55 lines
2.0 KiB
Plaintext
55 lines
2.0 KiB
Plaintext
# ==============================================================================
|
|
# SPIRE Agent Configuration
|
|
# Auth-Yes Identity & Access Management Fabric
|
|
# ==============================================================================
|
|
# The SPIRE Agent runs as a local node daemon, attesting workloads (e.g. Docker
|
|
# containers) and serving the Workload API UNIX domain socket.
|
|
# ==============================================================================
|
|
|
|
agent {
|
|
# Directory where the SPIRE agent caches SVIDs, bundles, and keys.
|
|
data_dir = "/opt/spire/data/agent"
|
|
|
|
# Logging verbosity: DEBUG, INFO, WARN, ERROR
|
|
log_level = "INFO"
|
|
|
|
# Address and port of the SPIRE Server container within the internal network.
|
|
server_address = "spire-server"
|
|
server_port = "8081"
|
|
|
|
# UNIX Domain Socket Path exposed to workloads for zero-trust identity fetching.
|
|
socket_path = "/var/run/spire/agent.sock"
|
|
|
|
# Must match the SPIRE Server's trust_domain.
|
|
trust_domain = "system.local"
|
|
|
|
# Automatically fetch trust bundle from server on first bootstrap
|
|
insecure_bootstrap = true
|
|
}
|
|
|
|
plugins {
|
|
# ----------------------------------------------------------------------------
|
|
# NodeAttestor Plugin: Authenticates this agent with the SPIRE Server.
|
|
# ----------------------------------------------------------------------------
|
|
NodeAttestor "join_token" {
|
|
plugin_data {}
|
|
}
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# KeyManager Plugin: Stores node-level private keys on disk.
|
|
# ----------------------------------------------------------------------------
|
|
KeyManager "disk" {
|
|
plugin_data {
|
|
directory = "/opt/spire/data/agent"
|
|
}
|
|
}
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# WorkloadAttestor Plugin: Inspects running containers on Docker / Podman
|
|
# to grant SPIFFE SVIDs based on container image, labels, or names.
|
|
# ----------------------------------------------------------------------------
|
|
WorkloadAttestor "docker" {
|
|
plugin_data {}
|
|
}
|
|
}
|