Initial spire chart setup

Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:00 +01:00
parent 258a5a2ca7
commit 007fa7b83d
26 changed files with 1076 additions and 0 deletions
@@ -0,0 +1,67 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "spire.fullname" . }}-server
+  namespace: {{ .Release.Namespace }}
+data:
+  server.conf: |
+    server {
+      bind_address = "0.0.0.0"
+      bind_port = "8081"
+      socket_path = "{{ include "spire.sockets" . }}/registration.sock"
+      trust_domain = {{ .Values.spire.trustDomain | quote }}
+      data_dir = "/run/spire/data"
+      log_level = "{{ .Values.spire.server.logLevel }}"
+      #AWS requires the use of RSA.  EC cryptography is not supported
+      ca_key_type = "rsa-2048"
+
+      {{- if eq (.Values.oidc.enabled | toString) "true" }}
+      jwt_issuer = "{{ .Values.oidc.domain }}"
+      {{ end }}
+      default_svid_ttl = "1h"
+      ca_subject = {
+        country = ["NL"],
+        organization = ["EXAMPLE"],
+        common_name = "",
+      }
+    }
+
+    plugins {
+      DataStore "sql" {
+        plugin_data {
+          database_type = "sqlite3"
+          connection_string = "/run/spire/data/datastore.sqlite3"
+        }
+      }
+
+      NodeAttestor "k8s_psat" {
+        plugin_data {
+          clusters = {
+            {{ .Values.spire.clusterName | quote }} = {
+              service_account_allow_list = ["{{ .Release.Namespace }}:{{ include "spire.serviceAccountName" . }}-agent"]
+            }
+          }
+        }
+      }
+
+      KeyManager "disk" {
+        plugin_data {
+          keys_path = "/run/spire/data/keys.json"
+        }
+      }
+
+      Notifier "k8sbundle" {
+        plugin_data {
+          namespace = "{{ .Release.Namespace }}"
+          config_map = "{{ include "spire.fullname" . }}-bundle"
+        }
+      }
+    }
+
+    health_checks {
+      listener_enabled = true
+      bind_address = "0.0.0.0"
+      bind_port = "8080"
+      live_path = "/live"
+      ready_path = "/ready"
+    }