spire-server-config-airfreight-nexus.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: spire-server
  namespace: spire
data:
  server.conf: |-
    server {
      bind_address = "0.0.0.0"
      bind_port = "8081"
      socket_path = "/tmp/spire-server/private/api.sock"
      trust_domain = "airfreight-nexus.example"
      data_dir = "/run/spire/data"
      log_level = "DEBUG"
      ca_key_type = "rsa-2048"

      ca_subject = {
        country = ["UK"],
        organization = ["AirFreight Nexus"],
        common_name = "AirFreight Nexus Ltd",
      }
      federation {
        bundle_endpoint {
          address = "0.0.0.0"
          port = 8443
        }
        federates_with "coastal-containers.example" {
          bundle_endpoint_url = "https://coastal-containers-control-plane:8443"
          bundle_endpoint_profile "https_spiffe" {
            endpoint_spiffe_id = "spiffe://coastal-containers.example/spire/server"
          }
        }
      }
    }

    plugins {
      DataStore "sql" {
        plugin_data {
          database_type = "sqlite3"
          connection_string = "/run/spire/data/datastore.sqlite3"
        }
      }

      NodeAttestor "k8s_psat" {
        plugin_data {
          clusters = {
            # NOTE: Change this to your cluster name
            "kind-airfreight-nexus" = {
              service_account_allow_list = ["spire:spire-agent"]
            }
          }
        }
      }

      KeyManager "memory" {
        plugin_data {}
      }

      Notifier "k8sbundle" {
        plugin_data {
        # When left unset, this plugin automatically publishes bundle contents from the in-cluster SPIRE server to the bundle.crt key within the spire-bundle ConfigMap
        }
      }
    }

    health_checks {
      listener_enabled = true
      bind_address = "0.0.0.0"
      bind_port = "8080"
      live_path = "/live"
      ready_path = "/ready"
    }