---
apiVersion: v1
kind: ConfigMap
metadata:
  name: kbs-config
  annotations:
    "helm.sh/resource-policy": "keep"
  labels:
    {{- include "coco-kbs.labels" . | nindent 4 }}
data:
  "kbs-config.toml": |
    [http_server]
    sockets = ["0.0.0.0:{{ .Values.kbs.service.port }}"]
    insecure_http = true
    # insecure_api = true

    [admin]
    auth_public_key = "/opt/confidential-containers/kbs/user-keys/public.pub"

    [[plugins]]
    name = "resource"
    {{- if .Values.kbs.aliyunKms.enabled }}
    type = "Aliyun"
    client_key = {{ .Values.kbs.aliyunKms.clientKey | quote }}
    kms_instance_id = "{{ .Values.kbs.aliyunKms.kmsIntanceId }}"
    password = "{{ .Values.kbs.aliyunKms.password }}"
    cert_pem = {{ .Values.kbs.aliyunKms.certPem | quote}}
    {{- else }}
    type = "LocalFs"
    dir_path = "/opt/confidential-containers/kbs/repository"
    {{- end }}

    [[plugins]]
    name = "tpm-pca"
    work_dir = "/opt/confidential-containers/kbs/tpm-pca"
    
    [attestation_token]
    insecure_key = true

    [attestation_service]
    type = "coco_as_grpc"
    {{- if .Values.as_ip }}
    as_addr = "http://{{ .Values.as_ip }}:{{ .Values.as.service.port }}"
    {{- else }}
    as_addr = "http://as:{{ .Values.as.service.port }}"
    {{- end }}