agent.conf

agent {
    data_dir = "/run/spire"
    log_level = "DEBUG"
    server_address = "spire-server"
    server_port = "8081"
    socket_path = "/run/spire/sockets/agent.sock"
    trust_bundle_path = "/run/spire/bundle/bundle.crt"
    trust_domain = "example.org"
}

plugins {
    NodeAttestor "k8s_psat" {
        plugin_data {
            # NOTE: Change this to your cluster name
            cluster = "nsm-cluster"
        }
    }

    KeyManager "memory" {
        plugin_data {}
    }

    WorkloadAttestor "k8s" {
        plugin_data {
            # Defaults to the secure kubelet port by default.
            # Minikube does not have a cert in the cluster CA bundle that
            # can authenticate the kubelet cert, so skip validation.
            skip_kubelet_verification = true
        }
    }
    WorkloadAttestor "unix" {
        plugin_data {}
    }
}