config.conf

server {
  bind_address = "0.0.0.0"
  bind_port = "8081"
  registration_uds_path = "/run/spire/data/registration.sock"
  trust_domain = "example.org"
  data_dir = "/run/spire/data"
  log_level = "DEBUG"
  #AWS requires the use of RSA.  EC cryptography is not supported
  ca_key_type = "rsa-2048"

  default_svid_ttl = "1h"
  ca_subject = {
    country = ["US"],
    organization = ["SPIFFE"],
    common_name = "",
  }
}

plugins {
  DataStore "sql" {
    plugin_data {
      database_type = "sqlite3"
      connection_string = "/run/spire/data/datastore.sqlite3"
    }
  }

  NodeAttestor "k8s_sat" {
    plugin_data {
      clusters = {
        # NOTE: Change this to your cluster name
        "minikube" = {
          use_token_review_api_validation = true
          service_account_whitelist = ["spire:spire-agent"]
        }
      }
    }
  }

  NodeResolver "noop" {
    plugin_data {}
  }

  KeyManager "disk" {
    plugin_data {
      keys_path = "/run/spire/data/keys.json"
    }
  }

  Notifier "k8sbundle" {
    plugin_data {
    }
  }
}