helm-charts-hardened/charts/spire/charts/spire-server/values.yaml

# Default values for spire-server.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

# -- SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database.
replicaCount: 1

image:
  # -- The OCI registry to pull the image from
  registry: ghcr.io
  # -- The repository within the registry
  repository: spiffe/spire-server
  # -- The image pull policy
  pullPolicy: IfNotPresent
  # -- Overrides the image tag whose default is the chart appVersion.
  tag: ""

imagePullSecrets: []
nameOverride: ""
namespaceOverride: ""
fullnameOverride: ""

serviceAccount:
  # -- Specifies whether a service account should be created
  create: true
  # -- Annotations to add to the service account
  annotations: {}
  # -- The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: ""

podAnnotations: {}

podSecurityContext: {}
  # fsGroup: 2000

securityContext: {}
  # capabilities:
  #   drop:
  #   - ALL
  # readOnlyRootFilesystem: true
  # runAsNonRoot: true
  # runAsUser: 1000

service:
  type: ClusterIP
  port: 8081
  annotations: {}

configMap:
  # -- Annotations to add to the SPIRE Server ConfigMap
  annotations: {}

resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # requests:
  #   cpu: 200m
  #   memory: 256Mi
  # limits:
  #   cpu: 200m
  #   memory: 256Mi

autoscaling:
  enabled: false
  minReplicas: 1
  maxReplicas: 100
  targetCPUUtilizationPercentage: 80
  # targetMemoryUtilizationPercentage: 80

# -- Select specific nodes to run on (currently only amd64 is supported by Tornjak)
nodeSelector: {}

tolerations: []

affinity: {}

topologySpreadConstraints: []

persistence:
  size: 1Gi
  accessMode: ReadWriteOnce
  storageClass: null

dataStore:
  sql:
    # -- Other supported databases are "postgres" and "mysql"
    databaseType: sqlite3
    # -- Only used by "postgres" or "mysql"
    databaseName: spire
    # -- Only used by "postgres" or "mysql"
    host: ""
    # -- If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases.
    port: 0
    # -- Only used by "postgres" or "mysql"
    username: spire
    # -- Only used by "postgres" or "mysql"
    password: ""
    # -- Only used by "postgres" or "mysql"
    options: []

    # -- Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section
    plugin_data: {}

# -- The log level, valid values are "debug", "info", "warn", and "error"
logLevel: info
# -- The JWT issuer domain
jwtIssuer: oidc-discovery.example.org

# -- Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`)
clusterName: example-cluster
# -- Set the trust domain to be used for the SPIFFE identifiers
trustDomain: example.org

bundleConfigMap: spire-bundle

# -- This is the value of your clusters `kubeadm init --service-dns-domain` flag
clusterDomain: cluster.local

federation:
  enabled: false
  bundleEndpoint:
    port: 8443
    address: "0.0.0.0"

ca_subject:
  country: NL
  organization: Example
  common_name: example.org

upstreamAuthority:
  disk:
    enabled: false
    secret:
      # -- If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself.
      create: true
      # -- If secret creation is disabled, the secret with this name will be used.
      name: "spiffe-upstream-ca"
      # -- If secret creation is enabled, will create a secret with following certificate info
      data:
        certificate: ""
        key: ""
        bundle: ""
  certManager:
    enabled: false
    rbac:
      create: true
    issuer_name: "spire-ca"
    issuer_kind: "Issuer"
    issuer_group: "cert-manager.io"
    # -- Specify to use a namespace other then the one the chart is installed into
    namespace: ""
    kube_config_file: ""

notifier:
  k8sbundle:
    # -- Namespace to push the bundle into, if blank will default to SPIRE Server namespace
    namespace: ""

controllerManager:
  enabled: false

  image:
    # -- The OCI registry to pull the image from
    registry: ghcr.io
    # -- The repository within the registry
    repository: spiffe/spire-controller-manager
    # -- The image pull policy
    pullPolicy: IfNotPresent
    # Overrides the image tag whose default is the chart appVersion.
    tag: "0.2.2"

  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # limits:
    #   cpu: 100m
    #   memory: 128Mi
    # requests:
    #   cpu: 100m
    #   memory: 128Mi

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  service:
    type: ClusterIP
    port: 443
    annotations: {}

  configMap:
    # -- Annotations to add to the Controller Manager ConfigMap
    annotations: {}

  ignoreNamespaces:
    - kube-system
    - kube-public
    - local-path-storage

  identities:
    enabled: true

    spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
    podSelector: {}
      # matchLabels:
      #   spiffe.io/spiffe-id: "true"
    namespaceSelector: {}
      # matchLabels:
      #   spiffe.io/spiffe-id: "true"
    dnsNameTemplates: []
      # - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local'

  validatingWebhookConfiguration:
    failurePolicy: Fail
    upgradeHook:
      image:
        # -- The OCI registry to pull the image from
        registry: docker.io
        # -- The repository within the registry
        repository: rancher/kubectl
        # -- The image pull policy
        pullPolicy: IfNotPresent
        tag: latest

telemetry:
  prometheus:
    enabled: false
    podMonitor:
      enabled: false
      # -- Override where to install the podMonitor, if not set will use the same namespace as the spire-server
      namespace: ""
      labels: {}

extraVolumes: []
extraVolumeMounts: []
extraContainers: []

initContainers: []

# -- The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA.  EC cryptography is not supported)
caKeyType: rsa-2048
caTTL: 24h
defaultX509SvidTTL: 4h
defaultJwtSvidTTL: 1h

nodeAttestor:
  k8sPsat:
    enabled: true
    serviceAccountAllowList: []

# tornjak - Tornjak specific configuration
tornjak:
  # -- Deploys Tornjak API (backend)
  enabled: false
  # -- Tornjak API image
  image:
    registry: ghcr.io
    repository: spiffe/tornjak-backend
    pullPolicy: IfNotPresent
    # -- Overrides the image tag whose default is the chart appVersion.
    version: "v1.2.0"
  service:
    type: ClusterIP
    port: 10000
    annotations: {}
  config:
    # -- persistent DB for storing Tornjak specific information
    dataStore:
      driver: "sqlite3"
      file: "/run/spire/data/tornjak.sqlite3"
  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # limits:
    #   cpu: 100m
    #   memory: 128Mi
    # requests:
    #   cpu: 100m
    #   memory: 128Mi