A Helm chart for deploying the full Spire stack into your k8s cluster.

Components:

• spire-server
  • spire-controller-manager (optional)
  • spire-k8s-workload-registrar (deprecated, optional)
• spire-agent
• spiffe-csi-driver
• spiffe-oidc-discovery-provider (optional)

Warning: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server.

Note: Minimum Spire version is v1.5.3 (This requires a nodeSelector to limit to amd64 nodes on multi-node clusters). The recommended minimum version for multi-architecture clusters is v1.6.0 which ships with arm64 support.

To enable Projected Service Account Tokens on Docker for Mac/Windows run the following command to SSH into the Docker Desktop K8s VM.

docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh

Then add the following to /etc/kubernetes/manifests/kube-apiserver.yaml

spec:
  containers:
    - command:
        - kube-apiserver
        - --api-audiences=api,spire-server
        - --service-account-issuer=api,spire-agent
        - --service-account-key-file=/run/config/pki/sa.pub
        - --service-account-signing-key-file=/run/config/pki/sa.key

Homepage: https://github.com/philips-labs/helm-charts/tree/main/charts/spire

• https://github.com/philips-labs/helm-charts/tree/main/charts/spire

Kubernetes: >=1.21.0-0