Skip to content

add key experimental.requirePQKEM for spire-server and spire-agent #755

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
daescha wants to merge 1 commit into
base: main
Choose a base branch
from
+8 −0
Open

add key experimental.requirePQKEM for spire-server and spire-agent #755

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions charts/spire/charts/spire-agent/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,6 +143,7 @@ A Helm chart to install the SPIRE agent.
| `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` |
| `experimental.enabled` | Allow configuration of experimental features | `false` |
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
| `experimental.requirePQKEM` | Require use of a post-quantum-safe key exchange method for TLS handshakes. | `false` |
| `experimental.featureFlags` | List of developer feature flags | `[]` |
| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
Expand Down
1 change: 1 addition & 0 deletions charts/spire/charts/spire-agent/templates/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,7 @@ agent:
{{- if eq (.enabled | toString) "true" }}
experimental:
sync_interval: {{ .syncInterval | quote }}
require_pq_kem: {{ .requirePQKEM }}
{{- if gt (len .featureFlags) 0 }}
feature_flags:
{{- range .featureFlags }}
Expand Down
2 changes: 2 additions & 0 deletions charts/spire/charts/spire-agent/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -376,6 +376,8 @@ experimental:
enabled: false
## @param experimental.syncInterval Sync interval with SPIRE server with exponential backoff
syncInterval: 5s
## @param experimental.requirePQKEM Require use of a post-quantum-safe key exchange method for TLS handshakes.
requirePQKEM: false
## @param experimental.featureFlags [array] List of developer feature flags
featureFlags: []

Expand Down
1 change: 1 addition & 0 deletions charts/spire/charts/spire-server/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -499,6 +499,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` |
| `experimental.eventsBasedCache` | Use events to update the cache with what's changed since the last update. | `false` |
| `experimental.pruneEventsOlderThan` | How old an event can be before being deleted. Used with events based cache. | `12h` |
| `experimental.requirePQKEM` | Require use of a post-quantum-safe key exchange method for TLS handshakes. | `false` |
| `experimental.featureFlags` | List of developer feature flags | `[]` |
| `experimental.authOpaPolicyEngine` | The [auth opa_policy engine](https://github.com/spiffe/spire/blob/main/doc/authorization_policy_engine.md) used for authorization decisions. Defaults to the default SPIRE authorization policy. | `{}` |
| `experimental.authOpaPolicyEngine.local.policy_data` | A JSON blob that defines additional data that can be used in the rego policy. | `""` |
Expand Down
1 change: 1 addition & 0 deletions charts/spire/charts/spire-server/templates/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,7 @@ server:
cache_reload_interval: {{ .cacheReloadInterval | quote }}
events_based_cache: {{ .eventsBasedCache }}
prune_events_older_than: {{ .pruneEventsOlderThan | quote }}
require_pq_kem: {{ .requirePQKEM }}
{{- if gt (len .featureFlags) 0 }}
feature_flags:
{{- range .featureFlags }}
Expand Down
2 changes: 2 additions & 0 deletions charts/spire/charts/spire-server/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1271,6 +1271,8 @@ experimental:
eventsBasedCache: false
## @param experimental.pruneEventsOlderThan How old an event can be before being deleted. Used with events based cache.
pruneEventsOlderThan: 12h
## @param experimental.requirePQKEM Require use of a post-quantum-safe key exchange method for TLS handshakes.
requirePQKEM: false
## @param experimental.featureFlags [array] List of developer feature flags
featureFlags: []
## @param experimental.authOpaPolicyEngine [object] The [auth opa_policy engine](https://github.com/spiffe/spire/blob/main/doc/authorization_policy_engine.md) used for authorization decisions. Defaults to the default SPIRE authorization policy.
Expand Down