Fix spire-server configmap UpstreamAuthority/aws_pca and KeyManager/a… (#489)

Current configmap template renders to a wrong KeyManager and
UpstreamAuthority configurarion when aws_kms and aws_pca are enabled and
container is crashing. The proposed changes will fix the issue.

---------

Signed-off-by: unufree <[email protected]>
Signed-off-by: unufr33 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>

charts/spire/charts/spire-server/templates/configmap.yaml

@@ -89,7 +89,7 @@ plugins:
   {{- if eq (.enabled | toString) "true" }}
   {{- $keyManagerUsed = add1 $keyManagerUsed }}
   KeyManager:
-    - aws_kms:
+    aws_kms:
       plugin_data:
         region: {{ .region | quote }}
         key_metadata_file: "/run/spire/data/aws-kms-key-metadata"
@@ -193,7 +193,7 @@ plugins:
   {{- if eq (.enabled | toString) "true" }}
   {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
   UpstreamAuthority:
-    - aws_pca:
+    aws_pca:
       plugin_data:
         region: {{ .region | quote }}
         certificate_authority_arn: {{ .certificateAuthorityARN | quote }}

tests/unit/spire_test.go

@@ -16,7 +16,7 @@ func ValueStringRender(chart *helmchart.Chart, values string) (map[string]string
 		return nil, err
 	}
 	ro := helmutil.ReleaseOptions{Name: "spire", Namespace: "spire-server", Revision: 1, IsUpgrade: false, IsInstall: true}
-	v, err = helmutil.ToRenderValues(chart, v, ro, helmutil.DefaultCapabilities);
+	v, err = helmutil.ToRenderValues(chart, v, ro, helmutil.DefaultCapabilities)
 	if err != nil {
 		return nil, err
 	}
@@ -71,4 +71,36 @@ spire-server:
 			Expect(notes).Should(ContainSubstring("join_token"))
 		})
 	})
+	Describe("spire-server.keyManager.aws_kms", func() {
+		It("plugin set ok", func() {
+			objs, err := ValueStringRender(chart, `
+spire-server:
+  keyManager:
+    awsKMS:
+      enabled: true
+      region: us-west-2
+      plugin_data: {}
+    disk:
+      enabled: false
+`)
+			Expect(err).Should(Succeed())
+			notes := objs["spire/charts/spire-server/templates/configmap.yaml"]
+			Expect(notes).Should(ContainSubstring("\"aws_kms\": {"))
+		})
+	})
+	Describe("spire-server.UpstreamAuthority.aws_pca", func() {
+		It("plugin set ok", func() {
+			objs, err := ValueStringRender(chart, `
+spire-server:
+  upstreamAuthority:
+    awsPCA:
+      enabled: true
+      region: us-west-2
+      plugin_data: {}
+`)
+			Expect(err).Should(Succeed())
+			notes := objs["spire/charts/spire-server/templates/configmap.yaml"]
+			Expect(notes).Should(ContainSubstring("\"aws_pca\": {"))
+		})
+	})
 })