helm-charts-hardened/charts/spire

spire

A Helm chart for deploying spire-server and spire-agent.

⚠️ Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server.

⚠️ Minimum Spire version is v1.0.2.

To enable Projected Service Account Tokens on Docker for Mac/Windows run the following command to SSH into the Docker Desktop K8s VM.

docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh

Then add the following to /etc/kubernetes/manifests/kube-apiserver.yaml

spec:
  containers:
    - command:
        - kube-apiserver
        - --api-audiences=api,spire-server
        - --service-account-issuer=api,spire-agent
        - --service-account-key-file=/run/config/pki/sa.pub
        - --service-account-signing-key-file=/run/config/pki/sa.key

Homepage: https://github.com/philips-labs/helm-charts/charts/spire

Maintainers

Name	Email	Url
marcofranssen	[email protected]	https://marcofranssen.nl

Source Code

• https://github.com/philips-labs/helm-charts/charts/spire

Requirements

Kubernetes: >=1.21.0-0

Repository	Name	Version
file://./charts/k8s-workload-registrar	k8s-workload-registrar	0.1.0
file://./charts/spiffe-csi-driver	spiffe-csi-driver	0.1.0
file://./charts/spiffe-oidc-discovery-provider	spiffe-oidc-discovery-provider	0.1.0

Values

Key	Type	Default	Description
fullnameOverride	string	""
imagePullSecrets	list	[]
k8s-workload-registrar.enabled	bool	true
nameOverride	string	""
serviceAccount.annotations	object	{}
serviceAccount.create	bool	true
serviceAccount.name	string	""
spiffe-oidc-discovery-provider.enabled	bool	false
spire-agent.bundleConfigMap	string	"spire-bundle"
spire-agent.nameOverride	string	"agent"
spire-server.bundleConfigMap	string	"spire-bundle"
spire-server.nameOverride	string	"server"
spire.clusterName	string	"example-cluster"
spire.trustDomain	string	"example.org"
waitForIt.image.pullPolicy	string	"IfNotPresent"
waitForIt.image.registry	string	"cgr.dev"
waitForIt.image.repository	string	"chainguard/wait-for-it"
waitForIt.image.version	string	"latest-20221223"
waitForIt.resources	object	{}

---

Autogenerated from chart metadata using helm-docs v1.11.0