Namespace override

This patch makes it possible to install the subcharts in different
namespaces as needed.

Signed-off-by: Kevin Fox <[email protected]>

.github/tests/lockdown/.env

@@ -0,0 +1 @@
+export EXTRA_HELM_ARGS="--values=examples/production/values.yaml"

.github/tests/lockdown/post-install.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT=$(readlink -f "$0")
+SCRIPTPATH=$(dirname "$SCRIPT")
+
+k_wait=(kubectl wait --for condition=available --timeout 30s --namespace)
+k_rollout_status=(kubectl rollout status --watch --timeout 30s --namespace)
+
+cat <<EOF >>"$GITHUB_STEP_SUMMARY"
+### spire
+| workload | Status |
+| -------- | ------ |
+| spire-server | $("${k_rollout_status[@]}" spire-server statefulset spire-server) |
+| spire-spiffe-csi-driver | $("${k_rollout_status[@]}" spire-system daemonset spire-spiffe-csi-driver) |
+| spire-agent | $("${k_rollout_status[@]}" spire-system daemonset spire-agent) |
+| spire-spiffe-oidc-discovery-provider | $("${k_wait[@]}" spire-server deployments.apps spire-spiffe-oidc-discovery-provider) |
+EOF
+
+if [ $1 -ne 0 ]; then
+  echo
+  echo '```'
+  echo '==> Events of namespace spire-server'
+  echo '........................................................................................................................'
+  echo '>>> kubectl --request-timeout=30s get events --output wide --namespace spire-server'
+  kubectl --request-timeout=30s get events --output wide --namespace spire-server
+  echo '........................................................................................................................'
+  echo '<== Events of namespace spire-server'
+  echo '........................................................................................................................'
+  echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-server'
+  kubectl --request-timeout=30s describe pods --namespace spire-server
+  echo '========================================================================================================================'
+  echo '==> Events of namespace spire-system'
+  echo '........................................................................................................................'
+  echo '>>> kubectl --request-timeout=30s get events --output wide --namespace spire-system'
+  kubectl --request-timeout=30s get events --output wide --namespace spire-system
+  echo '........................................................................................................................'
+  echo '<== Events of namespace spire-system'
+  echo '........................................................................................................................'
+  echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-system'
+  kubectl --request-timeout=30s describe pods --namespace spire-system
+  echo '========================================================================================================================'
+  kubectl get pods -o name -n spire-server | while read line; do echo logs for $line; kubectl logs -n spire-server $line --all-containers=true --ignore-errors=true; done
+  kubectl get pods -o name -n spire-system | while read line; do echo logs for $line; kubectl logs -n spire-system $line --all-containers=true --ignore-errors=true; done
+  echo '========================================================================================================================'
+  echo '```'
+fi | cat >> "$GITHUB_STEP_SUMMARY"

.github/tests/lockdown/pre-install.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-kubectl label namespace "$scenario" pod-security.kubernetes.io/enforce=privileged
-kubectl create namespace "${scenario}-deps"
-kubectl label namespace "${scenario}-deps" pod-security.kubernetes.io/enforce=restricted
-helm install -n "${scenario}-deps" spire charts/spire -f "${TEST_DIR}"/deps-values.yaml
+kubectl create namespace "spire-system"
+kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
+kubectl create namespace "spire-server"
+kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted

.github/tests/lockdown/values.yaml

@@ -1,20 +1,5 @@
-global:
-  telemetry:
-    prometheus:
-      enabled: true
-
-spiffe-csi-driver:
-  enabled: true
-
-spire-agent:
-  enabled: true
-  serviceAccount:
-    name: spire-agent
-  server:
-    address: spire-server.lockdown-deps
-
 spiffe-oidc-discovery-provider:
-  enabled: false
+  namespaceOverride: spire-server
 
 spire-server:
-  enabled: false
+  namespaceOverride: spire-server

charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml

@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: {{ include "spiffe-csi-driver.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spiffe-csi-driver.namespace" . }}
   labels:
     {{- include "spiffe-csi-driver.labels" . | nindent 4 }}
 spec:

charts/spire/charts/spiffe-oidc-discovery-provider/README.md

@@ -41,6 +41,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
 | insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` |  |
 | insecureScheme.nginx.resources | object | `{}` |  |
 | nameOverride | string | `""` |  |
+| namespaceOverride | string | `""` |  |
 | nodeSelector | object | `{}` |  |
 | podAnnotations | object | `{}` |  |
 | podSecurityContext | object | `{}` |  |

charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl

@@ -23,6 +23,17 @@ If release name contains chart name it will be used as a full name.
 {{- end }}
 {{- end }}
 
+{{/*
+Allow the release namespace to be overridden for multi-namespace deployments in combined charts
+*/}}
+{{- define "spiffe-oidc-discovery-provider.namespace" -}}
+  {{- if .Values.namespaceOverride -}}
+    {{- .Values.namespaceOverride -}}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}

charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml

@@ -3,15 +3,15 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
 data:
   oidc-discovery-provider.conf: |
     log_level = "{{ .Values.config.logLevel }}"
 
     domains = [
       "{{ include "spiffe-oidc-discovery-provider.fullname" . }}",
-      "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}",
-      "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local",
+      "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}",
+      "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.cluster.local",
     {{- if gt (len .Values.config.domains) 0 }}
       "{{- join "\",\n      \"" .Values.config.domains }}"
     {{- end }}

charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml

@@ -3,6 +3,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
+  namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
   labels:
     {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
 spec:

charts/spire/charts/spiffe-oidc-discovery-provider/templates/hpa.yaml

@@ -3,6 +3,7 @@ apiVersion: autoscaling/v2beta1
 kind: HorizontalPodAutoscaler
 metadata:
   name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
+  namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
   labels:
     {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
 spec:

charts/spire/charts/spiffe-oidc-discovery-provider/templates/service.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
   {{- with .Values.service.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

charts/spire/charts/spiffe-oidc-discovery-provider/templates/serviceaccount.yaml

@@ -3,6 +3,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}
+  namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
   labels:
     {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
   {{- with .Values.serviceAccount.annotations }}

charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml

@@ -2,6 +2,7 @@ apiVersion: v1
 kind: Pod
 metadata:
   name: "{{ include "spiffe-oidc-discovery-provider.fullname" . }}-test-connection"
+  namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
   labels:
     {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
   annotations:
@@ -19,13 +20,13 @@ spec:
     - name: wget-service-name-namespace
       image: busybox
       command: ['wget']
-      args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.service.port }}/.well-known/openid-configuration']
+      args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     - name: wget-service-name-namespace-svc-cluster-local
       image: busybox
       command: ['wget']
-      args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}/.well-known/openid-configuration']
+      args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.cluster.local:{{ .Values.service.port }}/.well-known/openid-configuration']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
   restartPolicy: Never

charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml

@@ -6,6 +6,8 @@ agentSocket: spire-agent.sock
 
 replicaCount: 1
 
+namespaceOverride: ""
+
 image:
   # registry: gcr.io
   # repository: spiffe-io/oidc-discovery-provider

charts/spire/charts/spire-agent/README.md

@@ -30,6 +30,7 @@ A Helm chart to install the SPIRE agent.
 | initContainers | list | `[]` |  |
 | logLevel | string | `"info"` |  |
 | nameOverride | string | `""` |  |
+| namespaceOverride | string | `""` |  |
 | nodeSelector | object | `{}` |  |
 | podAnnotations | object | `{}` |  |
 | podSecurityContext | object | `{}` |  |
@@ -37,6 +38,7 @@ A Helm chart to install the SPIRE agent.
 | resources | object | `{}` |  |
 | securityContext | object | `{}` |  |
 | server.address | string | `""` |  |
+| server.namespaceOverride | string | `""` |  |
 | server.port | int | `8081` |  |
 | serviceAccount.annotations | object | `{}` |  |
 | serviceAccount.create | bool | `true` |  |

charts/spire/charts/spire-agent/templates/_helpers.tpl

@@ -23,6 +23,25 @@ If release name contains chart name it will be used as a full name.
 {{- end }}
 {{- end }}
 
+{{/*
+Allow the release namespace to be overridden for multi-namespace deployments in combined charts
+*/}}
+{{- define "spire-agent.namespace" -}}
+  {{- if .Values.namespaceOverride -}}
+    {{- .Values.namespaceOverride -}}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "spire-agent.server.namespace" -}}
+  {{- if .Values.server.namespaceOverride -}}
+    {{- .Values.server.namespaceOverride -}}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}
@@ -77,7 +96,7 @@ Create the name of the service account to use
 {{- if .Values.server.address }}
 {{- .Values.server.address }}
 {{- else }}
-{{ .Release.Name }}-server
+{{ .Release.Name }}-server.{{ include "spire-agent.server.namespace" . }}
 {{- end }}
 {{- end }}
 

charts/spire/charts/spire-agent/templates/configmap.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "spire-agent.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-agent.namespace" . }}
 data:
   agent.conf: |
     agent {

charts/spire/charts/spire-agent/templates/daemonset.yaml

@@ -3,7 +3,7 @@ apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: {{ include "spire-agent.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-agent.namespace" . }}
   labels:
     {{- include "spire-agent.labels" . | nindent 4 }}
 spec:

charts/spire/charts/spire-agent/templates/roles.yaml

@@ -16,11 +16,10 @@ kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "spire-agent.fullname" . }}
-  namespace: {{ .Release.Namespace }}
 subjects:
   - kind: ServiceAccount
-    name: {{ include "spire-agent.fullname" . }}
-    namespace: {{ .Release.Namespace }}
+    name: {{ include "spire-agent.serviceAccountName" . }}
+    namespace: {{ include "spire-agent.namespace" . }}
 roleRef:
   kind: ClusterRole
   name: {{ include "spire-agent.fullname" . }}

charts/spire/charts/spire-agent/templates/serviceaccount.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "spire-agent.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-agent.namespace" . }}
   labels:
     {{- include "spire-agent.labels" . | nindent 4 }}
   {{- with .Values.serviceAccount.annotations }}

charts/spire/charts/spire-agent/values.yaml

@@ -13,6 +13,7 @@ image:
 
 imagePullSecrets: []
 nameOverride: ""
+namespaceOverride: ""
 fullnameOverride: ""
 
 serviceAccount:
@@ -60,6 +61,7 @@ bundleConfigMap: spire-bundle
 server:
   address: ""
   port: 8081
+  namespaceOverride: ""
 
 healthChecks:
   # -- override the host port used for health checking

charts/spire/charts/spire-server/README.md

@@ -66,6 +66,7 @@ A Helm chart to install the SPIRE server.
 | jwtIssuer | string | `"oidc-discovery.example.org"` |  |
 | logLevel | string | `"info"` |  |
 | nameOverride | string | `""` |  |
+| namespaceOverride | string | `""` |  |
 | nodeAttestor.k8sPsat.enabled | bool | `true` |  |
 | nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` |  |
 | nodeSelector | object | `{}` |  |

charts/spire/charts/spire-server/templates/_helpers.tpl

@@ -23,6 +23,17 @@ If release name contains chart name it will be used as a full name.
 {{- end }}
 {{- end }}
 
+{{/*
+Allow the release namespace to be overridden for multi-namespace deployments in combined charts
+*/}}
+{{- define "spire-server.namespace" -}}
+  {{- if .Values.namespaceOverride -}}
+    {{- .Values.namespaceOverride -}}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}

charts/spire/charts/spire-server/templates/bundle-configmap.yaml

@@ -1,5 +1,6 @@
+{{- $namespace := include "spire-server.namespace" . }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ .Values.bundleConfigMap }}
-  namespace: {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace }}
+  namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}

charts/spire/charts/spire-server/templates/configmap.yaml

@@ -1,9 +1,10 @@
-{{ $root := . }}
+{{- $root := . }}
+{{- $namespace := include "spire-server.namespace" . }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "spire-server.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
 data:
   server.conf: |
     server {
@@ -60,7 +61,7 @@ data:
 
       Notifier "k8sbundle" {
         plugin_data {
-          namespace = {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace | quote }}
+          namespace = {{ .Values.notifier.k8sbundle.namespace | default $namespace | quote }}
           config_map = {{ .Values.bundleConfigMap | quote }}
         }
       }

charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml

@@ -5,6 +5,7 @@ apiVersion: spire.spiffe.io/v1alpha1
 kind: ClusterSPIFFEID
 metadata:
   name: {{ include "spire-controller-manager.fullname" $root }}-service-account-based
+  namespace: {{ include "spire-server.namespace" $root }}
 spec:
   spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }}
   {{- with .identities.podSelector }}

charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml

@@ -3,14 +3,14 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "spire-controller-manager.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
 data:
   controller-manager-config.yaml: |
     apiVersion: spire.spiffe.io/v1alpha1
     kind: ControllerManagerConfig
     metadata:
       name: {{ include "spire-controller-manager.fullname" . }}
-      namespace: {{ .Release.Namespace }}
+      namespace: {{ include "spire-server.namespace" . }}
       labels:
         {{- include "spire-server.labels" . | nindent 8 }}
     metrics:
@@ -20,7 +20,7 @@ data:
     leaderElection:
       leaderElect: true
       resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
-      resourceNamespace: {{ .Release.Namespace }}
+      resourceNamespace: {{ include "spire-server.namespace" . }}
     validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook
     clusterName: {{ .Values.clusterName }}
     trustDomain: {{ .Values.trustDomain }}

charts/spire/charts/spire-server/templates/controller-manager-roles.yaml

@@ -3,7 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: {{ include "spire-controller-manager.fullname" . }}-leader-election
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
 rules:
   - apiGroups: [""]
     resources: ["configmaps"]
@@ -19,7 +19,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: {{ include "spire-controller-manager.fullname" . }}-leader-election
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -27,7 +27,7 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: {{ include "spire-server.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -76,5 +76,5 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: {{ include "spire-server.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
 {{- end }}

charts/spire/charts/spire-server/templates/controller-manager-service.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "spire-controller-manager.fullname" . }}-webhook
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
   labels:
     {{- include "spire-server.labels" . | nindent 4 }}
   {{- with .Values.controllerManager.service.annotations }}

charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml

@@ -8,7 +8,7 @@ webhooks:
     clientConfig:
       service:
         name: {{ include "spire-controller-manager.fullname" . }}-webhook
-        namespace: {{ .Release.Namespace }}
+        namespace: {{ include "spire-server.namespace" . }}
         path: /validate-spire-spiffe-io-v1alpha1-clusterfederatedtrustdomain
     failurePolicy: Fail
     name: vclusterfederatedtrustdomain.kb.io
@@ -22,7 +22,7 @@ webhooks:
     clientConfig:
       service:
         name: {{ include "spire-controller-manager.fullname" . }}-webhook
-        namespace: {{ .Release.Namespace }}
+        namespace: {{ include "spire-server.namespace" . }}
         path: /validate-spire-spiffe-io-v1alpha1-clusterspiffeid
     failurePolicy: Fail
     name: vclusterspiffeid.kb.io

charts/spire/charts/spire-server/templates/hpa.yaml

@@ -3,6 +3,7 @@ apiVersion: autoscaling/v2beta1
 kind: HorizontalPodAutoscaler
 metadata:
   name: {{ include "spire-server.fullname" . }}
+  namespace: {{ include "spire-server.namespace" . }}
   labels:
     {{- include "spire-server.labels" . | nindent 4 }}
 spec:

charts/spire/charts/spire-server/templates/roles.yaml

@@ -1,9 +1,10 @@
+{{- $namespace := include "spire-server.namespace" . }}
 # Role to be able to push certificate bundles to a configmap
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "spire-server.fullname" . }}-bundle
-  namespace: {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace }}
+  namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
 rules:
   - apiGroups: [""]
     resources: [configmaps]
@@ -18,7 +19,7 @@ kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "spire-server.fullname" . }}-cm
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ $namespace }}
 rules:
   - apiGroups: ["cert-manager.io"]
     resources:
@@ -35,11 +36,11 @@ kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "spire-server.fullname" . }}-cm
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ $namespace }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "spire-server.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
+    namespace: {{ $namespace }}
 roleRef:
   kind: Role
   name: {{ include "spire-server.fullname" . }}-cm
@@ -50,11 +51,11 @@ kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "spire-server.fullname" . }}-bundle
-  namespace: {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace }}
+  namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "spire-server.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
+    namespace: {{ $namespace }}
 roleRef:
   kind: Role
   name: {{ include "spire-server.fullname" . }}-bundle
@@ -89,7 +90,7 @@ metadata:
 subjects:
   - kind: ServiceAccount
     name: {{ include "spire-server.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
+    namespace: {{ $namespace }}
 roleRef:
   kind: ClusterRole
   name: {{ .Release.Namespace}}-{{ include "spire-server.fullname" . }}

charts/spire/charts/spire-server/templates/service.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "spire-server.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
   {{- with .Values.service.annotations }}
   annotations:
     {{- toYaml . | nindent 8 }}

charts/spire/charts/spire-server/templates/serviceaccount.yaml

@@ -3,6 +3,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "spire-server.serviceAccountName" . }}
+  namespace: {{ include "spire-server.namespace" . }}
   labels:
     {{- include "spire-server.labels" . | nindent 4 }}
   {{- with .Values.serviceAccount.annotations }}

charts/spire/charts/spire-server/templates/statefulset.yaml

@@ -5,6 +5,7 @@ apiVersion: apps/v1
 kind: StatefulSet
 metadata:
   name: {{ include "spire-server.fullname" . }}
+  namespace: {{ include "spire-server.namespace" . }}
   labels:
     {{- include "spire-server.labels" . | nindent 4 }}
 spec:

charts/spire/charts/spire-server/templates/tests/test-connection.yaml

@@ -2,6 +2,7 @@ apiVersion: v1
 kind: Pod
 metadata:
   name: "{{ include "spire-server.fullname" . }}-test-connection"
+  namespace: {{ include "spire-server.namespace" . }}
   labels:
     {{- include "spire-server.labels" . | nindent 4 }}
   annotations:

charts/spire/charts/spire-server/templates/upstream-ca-secret.yaml

@@ -5,7 +5,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ include "spire-server.upstream-ca-secret" $root }}
-  namespace: {{ $root.Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
   labels:
     {{- include "spire-server.labels" $root | nindent 4 }}
 data:

charts/spire/charts/spire-server/values.yaml

@@ -16,6 +16,7 @@ image:
 
 imagePullSecrets: []
 nameOverride: ""
+namespaceOverride: ""
 fullnameOverride: ""
 
 serviceAccount:

examples/production/README.md

@@ -0,0 +1,8 @@
+Install with something similar to:
+
+kubectl create namespace "spire-system"
+kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
+kubectl create namespace "spire-server"
+kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
+
+helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml

examples/production/values.yaml

@@ -0,0 +1,60 @@
+global:
+  telemetry:
+    prometheus:
+      enabled: true
+
+spiffe-oidc-discovery-provider:
+  enabled: true
+  insecureScheme:
+    enabled: true
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+  securityContext:
+    allowPrivilegeEscalation: false
+    runAsNonRoot: true
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop: [ALL]
+    seccompProfile:
+      type: RuntimeDefault
+
+spire-server:
+  nodeAttestor:
+    k8sPsat:
+      serviceAccountAllowList: ["spire-system:spire-agent"]
+  notifier:
+    k8sbundle:
+      namespace: spire-system
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+  securityContext:
+    allowPrivilegeEscalation: false
+    runAsNonRoot: true
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop: [ALL]
+    seccompProfile:
+      type: RuntimeDefault
+  controllerManager:
+    securityContext:
+      allowPrivilegeEscalation: false
+      runAsNonRoot: true
+      readOnlyRootFilesystem: true
+      capabilities:
+        drop: [ALL]
+      seccompProfile:
+        type: RuntimeDefault
+
+spiffe-csi-driver:
+  enabled: true
+  namespaceOverride: spire-system
+
+spire-agent:
+  enabled: true
+  namespaceOverride: spire-system
+  serviceAccount:
+    name: spire-agent
+  server:
+    namespaceOverride: spire-server