helm-charts-hardened/charts/spire-nested/values.yaml

# Default configuration for Spire chart
# SPDX-License-Identifier: APACHE-2.0

## @section Global parameters
## Note: the parameter values specified here will override the chart level values for these parameters.
##
global:
  k8s:
    ## @param global.k8s.clusterDomain Cluster domain name configured for Spire install
    clusterDomain: cluster.local

  spire:
    ## @param global.spire.clusterName The name of the k8s cluster for Spire install
    clusterName: example-cluster
    ## @param global.spire.jwtIssuer The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset
    jwtIssuer: ""
    ## @param global.spire.trustDomain The trust domain for Spire install
    trustDomain: example.org

    ## @param global.spire.caSubject.country Country for Spire server CA
    ## @param global.spire.caSubject.organization Organization for Spire server CA
    ## @param global.spire.caSubject.commonName Common Name for Spire server CA
    caSubject:
      country: ""
      organization: ""
      commonName: ""

    ## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off.
    ## @param global.spire.recommendations.namespaceLayout Set to true to use recommended values for installing across namespaces
    ## @param global.spire.recommendations.namespacePSS When chart namespace creation is enabled, label them with preffered Pod Security Standard labels
    ## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names
    ## @param global.spire.recommendations.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
    ## @param global.spire.recommendations.securityContexts Set to true to use recommended values for Pod and Container Security Contexts
    ## @param global.spire.recommendations.prometheus Enable prometheus exporters for monitoring
    recommendations:
      enabled: false
      namespaceLayout: true
      namespacePSS: true
      priorityClassName: true
      strictMode: true
      securityContexts: true
      prometheus: true

    image:
      ## @param global.spire.image.registry Override all Spire image registries at once
      registry: ""

    namespaces:
      ## @param global.spire.namespaces.create Set to true to Create all namespaces. If this or either of the namespace specific create flags is set, the namespace will be created.
      create: false
      system:
        ## @param global.spire.namespaces.system.name Name of the Spire system Namespace.
        name: "spire-system"
        ## @param global.spire.namespaces.system.create Create a Namespace for Spire system resources.
        create: false
        ## @param global.spire.namespaces.system.annotations [object] Annotations to apply to the Spire system Namespace.
        annotations: {}
        ## @param global.spire.namespaces.system.labels [object] Labels to apply to the Spire system Namespace.
        labels: {}
      server:
        ## @param global.spire.namespaces.server.name Name of the Spire server Namespace.
        name: "spire-server"
        ## @param global.spire.namespaces.server.create Create a Namespace for Spire server resources.
        create: false
        ## @param global.spire.namespaces.server.annotations [object] Annotations to apply to the Spire server Namespace.
        annotations: {}
        ## @param global.spire.namespaces.server.labels [object] Labels to apply to the Spire server Namespace.
        labels: {}

    ## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
    strictMode: false

    ## @param global.spire.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
    ingressControllerType: ""

    tools:
      kubectl:
        ## @param global.spire.tools.kubectl.tag Set to force the tag to use for all kubectl instances
        tag: ""

  installAndUpgradeHooks:
    ## @param global.installAndUpgradeHooks.enabled Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`)
    enabled: true
  deleteHooks:
    ## @param global.deleteHooks.enabled Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`)
    enabled: true

#  telemetry:
#    prometheus:
#      enabled: true
#      podMonitor:
#        enabled: true
#        # -- Allows to install the PodMonitor in another namespace then the spire components are installed into.
#        namespace: "kube-prometheus-system"
#        labels: {}

tags:
  ## @param tags.nestedRoot Set the chart architecture to root nested
  nestedRoot: false
  ## @param tags.nestedChildFull Set the chart mode to a child cluster with its own nested server
  nestedChildFull: false
  ## @param tags.nestedChildSecurity Set the chart mode to a child cluster for use with a security cluster
  nestedChildSecurity: false
  ## @param tags.haAgentCommon Set the chart mode to deploy the common portion of a spire-ha-agent setup
  haAgentCommon: false
  ## @param tags.bottomTurtleHAA Setup HA side A for use with a Bottom Turtle architecture
  bottomTurtleHAA: false
  ## @param tags.bottomTurtleHAB Setup HA side B for use with a Bottom Turtle architecture
  bottomTurtleHAB: false

## subcharts

## @section Spire agent parameters
## Parameter values for Spire agent
##
# Used with tags [nestedRoot, nestedChildFull]
downstream-spire-agent-full:
  # enabled: true
  ## @param downstream-spire-agent-full.nameOverride Overrides the name of Spire agent pods
  nameOverride: agent-downstream
  server:
    ## @param downstream-spire-agent-full.server.nameOverride The name override setting of the internal SPIRE server
    nameOverride: internal-server
  ## @param downstream-spire-agent-full.bundleConfigMap The name of the configmap that contains the downstream bundle
  bundleConfigMap: spire-bundle-downstream
  ## @param downstream-spire-agent-full.persistence.hostPath Which path to use on the host when persistence.type = hostPath
  persistence:
    hostPath: /var/lib/spire/k8s/downstream-agent

## @section Spire agent parameters
## Parameter values for Spire agent
##
# Used with tags [nestedChildSecurity]
downstream-spire-agent-security:
  # enabled: true
  ## @param downstream-spire-agent-security.nameOverride Overrides the name of Spire agent pods
  nameOverride: agent-downstream
  ## @param downstream-spire-agent-security.bundleConfigMap The name of the configmap that contains the downstream bundle
  bundleConfigMap: spire-bundle-upstream
  serviceAccount:
    ## @param downstream-spire-agent-security.serviceAccount.name The name of the service account to use
    name: spire-agent-upstream
  ## @param downstream-spire-agent-security.persistence.hostPath Which path to use on the host when persistence.type = hostPath
  persistence:
    hostPath: /var/lib/spire/k8s/downstream-agent

## @section Upstream Spire agent parameters
## Parameter values for upstream Spire agent
##
# Used with tags [nestedRoot, nestedChildFull]
upstream-spire-agent:
  # enabled: true
  ## @param upstream-spire-agent.upstream Flag for enabling upstream Spire agent
  upstream: true
  ## @param upstream-spire-agent.nameOverride Name override for upstream Spire agent
  nameOverride: agent-upstream
  ## @param upstream-spire-agent.bundleConfigMap The configmap name for upstream Spire agent bundle
  bundleConfigMap: spire-bundle-upstream
  ## @param upstream-spire-agent.socketPath Socket path where Spire agent socket is mounted
  socketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
  serviceAccount:
    ## @param upstream-spire-agent.serviceAccount.name Service account name for upstream Spire agent
    name: spire-agent-upstream
  healthChecks:
    ## @param upstream-spire-agent.healthChecks.port Health check port number for upstream Spire agent
    port: 9981
  telemetry:
    prometheus:
      ## @param upstream-spire-agent.telemetry.prometheus.port The port where prometheus metrics are available
      port: 9989
  server:
    ## @param upstream-spire-agent.server.nameOverride The name override setting of the root SPIRE server
    nameOverride: root-server
  ## @param upstream-spire-agent.persistence.hostPath Which path to use on the host when persistence.type = hostPath
  persistence:
    hostPath: /var/lib/spire/k8s/upstream-agent

## @section SPIFFE CSI Driver parameters
## Parameter values for spiffe-csi-driver
##
# Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity]
downstream-spiffe-csi-driver:
  # enabled: true
  ## @param downstream-spiffe-csi-driver.fullnameOverride Fullname override
  fullnameOverride: spiffe-csi-driver-downstream

## @section Upstream SPIFFE CSI Driver parameters
## Parameter values for upstream spiffe-csi-driver
##
# Used with tags [nestedRoot, nestedChildFull]
upstream-spiffe-csi-driver:
  # enabled: true
  ## @param upstream-spiffe-csi-driver.fullnameOverride Fullname override
  fullnameOverride: spiffe-csi-driver-upstream
  ## @param upstream-spiffe-csi-driver.pluginName The plugin name for configuring upstream Spiffe CSI driver
  pluginName: upstream.csi.spiffe.io
  ## @param upstream-spiffe-csi-driver.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
  agentSocketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
  healthChecks:
    ## @param upstream-spiffe-csi-driver.healthChecks.port The port where Spiffe CSI driver health checks are exposed
    port: 9810

## @section SPIFFE oidc discovery provider parameters
## Parameter values for spiffe-oidc-discovery-provider
##
# Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity, haAgentCommon]
spiffe-oidc-discovery-provider:
  # enabled: true
  ## @param spiffe-oidc-discovery-provider.fullnameOverride Fullname override
  fullnameOverride: spiffe-oidc-discovery-provider

## @section Tornjak frontend parameters
## Parameter values for Tornjak frontend
##
tornjak-frontend:
  ## @param tornjak-frontend.enabled Enables deployment of Tornjak frontend/UI (Not for production)
  enabled: false

# Used with tags [nestedRoot]
root-spire-server:
  # enabled: true
  ## @param root-spire-server.nameOverride Name override
  nameOverride: root-server
  ## @param root-spire-server.crNameOverride Custom Resource name override
  crNameOverride: root
  controllerManager:
    ## @param root-spire-server.controllerManager.enabled Enable controller manager and provision CRD's
    enabled: true
    externalControllerManagers:
      ## @param root-spire-server.controllerManager.externalControllerManagers.enabled Flag to enable external controller managers
      enabled: true
    validatingWebhookConfiguration:
      ## @param root-spire-server.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
      enabled: false
    ## @param root-spire-server.controllerManager.className specify to use an explicit class name.
    className: spire-mgmt-root-server
    identities:
      clusterSPIFFEIDs:
        child-servers:
          ## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable child servers
          enabled: true
        default:
          ## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable the default cluster spiffe id
          enabled: false
        oidc-discovery-provider:
          ## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled Enable the test-keys identity
          enabled: false
        test-keys:
          ## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable the test-keys identity
          enabled: false
  externalControllerManagers:
    ## @param root-spire-server.externalControllerManagers.enabled Flag to enable external controller managers
    enabled: true
  nodeAttestor:
    k8sPSAT:
      ## @param root-spire-server.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor
      serviceAccountAllowList:
        - spire-agent-upstream
  ## @param root-spire-server.bundleConfigMap The name of the configmap to store the upstream bundle
  bundleConfigMap: spire-bundle-upstream

# Used with tags [nestedChildFull]
external-root-spire-server-full:
  ## @param external-root-spire-server-full.externalServer Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers.
  externalServer: true
  ## @param external-root-spire-server-full.nameOverride Name override
  nameOverride: root-server
  ## @param external-root-spire-server-full.crNameOverride Custom Resource name override
  crNameOverride: root
  controllerManager:
    ## @param external-root-spire-server-full.controllerManager.enabled Enable controller manager and provision CRD's
    enabled: true
    validatingWebhookConfiguration:
      ## @param external-root-spire-server-full.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
      enabled: false
    ## @param external-root-spire-server-full.controllerManager.className specify to use an explicit class name.
    className: spire-mgmt-external-server
    identities:
      clusterSPIFFEIDs:
        child-servers:
          ## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable child servers
          enabled: true
        default:
          ## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable the default cluster spiffe id
          enabled: false
        oidc-discovery-provider:
          ## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled Enable the test-keys identity
          enabled: false
        test-keys:
          ## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable the test-keys identity
          enabled: false
  nodeAttestor:
    k8sPSAT:
      ## @param external-root-spire-server-full.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor
      serviceAccountAllowList:
        - spire-agent-upstream
  ## @param external-root-spire-server-full.bundleConfigMap The name of the configmap to store the upstream bundle
  bundleConfigMap: spire-bundle-upstream

# Used with tags [nestedChildSecurity]
external-root-spire-server-security:
  ## @param external-root-spire-server-security.externalServer Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers.
  externalServer: true
  ## @param external-root-spire-server-security.nameOverride Name override
  nameOverride: root-server
  ## @param external-root-spire-server-security.crNameOverride Custom Resource name override
  crNameOverride: root
  controllerManager:
    ## @param external-root-spire-server-security.controllerManager.enabled Enable controller manager and provision CRD's
    enabled: true
    validatingWebhookConfiguration:
      ## @param external-root-spire-server-security.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
      enabled: false
    ## @param external-root-spire-server-security.controllerManager.className specify to use an explicit class name.
    className: spire-mgmt-external-server
  nodeAttestor:
    k8sPSAT:
      ## @param external-root-spire-server-security.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor
      serviceAccountAllowList:
        - spire-agent-upstream
  ## @param external-root-spire-server-security.bundleConfigMap The name of the configmap to store the upstream bundle
  bundleConfigMap: spire-bundle-upstream

## @section Spire server parameters
## Parameter values for Spire server
##
# Used with tags [nestedRoot, nestedChildFull]
internal-spire-server:
  # enabled: true
  ## @param internal-spire-server.nameOverride Overrides the name of Spire server pods
  nameOverride: internal-server
  controllerManager:
    ## @param internal-spire-server.controllerManager.enabled Enable controller manager and provision CRD's
    enabled: true
    identities:
      clusterSPIFFEIDs:
        oidc-discovery-provider:
          ## @param internal-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames Auto populate dns entries
          autoPopulateDNSNames: false
  externalControllerManagers:
    ## @param internal-spire-server.externalControllerManagers.enabled Flag to enable external controller managers
    enabled: true
  upstreamAuthority:
    spire:
      ## @param internal-spire-server.upstreamAuthority.spire.enabled Enable upstream SPIRE server
      enabled: true
      ## @param internal-spire-server.upstreamAuthority.spire.upstreamDriver Use an upstream driver for authentication
      upstreamDriver: upstream.csi.spiffe.io
      server:
        ## @param internal-spire-server.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server
        nameOverride: root-server
  ## @param internal-spire-server.bundleConfigMap The name of the configmap to store the downstream bundle
  bundleConfigMap: spire-bundle-downstream

# Used with tags [nestedRoot]
external-spire-server:
  # enabled: true
  ## @param external-spire-server.nameOverride Overrides the name of Spire server pods
  nameOverride: external-server
  ## @param external-spire-server.crNameOverride Custom Resource name override
  crNameOverride: external
  controllerManager:
    ## @param external-spire-server.controllerManager.enabled Enable controller manager and provision CRD's
    enabled: true
    validatingWebhookConfiguration:
      ## @param external-spire-server.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
      enabled: false
    ## @param external-spire-server.controllerManager.className specify to use an explicit class name.
    className: spire-mgmt-external-server
    identities:
      clusterSPIFFEIDs:
        default:
          ## @param external-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable the default identity
          enabled: false
        oidc-discovery-provider:
          ## @param external-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled Enable the oidc-discovery-provider identity
          enabled: false
        test-keys:
          ## @param external-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable the test-keys identity
          enabled: false
  externalControllerManagers:
    ## @param external-spire-server.externalControllerManagers.enabled Flag to enable external controller managers
    enabled: true
  upstreamAuthority:
    spire:
      ## @param external-spire-server.upstreamAuthority.spire.enabled Enable upstream SPIRE server
      enabled: true
      ## @param external-spire-server.upstreamAuthority.spire.upstreamDriver Use an upstream driver for authentication
      upstreamDriver: upstream.csi.spiffe.io
      server:
        ## @param external-spire-server.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server
        nameOverride: root-server
  bundlePublisher:
    k8sConfigMap:
      ## @param external-spire-server.bundlePublisher.k8sConfigMap.enabled Enable local k8s bundle uploader
      enabled: false
  nodeAttestor:
    k8sPSAT:
      ## @param external-spire-server.nodeAttestor.k8sPSAT.enabled Enable PSAT k8s nodeattestor
      enabled: false
    joinToken:
      ## @param external-spire-server.nodeAttestor.joinToken.enabled Enable the join_token nodeattestor
      enabled: true

# Used with tags [haAgentCommon]
spiffe-csi-driver:
  # enabled: true
  ## @param spiffe-csi-driver.fullnameOverride Fullname override
  fullnameOverride: spiffe-csi-driver
  ## @param spiffe-csi-driver.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
  agentSocketPath: /var/run/spire/agent-sockets/spire-agent.sock
  healthChecks:
    ## @param spiffe-csi-driver.healthChecks.port Health check port number for upstream Spire agent
    port: 9814

# Used with tags [haAgentCommon]
spire-ha-agent:
  # enabled: true
  ## @param spire-ha-agent.fullnameOverride Fullname override
  fullnameOverride: spire-ha-agent

## @section Upstream SPIFFE CSI Driver for Bottom Turtle HA A parameters
## Parameter values for upstream spiffe-csi-driver-bottom-turtle-ha-a
##
# Used with tags [bottomTurtleHAA]
upstream-spiffe-csi-driver-bottom-turtle-ha-a:
  # enabled: true
  ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.fullnameOverride Fullname override
  fullnameOverride: spiffe-csi-driver-upstream-a
  ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.pluginName The plugin name for configuring upstream Spiffe CSI driver
  pluginName: upstream-a.csi.spiffe.io
  ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
  agentSocketPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public/spire-agent.sock
  healthChecks:
    ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.healthChecks.port The port where Spiffe CSI driver health checks are exposed
    port: 9810
  validatingAdmissionPolicy:
    ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.validatingAdmissionPolicy.enabled Flag to enable validating policy
    enabled: true

## @section Upstream SPIFFE CSI Driver for Bottom Turtle HA B parameters
## Parameter values for upstream spiffe-csi-driver-bottom-turtle-ha-b
##
# Used with tags [bottomTurtleHAB]
upstream-spiffe-csi-driver-bottom-turtle-ha-b:
  # enabled: true
  ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.fullnameOverride Fullname override
  fullnameOverride: spiffe-csi-driver-upstream-b
  ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.pluginName The plugin name for configuring upstream Spiffe CSI driver
  pluginName: upstream-b.csi.spiffe.io
  ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
  agentSocketPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public/spire-agent.sock
  healthChecks:
    ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.healthChecks.port The port where Spiffe CSI driver health checks are exposed
    port: 9812
  validatingAdmissionPolicy:
    ## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.validatingAdmissionPolicy.enabled Flag to enable validating policy
    enabled: true

## @section Spire server parameters
## Parameter values for Spire server
##
# Used with tags [bottomTurtleHAA]
internal-spire-server-bottom-turtle-ha-a:
  # enabled: true
  ## @param internal-spire-server-bottom-turtle-ha-a.nameOverride Overrides the name of Spire server pods
  nameOverride: internal-server
  ## @param internal-spire-server-bottom-turtle-ha-a.caKeyType Key type to use for the ca
  caKeyType: ec-p256
  experimental:
    ## @param internal-spire-server-bottom-turtle-ha-a.experimental.enabled enable experimental features
    enabled: true
    ## @param internal-spire-server-bottom-turtle-ha-a.experimental.agentSPIFFEIDAsSelector enable adding spiffe_id selectors to all agents
    agentSPIFFEIDAsSelector: true
  dynamicRegistration:
    ## @param internal-spire-server-bottom-turtle-ha-a.dynamicRegistration.enabled Enable dynamic registration
    enabled: true
    ## @param internal-spire-server-bottom-turtle-ha-a.dynamicRegistration.allowedIDPrefix The allowed ID prefix
    allowedIDPrefix: "spire/agent/x509pop/k8s"
    ## @param internal-spire-server-bottom-turtle-ha-a.dynamicRegistration.serviceAccount The service account to allow in for dynamic registration
    serviceAccount: spire-a-agent
  controllerManager:
    ## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.enabled Enable controller manager and provision CRD's
    enabled: true
    ## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.parentIDTemplate parent id template
    parentIDTemplate: "spiffe://{{ .TrustDomain }}/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"
    identities:
      clusterSPIFFEIDs:
        oidc-discovery-provider:
          ## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames Auto populate dns entries
          autoPopulateDNSNames: false
          ## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type The type of the entry
          type: oidc-discovery-provider-common
        spire-ha-agent:
          ## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled Enables the spire-ha-agent identity
          enabled: true
  persistence:
    ## @param internal-spire-server-bottom-turtle-ha-a.persistence.type What type to use for peristence
    type: emptyDir
  nodeAttestor:
    k8sPSAT:
      ## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.k8sPSAT.enabled Enable the k8s projected access token node attestor
      enabled: false
    x509POP:
      ## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
      enabled: true
      ## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.svidPrefix What prefix to use when mode is spiffe
      svidPrefix: /spire-exchange/k8s
      ## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
      agentPathTemplate: "/{{ .PluginName }}/{{ .SVIDPathTrimmed }}/k8s"
      addClusterName:
        ## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.svidPrefix Suffix the cluster name onto the svidPrefix
        svidPrefix: true
        ## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
        agentPathTemplate: true
  upstreamAuthority:
    spire:
      ## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.enabled Enable upstream SPIRE server
      enabled: true
      ## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.upstreamDriver Use an upstream driver for authentication
      upstreamDriver: upstream-a.csi.spiffe.io
      server:
        ## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server
        nameOverride: root-server
        ## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.server.address Address for upstream Spire server
        address: "spire-server-a"
        ## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.server.port The port setting of the root SPIRE server
        port: 8081
  ## @param internal-spire-server-bottom-turtle-ha-a.bundleConfigMap The name of the configmap to store the downstream bundle
  bundleConfigMap: spire-server-a-bundle
  trustSync:
    ## @param internal-spire-server-bottom-turtle-ha-a.trustSync.enabled Enable trust syncing
    enabled: true
    ## @param internal-spire-server-bottom-turtle-ha-a.trustSync.domains the trust domains to sync
    domains:
    - spire-ha

## @section Spire server parameters
## Parameter values for Spire server
##
# Used with tags [bottomTurtleHAB]
internal-spire-server-bottom-turtle-ha-b:
  # enabled: true
  ## @param internal-spire-server-bottom-turtle-ha-b.nameOverride Overrides the name of Spire server pods
  nameOverride: internal-server
  ## @param internal-spire-server-bottom-turtle-ha-b.caKeyType Key type to use for the ca
  caKeyType: ec-p256
  experimental:
    ## @param internal-spire-server-bottom-turtle-ha-b.experimental.enabled enable experimental features
    enabled: true
    ## @param internal-spire-server-bottom-turtle-ha-b.experimental.agentSPIFFEIDAsSelector enable adding spiffe_id selectors to all agents
    agentSPIFFEIDAsSelector: true
  dynamicRegistration:
    ## @param internal-spire-server-bottom-turtle-ha-b.dynamicRegistration.enabled Enable dynamic registration
    enabled: true
    ## @param internal-spire-server-bottom-turtle-ha-b.dynamicRegistration.allowedIDPrefix The allowed ID prefix
    allowedIDPrefix: "spire/agent/x509pop/k8s"
    ## @param internal-spire-server-bottom-turtle-ha-b.dynamicRegistration.serviceAccount The service account to allow in for dynamic registration
    serviceAccount: spire-b-agent
  controllerManager:
    ## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.enabled Enable controller manager and provision CRD's
    enabled: true
    ## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.parentIDTemplate parent id template
    parentIDTemplate: "spiffe://{{ .TrustDomain }}/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"
    identities:
      clusterSPIFFEIDs:
        oidc-discovery-provider:
          ## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames Auto populate dns entries
          autoPopulateDNSNames: false
          ## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type The type of the entry
          type: oidc-discovery-provider-common
        spire-ha-agent:
          ## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled Enables the spire-ha-agent identity
          enabled: true
  persistence:
    ## @param internal-spire-server-bottom-turtle-ha-b.persistence.type What type to use for peristence
    type: emptyDir
  nodeAttestor:
    k8sPSAT:
      ## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.k8sPSAT.enabled Enable the k8s projected access token node attestor
      enabled: false
    x509POP:
      ## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
      enabled: true
      ## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.svidPrefix What prefix to use when mode is spiffe
      svidPrefix: /spire-exchange/k8s
      ## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
      agentPathTemplate: "/{{ .PluginName }}/{{ .SVIDPathTrimmed }}/k8s"
      addClusterName:
        ## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.svidPrefix Suffix the cluster name onto the svidPrefix
        svidPrefix: true
        ## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
        agentPathTemplate: true
  upstreamAuthority:
    spire:
      ## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.enabled Enable upstream SPIRE server
      enabled: true
      ## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.upstreamDriver Use an upstream driver for authentication
      upstreamDriver: upstream-b.csi.spiffe.io
      server:
        ## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server
        nameOverride: root-server
        ## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.address Address for upstream Spire server
        address: "spire-server-b"
        ## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.port The port setting of the root SPIRE server
        port: 8081
  ## @param internal-spire-server-bottom-turtle-ha-b.bundleConfigMap The name of the configmap to store the downstream bundle
  bundleConfigMap: spire-server-b-bundle
  trustSync:
    ## @param internal-spire-server-bottom-turtle-ha-b.trustSync.enabled Enable trust syncing
    enabled: true
    ## @param internal-spire-server-bottom-turtle-ha-b.trustSync.domains the trust domains to sync
    domains:
    - spire-ha

# Used with tags [bottomTurtleHAA]
downstream-spire-agent-bottom-turtle-ha-a:
  # enabled: true
  ## @param downstream-spire-agent-bottom-turtle-ha-a.nameOverride Overrides the name of Spire agent pods
  nameOverride: agent-downstream
  server:
    ## @param downstream-spire-agent-bottom-turtle-ha-a.server.nameOverride The name override setting of the internal SPIRE server
    nameOverride: internal-server
  ## @param downstream-spire-agent-bottom-turtle-ha-a.bundleConfigMap The name of the configmap that contains the downstream bundle
  bundleConfigMap: spire-server-a-bundle
  ## @param downstream-spire-agent-bottom-turtle-ha-a.persistence.hostPath Which path to use on the host when persistence.type = hostPath
  persistence:
    hostPath: /var/lib/spire/k8s/downstream-agent-a
  dynamicRegistration:
    ## @param downstream-spire-agent-bottom-turtle-ha-a.dynamicRegistration.enabled Enable dynamic registration
    enabled: true
    ## @param downstream-spire-agent-bottom-turtle-ha-a.dynamicRegistration.nameOverride The name override to use to contact the server
    nameOverride: internal-server
  nodeAttestor:
    k8sPSAT:
      ## @param downstream-spire-agent-bottom-turtle-ha-a.nodeAttestor.k8sPSAT.enabled Enable the k8s projected access token node attestor
      enabled: false
    x509POP:
      ## @param downstream-spire-agent-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
      enabled: true
      ## @param downstream-spire-agent-bottom-turtle-ha-a.nodeAttestor.x509POP.spiffeEndpointSocket Where the socket is to use for mode spiffe
      spiffeEndpointSocket: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public/api.sock
  keyManager:
    memory:
      ## @param downstream-spire-agent-bottom-turtle-ha-a.keyManager.memory.enabled Enable the memory based Key Manager
      enabled: false
    disk:
      ## @param downstream-spire-agent-bottom-turtle-ha-a.keyManager.disk.enabled Enable the disk key manager
      enabled: true
      ## @param downstream-spire-agent-bottom-turtle-ha-a.keyManager.disk.mode Where the disk plugin will write out its data
      mode: emptyDir
  healthChecks:
    ## @param downstream-spire-agent-bottom-turtle-ha-a.healthChecks.port Health check port
    port: 9981
  telemetry:
    prometheus:
      ## @param downstream-spire-agent-bottom-turtle-ha-a.telemetry.prometheus.port Prometheus port to use
      port: 9989
  ## @param downstream-spire-agent-bottom-turtle-ha-a.socketPath Socket path to use
  socketPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
  sockets:
    ## @param downstream-spire-agent-bottom-turtle-ha-a.sockets.hostBasePath Path on the host to place sockets
    hostBasePath: /var/run/spire/agent/sockets/a
    admin:
      ## @param downstream-spire-agent-bottom-turtle-ha-a.sockets.admin.enabled Enable admin socket
      enabled: true
      ## @param downstream-spire-agent-bottom-turtle-ha-a.sockets.admin.mountOnHost Mount admin socket on host
      mountOnHost: true
  ## @param downstream-spire-agent-bottom-turtle-ha-a.authorizedDelegates List of workloads able to use the delegation api
  authorizedDelegates:
  - /spire-ha-agent

# Used with tags [bottomTurtleHAB]
downstream-spire-agent-bottom-turtle-ha-b:
  # enabled: true
  ## @param downstream-spire-agent-bottom-turtle-ha-b.nameOverride Overrides the name of Spire agent pods
  nameOverride: agent-downstream
  server:
    ## @param downstream-spire-agent-bottom-turtle-ha-b.server.nameOverride The name override setting of the internal SPIRE server
    nameOverride: internal-server
  ## @param downstream-spire-agent-bottom-turtle-ha-b.bundleConfigMap The name of the configmap that contains the downstream bundle
  bundleConfigMap: spire-server-b-bundle
  ## @param downstream-spire-agent-bottom-turtle-ha-b.persistence.hostPath Which path to use on the host when persistence.type = hostPath
  persistence:
    hostPath: /var/lib/spire/k8s/downstream-agent-b
  dynamicRegistration:
    ## @param downstream-spire-agent-bottom-turtle-ha-b.dynamicRegistration.enabled Enable dynamic registration
    enabled: true
    ## @param downstream-spire-agent-bottom-turtle-ha-b.dynamicRegistration.nameOverride The name override to use to contact the server
    nameOverride: internal-server
  nodeAttestor:
    k8sPSAT:
      ## @param downstream-spire-agent-bottom-turtle-ha-b.nodeAttestor.k8sPSAT.enabled Enable the k8s projected access token node attestor
      enabled: false
    x509POP:
      ## @param downstream-spire-agent-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
      enabled: true
      ## @param downstream-spire-agent-bottom-turtle-ha-b.nodeAttestor.x509POP.spiffeEndpointSocket Where the socket is to use for mode spiffe
      spiffeEndpointSocket: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public/api.sock
  keyManager:
    memory:
      ## @param downstream-spire-agent-bottom-turtle-ha-b.keyManager.memory.enabled Enable the memory based Key Manager
      enabled: false
    disk:
      ## @param downstream-spire-agent-bottom-turtle-ha-b.keyManager.disk.enabled Enable the disk key manager
      enabled: true
      ## @param downstream-spire-agent-bottom-turtle-ha-b.keyManager.disk.mode Where the disk plugin will write out its data
      mode: emptyDir
  healthChecks:
    ## @param downstream-spire-agent-bottom-turtle-ha-b.healthChecks.port Health check port
    port: 9982
  telemetry:
    prometheus:
      ## @param downstream-spire-agent-bottom-turtle-ha-b.telemetry.prometheus.port Prometheus port to use
      port: 9990
  ## @param downstream-spire-agent-bottom-turtle-ha-b.socketPath Socket path to use
  socketPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock
  sockets:
    ## @param downstream-spire-agent-bottom-turtle-ha-b.sockets.hostBasePath Path on the host to place sockets
    hostBasePath: /var/run/spire/agent/sockets/b
    admin:
      ## @param downstream-spire-agent-bottom-turtle-ha-b.sockets.admin.enabled Enable admin socket
      enabled: true
      ## @param downstream-spire-agent-bottom-turtle-ha-b.sockets.admin.mountOnHost Mount admin socket on host
      mountOnHost: true
  ## @param downstream-spire-agent-bottom-turtle-ha-b.authorizedDelegates List of workloads able to use the delegation api
  authorizedDelegates:
  - /spire-ha-agent

# Used with tags [bottomTurtleHAA]
downstream-spiffe-csi-driver-bottom-turtle-ha-a:
  # enabled: true
  ## @param downstream-spiffe-csi-driver-bottom-turtle-ha-a.fullnameOverride Fullname override
  fullnameOverride: spiffe-csi-driver-downstream-a
  ## @param downstream-spiffe-csi-driver-bottom-turtle-ha-a.agentSocketPath path to agent socket
  agentSocketPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
  ## @param downstream-spiffe-csi-driver-bottom-turtle-ha-a.pluginName The name of the plugin instance
  pluginName: a.csi.spiffe.io
  healthChecks:
    ## @param downstream-spiffe-csi-driver-bottom-turtle-ha-a.healthChecks.port The health check port
    port: 9814

# Used with tags [bottomTurtleHAB]
downstream-spiffe-csi-driver-bottom-turtle-ha-b:
  # enabled: true
  ## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.fullnameOverride Fullname override
  fullnameOverride: spiffe-csi-driver-downstream-b
  ## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.agentSocketPath path to agent socket
  agentSocketPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock
  ## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.pluginName The name of the plugin instance
  pluginName: b.csi.spiffe.io
  healthChecks:
    ## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.healthChecks.port The health check port
    port: 9816