helm-charts-hardened/charts/spiffe-step-ssh/values.yaml

# Default values for spiffe-step-ssh.
# SPDX-License-Identifier: APACHE-2.0

global:
  spiffe:
    ## @param global.spiffe.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
    ingressControllerType: ""

## @param trustDomain The trust domain for SPIRE
trustDomain: ""
## @param caPassword Password securing the SSH CA
caPassword: ""
## @param maxTLSCertDuration The maximum duration the X5C traded cert is valid for.
maxTLSCertDuration: 24h
## @param defaultTLSCertDuration The default duration the X5C traded cert is valid for.
defaultTLSCertDuration: 1h
## @param prefix Prefix where hosts show up that are allowed to get ssh host certs
prefix: sshd
## @param csiDriver The csi driver to use
csiDriver: csi.spiffe.io

## @skip inject
## These will be generated by the step-ca tool
inject:
  secrets:
    x509:
      root_ca_key: ""
      intermediate_ca_key: ""
    ssh:
      host_ca_key: ""
      user_ca_key: ""
  config:
    files:
      ca.json:
        authority: {}
  certificates:
    root_ca: ""
    intermediate_ca: ""
    ssh_host_ca: ""
    ssh_user_ca: ""

stepIngress:
  ## @param stepIngress.enabled Flag to enable ingress
  enabled: false
  ## @param stepIngress.className Ingress class name
  className: ""
  ## @param stepIngress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
  controllerType: ""
  ## @param stepIngress.annotations [object] Annotations for the ingress object
  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
    # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    # If Profile Type == https_spiffe:
    # nginx.ingress.kubernetes.io/ssl-passthrough: "true"

  ## @param stepIngress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
  host: "spiffe-step-ssh"

  ## @param stepIngress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
  tlsSecret: ""

  ## @param stepIngress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
  hosts: []
  #  - host: spiffe-step-ssh.example.org
  #    paths:
  #      - path: /
  #        pathType: Prefix

  ## @param stepIngress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
  tls: []
  #  - hosts:
  #      - spiffe-step-ssh.example.org

## @skip step
step:
  service:
    port: 443
    targetPort: 8443
  inject:
    enabled: false
  bootstrap:
    enabled: false
    configmaps: false
    secrets: false
  existingSecrets:
    enabled: true
    ca: true
    issuer: true
    certsAsSecret: false
    configAsSecret: false
    sshHostCa: true
    sshUserCa: true

spiffeHelper:
  ## @param spiffeHelper.image.registry The OCI registry to pull the image from
  ## @param spiffeHelper.image.repository The repository within the registry
  ## @param spiffeHelper.image.pullPolicy The image pull policy
  ## @param spiffeHelper.image.tag Overrides the image tag whose default is the chart appVersion
  ##
  image:
    registry: ghcr.io
    repository: spiffe/spiffe-helper
    pullPolicy: IfNotPresent
    tag: 0.8.0

nginx:
  ## @param nginx.image.registry The OCI registry to pull the image from
  ## @param nginx.image.repository The repository within the registry
  ## @param nginx.image.pullPolicy The image pull policy
  ## @param nginx.image.tag Overrides the image tag whose default is the chart appVersion
  ##
  image:
    registry: docker.io
    repository: nginxinc/nginx-unprivileged
    pullPolicy: IfNotPresent
    tag: 1.25.3-alpine

kubectl:
  ## @param kubectl.image.registry The OCI registry to pull the image from
  ## @param kubectl.image.repository The repository within the registry
  ## @param kubectl.image.pullPolicy The image pull policy
  ## @param kubectl.image.tag Overrides the image tag whose default is the chart appVersion
  ##
  image:
    registry: docker.io
    repository: rancher/kubectl
    pullPolicy: IfNotPresent
    tag: ""

yq:
  ## @param yq.image.registry The OCI registry to pull the image from
  ## @param yq.image.repository The repository within the registry
  ## @param yq.image.pullPolicy The image pull policy
  ## @param yq.image.tag Overrides the image tag whose default is the chart appVersion
  ##
  image:
    registry: docker.io
    repository: mikefarah/yq
    pullPolicy: IfNotPresent
    tag: "4.40.5"

busybox:
  ## @param busybox.image.registry The OCI registry to pull the image from
  ## @param busybox.image.repository The repository within the registry
  ## @param busybox.image.pullPolicy The image pull policy
  ## @param busybox.image.tag Overrides the image tag whose default is the chart appVersion
  ##
  image:
    registry: docker.io
    repository: busybox
    pullPolicy: IfNotPresent
    tag: "1.36.1-uclibc"

## @param imagePullSecrets [array] Pull secrets for images
imagePullSecrets: []

## @param nameOverride Name override
nameOverride: ""

## @param fullnameOverride Fullname override
fullnameOverride: ""

## @param serviceAccount.create Specifies whether a service account should be created
## @param serviceAccount.annotations [object] Annotations to add to the service account
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
##
serviceAccount:
  create: true
  annotations: {}
  name: ""

## @param podAnnotations [object] Additional pod annotations to add
podAnnotations: {}
## @param podLabels [object] Additional pod labels to add
podLabels: {}

## @param podSecurityContext [object} Specify pod security context settings
podSecurityContext: {}
  # fsGroup: 2000

## @param securityContext [object] Specify container security context settings
securityContext:
  # capabilities:
  #   drop:
  #   - ALL
  # readOnlyRootFilesystem: true
  # runAsNonRoot: true
  # runAsUser: 1000
  # FIXME
  runAsUser: 0

fetchCA:
  ## @param fetchCA.replicaCount Number of replicas to launch
  replicaCount: 1

  ## @param fetchCA.service.type The type of service to deploy
  ## @param fetchCA.service.port The port number of the service port
  service:
    type: ClusterIP
    port: 443

  ingress:
    ## @param fetchCA.ingress.enabled Flag to enable ingress
    enabled: false
    ## @param fetchCA.ingress.className Ingress class name
    className: ""
    ## @param fetchCA.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
    controllerType: ""
    ## @param fetchCA.ingress.annotations [object] Annotations for the ingress object
    annotations: {}
      # kubernetes.io/ingress.class: nginx
      # kubernetes.io/tls-acme: "true"
      # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
      # If Profile Type == https_spiffe:
      # nginx.ingress.kubernetes.io/ssl-passthrough: "true"

    ## @param fetchCA.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
    host: "spiffe-step-ssh-fetchca"

    ## @param fetchCA.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
    tlsSecret: ""

    ## @param fetchCA.ingress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
    hosts: []
    #  - host: spiffe-step-ssh-fetchca.example.org
    #    paths:
    #      - path: /
    #        pathType: Prefix

    ## @param fetchCA.ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
    tls: []
    #  - hosts:
    #      - spiffe-step-ssh-fetchca.example.org

  ## @param fetchCA.autoscaling.enabled Enable autoscaling
  ## @param fetchCA.autoscaling.minReplicas Minimum number of replicas to deploy
  ## @param fetchCA.autoscaling.maxReplicas Maximum number of replicas to deploy
  ## @param fetchCA.autoscaling.targetCPUUtilizationPercentage Target CPU utilization to use for autoscaling
  autoscaling:
    enabled: false
    minReplicas: 1
    maxReplicas: 100
    targetCPUUtilizationPercentage: 80
    # targetMemoryUtilizationPercentage: 80

  ## @param fetchCA.resources [object] Specify resources
  resources: {}
    # limits:
    #   cpu: 100m
    #   memory: 128Mi
    # requests:
    #   cpu: 100m
    #   memory: 128Mi

  spiffeHelper:
    ## @param fetchCA.spiffeHelper.resources [object] Specify resources for the SPIFFE helper
    resources: {}
      # limits:
      #   cpu: 100m
      #   memory: 128Mi
      # requests:
      #   cpu: 100m
      #   memory: 128Mi

  ## @param fetchCA.nodeSelector [object] Specify node selector
  nodeSelector: {}

  ## @param fetchCA.tolerations [array] Specify tolerations
  tolerations: []

  ## @param fetchCA.affinity [object] Specify affinity
  affinity: {}

config:
  ## @param config.resources [object] Specify resources
  resources: {}
    # limits:
    #   cpu: 100m
    #   memory: 128Mi
    # requests:
    #   cpu: 100m
    #   memory: 128Mi

  ## @param config.nodeSelector [object] Specify node selector
  nodeSelector: {}

  ## @param config.tolerations [array] Specify tolerations
  tolerations: []

  ## @param config.affinity [object] Specify affinity
  affinity: {}