more manifest changes

helm-charts/0.26.1/charts/spire/templates/spire-server-config-map.yaml

@@ -18,24 +18,37 @@ data:
   server.conf: |
     {
       "server": {
+        "audit_log_enabled": true,
         "bind_address": "0.0.0.0",
         "bind_port": "8081",
         "trust_domain": {{ .Values.global.spire.trustDomain | quote }},
         "data_dir": {{ .Values.spireServer.dataDir | quote }},
-        "log_level": "DEBUG",
+        "log_level": {{ .Values.global.spire.logLevel | quote }},
+{{- if .Values.global.spire.federationEnabled }}
         "federation": {
           "bundle_endpoint": {
             "address": "0.0.0.0",
             "port": 8443
           }
-{{- if .Values.experimental.eventsBasedCache }}
         },
+{{- end }}
+{{- if .Values.experimental.eventsBasedCache }}
         "experimental": {
           "events_based_cache": true
-        }
-{{- else }}
-        }
+        },
 {{- end }}
+        "ca_key_type": "rsa-2048",
+        "ca_subject": [
+          {
+            "common_name": {{ .Values.global.spire.caCommonName | quote }},
+            "country": [
+                {{ .Values.global.spire.caCountry | quote }}
+            ],
+            "organization": [
+              {{ .Values.global.spire.caOrganization | quote }}
+            ]
+          }
+        ]
       },
       "health_checks": {
         "bind_address": "0.0.0.0",
@@ -59,11 +72,20 @@ data:
           {
             "k8s_psat": {
               "plugin_data": {
-                "clusters": {
-                  "vsecm-cluster": {
-                    "service_account_allow_list": ["{{ .Values.global.spire.namespace }}:spire-agent"]
+                "clusters": [
+                  {
+                    "vsecm-cluster": {
+                      "allowed_node_label_keys": [],
+                      "allowed_pod_label_keys": [],
+                      "audience": [
+                        "spire-server"
+                      ],
+                      "service_account_allow_list": [
+                        "{{ .Values.global.spire.namespace }}:spire-agent"
+                      ]
+                    }
                   }
-                }
+                ]
               }
             }
           }

helm-charts/0.26.1/values.yaml

@@ -133,6 +133,10 @@ global:
 
   # -- SPIRE-related global configuration.
   spire:
+    # -- Enable federation. If set to true, SPIRE Server will be configured
+    # to federate with other SPIRE Servers. This is useful when you have
+    # multiple clusters, and you want to establish trust between them.
+    federationEnabled: false
     # -- The trust domain is the root of the SPIFFE ID hierarchy. It is used to
     # identify the trust domain of a workload. If you use anything other than
     # the default `vsecm.com`, you must also update the relevant environment
@@ -152,6 +156,12 @@ global:
     # All SPIFFE IDs shall be prefixed with `spiffe://<trustDomain>` unless
     # you have an advanced custom setup.
     trustDomain: "vsecm.com"
+    # -- The SPIRE CA common name.
+    caCommonName: "vsecm.com"
+    # -- The SPIRE CA country.
+    caCountry: "US"
+    # -- The SPIRE CA organization.
+    caOrganization: "vsecm.com"
     # -- This is the namespace where the SPIRE components will be deployed.
     namespace: spire-system
     # -- It is best to keep the SPIRE server namespace separate from other

k8s/0.26.1/spire.yaml

@@ -252,17 +252,24 @@ data:
   server.conf: |
     {
       "server": {
+        "audit_log_enabled": true,
         "bind_address": "0.0.0.0",
         "bind_port": "8081",
         "trust_domain": "vsecm.com",
         "data_dir": "/run/spire/data",
         "log_level": "DEBUG",
-        "federation": {
-          "bundle_endpoint": {
-            "address": "0.0.0.0",
-            "port": 8443
+        "ca_key_type": "rsa-2048",
+        "ca_subject": [
+          {
+            "common_name": "vsecm.com",
+            "country": [
+                "US"
+            ],
+            "organization": [
+              "vsecm.com"
+            ]
           }
-        }
+        ]
       },
       "health_checks": {
         "bind_address": "0.0.0.0",
@@ -286,11 +293,20 @@ data:
           {
             "k8s_psat": {
               "plugin_data": {
-                "clusters": {
-                  "vsecm-cluster": {
-                    "service_account_allow_list": ["spire-system:spire-agent"]
+                "clusters": [
+                  {
+                    "vsecm-cluster": {
+                      "allowed_node_label_keys": [],
+                      "allowed_pod_label_keys": [],
+                      "audience": [
+                        "spire-server"
+                      ],
+                      "service_account_allow_list": [
+                        "spire-system:spire-agent"
+                      ]
+                    }
                   }
-                }
+                ]
               }
             }
           }