helm-charts-hardened/charts/spire/charts/spire-server/README.md

spire-server

A Helm chart to install the SPIRE server.

Homepage: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire

Maintainers

Name	Email	Url
marcofranssen	[email protected]	https://marcofranssen.nl
kfox1111	[email protected]
faisal-memon	[email protected]
edwbuck	[email protected]

Source Code

• https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire

Tornjak

Tornjak is the UI and Control Plane for SPIRE https://github.com/spiffe/tornjak and it is composed of two components:

• Backend (this chart) - Tornjak APIs that extend SPIRE APIs with Control Plane functionality
• Frontend - Tornjak UI

When Tornjak is enabled, it is exposed on both http and https (if TLS server certs are configured). Tornjak handles a permanent redirect from http to https to ensure users always use the https endpoint.

In addition, you can configure a client certificate authority, this will make Tornjak backend verify Client certificates signed by this authority to enable mTLS authentication.

Important

For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access.

Tornjak with TLS Connection Type

TLS connection requires Tornjak to have access to TLS key and certificate. Complete instruction on creating your own TLS certificate can be found here. TLS Certificate and the private key must be provided to Tornjak via TLS Secret. Prior to deploying this Helm chart, create TLS Secret in the deployment namespace (e.g. spire-server)

kubectl -n spire-server create secret tls tornjak-tls-secret --cert=client.crt --key=client.key

Once the charts are deployed, you can test the TLS connection with the following command (assuming localhost):

curl --cacert CA/rootCA.crt https://localhost:10443

Tornjak with mTLS Connection Type

mTLS connection allows Tornjak server validation by client and Tornjak client validation by Tornjak server. The server validation is identical to above TLS. Follow the steps to create TLS secret with key and the certificate.

Additionally, you must provide the user CA to Tornjak server via Secret or ConfigMap. Follow the steps to create user CA for mTLS, then create a Secret (or ConfigMap) prior to deploying this Helm chart.

Here is an example using a Secret in spire-server namespace:

kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt"

Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost):

curl  --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhost:10443

Tornjak with HTTP Connection Type

In order to run Tornjak with simple HTTP Connection only, make sure you don't create any Secrets or ConfigMaps listed above.

Parameters

Chart parameters

Name	Description	Value
replicaCount	SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database.	1
image.registry	The OCI registry to pull the image from	ghcr.io
image.repository	The repository within the registry	spiffe/spire-server
image.pullPolicy	The image pull policy	IfNotPresent
image.tag	Overrides the image tag whose default is the chart appVersion	""
kind	Define SPIRE server deployment type. Can be statefulset/deployment. Defaults to statefulset if not set. This feature is experimental.	statefulset
externalServer	Deploy only the bundle ConfigMap, RBAC rules, and identity documents but not the server. Use in a nested setup where the server is external.	false
imagePullSecrets	Pull secrets for images	[]
nameOverride	Name override	""
crNameOverride	Name override for any custom resources	""
namespaceOverride	Namespace override	""
fullnameOverride	Fullname override	""
serviceAccount.create	Specifies whether a service account should be created	true
serviceAccount.annotations	Annotations to add to the service account	{}
serviceAccount.name	The name of the service account to use. If not set and create is true, a name is generated.	""
podAnnotations	Annotations to add to pods	{}
podLabels	Labels to add to pods	{}
podSecurityContext	Pod security context	{}
securityContext	Security context	{}
priorityClassName	Priority class assigned to statefulset pods. Can be auto set with global.recommendations.priorityClassName.	""
service.type	Type of the Spire server service created	ClusterIP
service.port	Port for the created service	443
service.annotations	Annotations to add to the service object	{}
service.loadBalancerIP	IP address to assign to load balancer (if supported)	""
configMap.annotations	Annotations to add to the SPIRE Server ConfigMap	{}
resources	Resource requests and limits	{}
autoscaling.enabled	Flag to enable autoscaling	false
autoscaling.minReplicas	Minimum replicas for autoscaling	1
autoscaling.maxReplicas	Maximum replicas for autoscaling	100
autoscaling.targetCPUUtilizationPercentage	Target CPU utilization that triggers autoscaling	80
nodeSelector	Select specific nodes to run on (currently only amd64 is supported by Tornjak)	{}
tolerations	List of tolerations	[]
affinity	List of node affinities	{}
topologySpreadConstraints	Topology spread constraints for resilience	[]
livenessProbe.failureThreshold	Failure threshold count for livenessProbe	2
livenessProbe.initialDelaySeconds	Initial delay seconds for livenessProbe	15
livenessProbe.periodSeconds	Period seconds for livenessProbe	60
livenessProbe.timeoutSeconds	Timeout in seconds for livenessProbe	3
readinessProbe.initialDelaySeconds	Initial delay seconds for readinessProbe	5
readinessProbe.periodSeconds	Period seconds for readinessProbe	5
persistence.type	What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only)	pvc
persistence.size	What size volume to use for persistence	1Gi
persistence.accessMode	What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended)	ReadWriteOnce
persistence.storageClass	What storage class to use for persistence	nil
persistence.hostPath	Which path to use on the host when persistence.type = hostPath	""
dataStore.sql.databaseType	Other supported databases are ["postgres", "mysql", "aws_postgresql", "aws_mysql", "gcp_mysql_sa_iam"]. Note: aws type databases are still experimental. gcp_mysql_sa_iam uses IAM authentication by default.	sqlite3
dataStore.sql.databaseName	Only used when type != "sqlite3"	spire
dataStore.sql.host	Only used when type != "sqlite3"	""
dataStore.sql.port	If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases.	0
dataStore.sql.username	Only used when type != "sqlite3"	spire
dataStore.sql.password	Only used when type != "sqlite3"	""
dataStore.sql.file	Data source file. Only used when type == "sqlite3"	/run/spire/data/datastore.sqlite3
dataStore.sql.options	takes an array of objects of form {: } to use when building the database connection string	[]
dataStore.sql.rootCAPath	Path to Root CA bundle (MySQL only)	""
dataStore.sql.clientCertPath	Path to client certificate (MySQL only)	""
dataStore.sql.clientKeyPath	Path to private key for client certificate (MySQL only)	""
dataStore.sql.externalSecret.enabled	Enable external secret for datastore creds	false
dataStore.sql.externalSecret.name	The name of the secret object	""
dataStore.sql.externalSecret.key	The key of the secret object whose value is the dataStore.sql password	""
dataStore.sql.maxOpenConns	The maximum number of open db connections	100
dataStore.sql.maxIdleConns	The maximum number of idle connections in the pool	2
dataStore.sql.connMaxLifetime	The maximum amount of time a connection may be reused. If 0, time is unlimited	0
dataStore.sql.disableMigration	True to disable auto-migration functionality	false
dataStore.sql.region	Region to use when database type is either aws_mysql or aws_postgresql	""
dataStore.sql.readOnly.enabled	Set to true to configure a readOnly dartabase connection	false
dataStore.sql.readOnly.host	Only used when type != "sqlite3"	""
dataStore.sql.readOnly.port	If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases.	0
dataStore.sql.readOnly.username	Only used when type != "sqlite3"	spire
dataStore.sql.readOnly.password	Only used when type != "sqlite3"	""
dataStore.sql.readOnly.options	Only used when type != "sqlite3"	[]
dataStore.sql.readOnly.externalSecret.enabled	Enable external secret for datastore creds	false
dataStore.sql.readOnly.externalSecret.name	The name of the secret object	""
dataStore.sql.readOnly.externalSecret.key	The key of the secret object whose value is the dataStore.sql password	""
adminIDs	SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges.	[]
auditLogEnabled	If true, enables audit logging	false
logLevel	The log level, valid values are "debug", "info", "warn", and "error"	info
jwtIssuer	The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset	""
clusterName	Set the name of the Kubernetes cluster. (kubeadm init --service-dns-domain)	example-cluster
trustDomain	Set the trust domain to be used for the SPIFFE identifiers	example.org
bundleConfigMap	Set the Configmap name for SPIRE bundle	spire-bundle
clusterDomain	This is the value of your clusters kubeadm init --service-dns-domain flag	cluster.local
federation.enabled	Flag to enable federation	false
federation.bundleEndpoint.port	Port value for trust bundle federation	8443
federation.bundleEndpoint.address	Address for trust bundle federation	0.0.0.0
federation.bundleEndpoint.refreshHint	Hint used by federated servers on how often to refresh the bundle. CA TTL must be 3-5x the duration of this value to ensure public keys are loaded on federated servers prior to private key rotation on remote server.	5m
federation.bundleEndpoint.profile.httpWeb.fileSyncInterval	Interval on which to reload the certificate/key from disk	1h
federation.tls.spire.enabled	Use spire to secure the federation bundle endpoint	true
federation.tls.externalSecret.enabled	Provide your own certificate/key via tls style Kubernetes Secret	false
federation.tls.externalSecret.secretName	Specify which Secret to use	""
federation.tls.certManager.enabled	Use certificateManager to create the certificate	false
federation.tls.certManager.issuer.create	Create an issuer to use to issue the certificate	true
federation.tls.certManager.issuer.acme.email	Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service	""
federation.tls.certManager.issuer.acme.server	Server to use to get certificate. Defaults to LetsEncrypt	https://acme-v02.api.letsencrypt.org/directory
federation.tls.certManager.issuer.acme.solvers	Configure the issuer solvers. Defaults to http01 via ingress.	{}
federation.tls.certManager.certificate.dnsNames	Override the dnsNames on the certificate request. Defaults to the same settings as Ingress	[]
federation.tls.certManager.certificate.issuerRef.group	If you are using an external plugin, specify the group for it here	""
federation.tls.certManager.certificate.issuerRef.kind	Kind of the issuer reference. Override if you want to use a ClusterIssuer	Issuer
federation.tls.certManager.certificate.issuerRef.name	Name of the issuer to use. If unset, it will use the name of the built in issuer	""
federation.ingress.enabled	Flag to enable ingress for federation	false
federation.ingress.className	Ingress class name for federation	""
federation.ingress.controllerType	Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].	""
federation.ingress.annotations	Annotations for the ingress object	{}
federation.ingress.host	Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.	spire-server-federation
federation.ingress.tlsSecret	Secret that has the certs. If blank will use default certs. Used with host var.	""
federation.ingress.hosts	Host paths for ingress object. If empty, rules will be built based on the host var.	[]
federation.ingress.tls	Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.	[]
caSubject.country	Country for Spire server CA	ARPA
caSubject.organization	Organization for Spire server CA	Example
caSubject.commonName	Common Name for Spire server CA	example.org
credentialComposer.cel.enabled	Enable the cel based credential composer	false
credentialComposer.cel.image.registry	The OCI registry to pull the image from	ghcr.io
credentialComposer.cel.image.repository	The repository within the registry	spiffe/spire-credentialcomposer-cel
credentialComposer.cel.image.pullPolicy	The image pull policy	IfNotPresent
credentialComposer.cel.image.tag	Overrides the image tag	0.0.2
credentialComposer.cel.checksum	The sha256 checksum of the plugin binary	23fa1d10f15ad5d5c555930cf82289c664801d7d5609bfd8847f95a0a667e4e4
credentialComposer.cel.pluginPath	The filename in the container of the plugin	/ko-app/cmd
credentialComposer.cel.jwt.expression	The expression to use for jwt token composing	""
credentialComposer.uniqueID.enabled	Add the x509UniqueIdentifier attribute to workload X509-SVIDs	false
keyManager.disk.enabled	Flag to enable keyManager on disk	true
keyManager.memory.enabled	Flag to enable keyManager in memory	false
keyManager.awsKMS.enabled	Flag to enable keyManager in memory	false
keyManager.awsKMS.region	Specify the region for AWS KMS	""
keyManager.awsKMS.keyIdentifierFile.enabled	Enable key identifier data to be stored in a file in persistent storage.	false
keyManager.awsKMS.keyIdentifierValue.enabled	Enable specifying a key identifier value for AWS KMS	false
keyManager.awsKMS.keyIdentifierValue.identifier	Static identifier for the SPIRE server instance	""
keyManager.awsKMS.keyPolicy	Policy to use when creating keys. If no policy is specified, a default policy will be used.
keyManager.awsKMS.keyPolicy.policy	Key policy in JSON format.	""
keyManager.awsKMS.keyPolicy.existingConfigMap	Name of a ConfigMap that has a policy.json file with the key policy in JSON format.	""
keyManager.awsKMS.accessKeyID	Access key ID for the AWS account. It's recommended to use an IAM role instead. See here to learn how to annotate your SPIRE Server Service Account to assume an IAM role.	""
keyManager.awsKMS.secretAccessKey	Secret access key for the AWS account.	""
upstreamAuthority.disk.enabled	Flag to enable upstream authority plugin on disk	false
upstreamAuthority.disk.secret.create	If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself.	true
upstreamAuthority.disk.secret.name	If secret creation is disabled, the secret with this name will be used.	spiffe-upstream-ca
upstreamAuthority.disk.secret.data	If secret creation is enabled, will create a secret with following certificate info
upstreamAuthority.disk.secret.data.certificate	Certificate to store within disk upstreamAuthority.	""
upstreamAuthority.disk.secret.data.key	Key corresponding to the upstreamAuthority.	""
upstreamAuthority.disk.secret.data.bundle	Trust bundle for upstreamAuthority.	""
upstreamAuthority.awsPCA.enabled	Flag to enable upstream authority plugin with AWS PCA	false
upstreamAuthority.awsPCA.region	AWS Region to use	""
upstreamAuthority.awsPCA.certificateAuthorityARN	ARN of the "upstream" CA certificate	""
upstreamAuthority.awsPCA.assumeRoleARN	(Optional) ARN of an IAM role to assume	""
upstreamAuthority.awsPCA.caSigningTemplateARN	(Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only. See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values.	""
upstreamAuthority.awsPCA.signingAlgorithm	(Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values.	""
upstreamAuthority.awsPCA.endpoint	(Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information.	""
upstreamAuthority.awsPCA.supplementalBundlePath	(Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle.	""
upstreamAuthority.certManager.enabled	Flag to enable upstream authority plugin with cert manager	false
upstreamAuthority.certManager.rbac.create	Flag to create RBAC roles	true
upstreamAuthority.certManager.issuerName	Defaults to the release name, override if CA is provided outside of the chart	""
upstreamAuthority.certManager.issuerKind	Defaults to "Issuer", override if CA is provided outside of the chart	Issuer
upstreamAuthority.certManager.issuerGroup	Defaults to "cert-manager.io", override if CA is provided outside of the chart	cert-manager.io
upstreamAuthority.certManager.namespace	Specify to use a namespace other then the one the chart is installed into	""
upstreamAuthority.certManager.kubeConfigFile	Path to kube config file on node to setup cert manager	""
upstreamAuthority.certManager.ca.create	Creates a Cert-Manager CA	false
upstreamAuthority.certManager.ca.duration	Duration of the CA. Defaults to 10 years	87600h
upstreamAuthority.certManager.ca.privateKey.algorithm	Algorithm to generate private key for CA	ECDSA
upstreamAuthority.certManager.ca.privateKey.size	Size of generated private key for CA	256
upstreamAuthority.certManager.ca.privateKey.rotationPolicy	Rotation policy for generated private key	""
upstreamAuthority.certManager.ca.renewBefore	How long to wait before renewing the CA	""
upstreamAuthority.spire.enabled	Flag to use another Spire install as upstream CA	false
upstreamAuthority.spire.upstreamDriver	Driver for Spire as upstream CA	""
upstreamAuthority.spire.server	Server details for the Spire instance use as upstream CA
upstreamAuthority.spire.server.nameOverride	Override the name for upstream Spire server. Should only be changed when building your own nested chart to ensure names align.	""
upstreamAuthority.spire.server.address	Address for upstream Spire server	""
upstreamAuthority.spire.server.port	Port for upstream Spire server	443
upstreamAuthority.vault.enabled	Enable Hashicorp Vault as upstream CA	false
upstreamAuthority.vault.vaultAddr	The URL of the Vault server. (e.g., https://vault.example.com:8443/)	""
upstreamAuthority.vault.namespace	Name of the Vault namespace. This is only available in the Vault Enterprise.	""
upstreamAuthority.vault.pkiMountPoint	Name of the mount point where PKI secret engine is mounted	pki
upstreamAuthority.vault.insecureSkipVerify	If true, caCert options are ignored and Spire accepts any server certificates claiming to be Vault	false
upstreamAuthority.vault.caCert.type	Type of resource representing the Vault server certificate, options are 'Secret' or 'Configmap', the item must be named ca.crt	Secret
upstreamAuthority.vault.caCert.name	Name of the Kubernetes resource containing the Vault server certificate	vault-ca
upstreamAuthority.vault.k8sAuth.enabled	Enable k8s authentication to Hashicorp Vault	false
upstreamAuthority.vault.k8sAuth.k8sAuthMountPoint	Name of the mount point where the Kubernetes auth method is mounted	kubernetes
upstreamAuthority.vault.k8sAuth.k8sAuthRoleName	Required - Name of the Vault role. The plugin authenticates against the named role	""
upstreamAuthority.vault.k8sAuth.token.audience	Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See 'Service Account Documentation' for more info.	vault
upstreamAuthority.vault.k8sAuth.token.expiry	Expiry time in seconds for the token	7200
notifier.k8sBundle.enabled	Enable local k8s bundle uploader	false
notifier.k8sBundle.namespace	Namespace to push the bundle into, if blank will default to SPIRE Server namespace	""
notifier.k8sBundle.apiServiceLabel	If set, rotate the CA Bundle in API services with this label set to true.	""
notifier.k8sBundle.webhookLabel	If set, rotate the CA Bundle in validating and mutating webhooks with this label set to true.	""
notifier.externalK8sBundle.enabled	Enable external k8s bundle uploader	false
notifier.externalK8sBundle.defaults.namespace	Namespace to push the bundle into on clusters	spire-system
notifier.externalK8sBundle.defaults.configMap	ConfigMap name to push the bundle into on external clusters	spire-bundle-upstream
notifier.externalK8sBundle.defaults.configMapKey	ConfigMap key to push the bundle into on external clusters	bundle.crt
notifier.externalK8sBundle.clusters	A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used.	{}
controllerManager.enabled	Flag to enable controller manager	false
controllerManager.staticManifestMode	Flag to configure static mode. Valid options off, internal, and external. If internal, the identities config options will be rendered to an included configmap	off
controllerManager.className	specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs.	""
controllerManager.watchClassless	specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.	false
controllerManager.entryIDPrefixCleanup	Sets which entry prefixes to remove for migrations. Consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it.	false
controllerManager.addEntryIDPrefix	If true, prepends the clusterName to the entryID of each entry the controller manager registers.	true
controllerManager.gcInterval	How often the SPIRE state is reconciled when the controller is otherwise idle. This impacts how quickly SPIRE state will converge after CRDs are removed or SPIRE state is mutated underneath the controller. Values are in nanoseconds.	10000000000
controllerManager.logLevel	The log level for the controller manager. Supported values are info, error, warn and debug.	info
controllerManager.parentIDTemplate	The template that is used to register workloads.	spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}
controllerManager.expandEnv	Set to true to enable environment variable substitution of config file options	false
controllerManager.extraEnv	Extra environment variables to add to the controller manager	[]
controllerManager.installAndUpgradeHook.enabled	Enable Helm hook to autofix common install/upgrade issues (should be disabled when using helm template)	true
controllerManager.deleteHook.enabled	Enable Helm hook to autofix common delete issues (should be disabled when using helm template)	true
controllerManager.image.registry	The OCI registry to pull the image from	ghcr.io
controllerManager.image.repository	The repository within the registry	spiffe/spire-controller-manager
controllerManager.image.pullPolicy	The image pull policy	IfNotPresent
controllerManager.image.tag	Overrides the image tag whose default is the chart appVersion	0.6.2
controllerManager.resources	Resource requests and limits for controller manager	{}
controllerManager.securityContext	Security context	{}
controllerManager.service.type	Service type for controller manager	ClusterIP
controllerManager.service.port	Service port for controller manager	443
controllerManager.service.annotations	Annotations for service resource	{}
controllerManager.configMap.annotations	Annotations to add to the Controller Manager ConfigMap	{}
controllerManager.ignoreNamespaces	These namespaces are ignored by controller manager	[]
controllerManager.reconcile.clusterSPIFFEIDs	Enable reconciliation of clusterSPIFFEIDs from K8s to the SPIRE server	true
controllerManager.reconcile.clusterStaticEntries	Enable reconciliation of clusterStaticEntries from K8s to the SPIRE server	true
controllerManager.reconcile.clusterFederatedTrustDomains	Enable reconciliation of clusterFederatedTrustDomains from K8s to the SPIRE server	true
controllerManager.identities.clusterSPIFFEIDs.default.enabled	Enable this identity for controller manager	true
controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate	Spiffe ID template for identities	spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
controllerManager.identities.clusterSPIFFEIDs.default.podSelector	Selector for pods to issue identity	{}
controllerManager.identities.clusterSPIFFEIDs.default.namespaceSelector	Selector for namespaces to issue identity	{}
controllerManager.identities.clusterSPIFFEIDs.default.dnsNameTemplates	DNS name template for issued identities	[]
controllerManager.identities.clusterSPIFFEIDs.default.federatesWith	Other Spire server URLs for identity federation	[]
controllerManager.identities.clusterSPIFFEIDs.default.workloadSelectorTemplates	Templates to produce selectors that apply to a given workload before it will receive an ID	[]
controllerManager.identities.clusterSPIFFEIDs.default.ttl	Indicates an upper-bound time-to-live for X509 SVIDs. If unset, the cluster default will be chosen.	""
controllerManager.identities.clusterSPIFFEIDs.default.jwtTTL	Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen.	""
controllerManager.identities.clusterSPIFFEIDs.default.admin	Indicates any pod matched by this identity will be an admin. Use this with extreme care.	false
controllerManager.identities.clusterSPIFFEIDs.default.downstream	Set if this spire instance is a root server and the workloads are downstream servers.	false
controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames	Auto populate DNS names from services attached to pods	false
controllerManager.identities.clusterSPIFFEIDs.default.fallback	Apply this ID only if there are no other matching non fallback ClusterSPIFFEIDs	true
controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled	Enable this identity for controller manager	false
controllerManager.identities.clusterSPIFFEIDs.child-servers.type	The type of rule this is.	child-servers
controllerManager.identities.clusterSPIFFEIDs.child-servers.downstream	Set if this spire instance is a root server and the workloads are downstream servers.	true
controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled	Enable this identity for controller manager	true
controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type	The type of rule this is.	oidc-discovery-provider
controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames	Auto populate DNS names to the discovery provider	true
controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.dnsNameTemplates	DNS name template for issued identities	[]
controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled	Enable this identity for controller manager	true
controllerManager.identities.clusterSPIFFEIDs.test-keys.type	The type of rule this is.	test-keys
controllerManager.identities.clusterSPIFFEIDs.spike-keeper.enabled	Enable this identity for controller manager	true
controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type	The type of rule this is.	spike-keeper
controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate	The template to use for this rule.	spiffe://{{ .TrustDomain }}/spike/keeper
controllerManager.identities.clusterSPIFFEIDs.spike-nexus.enabled	Enable this identity for controller manager	true
controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type	The type of rule this is.	spike-nexus
controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate	The template to use for this rule.	spiffe://{{ .TrustDomain }}/spike/nexus
controllerManager.identities.clusterSPIFFEIDs.spike-pilot.enabled	Enable this identity for controller manager	true
controllerManager.identities.clusterSPIFFEIDs.spike-pilot.type	The type of rule this is.	spike-pilot
controllerManager.identities.clusterSPIFFEIDs.spike-pilot.spiffeIDTemplate	The template to use for this rule.	spiffe://{{ .TrustDomain }}/spike/pilot/role/superuser
controllerManager.identities.clusterStaticEntries	Specify ClusterStaticEntry objects.	{}
controllerManager.identities.clusterFederatedTrustDomains	Specify ClusterFederatedTrustDomain objects.	{}
controllerManager.validatingWebhookConfiguration.enabled	Disable only when you have another chart instance on the k8s cluster with webhooks enabled.	true
controllerManager.validatingWebhookConfiguration.failurePolicy	Action when identity is not issued	Fail
controllerManager.cacheNamespaces	If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces.	{}
externalControllerManagers.enabled	Flag to enable external controller managers	false
externalControllerManagers.defaults.reconcile.clusterSPIFFEIDs	Enable reconciliation of clusterSPIFFEIDs from K8s to the SPIRE server	true
externalControllerManagers.defaults.reconcile.clusterStaticEntries	Enable reconciliation of clusterStaticEntries from K8s to the SPIRE server	false
externalControllerManagers.defaults.reconcile.clusterFederatedTrustDomains	Enable reconciliation of clusterFederatedTrustDomains from K8s to the SPIRE server	false
externalControllerManagers.defaults.className	specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs.	""
externalControllerManagers.defaults.watchClassless	specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true.	false
externalControllerManagers.defaults.entryIDPrefixCleanup	consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it.	false
externalControllerManagers.defaults.parentIDTemplate	The template that is used to register workloads.	spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}
externalControllerManagers.defaults.expandEnv	Set to true to enable environment variable substitution of config file options	false
externalControllerManagers.defaults.extraEnv	Extra environment variables to add to the controller manager	[]
externalControllerManagers.defaults.resources	Resource requests and limits for controller manager	{}
externalControllerManagers.defaults.securityContext	Security context	{}
externalControllerManagers.defaults.configMap.annotations	Annotations to add to the Controller Manager ConfigMap	{}
externalControllerManagers.defaults.ignoreNamespaces	These namespaces are ignored by controller manager	[]
externalControllerManagers.defaults.cacheNamespaces	If specified restricts the manager's cache to watch objects in the desired namespaces. Defaults to all namespaces.	{}
externalControllerManagers.clusters	A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used.	{}
tools.kubectl.image.registry	The OCI registry to pull the image from	registry.k8s.io
tools.kubectl.image.repository	The repository within the registry	kubectl
tools.kubectl.image.pullPolicy	The image pull policy	IfNotPresent
tools.kubectl.image.tag	Overrides the image tag whose default is the chart appVersion	""
tools.busybox.image.registry	The OCI registry to pull the image from	""
tools.busybox.image.repository	The repository within the registry	busybox
tools.busybox.image.pullPolicy	The image pull policy	IfNotPresent
tools.busybox.image.tag	Overrides the image tag whose default is the chart appVersion	1.37.0-uclibc
telemetry.prometheus.enabled	Flag to enable prometheus monitoring	false
telemetry.prometheus.podMonitor.enabled	Enable podMonitor for prometheus	false
telemetry.prometheus.podMonitor.namespace	Override where to install the podMonitor, if not set will use the same namespace as the spire-agent	""
telemetry.prometheus.podMonitor.labels	Pod labels to filter for prometheus monitoring	{}
telemetry.datadog.enabled	Flag to enable datadog monitoring	false
telemetry.datadog.address	The address of the datadog service to send metrics to. The default URL for services are <service-name>.<namespace>.svc	datadog.kube-system.svc
telemetry.datadog.port	The port of the datadog service to send metrics to	8125
ingress.enabled	Flag to enable ingress	false
ingress.className	Ingress class name	""
ingress.controllerType	Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].	""
ingress.annotations	Annotations for the ingress object	{}
ingress.host	Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.	spire-server
ingress.tlsSecret	Secret that has the certs. If blank will use default certs. Used with host var.	""
ingress.hosts	Host paths for ingress object. If empty, rules will be built based on the host var.	[]
ingress.tls	Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.	[]
extraEnv	Extra environment variables to add to the spire server	[]
extraVolumes	Extra volumes to be mounted	[]
extraVolumeMounts	Extra volume mounts	[]
extraContainers	Additional containers to create	[]
initContainers	Additional init containers to create	[]
caKeyType	The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported)	rsa-2048
caTTL	TTL for CA	24h
agentTTL	The TTL to use for agent SVIDs. If unset, the defaultX509SvidTTL will be used.	""
defaultX509SvidTTL	TTL for X509 Svids	4h
defaultJwtSvidTTL	TTL for JWT Svids	1h
nodeAttestor.k8sPSAT.enabled	Enable PSAT k8s nodeattestor	true
nodeAttestor.k8sPSAT.serviceAccountAllowList	Allowed service accounts for PSAT nodeattestor. If namespace isn't specified, release namespace will be used.	[]
nodeAttestor.k8sPSAT.audience	Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used	[]
nodeAttestor.k8sPSAT.allowedNodeLabelKeys	Node label keys considered for selectors	[]
nodeAttestor.k8sPSAT.allowedPodLabelKeys	Pod label keys considered for selectors	[]
nodeAttestor.externalK8sPSAT.enabled	Enable PSAT k8s nodeattestor for external Kubernetes clusters	true
nodeAttestor.externalK8sPSAT.defaults.serviceAccountAllowList	Allowed service accounts for PSAT node attestor	[]
nodeAttestor.externalK8sPSAT.defaults.audience	Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used	[]
nodeAttestor.externalK8sPSAT.defaults.allowedNodeLabelKeys	Node label keys considered for selectors	[]
nodeAttestor.externalK8sPSAT.defaults.allowedPodLabelKeys	Pod label keys considered for selectors	[]
nodeAttestor.externalK8sPSAT.clusters	A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used.	{}
nodeAttestor.joinToken.enabled	Enable the join_token nodeattestor	false
nodeAttestor.httpChallenge.enabled	Enable the http_challenge nodeattesto	false
nodeAttestor.httpChallenge.allowedDNSPatterns	A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed.	[]
nodeAttestor.httpChallenge.requiredPort	Set to a port number to require clients to listen only on that port. If 0, all port numbers are allowed	0
nodeAttestor.httpChallenge.allowNonRootPorts	Allow using ports >= 1024 from clients for attestation	true
nodeAttestor.httpChallenge.tofu	Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024	true
nodeAttestor.tpmDirect.enabled	Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental.	false
nodeAttestor.tpmDirect.image.registry	The OCI registry to pull the image from	ghcr.io
nodeAttestor.tpmDirect.image.repository	The repository within the registry	spiffe/spire-tpm-plugin-tpm-attestor-server
nodeAttestor.tpmDirect.image.pullPolicy	The image pull policy	IfNotPresent
nodeAttestor.tpmDirect.image.tag	Overrides the image tag	v1.9.0
nodeAttestor.tpmDirect.checksum	The sha256 checksum of the plugin binary	46d0caad8c25a027dd11c93e18b58a8bc6fbd9f1fe2e36fa2a0dd440986de4dc
nodeAttestor.tpmDirect.pluginPath	The filename in the container of the plugin	/app/tpm_attestor_server
nodeAttestor.tpmDirect.cas	A dictionary of TPM CA PEM or DER files that are allowed to connect.	{}
nodeAttestor.tpmDirect.hashes	A list of TPM hashes that are allowed to connect.	[]
nodeAttestor.awsIID.enabled	Enable the aws_iid node attestor	false
nodeAttestor.awsIID.assumeRole	AWS IAM Role NAME to use for the attestation	""
bundlePublisher.k8sConfigMap.enabled	Enable local k8s bundle uploader	true
bundlePublisher.k8sConfigMap.namespace	Namespace to push the bundle into, if blank will default to SPIRE Server namespace	""
bundlePublisher.k8sConfigMap.format	Format of the trust bundle. Can be pem or spiffe	spiffe
bundlePublisher.externalK8sConfigMap.enabled	Enable external k8s bundle uploader	true
bundlePublisher.externalK8sConfigMap.defaults.namespace	Namespace to push the bundle into on clusters	spire-system
bundlePublisher.externalK8sConfigMap.defaults.configMapName	ConfigMap name to push the bundle into on external clusters	spire-bundle-upstream
bundlePublisher.externalK8sConfigMap.defaults.configMapKey	ConfigMap key to push the bundle into on external clusters	""
bundlePublisher.externalK8sConfigMap.defaults.format	Format of the trust bundle. Can be pem or spiffe	spiffe
bundlePublisher.externalK8sConfigMap.clusters	A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used.	{}
bundlePublisher.awsRolesAnywhereTrustAnchor.enabled	Enable the AWS S3 bundle publisher	false
bundlePublisher.awsRolesAnywhereTrustAnchor.region	AWS region to store the trust bundle	""
bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID	AWS trust anchor ID to publish to	""
bundlePublisher.awsS3.enabled	Enable the AWS S3 bundle publisher	false
bundlePublisher.awsS3.endpoint	A custom S3 endpoint should be set when using third-party object storage providers, such as Minio.	""
bundlePublisher.awsS3.region	AWS region to store the trust bundle	""
bundlePublisher.awsS3.bucket	AWS S3 bucket name to which the trust bundle is uploaded	""
bundlePublisher.awsS3.objectKey	AWS S3 object key inside the bucket	""
bundlePublisher.awsS3.format	Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem]	""
bundlePublisher.gcpCloudStorage.enabled	Enable the Google Cloud Storage bundle publisher	false
bundlePublisher.gcpCloudStorage.bucketName	Google Cloud Storage bucket name to which the trust bundle is uploaded	""
bundlePublisher.gcpCloudStorage.objectName	Google Cloud Storage object name	""
bundlePublisher.gcpCloudStorage.format	Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem]	""

Tornjak

Name	Description	Value
tornjak.enabled	Deploys Tornjak API (backend) (Not for production)	false
tornjak.image.registry	The OCI registry to pull the image from	ghcr.io
tornjak.image.repository	The repository within the registry	spiffe/tornjak-backend
tornjak.image.pullPolicy	The image pull policy	IfNotPresent
tornjak.image.tag	Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications	""
tornjak.image.defaultTag	Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift.	v2.1.0
tornjak.service.type	Type of service resource	ClusterIP
tornjak.service.ports.http	Insecure port for tornjak service	10000
tornjak.service.ports.https	Secure port for tornjak service	10443
tornjak.service.annotations	Annotations for the service	{}
tornjak.ingress.enabled	Flag to enable ingress for Tornjak backend service	false
tornjak.ingress.className	Ingress class name for Tornjak backend service	""
tornjak.ingress.controllerType	Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].	""
tornjak.ingress.annotations	Annotations for Tornjak backend service	{}
tornjak.ingress.host	Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.	tornjak-backend
tornjak.ingress.tlsSecret	Secret that has the certs. If blank will use default certs. Used with host var.	""
tornjak.ingress.hosts	Host paths for ingress object. If empty, rules will be built based on the host var.	[]
tornjak.ingress.tls	Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.	[]
tornjak.startupProbe.failureThreshold	Failure threshold count	3
tornjak.startupProbe.initialDelaySeconds	Initial delay seconds	5
tornjak.startupProbe.periodSeconds	Period seconds	10
tornjak.startupProbe.successThreshold	Success threshold count	1
tornjak.startupProbe.timeoutSeconds	Timeout in seconds	5
tornjak.config.dataStore	Persistent DB for storing Tornjak specific information
tornjak.config.dataStore.driver	Database driver name	sqlite3
tornjak.config.dataStore.file	File path for sqlite3 file	/run/spire/data/tornjak.sqlite3
tornjak.config.userManagement	UserManagement config
tornjak.config.userManagement.issuer	UserManagement issuer URL	""
tornjak.config.userManagement.audience	UserManagement audience check	""
tornjak.config.tlsSecret	Name of the secret containing server side key and certificate for TLS verification (required for tls or mtls connectionType)	tornjak-tls-secret
tornjak.config.clientCA.type	Type of delivery for the user CA for TLS client verification. Options are Secret or ConfigMap (required for mtls connectionType)	Secret
tornjak.config.clientCA.name	Name of the resource secret or configMap with user CA for TLS	tornjak-client-ca
tornjak.resources	Resource requests and limits	{}
tornjak.securityContext	Security Context to use	{}
secrets.aws.accessKeyID	AWS Access Key ID	""
secrets.aws.secretAccessKey	AWS Secret Access Key	""
secrets.gcp.applicationCredentials	Google Application Credentials	""
customPlugins.bundlePublisher	Custom plugins of type BundlePublisher are configured here	{}
customPlugins.credentialComposer	Custom plugins of type CredentialComposer are configured here	{}
customPlugins.keyManager	Custom plugins of type KeyManager are configured here	{}
customPlugins.nodeAttestor	Custom plugins of type NodeAttestor are configured here	{}
customPlugins.upstreamAuthority	Custom plugins of type upstreamAuthority are configured here	{}
customPlugins.notifier	Custom plugins of type notifier are configured here	{}
chown.image.registry	The OCI registry to pull the image from	""
chown.image.repository	The repository within the registry	busybox
chown.image.pullPolicy	The image pull policy	IfNotPresent
chown.image.tag	Overrides the image tag whose default is the chart appVersion	1.37.0-uclibc
chown.resources	Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	{}
experimental.enabled	Allow configuration of experimental features	false
experimental.cacheReloadInterval	The amount of time between two reloads of the in-memory entry cache.	5s
experimental.eventsBasedCache	Use events to update the cache with what's changed since the last update.	false
experimental.pruneEventsOlderThan	How old an event can be before being deleted. Used with events based cache.	12h
experimental.featureFlags	List of developer feature flags	[]
experimental.authOpaPolicyEngine	The auth opa_policy engine used for authorization decisions. Defaults to the default SPIRE authorization policy.	{}
experimental.authOpaPolicyEngine.local.policy_data	A JSON blob that defines additional data that can be used in the rego policy.	""
experimental.authOpaPolicyEngine.local.rego	The contents of a rego policy file defining how to authorize the API calls.	""
tests.hostAliases	List of host aliases for testing	[]
tests.tls.enabled	Flag for enabling tls for tests	false
tests.tls.customCA	Custom CA value for tests	""
tests.bash.image.registry	The OCI registry to pull the image from	cgr.dev
tests.bash.image.repository	The repository within the registry	chainguard/bash
tests.bash.image.pullPolicy	The image pull policy	IfNotPresent
tests.bash.image.tag	Overrides the image tag whose default is the chart appVersion	latest@sha256:8a3e4efbd487a56a4782cdee917149a57d37312e1efc70c81d3c74f0215c4ae1
kubeConfigs	Manage additional kubeconfig files to talk to external Kubernetes clusters	{}