170 lines
4.5 KiB
YAML
170 lines
4.5 KiB
YAML
global:
|
|
k8s:
|
|
clusterDomain: cluster.local
|
|
spire:
|
|
clusterName: homelab
|
|
trustDomain: ddupan.top
|
|
# This is a stable external identity even before its Gateway route is added.
|
|
# Changing the issuer after consumers trust it would invalidate their config.
|
|
jwtIssuer: https://spire-oidc.ad.ddupan.top
|
|
caSubject:
|
|
country: CN
|
|
organization: ddupan homelab
|
|
commonName: ddupan.top
|
|
namespaces:
|
|
create: false
|
|
system:
|
|
name: spire-system
|
|
server:
|
|
name: spire-server
|
|
recommendations:
|
|
enabled: true
|
|
namespaceLayout: true
|
|
namespacePSS: true
|
|
priorityClassName: true
|
|
strictMode: true
|
|
securityContexts: true
|
|
prometheus: false
|
|
|
|
spire-server:
|
|
kind: statefulset
|
|
replicaCount: 1
|
|
auditLogEnabled: true
|
|
service:
|
|
type: LoadBalancer
|
|
port: 8081
|
|
loadBalancerIP: 192.168.10.127
|
|
kubeConfigs:
|
|
sandbox:
|
|
externalSecret:
|
|
name: spire-external-kubeconfigs
|
|
key: sandbox
|
|
sandbox-controller:
|
|
externalSecret:
|
|
name: spire-external-kubeconfigs
|
|
key: sandbox-controller
|
|
sandbox-runner-bundle:
|
|
externalSecret:
|
|
name: spire-external-kubeconfigs
|
|
key: sandbox-controller
|
|
nodeAttestor:
|
|
externalK8sPSAT:
|
|
enabled: true
|
|
clusters:
|
|
sandbox:
|
|
kubeConfigName: sandbox
|
|
serviceAccountAllowList:
|
|
- spire-system:spire-agent
|
|
sandbox-kata:
|
|
kubeConfigName: sandbox
|
|
serviceAccountAllowList:
|
|
- spire-smoke:spire-smoke
|
|
- opensandbox:gitea-ci
|
|
usePodUIDForAgentID: true
|
|
externalControllerManagers:
|
|
enabled: true
|
|
clusters:
|
|
sandbox:
|
|
kubeConfigName: sandbox-controller
|
|
# Dynamic OpenSandbox runner identities are exact Pod-UID-bound
|
|
# ClusterStaticEntries created in the sandbox cluster. The chart
|
|
# defaults this reconciler to false, so enable the central registration
|
|
# path explicitly.
|
|
reconcile:
|
|
clusterStaticEntries: true
|
|
bundlePublisher:
|
|
externalK8sConfigMap:
|
|
enabled: true
|
|
clusters:
|
|
sandbox:
|
|
kubeConfigName: sandbox-controller
|
|
namespace: spire-system
|
|
configMapName: spire-bundle
|
|
configMapKey: bundle.spiffe
|
|
format: spiffe
|
|
sandbox-runner-bundle:
|
|
kubeConfigName: sandbox-runner-bundle
|
|
namespace: opensandbox
|
|
configMapName: spire-bundle-pem
|
|
configMapKey: bundle.pem
|
|
format: pem
|
|
persistence:
|
|
# PostgreSQL stores registrations, but the disk KeyManager still needs durable
|
|
# storage for the trust-domain signing keys.
|
|
type: pvc
|
|
size: 1Gi
|
|
accessMode: ReadWriteOnce
|
|
storageClass: localpv-zfs-ceph
|
|
dataStore:
|
|
sql:
|
|
databaseType: postgres
|
|
databaseName: spire
|
|
host: shared-postgresql-rw.shared-db.svc.cluster.local
|
|
port: 5432
|
|
username: spire
|
|
options:
|
|
- sslmode: require
|
|
externalSecret:
|
|
enabled: true
|
|
name: spire-postgresql
|
|
key: password
|
|
maxOpenConns: 20
|
|
maxIdleConns: 2
|
|
connMaxLifetime: 30m
|
|
controllerManager:
|
|
enabled: true
|
|
# Identities are opt-in. Do not issue a fallback SVID to every pod in the
|
|
# cluster merely because it can mount the Workload API socket.
|
|
identities:
|
|
clusterSPIFFEIDs:
|
|
default:
|
|
enabled: false
|
|
test-keys:
|
|
enabled: false
|
|
|
|
spire-agent:
|
|
server:
|
|
# Keep the Agent endpoint aligned with spire-server.service.port. The
|
|
# chart defaults this to 443, which only remained unnoticed while the
|
|
# Agent's pre-upgrade gRPC connection stayed alive.
|
|
port: 8081
|
|
nodeAttestor:
|
|
k8sPSAT:
|
|
enabled: true
|
|
workloadAttestors:
|
|
k8s:
|
|
enabled: true
|
|
unix:
|
|
# The node Agent also exposes its Workload API socket on the host. Enable
|
|
# Unix attestation so local development processes can receive an identity
|
|
# through an explicitly scoped ClusterStaticEntry.
|
|
enabled: true
|
|
|
|
spiffe-csi-driver:
|
|
enabled: true
|
|
|
|
spiffe-oidc-discovery-provider:
|
|
enabled: true
|
|
# TLS will terminate at the existing Envoy Gateway when the stable issuer is
|
|
# exposed. The service remains ClusterIP-only during the first deployment.
|
|
tls:
|
|
spire:
|
|
enabled: false
|
|
externalSecret:
|
|
enabled: false
|
|
certManager:
|
|
enabled: false
|
|
|
|
upstream:
|
|
enabled: false
|
|
tornjak-frontend:
|
|
enabled: false
|
|
spire-identity-exchange:
|
|
enabled: false
|
|
spike-keeper:
|
|
enabled: false
|
|
spike-nexus:
|
|
enabled: false
|
|
spike-pilot:
|
|
enabled: false
|