sabsariandClaude Opus 4.8
c638121997
Render Gateway spec.infrastructure (labels/annotations) so Gateway API
controllers propagate the metadata onto the provisioned Service/Deployment,
e.g. AWS internal NLB annotations. Purely additive: guarded by `with`, so
the default {} renders no change.
- spire-lib: toYaml passthrough in the shared Gateway helper
- spire, spire-nested: add the values param; regenerate READMEs
- tests/unit: cover the positive passthrough case
Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
291 lines
13 KiB
YAML
291 lines
13 KiB
YAML
# Default configuration for Spire chart
|
|
# SPDX-License-Identifier: APACHE-2.0
|
|
|
|
## @section Global parameters
|
|
## Note: the parameter values specified here will override the chart level values for these parameters.
|
|
##
|
|
global:
|
|
## @param global.imagePullSecrets [array] Image pull secret names
|
|
imagePullSecrets: []
|
|
|
|
k8s:
|
|
## @param global.k8s.clusterDomain Cluster domain name configured for Spire install
|
|
clusterDomain: cluster.local
|
|
|
|
spire:
|
|
## @param global.spire.bundleConfigMap A configmap containing the Spire bundle
|
|
bundleConfigMap: ""
|
|
## @param global.spire.clusterName The name of the k8s cluster for Spire install
|
|
clusterName: example-cluster
|
|
## @param global.spire.jwtIssuer Issuer URL used for both the JWT-SVID `iss` claim minted by spire-server and the `issuer` field advertised by the OIDC discovery document. Defaults to oidc-discovery.$trustDomain if unset
|
|
jwtIssuer: ""
|
|
## @param global.spire.trustDomain The trust domain for Spire install
|
|
trustDomain: example.org
|
|
## @param global.spire.upstreamServerAddress Set what address to use for the upstream server when using nested spire
|
|
upstreamServerAddress: ""
|
|
|
|
## @param global.spire.caSubject.country Country for Spire server CA
|
|
## @param global.spire.caSubject.organization Organization for Spire server CA
|
|
## @param global.spire.caSubject.commonName Common Name for Spire server CA
|
|
caSubject:
|
|
country: ""
|
|
organization: ""
|
|
commonName: ""
|
|
|
|
persistence:
|
|
## @param global.spire.persistence.storageClass What storage class to use for persistence
|
|
storageClass: null
|
|
|
|
## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off.
|
|
## @param global.spire.recommendations.namespaceLayout Set to true to use recommended values for installing across namespaces
|
|
## @param global.spire.recommendations.namespacePSS When chart namespace creation is enabled, label them with preffered Pod Security Standard labels
|
|
## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names
|
|
## @param global.spire.recommendations.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
|
|
## @param global.spire.recommendations.securityContexts Set to true to use recommended values for Pod and Container Security Contexts
|
|
## @param global.spire.recommendations.prometheus Enable prometheus exporters for monitoring
|
|
recommendations:
|
|
enabled: false
|
|
namespaceLayout: true
|
|
namespacePSS: true
|
|
priorityClassName: true
|
|
strictMode: true
|
|
securityContexts: true
|
|
prometheus: true
|
|
|
|
image:
|
|
## @param global.spire.image.registry Override all Spire image registries at once
|
|
registry: ""
|
|
|
|
namespaces:
|
|
## @param global.spire.namespaces.create Set to true to Create all namespaces. If this or either of the namespace specific create flags is set, the namespace will be created.
|
|
create: false
|
|
system:
|
|
## @param global.spire.namespaces.system.name Name of the Spire system Namespace.
|
|
name: "spire-system"
|
|
## @param global.spire.namespaces.system.create Create a Namespace for Spire system resources.
|
|
create: false
|
|
## @param global.spire.namespaces.system.annotations [object] Annotations to apply to the Spire system Namespace.
|
|
annotations: {}
|
|
## @param global.spire.namespaces.system.labels [object] Labels to apply to the Spire system Namespace.
|
|
labels: {}
|
|
server:
|
|
## @param global.spire.namespaces.server.name Name of the Spire server Namespace.
|
|
name: "spire-server"
|
|
## @param global.spire.namespaces.server.create Create a Namespace for Spire server resources.
|
|
create: false
|
|
## @param global.spire.namespaces.server.annotations [object] Annotations to apply to the Spire server Namespace.
|
|
annotations: {}
|
|
## @param global.spire.namespaces.server.labels [object] Labels to apply to the Spire server Namespace.
|
|
labels: {}
|
|
|
|
## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
|
|
strictMode: false
|
|
|
|
## @param global.spire.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
|
ingressControllerType: ""
|
|
|
|
## Gateway API reference settings shared across charts. Only the values needed
|
|
## by other charts to attach their routes/ListenerSets to the shared Gateway
|
|
## live here; the Gateway object itself is configured under the top-level
|
|
## `gatewayAPI.gateway` block of this (umbrella) chart. Gateway API support is
|
|
## independent of ingress and can be enabled alongside it.
|
|
gatewayAPI:
|
|
## @param global.spire.gatewayAPI.manageListenerSets Default policy for whether services render a ListenerSet for their SNI listener. Each service may override via its gatewayAPI.listenerSet.enabled.
|
|
manageListenerSets: true
|
|
gateway:
|
|
## @param global.spire.gatewayAPI.gateway.name Name of the shared Gateway object that routes and ListenerSets attach to
|
|
name: spire
|
|
## @param global.spire.gatewayAPI.gateway.namespace Namespace of the shared Gateway object. Defaults to the release namespace if blank.
|
|
namespace: ""
|
|
## @param global.spire.gatewayAPI.gateway.port Port the shared Gateway listens on. ListenerSet listeners must match this.
|
|
port: 443
|
|
|
|
tools:
|
|
kubectl:
|
|
## @param global.spire.tools.kubectl.tag Set to force the tag to use for all kubectl instances
|
|
tag: ""
|
|
|
|
installAndUpgradeHooks:
|
|
## @param global.installAndUpgradeHooks.enabled Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`)
|
|
enabled: true
|
|
## @param global.installAndUpgradeHooks.resources [object] Resource requests and limits for installAndUpgradeHooks
|
|
resources: {}
|
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
|
# choice for the user. This also increases chances charts run on environments with little
|
|
# resources, such as Minikube. If you do want to specify resources, copy the following
|
|
# to your values file and edit as needed.
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
deleteHooks:
|
|
## @param global.deleteHooks.enabled Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`)
|
|
enabled: true
|
|
## @param global.deleteHooks.resources [object] Resource requests and limits for deleteHooks
|
|
resources: {}
|
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
|
# choice for the user. This also increases chances charts run on environments with little
|
|
# resources, such as Minikube. If you do want to specify resources, copy the following
|
|
# to your values file and edit as needed.
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
|
|
# telemetry:
|
|
# prometheus:
|
|
# enabled: true
|
|
# podMonitor:
|
|
# enabled: true
|
|
# # -- Allows to install the PodMonitor in another namespace then the spire components are installed into.
|
|
# namespace: "kube-prometheus-system"
|
|
# labels: {}
|
|
|
|
## @section Gateway API parameters
|
|
## Configuration for the optional shared Gateway object managed by this umbrella
|
|
## chart. The Gateway is rendered here (rather than in a subchart) so it exists
|
|
## even when spire-server is disabled. name/namespace/port come from
|
|
## global.spire.gatewayAPI.gateway; className and listener policy are local.
|
|
##
|
|
gatewayAPI:
|
|
gateway:
|
|
## @param gatewayAPI.gateway.enabled Render the shared Gateway object
|
|
enabled: false
|
|
## @param gatewayAPI.gateway.className gatewayClassName for the shared Gateway (e.g. "eg"). Required when enabled.
|
|
className: ""
|
|
## @param gatewayAPI.gateway.annotations [object] Annotations for the Gateway object
|
|
annotations: {}
|
|
## @param gatewayAPI.gateway.infrastructure [object] Metadata (labels/annotations) propagated to the provisioned Gateway Service/Deployment. Use for cloud LB annotations, e.g. internal NLB.
|
|
infrastructure: {}
|
|
## @param gatewayAPI.gateway.allowedListenersNamespaces From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector.
|
|
allowedListenersNamespaces: All
|
|
## @param gatewayAPI.gateway.allowedRoutesNamespaces From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector.
|
|
allowedRoutesNamespaces: All
|
|
## @param gatewayAPI.gateway.extraListeners [array] Additional listeners to add to the Gateway
|
|
extraListeners: []
|
|
|
|
## subcharts
|
|
|
|
## @section Spire server parameters
|
|
## Parameter values for Spire server
|
|
##
|
|
spire-server:
|
|
## @param spire-server.enabled Flag to enable Spire server
|
|
enabled: true
|
|
## @param spire-server.nameOverride Overrides the name of Spire server pods
|
|
nameOverride: server
|
|
## @param spire-server.kind Run spire server as deployment/statefulset. This feature is experimental.
|
|
kind: statefulset
|
|
controllerManager:
|
|
## @param spire-server.controllerManager.enabled Enable controller manager and provision CRD's
|
|
enabled: true
|
|
externalControllerManagers:
|
|
## @param spire-server.externalControllerManagers.enabled Enable external controller manager support
|
|
enabled: true
|
|
|
|
## @section Spire agent parameters
|
|
## Parameter values for Spire agent
|
|
##
|
|
spire-agent:
|
|
## @param spire-agent.enabled Flag to enable Spire agent
|
|
enabled: true
|
|
## @param spire-agent.nameOverride Overrides the name of Spire agent pods
|
|
nameOverride: agent
|
|
|
|
## @section Upstream Spire agent and CSI driver configuration
|
|
## Parameter values enabling upstream spire agent and CSI driver
|
|
##
|
|
upstream:
|
|
## @param upstream.enabled Enable upstream agent and driver for use with nested spire
|
|
enabled: false
|
|
|
|
## @section Upstream Spire agent parameters
|
|
## Parameter values for upstream Spire agent
|
|
##
|
|
upstream-spire-agent:
|
|
## @param upstream-spire-agent.upstream Flag for enabling upstream Spire agent
|
|
upstream: true
|
|
## @param upstream-spire-agent.nameOverride Name override for upstream Spire agent
|
|
nameOverride: agent-upstream
|
|
## @param upstream-spire-agent.bundleConfigMap The configmap name for upstream Spire agent bundle
|
|
bundleConfigMap: spire-bundle-upstream
|
|
## @param upstream-spire-agent.socketPath Socket path where Spire agent socket is mounted
|
|
socketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
|
|
serviceAccount:
|
|
## @param upstream-spire-agent.serviceAccount.name Service account name for upstream Spire agent
|
|
name: spire-agent-upstream
|
|
healthChecks:
|
|
## @param upstream-spire-agent.healthChecks.port Health check port number for upstream Spire agent
|
|
port: 9981
|
|
telemetry:
|
|
prometheus:
|
|
## @param upstream-spire-agent.telemetry.prometheus.port The port where prometheus metrics are available
|
|
port: 9989
|
|
## @param upstream-spire-agent.persistence.hostPath Which path to use on the host when persistence.type = hostPath
|
|
persistence:
|
|
hostPath: /var/lib/spire/k8s/upstream-agent
|
|
|
|
## @section SPIFFE CSI Driver parameters
|
|
## Parameter values for spiffe-csi-driver
|
|
##
|
|
spiffe-csi-driver:
|
|
## @param spiffe-csi-driver.enabled Flag to enable spiffe-csi-driver for the cluster
|
|
enabled: true
|
|
|
|
## @section Upstream SPIFFE CSI Driver parameters
|
|
## Parameter values for upstream spiffe-csi-driver
|
|
##
|
|
upstream-spiffe-csi-driver:
|
|
## @param upstream-spiffe-csi-driver.pluginName The plugin name for configuring upstream Spiffe CSI driver
|
|
pluginName: upstream.csi.spiffe.io
|
|
## @param upstream-spiffe-csi-driver.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
|
|
agentSocketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
|
|
healthChecks:
|
|
## @param upstream-spiffe-csi-driver.healthChecks.port The port where Spiffe CSI driver health checks are exposed
|
|
port: 9810
|
|
|
|
## @section SPIFFE oidc discovery provider parameters
|
|
## Parameter values for spiffe-oidc-discovery-provider
|
|
##
|
|
spiffe-oidc-discovery-provider:
|
|
## @param spiffe-oidc-discovery-provider.enabled Flag to enable spiffe-oidc-discovery-provider for the cluster
|
|
enabled: true
|
|
|
|
## @section Tornjak frontend parameters
|
|
## Parameter values for Tornjak frontend
|
|
##
|
|
tornjak-frontend:
|
|
## @param tornjak-frontend.enabled Enables deployment of Tornjak frontend/UI (Not for production)
|
|
enabled: false
|
|
|
|
## @section SPIKE Keeper parameters
|
|
## Parameter values for SPIKE Keeper
|
|
##
|
|
spike-keeper:
|
|
## @param spike-keeper.enabled Enables deployment of SPIKE Keeper (Not for production)
|
|
enabled: false
|
|
|
|
## @section SPIKE Nexus parameters
|
|
## Parameter values for SPIKE Nexus
|
|
##
|
|
spike-nexus:
|
|
## @param spike-nexus.enabled Enables deployment of SPIKE Nexus (Not for production)
|
|
enabled: false
|
|
|
|
## @section SPIKE Pilot parameters
|
|
## Parameter values for SPIKE Pilot
|
|
##
|
|
spike-pilot:
|
|
## @param spike-pilot.enabled Enables deployment of SPIKE Pilot (Not for production)
|
|
enabled: false
|
|
|
|
spire-identity-exchange:
|
|
## @param spire-identity-exchange.enabled Enables deployment of the SPIRE Identity Exchange (Not for production)
|
|
enabled: false
|
|
## @param spire-identity-exchange.nameOverride Overrides the name of the SPIRE Identity Exchnage
|
|
nameOverride: identity-exchange
|