CSI driver for SPIFFE Helm values¶

image.registry¶

Target image registry. This value is prepended to the target image repository, if set.
For example:

registry: quay.io
repository:
  driver: jetstack/cert-manager-csi-driver-spiffe
  approver: jetstack/cert-manager-csi-driver-spiffe-approver

image.repository.driver¶

quay.io/jetstack/cert-manager-csi-driver-spiffe

Target image repository for the CSI driver driver DaemonSet.

image.repository.approver¶

quay.io/jetstack/cert-manager-csi-driver-spiffe-approver

Target image repository for the CSI driver approver Deployment.

image.tag¶

Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.

image.digest¶

{}

image.digest.driver¶

Target CSI driver driver digest. Override any tag, if set.
For example:

driver: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20

image.digest.approver¶

Target CSI driver approver digest. Override any tag, if set.
For example:

approver: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20

image.pullPolicy¶

IfNotPresent

Kubernetes imagePullPolicy on DaemonSet.

imagePullSecrets¶

[]

Optional secrets used for pulling the CSI driver for SPIFFE and CSI driver for SPIFFE approver container images.

For example:

imagePullSecrets:
- name: secret-name

app.logLevel¶

1

Verbosity of cert-manager CSI driver logging.

app.certificateRequestDuration¶

1h

Duration requested for requested certificates.

app.runtimeIssuanceConfigMap¶

""

Name of a ConfigMap in the installation namespace to watch, providing runtime configuration of an issuer to use.

The "issuer-name", "issuer-kind" and "issuer-group" keys must be present in the ConfigMap for it to be used.

app.extraCertificateRequestAnnotations¶

null

List of annotations to add to certificate requests

For example:

extraCertificateRequestAnnotations: app=csi-driver-spiffe,foo=bar

app.trustDomain¶

cluster.local

The Trust Domain for this driver.

app.name¶

spiffe.csi.cert-manager.io

The name for the CSI driver installation.

app.issuer.name¶

spiffe-ca

Issuer name which is used to serve this Trust Domain.

app.issuer.kind¶

ClusterIssuer

Issuer kind which is used to serve this Trust Domain.

app.issuer.group¶

cert-manager.io

Issuer group which is used to serve this Trust Domain.

app.driver.sourceCABundle¶

null

Optional file containing a CA bundle that will be propagated to managed volumes.

app.driver.volumeFileName.ca¶

tls.crt

File name which signed certificates are written to in volumes.

app.driver.volumeFileName.ca¶

tls.key

File name which private keys are written to in volumes.

app.driver.volumeFileName.ca¶

ca.crt

File name where the CA bundles are written to, if enabled.

app.driver.volumes¶

[]

Optional extra volumes. Useful for mounting root CAs

For example:

volumes:
- name: root-cas
  secret:
    secretName: root-ca-bundle

app.driver.volumeMounts¶

[]

Optional extra volume mounts. Useful for mounting root CAs

For example:

volumeMounts:
- name: root-cas
  mountPath: /var/run/secrets/cert-manager-csi-driver-spiffe

app.driver.csiDataDir¶

/tmp/cert-manager-csi-driver

Configures the hostPath directory that the driver will write and mount volumes from.

app.driver.resources¶

{}

Kubernetes pod resource limits for cert-manager CSI driver for SPIFFE

For example:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

app.driver.nodeDriverRegistrarImage.registry¶

Target image registry. This value is prepended to the target image repository, if set.
For example:

registry: registry.k8s.io
repository: sig-storage/csi-node-driver-registrar

app.driver.nodeDriverRegistrarImage.pullPolicy¶

registry.k8s.io/sig-storage/csi-node-driver-registrar

Target image repository.

app.driver.nodeDriverRegistrarImage.pullPolicy¶

v2.11.1

Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.

app.driver.nodeDriverRegistrarImage.digest¶

Target image digest. Override any tag, if set.
For example:

digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20

app.driver.nodeDriverRegistrarImage.pullPolicy¶

IfNotPresent

Kubernetes imagePullPolicy on node-driver.

app.driver.livenessProbeImage.registry¶

Target image registry. This value is prepended to the target image repository, if set.
For example:

registry: registry.k8s.io
repository: sig-storage/livenessprobe

app.driver.livenessProbeImage.pullPolicy¶

registry.k8s.io/sig-storage/livenessprobe

Target image repository.

app.driver.livenessProbeImage.pullPolicy¶

v2.12.0

Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.

app.driver.livenessProbeImage.digest¶

Target image digest. Override any tag, if set.
For example:

digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20

app.driver.livenessProbeImage.pullPolicy¶

IfNotPresent

Kubernetes imagePullPolicy on liveness probe.

app.driver.livenessProbe.port¶

9809

The port that will expose the liveness of the CSI driver

app.approver.replicaCount¶

1

Number of replicas of the approver to run.

app.approver.signerName¶

""

A signer name that the CSI driver for SPIFFE approver will be given permission to approve and deny. CertificateRequests referencing this signer name can be processed by the SPIFFE approver. See CertificateRequest approval. Defaults to empty, which allows approval for all signers

app.approver.readinessProbe.port¶

6060

Container port to expose CSI driver for SPIFFE approver HTTP readiness probe on default network interface.

app.approver.metrics.service¶

9402

Port for exposing Prometheus metrics on 0.0.0.0 on path '/metrics'.

app.approver.metrics.service.enabled¶

true

Create a Service resource to expose metrics endpoint.

app.approver.metrics.service.type¶

ClusterIP

Service type to expose metrics.

app.approver.metrics.service.servicemonitor.labels¶

false

Create Prometheus ServiceMonitor resource for cert-manager CSI driver for SPIFFE approver.

app.approver.metrics.service.servicemonitor.labels¶

default

The value for the "prometheus" label on the ServiceMonitor. This allows for multiple Prometheus instances selecting difference ServiceMonitors using label selectors.

app.approver.metrics.service.servicemonitor.labels¶

10s

The interval that the Prometheus will scrape for metrics.

app.approver.metrics.service.servicemonitor.labels¶

5s

The timeout on each metric probe request.

app.approver.metrics.service.servicemonitor.labels¶

{}

Additional labels to give the ServiceMonitor resource.

app.approver.resources¶

{}

Kubernetes pod resource limits for cert-manager CSI driver for SPIFFE approver.

For example:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

priorityClassName¶

""

Optional priority class to be used for the CSI driver pods.

commonLabels¶

{}

Labels to apply to all resources

nodeSelector¶

kubernetes.io/os: linux

Kubernetes node selector: node labels for pod assignment.

affinity¶

{}

Kubernetes affinity: constraints for pod assignment.

For example:

affinity:
  nodeAffinity:
   requiredDuringSchedulingIgnoredDuringExecution:
     nodeSelectorTerms:
     - matchExpressions:
       - key: foo.bar.com/role
         operator: In
         values:
         - master

tolerations¶

[]

Kubernetes pod tolerations for cert-manager CSI driver for SPIFFE.

For example:

tolerations:
- key: foo.bar.com/role
  operator: Equal
  value: master
  effect: NoSchedule

topologySpreadConstraints¶

[]

List of Kubernetes TopologySpreadConstraints.

For example:

topologySpreadConstraints:
- maxSkew: 2
  topologyKey: topology.kubernetes.io/zone
  whenUnsatisfiable: ScheduleAnyway
  labelSelector:
    matchLabels:
      app.kubernetes.io/instance: cert-manager
      app.kubernetes.io/component: controller

openshift.securityContextConstraint.enabled¶

detect

Include RBAC to allow the DaemonSet to "use" the specified
SecurityContextConstraints.

This value can either be a boolean true or false, or the string "detect". If set to "detect" then the securityContextConstraint is automatically enabled for openshift installs.

openshift.securityContextConstraint.name¶

privileged

Name of the SecurityContextConstraints to create RBAC for.