panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
f4c7df239e97d08f47f5b75df1bf95a518354cc7
helm-charts-hardened/charts/spire-nested/values.yaml
T
kfox1111andFaisal Memon f4c7df239e Add broker suport to the spire-ha-agent (#884) 
* Add broker suport to the spire-ha-agent

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2026-07-30 13:15:55 -07:00

832 lines
44 KiB
YAML
Raw Blame History

# Default configuration for Spire chart
# SPDX-License-Identifier: APACHE-2.0
## @section Global parameters
## Note: the parameter values specified here will override the chart level values for these parameters.
##
global:
k8s:
## @param global.k8s.clusterDomain Cluster domain name configured for Spire install
clusterDomain: cluster.local
spire:
## @param global.spire.clusterName The name of the k8s cluster for Spire install
clusterName: example-cluster
## @param global.spire.jwtIssuer The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset
jwtIssuer: ""
## @param global.spire.trustDomain The trust domain for Spire install
trustDomain: example.org
## @param global.spire.caSubject.country Country for Spire server CA
## @param global.spire.caSubject.organization Organization for Spire server CA
## @param global.spire.caSubject.commonName Common Name for Spire server CA
caSubject:
country: ""
organization: ""
commonName: ""
## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off.
## @param global.spire.recommendations.namespaceLayout Set to true to use recommended values for installing across namespaces
## @param global.spire.recommendations.namespacePSS When chart namespace creation is enabled, label them with preffered Pod Security Standard labels
## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names
## @param global.spire.recommendations.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
## @param global.spire.recommendations.securityContexts Set to true to use recommended values for Pod and Container Security Contexts
## @param global.spire.recommendations.prometheus Enable prometheus exporters for monitoring
recommendations:
enabled: false
namespaceLayout: true
namespacePSS: true
priorityClassName: true
strictMode: true
securityContexts: true
prometheus: true
image:
## @param global.spire.image.registry Override all Spire image registries at once
registry: ""
namespaces:
## @param global.spire.namespaces.create Set to true to Create all namespaces. If this or either of the namespace specific create flags is set, the namespace will be created.
create: false
system:
## @param global.spire.namespaces.system.name Name of the Spire system Namespace.
name: "spire-system"
## @param global.spire.namespaces.system.create Create a Namespace for Spire system resources.
create: false
## @param global.spire.namespaces.system.annotations [object] Annotations to apply to the Spire system Namespace.
annotations: {}
## @param global.spire.namespaces.system.labels [object] Labels to apply to the Spire system Namespace.
labels: {}
server:
## @param global.spire.namespaces.server.name Name of the Spire server Namespace.
name: "spire-server"
## @param global.spire.namespaces.server.create Create a Namespace for Spire server resources.
create: false
## @param global.spire.namespaces.server.annotations [object] Annotations to apply to the Spire server Namespace.
annotations: {}
## @param global.spire.namespaces.server.labels [object] Labels to apply to the Spire server Namespace.
labels: {}
## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
strictMode: false
## @param global.spire.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
ingressControllerType: ""
tools:
kubectl:
## @param global.spire.tools.kubectl.tag Set to force the tag to use for all kubectl instances
tag: ""
installAndUpgradeHooks:
## @param global.installAndUpgradeHooks.enabled Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`)
enabled: true
deleteHooks:
## @param global.deleteHooks.enabled Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`)
enabled: true
# telemetry:
# prometheus:
# enabled: true
# podMonitor:
# enabled: true
# # -- Allows to install the PodMonitor in another namespace then the spire components are installed into.
# namespace: "kube-prometheus-system"
# labels: {}
tags:
## @param tags.nestedRoot Set the chart architecture to root nested
nestedRoot: false
## @param tags.nestedChildFull Set the chart mode to a child cluster with its own nested server
nestedChildFull: false
## @param tags.nestedChildSecurity Set the chart mode to a child cluster for use with a security cluster
nestedChildSecurity: false
## @param tags.haAgentCommon Set the chart mode to deploy the common portion of a spire-ha-agent setup
haAgentCommon: false
## @param tags.bottomTurtleHAA Setup HA side A for use with a Bottom Turtle architecture
bottomTurtleHAA: false
## @param tags.bottomTurtleHAB Setup HA side B for use with a Bottom Turtle architecture
bottomTurtleHAB: false
## subcharts
## @section Spire agent parameters
## Parameter values for Spire agent
##
# Used with tags [nestedRoot, nestedChildFull]
downstream-spire-agent-full:
# enabled: true
## @param downstream-spire-agent-full.nameOverride Overrides the name of Spire agent pods
nameOverride: agent-downstream
server:
## @param downstream-spire-agent-full.server.nameOverride The name override setting of the internal SPIRE server
nameOverride: internal-server
## @param downstream-spire-agent-full.bundleConfigMap The name of the configmap that contains the downstream bundle
bundleConfigMap: spire-bundle-downstream
## @param downstream-spire-agent-full.persistence.hostPath Which path to use on the host when persistence.type = hostPath
persistence:
hostPath: /var/lib/spire/k8s/downstream-agent
## @section Spire agent parameters
## Parameter values for Spire agent
##
# Used with tags [nestedChildSecurity]
downstream-spire-agent-security:
# enabled: true
## @param downstream-spire-agent-security.nameOverride Overrides the name of Spire agent pods
nameOverride: agent-downstream
## @param downstream-spire-agent-security.bundleConfigMap The name of the configmap that contains the downstream bundle
bundleConfigMap: spire-bundle-upstream
serviceAccount:
## @param downstream-spire-agent-security.serviceAccount.name The name of the service account to use
name: spire-agent-upstream
## @param downstream-spire-agent-security.persistence.hostPath Which path to use on the host when persistence.type = hostPath
persistence:
hostPath: /var/lib/spire/k8s/downstream-agent
## @section Upstream Spire agent parameters
## Parameter values for upstream Spire agent
##
# Used with tags [nestedRoot, nestedChildFull]
upstream-spire-agent:
# enabled: true
## @param upstream-spire-agent.upstream Flag for enabling upstream Spire agent
upstream: true
## @param upstream-spire-agent.nameOverride Name override for upstream Spire agent
nameOverride: agent-upstream
## @param upstream-spire-agent.bundleConfigMap The configmap name for upstream Spire agent bundle
bundleConfigMap: spire-bundle-upstream
## @param upstream-spire-agent.socketPath Socket path where Spire agent socket is mounted
socketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
serviceAccount:
## @param upstream-spire-agent.serviceAccount.name Service account name for upstream Spire agent
name: spire-agent-upstream
healthChecks:
## @param upstream-spire-agent.healthChecks.port Health check port number for upstream Spire agent
port: 9981
telemetry:
prometheus:
## @param upstream-spire-agent.telemetry.prometheus.port The port where prometheus metrics are available
port: 9989
server:
## @param upstream-spire-agent.server.nameOverride The name override setting of the root SPIRE server
nameOverride: root-server
## @param upstream-spire-agent.persistence.hostPath Which path to use on the host when persistence.type = hostPath
persistence:
hostPath: /var/lib/spire/k8s/upstream-agent
## @section SPIFFE CSI Driver parameters
## Parameter values for spiffe-csi-driver
##
# Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity]
downstream-spiffe-csi-driver:
# enabled: true
## @param downstream-spiffe-csi-driver.fullnameOverride Fullname override
fullnameOverride: spiffe-csi-driver-downstream
## @section Upstream SPIFFE CSI Driver parameters
## Parameter values for upstream spiffe-csi-driver
##
# Used with tags [nestedRoot, nestedChildFull]
upstream-spiffe-csi-driver:
# enabled: true
## @param upstream-spiffe-csi-driver.fullnameOverride Fullname override
fullnameOverride: spiffe-csi-driver-upstream
## @param upstream-spiffe-csi-driver.pluginName The plugin name for configuring upstream Spiffe CSI driver
pluginName: upstream.csi.spiffe.io
## @param upstream-spiffe-csi-driver.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
agentSocketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
healthChecks:
## @param upstream-spiffe-csi-driver.healthChecks.port The port where Spiffe CSI driver health checks are exposed
port: 9810
## @section SPIFFE oidc discovery provider parameters
## Parameter values for spiffe-oidc-discovery-provider
##
# Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity, haAgentCommon]
spiffe-oidc-discovery-provider:
# enabled: true
## @param spiffe-oidc-discovery-provider.fullnameOverride Fullname override
fullnameOverride: spiffe-oidc-discovery-provider
## @section Tornjak frontend parameters
## Parameter values for Tornjak frontend
##
tornjak-frontend:
## @param tornjak-frontend.enabled Enables deployment of Tornjak frontend/UI (Not for production)
enabled: false
# Used with tags [nestedRoot]
root-spire-server:
# enabled: true
## @param root-spire-server.nameOverride Name override
nameOverride: root-server
## @param root-spire-server.crNameOverride Custom Resource name override
crNameOverride: root
controllerManager:
## @param root-spire-server.controllerManager.enabled Enable controller manager and provision CRD's
enabled: true
externalControllerManagers:
## @param root-spire-server.controllerManager.externalControllerManagers.enabled Flag to enable external controller managers
enabled: true
validatingWebhookConfiguration:
## @param root-spire-server.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
enabled: false
## @param root-spire-server.controllerManager.className specify to use an explicit class name.
className: spire-mgmt-root-server
identities:
clusterSPIFFEIDs:
child-servers:
## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable child servers
enabled: true
default:
## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable the default cluster spiffe id
enabled: false
oidc-discovery-provider:
## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled Enable the test-keys identity
enabled: false
test-keys:
## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable the test-keys identity
enabled: false
externalControllerManagers:
## @param root-spire-server.externalControllerManagers.enabled Flag to enable external controller managers
enabled: true
nodeAttestor:
k8sPSAT:
## @param root-spire-server.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor
serviceAccountAllowList:
- spire-agent-upstream
## @param root-spire-server.bundleConfigMap The name of the configmap to store the upstream bundle
bundleConfigMap: spire-bundle-upstream
# Used with tags [nestedChildFull]
external-root-spire-server-full:
## @param external-root-spire-server-full.externalServer Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers.
externalServer: true
## @param external-root-spire-server-full.nameOverride Name override
nameOverride: root-server
## @param external-root-spire-server-full.crNameOverride Custom Resource name override
crNameOverride: root
controllerManager:
## @param external-root-spire-server-full.controllerManager.enabled Enable controller manager and provision CRD's
enabled: true
validatingWebhookConfiguration:
## @param external-root-spire-server-full.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
enabled: false
## @param external-root-spire-server-full.controllerManager.className specify to use an explicit class name.
className: spire-mgmt-external-server
identities:
clusterSPIFFEIDs:
child-servers:
## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable child servers
enabled: true
## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.child-servers.labels [object] Default label spire.spiffe.io/child-server is set to enable label-based informer filtering on the root cluster's external controller manager.
labels:
spire.spiffe.io/child-server: "true"
default:
## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable the default cluster spiffe id
enabled: false
oidc-discovery-provider:
## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled Enable the test-keys identity
enabled: false
test-keys:
## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable the test-keys identity
enabled: false
nodeAttestor:
k8sPSAT:
## @param external-root-spire-server-full.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor
serviceAccountAllowList:
- spire-agent-upstream
## @param external-root-spire-server-full.bundleConfigMap The name of the configmap to store the upstream bundle
bundleConfigMap: spire-bundle-upstream
# Used with tags [nestedChildSecurity]
external-root-spire-server-security:
## @param external-root-spire-server-security.externalServer Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers.
externalServer: true
## @param external-root-spire-server-security.nameOverride Name override
nameOverride: root-server
## @param external-root-spire-server-security.crNameOverride Custom Resource name override
crNameOverride: root
controllerManager:
## @param external-root-spire-server-security.controllerManager.enabled Enable controller manager and provision CRD's
enabled: true
validatingWebhookConfiguration:
## @param external-root-spire-server-security.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
enabled: false
## @param external-root-spire-server-security.controllerManager.className specify to use an explicit class name.
className: spire-mgmt-external-server
nodeAttestor:
k8sPSAT:
## @param external-root-spire-server-security.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor
serviceAccountAllowList:
- spire-agent-upstream
## @param external-root-spire-server-security.bundleConfigMap The name of the configmap to store the upstream bundle
bundleConfigMap: spire-bundle-upstream
## @section Spire server parameters
## Parameter values for Spire server
##
# Used with tags [nestedRoot, nestedChildFull]
internal-spire-server:
# enabled: true
## @param internal-spire-server.nameOverride Overrides the name of Spire server pods
nameOverride: internal-server
controllerManager:
## @param internal-spire-server.controllerManager.enabled Enable controller manager and provision CRD's
enabled: true
identities:
clusterSPIFFEIDs:
oidc-discovery-provider:
## @param internal-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames Auto populate dns entries
autoPopulateDNSNames: false
externalControllerManagers:
## @param internal-spire-server.externalControllerManagers.enabled Flag to enable external controller managers
enabled: true
upstreamAuthority:
spire:
## @param internal-spire-server.upstreamAuthority.spire.enabled Enable upstream SPIRE server
enabled: true
## @param internal-spire-server.upstreamAuthority.spire.upstreamDriver Use an upstream driver for authentication
upstreamDriver: upstream.csi.spiffe.io
server:
## @param internal-spire-server.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server
nameOverride: root-server
## @param internal-spire-server.bundleConfigMap The name of the configmap to store the downstream bundle
bundleConfigMap: spire-bundle-downstream
# Used with tags [nestedRoot]
external-spire-server:
# enabled: true
## @param external-spire-server.nameOverride Overrides the name of Spire server pods
nameOverride: external-server
## @param external-spire-server.crNameOverride Custom Resource name override
crNameOverride: external
controllerManager:
## @param external-spire-server.controllerManager.enabled Enable controller manager and provision CRD's
enabled: true
validatingWebhookConfiguration:
## @param external-spire-server.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
enabled: false
## @param external-spire-server.controllerManager.className specify to use an explicit class name.
className: spire-mgmt-external-server
identities:
clusterSPIFFEIDs:
default:
## @param external-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable the default identity
enabled: false
oidc-discovery-provider:
## @param external-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled Enable the oidc-discovery-provider identity
enabled: false
test-keys:
## @param external-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable the test-keys identity
enabled: false
externalControllerManagers:
## @param external-spire-server.externalControllerManagers.enabled Flag to enable external controller managers
enabled: true
upstreamAuthority:
spire:
## @param external-spire-server.upstreamAuthority.spire.enabled Enable upstream SPIRE server
enabled: true
## @param external-spire-server.upstreamAuthority.spire.upstreamDriver Use an upstream driver for authentication
upstreamDriver: upstream.csi.spiffe.io
server:
## @param external-spire-server.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server
nameOverride: root-server
bundlePublisher:
k8sConfigMap:
## @param external-spire-server.bundlePublisher.k8sConfigMap.enabled Enable local k8s bundle uploader
enabled: false
nodeAttestor:
k8sPSAT:
## @param external-spire-server.nodeAttestor.k8sPSAT.enabled Enable PSAT k8s nodeattestor
enabled: false
joinToken:
## @param external-spire-server.nodeAttestor.joinToken.enabled Enable the join_token nodeattestor
enabled: true
# Used with tags [haAgentCommon]
spiffe-csi-driver:
# enabled: true
## @param spiffe-csi-driver.fullnameOverride Fullname override
fullnameOverride: spiffe-csi-driver
## @param spiffe-csi-driver.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
agentSocketPath: /var/run/spire/agent-sockets/spire-agent.sock
healthChecks:
## @param spiffe-csi-driver.healthChecks.port Health check port number for upstream Spire agent
port: 9814
# Used with tags [haAgentCommon]
spire-ha-agent:
# enabled: true
## @param spire-ha-agent.fullnameOverride Fullname override
fullnameOverride: spire-ha-agent
## @section Upstream SPIFFE CSI Driver for Bottom Turtle HA A parameters
## Parameter values for upstream spiffe-csi-driver-bottom-turtle-ha-a
##
# Used with tags [bottomTurtleHAA]
upstream-spiffe-csi-driver-bottom-turtle-ha-a:
# enabled: true
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.fullnameOverride Fullname override
fullnameOverride: spiffe-csi-driver-upstream-a
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.pluginName The plugin name for configuring upstream Spiffe CSI driver
pluginName: upstream-a.csi.spiffe.io
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
agentSocketPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public/spire-agent.sock
healthChecks:
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.healthChecks.port The port where Spiffe CSI driver health checks are exposed
port: 9810
validatingAdmissionPolicy:
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-a.validatingAdmissionPolicy.enabled Flag to enable validating policy
enabled: true
## @section Upstream SPIFFE CSI Driver for Bottom Turtle HA B parameters
## Parameter values for upstream spiffe-csi-driver-bottom-turtle-ha-b
##
# Used with tags [bottomTurtleHAB]
upstream-spiffe-csi-driver-bottom-turtle-ha-b:
# enabled: true
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.fullnameOverride Fullname override
fullnameOverride: spiffe-csi-driver-upstream-b
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.pluginName The plugin name for configuring upstream Spiffe CSI driver
pluginName: upstream-b.csi.spiffe.io
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
agentSocketPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public/spire-agent.sock
healthChecks:
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.healthChecks.port The port where Spiffe CSI driver health checks are exposed
port: 9812
validatingAdmissionPolicy:
## @param upstream-spiffe-csi-driver-bottom-turtle-ha-b.validatingAdmissionPolicy.enabled Flag to enable validating policy
enabled: true
## @section Spire server parameters
## Parameter values for Spire server
##
# Used with tags [bottomTurtleHAA]
internal-spire-server-bottom-turtle-ha-a:
# enabled: true
## @param internal-spire-server-bottom-turtle-ha-a.nameOverride Overrides the name of Spire server pods
nameOverride: internal-server
## @param internal-spire-server-bottom-turtle-ha-a.caKeyType Key type to use for the ca
caKeyType: ec-p256
experimental:
## @param internal-spire-server-bottom-turtle-ha-a.experimental.enabled enable experimental features
enabled: true
## @param internal-spire-server-bottom-turtle-ha-a.experimental.agentSPIFFEIDAsSelector enable adding spiffe_id selectors to all agents
agentSPIFFEIDAsSelector: true
dynamicRegistration:
## @param internal-spire-server-bottom-turtle-ha-a.dynamicRegistration.enabled Enable dynamic registration
enabled: true
## @param internal-spire-server-bottom-turtle-ha-a.dynamicRegistration.allowedIDPrefix The allowed ID prefix
allowedIDPrefix: "spire/agent/x509pop/k8s"
## @param internal-spire-server-bottom-turtle-ha-a.dynamicRegistration.serviceAccount The service account to allow in for dynamic registration
serviceAccount: spire-a-agent
controllerManager:
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.enabled Enable controller manager and provision CRD's
enabled: true
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.parentIDTemplate parent id template
parentIDTemplate: "spiffe://{{ .TrustDomain }}/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"
identities:
clusterSPIFFEIDs:
oidc-discovery-provider:
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames Auto populate dns entries
autoPopulateDNSNames: false
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type The type of the entry
type: oidc-discovery-provider-common
spire-ha-agent:
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled Enables the spire-ha-agent identity
enabled: true
spire-identity-exchange-service:
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.spire-identity-exchange-service.federatesWith [array] List of trust domains to federate with
federatesWith:
- spire-ha
persistence:
## @param internal-spire-server-bottom-turtle-ha-a.persistence.type What type to use for peristence
type: emptyDir
nodeAttestor:
k8sPSAT:
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.k8sPSAT.enabled Enable the k8s projected access token node attestor
enabled: false
x509POP:
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
enabled: true
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.spiffePrefix What prefix to use when mode is spiffe
spiffePrefix: /spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
agentPathTemplate: "/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}"
addClusterName:
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.spiffePrefix Suffix the cluster name onto the spiffePrefix
spiffePrefix: true
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
agentPathTemplate: true
upstreamAuthority:
spire:
## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.enabled Enable upstream SPIRE server
enabled: true
## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.upstreamDriver Use an upstream driver for authentication
upstreamDriver: upstream-a.csi.spiffe.io
server:
## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server
nameOverride: root-server
## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.server.address Address for upstream Spire server
address: "spire-server-a"
## @param internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.server.port The port setting of the root SPIRE server
port: 8081
## @param internal-spire-server-bottom-turtle-ha-a.bundleConfigMap The name of the configmap to store the downstream bundle
bundleConfigMap: spire-server-a-bundle
trustSync:
## @param internal-spire-server-bottom-turtle-ha-a.trustSync.enabled Enable trust syncing
enabled: true
## @param internal-spire-server-bottom-turtle-ha-a.trustSync.domains the trust domains to sync
domains:
- spire-ha
## @section Spire server parameters
## Parameter values for Spire server
##
# Used with tags [bottomTurtleHAB]
internal-spire-server-bottom-turtle-ha-b:
# enabled: true
## @param internal-spire-server-bottom-turtle-ha-b.nameOverride Overrides the name of Spire server pods
nameOverride: internal-server
## @param internal-spire-server-bottom-turtle-ha-b.caKeyType Key type to use for the ca
caKeyType: ec-p256
experimental:
## @param internal-spire-server-bottom-turtle-ha-b.experimental.enabled enable experimental features
enabled: true
## @param internal-spire-server-bottom-turtle-ha-b.experimental.agentSPIFFEIDAsSelector enable adding spiffe_id selectors to all agents
agentSPIFFEIDAsSelector: true
dynamicRegistration:
## @param internal-spire-server-bottom-turtle-ha-b.dynamicRegistration.enabled Enable dynamic registration
enabled: true
## @param internal-spire-server-bottom-turtle-ha-b.dynamicRegistration.allowedIDPrefix The allowed ID prefix
allowedIDPrefix: "spire/agent/x509pop/k8s"
## @param internal-spire-server-bottom-turtle-ha-b.dynamicRegistration.serviceAccount The service account to allow in for dynamic registration
serviceAccount: spire-b-agent
controllerManager:
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.enabled Enable controller manager and provision CRD's
enabled: true
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.parentIDTemplate parent id template
parentIDTemplate: "spiffe://{{ .TrustDomain }}/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}"
identities:
clusterSPIFFEIDs:
oidc-discovery-provider:
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames Auto populate dns entries
autoPopulateDNSNames: false
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type The type of the entry
type: oidc-discovery-provider-common
spire-ha-agent:
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled Enables the spire-ha-agent identity
enabled: true
spire-identity-exchange-service:
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.spire-identity-exchange-service.federatesWith [array] List of trust domains to federate with
federatesWith:
- spire-ha
persistence:
## @param internal-spire-server-bottom-turtle-ha-b.persistence.type What type to use for peristence
type: emptyDir
nodeAttestor:
k8sPSAT:
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.k8sPSAT.enabled Enable the k8s projected access token node attestor
enabled: false
x509POP:
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
enabled: true
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.spiffePrefix What prefix to use when mode is spiffe
spiffePrefix: /spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
agentPathTemplate: "/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}"
addClusterName:
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.spiffePrefix Suffix the cluster name onto the spiffePrefix
spiffePrefix: true
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
agentPathTemplate: true
upstreamAuthority:
spire:
## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.enabled Enable upstream SPIRE server
enabled: true
## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.upstreamDriver Use an upstream driver for authentication
upstreamDriver: upstream-b.csi.spiffe.io
server:
## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server
nameOverride: root-server
## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.address Address for upstream Spire server
address: "spire-server-b"
## @param internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.port The port setting of the root SPIRE server
port: 8081
## @param internal-spire-server-bottom-turtle-ha-b.bundleConfigMap The name of the configmap to store the downstream bundle
bundleConfigMap: spire-server-b-bundle
trustSync:
## @param internal-spire-server-bottom-turtle-ha-b.trustSync.enabled Enable trust syncing
enabled: true
## @param internal-spire-server-bottom-turtle-ha-b.trustSync.domains the trust domains to sync
domains:
- spire-ha
# Used with tags [bottomTurtleHAA]
downstream-spire-agent-bottom-turtle-ha-a:
# enabled: true
## @param downstream-spire-agent-bottom-turtle-ha-a.nameOverride Overrides the name of Spire agent pods
nameOverride: agent-downstream
server:
## @param downstream-spire-agent-bottom-turtle-ha-a.server.nameOverride The name override setting of the internal SPIRE server
nameOverride: internal-server
## @param downstream-spire-agent-bottom-turtle-ha-a.bundleConfigMap The name of the configmap that contains the downstream bundle
bundleConfigMap: spire-server-a-bundle
## @param downstream-spire-agent-bottom-turtle-ha-a.persistence.hostPath Which path to use on the host when persistence.type = hostPath
persistence:
hostPath: /var/lib/spire/k8s/downstream-agent-a
dynamicRegistration:
## @param downstream-spire-agent-bottom-turtle-ha-a.dynamicRegistration.enabled Enable dynamic registration
enabled: true
## @param downstream-spire-agent-bottom-turtle-ha-a.dynamicRegistration.nameOverride The name override to use to contact the server
nameOverride: internal-server
nodeAttestor:
k8sPSAT:
## @param downstream-spire-agent-bottom-turtle-ha-a.nodeAttestor.k8sPSAT.enabled Enable the k8s projected access token node attestor
enabled: false
x509POP:
## @param downstream-spire-agent-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
enabled: true
## @param downstream-spire-agent-bottom-turtle-ha-a.nodeAttestor.x509POP.spiffeEndpointSocket Where the socket is to use for mode spiffe
spiffeEndpointSocket: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public/api.sock
keyManager:
memory:
## @param downstream-spire-agent-bottom-turtle-ha-a.keyManager.memory.enabled Enable the memory based Key Manager
enabled: false
disk:
## @param downstream-spire-agent-bottom-turtle-ha-a.keyManager.disk.enabled Enable the disk key manager
enabled: true
## @param downstream-spire-agent-bottom-turtle-ha-a.keyManager.disk.mode Where the disk plugin will write out its data
mode: emptyDir
healthChecks:
## @param downstream-spire-agent-bottom-turtle-ha-a.healthChecks.port Health check port
port: 9981
telemetry:
prometheus:
## @param downstream-spire-agent-bottom-turtle-ha-a.telemetry.prometheus.port Prometheus port to use
port: 9989
## @param downstream-spire-agent-bottom-turtle-ha-a.socketPath Socket path to use
socketPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
sockets:
## @param downstream-spire-agent-bottom-turtle-ha-a.sockets.hostBasePath Path on the host to place sockets
hostBasePath: /var/run/spire/agent/sockets/a
admin:
## @param downstream-spire-agent-bottom-turtle-ha-a.sockets.admin.enabled Enable admin socket
enabled: true
## @param downstream-spire-agent-bottom-turtle-ha-a.sockets.admin.mountOnHost Mount admin socket on host
mountOnHost: true
## @param downstream-spire-agent-bottom-turtle-ha-a.authorizedDelegates List of workloads able to use the delegation api
authorizedDelegates:
- /spire-ha-agent
brokerAPI:
brokers:
spire-ha-agent:
## @param downstream-spire-agent-bottom-turtle-ha-a.brokerAPI.brokers.spire-ha-agent.enabled Enable the spire-ha-agent by default
enabled: true
workloadAttestors:
k8s:
brokerAPI:
## @param downstream-spire-agent-bottom-turtle-ha-a.workloadAttestors.k8s.brokerAPI.accessPolicy The default accessPolicy
accessPolicy: permissive
brokers:
spire-ha-agent:
## @param downstream-spire-agent-bottom-turtle-ha-a.workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled Enable the spire-ha-agent by default
enabled: true
# Used with tags [bottomTurtleHAB]
downstream-spire-agent-bottom-turtle-ha-b:
# enabled: true
## @param downstream-spire-agent-bottom-turtle-ha-b.nameOverride Overrides the name of Spire agent pods
nameOverride: agent-downstream
server:
## @param downstream-spire-agent-bottom-turtle-ha-b.server.nameOverride The name override setting of the internal SPIRE server
nameOverride: internal-server
## @param downstream-spire-agent-bottom-turtle-ha-b.bundleConfigMap The name of the configmap that contains the downstream bundle
bundleConfigMap: spire-server-b-bundle
## @param downstream-spire-agent-bottom-turtle-ha-b.persistence.hostPath Which path to use on the host when persistence.type = hostPath
persistence:
hostPath: /var/lib/spire/k8s/downstream-agent-b
dynamicRegistration:
## @param downstream-spire-agent-bottom-turtle-ha-b.dynamicRegistration.enabled Enable dynamic registration
enabled: true
## @param downstream-spire-agent-bottom-turtle-ha-b.dynamicRegistration.nameOverride The name override to use to contact the server
nameOverride: internal-server
nodeAttestor:
k8sPSAT:
## @param downstream-spire-agent-bottom-turtle-ha-b.nodeAttestor.k8sPSAT.enabled Enable the k8s projected access token node attestor
enabled: false
x509POP:
## @param downstream-spire-agent-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
enabled: true
## @param downstream-spire-agent-bottom-turtle-ha-b.nodeAttestor.x509POP.spiffeEndpointSocket Where the socket is to use for mode spiffe
spiffeEndpointSocket: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public/api.sock
keyManager:
memory:
## @param downstream-spire-agent-bottom-turtle-ha-b.keyManager.memory.enabled Enable the memory based Key Manager
enabled: false
disk:
## @param downstream-spire-agent-bottom-turtle-ha-b.keyManager.disk.enabled Enable the disk key manager
enabled: true
## @param downstream-spire-agent-bottom-turtle-ha-b.keyManager.disk.mode Where the disk plugin will write out its data
mode: emptyDir
healthChecks:
## @param downstream-spire-agent-bottom-turtle-ha-b.healthChecks.port Health check port
port: 9982
telemetry:
prometheus:
## @param downstream-spire-agent-bottom-turtle-ha-b.telemetry.prometheus.port Prometheus port to use
port: 9990
## @param downstream-spire-agent-bottom-turtle-ha-b.socketPath Socket path to use
socketPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock
sockets:
## @param downstream-spire-agent-bottom-turtle-ha-b.sockets.hostBasePath Path on the host to place sockets
hostBasePath: /var/run/spire/agent/sockets/b
admin:
## @param downstream-spire-agent-bottom-turtle-ha-b.sockets.admin.enabled Enable admin socket
enabled: true
## @param downstream-spire-agent-bottom-turtle-ha-b.sockets.admin.mountOnHost Mount admin socket on host
mountOnHost: true
## @param downstream-spire-agent-bottom-turtle-ha-b.authorizedDelegates List of workloads able to use the delegation api
authorizedDelegates:
- /spire-ha-agent
brokerAPI:
brokers:
spire-ha-agent:
## @param downstream-spire-agent-bottom-turtle-ha-b.brokerAPI.brokers.spire-ha-agent.enabled Enable the spire-ha-agent by default
enabled: true
workloadAttestors:
k8s:
brokerAPI:
## @param downstream-spire-agent-bottom-turtle-ha-b.workloadAttestors.k8s.brokerAPI.accessPolicy The default accessPolicy
accessPolicy: permissive
brokers:
spire-ha-agent:
## @param downstream-spire-agent-bottom-turtle-ha-b.workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled Enable the spire-ha-agent by default
enabled: true
# Used with tags [bottomTurtleHAA]
downstream-spiffe-csi-driver-bottom-turtle-ha-a:
# enabled: true
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-a.fullnameOverride Fullname override
fullnameOverride: spiffe-csi-driver-downstream-a
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-a.agentSocketPath path to agent socket
agentSocketPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-a.pluginName The name of the plugin instance
pluginName: a.csi.spiffe.io
healthChecks:
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-a.healthChecks.port The health check port
port: 9814
# Used with tags [bottomTurtleHAB]
downstream-spiffe-csi-driver-bottom-turtle-ha-b:
# enabled: true
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.fullnameOverride Fullname override
fullnameOverride: spiffe-csi-driver-downstream-b
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.agentSocketPath path to agent socket
agentSocketPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.pluginName The name of the plugin instance
pluginName: b.csi.spiffe.io
healthChecks:
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.healthChecks.port The health check port
port: 9816
spire-identity-exchange-bottom-turtle-ha-a:
## @param spire-identity-exchange-bottom-turtle-ha-a.enabled Enable the spire-identity-exchange
enabled: false
## @param spire-identity-exchange-bottom-turtle-ha-a.nameOverride name override
nameOverride: identity-exchange
## @param spire-identity-exchange-bottom-turtle-ha-a.csiDriverName CSI driver name to use
csiDriverName: a.csi.spiffe.io
rest:
ingress:
## @param spire-identity-exchange-bottom-turtle-ha-a.rest.ingress.host Hostname override for the rest ingress service
host: "spire-identity-exchange-a-rest"
grpc:
ingress:
## @param spire-identity-exchange-bottom-turtle-ha-a.grpc.ingress.host Hostname override for the rest ingress service
host: "spire-identity-exchange-a-grpc"
server:
## @param spire-identity-exchange-bottom-turtle-ha-a.server.nameOverride The name override setting of the internal SPIRE server
nameOverride: internal-server
spire-identity-exchange-bottom-turtle-ha-b:
## @param spire-identity-exchange-bottom-turtle-ha-b.enabled Enable the spire-identity-exchange
enabled: false
## @param spire-identity-exchange-bottom-turtle-ha-b.nameOverride name override
nameOverride: identity-exchange
## @param spire-identity-exchange-bottom-turtle-ha-b.csiDriverName CSI driver name to use
csiDriverName: b.csi.spiffe.io
server:
## @param spire-identity-exchange-bottom-turtle-ha-b.server.nameOverride The name override setting of the internal SPIRE server
nameOverride: internal-server
rest:
ingress:
## @param spire-identity-exchange-bottom-turtle-ha-b.rest.ingress.host Hostname override for the rest ingress service
host: "spire-identity-exchange-b-rest"
grpc:
ingress:
## @param spire-identity-exchange-bottom-turtle-ha-b.grpc.ingress.host Hostname override for the rest ingress service
host: "spire-identity-exchange-b-grpc"
Reference in New Issue View Git Blame Copy Permalink