kfox1111
5d07eaff52
* Align more settings to convention Signed-off-by: Kevin Fox <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
16 lines
690 B
YAML
16 lines
690 B
YAML
spire-agent:
|
|
nodeAttestor:
|
|
k8sPSAT:
|
|
enabled: false
|
|
tpmDirect:
|
|
enabled: true
|
|
|
|
spire-server:
|
|
controllerManager:
|
|
# K8s labels have a 63 character limit. TPM hashes are 64 chars. So you need to label the node with two labels with half of the tpm's hash each. The 'node-restriction.kubernetes.io/' prefix is so that the
|
|
# nodes can't update the hash themselves, an important security constraint.
|
|
parentIDTemplate: 'spiffe://{{ .TrustDomain }}/spire/agent/tpm/{{ index .NodeMeta.Labels "node-restriction.kubernetes.io/tpm-pubhash" }}{{ index .NodeMeta.Labels "node-restriction.kubernetes.io/tpm-pubhash2" }}'
|
|
nodeAttestor:
|
|
tpmDirect:
|
|
enabled: true
|