helm-charts-hardened/charts/spire-nested/values.yaml

# Default configuration for Spire chart
# SPDX-License-Identifier: APACHE-2.0

## @section Global parameters
## Note: the parameter values specified here will override the chart level values for these parameters.
##
global:
  k8s:
    ## @param global.k8s.clusterDomain Cluster domain name configured for Spire install
    clusterDomain: cluster.local

  spire:
    ## @param global.spire.clusterName The name of the k8s cluster for Spire install
    clusterName: example-cluster
    ## @param global.spire.jwtIssuer The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset
    jwtIssuer: ""
    ## @param global.spire.trustDomain The trust domain for Spire install
    trustDomain: example.org

    ## @param global.spire.caSubject.country Country for Spire server CA
    ## @param global.spire.caSubject.organization Organization for Spire server CA
    ## @param global.spire.caSubject.commonName Common Name for Spire server CA
    caSubject:
      country: ""
      organization: ""
      commonName: ""

    ## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off.
    ## @param global.spire.recommendations.namespaceLayout Set to true to use recommended values for installing across namespaces
    ## @param global.spire.recommendations.namespacePSS When chart namespace creation is enabled, label them with preffered Pod Security Standard labels
    ## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names
    ## @param global.spire.recommendations.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
    ## @param global.spire.recommendations.securityContexts Set to true to use recommended values for Pod and Container Security Contexts
    ## @param global.spire.recommendations.prometheus Enable prometheus exporters for monitoring
    recommendations:
      enabled: false
      namespaceLayout: true
      namespacePSS: true
      priorityClassName: true
      strictMode: true
      securityContexts: true
      prometheus: true

    image:
      ## @param global.spire.image.registry Override all Spire image registries at once
      registry: ""

    namespaces:
      ## @param global.spire.namespaces.create Set to true to Create all namespaces. If this or either of the namespace specific create flags is set, the namespace will be created.
      create: false
      system:
        ## @param global.spire.namespaces.system.name Name of the Spire system Namespace.
        name: "spire-system"
        ## @param global.spire.namespaces.system.create Create a Namespace for Spire system resources.
        create: false
        ## @param global.spire.namespaces.system.annotations [object] Annotations to apply to the Spire system Namespace.
        annotations: {}
        ## @param global.spire.namespaces.system.labels [object] Labels to apply to the Spire system Namespace.
        labels: {}
      server:
        ## @param global.spire.namespaces.server.name Name of the Spire server Namespace.
        name: "spire-server"
        ## @param global.spire.namespaces.server.create Create a Namespace for Spire server resources.
        create: false
        ## @param global.spire.namespaces.server.annotations [object] Annotations to apply to the Spire server Namespace.
        annotations: {}
        ## @param global.spire.namespaces.server.labels [object] Labels to apply to the Spire server Namespace.
        labels: {}

    ## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
    strictMode: false

    ## @param global.spire.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
    ingressControllerType: ""

    ## Shared Gateway that routes and ListenerSets attach to. The Gateway object itself is
    ## rendered by the `gatewayAPI.gateway` block of this chart. Gateway API support is
    ## independent of ingress and can be enabled alongside it.
    gatewayAPI:
      ## @param global.spire.gatewayAPI.manageListenerSets Default policy for whether services render a ListenerSet for their SNI listener. Each service may override via its gatewayAPI.listenerSet.enabled.
      manageListenerSets: true
      gateway:
        ## @param global.spire.gatewayAPI.gateway.name Name of the shared Gateway object that routes and ListenerSets attach to
        name: spire
        ## The Gateway object and every route's parentRef both read this value, so they
        ## cannot disagree. It defaults to the server namespace so the Gateway sits with
        ## the workloads it fronts; a ListenerSet in another namespace still attaches, as
        ## the Gateway allows listeners from all namespaces by default.
        ## @param global.spire.gatewayAPI.gateway.namespace Namespace of the shared Gateway object. Defaults to the release namespace if blank.
        namespace: spire-server
        ## @param global.spire.gatewayAPI.gateway.port Port the shared Gateway listens on. ListenerSet listeners must match this.
        port: 443

    tools:
      kubectl:
        ## @param global.spire.tools.kubectl.tag Set to force the tag to use for all kubectl instances
        tag: ""

  installAndUpgradeHooks:
    ## @param global.installAndUpgradeHooks.enabled Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`)
    enabled: true
  deleteHooks:
    ## @param global.deleteHooks.enabled Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`)
    enabled: true

#  telemetry:
#    prometheus:
#      enabled: true
#      podMonitor:
#        enabled: true
#        # -- Allows to install the PodMonitor in another namespace then the spire components are installed into.
#        namespace: "kube-prometheus-system"
#        labels: {}

tags:
  ## @param tags.nestedRoot Set the chart architecture to root nested
  nestedRoot: false
  ## @param tags.nestedChildFull Set the chart mode to a child cluster with its own nested server
  nestedChildFull: false
  ## @param tags.nestedChildSecurity Set the chart mode to a child cluster for use with a security cluster
  nestedChildSecurity: false
  ## @param tags.haAgentCommon Set the chart mode to deploy the common portion of a spire-ha-agent setup
  haAgentCommon: false
  ## @param tags.bottomTurtleHAA Setup HA side A for use with a Bottom Turtle architecture
  bottomTurtleHAA: false
  ## @param tags.bottomTurtleHAB Setup HA side B for use with a Bottom Turtle architecture
  bottomTurtleHAB: false

## The shared Gateway that routes and ListenerSets attach to. Only one release in a cluster
## should render it. name/namespace/port come from global.spire.gatewayAPI.gateway; the
## class and listener policy are local.
##
gatewayAPI:
  gateway:
    ## @param gatewayAPI.gateway.enabled Render the shared Gateway object
    enabled: false
    ## @param gatewayAPI.gateway.className gatewayClassName for the shared Gateway (e.g. "eg"). Required when enabled.
    className: ""
    ## @param gatewayAPI.gateway.annotations [object] Annotations for the Gateway object
    annotations: {}
    ## @param gatewayAPI.gateway.allowedListenersNamespaces From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector.
    allowedListenersNamespaces: All
    ## @param gatewayAPI.gateway.allowedRoutesNamespaces From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector.
    allowedRoutesNamespaces: All
    ## @param gatewayAPI.gateway.extraListeners [array] Additional listeners to add to the Gateway
    extraListeners: []

## Combined exposure fronting the spire-identity-exchange of both HA sides. Only rendered
## with tags.haAgentCommon; the per-side exposures under bottomTurtleHAA/B are untouched.
## Each endpoint gets one Service selecting both sides' exchange pods, so the Ingress and
## the Gateway API route need only a single backend. The matching listener must be enabled
## on the sides themselves; if it is not, the Service simply has no endpoints.
spireIdentityExchange:
  ## @param spireIdentityExchange.podSelector [object] Labels selecting the exchange pods of both sides. Narrow it (for example by adding release-namespace) when other exchanges share the namespace.
  podSelector:
    component: spire-identity-exchange

  ## Endpoints served with the certificate each side loads from disk.
  tls:
    rest:
      ## @param spireIdentityExchange.tls.rest.enabled Expose the combined REST endpoint served with the on-disk certificate
      enabled: false
      ## @param spireIdentityExchange.tls.rest.service.type Service type
      ## @param spireIdentityExchange.tls.rest.service.port port for the service
      ## @param spireIdentityExchange.tls.rest.service.annotations Annotations for service resource
      ##
      service:
        type: ClusterIP
        port: 443
        annotations: {}
        ## @param spireIdentityExchange.tls.rest.service.loadBalancerIP IP address to assign to load balancer (if supported)
        loadBalancerIP: ""
      ingress:
        ## @param spireIdentityExchange.tls.rest.ingress.enabled Flag to enable ingress
        enabled: false
        ## @param spireIdentityExchange.tls.rest.ingress.className Ingress class name
        className: ""
        ## @param spireIdentityExchange.tls.rest.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
        controllerType: ""
        ## @param spireIdentityExchange.tls.rest.ingress.annotations [object] Annotations for ingress object
        annotations: {}
        ## @param spireIdentityExchange.tls.rest.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. Must differ from the per-side hosts.
        host: "spire-identity-exchange-rest"
        ## @param spireIdentityExchange.tls.rest.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
        tlsSecret: ""
        ## @param spireIdentityExchange.tls.rest.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
        hosts: []
        ## @param spireIdentityExchange.tls.rest.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
        tls: []
      ## Gateway API exposure for this endpoint. A set tlsSecret gives HTTPRoute (reencrypt); blank gives TLSRoute (SNI passthrough).
      gatewayAPI:
        ## @param spireIdentityExchange.tls.rest.gatewayAPI.enabled Flag to expose the endpoint via Gateway API
        enabled: false
        ## @param spireIdentityExchange.tls.rest.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
        host: "spire-identity-exchange-rest"
        ## @param spireIdentityExchange.tls.rest.gatewayAPI.tlsSecret Secret with the TLS cert for edge termination. Blank keeps passthrough.
        tlsSecret: ""
        ## @param spireIdentityExchange.tls.rest.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
        annotations: {}
        listenerSet:
          ## @param spireIdentityExchange.tls.rest.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
          enabled: null
        ## @param spireIdentityExchange.tls.rest.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
        parentRefs: []
        ## @param spireIdentityExchange.tls.rest.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
        sectionName: ""
        backendTLS:
          ## @param spireIdentityExchange.tls.rest.gatewayAPI.backendTLS.caCertificateRefs [array] ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap.
          caCertificateRefs: []
    grpc:
      ## @param spireIdentityExchange.tls.grpc.enabled Expose the combined gRPC endpoint served with the on-disk certificate
      enabled: false
      ## @param spireIdentityExchange.tls.grpc.service.type Service type
      ## @param spireIdentityExchange.tls.grpc.service.port port for the service
      ## @param spireIdentityExchange.tls.grpc.service.annotations Annotations for service resource
      ##
      service:
        type: ClusterIP
        port: 443
        annotations: {}
        ## @param spireIdentityExchange.tls.grpc.service.loadBalancerIP IP address to assign to load balancer (if supported)
        loadBalancerIP: ""
      ingress:
        ## @param spireIdentityExchange.tls.grpc.ingress.enabled Flag to enable ingress
        enabled: false
        ## @param spireIdentityExchange.tls.grpc.ingress.className Ingress class name
        className: ""
        ## @param spireIdentityExchange.tls.grpc.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
        controllerType: ""
        ## @param spireIdentityExchange.tls.grpc.ingress.annotations [object] Annotations for ingress object
        annotations: {}
        ## @param spireIdentityExchange.tls.grpc.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. Must differ from the per-side hosts.
        host: "spire-identity-exchange-grpc"
        ## @param spireIdentityExchange.tls.grpc.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
        tlsSecret: ""
        ## @param spireIdentityExchange.tls.grpc.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
        hosts: []
        ## @param spireIdentityExchange.tls.grpc.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
        tls: []
      ## Gateway API exposure for this endpoint. A set tlsSecret gives HTTPRoute (reencrypt); blank gives TLSRoute (SNI passthrough).
      gatewayAPI:
        ## @param spireIdentityExchange.tls.grpc.gatewayAPI.enabled Flag to expose the endpoint via Gateway API
        enabled: false
        ## @param spireIdentityExchange.tls.grpc.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
        host: "spire-identity-exchange-grpc"
        ## @param spireIdentityExchange.tls.grpc.gatewayAPI.tlsSecret Secret with the TLS cert for edge termination. Blank keeps passthrough.
        tlsSecret: ""
        ## @param spireIdentityExchange.tls.grpc.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
        annotations: {}
        listenerSet:
          ## @param spireIdentityExchange.tls.grpc.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
          enabled: null
        ## @param spireIdentityExchange.tls.grpc.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
        parentRefs: []
        ## @param spireIdentityExchange.tls.grpc.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
        sectionName: ""
        backendTLS:
          ## @param spireIdentityExchange.tls.grpc.gatewayAPI.backendTLS.caCertificateRefs [array] ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap.
          caCertificateRefs: []

  ## Endpoints served with each side's own X509-SVID. Gateway API is always a TLSRoute
  ## (SNI passthrough) here: an X509-SVID has no DNS SAN, so edge termination could never
  ## validate these backends.
  spiffe:
    rest:
      ## @param spireIdentityExchange.spiffe.rest.enabled Expose the combined REST endpoint served with each side's own X509-SVID
      enabled: false
      ## @param spireIdentityExchange.spiffe.rest.service.type Service type
      ## @param spireIdentityExchange.spiffe.rest.service.port port for the service
      ## @param spireIdentityExchange.spiffe.rest.service.annotations Annotations for service resource
      ##
      service:
        type: ClusterIP
        port: 443
        annotations: {}
        ## @param spireIdentityExchange.spiffe.rest.service.loadBalancerIP IP address to assign to load balancer (if supported)
        loadBalancerIP: ""
      ingress:
        ## @param spireIdentityExchange.spiffe.rest.ingress.enabled Flag to enable ingress
        enabled: false
        ## @param spireIdentityExchange.spiffe.rest.ingress.className Ingress class name
        className: ""
        ## @param spireIdentityExchange.spiffe.rest.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
        controllerType: ""
        ## @param spireIdentityExchange.spiffe.rest.ingress.annotations [object] Annotations for ingress object
        annotations: {}
        ## @param spireIdentityExchange.spiffe.rest.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. Must differ from the per-side hosts.
        host: "spire-identity-exchange-rest-spiffe"
        ## @param spireIdentityExchange.spiffe.rest.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
        tlsSecret: ""
        ## @param spireIdentityExchange.spiffe.rest.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
        hosts: []
        ## @param spireIdentityExchange.spiffe.rest.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
        tls: []
      ## Gateway API exposure for this endpoint. Always a TLSRoute (SNI passthrough).
      gatewayAPI:
        ## @param spireIdentityExchange.spiffe.rest.gatewayAPI.enabled Flag to expose the endpoint via Gateway API
        enabled: false
        ## @param spireIdentityExchange.spiffe.rest.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
        host: "spire-identity-exchange-rest-spiffe"
        ## @param spireIdentityExchange.spiffe.rest.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
        annotations: {}
        listenerSet:
          ## @param spireIdentityExchange.spiffe.rest.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
          enabled: null
        ## @param spireIdentityExchange.spiffe.rest.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
        parentRefs: []
        ## @param spireIdentityExchange.spiffe.rest.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
        sectionName: ""
    grpc:
      ## @param spireIdentityExchange.spiffe.grpc.enabled Expose the combined gRPC endpoint served with each side's own X509-SVID
      enabled: false
      ## @param spireIdentityExchange.spiffe.grpc.service.type Service type
      ## @param spireIdentityExchange.spiffe.grpc.service.port port for the service
      ## @param spireIdentityExchange.spiffe.grpc.service.annotations Annotations for service resource
      ##
      service:
        type: ClusterIP
        port: 443
        annotations: {}
        ## @param spireIdentityExchange.spiffe.grpc.service.loadBalancerIP IP address to assign to load balancer (if supported)
        loadBalancerIP: ""
      ingress:
        ## @param spireIdentityExchange.spiffe.grpc.ingress.enabled Flag to enable ingress
        enabled: false
        ## @param spireIdentityExchange.spiffe.grpc.ingress.className Ingress class name
        className: ""
        ## @param spireIdentityExchange.spiffe.grpc.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
        controllerType: ""
        ## @param spireIdentityExchange.spiffe.grpc.ingress.annotations [object] Annotations for ingress object
        annotations: {}
        ## @param spireIdentityExchange.spiffe.grpc.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. Must differ from the per-side hosts.
        host: "spire-identity-exchange-grpc-spiffe"
        ## @param spireIdentityExchange.spiffe.grpc.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
        tlsSecret: ""
        ## @param spireIdentityExchange.spiffe.grpc.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
        hosts: []
        ## @param spireIdentityExchange.spiffe.grpc.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
        tls: []
      ## Gateway API exposure for this endpoint. Always a TLSRoute (SNI passthrough).
      gatewayAPI:
        ## @param spireIdentityExchange.spiffe.grpc.gatewayAPI.enabled Flag to expose the endpoint via Gateway API
        enabled: false
        ## @param spireIdentityExchange.spiffe.grpc.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
        host: "spire-identity-exchange-grpc-spiffe"
        ## @param spireIdentityExchange.spiffe.grpc.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
        annotations: {}
        listenerSet:
          ## @param spireIdentityExchange.spiffe.grpc.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
          enabled: null
        ## @param spireIdentityExchange.spiffe.grpc.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
        parentRefs: []
        ## @param spireIdentityExchange.spiffe.grpc.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
        sectionName: ""

## subcharts

## @section Spire agent parameters
## Parameter values for Spire agent
##
# Used with tags [nestedRoot, nestedChildFull]
downstream-spire-agent-full:
  # enabled: true
  ## @param downstream-spire-agent-full.nameOverride Overrides the name of Spire agent pods
  nameOverride: agent-downstream
  server:
    ## @param downstream-spire-agent-full.server.nameOverride The name override setting of the internal SPIRE server
    nameOverride: internal-server
  ## @param downstream-spire-agent-full.bundleConfigMap The name of the configmap that contains the downstream bundle
  bundleConfigMap: spire-bundle-downstream
  ## @param downstream-spire-agent-full.persistence.hostPath Which path to use on the host when persistence.type = hostPath
  persistence:
    hostPath: /var/lib/spire/k8s/downstream-agent

## @section Spire agent parameters
## Parameter values for Spire agent
##
# Used with tags [nestedChildSecurity]
downstream-spire-agent-security:
  # enabled: true
  ## @param downstream-spire-agent-security.nameOverride Overrides the name of Spire agent pods
  nameOverride: agent-downstream
  ## @param downstream-spire-agent-security.bundleConfigMap The name of the configmap that contains the downstream bundle
  bundleConfigMap: spire-bundle-upstream
  serviceAccount:
    ## @param downstream-spire-agent-security.serviceAccount.name The name of the service account to use
    name: spire-agent-upstream
  ## @param downstream-spire-agent-security.persistence.hostPath Which path to use on the host when persistence.type = hostPath
  persistence:
    hostPath: /var/lib/spire/k8s/downstream-agent

## @section Upstream Spire agent parameters
## Parameter values for upstream Spire agent
##
# Used with tags [nestedRoot, nestedChildFull]
upstream-spire-agent:
  # enabled: true
  ## @param upstream-spire-agent.upstream Flag for enabling upstream Spire agent
  upstream: true
  ## @param upstream-spire-agent.nameOverride Name override for upstream Spire agent
  nameOverride: agent-upstream
  ## @param upstream-spire-agent.bundleConfigMap The configmap name for upstream Spire agent bundle
  bundleConfigMap: spire-bundle-upstream
  ## @param upstream-spire-agent.socketPath Socket path where Spire agent socket is mounted
  socketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
  serviceAccount:
    ## @param upstream-spire-agent.serviceAccount.name Service account name for upstream Spire agent
    name: spire-agent-upstream
  healthChecks:
    ## @param upstream-spire-agent.healthChecks.port Health check port number for upstream Spire agent
    port: 9981
  telemetry:
    prometheus:
      ## @param upstream-spire-agent.telemetry.prometheus.port The port where prometheus metrics are available
      port: 9989
  server:
    ## @param upstream-spire-agent.server.nameOverride The name override setting of the root SPIRE server
    nameOverride: root-server
  ## @param upstream-spire-agent.persistence.hostPath Which path to use on the host when persistence.type = hostPath
  persistence:
    hostPath: /var/lib/spire/k8s/upstream-agent

## @section SPIFFE CSI Driver parameters
## Parameter values for spiffe-csi-driver
##
# Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity]
downstream-spiffe-csi-driver:
  # enabled: true
  ## @param downstream-spiffe-csi-driver.fullnameOverride Fullname override
  fullnameOverride: spiffe-csi-driver-downstream

## @section Upstream SPIFFE CSI Driver parameters
## Parameter values for upstream spiffe-csi-driver
##
# Used with tags [nestedRoot, nestedChildFull]
upstream-spiffe-csi-driver:
  # enabled: true
  ## @param upstream-spiffe-csi-driver.fullnameOverride Fullname override
  fullnameOverride: spiffe-csi-driver-upstream
  ## @param upstream-spiffe-csi-driver.pluginName The plugin name for configuring upstream Spiffe CSI driver
  pluginName: upstream.csi.spiffe.io
  ## @param upstream-spiffe-csi-driver.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
  agentSocketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
  healthChecks:
    ## @param upstream-spiffe-csi-driver.healthChecks.port The port where Spiffe CSI driver health checks are exposed
    port: 9810

## @section SPIFFE oidc discovery provider parameters
## Parameter values for spiffe-oidc-discovery-provider
##
# Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity, haAgentCommon]
spiffe-oidc-discovery-provider:
  # enabled: true
  ## @param spiffe-oidc-discovery-provider.fullnameOverride Fullname override
  fullnameOverride: spiffe-oidc-discovery-provider

## @section Tornjak frontend parameters
## Parameter values for Tornjak frontend
##
tornjak-frontend:
  ## @param tornjak-frontend.enabled Enables deployment of Tornjak frontend/UI (Not for production)
  enabled: false

# Used with tags [nestedRoot]
root-spire-server:
  # enabled: true
  ## @param root-spire-server.nameOverride Name override
  nameOverride: root-server
  ## @param root-spire-server.crNameOverride Custom Resource name override
  crNameOverride: root
  controllerManager:
    ## @param root-spire-server.controllerManager.enabled Enable controller manager and provision CRD's
    enabled: true
    externalControllerManagers:
      ## @param root-spire-server.controllerManager.externalControllerManagers.enabled Flag to enable external controller managers
      enabled: true
    validatingWebhookConfiguration:
      ## @param root-spire-server.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
      enabled: false
    ## @param root-spire-server.controllerManager.className specify to use an explicit class name.
    className: spire-mgmt-root-server
    identities:
      clusterSPIFFEIDs:
        child-servers:
          ## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable child servers
          enabled: true
        default:
          ## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable the default cluster spiffe id
          enabled: false
        oidc-discovery-provider:
          ## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled Enable the test-keys identity
          enabled: false
        test-keys:
          ## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable the test-keys identity
          enabled: false
  externalControllerManagers:
    ## @param root-spire-server.externalControllerManagers.enabled Flag to enable external controller managers
    enabled: true
  nodeAttestor:
    k8sPSAT:
      ## @param root-spire-server.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor
      serviceAccountAllowList:
        - spire-agent-upstream
  ## @param root-spire-server.bundleConfigMap The name of the configmap to store the upstream bundle
  bundleConfigMap: spire-bundle-upstream

# Used with tags [nestedChildFull]
external-root-spire-server-full:
  ## @param external-root-spire-server-full.externalServer Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers.
  externalServer: true
  ## @param external-root-spire-server-full.nameOverride Name override
  nameOverride: root-server
  ## @param external-root-spire-server-full.crNameOverride Custom Resource name override
  crNameOverride: root
  controllerManager:
    ## @param external-root-spire-server-full.controllerManager.enabled Enable controller manager and provision CRD's
    enabled: true
    validatingWebhookConfiguration:
      ## @param external-root-spire-server-full.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
      enabled: false
    ## @param external-root-spire-server-full.controllerManager.className specify to use an explicit class name.
    className: spire-mgmt-external-server
    identities:
      clusterSPIFFEIDs:
        child-servers:
          ## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable child servers
          enabled: true
          ## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.child-servers.labels [object] Default label spire.spiffe.io/child-server is set to enable label-based informer filtering on the root cluster's external controller manager.
          labels:
            spire.spiffe.io/child-server: "true"
        default:
          ## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable the default cluster spiffe id
          enabled: false
        oidc-discovery-provider:
          ## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled Enable the test-keys identity
          enabled: false
        test-keys:
          ## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable the test-keys identity
          enabled: false
  nodeAttestor:
    k8sPSAT:
      ## @param external-root-spire-server-full.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor
      serviceAccountAllowList:
        - spire-agent-upstream
  ## @param external-root-spire-server-full.bundleConfigMap The name of the configmap to store the upstream bundle
  bundleConfigMap: spire-bundle-upstream

# Used with tags [nestedChildSecurity]
external-root-spire-server-security:
  ## @param external-root-spire-server-security.externalServer Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers.
  externalServer: true
  ## @param external-root-spire-server-security.nameOverride Name override
  nameOverride: root-server
  ## @param external-root-spire-server-security.crNameOverride Custom Resource name override
  crNameOverride: root
  controllerManager:
    ## @param external-root-spire-server-security.controllerManager.enabled Enable controller manager and provision CRD's
    enabled: true
    validatingWebhookConfiguration:
      ## @param external-root-spire-server-security.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
      enabled: false
    ## @param external-root-spire-server-security.controllerManager.className specify to use an explicit class name.
    className: spire-mgmt-external-server
  nodeAttestor:
    k8sPSAT:
      ## @param external-root-spire-server-security.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor
      serviceAccountAllowList:
        - spire-agent-upstream
  ## @param external-root-spire-server-security.bundleConfigMap The name of the configmap to store the upstream bundle
  bundleConfigMap: spire-bundle-upstream

## @section Spire server parameters
## Parameter values for Spire server
##
# Used with tags [nestedRoot, nestedChildFull]
internal-spire-server:
  # enabled: true
  ## @param internal-spire-server.nameOverride Overrides the name of Spire server pods
  nameOverride: internal-server
  controllerManager:
    ## @param internal-spire-server.controllerManager.enabled Enable controller manager and provision CRD's
    enabled: true
    identities:
      clusterSPIFFEIDs:
        oidc-discovery-provider:
          ## @param internal-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames Auto populate dns entries
          autoPopulateDNSNames: false
  externalControllerManagers:
    ## @param internal-spire-server.externalControllerManagers.enabled Flag to enable external controller managers
    enabled: true
  upstreamAuthority:
    spire:
      ## @param internal-spire-server.upstreamAuthority.spire.enabled Enable upstream SPIRE server
      enabled: true
      ## @param internal-spire-server.upstreamAuthority.spire.upstreamDriver Use an upstream driver for authentication
      upstreamDriver: upstream.csi.spiffe.io
      server:
        ## @param internal-spire-server.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server
        nameOverride: root-server
  ## @param internal-spire-server.bundleConfigMap The name of the configmap to store the downstream bundle
  bundleConfigMap: spire-bundle-downstream

# Used with tags [nestedRoot]
external-spire-server:
  # enabled: true
  ## @param external-spire-server.nameOverride Overrides the name of Spire server pods
  nameOverride: external-server
  ## @param external-spire-server.crNameOverride Custom Resource name override
  crNameOverride: external
  controllerManager:
    ## @param external-spire-server.controllerManager.enabled Enable controller manager and provision CRD's
    enabled: true
    validatingWebhookConfiguration:
      ## @param external-spire-server.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
      enabled: false
    ## @param external-spire-server.controllerManager.className specify to use an explicit class name.
    className: spire-mgmt-external-server
    identities:
      clusterSPIFFEIDs:
        default:
          ## @param external-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable the default identity
          enabled: false
        oidc-discovery-provider:
          ## @param external-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled Enable the oidc-discovery-provider identity
          enabled: false
        test-keys:
          ## @param external-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable the test-keys identity
          enabled: false
  externalControllerManagers:
    ## @param external-spire-server.externalControllerManagers.enabled Flag to enable external controller managers
    enabled: true
  upstreamAuthority:
    spire:
      ## @param external-spire-server.upstreamAuthority.spire.enabled Enable upstream SPIRE server
      enabled: true
      ## @param external-spire-server.upstreamAuthority.spire.upstreamDriver Use an upstream driver for authentication
      upstreamDriver: upstream.csi.spiffe.io
      server:
        ## @param external-spire-server.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server
        nameOverride: root-server
  bundlePublisher:
    k8sConfigMap:
      ## @param external-spire-server.bundlePublisher.k8sConfigMap.enabled Enable local k8s bundle uploader
      enabled: false
  nodeAttestor:
    k8sPSAT:
      ## @param external-spire-server.nodeAttestor.k8sPSAT.enabled Enable PSAT k8s nodeattestor
      enabled: false
    joinToken:
      ## @param external-spire-server.nodeAttestor.joinToken.enabled Enable the join_token nodeattestor
      enabled: true

# Used with tags [haAgentCommon]
spiffe-csi-driver:
  # enabled: true
  ## @param spiffe-csi-driver.fullnameOverride Fullname override
  fullnameOverride: spiffe-csi-driver
  ## @param spiffe-csi-driver.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
  agentSocketPath: /var/run/spire/agent-sockets/spire-agent.sock
  healthChecks:
    ## @param spiffe-csi-driver.healthChecks.port Health check port number for upstream Spire agent
    port: 9814

# Used with tags [haAgentCommon]
spire-ha-agent:
  # enabled: true
  ## @param spire-ha-agent.fullnameOverride Fullname override
  fullnameOverride: spire-ha-agent

## @section Upstream SPIFFE CSI Driver for Bottom Turtle HA A parameters
## Parameter values for upstream spiffe-csi-driver-bottom-turtle-ha-a
##
# Used with tags [bottomTurtleHAA]
upstream-spiffe-csi-driver-bottom-turtle-ha-a:
  # enabled: true
  ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.fullnameOverride Fullname override
  fullnameOverride: spiffe-csi-driver-upstream-a
  ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.pluginName The plugin name for configuring upstream Spiffe CSI driver
  pluginName: upstream-a.csi.spiffe.io
  ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
  agentSocketPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public/spire-agent.sock
  healthChecks:
    ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.healthChecks.port The port where Spiffe CSI driver health checks are exposed
    port: 9810
  validatingAdmissionPolicy:
    ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.validatingAdmissionPolicy.enabled Flag to enable validating policy
    enabled: true

## @section Upstream SPIFFE CSI Driver for Bottom Turtle HA B parameters
## Parameter values for upstream spiffe-csi-driver-bottom-turtle-ha-b
##
# Used with tags [bottomTurtleHAB]
upstream-spiffe-csi-driver-bottom-turtle-ha-b:
  # enabled: true
  ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.fullnameOverride Fullname override
  fullnameOverride: spiffe-csi-driver-upstream-b
  ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.pluginName The plugin name for configuring upstream Spiffe CSI driver
  pluginName: upstream-b.csi.spiffe.io
  ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
  agentSocketPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public/spire-agent.sock
  healthChecks:
    ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.healthChecks.port The port where Spiffe CSI driver health checks are exposed
    port: 9812
  validatingAdmissionPolicy:
    ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.validatingAdmissionPolicy.enabled Flag to enable validating policy
    enabled: true

## @section Spire server parameters
## Parameter values for Spire server
##
# Used with tags [bottomTurtleHAA]
internal-spire-server-bottom-turtle-ha-a:
  # enabled: true
  ## @param internal-spire-server-bottom-turtle-ha-a.nameOverride Overrides the name of Spire server pods
  nameOverride: internal-server
  ## @param internal-spire-server-bottom-turtle-ha-a.caKeyType Key type to use for the ca
  caKeyType: ec-p256
  experimental:
    ## @param internal-spire-server-bottom-turtle-ha-a.experimental.enabled enable experimental features
    enabled: true
    ## @param internal-spire-server-bottom-turtle-ha-a.experimental.agentSPIFFEIDAsSelector enable adding spiffe_id selectors to all agents
    agentSPIFFEIDAsSelector: true
  dynamicRegistration:
    ## @param internal-spire-server-bottom-turtle-ha-a.dynamicRegistration.enabled Enable dynamic registration
    enabled: true
    ## @param internal-spire-server-bottom-turtle-ha-a.dynamicRegistration.allowedIDPrefix The allowed ID prefix
    allowedIDPrefix: "spire/agent/x509pop/k8s"
    ## @param internal-spire-server-bottom-turtle-ha-a.dynamicRegistration.serviceAccount The service account to allow in for dynamic registration
    serviceAccount: spire-a-agent
  controllerManager:
    ## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.enabled Enable controller manager and provision CRD's
    enabled: true
    ## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.parentIDTemplate parent id template
    parentIDTemplate: "spiffe://{{ .TrustDomain }}/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"
    identities:
      clusterSPIFFEIDs:
        oidc-discovery-provider:
          ## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames Auto populate dns entries
          autoPopulateDNSNames: false
          ## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type The type of the entry
          type: oidc-discovery-provider-common
        spire-ha-agent:
          ## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled Enables the spire-ha-agent identity
          enabled: true
        spire-identity-exchange-service:
          ## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.federatesWith [array] List of trust domains to federate with
          federatesWith:
            - spire-ha
  persistence:
    ## @param internal-spire-server-bottom-turtle-ha-a.persistence.type What type to use for peristence
    type: emptyDir
  nodeAttestor:
    k8sPSAT:
      ## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.k8sPSAT.enabled Enable the k8s projected access token node attestor
      enabled: false
    x509POP:
      ## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
      enabled: true
      ## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.spiffePrefix What prefix to use when mode is spiffe
      spiffePrefix: /spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/
      ## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
      agentPathTemplate: "/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}"
      addClusterName:
        ## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.spiffePrefix Suffix the cluster name onto the spiffePrefix
        spiffePrefix: true
        ## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
        agentPathTemplate: true
  upstreamAuthority:
    spire:
      ## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.enabled Enable upstream SPIRE server
      enabled: true
      ## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.upstreamDriver Use an upstream driver for authentication
      upstreamDriver: upstream-a.csi.spiffe.io
      server:
        ## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server
        nameOverride: root-server
        ## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.server.address Address for upstream Spire server
        address: "spire-server-a"
        ## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.server.port The port setting of the root SPIRE server
        port: 8081
  ## @param internal-spire-server-bottom-turtle-ha-a.bundleConfigMap The name of the configmap to store the downstream bundle
  bundleConfigMap: spire-server-a-bundle
  trustSync:
    ## @param internal-spire-server-bottom-turtle-ha-a.trustSync.enabled Enable trust syncing
    enabled: true
    ## @param internal-spire-server-bottom-turtle-ha-a.trustSync.domains the trust domains to sync
    domains:
    - spire-ha

## @section Spire server parameters
## Parameter values for Spire server
##
# Used with tags [bottomTurtleHAB]
internal-spire-server-bottom-turtle-ha-b:
  # enabled: true
  ## @param internal-spire-server-bottom-turtle-ha-b.nameOverride Overrides the name of Spire server pods
  nameOverride: internal-server
  ## @param internal-spire-server-bottom-turtle-ha-b.caKeyType Key type to use for the ca
  caKeyType: ec-p256
  experimental:
    ## @param internal-spire-server-bottom-turtle-ha-b.experimental.enabled enable experimental features
    enabled: true
    ## @param internal-spire-server-bottom-turtle-ha-b.experimental.agentSPIFFEIDAsSelector enable adding spiffe_id selectors to all agents
    agentSPIFFEIDAsSelector: true
  dynamicRegistration:
    ## @param internal-spire-server-bottom-turtle-ha-b.dynamicRegistration.enabled Enable dynamic registration
    enabled: true
    ## @param internal-spire-server-bottom-turtle-ha-b.dynamicRegistration.allowedIDPrefix The allowed ID prefix
    allowedIDPrefix: "spire/agent/x509pop/k8s"
    ## @param internal-spire-server-bottom-turtle-ha-b.dynamicRegistration.serviceAccount The service account to allow in for dynamic registration
    serviceAccount: spire-b-agent
  controllerManager:
    ## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.enabled Enable controller manager and provision CRD's
    enabled: true
    ## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.parentIDTemplate parent id template
    parentIDTemplate: "spiffe://{{ .TrustDomain }}/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"
    identities:
      clusterSPIFFEIDs:
        oidc-discovery-provider:
          ## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames Auto populate dns entries
          autoPopulateDNSNames: false
          ## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type The type of the entry
          type: oidc-discovery-provider-common
        spire-ha-agent:
          ## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled Enables the spire-ha-agent identity
          enabled: true
        spire-identity-exchange-service:
          ## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.federatesWith [array] List of trust domains to federate with
          federatesWith:
            - spire-ha
  persistence:
    ## @param internal-spire-server-bottom-turtle-ha-b.persistence.type What type to use for peristence
    type: emptyDir
  nodeAttestor:
    k8sPSAT:
      ## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.k8sPSAT.enabled Enable the k8s projected access token node attestor
      enabled: false
    x509POP:
      ## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
      enabled: true
      ## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.spiffePrefix What prefix to use when mode is spiffe
      spiffePrefix: /spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/
      ## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
      agentPathTemplate: "/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}"
      addClusterName:
        ## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.spiffePrefix Suffix the cluster name onto the spiffePrefix
        spiffePrefix: true
        ## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
        agentPathTemplate: true
  upstreamAuthority:
    spire:
      ## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.enabled Enable upstream SPIRE server
      enabled: true
      ## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.upstreamDriver Use an upstream driver for authentication
      upstreamDriver: upstream-b.csi.spiffe.io
      server:
        ## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server
        nameOverride: root-server
        ## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.address Address for upstream Spire server
        address: "spire-server-b"
        ## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.port The port setting of the root SPIRE server
        port: 8081
  ## @param internal-spire-server-bottom-turtle-ha-b.bundleConfigMap The name of the configmap to store the downstream bundle
  bundleConfigMap: spire-server-b-bundle
  trustSync:
    ## @param internal-spire-server-bottom-turtle-ha-b.trustSync.enabled Enable trust syncing
    enabled: true
    ## @param internal-spire-server-bottom-turtle-ha-b.trustSync.domains the trust domains to sync
    domains:
    - spire-ha

# Used with tags [bottomTurtleHAA]
downstream-spire-agent-bottom-turtle-ha-a:
  # enabled: true
  ## @param downstream-spire-agent-bottom-turtle-ha-a.nameOverride Overrides the name of Spire agent pods
  nameOverride: agent-downstream
  server:
    ## @param downstream-spire-agent-bottom-turtle-ha-a.server.nameOverride The name override setting of the internal SPIRE server
    nameOverride: internal-server
  ## @param downstream-spire-agent-bottom-turtle-ha-a.bundleConfigMap The name of the configmap that contains the downstream bundle
  bundleConfigMap: spire-server-a-bundle
  ## @param downstream-spire-agent-bottom-turtle-ha-a.persistence.hostPath Which path to use on the host when persistence.type = hostPath
  persistence:
    hostPath: /var/lib/spire/k8s/downstream-agent-a
  dynamicRegistration:
    ## @param downstream-spire-agent-bottom-turtle-ha-a.dynamicRegistration.enabled Enable dynamic registration
    enabled: true
    ## @param downstream-spire-agent-bottom-turtle-ha-a.dynamicRegistration.nameOverride The name override to use to contact the server
    nameOverride: internal-server
  nodeAttestor:
    k8sPSAT:
      ## @param downstream-spire-agent-bottom-turtle-ha-a.nodeAttestor.k8sPSAT.enabled Enable the k8s projected access token node attestor
      enabled: false
    x509POP:
      ## @param downstream-spire-agent-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
      enabled: true
      ## @param downstream-spire-agent-bottom-turtle-ha-a.nodeAttestor.x509POP.spiffeEndpointSocket Where the socket is to use for mode spiffe
      spiffeEndpointSocket: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public/api.sock
  keyManager:
    memory:
      ## @param downstream-spire-agent-bottom-turtle-ha-a.keyManager.memory.enabled Enable the memory based Key Manager
      enabled: false
    disk:
      ## @param downstream-spire-agent-bottom-turtle-ha-a.keyManager.disk.enabled Enable the disk key manager
      enabled: true
      ## @param downstream-spire-agent-bottom-turtle-ha-a.keyManager.disk.mode Where the disk plugin will write out its data
      mode: emptyDir
  healthChecks:
    ## @param downstream-spire-agent-bottom-turtle-ha-a.healthChecks.port Health check port
    port: 9981
  telemetry:
    prometheus:
      ## @param downstream-spire-agent-bottom-turtle-ha-a.telemetry.prometheus.port Prometheus port to use
      port: 9989
  ## @param downstream-spire-agent-bottom-turtle-ha-a.socketPath Socket path to use
  socketPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
  sockets:
    ## @param downstream-spire-agent-bottom-turtle-ha-a.sockets.hostBasePath Path on the host to place sockets
    hostBasePath: /var/run/spire/agent/sockets/a
    admin:
      ## @param downstream-spire-agent-bottom-turtle-ha-a.sockets.admin.enabled Enable admin socket
      enabled: true
      ## @param downstream-spire-agent-bottom-turtle-ha-a.sockets.admin.mountOnHost Mount admin socket on host
      mountOnHost: true
  ## @param downstream-spire-agent-bottom-turtle-ha-a.authorizedDelegates List of workloads able to use the delegation api
  authorizedDelegates:
  - /spire-ha-agent
  brokerAPI:
    brokers:
      spire-ha-agent:
        ## @param downstream-spire-agent-bottom-turtle-ha-a.brokerAPI.brokers.spire-ha-agent.enabled Enable the spire-ha-agent by default
        enabled: true
  workloadAttestors:
    k8s:
      brokerAPI:
        ## @param downstream-spire-agent-bottom-turtle-ha-a.workloadAttestors.k8s.brokerAPI.accessPolicy The default accessPolicy
        accessPolicy: permissive
        brokers:
          spire-ha-agent:
            ## @param downstream-spire-agent-bottom-turtle-ha-a.workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled Enable the spire-ha-agent by default
            enabled: true

# Used with tags [bottomTurtleHAB]
downstream-spire-agent-bottom-turtle-ha-b:
  # enabled: true
  ## @param downstream-spire-agent-bottom-turtle-ha-b.nameOverride Overrides the name of Spire agent pods
  nameOverride: agent-downstream
  server:
    ## @param downstream-spire-agent-bottom-turtle-ha-b.server.nameOverride The name override setting of the internal SPIRE server
    nameOverride: internal-server
  ## @param downstream-spire-agent-bottom-turtle-ha-b.bundleConfigMap The name of the configmap that contains the downstream bundle
  bundleConfigMap: spire-server-b-bundle
  ## @param downstream-spire-agent-bottom-turtle-ha-b.persistence.hostPath Which path to use on the host when persistence.type = hostPath
  persistence:
    hostPath: /var/lib/spire/k8s/downstream-agent-b
  dynamicRegistration:
    ## @param downstream-spire-agent-bottom-turtle-ha-b.dynamicRegistration.enabled Enable dynamic registration
    enabled: true
    ## @param downstream-spire-agent-bottom-turtle-ha-b.dynamicRegistration.nameOverride The name override to use to contact the server
    nameOverride: internal-server
  nodeAttestor:
    k8sPSAT:
      ## @param downstream-spire-agent-bottom-turtle-ha-b.nodeAttestor.k8sPSAT.enabled Enable the k8s projected access token node attestor
      enabled: false
    x509POP:
      ## @param downstream-spire-agent-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
      enabled: true
      ## @param downstream-spire-agent-bottom-turtle-ha-b.nodeAttestor.x509POP.spiffeEndpointSocket Where the socket is to use for mode spiffe
      spiffeEndpointSocket: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public/api.sock
  keyManager:
    memory:
      ## @param downstream-spire-agent-bottom-turtle-ha-b.keyManager.memory.enabled Enable the memory based Key Manager
      enabled: false
    disk:
      ## @param downstream-spire-agent-bottom-turtle-ha-b.keyManager.disk.enabled Enable the disk key manager
      enabled: true
      ## @param downstream-spire-agent-bottom-turtle-ha-b.keyManager.disk.mode Where the disk plugin will write out its data
      mode: emptyDir
  healthChecks:
    ## @param downstream-spire-agent-bottom-turtle-ha-b.healthChecks.port Health check port
    port: 9982
  telemetry:
    prometheus:
      ## @param downstream-spire-agent-bottom-turtle-ha-b.telemetry.prometheus.port Prometheus port to use
      port: 9990
  ## @param downstream-spire-agent-bottom-turtle-ha-b.socketPath Socket path to use
  socketPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock
  sockets:
    ## @param downstream-spire-agent-bottom-turtle-ha-b.sockets.hostBasePath Path on the host to place sockets
    hostBasePath: /var/run/spire/agent/sockets/b
    admin:
      ## @param downstream-spire-agent-bottom-turtle-ha-b.sockets.admin.enabled Enable admin socket
      enabled: true
      ## @param downstream-spire-agent-bottom-turtle-ha-b.sockets.admin.mountOnHost Mount admin socket on host
      mountOnHost: true
  ## @param downstream-spire-agent-bottom-turtle-ha-b.authorizedDelegates List of workloads able to use the delegation api
  authorizedDelegates:
  - /spire-ha-agent
  brokerAPI:
    brokers:
      spire-ha-agent:
        ## @param downstream-spire-agent-bottom-turtle-ha-b.brokerAPI.brokers.spire-ha-agent.enabled Enable the spire-ha-agent by default
        enabled: true
  workloadAttestors:
    k8s:
      brokerAPI:
        ## @param downstream-spire-agent-bottom-turtle-ha-b.workloadAttestors.k8s.brokerAPI.accessPolicy The default accessPolicy
        accessPolicy: permissive
        brokers:
          spire-ha-agent:
            ## @param downstream-spire-agent-bottom-turtle-ha-b.workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled Enable the spire-ha-agent by default
            enabled: true

# Used with tags [bottomTurtleHAA]
downstream-spiffe-csi-driver-bottom-turtle-ha-a:
  # enabled: true
  ## @param downstream-spiffe-csi-driver-bottom-turtle-ha-a.fullnameOverride Fullname override
  fullnameOverride: spiffe-csi-driver-downstream-a
  ## @param downstream-spiffe-csi-driver-bottom-turtle-ha-a.agentSocketPath path to agent socket
  agentSocketPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
  ## @param downstream-spiffe-csi-driver-bottom-turtle-ha-a.pluginName The name of the plugin instance
  pluginName: a.csi.spiffe.io
  healthChecks:
    ## @param downstream-spiffe-csi-driver-bottom-turtle-ha-a.healthChecks.port The health check port
    port: 9814

# Used with tags [bottomTurtleHAB]
downstream-spiffe-csi-driver-bottom-turtle-ha-b:
  # enabled: true
  ## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.fullnameOverride Fullname override
  fullnameOverride: spiffe-csi-driver-downstream-b
  ## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.agentSocketPath path to agent socket
  agentSocketPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock
  ## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.pluginName The name of the plugin instance
  pluginName: b.csi.spiffe.io
  healthChecks:
    ## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.healthChecks.port The health check port
    port: 9816

spire-identity-exchange-bottom-turtle-ha-a:
  ## @param spire-identity-exchange-bottom-turtle-ha-a.enabled Enable the spire-identity-exchange
  enabled: false
  ## @param spire-identity-exchange-bottom-turtle-ha-a.nameOverride name override
  nameOverride: identity-exchange
  ## @param spire-identity-exchange-bottom-turtle-ha-a.csiDriverName CSI driver name to use
  csiDriverName: a.csi.spiffe.io
  tls:
    rest:
      ingress:
        ## @param spire-identity-exchange-bottom-turtle-ha-a.tls.rest.ingress.host Hostname override for the rest ingress service
        host: "spire-identity-exchange-a-rest"
    grpc:
      ingress:
        ## @param spire-identity-exchange-bottom-turtle-ha-a.tls.grpc.ingress.host Hostname override for the grpc ingress service
        host: "spire-identity-exchange-a-grpc"
  spiffe:
    rest:
      ingress:
        ## @param spire-identity-exchange-bottom-turtle-ha-a.spiffe.rest.ingress.host Hostname override for the SVID-served rest ingress service
        host: "spire-identity-exchange-a-rest-spiffe"
    grpc:
      ingress:
        ## @param spire-identity-exchange-bottom-turtle-ha-a.spiffe.grpc.ingress.host Hostname override for the SVID-served grpc ingress service
        host: "spire-identity-exchange-a-grpc-spiffe"
  server:
    ## @param spire-identity-exchange-bottom-turtle-ha-a.server.nameOverride The name override setting of the internal SPIRE server
    nameOverride: internal-server
  auth:
    plugins:
      spiffe:
        ## @param spire-identity-exchange-bottom-turtle-ha-a.auth.plugins.spiffe.csiDriverName The csi driver the spiffe plugin reads its trust bundle from. The shared ha-agent, since that is what mints the oidc discovery provider's serving svid.
        csiDriverName: csi.spiffe.io
        config:
          ## @param spire-identity-exchange-bottom-turtle-ha-a.auth.plugins.spiffe.config.discoveryURL The OIDC discovery provider to fetch keys from. This chart gives it a fullnameOverride, so the keySource convention does not apply.
          discoveryURL: https://spiffe-oidc-discovery-provider

spire-identity-exchange-bottom-turtle-ha-b:
  ## @param spire-identity-exchange-bottom-turtle-ha-b.enabled Enable the spire-identity-exchange
  enabled: false
  ## @param spire-identity-exchange-bottom-turtle-ha-b.nameOverride name override
  nameOverride: identity-exchange
  ## @param spire-identity-exchange-bottom-turtle-ha-b.csiDriverName CSI driver name to use
  csiDriverName: b.csi.spiffe.io
  server:
    ## @param spire-identity-exchange-bottom-turtle-ha-b.server.nameOverride The name override setting of the internal SPIRE server
    nameOverride: internal-server
  tls:
    rest:
      ingress:
        ## @param spire-identity-exchange-bottom-turtle-ha-b.tls.rest.ingress.host Hostname override for the rest ingress service
        host: "spire-identity-exchange-b-rest"
    grpc:
      ingress:
        ## @param spire-identity-exchange-bottom-turtle-ha-b.tls.grpc.ingress.host Hostname override for the grpc ingress service
        host: "spire-identity-exchange-b-grpc"
  spiffe:
    rest:
      ingress:
        ## @param spire-identity-exchange-bottom-turtle-ha-b.spiffe.rest.ingress.host Hostname override for the SVID-served rest ingress service
        host: "spire-identity-exchange-b-rest-spiffe"
    grpc:
      ingress:
        ## @param spire-identity-exchange-bottom-turtle-ha-b.spiffe.grpc.ingress.host Hostname override for the SVID-served grpc ingress service
        host: "spire-identity-exchange-b-grpc-spiffe"
  auth:
    plugins:
      spiffe:
        ## @param spire-identity-exchange-bottom-turtle-ha-b.auth.plugins.spiffe.csiDriverName The csi driver the spiffe plugin reads its trust bundle from. The shared ha-agent, since that is what mints the oidc discovery provider's serving svid.
        csiDriverName: csi.spiffe.io
        config:
          ## @param spire-identity-exchange-bottom-turtle-ha-b.auth.plugins.spiffe.config.discoveryURL The OIDC discovery provider to fetch keys from. This chart gives it a fullnameOverride, so the keySource convention does not apply.
          discoveryURL: https://spiffe-oidc-discovery-provider