sabsariandClaude Opus 4.8
c638121997
Render Gateway spec.infrastructure (labels/annotations) so Gateway API
controllers propagate the metadata onto the provisioned Service/Deployment,
e.g. AWS internal NLB annotations. Purely additive: guarded by `with`, so
the default {} renders no change.
- spire-lib: toYaml passthrough in the shared Gateway helper
- spire, spire-nested: add the values param; regenerate READMEs
- tests/unit: cover the positive passthrough case
Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
1115 lines
64 KiB
YAML
1115 lines
64 KiB
YAML
# Default configuration for Spire chart
|
|
# SPDX-License-Identifier: APACHE-2.0
|
|
|
|
## @section Global parameters
|
|
## Note: the parameter values specified here will override the chart level values for these parameters.
|
|
##
|
|
global:
|
|
k8s:
|
|
## @param global.k8s.clusterDomain Cluster domain name configured for Spire install
|
|
clusterDomain: cluster.local
|
|
|
|
spire:
|
|
## @param global.spire.clusterName The name of the k8s cluster for Spire install
|
|
clusterName: example-cluster
|
|
## @param global.spire.jwtIssuer The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset
|
|
jwtIssuer: ""
|
|
## @param global.spire.trustDomain The trust domain for Spire install
|
|
trustDomain: example.org
|
|
|
|
## @param global.spire.caSubject.country Country for Spire server CA
|
|
## @param global.spire.caSubject.organization Organization for Spire server CA
|
|
## @param global.spire.caSubject.commonName Common Name for Spire server CA
|
|
caSubject:
|
|
country: ""
|
|
organization: ""
|
|
commonName: ""
|
|
|
|
## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off.
|
|
## @param global.spire.recommendations.namespaceLayout Set to true to use recommended values for installing across namespaces
|
|
## @param global.spire.recommendations.namespacePSS When chart namespace creation is enabled, label them with preffered Pod Security Standard labels
|
|
## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names
|
|
## @param global.spire.recommendations.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
|
|
## @param global.spire.recommendations.securityContexts Set to true to use recommended values for Pod and Container Security Contexts
|
|
## @param global.spire.recommendations.prometheus Enable prometheus exporters for monitoring
|
|
recommendations:
|
|
enabled: false
|
|
namespaceLayout: true
|
|
namespacePSS: true
|
|
priorityClassName: true
|
|
strictMode: true
|
|
securityContexts: true
|
|
prometheus: true
|
|
|
|
image:
|
|
## @param global.spire.image.registry Override all Spire image registries at once
|
|
registry: ""
|
|
|
|
namespaces:
|
|
## @param global.spire.namespaces.create Set to true to Create all namespaces. If this or either of the namespace specific create flags is set, the namespace will be created.
|
|
create: false
|
|
system:
|
|
## @param global.spire.namespaces.system.name Name of the Spire system Namespace.
|
|
name: "spire-system"
|
|
## @param global.spire.namespaces.system.create Create a Namespace for Spire system resources.
|
|
create: false
|
|
## @param global.spire.namespaces.system.annotations [object] Annotations to apply to the Spire system Namespace.
|
|
annotations: {}
|
|
## @param global.spire.namespaces.system.labels [object] Labels to apply to the Spire system Namespace.
|
|
labels: {}
|
|
server:
|
|
## @param global.spire.namespaces.server.name Name of the Spire server Namespace.
|
|
name: "spire-server"
|
|
## @param global.spire.namespaces.server.create Create a Namespace for Spire server resources.
|
|
create: false
|
|
## @param global.spire.namespaces.server.annotations [object] Annotations to apply to the Spire server Namespace.
|
|
annotations: {}
|
|
## @param global.spire.namespaces.server.labels [object] Labels to apply to the Spire server Namespace.
|
|
labels: {}
|
|
|
|
## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
|
|
strictMode: false
|
|
|
|
## @param global.spire.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
|
ingressControllerType: ""
|
|
|
|
## Shared Gateway that routes and ListenerSets attach to. The Gateway object itself is
|
|
## rendered by the `gatewayAPI.gateway` block of this chart. Gateway API support is
|
|
## independent of ingress and can be enabled alongside it.
|
|
gatewayAPI:
|
|
## @param global.spire.gatewayAPI.manageListenerSets Default policy for whether services render a ListenerSet for their SNI listener. Each service may override via its gatewayAPI.listenerSet.enabled.
|
|
manageListenerSets: true
|
|
gateway:
|
|
## @param global.spire.gatewayAPI.gateway.name Name of the shared Gateway object that routes and ListenerSets attach to
|
|
name: spire
|
|
## The Gateway object and every route's parentRef both read this value, so they
|
|
## cannot disagree. It defaults to the server namespace so the Gateway sits with
|
|
## the workloads it fronts; a ListenerSet in another namespace still attaches, as
|
|
## the Gateway allows listeners from all namespaces by default.
|
|
## @param global.spire.gatewayAPI.gateway.namespace Namespace of the shared Gateway object. Defaults to the release namespace if blank.
|
|
namespace: spire-server
|
|
## @param global.spire.gatewayAPI.gateway.port Port the shared Gateway listens on. ListenerSet listeners must match this.
|
|
port: 443
|
|
|
|
tools:
|
|
kubectl:
|
|
## @param global.spire.tools.kubectl.tag Set to force the tag to use for all kubectl instances
|
|
tag: ""
|
|
|
|
installAndUpgradeHooks:
|
|
## @param global.installAndUpgradeHooks.enabled Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`)
|
|
enabled: true
|
|
deleteHooks:
|
|
## @param global.deleteHooks.enabled Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`)
|
|
enabled: true
|
|
|
|
# telemetry:
|
|
# prometheus:
|
|
# enabled: true
|
|
# podMonitor:
|
|
# enabled: true
|
|
# # -- Allows to install the PodMonitor in another namespace then the spire components are installed into.
|
|
# namespace: "kube-prometheus-system"
|
|
# labels: {}
|
|
|
|
tags:
|
|
## @param tags.nestedRoot Set the chart architecture to root nested
|
|
nestedRoot: false
|
|
## @param tags.nestedChildFull Set the chart mode to a child cluster with its own nested server
|
|
nestedChildFull: false
|
|
## @param tags.nestedChildSecurity Set the chart mode to a child cluster for use with a security cluster
|
|
nestedChildSecurity: false
|
|
## @param tags.haAgentCommon Set the chart mode to deploy the common portion of a spire-ha-agent setup
|
|
haAgentCommon: false
|
|
## @param tags.bottomTurtleHAA Setup HA side A for use with a Bottom Turtle architecture
|
|
bottomTurtleHAA: false
|
|
## @param tags.bottomTurtleHAB Setup HA side B for use with a Bottom Turtle architecture
|
|
bottomTurtleHAB: false
|
|
|
|
## The shared Gateway that routes and ListenerSets attach to. Only one release in a cluster
|
|
## should render it. name/namespace/port come from global.spire.gatewayAPI.gateway; the
|
|
## class and listener policy are local.
|
|
##
|
|
gatewayAPI:
|
|
gateway:
|
|
## @param gatewayAPI.gateway.enabled Render the shared Gateway object
|
|
enabled: false
|
|
## @param gatewayAPI.gateway.className gatewayClassName for the shared Gateway (e.g. "eg"). Required when enabled.
|
|
className: ""
|
|
## @param gatewayAPI.gateway.annotations [object] Annotations for the Gateway object
|
|
annotations: {}
|
|
## @param gatewayAPI.gateway.infrastructure [object] Metadata (labels/annotations) propagated to the provisioned Gateway Service/Deployment. Use for cloud LB annotations, e.g. internal NLB.
|
|
infrastructure: {}
|
|
## @param gatewayAPI.gateway.allowedListenersNamespaces From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector.
|
|
allowedListenersNamespaces: All
|
|
## @param gatewayAPI.gateway.allowedRoutesNamespaces From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector.
|
|
allowedRoutesNamespaces: All
|
|
## @param gatewayAPI.gateway.extraListeners [array] Additional listeners to add to the Gateway
|
|
extraListeners: []
|
|
|
|
## Combined exposure fronting the spire-identity-exchange of both HA sides. Only rendered
|
|
## with tags.haAgentCommon; the per-side exposures under bottomTurtleHAA/B are untouched.
|
|
## Each endpoint gets one Service selecting both sides' exchange pods, so the Ingress and
|
|
## the Gateway API route need only a single backend. The matching listener must be enabled
|
|
## on the sides themselves; if it is not, the Service simply has no endpoints.
|
|
spireIdentityExchange:
|
|
## @param spireIdentityExchange.podSelector [object] Labels selecting the exchange pods of both sides. Narrow it (for example by adding release-namespace) when other exchanges share the namespace.
|
|
podSelector:
|
|
component: spire-identity-exchange
|
|
|
|
## Endpoints served with the certificate each side loads from disk.
|
|
tls:
|
|
rest:
|
|
## @param spireIdentityExchange.tls.rest.enabled Expose the combined REST endpoint served with the on-disk certificate
|
|
enabled: false
|
|
## @param spireIdentityExchange.tls.rest.service.type Service type
|
|
## @param spireIdentityExchange.tls.rest.service.port port for the service
|
|
## @param spireIdentityExchange.tls.rest.service.annotations Annotations for service resource
|
|
##
|
|
service:
|
|
type: ClusterIP
|
|
port: 443
|
|
annotations: {}
|
|
## @param spireIdentityExchange.tls.rest.service.loadBalancerIP IP address to assign to load balancer (if supported)
|
|
loadBalancerIP: ""
|
|
ingress:
|
|
## @param spireIdentityExchange.tls.rest.ingress.enabled Flag to enable ingress
|
|
enabled: false
|
|
## @param spireIdentityExchange.tls.rest.ingress.className Ingress class name
|
|
className: ""
|
|
## @param spireIdentityExchange.tls.rest.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
|
controllerType: ""
|
|
## @param spireIdentityExchange.tls.rest.ingress.annotations [object] Annotations for ingress object
|
|
annotations: {}
|
|
## @param spireIdentityExchange.tls.rest.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. Must differ from the per-side hosts.
|
|
host: "spire-identity-exchange-rest"
|
|
## @param spireIdentityExchange.tls.rest.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
|
tlsSecret: ""
|
|
## @param spireIdentityExchange.tls.rest.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
|
hosts: []
|
|
## @param spireIdentityExchange.tls.rest.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
|
tls: []
|
|
## Gateway API exposure for this endpoint. A set tlsSecret gives HTTPRoute (reencrypt); blank gives TLSRoute (SNI passthrough).
|
|
gatewayAPI:
|
|
## @param spireIdentityExchange.tls.rest.gatewayAPI.enabled Flag to expose the endpoint via Gateway API
|
|
enabled: false
|
|
## @param spireIdentityExchange.tls.rest.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
|
host: "spire-identity-exchange-rest"
|
|
## @param spireIdentityExchange.tls.rest.gatewayAPI.tlsSecret Secret with the TLS cert for edge termination. Blank keeps passthrough.
|
|
tlsSecret: ""
|
|
## @param spireIdentityExchange.tls.rest.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
|
annotations: {}
|
|
listenerSet:
|
|
## @param spireIdentityExchange.tls.rest.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
|
enabled: null
|
|
## @param spireIdentityExchange.tls.rest.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
|
parentRefs: []
|
|
## @param spireIdentityExchange.tls.rest.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
|
sectionName: ""
|
|
backendTLS:
|
|
## @param spireIdentityExchange.tls.rest.gatewayAPI.backendTLS.caCertificateRefs [array] ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap.
|
|
caCertificateRefs: []
|
|
grpc:
|
|
## @param spireIdentityExchange.tls.grpc.enabled Expose the combined gRPC endpoint served with the on-disk certificate
|
|
enabled: false
|
|
## @param spireIdentityExchange.tls.grpc.service.type Service type
|
|
## @param spireIdentityExchange.tls.grpc.service.port port for the service
|
|
## @param spireIdentityExchange.tls.grpc.service.annotations Annotations for service resource
|
|
##
|
|
service:
|
|
type: ClusterIP
|
|
port: 443
|
|
annotations: {}
|
|
## @param spireIdentityExchange.tls.grpc.service.loadBalancerIP IP address to assign to load balancer (if supported)
|
|
loadBalancerIP: ""
|
|
ingress:
|
|
## @param spireIdentityExchange.tls.grpc.ingress.enabled Flag to enable ingress
|
|
enabled: false
|
|
## @param spireIdentityExchange.tls.grpc.ingress.className Ingress class name
|
|
className: ""
|
|
## @param spireIdentityExchange.tls.grpc.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
|
controllerType: ""
|
|
## @param spireIdentityExchange.tls.grpc.ingress.annotations [object] Annotations for ingress object
|
|
annotations: {}
|
|
## @param spireIdentityExchange.tls.grpc.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. Must differ from the per-side hosts.
|
|
host: "spire-identity-exchange-grpc"
|
|
## @param spireIdentityExchange.tls.grpc.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
|
tlsSecret: ""
|
|
## @param spireIdentityExchange.tls.grpc.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
|
hosts: []
|
|
## @param spireIdentityExchange.tls.grpc.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
|
tls: []
|
|
## Gateway API exposure for this endpoint. A set tlsSecret gives HTTPRoute (reencrypt); blank gives TLSRoute (SNI passthrough).
|
|
gatewayAPI:
|
|
## @param spireIdentityExchange.tls.grpc.gatewayAPI.enabled Flag to expose the endpoint via Gateway API
|
|
enabled: false
|
|
## @param spireIdentityExchange.tls.grpc.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
|
host: "spire-identity-exchange-grpc"
|
|
## @param spireIdentityExchange.tls.grpc.gatewayAPI.tlsSecret Secret with the TLS cert for edge termination. Blank keeps passthrough.
|
|
tlsSecret: ""
|
|
## @param spireIdentityExchange.tls.grpc.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
|
annotations: {}
|
|
listenerSet:
|
|
## @param spireIdentityExchange.tls.grpc.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
|
enabled: null
|
|
## @param spireIdentityExchange.tls.grpc.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
|
parentRefs: []
|
|
## @param spireIdentityExchange.tls.grpc.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
|
sectionName: ""
|
|
backendTLS:
|
|
## @param spireIdentityExchange.tls.grpc.gatewayAPI.backendTLS.caCertificateRefs [array] ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap.
|
|
caCertificateRefs: []
|
|
|
|
## Endpoints served with each side's own X509-SVID. Gateway API is always a TLSRoute
|
|
## (SNI passthrough) here: an X509-SVID has no DNS SAN, so edge termination could never
|
|
## validate these backends.
|
|
spiffe:
|
|
rest:
|
|
## @param spireIdentityExchange.spiffe.rest.enabled Expose the combined REST endpoint served with each side's own X509-SVID
|
|
enabled: false
|
|
## @param spireIdentityExchange.spiffe.rest.service.type Service type
|
|
## @param spireIdentityExchange.spiffe.rest.service.port port for the service
|
|
## @param spireIdentityExchange.spiffe.rest.service.annotations Annotations for service resource
|
|
##
|
|
service:
|
|
type: ClusterIP
|
|
port: 443
|
|
annotations: {}
|
|
## @param spireIdentityExchange.spiffe.rest.service.loadBalancerIP IP address to assign to load balancer (if supported)
|
|
loadBalancerIP: ""
|
|
ingress:
|
|
## @param spireIdentityExchange.spiffe.rest.ingress.enabled Flag to enable ingress
|
|
enabled: false
|
|
## @param spireIdentityExchange.spiffe.rest.ingress.className Ingress class name
|
|
className: ""
|
|
## @param spireIdentityExchange.spiffe.rest.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
|
controllerType: ""
|
|
## @param spireIdentityExchange.spiffe.rest.ingress.annotations [object] Annotations for ingress object
|
|
annotations: {}
|
|
## @param spireIdentityExchange.spiffe.rest.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. Must differ from the per-side hosts.
|
|
host: "spire-identity-exchange-rest-spiffe"
|
|
## @param spireIdentityExchange.spiffe.rest.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
|
tlsSecret: ""
|
|
## @param spireIdentityExchange.spiffe.rest.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
|
hosts: []
|
|
## @param spireIdentityExchange.spiffe.rest.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
|
tls: []
|
|
## Gateway API exposure for this endpoint. Always a TLSRoute (SNI passthrough).
|
|
gatewayAPI:
|
|
## @param spireIdentityExchange.spiffe.rest.gatewayAPI.enabled Flag to expose the endpoint via Gateway API
|
|
enabled: false
|
|
## @param spireIdentityExchange.spiffe.rest.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
|
host: "spire-identity-exchange-rest-spiffe"
|
|
## @param spireIdentityExchange.spiffe.rest.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
|
annotations: {}
|
|
listenerSet:
|
|
## @param spireIdentityExchange.spiffe.rest.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
|
enabled: null
|
|
## @param spireIdentityExchange.spiffe.rest.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
|
parentRefs: []
|
|
## @param spireIdentityExchange.spiffe.rest.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
|
sectionName: ""
|
|
grpc:
|
|
## @param spireIdentityExchange.spiffe.grpc.enabled Expose the combined gRPC endpoint served with each side's own X509-SVID
|
|
enabled: false
|
|
## @param spireIdentityExchange.spiffe.grpc.service.type Service type
|
|
## @param spireIdentityExchange.spiffe.grpc.service.port port for the service
|
|
## @param spireIdentityExchange.spiffe.grpc.service.annotations Annotations for service resource
|
|
##
|
|
service:
|
|
type: ClusterIP
|
|
port: 443
|
|
annotations: {}
|
|
## @param spireIdentityExchange.spiffe.grpc.service.loadBalancerIP IP address to assign to load balancer (if supported)
|
|
loadBalancerIP: ""
|
|
ingress:
|
|
## @param spireIdentityExchange.spiffe.grpc.ingress.enabled Flag to enable ingress
|
|
enabled: false
|
|
## @param spireIdentityExchange.spiffe.grpc.ingress.className Ingress class name
|
|
className: ""
|
|
## @param spireIdentityExchange.spiffe.grpc.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
|
controllerType: ""
|
|
## @param spireIdentityExchange.spiffe.grpc.ingress.annotations [object] Annotations for ingress object
|
|
annotations: {}
|
|
## @param spireIdentityExchange.spiffe.grpc.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. Must differ from the per-side hosts.
|
|
host: "spire-identity-exchange-grpc-spiffe"
|
|
## @param spireIdentityExchange.spiffe.grpc.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
|
tlsSecret: ""
|
|
## @param spireIdentityExchange.spiffe.grpc.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
|
hosts: []
|
|
## @param spireIdentityExchange.spiffe.grpc.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
|
tls: []
|
|
## Gateway API exposure for this endpoint. Always a TLSRoute (SNI passthrough).
|
|
gatewayAPI:
|
|
## @param spireIdentityExchange.spiffe.grpc.gatewayAPI.enabled Flag to expose the endpoint via Gateway API
|
|
enabled: false
|
|
## @param spireIdentityExchange.spiffe.grpc.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
|
|
host: "spire-identity-exchange-grpc-spiffe"
|
|
## @param spireIdentityExchange.spiffe.grpc.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
|
|
annotations: {}
|
|
listenerSet:
|
|
## @param spireIdentityExchange.spiffe.grpc.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
|
|
enabled: null
|
|
## @param spireIdentityExchange.spiffe.grpc.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
|
|
parentRefs: []
|
|
## @param spireIdentityExchange.spiffe.grpc.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
|
|
sectionName: ""
|
|
|
|
## subcharts
|
|
|
|
## @section Spire agent parameters
|
|
## Parameter values for Spire agent
|
|
##
|
|
# Used with tags [nestedRoot, nestedChildFull]
|
|
downstream-spire-agent-full:
|
|
# enabled: true
|
|
## @param downstream-spire-agent-full.nameOverride Overrides the name of Spire agent pods
|
|
nameOverride: agent-downstream
|
|
server:
|
|
## @param downstream-spire-agent-full.server.nameOverride The name override setting of the internal SPIRE server
|
|
nameOverride: internal-server
|
|
## @param downstream-spire-agent-full.bundleConfigMap The name of the configmap that contains the downstream bundle
|
|
bundleConfigMap: spire-bundle-downstream
|
|
## @param downstream-spire-agent-full.persistence.hostPath Which path to use on the host when persistence.type = hostPath
|
|
persistence:
|
|
hostPath: /var/lib/spire/k8s/downstream-agent
|
|
|
|
## @section Spire agent parameters
|
|
## Parameter values for Spire agent
|
|
##
|
|
# Used with tags [nestedChildSecurity]
|
|
downstream-spire-agent-security:
|
|
# enabled: true
|
|
## @param downstream-spire-agent-security.nameOverride Overrides the name of Spire agent pods
|
|
nameOverride: agent-downstream
|
|
## @param downstream-spire-agent-security.bundleConfigMap The name of the configmap that contains the downstream bundle
|
|
bundleConfigMap: spire-bundle-upstream
|
|
serviceAccount:
|
|
## @param downstream-spire-agent-security.serviceAccount.name The name of the service account to use
|
|
name: spire-agent-upstream
|
|
## @param downstream-spire-agent-security.persistence.hostPath Which path to use on the host when persistence.type = hostPath
|
|
persistence:
|
|
hostPath: /var/lib/spire/k8s/downstream-agent
|
|
|
|
## @section Upstream Spire agent parameters
|
|
## Parameter values for upstream Spire agent
|
|
##
|
|
# Used with tags [nestedRoot, nestedChildFull]
|
|
upstream-spire-agent:
|
|
# enabled: true
|
|
## @param upstream-spire-agent.upstream Flag for enabling upstream Spire agent
|
|
upstream: true
|
|
## @param upstream-spire-agent.nameOverride Name override for upstream Spire agent
|
|
nameOverride: agent-upstream
|
|
## @param upstream-spire-agent.bundleConfigMap The configmap name for upstream Spire agent bundle
|
|
bundleConfigMap: spire-bundle-upstream
|
|
## @param upstream-spire-agent.socketPath Socket path where Spire agent socket is mounted
|
|
socketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
|
|
serviceAccount:
|
|
## @param upstream-spire-agent.serviceAccount.name Service account name for upstream Spire agent
|
|
name: spire-agent-upstream
|
|
healthChecks:
|
|
## @param upstream-spire-agent.healthChecks.port Health check port number for upstream Spire agent
|
|
port: 9981
|
|
telemetry:
|
|
prometheus:
|
|
## @param upstream-spire-agent.telemetry.prometheus.port The port where prometheus metrics are available
|
|
port: 9989
|
|
server:
|
|
## @param upstream-spire-agent.server.nameOverride The name override setting of the root SPIRE server
|
|
nameOverride: root-server
|
|
## @param upstream-spire-agent.persistence.hostPath Which path to use on the host when persistence.type = hostPath
|
|
persistence:
|
|
hostPath: /var/lib/spire/k8s/upstream-agent
|
|
|
|
## @section SPIFFE CSI Driver parameters
|
|
## Parameter values for spiffe-csi-driver
|
|
##
|
|
# Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity]
|
|
downstream-spiffe-csi-driver:
|
|
# enabled: true
|
|
## @param downstream-spiffe-csi-driver.fullnameOverride Fullname override
|
|
fullnameOverride: spiffe-csi-driver-downstream
|
|
|
|
## @section Upstream SPIFFE CSI Driver parameters
|
|
## Parameter values for upstream spiffe-csi-driver
|
|
##
|
|
# Used with tags [nestedRoot, nestedChildFull]
|
|
upstream-spiffe-csi-driver:
|
|
# enabled: true
|
|
## @param upstream-spiffe-csi-driver.fullnameOverride Fullname override
|
|
fullnameOverride: spiffe-csi-driver-upstream
|
|
## @param upstream-spiffe-csi-driver.pluginName The plugin name for configuring upstream Spiffe CSI driver
|
|
pluginName: upstream.csi.spiffe.io
|
|
## @param upstream-spiffe-csi-driver.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
|
|
agentSocketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
|
|
healthChecks:
|
|
## @param upstream-spiffe-csi-driver.healthChecks.port The port where Spiffe CSI driver health checks are exposed
|
|
port: 9810
|
|
|
|
## @section SPIFFE oidc discovery provider parameters
|
|
## Parameter values for spiffe-oidc-discovery-provider
|
|
##
|
|
# Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity, haAgentCommon]
|
|
spiffe-oidc-discovery-provider:
|
|
# enabled: true
|
|
## @param spiffe-oidc-discovery-provider.fullnameOverride Fullname override
|
|
fullnameOverride: spiffe-oidc-discovery-provider
|
|
|
|
## @section Tornjak frontend parameters
|
|
## Parameter values for Tornjak frontend
|
|
##
|
|
tornjak-frontend:
|
|
## @param tornjak-frontend.enabled Enables deployment of Tornjak frontend/UI (Not for production)
|
|
enabled: false
|
|
|
|
# Used with tags [nestedRoot]
|
|
root-spire-server:
|
|
# enabled: true
|
|
## @param root-spire-server.nameOverride Name override
|
|
nameOverride: root-server
|
|
## @param root-spire-server.crNameOverride Custom Resource name override
|
|
crNameOverride: root
|
|
controllerManager:
|
|
## @param root-spire-server.controllerManager.enabled Enable controller manager and provision CRD's
|
|
enabled: true
|
|
externalControllerManagers:
|
|
## @param root-spire-server.controllerManager.externalControllerManagers.enabled Flag to enable external controller managers
|
|
enabled: true
|
|
validatingWebhookConfiguration:
|
|
## @param root-spire-server.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
|
|
enabled: false
|
|
## @param root-spire-server.controllerManager.className specify to use an explicit class name.
|
|
className: spire-mgmt-root-server
|
|
identities:
|
|
clusterSPIFFEIDs:
|
|
child-servers:
|
|
## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable child servers
|
|
enabled: true
|
|
default:
|
|
## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable the default cluster spiffe id
|
|
enabled: false
|
|
oidc-discovery-provider:
|
|
## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled Enable the test-keys identity
|
|
enabled: false
|
|
test-keys:
|
|
## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable the test-keys identity
|
|
enabled: false
|
|
externalControllerManagers:
|
|
## @param root-spire-server.externalControllerManagers.enabled Flag to enable external controller managers
|
|
enabled: true
|
|
nodeAttestor:
|
|
k8sPSAT:
|
|
## @param root-spire-server.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor
|
|
serviceAccountAllowList:
|
|
- spire-agent-upstream
|
|
## @param root-spire-server.bundleConfigMap The name of the configmap to store the upstream bundle
|
|
bundleConfigMap: spire-bundle-upstream
|
|
|
|
# Used with tags [nestedChildFull]
|
|
external-root-spire-server-full:
|
|
## @param external-root-spire-server-full.externalServer Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers.
|
|
externalServer: true
|
|
## @param external-root-spire-server-full.nameOverride Name override
|
|
nameOverride: root-server
|
|
## @param external-root-spire-server-full.crNameOverride Custom Resource name override
|
|
crNameOverride: root
|
|
controllerManager:
|
|
## @param external-root-spire-server-full.controllerManager.enabled Enable controller manager and provision CRD's
|
|
enabled: true
|
|
validatingWebhookConfiguration:
|
|
## @param external-root-spire-server-full.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
|
|
enabled: false
|
|
## @param external-root-spire-server-full.controllerManager.className specify to use an explicit class name.
|
|
className: spire-mgmt-external-server
|
|
identities:
|
|
clusterSPIFFEIDs:
|
|
child-servers:
|
|
## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable child servers
|
|
enabled: true
|
|
## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.child-servers.labels [object] Default label spire.spiffe.io/child-server is set to enable label-based informer filtering on the root cluster's external controller manager.
|
|
labels:
|
|
spire.spiffe.io/child-server: "true"
|
|
default:
|
|
## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable the default cluster spiffe id
|
|
enabled: false
|
|
oidc-discovery-provider:
|
|
## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled Enable the test-keys identity
|
|
enabled: false
|
|
test-keys:
|
|
## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable the test-keys identity
|
|
enabled: false
|
|
nodeAttestor:
|
|
k8sPSAT:
|
|
## @param external-root-spire-server-full.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor
|
|
serviceAccountAllowList:
|
|
- spire-agent-upstream
|
|
## @param external-root-spire-server-full.bundleConfigMap The name of the configmap to store the upstream bundle
|
|
bundleConfigMap: spire-bundle-upstream
|
|
|
|
# Used with tags [nestedChildSecurity]
|
|
external-root-spire-server-security:
|
|
## @param external-root-spire-server-security.externalServer Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers.
|
|
externalServer: true
|
|
## @param external-root-spire-server-security.nameOverride Name override
|
|
nameOverride: root-server
|
|
## @param external-root-spire-server-security.crNameOverride Custom Resource name override
|
|
crNameOverride: root
|
|
controllerManager:
|
|
## @param external-root-spire-server-security.controllerManager.enabled Enable controller manager and provision CRD's
|
|
enabled: true
|
|
validatingWebhookConfiguration:
|
|
## @param external-root-spire-server-security.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
|
|
enabled: false
|
|
## @param external-root-spire-server-security.controllerManager.className specify to use an explicit class name.
|
|
className: spire-mgmt-external-server
|
|
nodeAttestor:
|
|
k8sPSAT:
|
|
## @param external-root-spire-server-security.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor
|
|
serviceAccountAllowList:
|
|
- spire-agent-upstream
|
|
## @param external-root-spire-server-security.bundleConfigMap The name of the configmap to store the upstream bundle
|
|
bundleConfigMap: spire-bundle-upstream
|
|
|
|
## @section Spire server parameters
|
|
## Parameter values for Spire server
|
|
##
|
|
# Used with tags [nestedRoot, nestedChildFull]
|
|
internal-spire-server:
|
|
# enabled: true
|
|
## @param internal-spire-server.nameOverride Overrides the name of Spire server pods
|
|
nameOverride: internal-server
|
|
controllerManager:
|
|
## @param internal-spire-server.controllerManager.enabled Enable controller manager and provision CRD's
|
|
enabled: true
|
|
identities:
|
|
clusterSPIFFEIDs:
|
|
oidc-discovery-provider:
|
|
## @param internal-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames Auto populate dns entries
|
|
autoPopulateDNSNames: false
|
|
externalControllerManagers:
|
|
## @param internal-spire-server.externalControllerManagers.enabled Flag to enable external controller managers
|
|
enabled: true
|
|
upstreamAuthority:
|
|
spire:
|
|
## @param internal-spire-server.upstreamAuthority.spire.enabled Enable upstream SPIRE server
|
|
enabled: true
|
|
## @param internal-spire-server.upstreamAuthority.spire.upstreamDriver Use an upstream driver for authentication
|
|
upstreamDriver: upstream.csi.spiffe.io
|
|
server:
|
|
## @param internal-spire-server.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server
|
|
nameOverride: root-server
|
|
## @param internal-spire-server.bundleConfigMap The name of the configmap to store the downstream bundle
|
|
bundleConfigMap: spire-bundle-downstream
|
|
|
|
# Used with tags [nestedRoot]
|
|
external-spire-server:
|
|
# enabled: true
|
|
## @param external-spire-server.nameOverride Overrides the name of Spire server pods
|
|
nameOverride: external-server
|
|
## @param external-spire-server.crNameOverride Custom Resource name override
|
|
crNameOverride: external
|
|
controllerManager:
|
|
## @param external-spire-server.controllerManager.enabled Enable controller manager and provision CRD's
|
|
enabled: true
|
|
validatingWebhookConfiguration:
|
|
## @param external-spire-server.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
|
|
enabled: false
|
|
## @param external-spire-server.controllerManager.className specify to use an explicit class name.
|
|
className: spire-mgmt-external-server
|
|
identities:
|
|
clusterSPIFFEIDs:
|
|
default:
|
|
## @param external-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable the default identity
|
|
enabled: false
|
|
oidc-discovery-provider:
|
|
## @param external-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled Enable the oidc-discovery-provider identity
|
|
enabled: false
|
|
test-keys:
|
|
## @param external-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable the test-keys identity
|
|
enabled: false
|
|
externalControllerManagers:
|
|
## @param external-spire-server.externalControllerManagers.enabled Flag to enable external controller managers
|
|
enabled: true
|
|
upstreamAuthority:
|
|
spire:
|
|
## @param external-spire-server.upstreamAuthority.spire.enabled Enable upstream SPIRE server
|
|
enabled: true
|
|
## @param external-spire-server.upstreamAuthority.spire.upstreamDriver Use an upstream driver for authentication
|
|
upstreamDriver: upstream.csi.spiffe.io
|
|
server:
|
|
## @param external-spire-server.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server
|
|
nameOverride: root-server
|
|
bundlePublisher:
|
|
k8sConfigMap:
|
|
## @param external-spire-server.bundlePublisher.k8sConfigMap.enabled Enable local k8s bundle uploader
|
|
enabled: false
|
|
nodeAttestor:
|
|
k8sPSAT:
|
|
## @param external-spire-server.nodeAttestor.k8sPSAT.enabled Enable PSAT k8s nodeattestor
|
|
enabled: false
|
|
joinToken:
|
|
## @param external-spire-server.nodeAttestor.joinToken.enabled Enable the join_token nodeattestor
|
|
enabled: true
|
|
|
|
# Used with tags [haAgentCommon]
|
|
spiffe-csi-driver:
|
|
# enabled: true
|
|
## @param spiffe-csi-driver.fullnameOverride Fullname override
|
|
fullnameOverride: spiffe-csi-driver
|
|
## @param spiffe-csi-driver.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
|
|
agentSocketPath: /var/run/spire/agent-sockets/spire-agent.sock
|
|
healthChecks:
|
|
## @param spiffe-csi-driver.healthChecks.port Health check port number for upstream Spire agent
|
|
port: 9814
|
|
|
|
# Used with tags [haAgentCommon]
|
|
spire-ha-agent:
|
|
# enabled: true
|
|
## @param spire-ha-agent.fullnameOverride Fullname override
|
|
fullnameOverride: spire-ha-agent
|
|
|
|
## @section Upstream SPIFFE CSI Driver for Bottom Turtle HA A parameters
|
|
## Parameter values for upstream spiffe-csi-driver-bottom-turtle-ha-a
|
|
##
|
|
# Used with tags [bottomTurtleHAA]
|
|
upstream-spiffe-csi-driver-bottom-turtle-ha-a:
|
|
# enabled: true
|
|
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.fullnameOverride Fullname override
|
|
fullnameOverride: spiffe-csi-driver-upstream-a
|
|
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.pluginName The plugin name for configuring upstream Spiffe CSI driver
|
|
pluginName: upstream-a.csi.spiffe.io
|
|
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
|
|
agentSocketPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public/spire-agent.sock
|
|
healthChecks:
|
|
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.healthChecks.port The port where Spiffe CSI driver health checks are exposed
|
|
port: 9810
|
|
validatingAdmissionPolicy:
|
|
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.validatingAdmissionPolicy.enabled Flag to enable validating policy
|
|
enabled: true
|
|
|
|
## @section Upstream SPIFFE CSI Driver for Bottom Turtle HA B parameters
|
|
## Parameter values for upstream spiffe-csi-driver-bottom-turtle-ha-b
|
|
##
|
|
# Used with tags [bottomTurtleHAB]
|
|
upstream-spiffe-csi-driver-bottom-turtle-ha-b:
|
|
# enabled: true
|
|
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.fullnameOverride Fullname override
|
|
fullnameOverride: spiffe-csi-driver-upstream-b
|
|
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.pluginName The plugin name for configuring upstream Spiffe CSI driver
|
|
pluginName: upstream-b.csi.spiffe.io
|
|
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
|
|
agentSocketPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public/spire-agent.sock
|
|
healthChecks:
|
|
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.healthChecks.port The port where Spiffe CSI driver health checks are exposed
|
|
port: 9812
|
|
validatingAdmissionPolicy:
|
|
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.validatingAdmissionPolicy.enabled Flag to enable validating policy
|
|
enabled: true
|
|
|
|
## @section Spire server parameters
|
|
## Parameter values for Spire server
|
|
##
|
|
# Used with tags [bottomTurtleHAA]
|
|
internal-spire-server-bottom-turtle-ha-a:
|
|
# enabled: true
|
|
## @param internal-spire-server-bottom-turtle-ha-a.nameOverride Overrides the name of Spire server pods
|
|
nameOverride: internal-server
|
|
## @param internal-spire-server-bottom-turtle-ha-a.caKeyType Key type to use for the ca
|
|
caKeyType: ec-p256
|
|
experimental:
|
|
## @param internal-spire-server-bottom-turtle-ha-a.experimental.enabled enable experimental features
|
|
enabled: true
|
|
## @param internal-spire-server-bottom-turtle-ha-a.experimental.agentSPIFFEIDAsSelector enable adding spiffe_id selectors to all agents
|
|
agentSPIFFEIDAsSelector: true
|
|
dynamicRegistration:
|
|
## @param internal-spire-server-bottom-turtle-ha-a.dynamicRegistration.enabled Enable dynamic registration
|
|
enabled: true
|
|
## @param internal-spire-server-bottom-turtle-ha-a.dynamicRegistration.allowedIDPrefix The allowed ID prefix
|
|
allowedIDPrefix: "spire/agent/x509pop/k8s"
|
|
## @param internal-spire-server-bottom-turtle-ha-a.dynamicRegistration.serviceAccount The service account to allow in for dynamic registration
|
|
serviceAccount: spire-a-agent
|
|
controllerManager:
|
|
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.enabled Enable controller manager and provision CRD's
|
|
enabled: true
|
|
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.parentIDTemplate parent id template
|
|
parentIDTemplate: "spiffe://{{ .TrustDomain }}/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"
|
|
identities:
|
|
clusterSPIFFEIDs:
|
|
oidc-discovery-provider:
|
|
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames Auto populate dns entries
|
|
autoPopulateDNSNames: false
|
|
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type The type of the entry
|
|
type: oidc-discovery-provider-common
|
|
spire-ha-agent:
|
|
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled Enables the spire-ha-agent identity
|
|
enabled: true
|
|
spire-identity-exchange-service:
|
|
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.federatesWith [array] List of trust domains to federate with
|
|
federatesWith:
|
|
- spire-ha
|
|
persistence:
|
|
## @param internal-spire-server-bottom-turtle-ha-a.persistence.type What type to use for peristence
|
|
type: emptyDir
|
|
nodeAttestor:
|
|
k8sPSAT:
|
|
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.k8sPSAT.enabled Enable the k8s projected access token node attestor
|
|
enabled: false
|
|
x509POP:
|
|
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
|
|
enabled: true
|
|
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.spiffePrefix What prefix to use when mode is spiffe
|
|
spiffePrefix: /spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/
|
|
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
|
|
agentPathTemplate: "/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}"
|
|
addClusterName:
|
|
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.spiffePrefix Suffix the cluster name onto the spiffePrefix
|
|
spiffePrefix: true
|
|
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
|
|
agentPathTemplate: true
|
|
upstreamAuthority:
|
|
spire:
|
|
## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.enabled Enable upstream SPIRE server
|
|
enabled: true
|
|
## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.upstreamDriver Use an upstream driver for authentication
|
|
upstreamDriver: upstream-a.csi.spiffe.io
|
|
server:
|
|
## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server
|
|
nameOverride: root-server
|
|
## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.server.address Address for upstream Spire server
|
|
address: "spire-server-a"
|
|
## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.server.port The port setting of the root SPIRE server
|
|
port: 8081
|
|
## @param internal-spire-server-bottom-turtle-ha-a.bundleConfigMap The name of the configmap to store the downstream bundle
|
|
bundleConfigMap: spire-server-a-bundle
|
|
trustSync:
|
|
## @param internal-spire-server-bottom-turtle-ha-a.trustSync.enabled Enable trust syncing
|
|
enabled: true
|
|
## @param internal-spire-server-bottom-turtle-ha-a.trustSync.domains the trust domains to sync
|
|
domains:
|
|
- spire-ha
|
|
|
|
## @section Spire server parameters
|
|
## Parameter values for Spire server
|
|
##
|
|
# Used with tags [bottomTurtleHAB]
|
|
internal-spire-server-bottom-turtle-ha-b:
|
|
# enabled: true
|
|
## @param internal-spire-server-bottom-turtle-ha-b.nameOverride Overrides the name of Spire server pods
|
|
nameOverride: internal-server
|
|
## @param internal-spire-server-bottom-turtle-ha-b.caKeyType Key type to use for the ca
|
|
caKeyType: ec-p256
|
|
experimental:
|
|
## @param internal-spire-server-bottom-turtle-ha-b.experimental.enabled enable experimental features
|
|
enabled: true
|
|
## @param internal-spire-server-bottom-turtle-ha-b.experimental.agentSPIFFEIDAsSelector enable adding spiffe_id selectors to all agents
|
|
agentSPIFFEIDAsSelector: true
|
|
dynamicRegistration:
|
|
## @param internal-spire-server-bottom-turtle-ha-b.dynamicRegistration.enabled Enable dynamic registration
|
|
enabled: true
|
|
## @param internal-spire-server-bottom-turtle-ha-b.dynamicRegistration.allowedIDPrefix The allowed ID prefix
|
|
allowedIDPrefix: "spire/agent/x509pop/k8s"
|
|
## @param internal-spire-server-bottom-turtle-ha-b.dynamicRegistration.serviceAccount The service account to allow in for dynamic registration
|
|
serviceAccount: spire-b-agent
|
|
controllerManager:
|
|
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.enabled Enable controller manager and provision CRD's
|
|
enabled: true
|
|
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.parentIDTemplate parent id template
|
|
parentIDTemplate: "spiffe://{{ .TrustDomain }}/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"
|
|
identities:
|
|
clusterSPIFFEIDs:
|
|
oidc-discovery-provider:
|
|
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames Auto populate dns entries
|
|
autoPopulateDNSNames: false
|
|
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type The type of the entry
|
|
type: oidc-discovery-provider-common
|
|
spire-ha-agent:
|
|
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled Enables the spire-ha-agent identity
|
|
enabled: true
|
|
spire-identity-exchange-service:
|
|
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.federatesWith [array] List of trust domains to federate with
|
|
federatesWith:
|
|
- spire-ha
|
|
persistence:
|
|
## @param internal-spire-server-bottom-turtle-ha-b.persistence.type What type to use for peristence
|
|
type: emptyDir
|
|
nodeAttestor:
|
|
k8sPSAT:
|
|
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.k8sPSAT.enabled Enable the k8s projected access token node attestor
|
|
enabled: false
|
|
x509POP:
|
|
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
|
|
enabled: true
|
|
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.spiffePrefix What prefix to use when mode is spiffe
|
|
spiffePrefix: /spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/
|
|
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
|
|
agentPathTemplate: "/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}"
|
|
addClusterName:
|
|
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.spiffePrefix Suffix the cluster name onto the spiffePrefix
|
|
spiffePrefix: true
|
|
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
|
|
agentPathTemplate: true
|
|
upstreamAuthority:
|
|
spire:
|
|
## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.enabled Enable upstream SPIRE server
|
|
enabled: true
|
|
## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.upstreamDriver Use an upstream driver for authentication
|
|
upstreamDriver: upstream-b.csi.spiffe.io
|
|
server:
|
|
## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server
|
|
nameOverride: root-server
|
|
## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.address Address for upstream Spire server
|
|
address: "spire-server-b"
|
|
## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.port The port setting of the root SPIRE server
|
|
port: 8081
|
|
## @param internal-spire-server-bottom-turtle-ha-b.bundleConfigMap The name of the configmap to store the downstream bundle
|
|
bundleConfigMap: spire-server-b-bundle
|
|
trustSync:
|
|
## @param internal-spire-server-bottom-turtle-ha-b.trustSync.enabled Enable trust syncing
|
|
enabled: true
|
|
## @param internal-spire-server-bottom-turtle-ha-b.trustSync.domains the trust domains to sync
|
|
domains:
|
|
- spire-ha
|
|
|
|
# Used with tags [bottomTurtleHAA]
|
|
downstream-spire-agent-bottom-turtle-ha-a:
|
|
# enabled: true
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.nameOverride Overrides the name of Spire agent pods
|
|
nameOverride: agent-downstream
|
|
server:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.server.nameOverride The name override setting of the internal SPIRE server
|
|
nameOverride: internal-server
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.bundleConfigMap The name of the configmap that contains the downstream bundle
|
|
bundleConfigMap: spire-server-a-bundle
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.persistence.hostPath Which path to use on the host when persistence.type = hostPath
|
|
persistence:
|
|
hostPath: /var/lib/spire/k8s/downstream-agent-a
|
|
dynamicRegistration:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.dynamicRegistration.enabled Enable dynamic registration
|
|
enabled: true
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.dynamicRegistration.nameOverride The name override to use to contact the server
|
|
nameOverride: internal-server
|
|
nodeAttestor:
|
|
k8sPSAT:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.nodeAttestor.k8sPSAT.enabled Enable the k8s projected access token node attestor
|
|
enabled: false
|
|
x509POP:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
|
|
enabled: true
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.nodeAttestor.x509POP.spiffeEndpointSocket Where the socket is to use for mode spiffe
|
|
spiffeEndpointSocket: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public/api.sock
|
|
keyManager:
|
|
memory:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.keyManager.memory.enabled Enable the memory based Key Manager
|
|
enabled: false
|
|
disk:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.keyManager.disk.enabled Enable the disk key manager
|
|
enabled: true
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.keyManager.disk.mode Where the disk plugin will write out its data
|
|
mode: emptyDir
|
|
healthChecks:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.healthChecks.port Health check port
|
|
port: 9981
|
|
telemetry:
|
|
prometheus:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.telemetry.prometheus.port Prometheus port to use
|
|
port: 9989
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.socketPath Socket path to use
|
|
socketPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
|
|
sockets:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.sockets.hostBasePath Path on the host to place sockets
|
|
hostBasePath: /var/run/spire/agent/sockets/a
|
|
admin:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.sockets.admin.enabled Enable admin socket
|
|
enabled: true
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.sockets.admin.mountOnHost Mount admin socket on host
|
|
mountOnHost: true
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.authorizedDelegates List of workloads able to use the delegation api
|
|
authorizedDelegates:
|
|
- /spire-ha-agent
|
|
brokerAPI:
|
|
brokers:
|
|
spire-ha-agent:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.brokerAPI.brokers.spire-ha-agent.enabled Enable the spire-ha-agent by default
|
|
enabled: true
|
|
workloadAttestors:
|
|
k8s:
|
|
brokerAPI:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.workloadAttestors.k8s.brokerAPI.accessPolicy The default accessPolicy
|
|
accessPolicy: permissive
|
|
brokers:
|
|
spire-ha-agent:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-a.workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled Enable the spire-ha-agent by default
|
|
enabled: true
|
|
|
|
# Used with tags [bottomTurtleHAB]
|
|
downstream-spire-agent-bottom-turtle-ha-b:
|
|
# enabled: true
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.nameOverride Overrides the name of Spire agent pods
|
|
nameOverride: agent-downstream
|
|
server:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.server.nameOverride The name override setting of the internal SPIRE server
|
|
nameOverride: internal-server
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.bundleConfigMap The name of the configmap that contains the downstream bundle
|
|
bundleConfigMap: spire-server-b-bundle
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.persistence.hostPath Which path to use on the host when persistence.type = hostPath
|
|
persistence:
|
|
hostPath: /var/lib/spire/k8s/downstream-agent-b
|
|
dynamicRegistration:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.dynamicRegistration.enabled Enable dynamic registration
|
|
enabled: true
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.dynamicRegistration.nameOverride The name override to use to contact the server
|
|
nameOverride: internal-server
|
|
nodeAttestor:
|
|
k8sPSAT:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.nodeAttestor.k8sPSAT.enabled Enable the k8s projected access token node attestor
|
|
enabled: false
|
|
x509POP:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
|
|
enabled: true
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.nodeAttestor.x509POP.spiffeEndpointSocket Where the socket is to use for mode spiffe
|
|
spiffeEndpointSocket: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public/api.sock
|
|
keyManager:
|
|
memory:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.keyManager.memory.enabled Enable the memory based Key Manager
|
|
enabled: false
|
|
disk:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.keyManager.disk.enabled Enable the disk key manager
|
|
enabled: true
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.keyManager.disk.mode Where the disk plugin will write out its data
|
|
mode: emptyDir
|
|
healthChecks:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.healthChecks.port Health check port
|
|
port: 9982
|
|
telemetry:
|
|
prometheus:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.telemetry.prometheus.port Prometheus port to use
|
|
port: 9990
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.socketPath Socket path to use
|
|
socketPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock
|
|
sockets:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.sockets.hostBasePath Path on the host to place sockets
|
|
hostBasePath: /var/run/spire/agent/sockets/b
|
|
admin:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.sockets.admin.enabled Enable admin socket
|
|
enabled: true
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.sockets.admin.mountOnHost Mount admin socket on host
|
|
mountOnHost: true
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.authorizedDelegates List of workloads able to use the delegation api
|
|
authorizedDelegates:
|
|
- /spire-ha-agent
|
|
brokerAPI:
|
|
brokers:
|
|
spire-ha-agent:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.brokerAPI.brokers.spire-ha-agent.enabled Enable the spire-ha-agent by default
|
|
enabled: true
|
|
workloadAttestors:
|
|
k8s:
|
|
brokerAPI:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.workloadAttestors.k8s.brokerAPI.accessPolicy The default accessPolicy
|
|
accessPolicy: permissive
|
|
brokers:
|
|
spire-ha-agent:
|
|
## @param downstream-spire-agent-bottom-turtle-ha-b.workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled Enable the spire-ha-agent by default
|
|
enabled: true
|
|
|
|
# Used with tags [bottomTurtleHAA]
|
|
downstream-spiffe-csi-driver-bottom-turtle-ha-a:
|
|
# enabled: true
|
|
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-a.fullnameOverride Fullname override
|
|
fullnameOverride: spiffe-csi-driver-downstream-a
|
|
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-a.agentSocketPath path to agent socket
|
|
agentSocketPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
|
|
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-a.pluginName The name of the plugin instance
|
|
pluginName: a.csi.spiffe.io
|
|
healthChecks:
|
|
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-a.healthChecks.port The health check port
|
|
port: 9814
|
|
|
|
# Used with tags [bottomTurtleHAB]
|
|
downstream-spiffe-csi-driver-bottom-turtle-ha-b:
|
|
# enabled: true
|
|
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.fullnameOverride Fullname override
|
|
fullnameOverride: spiffe-csi-driver-downstream-b
|
|
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.agentSocketPath path to agent socket
|
|
agentSocketPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock
|
|
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.pluginName The name of the plugin instance
|
|
pluginName: b.csi.spiffe.io
|
|
healthChecks:
|
|
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.healthChecks.port The health check port
|
|
port: 9816
|
|
|
|
spire-identity-exchange-bottom-turtle-ha-a:
|
|
## @param spire-identity-exchange-bottom-turtle-ha-a.enabled Enable the spire-identity-exchange
|
|
enabled: false
|
|
## @param spire-identity-exchange-bottom-turtle-ha-a.nameOverride name override
|
|
nameOverride: identity-exchange
|
|
## @param spire-identity-exchange-bottom-turtle-ha-a.csiDriverName CSI driver name to use
|
|
csiDriverName: a.csi.spiffe.io
|
|
tls:
|
|
rest:
|
|
ingress:
|
|
## @param spire-identity-exchange-bottom-turtle-ha-a.tls.rest.ingress.host Hostname override for the rest ingress service
|
|
host: "spire-identity-exchange-a-rest"
|
|
grpc:
|
|
ingress:
|
|
## @param spire-identity-exchange-bottom-turtle-ha-a.tls.grpc.ingress.host Hostname override for the grpc ingress service
|
|
host: "spire-identity-exchange-a-grpc"
|
|
spiffe:
|
|
rest:
|
|
ingress:
|
|
## @param spire-identity-exchange-bottom-turtle-ha-a.spiffe.rest.ingress.host Hostname override for the SVID-served rest ingress service
|
|
host: "spire-identity-exchange-a-rest-spiffe"
|
|
grpc:
|
|
ingress:
|
|
## @param spire-identity-exchange-bottom-turtle-ha-a.spiffe.grpc.ingress.host Hostname override for the SVID-served grpc ingress service
|
|
host: "spire-identity-exchange-a-grpc-spiffe"
|
|
server:
|
|
## @param spire-identity-exchange-bottom-turtle-ha-a.server.nameOverride The name override setting of the internal SPIRE server
|
|
nameOverride: internal-server
|
|
auth:
|
|
plugins:
|
|
spiffe:
|
|
## @param spire-identity-exchange-bottom-turtle-ha-a.auth.plugins.spiffe.csiDriverName The csi driver the spiffe plugin reads its trust bundle from. The shared ha-agent, since that is what mints the oidc discovery provider's serving svid.
|
|
csiDriverName: csi.spiffe.io
|
|
config:
|
|
## @param spire-identity-exchange-bottom-turtle-ha-a.auth.plugins.spiffe.config.discoveryURL The OIDC discovery provider to fetch keys from. This chart gives it a fullnameOverride, so the keySource convention does not apply.
|
|
discoveryURL: https://spiffe-oidc-discovery-provider
|
|
|
|
spire-identity-exchange-bottom-turtle-ha-b:
|
|
## @param spire-identity-exchange-bottom-turtle-ha-b.enabled Enable the spire-identity-exchange
|
|
enabled: false
|
|
## @param spire-identity-exchange-bottom-turtle-ha-b.nameOverride name override
|
|
nameOverride: identity-exchange
|
|
## @param spire-identity-exchange-bottom-turtle-ha-b.csiDriverName CSI driver name to use
|
|
csiDriverName: b.csi.spiffe.io
|
|
server:
|
|
## @param spire-identity-exchange-bottom-turtle-ha-b.server.nameOverride The name override setting of the internal SPIRE server
|
|
nameOverride: internal-server
|
|
tls:
|
|
rest:
|
|
ingress:
|
|
## @param spire-identity-exchange-bottom-turtle-ha-b.tls.rest.ingress.host Hostname override for the rest ingress service
|
|
host: "spire-identity-exchange-b-rest"
|
|
grpc:
|
|
ingress:
|
|
## @param spire-identity-exchange-bottom-turtle-ha-b.tls.grpc.ingress.host Hostname override for the grpc ingress service
|
|
host: "spire-identity-exchange-b-grpc"
|
|
spiffe:
|
|
rest:
|
|
ingress:
|
|
## @param spire-identity-exchange-bottom-turtle-ha-b.spiffe.rest.ingress.host Hostname override for the SVID-served rest ingress service
|
|
host: "spire-identity-exchange-b-rest-spiffe"
|
|
grpc:
|
|
ingress:
|
|
## @param spire-identity-exchange-bottom-turtle-ha-b.spiffe.grpc.ingress.host Hostname override for the SVID-served grpc ingress service
|
|
host: "spire-identity-exchange-b-grpc-spiffe"
|
|
auth:
|
|
plugins:
|
|
spiffe:
|
|
## @param spire-identity-exchange-bottom-turtle-ha-b.auth.plugins.spiffe.csiDriverName The csi driver the spiffe plugin reads its trust bundle from. The shared ha-agent, since that is what mints the oidc discovery provider's serving svid.
|
|
csiDriverName: csi.spiffe.io
|
|
config:
|
|
## @param spire-identity-exchange-bottom-turtle-ha-b.auth.plugins.spiffe.config.discoveryURL The OIDC discovery provider to fetch keys from. This chart gives it a fullnameOverride, so the keySource convention does not apply.
|
|
discoveryURL: https://spiffe-oidc-discovery-provider
|