ""
|
|
clusterRole:
|
|
## @param clusterRole.create create a k8s cluster role to allow access to token reviews and oidc discovery
|
|
create: true
|
|
|
|
## @param server.address Address for Spire server
|
|
## @param server.port Port number for Spire server
|
|
## @param server.namespaceOverride Override the namespace for Spire server
|
|
## @param server.nameOverride Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align.
|
|
##
|
|
server:
|
|
address: ""
|
|
port: 443
|
|
namespaceOverride: ""
|
|
nameOverride: ""
|