# Unix Domain Socket is typically open to all (i.e. 0777).
  fsGroupPolicy: None

  # Declare support for ephemeral volumes only.
  volumeLifecycleModes:
    - Ephemeral

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: spire-server
  namespace: spire

---
# ConfigMap for spire-agent bootstrapping.
apiVersion: v1
kind: ConfigMap
metadata:
  name: spire-bundle
  namespace: spire

---

	Kind SubjectKind
	// `user` matches based on username.
	// +optional
	User *UserSubject
	// `group` matches based on user group name.
	// +optional
	Group *GroupSubject
	// `serviceAccount` matches ServiceAccounts.
	// +optional
	ServiceAccount *ServiceAccountSubject
}

// SubjectKind is the kind of subject.
type SubjectKind string

// Supported subject's kinds.
const (

  // +optional
  optional UserSubject user = 2;

  // `group` matches based on user group name.
  // +optional
  optional GroupSubject group = 3;

  // `serviceAccount` matches ServiceAccounts.
  // +optional
  optional ServiceAccountSubject serviceAccount = 4;
}

// UserSubject holds detailed information for user-kind subject.
message UserSubject {
  // `name` is the username that matches, or "*" to match all usernames.

	// `group` matches based on user group name.
	// +optional
	Group *GroupSubject `json:"group,omitempty" protobuf:"bytes,3,opt,name=group"`
	// `serviceAccount` matches ServiceAccounts.
	// +optional
	ServiceAccount *ServiceAccountSubject `json:"serviceAccount,omitempty" protobuf:"bytes,4,opt,name=serviceAccount"`
}

// SubjectKind is the kind of subject.
type SubjectKind string

// Supported subject's kinds.
const (

	// `group` matches based on user group name.
	// +optional
	Group *GroupSubject `json:"group,omitempty" protobuf:"bytes,3,opt,name=group"`
	// `serviceAccount` matches ServiceAccounts.
	// +optional
	ServiceAccount *ServiceAccountSubject `json:"serviceAccount,omitempty" protobuf:"bytes,4,opt,name=serviceAccount"`
}

// SubjectKind is the kind of subject.
type SubjectKind string

// Supported subject's kinds.
const (

		},
	}
)

const (
	testNamespace          = "istio-system-test"
	testServiceAccountName = "test-service-account"
)

func makeServiceAccount(secrets ...string) *v1.ServiceAccount {
	sa := &v1.ServiceAccount{
		ObjectMeta: metav1.ObjectMeta{
			Name:      testServiceAccountName,
			Namespace: testNamespace,
		},
	}

	for _, secret := range secrets {

  // +optional
  optional UserSubject user = 2;

  // `group` matches based on user group name.
  // +optional
  optional GroupSubject group = 3;

  // `serviceAccount` matches ServiceAccounts.
  // +optional
  optional ServiceAccountSubject serviceAccount = 4;
}

// UserSubject holds detailed information for user-kind subject.
message UserSubject {
  // `name` is the username that matches, or "*" to match all usernames.

            items:
              - key: {{ .Values.tls.publicCrt }}
                path: CAs/public.crt
        {{- end }}
      {{- if .Values.serviceAccount.create }}
      serviceAccountName: {{ .Values.serviceAccount.name }}
      {{- end }}
      {{- if .Values.policies }}
      initContainers:
        - name: minio-make-policy

        fsGroupChangePolicy: {{ .Values.securityContext.fsGroupChangePolicy }}
        {{- end }}
      {{- end }}
      {{- if .Values.serviceAccount.create }}
      serviceAccountName: {{ .Values.serviceAccount.name }}
      {{- end }}
      containers:
        - name: {{ .Chart.Name }}
          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}

  // +optional
  optional UserSubject user = 2;

  // `group` matches based on user group name.
  // +optional
  optional GroupSubject group = 3;

  // `serviceAccount` matches ServiceAccounts.
  // +optional
  optional ServiceAccountSubject serviceAccount = 4;
}

// UserSubject holds detailed information for user-kind subject.
message UserSubject {
  // `name` is the username that matches, or "*" to match all usernames.