Deny production runs of example.org trust domains

[kfox1111]

This pr adds some tests to ensure that if the user is deploying for production that they set appropriate settings.

fixes: #195

[marcofranssen]

Do we really want to enforce people to override? If they are just doing a quick install for testing, shouldn't that be possible with the default values?

If we want people to explicitly set those it would be better to remove the defaults.

This feels a bit like a unnecessary additional config value.

[kfox1111]

Do we really want to enforce people to override? If they are just doing a quick install for testing, shouldn't that be possible with the default values?

That's the point of the pr. If you just helm install the chart, it just works with example.org for a quick install for testing as it does today.

If you say explicitly, your trying to deploy for production by adding examples/production/values.yaml, then it forces you to specify the things you should be specifying. No one should be deploying a production spire as example.org? The pr helps you find all the things you need to override to get a valid production site by enforcing you set them.

If we want people to explicitly set those it would be better to remove the defaults.

That would make the, "just kick the tires" install much harder. But I could get behind that if there is agreement that is easier. It would be less complicated in the chart, just harder to get an example going. We could put the example values in examples/testing-deployment/values.yaml or something and then have people need to use that for a test deployment?

This feels a bit like a unnecessary additional config value.

Necessary or unnecessary depends on the usability path question above.

Side bar commentary by Marco with Kevin indicate that other maintainers are ok with the idea that the initial installation of SPIRE using these Helm charts not be production ready.

[kfox1111]

Update to include new global.

Also, set default back to false until we determine that tests should be rewritten

[kfox1111]

Something like productionChecks for the value instead.

[faisal-memon]

Something like productionChecks for the value instead.

That sounds good to me.

[kfox1111]

@faisal-memon ?

[marcofranssen]

LGTM 🚀