helm-charts-hardened/charts/spire/charts/spike-nexus

spike-nexus

A Helm chart to deploy spike nexus

Homepage: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire

Version support

Note

This Chart is still in development and still subject to change the API (values.yaml). Until we reach a 1.0.0 version of the chart we can't guarantee backwards compatibility although we do aim for as much stability as possible.

Dependency	Supported Versions
Helm	3.x

Source Code

• https://github.com/spiffe/spike

Parameters

Chart parameters

Name	Description	Value
image.registry	The OCI registry to pull the image from	ghcr.io
image.repository	The repository within the registry	spiffe/spike-nexus
image.pullPolicy	The image pull policy	IfNotPresent
image.tag	Overrides the image tag whose default is the chart appVersion	""
bootstrap.force	Force bootstrapping	false
bootstrap.image.registry	The OCI registry to pull the image from	ghcr.io
bootstrap.image.repository	The repository within the registry	spiffe/spike-bootstrap
bootstrap.image.pullPolicy	The image pull policy	IfNotPresent
bootstrap.image.tag	Overrides the image tag whose default is the chart appVersion	""
installAndUpgradeHook.enabled	Enable Helm hook to bootstrap	true
backendStore	The backend store to use. Must be one of [sqlite, memory, lite]	sqlite
replicas	The number of keepers to launch	1
shamir.shares	How many shares to configure for shamir secrets	3
shamir.threshold	How many shares needed to recover	2
keeperPeers	Keeper peer configuration. If blank, it will be autodetected	[]
trustRoot.self	Override which trustRoot(s) this SPIKE Nexus instance is in (array)	[]
trustRoot.keeper	Override which trustRoot(s) Keeper is in (array)	[]
trustRoot.pilot	Override which trustRoot(s) Pilot is in (array)	[]
trustRoot.bootstrap	Override which trustRoot(s) Bootstrap is in (array)	[]
trustRoot.nexus	Override which trustRoot(s) Nexus is in (array)	[]
logLevel	The log level, valid values are "debug", "info", "warn", and "error"	debug
agentSocketName	The name of the spire-agent unix socket	spire-agent.sock
csiDriverName	The csi driver to use	csi.spiffe.io
imagePullSecrets	Pull secrets for images	[]
nameOverride	Name override	""
namespaceOverride	Namespace override	""
fullnameOverride	Fullname override	""
serviceAccount.create	Specifies whether a service account should be created	true
serviceAccount.annotations	Annotations to add to the service account	{}
serviceAccount.name	The name of the service account to use. If not set and create is true, a name is generated.	""
labels	Labels for pods	{}
podSecurityContext	Pod security context	{}
securityContext	Security context	{}
service.type	Service type	ClusterIP
service.port	Service port	443
service.annotations	Annotations for service resource	{}
nodeSelector	(Optional) Select specific nodes to run on.	{}
affinity	Affinity rules	{}
tolerations	List of tolerations	[]
topologySpreadConstraints	List of topology spread constraints for resilience	[]
startupProbe.enabled	Enable startupProbe	true
startupProbe.initialDelaySeconds	Initial delay seconds for startupProbe	5
startupProbe.periodSeconds	Period seconds for startupProbe	10
startupProbe.timeoutSeconds	Timeout seconds for startupProbe	5
startupProbe.failureThreshold	Failure threshold count for startupProbe	6
startupProbe.successThreshold	Success threshold count for startupProbe	1
ingress.enabled	Flag to enable ingress	false
ingress.className	Ingress class name	""
ingress.controllerType	Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, auto-detection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].	""
ingress.annotations	Annotations	{}
ingress.host	Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.	nexus
ingress.tlsSecret	Secret that has the certs. If blank will use default certs. Used with host var.	""
ingress.hosts	Host paths for ingress object. If empty, rules will be built based on the host var.	[]
ingress.tls	Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.	[]
persistence.type	What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only)	pvc
persistence.size	What size volume to use for persistence	1Gi
persistence.accessMode	What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended)	ReadWriteOnce
persistence.storageClass	What storage class to use for persistence	nil
persistence.hostPath	Which path to use on the host when persistence.type = hostPath	""