Skip to content

Commit

Permalink
Remove 'Considerations for a production environment'
Browse files Browse the repository at this point in the history
We now have the helm charts documented on the site, they are going to be a much better choice for production.

Signed-off-by: Sorin Dumitru <[email protected]>
  • Loading branch information
sorindumitru committed Jan 18, 2025
1 parent a335850 commit 8019e6f
Showing 1 changed file with 0 additions and 11 deletions.
11 changes: 0 additions & 11 deletions content/docs/latest/try/getting-started-k8s.md
Original file line number Diff line number Diff line change
Expand Up @@ -231,17 +231,6 @@ $ minikube start \
For Kubernetes versions prior to 1.17.0 the `apiserver.authorization-mode` can be specified as `apiserver.authorization-mode=RBAC`. Besides, for older versions of Kubernetes you should use `apiserver.service-account-api-audiences` configuration flag instead of `apiserver.api-audiences`.
{{< /info >}}
# Considerations For A Production Environment
When deploying SPIRE in a production environment the following considerations should be made.
In the [Create Server Configmap](#create-server-configmap) step: set the the cluster name in the `k8s_sat NodeAttestor` entry to the name you provide in the **agent-configmap.yaml** configuration file.
If your Kubernetes cluster supports projected service account tokens, consider using the built-in
[Projected Service Account Token k8s Node Attestor](https://github.com/spiffe/spire/blob/{{< spire-latest "tag" >}}/doc/plugin_server_nodeattestor_k8s_psat.md) for authenticating the SPIRE agent to the server. Projected Service Account Tokens are more tightly scoped than regular service account tokens, and thus more secure.
As configured, the SPIRE agent does not verify the identity of the Kubernetes kubelet when requesting metadata for workload attestation. For additional security, you may wish to configure the Kubernetes workload attestor to perform this verification on compatible Kubernetes distributions by setting `skip_kubelet_verification` to `false`. [Read more](https://github.com/spiffe/spire/blob/{{< spire-latest "tag" >}}/doc/plugin_agent_workloadattestor_k8s.md)
# Next steps
* [Review the SPIRE Documentation](/docs/latest/spire/using/) to learn how to configure SPIRE for your environment.

0 comments on commit 8019e6f

Please sign in to comment.