panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
752a26565a6c06b7f5cbba21c97ec4a18f16cff5
helm-charts-hardened/charts/spire/charts/spire-server/values.yaml
T
Michael Munchandkfox1111 1ce42d587a fix(spire-server): support postgres TLS client-certificate (passwordless) auth (#922) 
* fix(spire-server): support postgres TLS client-certificate (passwordless) auth

The postgres datastore always injected a password into the connection
string, always created the -dbpw Secret, and always set the DBPW env var,
with no way to use TLS client-certificate (or IAM) authentication. This
forced a dummy password (e.g. "unused") when authenticating with certs.

- Map dataStore.sql.rootCAPath / clientCertPath / clientKeyPath to the
  postgres connection-string options sslrootcert / sslcert / sslkey
  (previously these were mysql-only and rejected for postgres). MySQL keeps
  using the root_ca_path / client_cert_path / client_key_path plugin fields,
  now correctly gated to mysql/aws_mysql only.
- For postgres/aws_postgres, when dataStore.sql.password is empty, omit
  "password=${DBPW}" from the connection string and skip creating the -dbpw
  Secret and the DBPW/RODBPW env vars (mirrors the existing gcp_mysql_sa_iam
  passwordless behavior).
- Add a guard: for postgres, dataStore.sql.password and clientCertPath are
  mutually exclusive.
- Fix a stray tab in the mysql client_key_path config field.
- Update value docs and regenerate the README.

Existing configurations with a password set are unaffected.

Signed-off-by: Michael Munch <[email protected]>

* 🐛 fix(spire-server): keep postgres password when external secret is used

The postgres passwordless path keyed only on an empty password, so
enabling dataStore.sql.externalSecret (or readOnly.externalSecret) with
an empty password dropped the password token from the connection string
and skipped the DBPW/RODBPW env vars, breaking external-secret auth.

- Add shared passwordless predicates that also require external secrets
  to be disabled, evaluated independently for read-write and read-only.
- Use the predicates in datastore-config, secret.yaml, and
  server-resource.yaml so the gating cannot drift.
- Add unit tests for postgres with read-write and read-only external
  secrets plus the cert-auth passwordless case.

Signed-off-by: Michael Munch <[email protected]>

* 🔁 ci: re-trigger checks

Re-run CI; the previous spiffe-step-ssh integration job failed on an
unrelated flaky SSH host-key verification on k8s v1.35.1 (passed on
v1.33.7 and v1.34.3).

Signed-off-by: Michael Munch <[email protected]>

---------

Signed-off-by: Michael Munch <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
2026-08-20 11:15:26 -07:00

1690 lines
92 KiB
YAML
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# Default configuration for Spire server
# SPDX-License-Identifier: APACHE-2.0
## @skip global
global: {}
## @section Chart parameters
##
## @param replicaCount SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database.
replicaCount: 1
## @param image.registry The OCI registry to pull the image from
## @param image.repository The repository within the registry
## @param image.pullPolicy The image pull policy
## @param image.tag Overrides the image tag whose default is the chart appVersion
##
image:
registry: ghcr.io
repository: spiffe/spire-server
pullPolicy: IfNotPresent
tag: ""
## @param kind Define SPIRE server deployment type. Can be statefulset/deployment. Defaults to statefulset if not set. This feature is experimental.
kind: statefulset
## @param updateStrategy [object] Rollout strategy for the server, mapped to spec.updateStrategy when kind is "statefulset" and to spec.strategy when kind is "deployment". Left empty the Kubernetes default applies, which for a Deployment surges a second server before the old one goes away. Set `{type: Recreate}` to keep at most one server running, as a memory keyManager or an in-memory datastore requires.
updateStrategy: {}
## @param externalServer Deploy only the bundle ConfigMap, RBAC rules, and identity documents but not the server. Use in a nested setup where the server is external.
externalServer: false
## @param externalServerSubject.kind RBAC subject kind the external (nested) server's downstream bindings are granted to. One of "User" (client-certificate identity, the historical default), "Group", or "ServiceAccount" (e.g. for a static-token kubeconfig). Only used when externalServer is true.
## @param externalServerSubject.name Name of the subject. For kind "User" it must match the CN of the client certificate the external server presents; for kind "Group" it is the group name (e.g. a certificate O value); for kind "ServiceAccount" it is the name of the (operator-managed, out-of-band) ServiceAccount.
## @param externalServerSubject.namespace Namespace of the ServiceAccount. Only used when kind is "ServiceAccount"; empty uses the server namespace.
externalServerSubject:
kind: User
name: spire-root
namespace: ""
## @param imagePullSecrets [array] Pull secrets for images
imagePullSecrets: []
## @param nameOverride Name override
nameOverride: ""
## @param crNameOverride Name override for any custom resources
crNameOverride: ""
## @param namespaceOverride Namespace override
namespaceOverride: ""
## @param fullnameOverride Fullname override
fullnameOverride: ""
## @param serviceAccount.create Specifies whether a service account should be created
## @param serviceAccount.annotations [object] Annotations to add to the service account
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
##
serviceAccount:
create: true
annotations: {}
name: ""
## @param podAnnotations [object] Annotations to add to pods
podAnnotations: {}
## @param podLabels [object] Labels to add to pods
podLabels: {}
## @param podSecurityContext [object] Pod security context
podSecurityContext: {}
# fsGroup: 2000
## @param securityContext [object] Security context
securityContext: {}
# capabilities:
# drop:
# - ALL
# readOnlyRootFilesystem: true
# runAsNonRoot: true
# runAsUser: 1000
## @param priorityClassName Priority class assigned to statefulset pods. Can be auto set with global.recommendations.priorityClassName.
priorityClassName: ""
## @param service.type Type of the Spire server service created
## @param service.port Port for the created service
## @param service.annotations [object] Annotations to add to the service object
##
service:
type: ClusterIP
port: 443
annotations: {}
## @param service.loadBalancerIP IP address to assign to load balancer (if supported)
loadBalancerIP: ""
## @param service.externalTrafficPolicy Traffic policy applied when service.type is LoadBalancer (e.g. "Local" to preserve client source IP). Defaults to "Cluster" when left empty.
externalTrafficPolicy: ""
configMap:
## @param configMap.annotations [object] Annotations to add to the SPIRE Server ConfigMap
annotations: {}
## @param resources [object] Resource requests and limits
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# requests:
# cpu: 200m
# memory: 256Mi
# limits:
# cpu: 200m
# memory: 256Mi
## @param autoscaling.enabled Flag to enable autoscaling
## @param autoscaling.minReplicas Minimum replicas for autoscaling
## @param autoscaling.maxReplicas Maximum replicas for autoscaling
## @param autoscaling.scaleOnSPIREServerOnly Flag to only consider the main SPIRE container for autoscaling purposes
## @param autoscaling.targetCPUUtilizationPercentage Target CPU utilization that triggers autoscaling
##
autoscaling:
enabled: false
minReplicas: 1
maxReplicas: 100
scaleOnSPIREServerOnly: false
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
## @param podDisruptionBudget.enabled Flag to enable a PodDisruptionBudget for the SPIRE server pods
## @param podDisruptionBudget.minAvailable Minimum number/percentage of pods that must remain available (mutually exclusive with maxUnavailable)
## @param podDisruptionBudget.maxUnavailable Maximum number/percentage of pods that can be unavailable (mutually exclusive with minAvailable)
##
podDisruptionBudget:
enabled: false
minAvailable: ""
maxUnavailable: ""
## @param nodeSelector [object] Select specific nodes to run on (currently only amd64 is supported by Tornjak)
nodeSelector: {}
## @param tolerations [array] List of tolerations
tolerations: []
## @param affinity [object] List of node affinities
affinity: {}
## @param topologySpreadConstraints [array] Topology spread constraints for resilience
topologySpreadConstraints: []
## @param terminationGracePeriodSeconds [nullable] Override the termination grace period for the pod. Increase to allow time for load balancer target deregistration and in-flight gRPC drain before SIGKILL.
terminationGracePeriodSeconds: ~
## @param livenessProbe.failureThreshold Failure threshold count for livenessProbe
## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
## @param livenessProbe.periodSeconds Period seconds for livenessProbe
## @param livenessProbe.timeoutSeconds Timeout in seconds for livenessProbe
##
livenessProbe:
failureThreshold: 2
initialDelaySeconds: 15
periodSeconds: 60
timeoutSeconds: 3
## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
## @param readinessProbe.periodSeconds Period seconds for readinessProbe
##
readinessProbe:
initialDelaySeconds: 5
periodSeconds: 5
## @param persistence.type What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing or nested child only)
## @param persistence.size What size volume to use for persistence
## @param persistence.accessMode What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended)
## @param persistence.storageClass What storage class to use for persistence
## @param persistence.hostPath Which path to use on the host when persistence.type = hostPath
##
persistence:
type: pvc
size: 1Gi
accessMode: ReadWriteOnce
storageClass: null
hostPath: ""
dataStore:
sql:
## @param dataStore.sql.databaseType Other supported databases are ["postgres", "mysql", "aws_postgresql", "aws_mysql", "gcp_mysql_sa_iam"]. Note: aws type databases are still experimental. gcp_mysql_sa_iam uses IAM authentication by default.
databaseType: sqlite3
## @param dataStore.sql.databaseName Only used when type != "sqlite3"
databaseName: spire
## @param dataStore.sql.host Only used when type != "sqlite3"
host: ""
## @param dataStore.sql.port If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases.
port: 0
## @param dataStore.sql.username Only used when type != "sqlite3"
username: spire
## @param dataStore.sql.password Only used when type != "sqlite3". For postgres/aws_postgres, leave empty to omit the password from the connection string (e.g. TLS client-certificate or IAM authentication).
password: ""
## @param dataStore.sql.file Data source file. Only used when type == "sqlite3" and inMemory is false
file: "/run/spire/data/datastore.sqlite3"
## @param dataStore.sql.inMemory Hold the sqlite3 datastore in memory instead of in a file, in which case `file` is unused. The datastore starts empty on every restart, so this only suits a single replica whose registration entries are recreated at startup, for example by the controller manager writing static entries. Required to run as a deployment on sqlite3, since a deployment has no durable per-pod storage.
inMemory: false
## @param dataStore.sql.options [array] takes an array of objects of form {<key>: <value>} to use when building the database connection string
options: []
## @param dataStore.sql.rootCAPath Path to Root CA bundle. Supports MySQL and postgres.
rootCAPath: ""
## @param dataStore.sql.clientCertPath Path to client certificate. Supports MySQL and postgres.
clientCertPath: ""
## @param dataStore.sql.clientKeyPath Path to private key for client certificate. Supports MySQL and postgres.
clientKeyPath: ""
## When an external source creates the secret. The secret should reside in the same namespace as the spire server
externalSecret:
## @param dataStore.sql.externalSecret.enabled Enable external secret for datastore creds
enabled: false
## @param dataStore.sql.externalSecret.name The name of the secret object
name: ""
## @param dataStore.sql.externalSecret.key The key of the secret object whose value is the dataStore.sql password
key: ""
## @param dataStore.sql.maxOpenConns The maximum number of open db connections
maxOpenConns: 100
## @param dataStore.sql.maxIdleConns The maximum number of idle connections in the pool
maxIdleConns: 2
## @param dataStore.sql.connMaxLifetime The maximum amount of time a connection may be reused. Supports duration strings (e.g., "1h", "30m", "3600s") or 0 for unlimited. Duration strings are recommended to prevent connection accumulation.
connMaxLifetime: 0
## @param dataStore.sql.disableMigration True to disable auto-migration functionality
disableMigration: false
## @param dataStore.sql.region Region to use when database type is either aws_mysql or aws_postgresql
region: ""
readOnly:
## @param dataStore.sql.readOnly.enabled Set to true to configure a readOnly dartabase connection
enabled: false
## @param dataStore.sql.readOnly.host Only used when type != "sqlite3"
host: ""
## @param dataStore.sql.readOnly.port If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases.
port: 0
## @param dataStore.sql.readOnly.username Only used when type != "sqlite3"
username: spire
## @param dataStore.sql.readOnly.password Only used when type != "sqlite3"
password: ""
## @param dataStore.sql.readOnly.options [array] Only used when type != "sqlite3"
options: []
## When an external source creates the secret. The secret should reside in the same namespace as the spire server
externalSecret:
## @param dataStore.sql.readOnly.externalSecret.enabled Enable external secret for datastore creds
enabled: false
## @param dataStore.sql.readOnly.externalSecret.name The name of the secret object
name: ""
## @param dataStore.sql.readOnly.externalSecret.key The key of the secret object whose value is the dataStore.sql password
key: ""
## @param adminIDs SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges.
adminIDs: []
## @param auditLogEnabled If true, enables audit logging
auditLogEnabled: false
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
logLevel: info
## @param logFormat The log format, valid values are "text" and "json"
logFormat: "text"
## @param jwtIssuer The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset
jwtIssuer: ""
## @param clusterName Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`)
clusterName: example-cluster
## @param trustDomain Set the trust domain to be used for the SPIFFE identifiers
trustDomain: example.org
## @param bundleConfigMap Set the Configmap name for SPIRE bundle
bundleConfigMap: spire-bundle
## @param clusterDomain This is the value of your clusters `kubeadm init --service-dns-domain` flag
clusterDomain: cluster.local
## @param jwtSVIDSupport If false, completely disables JWT-SVID functionality. The server will not generate JWT keys, sign JWT-SVIDs, or implement JWT-related API calls. This is useful for deployments that don’t need JWT-SVIDs support.
jwtSVIDSupport: true
federation:
## @param federation.enabled Flag to enable federation
enabled: false
bundleEndpoint:
## @param federation.bundleEndpoint.port Port value for trust bundle federation
port: 8443
## @param federation.bundleEndpoint.address Address for trust bundle federation
address: "0.0.0.0"
## @param federation.bundleEndpoint.refreshHint Hint used by federated servers on how often to refresh the bundle. CA TTL must be 3-5x the duration of this value to ensure public keys are loaded on federated servers prior to private key rotation on remote server.
refreshHint: "5m"
profile:
httpWeb:
## @param federation.bundleEndpoint.profile.httpWeb.fileSyncInterval Interval on which to reload the certificate/key from disk
fileSyncInterval: 1h
tls:
spire:
## @param federation.tls.spire.enabled Use spire to secure the federation bundle endpoint
enabled: true
externalSecret:
## @param federation.tls.externalSecret.enabled Provide your own certificate/key via tls style Kubernetes Secret
enabled: false
## @param federation.tls.externalSecret.secretName Specify which Secret to use
secretName: ""
certManager:
## @param federation.tls.certManager.enabled Use certificateManager to create the certificate
enabled: false
issuer:
## @param federation.tls.certManager.issuer.create Create an issuer to use to issue the certificate
create: true
acme:
## @param federation.tls.certManager.issuer.acme.email Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service
email: ""
## @param federation.tls.certManager.issuer.acme.server Server to use to get certificate. Defaults to LetsEncrypt
server: https://acme-v02.api.letsencrypt.org/directory
# Testing server: https://acme-staging-v02.api.letsencrypt.org/directory
## @param federation.tls.certManager.issuer.acme.solvers [object] Configure the issuer solvers. Defaults to http01 via ingress.
solvers: {}
# - http01:
# ingress:
# ingressClassName: nginx
certificate:
## @param federation.tls.certManager.certificate.dnsNames Override the dnsNames on the certificate request. Defaults to the same settings as Ingress
dnsNames: []
## @param federation.tls.certManager.certificate.issuerRef.group If you are using an external plugin, specify the group for it here
## @param federation.tls.certManager.certificate.issuerRef.kind Kind of the issuer reference. Override if you want to use a ClusterIssuer
## @param federation.tls.certManager.certificate.issuerRef.name Name of the issuer to use. If unset, it will use the name of the built in issuer
issuerRef:
group: ""
kind: Issuer
name: ""
ingress:
## @param federation.ingress.enabled Flag to enable ingress for federation
enabled: false
## @param federation.ingress.className Ingress class name for federation
className: ""
## @param federation.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
controllerType: ""
## @param federation.ingress.annotations [object] Annotations for the ingress object
annotations: {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
# If Profile Type == https_spiffe:
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
## @param federation.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
host: "spire-server-federation"
## @param federation.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
tlsSecret: ""
## @param federation.ingress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
hosts: []
# - host: spire-server-federation.example.org
# paths:
# - path: /
# pathType: Prefix
## @param federation.ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
tls: []
# - hosts:
# - spire-server-federation.example.org
# If Profile Type == https_web:
# secretName: spire-server-federation-tls
gatewayAPI:
## @param federation.gatewayAPI.enabled Flag to expose the federation endpoint via Gateway API (TLS passthrough)
enabled: false
## @param federation.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
host: "spire-server-federation"
## @param federation.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
annotations: {}
listenerSet:
## @param federation.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
enabled: null
## @param federation.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
parentRefs: []
## @param federation.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
sectionName: ""
caSubject:
## @param caSubject.country Country for Spire server CA
country: ARPA
## @param caSubject.organization Organization for Spire server CA
organization: Example
## @param caSubject.commonName Common Name for Spire server CA
commonName: example.org
credentialComposer:
cel:
## @param credentialComposer.cel.enabled Enable the cel based credential composer
enabled: false
## @param credentialComposer.cel.image.registry The OCI registry to pull the image from
## @param credentialComposer.cel.image.repository The repository within the registry
## @param credentialComposer.cel.image.pullPolicy The image pull policy
## @param credentialComposer.cel.image.tag Overrides the image tag
##
image:
registry: ghcr.io
repository: spiffe/spire-credentialcomposer-cel
pullPolicy: IfNotPresent
tag: "0.0.2"
## @param credentialComposer.cel.checksum The sha256 checksum of the plugin binary
checksum: 23fa1d10f15ad5d5c555930cf82289c664801d7d5609bfd8847f95a0a667e4e4
## @param credentialComposer.cel.pluginPath The filename in the container of the plugin
pluginPath: /ko-app/cmd
jwt:
## @param credentialComposer.cel.jwt.expression The expression to use for jwt token composing
expression: ""
#expression: |
# spire.plugin.server.credentialcomposer.v1.ComposeWorkloadJWTSVIDResponse{
# attributes: spire.plugin.server.credentialcomposer.v1.JWTSVIDAttributes{
# claims: request.attributes.claims.mapOverrideEntries(
# {'newclaim': "value"}
# )
# }
# }
uniqueID:
## @param credentialComposer.uniqueID.enabled Add the x509UniqueIdentifier attribute to workload X509-SVIDs
enabled: false
spireIdentityExchange:
## @param credentialComposer.spireIdentityExchange.image.registry The OCI registry to pull the image from
## @param credentialComposer.spireIdentityExchange.image.repository The repository within the registry
## @param credentialComposer.spireIdentityExchange.image.pullPolicy The image pull policy
## @param credentialComposer.spireIdentityExchange.image.tag Overrides the image tag
##
image:
registry: ghcr.io
repository: spiffe/spire-credentialcomposer-identity-exchange
pullPolicy: IfNotPresent
tag: "v0.2.0"
## @param credentialComposer.spireIdentityExchange.checksum The sha256 checksum of the plugin binary
checksum: 198bfed106794a60e565cb804cb6b360d4633e4542981abbea0c0c669ddd6036
## @param credentialComposer.spireIdentityExchange.pluginPath The filename in the container of the plugin
pluginPath: /ko-app/spire-credentialcomposer-identity-exchange
## @param credentialComposer.spireIdentityExchange.prefix The prefix to operate on
prefix: ""
keyManager:
disk:
## @param keyManager.disk.enabled Flag to enable keyManager on disk
enabled: true
memory:
## @param keyManager.memory.enabled Flag to enable keyManager in memory
enabled: false
awsKMS:
## @param keyManager.awsKMS.enabled Flag to enable keyManager in memory
enabled: false
## @param keyManager.awsKMS.region Specify the region for AWS KMS
region: ""
keyIdentifierFile:
## @param keyManager.awsKMS.keyIdentifierFile.enabled Enable key identifier data to be stored in a file in persistent storage.
enabled: false
keyIdentifierValue:
## @param keyManager.awsKMS.keyIdentifierValue.enabled Enable specifying a key identifier value for AWS KMS
enabled: false
## @param keyManager.awsKMS.keyIdentifierValue.identifier Static identifier for the SPIRE server instance
identifier: ""
## @extra keyManager.awsKMS.keyPolicy Policy to use when creating keys. If no policy is specified, a default policy will be used.
keyPolicy:
## @param keyManager.awsKMS.keyPolicy.policy [nullable] Key policy in JSON format.
policy: ""
## @param keyManager.awsKMS.keyPolicy.existingConfigMap [nullable] Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format.
existingConfigMap: ""
## @param keyManager.awsKMS.keyTags [object] Custom tags to apply to KMS keys created by the plugin. Tags are key-value pairs used for resource management and cost allocation. When using key tagging, you must add the `kms:TagResource` permission to your IAM policy. Constraints: keys (1-128 chars), values (0-256 chars), max 50 tags, valid chars (letters, numbers, spaces, + - = . _ : / @), keys cannot start with 'aws:' or 'spire-'.
keyTags: {}
# Environment: "production"
# Team: "security"
# Component: "spire"
## @param keyManager.awsKMS.accessKeyID [nullable] Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role.
accessKeyID: ""
## @param keyManager.awsKMS.secretAccessKey [nullable] Secret access key for the AWS account.
secretAccessKey: ""
upstreamAuthority:
disk:
## @param upstreamAuthority.disk.enabled Flag to enable upstream authority plugin on disk
enabled: false
secret:
## @param upstreamAuthority.disk.secret.create If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself.
create: true
## @param upstreamAuthority.disk.secret.name If secret creation is disabled, the secret with this name will be used.
name: "spiffe-upstream-ca"
## @extra upstreamAuthority.disk.secret.data If secret creation is enabled, will create a secret with following certificate info
data:
## @param upstreamAuthority.disk.secret.data.certificate Certificate to store within disk upstreamAuthority.
certificate: ""
## @param upstreamAuthority.disk.secret.data.key Key corresponding to the upstreamAuthority.
key: ""
## @param upstreamAuthority.disk.secret.data.bundle Trust bundle for upstreamAuthority.
bundle: ""
ejbca:
## @param upstreamAuthority.ejbca.enabled Flag to enable upstream authority plugin with EJBCA
enabled: false
## @param upstreamAuthority.ejbca.hostname Hostname of the connected EJBCA server (e.g. "ejbca.example.com:8443")
hostname: ""
## @param upstreamAuthority.ejbca.caName Name of a CA in the connected EJBCA instance that will issue the intermediate signing certificates
caName: ""
## @param upstreamAuthority.ejbca.endEntityProfileName Name of an end entity profile in the connected EJBCA instance that is configured to issue SPIFFE certificates
endEntityProfileName: ""
## @param upstreamAuthority.ejbca.certificateProfileName Name of a certificate profile in the connected EJBCA instance that is configured to issue intermediate CA certificates
certificateProfileName: ""
## @param upstreamAuthority.ejbca.endEntityName (Optional) Customizes how the End Entity Name is selected. One of "cn", "dns", "uri", "ip", or a custom value
endEntityName: ""
## @param upstreamAuthority.ejbca.accountBindingId (Optional) An account binding ID in EJBCA to associate with issued certificates
accountBindingId: ""
secret:
## @param upstreamAuthority.ejbca.secret.create If disabled requires you to create a secret with the given keys (clientCert, clientKey and optional caCert) yourself.
create: true
## @param upstreamAuthority.ejbca.secret.name If secret creation is disabled, the secret with this name will be used.
name: "spiffe-ejbca-client"
## @extra upstreamAuthority.ejbca.secret.data If secret creation is enabled, will create a secret with the following mTLS credentials
data:
## @param upstreamAuthority.ejbca.secret.data.clientCert Client certificate (public key) used to authenticate to EJBCA via mTLS.
clientCert: ""
## @param upstreamAuthority.ejbca.secret.data.clientKey Client key matching the client certificate used to authenticate to EJBCA.
clientKey: ""
## @param upstreamAuthority.ejbca.secret.data.caCert CA certificate used to validate the EJBCA server's certificate. Leave empty when the EJBCA server uses a publicly trusted certificate. When secret.create is false, set this to any non-empty value to enable ca_cert_path against your externally provided secret (mirrors the disk plugin's bundle behavior).
caCert: ""
awsPCA:
## @param upstreamAuthority.awsPCA.enabled Flag to enable upstream authority plugin with AWS PCA
enabled: false
## @param upstreamAuthority.awsPCA.region AWS Region to use
region: ""
## @param upstreamAuthority.awsPCA.certificateAuthorityARN ARN of the "upstream" CA certificate
certificateAuthorityARN: ""
## @param upstreamAuthority.awsPCA.assumeRoleARN (Optional) ARN of an IAM role to assume
assumeRoleARN: ""
## @param upstreamAuthority.awsPCA.caSigningTemplateARN (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values.
caSigningTemplateARN: ""
## @param upstreamAuthority.awsPCA.signingAlgorithm (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values.
signingAlgorithm: ""
## @param upstreamAuthority.awsPCA.endpoint (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information.
endpoint: ""
## @param upstreamAuthority.awsPCA.supplementalBundlePath (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle.
supplementalBundlePath: ""
awsSecret:
## @param upstreamAuthority.awsSecret.enabled Flag to enable upstream authority plugin with AWS Secrets Manager
enabled: false
## @param upstreamAuthority.awsSecret.region AWS Region to use
region: ""
## @param upstreamAuthority.awsSecret.certFileArn ARN or name of the secret containing the intermediate CA certificate
certFileArn: ""
## @param upstreamAuthority.awsSecret.keyFileArn ARN or name of the secret containing the intermediate CA private key
keyFileArn: ""
## @param upstreamAuthority.awsSecret.bundleFileArn (Optional) ARN or name of the secret containing the root CA bundle
bundleFileArn: ""
## @param upstreamAuthority.awsSecret.assumeRoleArn (Optional) ARN of an IAM role to assume
assumeRoleArn: ""
gcpCAS:
## @param upstreamAuthority.gcpCAS.enabled Flag to enable upstream authority plugin with GCP Certificate Authority Service
enabled: false
## @param upstreamAuthority.gcpCAS.projectName GCP project containing the root CA certificate
projectName: ""
## @param upstreamAuthority.gcpCAS.regionName GCP region name (e.g., us-central1)
regionName: ""
## @param upstreamAuthority.gcpCAS.caPool Name of the CA Pool that has the root CA certificate
caPool: ""
## @param upstreamAuthority.gcpCAS.labelKey Label key used to filter and select the relevant CA certificate
labelKey: ""
## @param upstreamAuthority.gcpCAS.labelValue Label value used to filter and select the relevant CA certificate
labelValue: ""
certManager:
## @param upstreamAuthority.certManager.enabled Flag to enable upstream authority plugin with cert manager
enabled: false
## @param upstreamAuthority.certManager.rbac.create Flag to create RBAC roles
rbac:
create: true
## @param upstreamAuthority.certManager.issuerName Defaults to the release name, override if CA is provided outside of the chart
issuerName: ""
## @param upstreamAuthority.certManager.issuerKind Defaults to "Issuer", override if CA is provided outside of the chart
issuerKind: "Issuer"
## @param upstreamAuthority.certManager.issuerGroup Defaults to "cert-manager.io", override if CA is provided outside of the chart
issuerGroup: "cert-manager.io"
## @param upstreamAuthority.certManager.namespace Specify to use a namespace other then the one the chart is installed into
namespace: ""
## @param upstreamAuthority.certManager.kubeConfigFile Path to kube config file on node to setup cert manager
kubeConfigFile: ""
ca:
## @param upstreamAuthority.certManager.ca.create Creates a Cert-Manager CA
create: false
## @param upstreamAuthority.certManager.ca.duration Duration of the CA. Defaults to 10 years
duration: 87600h
privateKey:
## @param upstreamAuthority.certManager.ca.privateKey.algorithm Algorithm to generate private key for CA
algorithm: ECDSA
## @param upstreamAuthority.certManager.ca.privateKey.size Size of generated private key for CA
size: 256
## @param upstreamAuthority.certManager.ca.privateKey.rotationPolicy Rotation policy for generated private key
rotationPolicy: ""
## @param upstreamAuthority.certManager.ca.renewBefore How long to wait before renewing the CA
renewBefore: ""
spire:
## @param upstreamAuthority.spire.enabled Flag to use another Spire install as upstream CA
enabled: false
## @param upstreamAuthority.spire.upstreamDriver Driver for Spire as upstream CA
upstreamDriver: ""
## @extra upstreamAuthority.spire.server Server details for the Spire instance use as upstream CA
server:
## @param upstreamAuthority.spire.server.nameOverride Override the name for upstream Spire server. Should only be changed when building your own nested chart to ensure names align.
nameOverride: ""
## @param upstreamAuthority.spire.server.address Address for upstream Spire server
address: ""
## @param upstreamAuthority.spire.server.port Port for upstream Spire server
port: 443
vault:
## @param upstreamAuthority.vault.enabled Enable Hashicorp Vault as upstream CA
enabled: false
## @param upstreamAuthority.vault.vaultAddr The URL of the Vault server. (e.g., https://vault.example.com:8443/)
vaultAddr: ""
## @param upstreamAuthority.vault.namespace Name of the Vault namespace. This is only available in the Vault Enterprise.
namespace: ""
## @param upstreamAuthority.vault.pkiMountPoint Name of the mount point where PKI secret engine is mounted
pkiMountPoint: "pki"
## @param upstreamAuthority.vault.insecureSkipVerify If true, caCert options are ignored and Spire accepts any server certificates claiming to be Vault
insecureSkipVerify: false
caCert:
## @param upstreamAuthority.vault.caCert.type Type of resource representing the Vault server certificate, options are 'Secret' or 'Configmap', the item must be named `ca.crt`
type: Secret
## @param upstreamAuthority.vault.caCert.name Name of the Kubernetes resource containing the Vault server certificate
name: vault-ca
k8sAuth:
## @param upstreamAuthority.vault.k8sAuth.enabled Enable k8s authentication to Hashicorp Vault
enabled: false
## @param upstreamAuthority.vault.k8sAuth.k8sAuthMountPoint Name of the mount point where the Kubernetes auth method is mounted
k8sAuthMountPoint: "kubernetes"
## @param upstreamAuthority.vault.k8sAuth.k8sAuthRoleName Required - Name of the Vault role. The plugin authenticates against the named role
k8sAuthRoleName: ""
token:
## @param upstreamAuthority.vault.k8sAuth.token.audience Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info.
audience: "vault"
## @param upstreamAuthority.vault.k8sAuth.token.expiry Expiry time in seconds for the token
expiry: 7200
notifier:
k8sBundle:
## @param notifier.k8sBundle.enabled Enable local k8s bundle uploader
enabled: false
## @param notifier.k8sBundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace
namespace: ""
## @param notifier.k8sBundle.apiServiceLabel If set, rotate the CA Bundle in API services with this label set to true.
apiServiceLabel: ""
## @param notifier.k8sBundle.webhookLabel If set, rotate the CA Bundle in validating and mutating webhooks with this label set to true.
webhookLabel: ""
externalK8sBundle:
## @param notifier.externalK8sBundle.enabled Enable external k8s bundle uploader
enabled: false
defaults:
## @param notifier.externalK8sBundle.defaults.namespace Namespace to push the bundle into on clusters
namespace: "spire-system"
## @param notifier.externalK8sBundle.defaults.configMap ConfigMap name to push the bundle into on external clusters
configMap: "spire-bundle-upstream"
## @param notifier.externalK8sBundle.defaults.configMapKey ConfigMap key to push the bundle into on external clusters
configMapKey: "bundle.crt"
## @param notifier.externalK8sBundle.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used.
clusters: {}
# clustera:
# namespace: foo
# clusterb: {}
controllerManager:
## @param controllerManager.enabled Flag to enable controller manager
enabled: false
## @param controllerManager.staticManifestMode Flag to configure static mode. Valid options off, internal, and external. If internal, the identities config options will be rendered to an included configmap
staticManifestMode: "off"
## @param controllerManager.className specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs.
className: ""
## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.
watchClassless: false
## @param controllerManager.filterByClassName Restrict the ClusterSPIFFEID cache to this controller's className. Only enable after confirming target ClusterSPIFFEIDs already carry the className label, or existing registrations will be deleted.
filterByClassName: false
## @param controllerManager.entryIDPrefixCleanup Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it.
entryIDPrefixCleanup: false
## @param controllerManager.addEntryIDPrefix If true, prepends the clusterName to the entryID of each entry the controller manager registers.
addEntryIDPrefix: true
## @param controllerManager.gcInterval How often the SPIRE state is reconciled when the controller is otherwise idle. This impacts how quickly SPIRE state will converge after CRDs are removed or SPIRE state is mutated underneath the controller. Values are in nanoseconds.
gcInterval: 10000000000
## @param controllerManager.logLevel The log level for the controller manager. Supported values are info, error, warn and debug.
logLevel: info
## @param controllerManager.logEncoding The log encoding for the controller manager. Supported values are console and json.
logEncoding: "console"
## @param controllerManager.leaderElection.leaseDuration Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure.
## @param controllerManager.leaderElection.renewDeadline Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration.
## @param controllerManager.leaderElection.retryPeriod Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline.
leaderElection:
leaseDuration: "15s"
renewDeadline: "10s"
retryPeriod: "2s"
## @param controllerManager.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
## @param controllerManager.livenessProbe.periodSeconds Period seconds for livenessProbe
## @param controllerManager.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe
## @param controllerManager.livenessProbe.failureThreshold Failure threshold for livenessProbe
livenessProbe:
initialDelaySeconds: 5
periodSeconds: 10
timeoutSeconds: 5
failureThreshold: 3
## @param controllerManager.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
## @param controllerManager.readinessProbe.periodSeconds Period seconds for readinessProbe
## @param controllerManager.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
## @param controllerManager.readinessProbe.failureThreshold Failure threshold for readinessProbe
readinessProbe:
initialDelaySeconds: 5
periodSeconds: 10
timeoutSeconds: 5
failureThreshold: 3
## @param controllerManager.parentIDTemplate The template that is used to register workloads.
parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"
## @param controllerManager.expandEnv Set to true to enable environment variable substitution of config file options
expandEnv: false
## @param controllerManager.extraEnv [array] Extra environment variables to add to the controller manager
extraEnv: []
installAndUpgradeHook:
## @param controllerManager.installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`)
enabled: true
deleteHook:
## @param controllerManager.deleteHook.enabled Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`)
enabled: true
## @param controllerManager.image.registry The OCI registry to pull the image from
## @param controllerManager.image.repository The repository within the registry
## @param controllerManager.image.pullPolicy The image pull policy
## @param controllerManager.image.tag Overrides the image tag whose default is the chart appVersion
##
image:
registry: ghcr.io
repository: spiffe/spire-controller-manager
pullPolicy: IfNotPresent
tag: "0.7.0"
## @param controllerManager.resources [object] Resource requests and limits for controller manager
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# limits:
# cpu: 100m
# memory: 128Mi
# requests:
# cpu: 100m
# memory: 128Mi
## @param controllerManager.securityContext [object] Security context
securityContext: {}
# capabilities:
# drop:
# - ALL
# readOnlyRootFilesystem: true
# runAsNonRoot: true
# runAsUser: 1000
## @param controllerManager.service.type Service type for controller manager
## @param controllerManager.service.port Service port for controller manager
## @param controllerManager.service.annotations Annotations for service resource
##
service:
type: ClusterIP
port: 443
annotations: {}
configMap:
## @param controllerManager.configMap.annotations [object] Annotations to add to the Controller Manager ConfigMap
annotations: {}
## @param controllerManager.ignoreNamespaces [array] These namespaces are ignored by controller manager
ignoreNamespaces:
- kube-system
- kube-public
- local-path-storage
# openshift creates many namespaces that should be typically ignored:
- openshift-.*
# ibmcloud specific namespaces:
- ibm-.*
## @param controllerManager.reconcile.clusterSPIFFEIDs Enable reconciliation of clusterSPIFFEIDs from K8s to the SPIRE server
## @param controllerManager.reconcile.clusterStaticEntries Enable reconciliation of clusterStaticEntries from K8s to the SPIRE server
## @param controllerManager.reconcile.clusterFederatedTrustDomains Enable reconciliation of clusterFederatedTrustDomains from K8s to the SPIRE server
reconcile:
clusterSPIFFEIDs: true
clusterStaticEntries: true
clusterFederatedTrustDomains: true
identities:
clusterSPIFFEIDs:
# NOTE you can add multiple uniquely named entries to create multiple ClusterSPIFFEID objects. See example below.
default:
## @param controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable this identity for controller manager
enabled: true
## @param controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate Spiffe ID template for identities
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
## @param controllerManager.identities.clusterSPIFFEIDs.default.podSelector [object] Selector for pods to issue identity
podSelector: {}
# matchLabels:
# spiffe.io/spiffe-id: "true"
## @param controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector [object] Selector for namespaces to issue identity
namespaceSelector: {}
# matchLabels:
# spiffe.io/spiffe-id: "true"
## @param controllerManager.identities.clusterSPIFFEIDs.default.dnsNameTemplates [array] DNS name template for issued identities
dnsNameTemplates: []
# - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local'
## @param controllerManager.identities.clusterSPIFFEIDs.default.federatesWith [array] Other Spire server URLs for identity federation
federatesWith: []
# - example.io
# - example.ai
## @param controllerManager.identities.clusterSPIFFEIDs.default.workloadSelectorTemplates [array] Templates to produce selectors that apply to a given workload before it will receive an ID
workloadSelectorTemplates: []
## @param controllerManager.identities.clusterSPIFFEIDs.default.ttl Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen.
ttl: ""
## @param controllerManager.identities.clusterSPIFFEIDs.default.jwtTTL Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen.
jwtTTL: ""
## @param controllerManager.identities.clusterSPIFFEIDs.default.admin Indicates any pod matched by this identity will be an admin. Use this with extreme care.
admin: false
## @param controllerManager.identities.clusterSPIFFEIDs.default.downstream Set if this spire instance is a root server and the workloads are downstream servers.
downstream: false
## @param controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames Auto populate DNS names from services attached to pods
autoPopulateDNSNames: false
## @param controllerManager.identities.clusterSPIFFEIDs.default.fallback Apply this ID only if there are no other matching non fallback ClusterSPIFFEIDs
fallback: true
# Set what hint to use. If unset, it will be asigned the clusterSPIFFEID name. If set to "", it will be unset. Any other value will set the hint to exactly what is specified.
# hint: ""
child-servers:
## @param controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable this identity for controller manager
enabled: false
## @param controllerManager.identities.clusterSPIFFEIDs.child-servers.type The type of rule this is.
type: child-servers
## @param controllerManager.identities.clusterSPIFFEIDs.child-servers.downstream Set if this spire instance is a root server and the workloads are downstream servers.
downstream: true
oidc-discovery-provider:
## @param controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled Enable this identity for controller manager
enabled: true
## @param controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type The type of rule this is.
type: oidc-discovery-provider
## @param controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames Auto populate DNS names to the discovery provider
autoPopulateDNSNames: true
## @param controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.dnsNameTemplates [array] DNS name template for issued identities
dnsNameTemplates:
- oidc-discovery.{{ .TrustDomain }}
test-keys:
## @param controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable this identity for controller manager
enabled: true
## @param controllerManager.identities.clusterSPIFFEIDs.test-keys.type The type of rule this is.
type: test-keys
spike-keeper:
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type The type of rule this is.
type: spike-keeper
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate The template to use for this rule.
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/keeper/{{ .PodMeta.Name }}
spike-nexus:
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type The type of rule this is.
type: spike-nexus
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate The template to use for this rule.
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/nexus/{{ .PodMeta.Name }}
spike-bootstrap:
## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.type The type of rule this is.
type: spike-bootstrap
## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.spiffeIDTemplate The template to use for this rule.
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/bootstrap/{{ .PodMeta.Name }}
spike-pilot:
## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.type The type of rule this is.
type: spike-pilot
## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.spiffeIDTemplate The template to use for this rule.
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/pilot/role/superuser
spire-ha-agent:
## @param controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled Enable this identity for controller manager
enabled: false
## @param controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.type The type of rule this is.
type: spire-ha-agent
## @param controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.spiffeIDTemplate The template to use for this rule.
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spire-ha-agent
## @param controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.federatesWith Federated trust domains to pass to the workload
federatesWith:
- spire-ha
spire-identity-exchange-trustbundle:
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.spiffeIDTemplate The template to use for this rule.
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/service/trustbundle-spire-identity-exchange
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.type The type of rule this is.
type: spire-identity-exchange
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.workloadSelectorTemplates [array] Workload selectors.
workloadSelectorTemplates:
- "k8s:container-name:spire-server-attestor"
spire-identity-exchange-service:
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.spiffeIDTemplate The template to use for this rule.
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/service/spire-identity-exchange
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.type The type of rule this is.
type: spire-identity-exchange
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.workloadSelectorTemplates [array] Workload selectors.
workloadSelectorTemplates:
- "k8s:container-name:spire-identity-exchange"
spire-identity-exchange-agent:
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-agent.type The type of rule this is.
type: spire-identity-exchange
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-agent.workloadSelectorTemplates [array] Workload selectors.
workloadSelectorTemplates:
- "k8s:container-name:spire-agent"
# You can specify additional ClusterSPIFFEIDs following this example:
# foo:
# labels:
# foo: bar
# spiffeIDTemplate: spiffe://{{ .TrustDomain }}/foo
# namespaceSelector:
# matchLabels:
# foo: bar
clusterStaticEntries:
## @param controllerManager.identities.clusterStaticEntries.spire-identity-exchange [object] Settings for the spire-identity-exchnage
spire-identity-exchange: {}
#FIXME Only needed for delegated api. Can remove once spire-identity-exchange switched to the broker api.
spire-identity-exchange-agent:
## @param controllerManager.identities.clusterStaticEntries.spire-identity-exchange-agent.selectors [array] selector
selectors:
- unix:path:/ko-app/spire-identity-exchange-server
# foo:
# labels:
# foo: bar
# parentID: spiffe://example.com/bar
# spiffeID: spiffe://example.com/foo
# selectors:
# - k8s:pod-label:app.kubernetes.io/name:server
## @param controllerManager.identities.clusterFederatedTrustDomains Specify ClusterFederatedTrustDomain objects.
clusterFederatedTrustDomains: {}
# foo:
# labels:
# foo: bar
# bundleEndpointProfile:
# endpointSPIFFEID: spiffe://example.com/foo
# type: https_spiffe
# bundleEndpointURL: https://rootserver.example.com:1234
# trustDomain: example.com
validatingWebhookConfiguration:
## @param controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another chart instance on the k8s cluster with webhooks enabled.
enabled: true
## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued
failurePolicy: Fail
## @param controllerManager.cacheNamespaces If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces.
cacheNamespaces: {}
# default:
# nsWithLabel:
# labelSelectors:
# lName: l1
# nsWithField:
# fieldSelectors:
# fName: f1
# nsWithBoth:
# labelSelectors:
# lName: l1
# fieldSelectors:
# fName: f1
externalControllerManagers:
## @param externalControllerManagers.enabled Flag to enable external controller managers
enabled: false
defaults:
## @param externalControllerManagers.defaults.reconcile.clusterSPIFFEIDs Enable reconciliation of clusterSPIFFEIDs from K8s to the SPIRE server
## @param externalControllerManagers.defaults.reconcile.clusterStaticEntries Enable reconciliation of clusterStaticEntries from K8s to the SPIRE server
## @param externalControllerManagers.defaults.reconcile.clusterFederatedTrustDomains Enable reconciliation of clusterFederatedTrustDomains from K8s to the SPIRE server
reconcile:
clusterSPIFFEIDs: true
clusterStaticEntries: false
clusterFederatedTrustDomains: false
## @param externalControllerManagers.defaults.className specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs.
className: ""
## @param externalControllerManagers.defaults.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.
watchClassless: false
## @param externalControllerManagers.defaults.filterByClassName Restrict the ClusterSPIFFEID cache to this controller's className. Only enable after confirming target ClusterSPIFFEIDs already carry the className label, or existing registrations will be deleted.
filterByClassName: false
## @param externalControllerManagers.defaults.entryIDPrefixCleanup consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it.
entryIDPrefixCleanup: false
## @param externalControllerManagers.defaults.parentIDTemplate The template that is used to register workloads.
parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"
## @param externalControllerManagers.defaults.leaderElection.leaseDuration Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure.
## @param externalControllerManagers.defaults.leaderElection.renewDeadline Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration.
## @param externalControllerManagers.defaults.leaderElection.retryPeriod Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline.
leaderElection:
leaseDuration: "15s"
renewDeadline: "10s"
retryPeriod: "2s"
## @param externalControllerManagers.defaults.expandEnv Set to true to enable environment variable substitution of config file options
expandEnv: false
## @param externalControllerManagers.defaults.extraEnv [array] Extra environment variables to add to the controller manager
extraEnv: []
## @param externalControllerManagers.defaults.resources [object] Resource requests and limits for controller manager
resources: {}
## @param externalControllerManagers.defaults.securityContext [object] Security context
securityContext: {}
configMap:
## @param externalControllerManagers.defaults.configMap.annotations [object] Annotations to add to the Controller Manager ConfigMap
annotations: {}
## @param externalControllerManagers.defaults.ignoreNamespaces [array] These namespaces are ignored by controller manager
ignoreNamespaces:
- kube-system
- kube-public
- local-path-storage
# openshift creates many namespaces that should be typically ignored:
- openshift-.*
# ibmcloud specific namespaces:
- ibm-.*
## @param externalControllerManagers.defaults.cacheNamespaces [object] If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces.
cacheNamespaces: {}
## @param externalControllerManagers.clusters [object] A dictionary of clusters to add with optional overrides (kubeConfigName, reconcile, healthPortName, prometheusPortName). If empty, all clusters defined in kubeConfigs will be used.
clusters: {}
# clustera:
# Should match the name of the config in the kubeConfigs section
# kubeConfigName: foo
# reconcile:
# clusterStaticEntries: true
# healthPortName: "hp-clustera-01"
# prometheusPortName: "pm-clustera-01"
# other: {}
tools:
kubectl:
## @param tools.kubectl.image.registry The OCI registry to pull the image from
## @param tools.kubectl.image.repository The repository within the registry
## @param tools.kubectl.image.pullPolicy The image pull policy
## @param tools.kubectl.image.tag Overrides the image tag whose default is the chart appVersion
##
image:
registry: registry.k8s.io
repository: kubectl
pullPolicy: IfNotPresent
tag: ""
busybox:
## @param tools.busybox.image.registry The OCI registry to pull the image from
## @param tools.busybox.image.repository The repository within the registry
## @param tools.busybox.image.pullPolicy The image pull policy
## @param tools.busybox.image.tag Overrides the image tag whose default is the chart appVersion
##
image:
registry: ""
repository: busybox
pullPolicy: IfNotPresent
tag: 1.37.0-uclibc
telemetry:
prometheus:
## @param telemetry.prometheus.enabled Flag to enable prometheus monitoring
enabled: false
podMonitor:
## @param telemetry.prometheus.podMonitor.enabled Enable podMonitor for prometheus
enabled: false
## @param telemetry.prometheus.podMonitor.namespace Override where to install the podMonitor, if not set will use the same namespace as the spire-agent
namespace: ""
## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring
labels: {}
datadog:
## @param telemetry.datadog.enabled Flag to enable datadog monitoring
enabled: false
## @param telemetry.datadog.address The address of the datadog service to send metrics to. The default URL for services are `<service-name>.<namespace>.svc`
address: "datadog.kube-system.svc"
## @param telemetry.datadog.port The port of the datadog service to send metrics to
port: 8125
ingress:
## @param ingress.enabled Flag to enable ingress
enabled: false
## @param ingress.className Ingress class name
className: ""
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
controllerType: ""
## @param ingress.annotations [object] Annotations for the ingress object
annotations: {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
host: "spire-server"
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
tlsSecret: ""
## @param ingress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
hosts: []
# - host: spire-server.example.org
# paths:
# - path: /
# pathType: Prefix
## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
tls: []
# - secretName: spire-server-tls
# hosts:
# - spire-server.example.org
gatewayAPI:
## @param gatewayAPI.enabled Flag to expose spire-server via Gateway API (TLS passthrough)
enabled: false
## @param gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
host: "spire-server"
## @param gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
annotations: {}
listenerSet:
## @param gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
enabled: null
## @param gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
parentRefs: []
## @param gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
sectionName: ""
## @param extraEnv [array] Extra environment variables to add to the spire server
extraEnv: []
## @param extraVolumes [array] Extra volumes to be mounted
extraVolumes: []
## @param extraVolumeMounts [array] Extra volume mounts
extraVolumeMounts: []
## @param extraContainers [array] Additional containers to create
extraContainers: []
## @param initContainers [array] Additional init containers to create
initContainers: []
## @param caKeyType The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported)
caKeyType: rsa-2048
## @param caTTL TTL for CA
caTTL: 24h
## @param agentTTL The TTL to use for agent SVIDs. If unset, the defaultX509SvidTTL will be used.
agentTTL: ""
## @param defaultX509SvidTTL TTL for X509 Svids
defaultX509SvidTTL: 4h
## @param defaultJwtSvidTTL TTL for JWT Svids
defaultJwtSvidTTL: 1h
## @param rateLimit.attestation Enable rate limiting for node attestation. When true, rate limits node attestation to 1 per second globally. Set to false to disable.
## @param rateLimit.signing Enable rate limiting for SVID signing (BatchNewX509SVID, BatchNewJWTSVID). When true, rate limits signing to 500 requests per second per server pod. Set to false to disable. Disabling is appropriate when running many replicas or during thundering-herd recovery.
rateLimit:
attestation: true
signing: true
## @param pruneAttestedNodesExpiredFor Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval.
pruneAttestedNodesExpiredFor: ""
## @param pruneTOFUNodes If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned.
pruneTOFUNodes: false
## @param maxAttestedNodeInfoStaleness How long to trust stale cache information about attested nodes. Set to "" to use the SPIRE default (0s). Increasing this can improve performance under high load by reducing datastore reads, at the cost of acting on slightly stale node state. Accepts Go duration strings (e.g. "10s", "1m").
maxAttestedNodeInfoStaleness: ""
nodeAttestor:
k8sPSAT:
## @param nodeAttestor.k8sPSAT.enabled Enable PSAT k8s nodeattestor
enabled: true
## @param nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor. If namespace isn't specified, release namespace will be used.
serviceAccountAllowList: []
## @param nodeAttestor.k8sPSAT.audience [array] Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used
audience: ["spire-server"]
## @param nodeAttestor.k8sPSAT.allowedNodeLabelKeys [array] Node label keys considered for selectors
allowedNodeLabelKeys: []
## @param nodeAttestor.k8sPSAT.allowedPodLabelKeys [array] Pod label keys considered for selectors
allowedPodLabelKeys: []
externalK8sPSAT:
## @param nodeAttestor.externalK8sPSAT.enabled Enable PSAT k8s nodeattestor for external Kubernetes clusters
enabled: true
defaults:
## @param nodeAttestor.externalK8sPSAT.defaults.serviceAccountAllowList [array] Allowed service accounts for PSAT node attestor
serviceAccountAllowList: ["spire-system:spire-agent-upstream"]
## @param nodeAttestor.externalK8sPSAT.defaults.audience [array] Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used
audience: ["spire-server"]
## @param nodeAttestor.externalK8sPSAT.defaults.allowedNodeLabelKeys [array] Node label keys considered for selectors
allowedNodeLabelKeys: []
## @param nodeAttestor.externalK8sPSAT.defaults.allowedPodLabelKeys [array] Pod label keys considered for selectors
allowedPodLabelKeys: []
## @param nodeAttestor.externalK8sPSAT.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used.
clusters: {}
# clustera:
# kubeConfigName: foo
# serviceAccountAllowList: ["other-ns:other-agent"]
# clusterb: {}
joinToken:
## @param nodeAttestor.joinToken.enabled Enable the join_token nodeattestor
enabled: false
httpChallenge:
## @param nodeAttestor.httpChallenge.enabled Enable the http_challenge nodeattesto
enabled: false
## @param nodeAttestor.httpChallenge.allowedDNSPatterns A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed.
allowedDNSPatterns: []
## @param nodeAttestor.httpChallenge.requiredPort Set to a port number to require clients to listen only on that port. If 0, all port numbers are allowed
requiredPort: 0
## @param nodeAttestor.httpChallenge.allowNonRootPorts Allow using ports >= 1024 from clients for attestation
allowNonRootPorts: true
## @param nodeAttestor.httpChallenge.tofu Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024
tofu: true
tpmDirect:
## @param nodeAttestor.tpmDirect.enabled Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental.
enabled: false
## @param nodeAttestor.tpmDirect.image.registry The OCI registry to pull the image from
## @param nodeAttestor.tpmDirect.image.repository The repository within the registry
## @param nodeAttestor.tpmDirect.image.pullPolicy The image pull policy
## @param nodeAttestor.tpmDirect.image.tag Overrides the image tag
##
image:
registry: ghcr.io
repository: spiffe/spire-tpm-plugin-tpm-attestor-server
pullPolicy: IfNotPresent
tag: "v1.9.0"
## @param nodeAttestor.tpmDirect.checksum The sha256 checksum of the plugin binary
checksum: 46d0caad8c25a027dd11c93e18b58a8bc6fbd9f1fe2e36fa2a0dd440986de4dc
## @param nodeAttestor.tpmDirect.pluginPath The filename in the container of the plugin
pluginPath: /app/tpm_attestor_server
## @param nodeAttestor.tpmDirect.cas A dictionary of TPM CA PEM or DER files that are allowed to connect.
cas: {}
## @param nodeAttestor.tpmDirect.hashes A list of TPM hashes that are allowed to connect.
hashes: []
awsIID:
## @param nodeAttestor.awsIID.enabled Enable the aws_iid node attestor
enabled: false
## @param nodeAttestor.awsIID.assumeRole AWS IAM Role NAME to use for the attestation
assumeRole: ""
## @extra nodeAttestor.awsIID.verifyOrganization When enabled, SPIRE verifies the attesting node's AWS account is a member of your AWS Organization ([SPIRE aws_iid server plugin](https://github.com/spiffe/spire/blob/main/doc/plugin_server_nodeattestor_aws_iid.md)).
verifyOrganization:
## @param nodeAttestor.awsIID.verifyOrganization.enabled Enable AWS Organizations membership validation (`verify_organization` in plugin config)
enabled: false
## @param nodeAttestor.awsIID.verifyOrganization.managementAccountId AWS Organizations management/root account ID (12 digits); SPIRE assumes `arn:aws:iam::<managementAccountId>:role/<assumeOrgRole>` for listing org accounts.
managementAccountId: ""
## @param nodeAttestor.awsIID.verifyOrganization.assumeOrgRole IAM role **name** in the management account; must allow `organizations:ListAccounts` and trust the IAM identity used by the SPIRE server.
assumeOrgRole: ""
## @param nodeAttestor.awsIID.verifyOrganization.managementAccountRegion Optional region SPIRE uses for org validation/cache keying (defaults in SPIRE if unset).
managementAccountRegion: ""
## @param nodeAttestor.awsIID.verifyOrganization.orgAccountMapTTL Optional cache TTL for the org account map (SPIRE expects a duration ≥ 1m when set; e.g. `3m`, `5m`). Defaults to 3 minutes.
orgAccountMapTTL: "3m"
gcpIIT:
## @param nodeAttestor.gcpIIT.enabled Enable the gcp_iit node attestor
enabled: false
## @param nodeAttestor.gcpIIT.projectIDAllowList List of ProjectIDs from which nodes can be attested
projectIDAllowList: []
## @param nodeAttestor.gcpIIT.useInstanceMetadata If true, instance metadata is fetched from the Google Compute Engine API and used to augment the node selectors produced by the plugin
useInstanceMetadata: false
## @param nodeAttestor.gcpIIT.allowedLabelKeys Instance label keys considered for selectors
allowedLabelKeys: []
## @param nodeAttestor.gcpIIT.allowedMetadataKeys Instance metadata keys considered for selectors
allowedMetadataKeys: []
## @param nodeAttestor.gcpIIT.metadataValueMaxSize Sets the maximum metadata value size considered by the plugin for selectors
metadataValueMaxSize: 0
## @param nodeAttestor.gcpIIT.agentPathTemplate A URL path portion format of Agent's SPIFFE ID. Describe in text/template format.
agentPathTemplate: ""
x509POP:
## @param nodeAttestor.x509POP.enabled Enable the x509_popg node attestor
enabled: false
## @param nodeAttestor.x509POP.mode Plugin mode: spiffe (exchange) or externalPKI (enrollment CA bundle)
mode: spiffe
## @extra nodeAttestor.x509POP.caBundle CA bundle for externalPKI mode. Provide inline PEM contents or reference an existing ConfigMap.
caBundle:
## @param nodeAttestor.x509POP.caBundle.bundle [nullable] PEM CA bundle contents. When set, the chart creates and mounts a ConfigMap.
bundle: ""
## @param nodeAttestor.x509POP.caBundle.existingConfigMap [nullable] Name of a ConfigMap containing a `ca-bundle.pem` key with the PEM CA bundle.
existingConfigMap: ""
## @param nodeAttestor.x509POP.spiffePrefix What prefix to use when mode is spiffe
spiffePrefix: "/spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/"
## @param nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
agentPathTemplate: ""
## @param nodeAttestor.x509POP.maxIntermediates Maximum number of intermediate certificates allowed in the certificate chain
maxIntermediates: 4
## @param nodeAttestor.x509POP.maxRSAKeySize Maximum RSA key size in bits allowed in certificates
maxRSAKeySize: 8192
addClusterName:
## @param nodeAttestor.x509POP.addClusterName.spiffePrefix Suffix the cluster name onto the svidPrefix
spiffePrefix: true
## @param nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
agentPathTemplate: true
# The secrets needed for this plugin are configured in the secrets: section
bundlePublisher:
k8sConfigMap:
## @param bundlePublisher.k8sConfigMap.enabled Enable local k8s bundle uploader
enabled: true
## @param bundlePublisher.k8sConfigMap.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace
namespace: ""
## @param bundlePublisher.k8sConfigMap.format Format of the trust bundle. Can be pem or spiffe
format: spiffe
externalK8sConfigMap:
## @param bundlePublisher.externalK8sConfigMap.enabled Enable external k8s bundle uploader
enabled: true
defaults:
## @param bundlePublisher.externalK8sConfigMap.defaults.namespace Namespace to push the bundle into on clusters
namespace: "spire-system"
## @param bundlePublisher.externalK8sConfigMap.defaults.configMapName ConfigMap name to push the bundle into on external clusters
configMapName: "spire-bundle-upstream"
## @param bundlePublisher.externalK8sConfigMap.defaults.configMapKey ConfigMap key to push the bundle into on external clusters
configMapKey: ""
## @param bundlePublisher.externalK8sConfigMap.defaults.format Format of the trust bundle. Can be pem or spiffe
format: spiffe
## @param bundlePublisher.externalK8sConfigMap.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used.
clusters: {}
# clustera:
# namespace: foo
# clusterb: {}
awsRolesAnywhereTrustAnchor:
## @param bundlePublisher.awsRolesAnywhereTrustAnchor.enabled Enable the AWS S3 bundle publisher
enabled: false
## @param bundlePublisher.awsRolesAnywhereTrustAnchor.region AWS region to store the trust bundle
region: ""
## @param bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID AWS trust anchor ID to publish to
trustAnchorID: ""
awsS3:
## @param bundlePublisher.awsS3.enabled Enable the AWS S3 bundle publisher
enabled: false
## @param bundlePublisher.awsS3.endpoint A custom S3 endpoint should be set when using third-party object storage providers, such as Minio.
endpoint: ""
## @param bundlePublisher.awsS3.region AWS region to store the trust bundle
region: ""
## @param bundlePublisher.awsS3.bucket AWS S3 bucket name to which the trust bundle is uploaded
bucket: ""
## @param bundlePublisher.awsS3.objectKey AWS S3 object key inside the bucket
objectKey: ""
## @param bundlePublisher.awsS3.format Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem]
format: ""
gcpCloudStorage:
## @param bundlePublisher.gcpCloudStorage.enabled Enable the Google Cloud Storage bundle publisher
enabled: false
## @param bundlePublisher.gcpCloudStorage.bucketName Google Cloud Storage bucket name to which the trust bundle is uploaded
bucketName: ""
## @param bundlePublisher.gcpCloudStorage.objectName Google Cloud Storage object name
objectName: ""
## @param bundlePublisher.gcpCloudStorage.format Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem]
format: ""
dynamicRegistration:
## @param dynamicRegistration.enabled Deploys the sidecar helper for dynamic registration
enabled: false
## @param dynamicRegistration.image.registry The OCI registry to pull the image from
## @param dynamicRegistration.image.repository The repository within the registry
## @param dynamicRegistration.image.pullPolicy The image pull policy
## @param dynamicRegistration.image.tag Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications
##
image:
registry: ghcr.io
repository: spiffe/spire-controller-manager-dynamic-registration/spire-controller-manager-dynamic-registration-server
pullPolicy: IfNotPresent
tag: "0.1.0"
## @param dynamicRegistration.serviceAccount Which service account to allow to register
serviceAccount: "spire-agent"
## @param dynamicRegistration.audience The expected audience
audience: spire-controller-manager-dynamic-registration
## @param dynamicRegistration.entryPrefix Unique prefix to bind nodes aliases to the server
entryPrefix: "scmnr"
## @param dynamicRegistration.allowedIDPrefix Prefix of agents that are allowed to register
allowedIDPrefix: "spire/agent/k8s_psat"
## @param dynamicRegistration.registrationPrefix prefix to use on all new registration entries
registrationPrefix: "k8s_psat"
addClusterName:
## @param dynamicRegistration.addClusterName.registrationPrefix suffix the cluster name onto the registrationPrefix
registrationPrefix: true
## @param dynamicRegistration.addClusterName.allowedIDPrefix suffix the cluster name onto the allowedIDPrefix
allowedIDPrefix: true
## @param dynamicRegistration.securityContext [object] Security Context to use
securityContext: {}
## @section Tornjak
tornjak:
## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production)
enabled: false
## @param tornjak.image.registry The OCI registry to pull the image from
## @param tornjak.image.repository The repository within the registry
## @param tornjak.image.pullPolicy The image pull policy
## @param tornjak.image.tag Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications
## @param tornjak.image.defaultTag Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift.
##
image:
registry: ghcr.io
repository: spiffe/tornjak-backend
pullPolicy: IfNotPresent
tag: ""
defaultTag: "v2.1.0"
service:
## @param tornjak.service.type Type of service resource
type: ClusterIP
ports:
## @param tornjak.service.ports.http Insecure port for tornjak service
http: 10000
## @param tornjak.service.ports.https Secure port for tornjak service
https: 10443
## @param tornjak.service.annotations [object] Annotations for the service
annotations: {}
## @param tornjak.ingress.enabled Flag to enable ingress for Tornjak backend service
## @param tornjak.ingress.className Ingress class name for Tornjak backend service
## @param tornjak.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
## @param tornjak.ingress.annotations [object] Annotations for Tornjak backend service
ingress:
enabled: false
className: ""
controllerType: ""
annotations: {}
## @param tornjak.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
host: "tornjak-backend"
## @param tornjak.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
tlsSecret: ""
## @param tornjak.ingress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
hosts: []
# - host: tornjak-backend.example.org
# paths:
# - path: /
# pathType: Prefix
## @param tornjak.ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
tls: []
# - secretName: chart-example-tls
# hosts:
# - tornjak-backend.example.org
## Gateway API exposure for the Tornjak backend. Route kind follows the tornjak
## connectionType: non-http => TLSRoute (passthrough), http => HTTPRoute (edge).
gatewayAPI:
## @param tornjak.gatewayAPI.enabled Flag to expose the Tornjak backend via Gateway API
enabled: false
## @param tornjak.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
host: "tornjak-backend"
## @param tornjak.gatewayAPI.tlsSecret Secret with the TLS cert for edge termination (used when connectionType is http). Blank keeps passthrough.
tlsSecret: ""
## @param tornjak.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
annotations: {}
listenerSet:
## @param tornjak.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
enabled: null
## @param tornjak.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
parentRefs: []
## @param tornjak.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
sectionName: ""
## @param tornjak.startupProbe.failureThreshold Failure threshold count
## @param tornjak.startupProbe.initialDelaySeconds Initial delay seconds
## @param tornjak.startupProbe.periodSeconds Period seconds
## @param tornjak.startupProbe.successThreshold Success threshold count
## @param tornjak.startupProbe.timeoutSeconds Timeout in seconds
##
startupProbe:
failureThreshold: 3
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
# tornjak - Tornjak default values
config:
## @extra tornjak.config.dataStore [object] Persistent DB for storing Tornjak specific information
dataStore:
## @param tornjak.config.dataStore.driver Database driver name
driver: "sqlite3"
## @param tornjak.config.dataStore.file File path for sqlite3 file
file: "/run/spire/data/tornjak.sqlite3"
## @extra tornjak.config.userManagement [object] UserManagement config
userManagement:
## @param tornjak.config.userManagement.issuer UserManagement issuer URL
issuer: ""
## @param tornjak.config.userManagement.audience UserManagement audience check
audience: ""
# Tornjak supports 3 connection types: `http`, `tls`, and `mtls`.
# The connections are determined based on provided configuration
# When `tlsSecret` is created in this chart namespace, the TLS connection is started
# When `tlsSecret` and `clientCA.tornjak-client-ca` are created in this chart namespace, the mTLS connection is started
# When none of them are created, Tornjak starts with HTTP connection only
## @param tornjak.config.tlsSecret Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType)
tlsSecret: tornjak-tls-secret
clientCA:
## @param tornjak.config.clientCA.type Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType)
type: Secret
## @param tornjak.config.clientCA.name Name of the resource secret or configMap with user CA for TLS
name: tornjak-client-ca
## @param tornjak.resources [object] Resource requests and limits
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# limits:
# cpu: 100m
# memory: 128Mi
# requests:
# cpu: 100m
# memory: 128Mi
## @param tornjak.securityContext [object] Security Context to use
securityContext: {}
secrets:
aws:
## @param secrets.aws.accessKeyID AWS Access Key ID
accessKeyID: ""
## @param secrets.aws.secretAccessKey AWS Secret Access Key
secretAccessKey: ""
gcp:
## @param secrets.gcp.applicationCredentials Google Application Credentials
applicationCredentials: ""
trustSync:
## @param trustSync.enabled Allow configuration of trust syncing
enabled: false
## @param trustSync.domains List of trust domains to sync from parent to child servers
domains: []
#- spire-ha
#- foo.org
## @param trustSync.image.registry The OCI registry to pull the image from
## @param trustSync.image.repository The repository within the registry
## @param trustSync.image.pullPolicy The image pull policy
## @param trustSync.image.tag Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications
##
image:
registry: ghcr.io
repository: spiffe/spire-ha-agent/spire-trust-sync
pullPolicy: IfNotPresent
tag: "0.2.0"
## @param trustSync.resources [object] Resource requests and limits
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# limits:
# cpu: 100m
# memory: 128Mi
# requests:
# cpu: 100m
# memory: 128Mi
# NOTE: This is unsupported and only to configure currently supported spire built in plugins but plugins unsupported by the chart.
# Upgrades wont be tested for anything under this config. If you need this, please let the chart developers know your needs so we
# can prioritize proper support.
## @skip unsupportedBuiltInPlugins
unsupportedBuiltInPlugins:
bundlePublisher: {}
credentialComposer: {}
keyManager: {}
nodeAttestor: {}
upstreamAuthority: {}
notifier: {}
## @param customPlugins.bundlePublisher Custom plugins of type BundlePublisher are configured here
## @param customPlugins.credentialComposer Custom plugins of type CredentialComposer are configured here
## @param customPlugins.keyManager Custom plugins of type KeyManager are configured here
## @param customPlugins.nodeAttestor Custom plugins of type NodeAttestor are configured here
## @param customPlugins.upstreamAuthority Custom plugins of type upstreamAuthority are configured here
## @param customPlugins.notifier Custom plugins of type notifier are configured here
customPlugins:
bundlePublisher: {}
credentialComposer: {}
keyManager: {}
nodeAttestor: {}
upstreamAuthority: {}
notifier: {}
# When upgrading from a previous version, sometimes we need to change the user and requires updating permissions.
chown:
## @param chown.image.registry The OCI registry to pull the image from
## @param chown.image.repository The repository within the registry
## @param chown.image.pullPolicy The image pull policy
## @param chown.image.tag Overrides the image tag whose default is the chart appVersion
##
image:
registry: ""
repository: busybox
pullPolicy: IfNotPresent
tag: 1.37.0-uclibc
## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {}
experimental:
## @param experimental.enabled Allow configuration of experimental features
enabled: false
## @param experimental.agentSPIFFEIDAsSelector enable adding spiffe_id selectors to all agents
agentSPIFFEIDAsSelector: false
## @param experimental.cacheReloadInterval The amount of time between two reloads of the in-memory entry cache.
cacheReloadInterval: 5s
## @param experimental.eventsBasedCache Use events to update the cache with what's changed since the last update.
eventsBasedCache: false
## @param experimental.pruneEventsOlderThan How old an event can be before being deleted. Used with events based cache.
pruneEventsOlderThan: 12h
## @param experimental.requirePQKEM Require use of a post-quantum-safe key exchange method for TLS handshakes.
requirePQKEM: false
## @param experimental.featureFlags [array] List of developer feature flags
featureFlags: []
## @param experimental.authOpaPolicyEngine [object] The [auth opa_policy engine](https://github.com/spiffe/spire/blob/main/doc/authorization_policy_engine.md) used for authorization decisions. Defaults to the default SPIRE authorization policy.
authOpaPolicyEngine:
local:
## @param experimental.authOpaPolicyEngine.local.policy_data [string] A JSON blob that defines additional data that can be used in the rego policy.
policy_data: ""
## @param experimental.authOpaPolicyEngine.local.rego [string] The contents of a rego policy file defining how to authorize the API calls.
rego: ""
tests:
## @param tests.hostAliases [array] List of host aliases for testing
hostAliases: []
tls:
## @param tests.tls.enabled Flag for enabling tls for tests
enabled: false
## @param tests.tls.customCA Custom CA value for tests
customCA: ""
bash:
## @param tests.bash.image.registry The OCI registry to pull the image from
## @param tests.bash.image.repository The repository within the registry
## @param tests.bash.image.pullPolicy The image pull policy
## @param tests.bash.image.tag Overrides the image tag whose default is the chart appVersion
##
image:
registry: cgr.dev
repository: chainguard/bash
pullPolicy: IfNotPresent
tag: latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58
## @param kubeConfigs [object] Manage additional kubeconfig files to talk to external Kubernetes clusters
## Each entry sets exactly one of kubeConfig, kubeConfigBase64, externalSecret, or jwtSVIDExec. Use externalSecret
## to reference a kubeconfig from an externally-managed Secret instead of embedding it in values; entries may
## reference different Secrets and mix with inline ones. Use jwtSVIDExec to have the chart generate an
## exec-credential kubeconfig that authenticates to the target cluster with short-lived SPIFFE JWT-SVIDs fetched
## at call time by the exec plugin (see jwtSVIDExecConfig).
kubeConfigs: {}
# clustera:
# kubeConfig: |
# xxxxx
# xxxxx
# clusterb:
# kubeConfigBase64: eXl5Cnl5eQo=
# clusterc:
# externalSecret:
# name: my-kubeconfigs-secret # name of the externally-managed Secret to read from
# key: clusterc # optional, defaults to the entry name
# clusterd:
# jwtSVIDExec:
# server: https://clusterd-api.example.com:6443 # target apiserver URL
# certificateAuthorityData: LS0tLS1CRUdJ... # apiserver CA bundle, base64-encoded PEM (kubeconfig certificate-authority-data)
# audience: k8s # optional, JWT-SVID audience the target expects (default k8s)
## @param jwtSVIDExecConfig.image.registry The OCI registry to pull the exec credential plugin image from
## @param jwtSVIDExecConfig.image.repository The repository within the registry
## @param jwtSVIDExecConfig.image.pullPolicy The image pull policy
## @param jwtSVIDExecConfig.image.tag Overrides the image tag
## @param jwtSVIDExecConfig.pluginPath The path of the plugin binary inside the plugin image, staged for exec by the kubeConfigs consumers
## @param jwtSVIDExecConfig.spiffeID The SPIFFE ID the plugin mints a JWT-SVID for; a full spiffe:// URI, or a "/"-prefixed path expanded with the chart trust domain (e.g. /spire-root); required when any kubeConfigs entry uses jwtSVIDExec
## Global wiring shared by every kubeConfigs entry that uses jwtSVIDExec. The plugin binary is staged from this
## image into the shared plugins volume, and every such entry mints a JWT-SVID for spiffeID from the SPIRE Server
## admin API socket, which is already mounted into the kubeConfigs consumers, so no agent Workload API socket is required.
jwtSVIDExecConfig:
image:
registry: ghcr.io
repository: spiffe/k8s-spiffe-workload-jwt-exec-auth
pullPolicy: IfNotPresent
tag: "0.2.0"
pluginPath: /ko-app/cmd
spiffeID: "/spire-root"
spireIdentityExchange:
## @param spireIdentityExchange.enabled Enable the server side of the SPIRE Identity Exchange system
enabled: false
spike:
## @param spike.enabled Enable the server side of SPIKE
enabled: false
Reference in New Issue View Git Blame Copy Permalink