107 lines
2.6 KiB
YAML
107 lines
2.6 KiB
YAML
global:
|
|
k8s:
|
|
clusterDomain: cluster.local
|
|
spire:
|
|
clusterName: homelab
|
|
trustDomain: ddupan.top
|
|
# This is a stable external identity even before its Gateway route is added.
|
|
# Changing the issuer after consumers trust it would invalidate their config.
|
|
jwtIssuer: https://spire-oidc.ad.ddupan.top
|
|
caSubject:
|
|
country: CN
|
|
organization: ddupan homelab
|
|
commonName: ddupan.top
|
|
namespaces:
|
|
create: false
|
|
system:
|
|
name: spire-system
|
|
server:
|
|
name: spire-server
|
|
recommendations:
|
|
enabled: true
|
|
namespaceLayout: true
|
|
namespacePSS: true
|
|
priorityClassName: true
|
|
strictMode: true
|
|
securityContexts: true
|
|
prometheus: false
|
|
|
|
spire-server:
|
|
kind: statefulset
|
|
replicaCount: 1
|
|
auditLogEnabled: true
|
|
persistence:
|
|
# PostgreSQL stores registrations, but the disk KeyManager still needs durable
|
|
# storage for the trust-domain signing keys.
|
|
type: pvc
|
|
size: 1Gi
|
|
accessMode: ReadWriteOnce
|
|
storageClass: localpv-zfs-ceph
|
|
dataStore:
|
|
sql:
|
|
databaseType: postgres
|
|
databaseName: spire
|
|
host: shared-postgresql-rw.shared-db.svc.cluster.local
|
|
port: 5432
|
|
username: spire
|
|
options:
|
|
- sslmode: require
|
|
externalSecret:
|
|
enabled: true
|
|
name: spire-postgresql
|
|
key: password
|
|
maxOpenConns: 20
|
|
maxIdleConns: 2
|
|
connMaxLifetime: 30m
|
|
controllerManager:
|
|
enabled: true
|
|
# Identities are opt-in. Do not issue a fallback SVID to every pod in the
|
|
# cluster merely because it can mount the Workload API socket.
|
|
identities:
|
|
clusterSPIFFEIDs:
|
|
default:
|
|
enabled: false
|
|
test-keys:
|
|
enabled: false
|
|
|
|
spire-agent:
|
|
nodeAttestor:
|
|
k8sPSAT:
|
|
enabled: true
|
|
workloadAttestors:
|
|
k8s:
|
|
enabled: true
|
|
unix:
|
|
# The node Agent also exposes its Workload API socket on the host. Enable
|
|
# Unix attestation so local development processes can receive an identity
|
|
# through an explicitly scoped ClusterStaticEntry.
|
|
enabled: true
|
|
|
|
spiffe-csi-driver:
|
|
enabled: true
|
|
|
|
spiffe-oidc-discovery-provider:
|
|
enabled: true
|
|
# TLS will terminate at the existing Envoy Gateway when the stable issuer is
|
|
# exposed. The service remains ClusterIP-only during the first deployment.
|
|
tls:
|
|
spire:
|
|
enabled: false
|
|
externalSecret:
|
|
enabled: false
|
|
certManager:
|
|
enabled: false
|
|
|
|
upstream:
|
|
enabled: false
|
|
tornjak-frontend:
|
|
enabled: false
|
|
spire-identity-exchange:
|
|
enabled: false
|
|
spike-keeper:
|
|
enabled: false
|
|
spike-nexus:
|
|
enabled: false
|
|
spike-pilot:
|
|
enabled: false
|