Initial spire chart setup

Signed-off-by: Marco Franssen <[email protected]>

charts/spire/templates/NOTES.txt

@@ -0,0 +1,4 @@
+1. Get the currently registered SPIFFE entries from the server:
+
+  kubectl exec -n {{ .Release.Namespace }} {{ include "spire.fullname" . }}-server-0 -c spire-server -- \
+    bin/spire-server entry show -socketPath {{ include "spire.sockets" . }}/registration.sock

charts/spire/templates/_helpers.tpl

@@ -0,0 +1,106 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "spire.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "spire.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "spire.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "spire.labels" -}}
+helm.sh/chart: {{ include "spire.chart" . }}
+{{ include "spire.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "spire.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "spire.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Common server labels
+*/}}
+{{- define "spire.server.labels" -}}
+helm.sh/chart: {{ include "spire.chart" . }}
+{{ include "spire.server.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector server labels
+*/}}
+{{- define "spire.server.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "spire.name" . }}-server
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Common agent labels
+*/}}
+{{- define "spire.agent.labels" -}}
+helm.sh/chart: {{ include "spire.chart" . }}
+{{ include "spire.agent.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector agent labels
+*/}}
+{{- define "spire.agent.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "spire.name" . }}-agent
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "spire.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "spire.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{- define "spire.sockets" -}}
+{{- "/run/spire/sockets" -}}
+{{- end -}}

charts/spire/templates/agent-cluster-role.yaml

@@ -0,0 +1,25 @@
+# Required cluster role to allow spire-agent to query k8s API server
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire.fullname" . }}-agent-cluster-role
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "nodes", "nodes/proxy"]
+    verbs: ["get"]
+
+---
+# Binds above cluster role to spire-agent service account
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire.fullname" . }}-agent-cluster-role-binding
+  namespace: {{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "spire.fullname" . }}-agent
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "spire.fullname" . }}-agent-cluster-role
+  apiGroup: rbac.authorization.k8s.io

charts/spire/templates/agent-configmap.yaml

@@ -0,0 +1,51 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "spire.fullname" . }}-agent
+  namespace: {{ .Release.Namespace }}
+data:
+  agent.conf: |
+    agent {
+      data_dir = "/run/spire"
+      log_level = "{{ .Values.spire.agent.logLevel }}"
+      server_address = "{{ include "spire.fullname" . }}-server"
+      server_port = "{{ .Values.server.service.port }}"
+      socket_path = "/run/spire/sockets/agent.sock"
+      trust_bundle_path = "/run/spire/bundle/bundle.crt"
+      trust_domain = {{ .Values.spire.trustDomain | quote }}
+    }
+
+    plugins {
+      NodeAttestor "k8s_psat" {
+        plugin_data {
+          cluster = {{ .Values.spire.clusterName | quote }}
+        }
+      }
+
+      KeyManager "memory" {
+        plugin_data {
+        }
+      }
+
+      WorkloadAttestor "k8s" {
+        plugin_data {
+          # Defaults to the secure kubelet port by default.
+          # Minikube does not have a cert in the cluster CA bundle that
+          # can authenticate the kubelet cert, so skip validation.
+          skip_kubelet_verification = true
+        }
+      }
+
+      WorkloadAttestor "unix" {
+          plugin_data {
+          }
+      }
+    }
+
+    health_checks {
+      listener_enabled = true
+      bind_address = "0.0.0.0"
+      bind_port = "8080"
+      live_path = "/live"
+      ready_path = "/ready"
+    }

charts/spire/templates/agent-daemonset.yaml

@@ -0,0 +1,75 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ include "spire.fullname" . }}-agent
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "spire.agent.labels" . | nindent 4 }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "spire.agent.selectorLabels" . | nindent 6 }}
+  updateStrategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        {{- include "spire.agent.selectorLabels" . | nindent 8 }}
+    spec:
+      hostPID: true
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      serviceAccountName: {{ include "spire.serviceAccountName" . }}-agent
+      initContainers:
+        - name: init
+          # This is a small image with wait-for-it, choose whatever image
+          # you prefer that waits for a service to be up. This image is built
+          # from https://github.com/lqhl/wait-for-it
+          image: gcr.io/spiffe-io/wait-for-it:latest
+          args: ["-t", "30", "{{ include "spire.fullname" . }}-server:8081"]
+      containers:
+        - name: {{ .Chart.Name }}-agent
+          image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag | default .Chart.AppVersion }}"
+          args: ["-config", "/run/spire/config/agent.conf"]
+          volumeMounts:
+            - name: spire-config
+              mountPath: /run/spire/config
+              readOnly: true
+            - name: spire-bundle
+              mountPath: /run/spire/bundle
+              readOnly: true
+            - name: spire-agent-socket
+              mountPath: /run/spire/sockets
+              readOnly: false
+            - name: spire-token
+              mountPath: /var/run/secrets/tokens
+          livenessProbe:
+            httpGet:
+              path: /live
+              port: 8080
+            initialDelaySeconds: 15
+            periodSeconds: 60
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: 8080
+            initialDelaySeconds: 15
+            periodSeconds: 60
+      volumes:
+        - name: spire-config
+          configMap:
+            name: {{ include "spire.fullname" . }}-agent
+        - name: spire-bundle
+          configMap:
+            name: {{ include "spire.fullname" . }}-bundle
+        - name: spire-agent-socket
+          hostPath:
+            path: /run/spire/sockets
+            type: DirectoryOrCreate
+        - name: spire-token
+          projected:
+            sources:
+            - serviceAccountToken:
+                path: spire-agent
+                expirationSeconds: 7200
+                audience: spire-server

charts/spire/templates/agent-serviceaccount.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "spire.serviceAccountName" . }}-agent
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "spire.agent.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

charts/spire/templates/hpa.yaml

@@ -0,0 +1,29 @@
+{{- if .Values.autoscaling.enabled }}
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "spire.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "spire.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "spire.fullname" . }}
+  minReplicas: {{ .Values.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+    {{- end }}
+    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    {{- end }}
+{{- end }}

charts/spire/templates/image-pull-secrets.yaml

@@ -0,0 +1,21 @@
+{{- $fullname := include "spire.fullname" . }}
+{{- $ns := .Release.Namespace }}
+{{- $labels := include "spire.labels" . }}
+{{- range .Values.imagePullSecrets }}
+{{- $registryAuthDocument := dict -}}
+{{- $authMessage := printf "%s:%s" .username .password | b64enc }}
+{{- $_ := set $registryAuthDocument "auth" $authMessage }}
+{{- $dockerAuthDocument := dict .registryURL $registryAuthDocument }}
+{{- $dockerConfigJSONDocument := dict "auths" $dockerAuthDocument -}}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ (printf "%s-%s" $fullname .name) }}
+  namespace: {{ $ns }}
+  labels:
+    {{- $labels | nindent 4 }}
+data:
+  .dockerconfigjson: {{ $dockerConfigJSONDocument | toJson | b64enc | quote }}
+type: kubernetes.io/dockerconfigjson
+{{- end }}

charts/spire/templates/oidc-dp-configmap.yaml

@@ -0,0 +1,22 @@
+{{- if eq (.Values.oidc.enabled | toString) "true" }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "spire.fullname" . }}-oidc-discovery-provider
+  namespace: {{ .Release.Namespace }}
+data:
+  oidc-discovery-provider.conf: |
+    log_level = "{{ .Values.oidc.logLevel }}"
+
+    domain = "{{ .Values.oidc.ingress.domain }}"
+    insecure_addr = ":{{ .Values.oidc.service.port }}"
+    # acme {
+    #     directory_url = "https://acme-v02.api.letsencrypt.org/directory"
+    #     cache_dir = "/run/spire"
+    #     tos_accepted = true
+    #     email = "{{ .Values.oidc.letsEncrypt.emailAddress }}"
+    # }
+    server_api {
+        address = "unix://{{ include "spire.sockets" . }}/registration.sock"
+    }
+{{ end }}

charts/spire/templates/oidc-ingress.yaml

@@ -0,0 +1,30 @@
+{{- if and (eq (.Values.oidc.enabled | toString) "true") (eq (.Values.oidc.ingress.enabled | toString) "true") }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "spire.fullname" . }}-oidc-ingress
+  namespace: spire
+spec:
+  tls:
+    - hosts:
+        - {{ .Values.oidc.ingress.domain }}
+      secretName: oidc-secret
+  rules:
+    - host: {{ .Values.oidc.ingress.domain }}
+      http:
+        paths:
+          - path: /.well-known/openid-configuration
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: {{ include "spire.fullname" . }}-oidc
+                port:
+                  name: http
+          - path: /keys
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: {{ include "spire.fullname" . }}-oidc
+                port:
+                  name: http
+{{ end }}

charts/spire/templates/oidc-service.yaml

@@ -0,0 +1,15 @@
+{{- if eq (.Values.oidc.enabled | toString) "true" }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "spire.fullname" . }}-oidc
+  namespace: {{ .Release.Namespace }}
+spec:
+  type: {{ .Values.oidc.service.type }}
+  ports:
+    - name: http
+      port: {{ .Values.oidc.service.port }}
+      targetPort: spire-oidc-port
+  selector:
+    {{- include "spire.server.selectorLabels" . | nindent 4 }}
+{{ end }}

charts/spire/templates/server-cluster-role.yaml

@@ -0,0 +1,31 @@
+# ClusterRole to allow spire-server node attestor to query Token Review API
+# and to be able to push certificate bundles to a configmap
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire.fullname" . }}-server-cluster-role
+rules:
+    # allow TokenReview requests (to verify service account tokens for PSAT
+    # attestation)
+  - apiGroups: ["authentication.k8s.io"]
+    resources: ["tokenreviews"]
+    verbs: ["get", "create"]
+  - apiGroups: [""]
+    resources: ["pods", "nodes"]
+    verbs: ["get", "list", "watch"]
+
+---
+# Binds above cluster role to spire-server service account
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire.fullname" . }}-server-cluster-role-binding
+  namespace: {{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "spire.serviceAccountName" . }}-server
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "spire.fullname" . }}-server-cluster-role
+  apiGroup: rbac.authorization.k8s.io

charts/spire/templates/server-configmap.yaml

@@ -0,0 +1,67 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "spire.fullname" . }}-server
+  namespace: {{ .Release.Namespace }}
+data:
+  server.conf: |
+    server {
+      bind_address = "0.0.0.0"
+      bind_port = "8081"
+      socket_path = "{{ include "spire.sockets" . }}/registration.sock"
+      trust_domain = {{ .Values.spire.trustDomain | quote }}
+      data_dir = "/run/spire/data"
+      log_level = "{{ .Values.spire.server.logLevel }}"
+      #AWS requires the use of RSA.  EC cryptography is not supported
+      ca_key_type = "rsa-2048"
+
+      {{- if eq (.Values.oidc.enabled | toString) "true" }}
+      jwt_issuer = "{{ .Values.oidc.domain }}"
+      {{ end }}
+      default_svid_ttl = "1h"
+      ca_subject = {
+        country = ["NL"],
+        organization = ["EXAMPLE"],
+        common_name = "",
+      }
+    }
+
+    plugins {
+      DataStore "sql" {
+        plugin_data {
+          database_type = "sqlite3"
+          connection_string = "/run/spire/data/datastore.sqlite3"
+        }
+      }
+
+      NodeAttestor "k8s_psat" {
+        plugin_data {
+          clusters = {
+            {{ .Values.spire.clusterName | quote }} = {
+              service_account_allow_list = ["{{ .Release.Namespace }}:{{ include "spire.serviceAccountName" . }}-agent"]
+            }
+          }
+        }
+      }
+
+      KeyManager "disk" {
+        plugin_data {
+          keys_path = "/run/spire/data/keys.json"
+        }
+      }
+
+      Notifier "k8sbundle" {
+        plugin_data {
+          namespace = "{{ .Release.Namespace }}"
+          config_map = "{{ include "spire.fullname" . }}-bundle"
+        }
+      }
+    }
+
+    health_checks {
+      listener_enabled = true
+      bind_address = "0.0.0.0"
+      bind_port = "8080"
+      live_path = "/live"
+      ready_path = "/ready"
+    }

charts/spire/templates/server-role.yaml

@@ -0,0 +1,43 @@
+# ClusterRole to allow spire-server node attestor to query Token Review API
+# and to be able to push certificate bundles to a configmap
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire.fullname" . }}-server-role
+  namespace: {{ .Release.Namespace }}
+rules:
+  # allow "get" access to pods (to resolve selectors for PSAT attestation)
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get"]
+    # allow access to "get" and "patch" the spire-bundle ConfigMap (for SPIRE
+    # agent bootstrapping, see the spire-bundle ConfigMap below)
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    resourceNames: ["{{ include "spire.fullname" . }}-bundle"]
+    verbs: ["get", "patch"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["create"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    resourceNames: ["spire-k8s-registrar-leader-election"]
+    verbs: ["update", "get"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["create"]
+
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire.fullname" . }}-server-role-binding
+  namespace: {{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "spire.serviceAccountName" . }}-server
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: {{ include "spire.fullname" . }}-server-role
+  apiGroup: rbac.authorization.k8s.io

charts/spire/templates/server-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "spire.fullname" . }}-server
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "spire.server.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.server.service.type }}
+  ports:
+    - name: grpc
+      port: {{ .Values.server.service.port }}
+      targetPort: grpc
+      protocol: TCP
+  selector:
+    {{- include "spire.server.selectorLabels" . | nindent 4 }}

charts/spire/templates/server-serviceaccount.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "spire.serviceAccountName" . }}-server
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "spire.server.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

charts/spire/templates/server-statefulset.yaml

@@ -0,0 +1,162 @@
+{{- $fullname := include "spire.fullname" . }}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ $fullname }}-server
+  labels:
+    {{- include "spire.server.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  serviceName: {{ include "spire.fullname" . }}-server
+  selector:
+    matchLabels:
+      {{- include "spire.server.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "spire.server.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range . }}
+        - name: {{ printf "%s-%s" $fullname .name }}
+        {{- end }}
+      {{- end }}
+      serviceAccountName: {{ include "spire.serviceAccountName" . }}-server
+      shareProcessNamespace: true
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}-server
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.server.image.repository }}:{{ .Values.server.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.server.image.pullPolicy }}
+          args:
+            - -config
+            - /run/spire/config/server.conf
+          ports:
+            - name: grpc
+              containerPort: 8081
+              protocol: TCP
+          volumeMounts:
+            - name: spire-server-socket
+              mountPath: {{ include "spire.sockets" . }}
+              readOnly: false
+            - name: spire-config
+              mountPath: /run/spire/config
+              readOnly: true
+            {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }}
+            - name: spire-data
+              mountPath: /run/spire/data
+              readOnly: false
+            {{ end }}
+          livenessProbe:
+            httpGet:
+              path: /live
+              port: 8080
+            failureThreshold: 2
+            initialDelaySeconds: 15
+            periodSeconds: 60
+            timeoutSeconds: 3
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+        - name: {{ .Chart.Name }}-workload-registrar
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.workloadRegistrar.image.repository }}:{{ .Values.workloadRegistrar.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.workloadRegistrar.image.pullPolicy }}
+          args:
+            - -config
+            - /run/spire/k8s-workload-registrar/config/workload-registrar.conf
+          ports:
+            - containerPort: 8443
+              name: registrar-port
+          volumeMounts:
+            - name: spire-server-socket
+              mountPath: {{ include "spire.sockets" . }}
+              readOnly: true
+            - name: spire-workload-registrar-config
+              mountPath: /run/spire/k8s-workload-registrar/config
+              readOnly: true
+        {{- if eq (.Values.oidc.enabled | toString) "true" }}
+        - name: spire-oidc
+          image: "{{ .Values.oidc.image.repository }}:{{ .Values.oidc.image.tag | default .Chart.AppVersion }}"
+          args:
+            - -config
+            - /run/spire/oidc/config/oidc-discovery-provider.conf
+          ports:
+            - containerPort: {{ .Values.oidc.service.port }}
+              name: spire-oidc-port
+          volumeMounts:
+            - name: spire-server-socket
+              mountPath: {{ include "spire.sockets" . }}
+              readOnly: true
+            - name: spire-oidc-config
+              mountPath: /run/spire/oidc/config/
+              readOnly: true
+            {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }}
+            - name: spire-data
+              mountPath: /run/spire/data
+              readOnly: false
+            {{ end }}
+          readinessProbe:
+            exec:
+              command: ["/bin/ps", "aux", " ||", "grep", "oidc-discovery-provider -config /run/spire/oidc/config/oidc-discovery-provider.conf"]
+            initialDelaySeconds: 5
+            periodSeconds: 5
+        {{ end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+        - name: spire-workload-registrar-config
+          configMap:
+            name: {{ include "spire.fullname" . }}-workload-registrar
+        - name: spire-config
+          configMap:
+            name: {{ include "spire.fullname" . }}-server
+        {{- if eq (.Values.oidc.enabled | toString) "true" }}
+        - name: spire-oidc-config
+          configMap:
+            name: {{ include "spire.fullname" . }}-oidc-discovery-provider
+        {{ end }}
+        - name: spire-server-socket
+          hostPath:
+            path: /run/spire/server-sockets
+            type: DirectoryOrCreate
+  volumeClaimTemplates:
+    {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }}
+    - metadata:
+        name: spire-data
+      spec:
+        accessModes:
+          - {{ .Values.server.dataStorage.accessMode | default "ReadWriteOnce" }}
+        resources:
+          requests:
+            storage: {{ .Values.server.dataStorage.size }}
+        {{- if .Values.server.dataStorage.storageClass }}
+        storageClassName: {{ .Values.server.dataStorage.storageClass }}
+        {{- end }}
+    {{ end }}

charts/spire/templates/spire-bundle-configmap.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "spire.fullname" . }}-bundle
+  namespace: {{ .Release.Namespace }}

charts/spire/templates/tests/server-test-connection.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "spire.fullname" . }}-server-test-connection"
+  labels:
+    {{- include "spire.server.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+spec:
+  containers:
+    - name: check-port
+      image: busybox
+      command: ['nc']
+      args: ['-zvw3', '{{ include "spire.fullname" . }}-server', '{{ .Values.server.service.port }}']
+  restartPolicy: Never

charts/spire/templates/workload-registrar-configmap.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "spire.fullname" . }}-workload-registrar
+  namespace: {{ .Release.Namespace }}
+data:
+  workload-registrar.conf: |
+    log_level       = "debug"
+    mode            = "reconcile"
+    trust_domain    = {{ .Values.spire.trustDomain | quote }}
+    cluster         = {{ .Values.spire.clusterName | quote }}
+    server_address  = "unix://{{ include "spire.sockets" . }}/registration.sock"
+    leader_election = true
+    metrics_addr    = "0.0.0.0:18080"

charts/spire/templates/workload-registrar-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "spire.fullname" . }}-k8s-workload-registrar
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "spire.server.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.server.service.type }}
+  ports:
+    - name: https
+      port: 443
+      targetPort: registrar-port
+      protocol: TCP
+  selector:
+    {{- include "spire.server.selectorLabels" . | nindent 4 }}