Add support for spire-controller-manager

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/charts/spire-server/templates/_helpers.tpl

@@ -85,6 +85,10 @@ Create the name of the service account to use
 {{- end -}}
 {{- end }}
 
+{{- define "spire-controller-manager.fullname" -}}
+{{ include "spire-server.fullname" . | trimSuffix "-server" }}-controller-manager
+{{- end }}
+
 {{- define "spire-k8s-workload-registrar.fullname" -}}
 {{ include "spire-server.fullname" . | trimSuffix "-server" }}-k8s-workload-registrar
 {{- end }}

charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml

@@ -0,0 +1,32 @@
+{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "spire-controller-manager.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+data:
+  controller-manager-config.yaml: |
+    apiVersion: spire.spiffe.io/v1alpha1
+    kind: ControllerManagerConfig
+    metadata:
+      name: {{ include "spire-controller-manager.fullname" . }}
+      namespace: {{ .Release.Namespace }}
+      labels:
+        {{- include "spire-server.labels" . | nindent 8 }}
+    metrics:
+      bindAddress: 127.0.0.1:8082
+    healthProbe:
+      bindAddress: 127.0.0.1:8083
+    leaderElection:
+      leaderElect: true
+      resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
+      resourceNamespace: {{ .Release.Namespace }}
+    clusterName: {{ .Values.clusterName }}
+    trustDomain: {{ .Values.trustDomain }}
+    ignoreNamespaces:
+      - kube-system
+      - kube-public
+      - {{ .Release.Namespace }}
+      - local-path-storage
+    spireServerSocketPath: {{ .Values.socketPath | quote }}
+{{- end }}

charts/spire/charts/spire-server/templates/controller-manager-roles.yaml

@@ -0,0 +1,80 @@
+{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "spire-controller-manager.fullname" . }}-leader-election
+  namespace: {{ .Release.Namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["create", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "spire-controller-manager.fullname" . }}-leader-election
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "spire-controller-manager.fullname" . }}-leader-election
+subjects:
+- kind: ServiceAccount
+  name: {{ include "spire-server.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "spire-controller-manager.fullname" . }}
+rules:
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations"]
+    verbs: ["get", "list", "patch", "watch"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["spire.spiffe.io"]
+    resources: ["clusterfederatedtrustdomains"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["spire.spiffe.io"]
+    resources: ["clusterfederatedtrustdomains/finalizers"]
+    verbs: ["update"]
+  - apiGroups: ["spire.spiffe.io"]
+    resources: ["clusterfederatedtrustdomains/status"]
+    verbs: ["get", "patch", "update"]
+  - apiGroups: ["spire.spiffe.io"]
+    resources: ["clusterspiffeids"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["spire.spiffe.io"]
+    resources: ["clusterspiffeids/finalizers"]
+    verbs: ["update"]
+  - apiGroups: ["spire.spiffe.io"]
+    resources: ["clusterspiffeids/status"]
+    verbs: ["get", "patch", "update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "spire-controller-manager.fullname" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "spire-controller-manager.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "spire-server.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}

charts/spire/charts/spire-server/templates/controller-manager-service.yaml

@@ -0,0 +1,22 @@
+{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "spire-controller-manager.fullname" . }}-webhook
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
+  {{- with .Values.controllerManager.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 8 }}
+  {{- end }}
+spec:
+  type: {{ .Values.controllerManager.service.type }}
+  ports:
+    - name: https
+      port: {{ .Values.controllerManager.service.port }}
+      targetPort: https
+      protocol: TCP
+  selector:
+    {{- include "spire-server.selectorLabels" . | nindent 4 }}
+{{- end }}

charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml

@@ -0,0 +1,35 @@
+{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: {{ include "spire-controller-manager.fullname" . }}-webhook
+webhooks:
+  - admissionReviewVersions: ["v1"]
+    clientConfig:
+      service:
+        name: {{ include "spire-controller-manager.fullname" . }}-webhook
+        namespace: {{ .Release.Namespace }}
+        path: /validate-spire-spiffe-io-v1alpha1-clusterfederatedtrustdomain
+    failurePolicy: Fail
+    name: vclusterfederatedtrustdomain.kb.io
+    rules:
+      - apiGroups: ["spire.spiffe.io"]
+        apiVersions: ["v1alpha1"]
+        operations: ["CREATE", "UPDATE"]
+        resources: ["clusterfederatedtrustdomains"]
+    sideEffects: None
+  - admissionReviewVersions: ["v1"]
+    clientConfig:
+      service:
+        name: {{ include "spire-controller-manager.fullname" . }}-webhook
+        namespace: {{ .Release.Namespace }}
+        path: /validate-spire-spiffe-io-v1alpha1-clusterspiffeid
+    failurePolicy: Fail
+    name: vclusterspiffeid.kb.io
+    rules:
+      - apiGroups: ["spire.spiffe.io"]
+        apiVersions: ["v1alpha1"]
+        operations: ["CREATE", "UPDATE"]
+        resources: ["clusterspiffeids"]
+    sideEffects: None
+{{- end }}

charts/spire/charts/spire-server/templates/statefulset.yaml

@@ -99,6 +99,38 @@ spec:
               mountPath: /run/spire/k8s-workload-registrar/config
               readOnly: true
         {{- end }}
+        {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
+        - name: spire-controller-manager
+          securityContext:
+            {{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
+          image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image) }}
+          imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }}
+          args:
+            - --config=controller-manager-config.yaml
+          ports:
+            - name: https
+              containerPort: 9443
+              protocol: TCP
+          # TODO: implement probes
+          # livenessProbe:
+          #   httpGet:
+          #     path: /
+          #     port: https
+          # readinessProbe:
+          #   httpGet:
+          #     path: /
+          #     port: https
+          resources:
+            {{- toYaml .Values.controllerManager.resources | nindent 12 }}
+          volumeMounts:
+            - name: spire-server-socket
+              mountPath: /run/spire/server-sockets
+              readOnly: true
+            - name: controller-manager-config
+              mountPath: /controller-manager-config.yaml
+              subPath: controller-manager-config.yaml
+              readOnly: true
+        {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
@@ -133,6 +165,11 @@ spec:
           configMap:
             name: {{ include "spire-k8s-workload-registrar.fullname" . }}
         {{- end }}
+        {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
+        - name: controller-manager-config
+          configMap:
+            name: {{ include "spire-controller-manager.fullname" . }}
+        {{- end }}
   volumeClaimTemplates:
     {{- if eq (.Values.dataStorage.enabled | toString) "true" }}
     - metadata: