helm-charts-hardened/charts/spire/charts/spire-agent/README.md

spire-agent

A Helm chart to install the SPIRE agent.

Homepage: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire

Maintainers

Name	Email	Url
marcofranssen	[email protected]	https://marcofranssen.nl
kfox1111	[email protected]
faisal-memon	[email protected]
edwbuck	[email protected]

Source Code

• https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire

Parameters

Chart parameters

Name	Description	Value
image.registry	The OCI registry to pull the image from	ghcr.io
image.repository	The repository within the registry	spiffe/spire-agent
image.pullPolicy	The image pull policy	IfNotPresent
image.tag	Overrides the image tag whose default is the chart appVersion	""
imagePullSecrets	Pull secrets for images	[]
nameOverride	Name override	""
namespaceOverride	Namespace override	""
fullnameOverride	Fullname override	""
serviceAccount.create	Specifies whether a service account should be created	true
serviceAccount.annotations	Annotations to add to the service account	{}
serviceAccount.name	The name of the service account to use.	""
configMap.annotations	Annotations to add to the SPIRE Agent ConfigMap	{}
podAnnotations	Annotations to add to pods	{}
podSecurityContext	Pod security context	{}
securityContext	Security context	{}
resources	Resource requests and limits	{}
nodeSelector	Node selector	{}
tolerations	List of tolerations	[]
affinity	Node affinity	{}
logLevel	The log level, valid values are "debug", "info", "warn", and "error"	info
clusterName	The name of the Kubernetes cluster (kubeadm init --service-dns-domain)	example-cluster
trustDomain	The trust domain to be used for the SPIFFE identifiers	example.org
trustBundleURL	If set, obtain trust bundle from url instead of Kubernetes ConfigMap	""
trustBundleFormat	If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe"	pem
bundleConfigMap	Configmap name for Spire bundle	spire-bundle
availabilityTarget	The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h.	""
server.address	Address for Spire server	""
server.port	Port number for Spire server	8081
server.namespaceOverride	Override the namespace for Spire server	""
healthChecks.port	override the host port used for health checking	9982
livenessProbe.initialDelaySeconds	Initial delay seconds for probe	15
livenessProbe.periodSeconds	Period seconds for probe	60
readinessProbe.initialDelaySeconds	Initial delay seconds for probe	10
readinessProbe.periodSeconds	Period seconds for probe	30
waitForIt.image.registry	The OCI registry to pull the image from	cgr.dev
waitForIt.image.repository	The repository within the registry	chainguard/wait-for-it
waitForIt.image.pullPolicy	The image pull policy	IfNotPresent
waitForIt.image.tag	Overrides the image tag whose default is the chart appVersion	latest@sha256:64ba1b49313924643dec6a03e15a1c6cfc24046cff96b0b3c0003cabbad2f60d
waitForIt.resources	Resource requests and limits	{}
fsGroupFix.image.registry	The OCI registry to pull the image from	cgr.dev
fsGroupFix.image.repository	The repository within the registry	chainguard/bash
fsGroupFix.image.pullPolicy	The image pull policy	Always
fsGroupFix.image.tag	Overrides the image tag whose default is the chart appVersion	latest@sha256:1b4e8389d2582d0b013fad55d7ad799a67bbdcbfbae0a053258ae24c8b03a19f
fsGroupFix.resources	Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	{}
keyManager.memory.enabled	Enable the memory based Key Manager	true
nodeAttestor.k8sPsat.enabled	Enable Psat k8s Node Attestor	true
workloadAttestors.unix.enabled	Enables the Unix workload attestor	false
workloadAttestors.k8s.enabled	Enables the Kubernetes workload attestor	true
workloadAttestors.k8s.skipKubeletVerification	If true, kubelet certificate verification is skipped	true
workloadAttestors.k8s.disableContainerSelectors	Set to true if using holdApplicationUntilProxyStarts in Istio	false
sds.enabled	Enables Envoy SDS configuration	false
sds.defaultSvidName	The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS	default
sds.defaultBundleName	The Validation Context resource name to use for the default X.509 bundle with Envoy SDS	ROOTCA
sds.defaultAllBundlesName	The Validation Context resource name to use for all bundles (including federated) with Envoy SDS	ALL
sds.disableSpiffeCertValidation	Disable Envoy SDS custom validation	false
telemetry.prometheus.enabled	Flag to enable prometheus monitoring	false
telemetry.prometheus.port	Port for prometheus metrics	9988
telemetry.prometheus.podMonitor.enabled	Enable podMonitor for prometheus	false
telemetry.prometheus.podMonitor.namespace	Override where to install the podMonitor, if not set will use the same namespace as the spire-agent	""
telemetry.prometheus.podMonitor.labels	Pod labels to filter for prometheus monitoring	{}
kubeletConnectByHostname	If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise.	""
socketPath	The unix socket path to the spire-agent	/run/spire/agent-sockets/spire-agent.sock
socketAlternate.names	List of alternate names for the socket that workloads might expect to be able to access in the driver mount.	["socket","spire-agent.sock","api.sock"]
socketAlternate.image.registry	The OCI registry to pull the image from	cgr.dev
socketAlternate.image.repository	The repository within the registry	chainguard/bash
socketAlternate.image.pullPolicy	The image pull policy	Always
socketAlternate.image.tag	Overrides the image tag whose default is the chart appVersion	latest@sha256:07d2662ef699e9ceafab3f39624083193dfcb7b768ee86860dbdd5cb4473dcea
socketAlternate.resources	Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	{}
priorityClassName	Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.	""
extraEnvVars	Extra environment variables to be added to the Spire Agent container	[]
extraVolumes	Extra volumes to be mounted on Spire Agent pods	[]
extraVolumeMounts	Extra volume mounts for Spire Agent pods	[]
extraContainers	Additional containers to create with Spire Agent pods	[]
initContainers	Additional init containers to create with Spire Agent pods	[]
hostAliases	Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/	[]
customPlugins.keyManager	Custom plugins of type KeyManager are configured here	{}
customPlugins.nodeAttestor	Custom plugins of type NodeAttestor are configured here	{}
customPlugins.svidStore	Custom plugins of type SVIDStore are configured here	{}
customPlugins.workloadAttestor	Custom plugins of type WorkloadAttestor are configured here	{}
experimental.enabled	Allow configuration of experimental features	false
experimental.syncInterval	Sync interval with SPIRE server with exponential backoff	5s
experimental.featureFlags	List of developer feature flags	[]
sockets.hostBasePath	Path on which the agent socket is made available when admin.mountOnHost is true	/run/spire/agent/sockets
sockets.admin.enabled	Enable the admin socket. Useful for admin tasks or the Delegated Identity API.	false
sockets.admin.mountOnHost	Enable the admin socket to be visible on the host.	false