46 lines
1.1 KiB
YAML
46 lines
1.1 KiB
YAML
global:
|
|
spire:
|
|
clusterName: production
|
|
trustDomain: production.other
|
|
|
|
spire-server:
|
|
controllerManager:
|
|
identities:
|
|
clusterSPIFFEIDs:
|
|
default:
|
|
type: raw
|
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/k8s/{{ .ClusterName }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
|
namespaceSelector:
|
|
matchExpressions:
|
|
- key: "kubernetes.io/metadata.name"
|
|
operator: In
|
|
values: [spire-server]
|
|
podSelector:
|
|
matchLabels:
|
|
release: spire
|
|
release-namespace: spire-server
|
|
component: server
|
|
downstream: true
|
|
oidc-discovery-provider:
|
|
enabled: false
|
|
test-keys:
|
|
enabled: false
|
|
nodeAttestor:
|
|
k8sPsat:
|
|
serviceAccountAllowList:
|
|
- spire-system:spire-agent-upstream
|
|
bundleConfigMap: spire-bundle-upstream
|
|
notifier:
|
|
k8sbundle:
|
|
namespace: spire-system
|
|
|
|
spiffe-oidc-discovery-provider:
|
|
enabled: false
|
|
|
|
spire-agent:
|
|
enabled: false
|
|
|
|
spiffe-csi-driver:
|
|
enabled: false
|
|
|