300 lines
8.3 KiB
YAML
300 lines
8.3 KiB
YAML
# Default values for spire-server.
|
|
# This is a YAML-formatted file.
|
|
# Declare variables to be passed into your templates.
|
|
|
|
# -- SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database.
|
|
replicaCount: 1
|
|
|
|
image:
|
|
# -- The OCI registry to pull the image from
|
|
registry: ghcr.io
|
|
# -- The repository within the registry
|
|
repository: spiffe/spire-server
|
|
# -- The image pull policy
|
|
pullPolicy: IfNotPresent
|
|
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
version: ""
|
|
# -- Overrides the image tag whose default is the chart appVersion.
|
|
tag: ""
|
|
|
|
imagePullSecrets: []
|
|
nameOverride: ""
|
|
namespaceOverride: ""
|
|
fullnameOverride: ""
|
|
|
|
serviceAccount:
|
|
# -- Specifies whether a service account should be created
|
|
create: true
|
|
# -- Annotations to add to the service account
|
|
annotations: {}
|
|
# -- The name of the service account to use.
|
|
# If not set and create is true, a name is generated using the fullname template
|
|
name: ""
|
|
|
|
podAnnotations: {}
|
|
|
|
podSecurityContext: {}
|
|
# fsGroup: 2000
|
|
|
|
securityContext: {}
|
|
# capabilities:
|
|
# drop:
|
|
# - ALL
|
|
# readOnlyRootFilesystem: true
|
|
# runAsNonRoot: true
|
|
# runAsUser: 1000
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 8081
|
|
annotations: {}
|
|
|
|
configMap:
|
|
# -- Annotations to add to the SPIRE Server ConfigMap
|
|
annotations: {}
|
|
|
|
resources: {}
|
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
|
# choice for the user. This also increases chances charts run on environments with little
|
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
|
# requests:
|
|
# cpu: 200m
|
|
# memory: 256Mi
|
|
# limits:
|
|
# cpu: 200m
|
|
# memory: 256Mi
|
|
|
|
autoscaling:
|
|
enabled: false
|
|
minReplicas: 1
|
|
maxReplicas: 100
|
|
targetCPUUtilizationPercentage: 80
|
|
# targetMemoryUtilizationPercentage: 80
|
|
|
|
# -- Select specific nodes to run on (currently only amd64 is supported by Tornjak)
|
|
nodeSelector: {}
|
|
|
|
tolerations: []
|
|
|
|
affinity: {}
|
|
|
|
topologySpreadConstraints: []
|
|
|
|
persistence:
|
|
size: 1Gi
|
|
accessMode: ReadWriteOnce
|
|
storageClass: null
|
|
|
|
dataStore:
|
|
sql:
|
|
# -- Other supported databases are "postgres" and "mysql"
|
|
databaseType: sqlite3
|
|
# -- Only used by "postgres" or "mysql"
|
|
databaseName: spire
|
|
# -- Only used by "postgres" or "mysql"
|
|
host: ""
|
|
# -- If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases.
|
|
port: 0
|
|
# -- Only used by "postgres" or "mysql"
|
|
username: spire
|
|
# -- Only used by "postgres" or "mysql"
|
|
password: ""
|
|
# -- Only used by "postgres" or "mysql"
|
|
options: []
|
|
|
|
# -- Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section
|
|
plugin_data: {}
|
|
|
|
# -- The log level, valid values are "debug", "info", "warn", and "error"
|
|
logLevel: info
|
|
# -- The JWT issuer domain
|
|
jwtIssuer: oidc-discovery.example.org
|
|
|
|
# -- Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`)
|
|
clusterName: example-cluster
|
|
# -- Set the trust domain to be used for the SPIFFE identifiers
|
|
trustDomain: example.org
|
|
|
|
bundleConfigMap: spire-bundle
|
|
|
|
# -- This is the value of your clusters `kubeadm init --service-dns-domain` flag
|
|
clusterDomain: cluster.local
|
|
|
|
federation:
|
|
enabled: false
|
|
bundleEndpoint:
|
|
port: 8443
|
|
address: "0.0.0.0"
|
|
|
|
ca_subject:
|
|
country: NL
|
|
organization: Example
|
|
common_name: example.org
|
|
|
|
upstreamAuthority:
|
|
disk:
|
|
enabled: false
|
|
secret:
|
|
# -- If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself.
|
|
create: true
|
|
# -- If secret creation is disabled, the secret with this name will be used.
|
|
name: "spiffe-upstream-ca"
|
|
# -- If secret creation is enabled, will create a secret with following certificate info
|
|
data:
|
|
certificate: ""
|
|
key: ""
|
|
bundle: ""
|
|
certManager:
|
|
enabled: false
|
|
rbac:
|
|
create: true
|
|
issuer_name: "spire-ca"
|
|
issuer_kind: "Issuer"
|
|
issuer_group: "cert-manager.io"
|
|
# -- Specify to use a namespace other then the one the chart is installed into
|
|
namespace: ""
|
|
kube_config_file: ""
|
|
|
|
notifier:
|
|
k8sbundle:
|
|
# -- Namespace to push the bundle into, if blank will default to SPIRE Server namespace
|
|
namespace: ""
|
|
|
|
controllerManager:
|
|
enabled: false
|
|
|
|
image:
|
|
# -- The OCI registry to pull the image from
|
|
registry: ghcr.io
|
|
# -- The repository within the registry
|
|
repository: spiffe/spire-controller-manager
|
|
# -- The image pull policy
|
|
pullPolicy: IfNotPresent
|
|
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
version: ""
|
|
# -- Overrides the image tag
|
|
tag: "0.2.2"
|
|
|
|
resources: {}
|
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
|
# choice for the user. This also increases chances charts run on environments with little
|
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
|
|
securityContext: {}
|
|
# capabilities:
|
|
# drop:
|
|
# - ALL
|
|
# readOnlyRootFilesystem: true
|
|
# runAsNonRoot: true
|
|
# runAsUser: 1000
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 443
|
|
annotations: {}
|
|
|
|
configMap:
|
|
# -- Annotations to add to the Controller Manager ConfigMap
|
|
annotations: {}
|
|
|
|
ignoreNamespaces:
|
|
- kube-system
|
|
- kube-public
|
|
- local-path-storage
|
|
|
|
identities:
|
|
enabled: true
|
|
|
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
|
podSelector: {}
|
|
# matchLabels:
|
|
# spiffe.io/spiffe-id: "true"
|
|
namespaceSelector: {}
|
|
# matchLabels:
|
|
# spiffe.io/spiffe-id: "true"
|
|
dnsNameTemplates: []
|
|
# - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local'
|
|
|
|
validatingWebhookConfiguration:
|
|
failurePolicy: Fail
|
|
upgradeHook:
|
|
image:
|
|
# -- The OCI registry to pull the image from
|
|
registry: docker.io
|
|
# -- The repository within the registry
|
|
repository: rancher/kubectl
|
|
# -- The image pull policy
|
|
pullPolicy: IfNotPresent
|
|
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
version: ""
|
|
# -- Overrides the image tag
|
|
tag: ""
|
|
|
|
telemetry:
|
|
prometheus:
|
|
enabled: false
|
|
podMonitor:
|
|
enabled: false
|
|
# -- Override where to install the podMonitor, if not set will use the same namespace as the spire-server
|
|
namespace: ""
|
|
labels: {}
|
|
|
|
extraVolumes: []
|
|
extraVolumeMounts: []
|
|
extraContainers: []
|
|
|
|
initContainers: []
|
|
|
|
# -- The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported)
|
|
caKeyType: rsa-2048
|
|
caTTL: 24h
|
|
defaultX509SvidTTL: 4h
|
|
defaultJwtSvidTTL: 1h
|
|
|
|
nodeAttestor:
|
|
k8sPsat:
|
|
enabled: true
|
|
serviceAccountAllowList: []
|
|
|
|
# tornjak - Tornjak specific configuration
|
|
tornjak:
|
|
# -- Deploys Tornjak API (backend)
|
|
enabled: false
|
|
# -- Tornjak API image
|
|
image:
|
|
registry: ghcr.io
|
|
repository: spiffe/tornjak-backend
|
|
pullPolicy: IfNotPresent
|
|
# -- This value is deprecated in favor of tag. (Will be removed in a future release)
|
|
version: ""
|
|
# -- Overrides the image tag
|
|
tag: "v1.2.0"
|
|
service:
|
|
type: ClusterIP
|
|
port: 10000
|
|
annotations: {}
|
|
config:
|
|
# -- persistent DB for storing Tornjak specific information
|
|
dataStore:
|
|
driver: "sqlite3"
|
|
file: "/run/spire/data/tornjak.sqlite3"
|
|
resources: {}
|
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
|
# choice for the user. This also increases chances charts run on environments with little
|
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|