Mariusz Sabath
1247b68f4d
This PR addresses #307 by parametrizing Probes and moving them to values.yaml --------- Signed-off-by: Mariusz Sabath <[email protected]>
140 lines
3.8 KiB
YAML
140 lines
3.8 KiB
YAML
# Default values for spire-agent.
|
||
# This is a YAML-formatted file.
|
||
# Declare variables to be passed into your templates.
|
||
|
||
image:
|
||
# -- The OCI registry to pull the image from
|
||
registry: ghcr.io
|
||
# -- The repository within the registry
|
||
repository: spiffe/spire-agent
|
||
# -- The image pull policy
|
||
pullPolicy: IfNotPresent
|
||
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
||
version: ""
|
||
# -- Overrides the image tag whose default is the chart appVersion.
|
||
tag: ""
|
||
|
||
imagePullSecrets: []
|
||
nameOverride: ""
|
||
namespaceOverride: ""
|
||
fullnameOverride: ""
|
||
|
||
serviceAccount:
|
||
# -- Specifies whether a service account should be created
|
||
create: true
|
||
# -- Annotations to add to the service account
|
||
annotations: {}
|
||
# -- The name of the service account to use.
|
||
# If not set and create is true, a name is generated using the fullname template
|
||
name: ""
|
||
|
||
configMap:
|
||
# -- Annotations to add to the SPIRE Agent ConfigMap
|
||
annotations: {}
|
||
|
||
podAnnotations: {}
|
||
|
||
podSecurityContext: {}
|
||
# fsGroup: 2000
|
||
|
||
securityContext: {}
|
||
# capabilities:
|
||
# drop:
|
||
# - ALL
|
||
# readOnlyRootFilesystem: true
|
||
# runAsNonRoot: true
|
||
# runAsUser: 1000
|
||
|
||
resources: {}
|
||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||
# choice for the user. This also increases chances charts run on environments with little
|
||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||
# requests:
|
||
# cpu: 50m
|
||
# memory: 64Mi
|
||
# limits:
|
||
# cpu: 100m
|
||
# memory: 128Mi
|
||
|
||
nodeSelector: {}
|
||
|
||
# -- The log level, valid values are "debug", "info", "warn", and "error"
|
||
logLevel: info
|
||
# -- The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)
|
||
clusterName: example-cluster
|
||
# -- The trust domain to be used for the SPIFFE identifiers
|
||
trustDomain: example.org
|
||
# -- If set, obtain trust bundle from url instead of Kubernetes ConfigMap
|
||
trustBundleURL: ""
|
||
# -- If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe"
|
||
trustBundleFormat: pem
|
||
bundleConfigMap: spire-bundle
|
||
|
||
server:
|
||
address: ""
|
||
port: 8081
|
||
namespaceOverride: ""
|
||
|
||
healthChecks:
|
||
# -- override the host port used for health checking
|
||
port: 9980
|
||
|
||
livenessProbe:
|
||
# -- Initial delay seconds for livenessProbe
|
||
initialDelaySeconds: 15
|
||
# -- Period seconds for livenessProbe
|
||
periodSeconds: 60
|
||
|
||
readinessProbe:
|
||
# -- Initial delay seconds for readinessProbe
|
||
initialDelaySeconds: 15
|
||
# -- Period seconds for readinessProbe
|
||
periodSeconds: 60
|
||
|
||
waitForIt:
|
||
image:
|
||
# -- The OCI registry to pull the image from
|
||
registry: cgr.dev
|
||
# -- The repository within the registry
|
||
repository: chainguard/wait-for-it
|
||
# -- The image pull policy
|
||
pullPolicy: IfNotPresent
|
||
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
||
version: ""
|
||
# -- Overrides the image tag
|
||
tag: latest-20230517
|
||
resources: {}
|
||
|
||
# workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
|
||
workloadAttestors:
|
||
# unix is a workload attestor which generates unix-based selectors like 'uid' and 'gid'.
|
||
unix:
|
||
# -- enables the Unix workload attestor
|
||
enabled: false
|
||
k8s:
|
||
# -- If true, kubelet certificate verification is skipped
|
||
skipKubeletVerification: true
|
||
|
||
telemetry:
|
||
prometheus:
|
||
enabled: false
|
||
port: 9988
|
||
podMonitor:
|
||
enabled: false
|
||
# -- Override where to install the podMonitor, if not set will use the same namespace as the spire-agent
|
||
namespace: ""
|
||
labels: {}
|
||
|
||
# -- The unix socket path to the spire-agent
|
||
socketPath: /run/spire/agent-sockets/spire-agent.sock
|
||
|
||
# -- Priority class assigned to daemonset pods
|
||
priorityClassName: ""
|
||
|
||
extraVolumes: []
|
||
extraVolumeMounts: []
|
||
extraContainers: []
|
||
|
||
initContainers: []
|