helm-charts-hardened/charts/spire-identity-exchange

spire-identity-exchange

A Helm chart to install the SPIRE Identity Exchange.

Homepage: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-identity-exchange

Maintainers

Name	Email	Url
marcofranssen	[email protected]	https://marcofranssen.nl
kfox1111	[email protected]
faisal-memon	[email protected]

Source Code

• https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-identity-exchange

Listeners

Serving is a two-axis matrix: protocol (gRPC or REST) crossed with the source of the certificate the listener presents. All four listeners are independent and can run at once.

Values block	Serves with	Default port	Default
tls.rest	the certificate from tls.externalSecret / tls.certManager	8444	off
tls.grpc	the certificate from tls.externalSecret / tls.certManager	8443	off
spiffe.rest	this deployment's own X509-SVID	8544	on
spiffe.grpc	this deployment's own X509-SVID	8543	off

The spiffe.* listeners need no certificate files: the SVID is fetched from the SPIRE Agent Workload API and rotated automatically, so a SPIFFE-only install requires neither cert-manager nor a TLS Secret. A cert source under tls: is required only when tls.rest or tls.grpc is enabled. Client authentication is identical on all four — callers present a bearer token.

With tls.certManager, the requested certificate's dnsNames are taken from whichever exposures are enabled — the ingress.host, the gatewayAPI.host, or both — across every enabled tls.* listener, deduplicated. Each enabled tls.* listener must therefore have an ingress or a gateway enabled, unless you set tls.certManager.certificate.dnsNames explicitly.

The stack selector

Every exchange addresses a stack: an entry in auth.stacks, or — with auth.passthroughPlugins (the default) — a single plugin addressed under its own name. It is the {stack} segment of the REST path (/api/v1/svid/{stack}/x509).

As of app version v0.4.0 the exchange asserts one selector on its own behalf, naming the stack that was addressed:

Selector type	Value	Example
spire_identity_exchange	stack:name:<stack>	spire_identity_exchange:stack:name:k8s_psat

Add it to a registration entry to scope that entry to a single stack:

controllerManager:
  identities:
    clusterStaticEntries:
      test:
        selectors:
          - k8s_psat:namespace:default
          - k8s_psat:service_account_name:default
          - spire_identity_exchange:stack:name:k8s_psat   # only issuable via this stack

Parameters

Chart parameters

Name	Description	Value
agentSocketName	The name of the spire-agent unix socket	spire-agent.sock
csiDriverName	The csi driver to use	csi.spiffe.io
replicaCount	Replica count	1
namespaceOverride	Namespace override	""
annotations	Annotations for the deployment	{}
labels	Labels for the deployment	{}
image.registry	The OCI registry to pull the image from	ghcr.io
image.repository	The repository within the registry	spiffe/spire-identity-exchange-server
image.pullPolicy	The image pull policy	IfNotPresent
image.tag	Overrides the image tag whose default is the chart appVersion	""
spireAgent.resources	Resource requests and limits	{}
spireAgent.image.registry	The OCI registry to pull the image from	ghcr.io
spireAgent.image.repository	The repository within the registry	spiffe/spire-agent
spireAgent.image.pullPolicy	The image pull policy	IfNotPresent
spireAgent.image.tag	Overrides the image tag whose default is the chart appVersion	1.15.3
extraEnv	Extra environment variables to add to the spire identity exchange	[]
resources	Resource requests and limits	{}
configMap.annotations	Annotations to add to the SPIRE Identity Exchange ConfigMap	{}
podSecurityContext	Pod security context for SPIRE Identity Exchange pods	{}
securityContext	Security context for SPIRE Identity Exchange deployment	{}
readinessProbe.initialDelaySeconds	Initial delay seconds for readinessProbe	5
readinessProbe.periodSeconds	Period seconds for readinessProbe	5
livenessProbe.initialDelaySeconds	Initial delay seconds for livenessProbe	5
livenessProbe.periodSeconds	Period seconds for livenessProbe	5
podAnnotations	Pod annotations for SPIRE Identity Exchange	{}
podLabels	Labels to add to pods	{}
config.logLevel	The log level, valid values are "debug", "info", "warn", and "error"	info
config.logFormat	The log format, valid values are "text" and "json"	text
telemetry.prometheus.port	Port for prometheus metrics	4950
telemetry.prometheus.podMonitor.enabled	Enable podMonitor for prometheus	false
telemetry.prometheus.podMonitor.namespace	Override where to install the podMonitor, if not set will use the same namespace as the helm release	""
telemetry.prometheus.podMonitor.labels	Pod labels to filter for prometheus monitoring	{}
imagePullSecrets	Image pull secret names	[]
nameOverride	Name override	""
fullnameOverride	Full name override	""
serviceAccount.create	Specifies whether a service account should be created	true
serviceAccount.annotations	Annotations to add to the service account	{}
serviceAccount.name	The name of the service account to use. If not set and create is true, a name is generated.	""
deleteHook.enabled	Enable Helm hooks to autofix common delete issues (should be disabled when using helm template)	true
autoscaling.enabled	Flag to enable autoscaling	false
autoscaling.minReplicas	Minimum replicas for autoscaling	1
autoscaling.maxReplicas	Maximum replicas for autoscaling	5
autoscaling.targetCPUUtilizationPercentage	Target CPU utlization that triggers autoscaling	80
autoscaling.targetMemoryUtilizationPercentage	Target Memory utlization that triggers autoscaling	80
nodeSelector	Node selector	{}
tolerations	list of tolerations	[]
affinity	Node affinity	{}
trustDomain	Set the trust domain to be used for the SPIFFE identifiers	example.org
clusterName	The name of this Kubernetes cluster, as it appears in SPIFFE ID paths	example-cluster
jwtIssuer	The issuer URL for JWT-SVIDs. Defaults to https://oidc-discovery.$trustDomain	""
clusterDomain	The name of the Kubernetes cluster (kubeadm init --service-dns-domain)	cluster.local
auth.plugins.k8s_psat.enabled	Enable the k8s psat plugin	true
auth.plugins.k8s_psat.config.audiences	The audiences to allow	[]
auth.plugins.k8s_psat.config.allowedServiceAccounts	The service accounts that are allowed	[]
auth.plugins.spiffe.enabled	Enable the spiffe plugin	true
auth.plugins.spiffe.keySource	What source to use to fetch the keys. Can be oidc or oidcLocal. oidcLocal forces discoveryURL to be the internal discovery address.	oidcLocal
auth.plugins.spiffe.csiDriverName	The CSI driver providing the SPIRE Agent workload socket this plugin attests against. Defaults to the chart level csiDriverName. Requires config.connectWithTrustBundle.
auth.plugins.spiffe.config.issuerURL	The url to connect to for JWKS discovery	${SPIFFE_JWT_ISSUER}
auth.plugins.spiffe.config.trustDomain	The trust domain to use	${SPIFFE_TRUST_DOMAIN}
auth.plugins.spiffe.config.pathPatterns	The service accounts that are allowed	[]
auth.plugins.spiffe.config.audiences	The audiences to allow	[]
auth.plugins.spiffe.config.connectWithTrustBundle	Use the trust bundle to validate the issuerURL	true
auth.stacks.image_pull.enabled	Enable the image_pull stack	true
auth.stacks.image_pull.plugins	List of plugins that are required by this stack	[]
auth.unsupportedBuiltInPlugins	Unsupported mechanism to use plugins not yet supported by the chart.	{}
auth.passthroughPlugins	Address each plugin as a stack of its own, in addition to any stacks defined	false
tls.externalSecret.enabled	Provide your own certificate/key via tls style Kubernetes Secret	false
tls.externalSecret.secretName	Specify which Secret to use	""
tls.certManager.enabled	Use certificateManager to create the certificate	false
tls.certManager.issuer.create	Create an issuer to use to issue the certificate	true
tls.certManager.issuer.acme.email	Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service	""
tls.certManager.issuer.acme.server	Server to use to get certificate. Defaults to LetsEncrypt	https://acme-v02.api.letsencrypt.org/directory
tls.certManager.issuer.acme.solvers	Configure the issuer solvers. Defaults to http01 via ingress.	{}
tls.certManager.certificate.dnsNames	Override the dnsNames on the certificate request. Defaults to the same settings as Ingress	[]
tls.certManager.certificate.issuerRef.group	If you are using an external plugin, specify the group for it here	""
tls.certManager.certificate.issuerRef.kind	Kind of the issuer reference. Override if you want to use a ClusterIssuer	Issuer
tls.certManager.certificate.issuerRef.name	Name of the issuer to use. If unset, it will use the name of the built in issuer	""
tls.rest.enabled	Enable the REST listener served with the certificate from disk	false
tls.rest.port	Container port for the REST listener served with the certificate from disk	8444
tls.rest.service.type	Service type	ClusterIP
tls.rest.service.port	port for the service	443
tls.rest.service.annotations	Annotations for service resource	{}
tls.rest.service.loadBalancerIP	IP address to assign to load balancer (if supported)	""
tls.rest.ingress.enabled	Flag to enable ingress	false
tls.rest.ingress.className	Ingress class name	""
tls.rest.ingress.controllerType	Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].	""
tls.rest.ingress.annotations	Annotations for ingress object	{}
tls.rest.ingress.host	Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.	spire-identity-exchange-rest
tls.rest.ingress.tlsSecret	Secret that has the certs. If blank will use default certs. Used with host var.	""
tls.rest.ingress.hosts	Host paths for ingress object. If emtpy, rules will be built based on the host var.	[]
tls.rest.ingress.tls	Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.	[]
tls.rest.gatewayAPI.enabled	Flag to expose the endpoint via Gateway API	false
tls.rest.gatewayAPI.host	Host name for the route. If no '.' in host, trustDomain is automatically appended.	spire-identity-exchange-rest
tls.rest.gatewayAPI.tlsSecret	Secret with the TLS cert for edge termination. Blank keeps passthrough.	""
tls.rest.gatewayAPI.annotations	Annotations for the route (and its ListenerSet)	{}
tls.rest.gatewayAPI.listenerSet.enabled	Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.	nil
tls.rest.gatewayAPI.parentRefs	parentRefs used when ListenerSet management is disabled (direct attach)	[]
tls.rest.gatewayAPI.sectionName	Listener sectionName override when attaching directly to a Gateway	""
tls.rest.gatewayAPI.backendTLS.caCertificateRefs	ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap.	[]
tls.grpc.enabled	Enable the gRPC listener served with the certificate from disk	false
tls.grpc.port	Container port for the gRPC listener served with the certificate from disk	8443
tls.grpc.service.type	Service type	ClusterIP
tls.grpc.service.port	port for the service	443
tls.grpc.service.annotations	Annotations for service resource	{}
tls.grpc.service.loadBalancerIP	IP address to assign to load balancer (if supported)	""
tls.grpc.ingress.enabled	Flag to enable ingress	false
tls.grpc.ingress.className	Ingress class name	""
tls.grpc.ingress.controllerType	Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].	""
tls.grpc.ingress.annotations	Annotations for ingress object	{}
tls.grpc.ingress.host	Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The grpc of the rules will be autogenerated. For more customizability, use hosts[] instead.	spire-identity-exchange-grpc
tls.grpc.ingress.tlsSecret	Secret that has the certs. If blank will use default certs. Used with host var.	""
tls.grpc.ingress.hosts	Host paths for ingress object. If emtpy, rules will be built based on the host var.	[]
tls.grpc.ingress.tls	Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.	[]
tls.grpc.gatewayAPI.enabled	Flag to expose the endpoint via Gateway API	false
tls.grpc.gatewayAPI.host	Host name for the route. If no '.' in host, trustDomain is automatically appended.	spire-identity-exchange-grpc
tls.grpc.gatewayAPI.tlsSecret	Secret with the TLS cert for edge termination. Blank keeps passthrough.	""
tls.grpc.gatewayAPI.annotations	Annotations for the route (and its ListenerSet)	{}
tls.grpc.gatewayAPI.listenerSet.enabled	Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.	nil
tls.grpc.gatewayAPI.parentRefs	parentRefs used when ListenerSet management is disabled (direct attach)	[]
tls.grpc.gatewayAPI.sectionName	Listener sectionName override when attaching directly to a Gateway	""
tls.grpc.gatewayAPI.backendTLS.caCertificateRefs	ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap.	[]
spiffe.rest.enabled	Enable the REST listener served with this deployment's own X509-SVID	true
spiffe.rest.port	Container port for the REST listener served with this deployment's own X509-SVID	8544
spiffe.rest.service.type	Service type	ClusterIP
spiffe.rest.service.port	port for the service	443
spiffe.rest.service.annotations	Annotations for service resource	{}
spiffe.rest.service.loadBalancerIP	IP address to assign to load balancer (if supported)	""
spiffe.rest.ingress.enabled	Flag to enable ingress	false
spiffe.rest.ingress.className	Ingress class name	""
spiffe.rest.ingress.controllerType	Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].	""
spiffe.rest.ingress.annotations	Annotations for ingress object	{}
spiffe.rest.ingress.host	Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.	spire-identity-exchange-rest-spiffe
spiffe.rest.ingress.tlsSecret	Secret that has the certs. If blank will use default certs. Used with host var.	""
spiffe.rest.ingress.hosts	Host paths for ingress object. If emtpy, rules will be built based on the host var.	[]
spiffe.rest.ingress.tls	Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.	[]
spiffe.rest.gatewayAPI.enabled	Flag to expose the endpoint via Gateway API	false
spiffe.rest.gatewayAPI.host	Host name for the route. If no '.' in host, trustDomain is automatically appended.	spire-identity-exchange-rest-spiffe
spiffe.rest.gatewayAPI.annotations	Annotations for the route (and its ListenerSet)	{}
spiffe.rest.gatewayAPI.listenerSet.enabled	Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.	nil
spiffe.rest.gatewayAPI.parentRefs	parentRefs used when ListenerSet management is disabled (direct attach)	[]
spiffe.rest.gatewayAPI.sectionName	Listener sectionName override when attaching directly to a Gateway	""
spiffe.grpc.enabled	Enable the gRPC listener served with this deployment's own X509-SVID	false
spiffe.grpc.port	Container port for the gRPC listener served with this deployment's own X509-SVID	8543
spiffe.grpc.service.type	Service type	ClusterIP
spiffe.grpc.service.port	port for the service	443
spiffe.grpc.service.annotations	Annotations for service resource	{}
spiffe.grpc.service.loadBalancerIP	IP address to assign to load balancer (if supported)	""
spiffe.grpc.ingress.enabled	Flag to enable ingress	false
spiffe.grpc.ingress.className	Ingress class name	""
spiffe.grpc.ingress.controllerType	Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].	""
spiffe.grpc.ingress.annotations	Annotations for ingress object	{}
spiffe.grpc.ingress.host	Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The grpc of the rules will be autogenerated. For more customizability, use hosts[] instead.	spire-identity-exchange-grpc-spiffe
spiffe.grpc.ingress.tlsSecret	Secret that has the certs. If blank will use default certs. Used with host var.	""
spiffe.grpc.ingress.hosts	Host paths for ingress object. If emtpy, rules will be built based on the host var.	[]
spiffe.grpc.ingress.tls	Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.	[]
spiffe.grpc.gatewayAPI.enabled	Flag to expose the endpoint via Gateway API	false
spiffe.grpc.gatewayAPI.host	Host name for the route. If no '.' in host, trustDomain is automatically appended.	spire-identity-exchange-grpc-spiffe
spiffe.grpc.gatewayAPI.annotations	Annotations for the route (and its ListenerSet)	{}
spiffe.grpc.gatewayAPI.listenerSet.enabled	Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.	nil
spiffe.grpc.gatewayAPI.parentRefs	parentRefs used when ListenerSet management is disabled (direct attach)	[]
spiffe.grpc.gatewayAPI.sectionName	Listener sectionName override when attaching directly to a Gateway	""
tools.kubectl.image.registry	The OCI registry to pull the image from	registry.k8s.io
tools.kubectl.image.repository	The repository within the registry	kubectl
tools.kubectl.image.pullPolicy	The image pull policy	IfNotPresent
tools.kubectl.image.tag	Overrides the image tag whose default is the chart appVersion	""
clusterRole.create	create a k8s cluster role to allow access to token reviews and oidc discovery	true
server.address	Address for Spire server	""
server.port	Port number for Spire server	443
server.namespaceOverride	Override the namespace for Spire server	""
server.nameOverride	Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align.	""