kfox1111andFaisal Memon
90e3518dca
* Update spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Update spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Update with new features Signed-off-by: Kevin Fox <[email protected]> * Updates Signed-off-by: Kevin Fox <[email protected]> * Point at release Signed-off-by: Kevin Fox <[email protected]> * Fix version Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
275 lines
11 KiB
YAML
275 lines
11 KiB
YAML
# Default configuration for Spire Agent
|
|
# SPDX-License-Identifier: APACHE-2.0
|
|
|
|
## @skip global
|
|
global: {}
|
|
|
|
## @section Chart parameters
|
|
##
|
|
## @param image.registry The OCI registry to pull the image from
|
|
## @param image.repository The repository within the registry
|
|
## @param image.pullPolicy The image pull policy
|
|
## @param image.tag Overrides the image tag whose default is the chart appVersion
|
|
##
|
|
image:
|
|
registry: ghcr.io
|
|
repository: spiffe/spire-ha-agent
|
|
pullPolicy: IfNotPresent
|
|
tag: ""
|
|
|
|
## @param mode If the spire-ha-agent will run in delegated or broker mode
|
|
mode: delegated
|
|
|
|
## @param trustDomain The trust domain to be used for the SPIFFE identifiers
|
|
trustDomain: example.org
|
|
|
|
## @param singleSocket If in singleSocket mode, only one driver is used
|
|
singleSocket: false
|
|
|
|
## @param sockets.single.admin.hostPath Where the admin socket is on disk when in single socket mode
|
|
## @param sockets.a.admin.hostPath Where the a admin socket is on disk
|
|
## @param sockets.b.admin.hostPath Where the b admin sockets is on disk
|
|
## @param sockets.single.broker.hostPath Where the broker socket is on disk when in single socket mode
|
|
## @param sockets.a.broker.hostPath Where the a broker socket is on disk
|
|
## @param sockets.b.broker.hostPath Where the b broker socket is on disk
|
|
## @param sockets.single.workload.hostPath Where the broker socket is on disk when in single socket mode
|
|
## @param sockets.a.workload.hostPath Where the a workload socket is on disk
|
|
## @param sockets.b.workload.hostPath Where the b workload socket is on disk
|
|
sockets:
|
|
single:
|
|
admin:
|
|
hostPath: /var/run/spire/agent/sockets/main/csi.spiffe.io/admin
|
|
broker:
|
|
hostPath: /var/run/spire/agent/sockets/main/csi.spiffe.io/broker
|
|
workload:
|
|
hostPath: /var/run/spire/agent-sockets
|
|
a:
|
|
admin:
|
|
hostPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/admin
|
|
broker:
|
|
hostPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/broker
|
|
workload:
|
|
hostPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/public
|
|
b:
|
|
admin:
|
|
hostPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/admin
|
|
broker:
|
|
hostPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/broker
|
|
workload:
|
|
hostPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/public
|
|
|
|
## @param vsock Use a vsockets to expose the service rather then a unix socket
|
|
vsock: false
|
|
|
|
## @param port Port number to listen on
|
|
port: 999
|
|
|
|
brokerAPI:
|
|
## @param brokerAPI.enabled Serve the SPIFFE Broker API to downstream consumers. Only supported when mode is broker.
|
|
enabled: false
|
|
socket:
|
|
## @param brokerAPI.socket.enabled Serve the broker api on a unix socket
|
|
enabled: true
|
|
## @param brokerAPI.socket.mountOnHost Make the served broker socket visible on the host, so consumers running in other pods on the node can reach it. When false the socket stays in an emptyDir, reachable only from this pod.
|
|
mountOnHost: true
|
|
## @param brokerAPI.socket.hostPath Where the served broker socket is made available on the host when mountOnHost is true
|
|
hostPath: /run/spire/agent/sockets/csi.spiffe.io/broker
|
|
tcp:
|
|
## @param brokerAPI.tcp.enabled Serve the broker api over tcp
|
|
enabled: false
|
|
## @param brokerAPI.tcp.bindAddress The tcp address to bind to
|
|
bindAddress: 0.0.0.0:8788
|
|
## Brokers allowed to use the served broker api, keyed by name. At least one
|
|
## must be enabled when brokerAPI.enabled is true. Add your own alongside
|
|
## these following the same shape.
|
|
brokers:
|
|
spiffefs:
|
|
## @param brokerAPI.brokers.spiffefs.enabled Enable spiffefs as a broker. This feature is experimental.
|
|
enabled: false
|
|
## @param brokerAPI.brokers.spiffefs.idTemplate The default id template
|
|
idTemplate: spiffe://{{ .TrustDomain }}/spiffefs
|
|
allowedReferenceTypes:
|
|
## @param brokerAPI.brokers.spiffefs.allowedReferenceTypes[0].typeURL The type of reference allowed
|
|
## @param brokerAPI.brokers.spiffefs.allowedReferenceTypes[0].allowOverTCP Allow access over TCP
|
|
- typeURL: "type.googleapis.com/spiffe.broker.WorkloadPIDReference"
|
|
allowOverTCP: false
|
|
|
|
upstreamKeepalive:
|
|
## @param upstreamKeepalive.time How often to ping an upstream broker to notice a connection that died silently. 0 disables. Do not lower below 5m: a spire-agent that does not configure a keepalive enforcement policy answers more frequent pings with GOAWAY too_many_pings and drops the connection.
|
|
time: 5m
|
|
## @param upstreamKeepalive.timeout How long to wait for a keepalive ping response before considering the connection dead
|
|
timeout: 20s
|
|
|
|
telemetry:
|
|
prometheus:
|
|
## @param telemetry.prometheus.enabled Flag to enable prometheus monitoring
|
|
enabled: false
|
|
## @param telemetry.prometheus.port Port for prometheus metrics
|
|
port: 9988
|
|
## @param telemetry.prometheus.host Host for prometheus metrics
|
|
host: "0.0.0.0"
|
|
podMonitor:
|
|
## @param telemetry.prometheus.podMonitor.enabled Enable podMonitor for prometheus
|
|
enabled: false
|
|
## @param telemetry.prometheus.podMonitor.namespace Override where to install the podMonitor, if not set will use the same namespace as the spire-ha-agent
|
|
namespace: ""
|
|
## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring
|
|
labels: {}
|
|
|
|
## @param imagePullSecrets [array] Pull secrets for images
|
|
imagePullSecrets: []
|
|
|
|
## @param nameOverride Name override
|
|
nameOverride: ""
|
|
|
|
## @param namespaceOverride Namespace override
|
|
namespaceOverride: ""
|
|
|
|
## @param fullnameOverride Fullname override
|
|
fullnameOverride: ""
|
|
|
|
serviceAccount:
|
|
## @param serviceAccount.create Specifies whether a service account should be created
|
|
create: true
|
|
## @param serviceAccount.annotations [object] Annotations to add to the service account
|
|
annotations: {}
|
|
## @param serviceAccount.name The name of the service account to use.
|
|
## If not set and create is true, a name is generated using the fullname template
|
|
name: ""
|
|
|
|
## @param podAnnotations [object] Annotations to add to pods
|
|
podAnnotations: {}
|
|
|
|
## @param podLabels [object] Labels to add to pods
|
|
podLabels: {}
|
|
|
|
## @param podSecurityContext [object] Pod security context
|
|
podSecurityContext: {}
|
|
# fsGroup: 2000
|
|
|
|
## @param securityContext [object] Security context
|
|
securityContext: {}
|
|
# capabilities:
|
|
# drop:
|
|
# - ALL
|
|
# readOnlyRootFilesystem: true
|
|
# runAsNonRoot: true
|
|
# runAsUser: 1000
|
|
|
|
## @param resources [object] Resource requests and limits
|
|
resources: {}
|
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
|
# choice for the user. This also increases chances charts run on environments with little
|
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
|
# requests:
|
|
# cpu: 50m
|
|
# memory: 64Mi
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
|
|
## @param nodeSelector [object] Node selector
|
|
nodeSelector: {}
|
|
|
|
## @param tolerations [array] List of tolerations
|
|
tolerations: []
|
|
|
|
## @param affinity [object] Node affinity
|
|
affinity: {}
|
|
|
|
## @param updateStrategy.type The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete.
|
|
## @param updateStrategy.rollingUpdate.maxUnavailable Max unavailable pods during update. Can be a number or a percentage.
|
|
updateStrategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxUnavailable: 1
|
|
|
|
# When running as non root, needed to ensure the socket path has the correct permissions.
|
|
# Set runAsUser to a non-zero value in podSecurityContext to run as non-root user.
|
|
fsGroupFix:
|
|
## @param fsGroupFix.image.registry The OCI registry to pull the image from
|
|
## @param fsGroupFix.image.repository The repository within the registry
|
|
## @param fsGroupFix.image.pullPolicy The image pull policy
|
|
## @param fsGroupFix.image.tag Overrides the image tag whose default is the chart appVersion
|
|
##
|
|
image:
|
|
registry: cgr.dev
|
|
repository: chainguard/bash
|
|
pullPolicy: Always
|
|
tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1
|
|
|
|
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
|
resources: {}
|
|
|
|
cid2PID:
|
|
## @param cid2PID.image.registry The OCI registry to pull the image from
|
|
## @param cid2PID.image.repository The repository within the registry
|
|
## @param cid2PID.image.pullPolicy The image pull policy
|
|
## @param cid2PID.image.tag Overrides the image tag whose default is the chart appVersion
|
|
##
|
|
image:
|
|
registry: ghcr.io
|
|
repository: kfox1111/cid2pid
|
|
pullPolicy: Always
|
|
tag: v0.0.3
|
|
|
|
## @param cid2PID.busybox.image.registry The OCI registry to pull the image from
|
|
## @param cid2PID.busybox.image.repository The repository within the registry
|
|
## @param cid2PID.busybox.image.pullPolicy The image pull policy
|
|
## @param cid2PID.busybox.image.tag Overrides the image tag whose default is the chart appVersion
|
|
##
|
|
busybox:
|
|
image:
|
|
registry: docker.io
|
|
repository: library/busybox
|
|
pullPolicy: IfNotPresent
|
|
tag: 1.36.1-uclibc
|
|
|
|
## @param cid2PID.busybox.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
|
resources: {}
|
|
|
|
## @param socketPath The unix socket path to the spire-agent
|
|
socketPath: /run/spire/agent-sockets/spire-agent.sock
|
|
|
|
socketAlternate:
|
|
## @param socketAlternate.names List of alternate names for the socket that workloads might expect to be able to access in the driver mount.
|
|
names:
|
|
- socket
|
|
- spire-agent.sock
|
|
- api.sock
|
|
|
|
## @param socketAlternate.image.registry The OCI registry to pull the image from
|
|
## @param socketAlternate.image.repository The repository within the registry
|
|
## @param socketAlternate.image.pullPolicy The image pull policy
|
|
## @param socketAlternate.image.tag Overrides the image tag whose default is the chart appVersion
|
|
##
|
|
image:
|
|
registry: cgr.dev
|
|
repository: chainguard/bash
|
|
pullPolicy: Always
|
|
tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1
|
|
|
|
## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
|
resources: {}
|
|
|
|
## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.
|
|
priorityClassName: ""
|
|
|
|
## @param extraEnvVars [array] Extra environment variables to be added to the Spire Agent container
|
|
extraEnvVars: []
|
|
|
|
## @param extraVolumes [array] Extra volumes to be mounted on Spire Agent pods
|
|
extraVolumes: []
|
|
|
|
## @param extraVolumeMounts [array] Extra volume mounts for Spire Agent pods
|
|
extraVolumeMounts: []
|
|
|
|
## @param extraContainers [array] Additional containers to create with Spire Agent pods
|
|
extraContainers: []
|
|
|
|
## @param initContainers [array] Additional init containers to create with Spire Agent pods
|
|
initContainers: []
|
|
## @param hostAliases [array] Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/
|
|
hostAliases: []
|