helm-charts-hardened/charts/spire/charts/spiffe-oidc-discovery-provider/README.md

spiffe-oidc-discovery-provider

A Helm chart to install the SPIFFE OIDC discovery provider.

Homepage: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire

Maintainers

Name	Email	Url
marcofranssen	[email protected]	https://marcofranssen.nl
kfox1111	[email protected]
faisal-memon	[email protected]
edwbuck	[email protected]

Source Code

• https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire

Parameters

Chart parameters

Name	Description	Value
agentSocketName	The name of the spire-agent unix socket	spire-agent.sock
csiDriverName	The csi driver to use	csi.spiffe.io
replicaCount	Replica count	1
namespaceOverride	Namespace override	""
annotations	Annotations for the deployment	{}
image.registry	The OCI registry to pull the image from	ghcr.io
image.repository	The repository within the registry	spiffe/oidc-discovery-provider
image.pullPolicy	The image pull policy	IfNotPresent
image.tag	Overrides the image tag whose default is the chart appVersion	""
spiffeHelper.image.registry	The OCI registry to pull the image from	ghcr.io
spiffeHelper.image.repository	The repository within the registry	spiffe/spiffe-helper
spiffeHelper.image.pullPolicy	The image pull policy	IfNotPresent
spiffeHelper.image.tag	Overrides the image tag whose default is the chart appVersion	nightly@sha256:8cee346ffdcee5c996d394f1c3bb761c2c06834a0e779a78db6dc6a46fd13ae6
spiffeHelper.resources	Resource requests and limits	{}
resources	Resource requests and limits	{}
service.type	Service type	ClusterIP
service.ports.http	Insecure port for the service	80
service.ports.https	Secure port for the service	443
service.annotations	Annotations for service resource	{}
configMap.annotations	Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap	{}
podSecurityContext	Pod security context for OIDC discovery provider pods	{}
securityContext	Security context for OIDC discovery provider deployment	{}
readinessProbe.initialDelaySeconds	Initial delay seconds for readinessProbe	5
readinessProbe.periodSeconds	Period seconds for readinessProbe	5
livenessProbe.initialDelaySeconds	Initial delay seconds for livenessProbe	5
livenessProbe.periodSeconds	Period seconds for livenessProbe	5
podAnnotations	Pod annotations for Spire OIDC discovery provider	{}
tls.spire.enabled	Use spire to secure the oidc-discovery-provider	true
tls.externalSecret.enabled	Provide your own certificate/key via tls style Kubernetes Secret	false
tls.externalSecret.secretName	Specify which Secret to use	""
tls.certManager.enabled	Use certificateManager to create the certificate	false
tls.certManager.issuer.create	Create an issuer to use to issue the certificate	true
tls.certManager.issuer.acme.email	Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service	""
tls.certManager.issuer.acme.server	Server to use to get certificate. Defaults to LetsEncrypt	https://acme-v02.api.letsencrypt.org/directory
tls.certManager.issuer.acme.solvers	Configure the issuer solvers. Defaults to http01 via ingress.	{}
tls.certManager.certificate.dnsNames	Override the dnsNames on the certificate request. Defaults to the same settings as Ingress	[]
tls.certManager.certificate.issuerRef.group	If you are using an external plugin, specify the group for it here	""
tls.certManager.certificate.issuerRef.kind	Kind of the issuer reference. Override if you want to use a ClusterIssuer	Issuer
tls.certManager.certificate.issuerRef.name	Name of the issuer to use. If unset, it will use the name of the built in issuer	""
insecureScheme.nginx.image.registry	The OCI registry to pull the image from. Only used when TLS is disabled.	docker.io
insecureScheme.nginx.image.repository	The repository within the registry. Only used when TLS is disabled.	nginxinc/nginx-unprivileged
insecureScheme.nginx.image.pullPolicy	The image pull policy. Only used when TLS is disabled.	IfNotPresent
insecureScheme.nginx.image.tag	Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled.	1.25.3-alpine
insecureScheme.nginx.resources	Resource requests and limits	{}
jwtIssuer	Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset	""
config.logLevel	The log level, valid values are "debug", "info", "warn", and "error"	info
config.additionalDomains	Add additional domains that can be used for oidc discovery	[]
imagePullSecrets	Image pull secret names	[]
nameOverride	Name override	""
fullnameOverride	Full name override	""
serviceAccount.create	Specifies whether a service account should be created	true
serviceAccount.annotations	Annotations to add to the service account	{}
serviceAccount.name	The name of the service account to use. If not set and create is true, a name is generated.	""
deleteHook.enabled	Enable Helm hooks to autofix common delete issues (should be disabled when using helm template)	true
autoscaling.enabled	Flag to enable autoscaling	false
autoscaling.minReplicas	Minimum replicas for autoscaling	1
autoscaling.maxReplicas	Maximum replicas for autoscaling	5
autoscaling.targetCPUUtilizationPercentage	Target CPU utlization that triggers autoscaling	80
autoscaling.targetMemoryUtilizationPercentage	Target Memory utlization that triggers autoscaling	80
nodeSelector	Node selector	{}
tolerations	iist of tolerations	[]
affinity	Node affinity	{}
trustDomain	Set the trust domain to be used for the SPIFFE identifiers	example.org
clusterDomain	The name of the Kubernetes cluster (kubeadm init --service-dns-domain)	cluster.local
telemetry.prometheus.enabled	Flag to enable prometheus monitoring	false
telemetry.prometheus.port	Port for prometheus metrics	9988
telemetry.prometheus.podMonitor.enabled	Enable podMonitor for prometheus	false
telemetry.prometheus.podMonitor.namespace	Override where to install the podMonitor, if not set will use the same namespace as the helm release	""
telemetry.prometheus.podMonitor.labels	Pod labels to filter for prometheus monitoring	{}
telemetry.prometheus.nginxExporter.image.registry	The OCI registry to pull the image from	docker.io
telemetry.prometheus.nginxExporter.image.repository	The repository within the registry	nginx/nginx-prometheus-exporter
telemetry.prometheus.nginxExporter.image.pullPolicy	The image pull policy	IfNotPresent
telemetry.prometheus.nginxExporter.image.tag	Overrides the image tag whose default is the chart appVersion	1.1.0
telemetry.prometheus.nginxExporter.resources	Resource requests and limits	{}
ingress.enabled	Flag to enable ingress	false
ingress.className	Ingress class name	""
ingress.controllerType	Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].	""
ingress.annotations	Annotations for ingress object	{}
ingress.host	Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.	oidc-discovery
ingress.tlsSecret	Secret that has the certs. If blank will use default certs. Used with host var.	""
ingress.hosts	Host paths for ingress object. If emtpy, rules will be built based on the host var.	[]
ingress.tls	Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.	[]
tests.hostAliases	List of host aliases for testing	[]
tests.tls.enabled	Flag for enabling tls for tests	false
tests.tls.customCA	Custom CA value for tests	""
tests.bash.image.registry	The OCI registry to pull the image from	cgr.dev
tests.bash.image.repository	The repository within the registry	chainguard/bash
tests.bash.image.pullPolicy	The image pull policy	IfNotPresent
tests.bash.image.tag	Overrides the image tag whose default is the chart appVersion	latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f
tests.toolkit.image.registry	The OCI registry to pull the image from	cgr.dev
tests.toolkit.image.repository	The repository within the registry	chainguard/slim-toolkit-debug
tests.toolkit.image.pullPolicy	The image pull policy	IfNotPresent
tests.toolkit.image.tag	Overrides the image tag whose default is the chart appVersion	latest@sha256:41c7d1fcb755339b883b0cf2998c52e77ba2e4fab9347665a54c6ef3e4d97838
tests.step.image.registry	The OCI registry to pull the image from	docker.io
tests.step.image.repository	The repository within the registry	smallstep/step-cli
tests.step.image.pullPolicy	The image pull policy	IfNotPresent
tests.step.image.tag	Overrides the image tag whose default is the chart appVersion	0.25.2
tests.busybox.image.registry	The OCI registry to pull the image from	""
tests.busybox.image.repository	The repository within the registry	busybox
tests.busybox.image.pullPolicy	The image pull policy	IfNotPresent
tests.busybox.image.tag	Overrides the image tag whose default is the chart appVersion	1.36.1-uclibc
tests.agent.image.registry	The OCI registry to pull the image from	ghcr.io
tests.agent.image.repository	The repository within the registry	spiffe/spire-agent
tests.agent.image.pullPolicy	The image pull policy	IfNotPresent
tests.agent.image.tag	Overrides the image tag whose default is the chart appVersion	""
tools.kubectl.image.registry	The OCI registry to pull the image from	docker.io
tools.kubectl.image.repository	The repository within the registry	rancher/kubectl
tools.kubectl.image.pullPolicy	The image pull policy	IfNotPresent
tools.kubectl.image.tag	Overrides the image tag whose default is the chart appVersion	""