helm-charts-hardened/charts/spire-identity-exchange/values.yaml

# Default configuration for SPIRE Identity Exchange chart
# SPDX-License-Identifier: APACHE-2.0

## @skip global
global: {}

## @section Chart parameters
##
## @param agentSocketName The name of the spire-agent unix socket
agentSocketName: spire-agent.sock
## @param csiDriverName The csi driver to use
csiDriverName: csi.spiffe.io

## @param replicaCount Replica count
replicaCount: 1

## @param namespaceOverride Namespace override
namespaceOverride: ""

## @param annotations [object] Annotations for the deployment
annotations: {}

## @param labels [object] Labels for the deployment
labels: {}
  # if you configured your controller manager to register pods based on labels, you need to add these labels here too
  # For instance:
  # spiffe.io/spiffe-id: "true"

image:
  ## @param image.registry The OCI registry to pull the image from
  ## @param image.repository The repository within the registry
  ## @param image.pullPolicy The image pull policy
  ## @param image.tag Overrides the image tag whose default is the chart appVersion
  ##
  registry: ghcr.io
  repository: spiffe/spire-identity-exchange-server
  pullPolicy: IfNotPresent
  tag: ""

spireServerAttestorSPIFFEWorkloadAPI:
  ## @param spireServerAttestorSPIFFEWorkloadAPI.resources [object] Resource requests and limits
  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # requests:
    #   cpu: 50m
    #   memory: 32Mi
    # limits:
    #   cpu: 100m
    #   memory: 64Mi
  image:
    ## @param spireServerAttestorSPIFFEWorkloadAPI.image.registry The OCI registry to pull the image from
    ## @param spireServerAttestorSPIFFEWorkloadAPI.image.repository The repository within the registry
    ## @param spireServerAttestorSPIFFEWorkloadAPI.image.pullPolicy The image pull policy
    ## @param spireServerAttestorSPIFFEWorkloadAPI.image.tag Overrides the image tag whose default is the chart appVersion
    ##
    registry: ghcr.io
    repository: spiffe/spire-server-attestor-spiffe-workload-api
    pullPolicy: IfNotPresent
    tag: ""

spireAgent:
  ## @param spireAgent.resources [object] Resource requests and limits
  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # requests:
    #   cpu: 50m
    #   memory: 32Mi
    # limits:
    #   cpu: 100m
    #   memory: 64Mi
  image:
    ## @param spireAgent.image.registry The OCI registry to pull the image from
    ## @param spireAgent.image.repository The repository within the registry
    ## @param spireAgent.image.pullPolicy The image pull policy
    ## @param spireAgent.image.tag Overrides the image tag whose default is the chart appVersion
    ##
    registry: ghcr.io
    repository: spiffe/spire-agent
    pullPolicy: IfNotPresent
    tag: "1.15.2"

## @param extraEnv [array] Extra environment variables to add to the spire identity exchange
extraEnv: []

## @param resources [object] Resource requests and limits
resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # requests:
  #   cpu: 50m
  #   memory: 32Mi
  # limits:
  #   cpu: 100m
  #   memory: 64Mi

configMap:
  ## @param configMap.annotations [object] Annotations to add to the SPIRE Identity Exchange ConfigMap
  annotations: {}

## @param podSecurityContext [object] Pod security context for SPIRE Identity Exchange pods
podSecurityContext: {}
  # fsGroup: 2000

## @param securityContext [object] Security context for SPIRE Identity Exchange deployment
securityContext: {}
  # capabilities:
  #   drop:
  #   - ALL
  # readOnlyRootFilesystem: true
  # runAsNonRoot: true
  # runAsUser: 1000

## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
## @param readinessProbe.periodSeconds Period seconds for readinessProbe
##
readinessProbe:
  initialDelaySeconds: 5
  periodSeconds: 5

## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
## @param livenessProbe.periodSeconds Period seconds for livenessProbe
##
livenessProbe:
  initialDelaySeconds: 5
  periodSeconds: 5

## @param podAnnotations [object] Pod annotations for SPIRE Identity Exchange
podAnnotations: {}

## @param podLabels [object] Labels to add to pods
podLabels: {}

config:
  ## @param config.logLevel The log level, valid values are "debug", "info", "warn", and "error"
  logLevel: info
  ## @param config.logFormat The log format, valid values are "text" and "json"
  logFormat: text

# The metrics endpoint is always served; spire-identity-exchange requires a nonzero port for it.
telemetry:
  prometheus:
    ## @param telemetry.prometheus.port Port for prometheus metrics
    port: 4950
    podMonitor:
      ## @param telemetry.prometheus.podMonitor.enabled Enable podMonitor for prometheus
      enabled: false
      ## @param telemetry.prometheus.podMonitor.namespace Override where to install the podMonitor, if not set will use the same namespace as the helm release
      namespace: ""
      ## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring
      labels: {}

## @param imagePullSecrets [array] Image pull secret names
imagePullSecrets: []

## @param nameOverride Name override
nameOverride: ""

## @param fullnameOverride Full name override
fullnameOverride: ""

## @param serviceAccount.create Specifies whether a service account should be created
## @param serviceAccount.annotations Annotations to add to the service account
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
##
serviceAccount:
  create: true
  annotations: {}
  name: ""

deleteHook:
  ## @param deleteHook.enabled Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`)
  enabled: true

## @param autoscaling.enabled Flag to enable autoscaling
## @param autoscaling.minReplicas Minimum replicas for autoscaling
## @param autoscaling.maxReplicas Maximum replicas for autoscaling
## @param autoscaling.targetCPUUtilizationPercentage Target CPU utlization that triggers autoscaling
## @param autoscaling.targetMemoryUtilizationPercentage Target Memory utlization that triggers autoscaling
##
autoscaling:
  enabled: false
  minReplicas: 1
  maxReplicas: 5
  targetCPUUtilizationPercentage: 80
  targetMemoryUtilizationPercentage: 80

## @param nodeSelector [object] Node selector
nodeSelector: {}

## @param tolerations [array] list of tolerations
tolerations: []

## @param affinity [object] Node affinity
affinity: {}

## @param trustDomain Set the trust domain to be used for the SPIFFE identifiers
trustDomain: example.org

## @param clusterName The name of this Kubernetes cluster, as it appears in SPIFFE ID paths
clusterName: example-cluster

## @param jwtIssuer The issuer URL for JWT-SVIDs. Defaults to https://oidc-discovery.$trustDomain
jwtIssuer: ""

## @param clusterDomain The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)
clusterDomain: cluster.local

auth:
  plugins:
    k8s_psat:
      ## @param auth.plugins.k8s_psat.enabled Enable the k8s psat plugin
      enabled: true
      config:
        ## @param auth.plugins.k8s_psat.config.audiences [array] The audiences to allow
        audiences:
          - spire-identity-exchange
        ## @param auth.plugins.k8s_psat.config.allowedServiceAccounts [array] The service accounts that are allowed
        allowedServiceAccounts:
          - "*"
    spiffe:
      ## @param auth.plugins.spiffe.enabled Enable the spiffe plugin
      enabled: true
      ## @param auth.plugins.spiffe.keySource What source to use to fetch the keys. Can be oidc or oidcLocal. oidcLocal forces discoveryURL to be the internal discovery address.
      keySource: oidcLocal
      ## @extra auth.plugins.spiffe.csiDriverName The CSI driver providing the SPIRE Agent workload socket this plugin attests against. Defaults to the chart level csiDriverName. Requires config.connectWithTrustBundle.
      config:
        ## @param auth.plugins.spiffe.config.issuerURL The url to connect to for JWKS discovery
        issuerURL: "${SPIFFE_JWT_ISSUER}"
        ## @param auth.plugins.spiffe.config.trustDomain The trust domain to use
        trustDomain: "${SPIFFE_TRUST_DOMAIN}"
        ## @param auth.plugins.spiffe.config.pathPatterns [array] The service accounts that are allowed
        pathPatterns:
          - "^/k8s/${K8S_CLUSTER_NAME}/node/[^/]+"
        ## @param auth.plugins.spiffe.config.audiences [array] The audiences to allow
        audiences:
          - spire-identity-exchange
        ## @param auth.plugins.spiffe.config.connectWithTrustBundle Use the trust bundle to validate the issuerURL
        connectWithTrustBundle: true

  stacks:
    image_pull:
      ## @param auth.stacks.image_pull.enabled Enable the image_pull stack
      enabled: true
      ## @param auth.stacks.image_pull.plugins [array] List of plugins that are required by this stack
      plugins:
        - spiffe
        - k8s_psat

  ## @param auth.unsupportedBuiltInPlugins [object] Unsupported mechanism to use plugins not yet supported by the chart.
  unsupportedBuiltInPlugins: {}

  ## @param auth.passthroughPlugins Address each plugin as a stack of its own, in addition to any stacks defined
  passthroughPlugins: false

# Listeners served with a certificate from disk. Select one of the options below to be the source of that certificate.
tls:

  externalSecret:
    ## @param tls.externalSecret.enabled Provide your own certificate/key via tls style Kubernetes Secret
    enabled: false
    ## @param tls.externalSecret.secretName Specify which Secret to use
    secretName: ""

  certManager:
    ## @param tls.certManager.enabled Use certificateManager to create the certificate
    enabled: false
    issuer:
      ## @param tls.certManager.issuer.create Create an issuer to use to issue the certificate
      create: true
      acme:
        ## @param tls.certManager.issuer.acme.email Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service
        email: ""
        ## @param tls.certManager.issuer.acme.server Server to use to get certificate. Defaults to LetsEncrypt
        server: https://acme-v02.api.letsencrypt.org/directory
        # Testing server: https://acme-staging-v02.api.letsencrypt.org/directory
        ## @param tls.certManager.issuer.acme.solvers [object] Configure the issuer solvers. Defaults to http01 via ingress.
        solvers: {}
        # - http01:
        #     ingress:
        #       ingressClassName: nginx
    certificate:
      ## @param tls.certManager.certificate.dnsNames Override the dnsNames on the certificate request. Defaults to the same settings as Ingress
      dnsNames: []
      ## @param tls.certManager.certificate.issuerRef.group If you are using an external plugin, specify the group for it here
      ## @param tls.certManager.certificate.issuerRef.kind Kind of the issuer reference. Override if you want to use a ClusterIssuer
      ## @param tls.certManager.certificate.issuerRef.name Name of the issuer to use. If unset, it will use the name of the built in issuer
      issuerRef:
        group: ""
        kind: Issuer
        name: ""

  rest:
    ## @param tls.rest.enabled Enable the REST listener served with the certificate from disk
    enabled: false
    ## @param tls.rest.port Container port for the REST listener served with the certificate from disk
    port: 8444
    ## @param tls.rest.service.type Service type
    ## @param tls.rest.service.port port for the service
    ## @param tls.rest.service.annotations Annotations for service resource
    ##
    service:
      type: ClusterIP
      port: 443
      annotations: {}
      # external-dns.alpha.kubernetes.io/hostname: spire-identity-exchange-rest.example.org
      ## @param tls.rest.service.loadBalancerIP IP address to assign to load balancer (if supported)
      loadBalancerIP: ""
    ingress:
      ## @param tls.rest.ingress.enabled Flag to enable ingress
      enabled: false
      ## @param tls.rest.ingress.className Ingress class name
      className: ""
      ## @param tls.rest.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
      controllerType: ""
      ## @param tls.rest.ingress.annotations [object] Annotations for ingress object
      annotations: {}
        # kubernetes.io/ingress.class: nginx
        # kubernetes.io/tls-acme: "true"
        # nginx.ingress.kubernetes.io/ssl-redirect: "true"
        # nginx.ingress.kubernetes.io/force-ssl-redirect: "true"

      ## @param tls.rest.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
      host: "spire-identity-exchange-rest"

      ## @param tls.rest.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
      tlsSecret: ""

      ## @param tls.rest.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
      hosts: []
      #  - host: spire-identity-exchange-rest.example.org
      #    paths:
      #      - path: /
      #        pathType: Prefix

      ## @param tls.rest.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
      tls: []
      #  - secretName: chart-example-tls
      #    hosts:
      #      - spire-identity-exchange-rest.example.org

    ## Gateway API exposure for this endpoint. A set tlsSecret gives HTTPRoute (reencrypt); blank gives TLSRoute (SNI passthrough).
    gatewayAPI:
      ## @param tls.rest.gatewayAPI.enabled Flag to expose the endpoint via Gateway API
      enabled: false
      ## @param tls.rest.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
      host: "spire-identity-exchange-rest"
      ## @param tls.rest.gatewayAPI.tlsSecret Secret with the TLS cert for edge termination. Blank keeps passthrough.
      tlsSecret: ""
      ## @param tls.rest.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
      annotations: {}
      listenerSet:
        ## @param tls.rest.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
        enabled: null
      ## @param tls.rest.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
      parentRefs: []
      ## @param tls.rest.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
      sectionName: ""
      # BackendTLSPolicy (reencrypt) is emitted automatically for the terminated
      # HTTPS backend when gatewayAPI.tlsSecret is set.
      backendTLS:
        ## @param tls.rest.gatewayAPI.backendTLS.caCertificateRefs [array] ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap.
        caCertificateRefs: []

  grpc:
    ## @param tls.grpc.enabled Enable the gRPC listener served with the certificate from disk
    enabled: false
    ## @param tls.grpc.port Container port for the gRPC listener served with the certificate from disk
    port: 8443
    ## @param tls.grpc.service.type Service type
    ## @param tls.grpc.service.port port for the service
    ## @param tls.grpc.service.annotations Annotations for service resource
    ##
    service:
      type: ClusterIP
      port: 443
      annotations: {}
      # external-dns.alpha.kubernetes.io/hostname: spire-identity-exchange-grpc.example.org
      ## @param tls.grpc.service.loadBalancerIP IP address to assign to load balancer (if supported)
      loadBalancerIP: ""
    ingress:
      ## @param tls.grpc.ingress.enabled Flag to enable ingress
      enabled: false
      ## @param tls.grpc.ingress.className Ingress class name
      className: ""
      ## @param tls.grpc.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
      controllerType: ""
      ## @param tls.grpc.ingress.annotations [object] Annotations for ingress object
      annotations: {}
        # kubernetes.io/ingress.class: nginx
        # kubernetes.io/tls-acme: "true"
        # nginx.ingress.kubernetes.io/ssl-redirect: "true"
        # nginx.ingress.kubernetes.io/force-ssl-redirect: "true"

      ## @param tls.grpc.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The grpc of the rules will be autogenerated. For more customizability, use hosts[] instead.
      host: "spire-identity-exchange-grpc"

      ## @param tls.grpc.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
      tlsSecret: ""

      ## @param tls.grpc.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
      hosts: []
      #  - host: spire-identity-exchange-grpc.example.org
      #    paths:
      #      - path: /
      #        pathType: Prefix

      ## @param tls.grpc.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
      tls: []
      #  - secretName: chart-example-tls
      #    hosts:
      #      - spire-identiy-exchange-grpc.example.org

    ## Gateway API exposure for this endpoint. A set tlsSecret gives HTTPRoute (reencrypt); blank gives TLSRoute (SNI passthrough).
    gatewayAPI:
      ## @param tls.grpc.gatewayAPI.enabled Flag to expose the endpoint via Gateway API
      enabled: false
      ## @param tls.grpc.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
      host: "spire-identity-exchange-grpc"
      ## @param tls.grpc.gatewayAPI.tlsSecret Secret with the TLS cert for edge termination. Blank keeps passthrough.
      tlsSecret: ""
      ## @param tls.grpc.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
      annotations: {}
      listenerSet:
        ## @param tls.grpc.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
        enabled: null
      ## @param tls.grpc.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
      parentRefs: []
      ## @param tls.grpc.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
      sectionName: ""
      # BackendTLSPolicy (reencrypt) is emitted automatically for the terminated
      # HTTPS backend when gatewayAPI.tlsSecret is set.
      backendTLS:
        ## @param tls.grpc.gatewayAPI.backendTLS.caCertificateRefs [array] ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap.
        caCertificateRefs: []

# Listeners served with this deployment's own X509-SVID from the Workload API. No certificate files needed.
spiffe:

  rest:
    ## @param spiffe.rest.enabled Enable the REST listener served with this deployment's own X509-SVID
    enabled: true
    ## @param spiffe.rest.port Container port for the REST listener served with this deployment's own X509-SVID
    port: 8544
    ## @param spiffe.rest.service.type Service type
    ## @param spiffe.rest.service.port port for the service
    ## @param spiffe.rest.service.annotations Annotations for service resource
    ##
    service:
      type: ClusterIP
      port: 443
      annotations: {}
      # external-dns.alpha.kubernetes.io/hostname: spire-identity-exchange-rest-spiffe.example.org
      ## @param spiffe.rest.service.loadBalancerIP IP address to assign to load balancer (if supported)
      loadBalancerIP: ""
    ingress:
      ## @param spiffe.rest.ingress.enabled Flag to enable ingress
      enabled: false
      ## @param spiffe.rest.ingress.className Ingress class name
      className: ""
      ## @param spiffe.rest.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
      controllerType: ""
      ## @param spiffe.rest.ingress.annotations [object] Annotations for ingress object
      annotations: {}
        # kubernetes.io/ingress.class: nginx
        # kubernetes.io/tls-acme: "true"
        # nginx.ingress.kubernetes.io/ssl-redirect: "true"
        # nginx.ingress.kubernetes.io/force-ssl-redirect: "true"

      ## @param spiffe.rest.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
      host: "spire-identity-exchange-rest-spiffe"

      ## @param spiffe.rest.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
      tlsSecret: ""

      ## @param spiffe.rest.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
      hosts: []
      #  - host: spire-identity-exchange-rest-spiffe.example.org
      #    paths:
      #      - path: /
      #        pathType: Prefix

      ## @param spiffe.rest.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
      tls: []
      #  - secretName: chart-example-tls
      #    hosts:
      #      - spire-identity-exchange-rest-spiffe.example.org

    ## Gateway API exposure for this endpoint. Always a TLSRoute (SNI passthrough): an X509-SVID has no DNS SAN, so edge termination cannot validate this backend.
    gatewayAPI:
      ## @param spiffe.rest.gatewayAPI.enabled Flag to expose the endpoint via Gateway API
      enabled: false
      ## @param spiffe.rest.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
      host: "spire-identity-exchange-rest-spiffe"
      ## @param spiffe.rest.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
      annotations: {}
      listenerSet:
        ## @param spiffe.rest.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
        enabled: null
      ## @param spiffe.rest.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
      parentRefs: []
      ## @param spiffe.rest.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
      sectionName: ""

  grpc:
    ## @param spiffe.grpc.enabled Enable the gRPC listener served with this deployment's own X509-SVID
    enabled: false
    ## @param spiffe.grpc.port Container port for the gRPC listener served with this deployment's own X509-SVID
    port: 8543
    ## @param spiffe.grpc.service.type Service type
    ## @param spiffe.grpc.service.port port for the service
    ## @param spiffe.grpc.service.annotations Annotations for service resource
    ##
    service:
      type: ClusterIP
      port: 443
      annotations: {}
      # external-dns.alpha.kubernetes.io/hostname: spire-identity-exchange-grpc-spiffe.example.org
      ## @param spiffe.grpc.service.loadBalancerIP IP address to assign to load balancer (if supported)
      loadBalancerIP: ""
    ingress:
      ## @param spiffe.grpc.ingress.enabled Flag to enable ingress
      enabled: false
      ## @param spiffe.grpc.ingress.className Ingress class name
      className: ""
      ## @param spiffe.grpc.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
      controllerType: ""
      ## @param spiffe.grpc.ingress.annotations [object] Annotations for ingress object
      annotations: {}
        # kubernetes.io/ingress.class: nginx
        # kubernetes.io/tls-acme: "true"
        # nginx.ingress.kubernetes.io/ssl-redirect: "true"
        # nginx.ingress.kubernetes.io/force-ssl-redirect: "true"

      ## @param spiffe.grpc.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The grpc of the rules will be autogenerated. For more customizability, use hosts[] instead.
      host: "spire-identity-exchange-grpc-spiffe"

      ## @param spiffe.grpc.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
      tlsSecret: ""

      ## @param spiffe.grpc.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
      hosts: []
      #  - host: spire-identity-exchange-grpc-spiffe.example.org
      #    paths:
      #      - path: /
      #        pathType: Prefix

      ## @param spiffe.grpc.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
      tls: []
      #  - secretName: chart-example-tls
      #    hosts:
      #      - spire-identiy-exchange-grpc-spiffe.example.org

    ## Gateway API exposure for this endpoint. Always a TLSRoute (SNI passthrough): an X509-SVID has no DNS SAN, so edge termination cannot validate this backend.
    gatewayAPI:
      ## @param spiffe.grpc.gatewayAPI.enabled Flag to expose the endpoint via Gateway API
      enabled: false
      ## @param spiffe.grpc.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
      host: "spire-identity-exchange-grpc-spiffe"
      ## @param spiffe.grpc.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
      annotations: {}
      listenerSet:
        ## @param spiffe.grpc.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
        enabled: null
      ## @param spiffe.grpc.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
      parentRefs: []
      ## @param spiffe.grpc.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
      sectionName: ""

tools:
  kubectl:
    ## @param tools.kubectl.image.registry The OCI registry to pull the image from
    ## @param tools.kubectl.image.repository The repository within the registry
    ## @param tools.kubectl.image.pullPolicy The image pull policy
    ## @param tools.kubectl.image.tag Overrides the image tag whose default is the chart appVersion
    ##
    image:
      registry: registry.k8s.io
      repository: kubectl
      pullPolicy: IfNotPresent
      tag: ""
clusterRole:
  ## @param clusterRole.create create a k8s cluster role to allow access to token reviews and oidc discovery
  create: true

## @param server.address Address for Spire server
## @param server.port Port number for Spire server
## @param server.namespaceOverride Override the namespace for Spire server
## @param server.nameOverride Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align.
##
server:
  address: ""
  port: 443
  namespaceOverride: ""
  nameOverride: ""