helm-charts-hardened/charts/spire-ha-agent

spire-ha-agent

A Helm chart to install the SPIRE HA agent.

Homepage: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire

Maintainers

Name	Email	Url
marcofranssen	[email protected]	https://marcofranssen.nl
kfox1111	[email protected]
faisal-memon	[email protected]

Source Code

• https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-ha-agent

Parameters

Chart parameters

Name	Description	Value
image.registry	The OCI registry to pull the image from	ghcr.io
image.repository	The repository within the registry	spiffe/spire-ha-agent
image.pullPolicy	The image pull policy	IfNotPresent
image.tag	Overrides the image tag whose default is the chart appVersion	""
mode	If the spire-ha-agent will run in delegated or broker mode	delegated
trustDomain	The trust domain to be used for the SPIFFE identifiers	example.org
singleSocket	If in singleSocket mode, only one driver is used	false
sockets.single.admin.hostPath	Where the admin socket is on disk when in single socket mode	/var/run/spire/agent/sockets/main/csi.spiffe.io/admin
sockets.a.admin.hostPath	Where the a admin socket is on disk	/var/run/spire/agent/sockets/a/csi.spiffe.io/admin
sockets.b.admin.hostPath	Where the b admin sockets is on disk	/var/run/spire/agent/sockets/b/csi.spiffe.io/admin
sockets.single.broker.hostPath	Where the broker socket is on disk when in single socket mode	/var/run/spire/agent/sockets/main/csi.spiffe.io/broker
sockets.a.broker.hostPath	Where the a broker socket is on disk	/var/run/spire/agent/sockets/a/csi.spiffe.io/broker
sockets.b.broker.hostPath	Where the b broker socket is on disk	/var/run/spire/agent/sockets/b/csi.spiffe.io/broker
sockets.single.workload.hostPath	Where the broker socket is on disk when in single socket mode	/var/run/spire/agent-sockets
sockets.a.workload.hostPath	Where the a workload socket is on disk	/var/run/spire/agent/sockets/a/csi.spiffe.io/public
sockets.b.workload.hostPath	Where the b workload socket is on disk	/var/run/spire/agent/sockets/b/csi.spiffe.io/public
vsock	Use a vsockets to expose the service rather then a unix socket	false
port	Port number to listen on	999
brokerAPI.enabled	Serve the SPIFFE Broker API to downstream consumers. Only supported when mode is broker.	false
brokerAPI.socket.enabled	Serve the broker api on a unix socket	true
brokerAPI.socket.mountOnHost	Make the served broker socket visible on the host, so consumers running in other pods on the node can reach it. When false the socket stays in an emptyDir, reachable only from this pod.	true
brokerAPI.socket.hostPath	Where the served broker socket is made available on the host when mountOnHost is true	/run/spire/agent/sockets/csi.spiffe.io/broker
brokerAPI.tcp.enabled	Serve the broker api over tcp	false
brokerAPI.tcp.bindAddress	The tcp address to bind to	0.0.0.0:8788
brokerAPI.brokers.spiffefs.enabled	Enable spiffefs as a broker. This feature is experimental.	false
brokerAPI.brokers.spiffefs.idTemplate	The default id template	spiffe://{{ .TrustDomain }}/spiffefs
brokerAPI.brokers.spiffefs.allowedReferenceTypes[0].typeURL	The type of reference allowed	type.googleapis.com/spiffe.broker.WorkloadPIDReference
brokerAPI.brokers.spiffefs.allowedReferenceTypes[0].allowOverTCP	Allow access over TCP	false
upstreamKeepalive.time	How often to ping an upstream broker to notice a connection that died silently. 0 disables. Do not lower below 5m: a spire-agent that does not configure a keepalive enforcement policy answers more frequent pings with GOAWAY too_many_pings and drops the connection.	5m
upstreamKeepalive.timeout	How long to wait for a keepalive ping response before considering the connection dead	20s
telemetry.prometheus.enabled	Flag to enable prometheus monitoring	false
telemetry.prometheus.port	Port for prometheus metrics	9988
telemetry.prometheus.host	Host for prometheus metrics	0.0.0.0
telemetry.prometheus.podMonitor.enabled	Enable podMonitor for prometheus	false
telemetry.prometheus.podMonitor.namespace	Override where to install the podMonitor, if not set will use the same namespace as the spire-ha-agent	""
telemetry.prometheus.podMonitor.labels	Pod labels to filter for prometheus monitoring	{}
imagePullSecrets	Pull secrets for images	[]
nameOverride	Name override	""
namespaceOverride	Namespace override	""
fullnameOverride	Fullname override	""
serviceAccount.create	Specifies whether a service account should be created	true
serviceAccount.annotations	Annotations to add to the service account	{}
serviceAccount.name	The name of the service account to use.	""
podAnnotations	Annotations to add to pods	{}
podLabels	Labels to add to pods	{}
podSecurityContext	Pod security context	{}
securityContext	Security context	{}
resources	Resource requests and limits	{}
nodeSelector	Node selector	{}
tolerations	List of tolerations	[]
affinity	Node affinity	{}
updateStrategy.type	The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete.	RollingUpdate
updateStrategy.rollingUpdate.maxUnavailable	Max unavailable pods during update. Can be a number or a percentage.	1
fsGroupFix.image.registry	The OCI registry to pull the image from	cgr.dev
fsGroupFix.image.repository	The repository within the registry	chainguard/bash
fsGroupFix.image.pullPolicy	The image pull policy	Always
fsGroupFix.image.tag	Overrides the image tag whose default is the chart appVersion	latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1
fsGroupFix.resources	Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	{}
cid2PID.image.registry	The OCI registry to pull the image from	ghcr.io
cid2PID.image.repository	The repository within the registry	kfox1111/cid2pid
cid2PID.image.pullPolicy	The image pull policy	Always
cid2PID.image.tag	Overrides the image tag whose default is the chart appVersion	v0.0.3
cid2PID.busybox.image.registry	The OCI registry to pull the image from	docker.io
cid2PID.busybox.image.repository	The repository within the registry	library/busybox
cid2PID.busybox.image.pullPolicy	The image pull policy	IfNotPresent
cid2PID.busybox.image.tag	Overrides the image tag whose default is the chart appVersion	1.36.1-uclibc
cid2PID.busybox.resources	Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	{}
socketPath	The unix socket path to the spire-agent	/run/spire/agent-sockets/spire-agent.sock
socketAlternate.names	List of alternate names for the socket that workloads might expect to be able to access in the driver mount.	["socket","spire-agent.sock","api.sock"]
socketAlternate.image.registry	The OCI registry to pull the image from	cgr.dev
socketAlternate.image.repository	The repository within the registry	chainguard/bash
socketAlternate.image.pullPolicy	The image pull policy	Always
socketAlternate.image.tag	Overrides the image tag whose default is the chart appVersion	latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1
socketAlternate.resources	Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	{}
priorityClassName	Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.	""
extraEnvVars	Extra environment variables to be added to the Spire Agent container	[]
extraVolumes	Extra volumes to be mounted on Spire Agent pods	[]
extraVolumeMounts	Extra volume mounts for Spire Agent pods	[]
extraContainers	Additional containers to create with Spire Agent pods	[]
initContainers	Additional init containers to create with Spire Agent pods	[]
hostAliases	Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/	[]