configmap.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ include "spire-agent.fullname" . }}
  namespace: {{ .Release.Namespace }}
data:
  agent.conf: |
    agent {
      data_dir = "/run/spire"
      log_level = {{ .Values.logLevel | quote }}
      server_address = "{{ .Release.Name }}-server"
      server_port = {{ .Values.server.port | quote }}
      socket_path = {{ include "spire.agent-socket-path" . | quote }}
      trust_bundle_path = "/run/spire/bundle/bundle.crt"
      trust_domain = {{ .Values.trustDomain | quote }}
    }

    plugins {
      NodeAttestor "k8s_psat" {
        plugin_data {
          cluster = {{ .Values.clusterName | quote }}
        }
      }

      KeyManager "memory" {
        plugin_data {
        }
      }

      WorkloadAttestor "k8s" {
        plugin_data {
          # Defaults to the secure kubelet port by default.
          # Minikube does not have a cert in the cluster CA bundle that
          # can authenticate the kubelet cert, so skip validation.
          skip_kubelet_verification = true
        }
      }

      {{- if .Values.workloadAttestors.unix.enabled }}
      WorkloadAttestor "unix" {
          plugin_data {
          }
      }
      {{- end }}
    }

    health_checks {
      listener_enabled = true
      bind_address = "0.0.0.0"
      bind_port = {{ .Values.healthChecks.port | quote }}
      live_path = "/live"
      ready_path = "/ready"
    }

    {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
    telemetry {
      Prometheus {
        host = "0.0.0.0"
        port = {{ .Values.telemetry.prometheus.port }}
      }
    }
    {{- end }}