Change spire-server configmap to yaml format

Signed-off-by: Marco Franssen <[email protected]>
2023-04-17 11:52:45 +02:00
parent ad8bee0d3f
commit 1d72b57260
1 changed files with 102 additions and 118 deletions
@@ -1,5 +1,105 @@
+{{- define "spire-server.yaml-config" -}}
 {{- $root := . }}
-{{- $namespace := include "spire-server.namespace" . }}
+server:
+  bind_address: "0.0.0.0"
+  bind_port: "8081"
+  trust_domain: {{ include "spire-server.trust-domain" . | quote }}
+  data_dir: "/run/spire/data"
+  log_level: {{ .Values.logLevel | quote }}
+  jwt_issuer: {{ .Values.jwtIssuer | quote }}
+
+  ca_key_type: {{ .Values.caKeyType | quote }}
+  ca_ttl: {{ .Values.caTTL | quote }}
+
+  default_x509_svid_ttl: {{ .Values.defaultX509SvidTTL | quote }}
+  default_jwt_svid_ttl: {{ .Values.defaultJwtSvidTTL | quote }}
+
+  ca_subject:
+    {{- with .Values.ca_subject }}
+    - country: [{{ .country | quote }}]
+      organization: [{{ .organization | quote }}]
+      common_name: {{ .common_name | quote }}
+    {{- end }}
+
+  {{- with .Values.federation }}
+  {{- if eq (.enabled | toString) "true" }}
+  federation:
+    bundle_endpoint:
+      - {{ .bundleEndpoint | toYaml | nindent 8 }}
+  {{- end }}
+  {{- end }}
+
+plugins:
+  DataStore:
+    - sql:
+        plugin_data:
+          database_type: "sqlite3"
+          connection_string: "/run/spire/data/datastore.sqlite3"
+
+  {{- with .Values.nodeAttestor.k8sPsat }}
+  {{- if eq (.enabled | toString) "true" }}
+  NodeAttestor:
+    - k8s_psat:
+        plugin_data:
+          clusters:
+            {{ include "spire-server.cluster-name" $root }}:
+              service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
+  {{- end }}
+  {{- end }}
+
+  KeyManager:
+    - disk:
+        plugin_data:
+          keys_path: "/run/spire/data/keys.json"
+
+  Notifier:
+    - k8sbundle:
+        plugin_data:
+          namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }}
+          config_map: {{ include "spire-server.bundle-configmap" . | quote }}
+
+  {{- with .Values.upstreamAuthority.disk }}
+  {{- if eq (.enabled | toString) "true" }}
+  UpstreamAuthority:
+    - disk:
+        plugin_data:
+          cert_file_path: "/run/spire/upstream_ca/tls.crt"
+          key_file_path: "/run/spire/upstream_ca/tls.key"
+          {{- if ne .secret.data.bundle "" }}
+          bundle_file_path: "/run/spire/upstream_ca/bundle.crt"
+          {{- end }}
+  {{- end }}
+  {{- end }}
+
+  {{- with .Values.upstreamAuthority.certManager }}
+  {{- if eq (.enabled | toString) "true" }}
+  UpstreamAuthority:
+    - cert-manager:
+        plugin_data:
+          issuer_name: {{ .issuer_name | quote }}
+          issuer_kind: {{ .issuer_kind | quote }}
+          issuer_group: {{ .issuer_group | quote }}
+          namespace: {{ default $root.Release.Namespace .namespace | quote }}
+          {{- if ne .kube_config_file "" }}
+          kube_config_file: {{ .kube_config_file | quote }}
+          {{- end }}
+  {{- end }}
+  {{- end }}
+
+health_checks:
+  listener_enabled: true
+  bind_address: "0.0.0.0"
+  bind_port: "8080"
+  live_path: "/live"
+  ready_path: "/ready"
+
+{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
+telemetry:
+  - Prometheus:
+      - host: "0.0.0.0"
+        port: 9988
+{{- end }}
+{{- end }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -7,120 +107,4 @@ metadata:
  namespace: {{ include "spire-server.namespace" . }}
 data:
  server.conf: |
-    server {
-      bind_address = "0.0.0.0"
-      bind_port = "8081"
-      trust_domain = {{ include "spire-server.trust-domain" . | quote }}
-      data_dir = "/run/spire/data"
-      log_level = {{ .Values.logLevel | quote }}
-
-      jwt_issuer = {{ .Values.jwtIssuer | quote }}
-
-      ca_key_type = {{ .Values.caKeyType | quote }}
-      ca_ttl = {{ .Values.caTTL | quote }}
-
-      default_x509_svid_ttl = {{ .Values.defaultX509SvidTTL | quote }}
-      default_jwt_svid_ttl = {{ .Values.defaultJwtSvidTTL | quote }}
-
-      ca_subject = {
-        {{- with .Values.ca_subject }}
-        country = [{{ .country | quote }}],
-        organization = [{{ .organization | quote }}],
-        common_name = {{ .common_name | quote }},
-        {{- end }}
-      }
-
-      {{- with .Values.federation }}
-      {{- if eq (.enabled | toString) "true" }}
-      federation {
-        bundle_endpoint {
-          address = "{{ .bundleEndpoint.address }}"
-          port = {{ .bundleEndpoint.port }}
-        }
-      }
-      {{- end }}
-      {{- end }}
-    }
-
-    plugins {
-      DataStore "sql" {
-        plugin_data {
-          database_type = "sqlite3"
-          connection_string = "/run/spire/data/datastore.sqlite3"
-        }
-      }
-
-      {{- with .Values.nodeAttestor.k8sPsat }}
-      {{- if eq (.enabled | toString) "true" }}
-      NodeAttestor "k8s_psat" {
-        plugin_data {
-          clusters = {
-            {{ include "spire-server.cluster-name" $root | quote }} = {
-              service_account_allow_list = {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
-            }
-          }
-        }
-      }
-      {{- end }}
-      {{- end }}
-
-      KeyManager "disk" {
-        plugin_data {
-          keys_path = "/run/spire/data/keys.json"
-        }
-      }
-
-      Notifier "k8sbundle" {
-        plugin_data {
-          namespace = {{ .Values.notifier.k8sbundle.namespace | default $namespace | quote }}
-          config_map = {{ include "spire-server.bundle-configmap" . | quote }}
-        }
-      }
-
-      {{- with .Values.upstreamAuthority.disk }}
-      {{- if eq (.enabled | toString) "true" }}
-      UpstreamAuthority "disk" {
-        plugin_data {
-          cert_file_path = "/run/spire/upstream_ca/tls.crt"
-          key_file_path = "/run/spire/upstream_ca/tls.key"
-          {{- if ne .secret.data.bundle "" }}
-          bundle_file_path = "/run/spire/upstream_ca/bundle.crt"
-          {{- end }}
-        }
-      }
-      {{- end }}
-      {{- end }}
-
-      {{- with .Values.upstreamAuthority.certManager }}
-      {{- if eq (.enabled | toString) "true" }}
-      UpstreamAuthority "cert-manager" {
-        plugin_data {
-          issuer_name = {{ .issuer_name | quote }}
-          issuer_kind = {{ .issuer_kind | quote }}
-          issuer_group = {{ .issuer_group | quote }}
-          namespace = {{ default $root.Release.Namespace .namespace | quote }}
-          {{- if ne .kube_config_file "" }}
-          kube_config_file = {{ .kube_config_file | quote }}
-          {{- end }}
-        }
-      }
-      {{- end }}
-      {{- end }}
-    }
-
-    health_checks {
-      listener_enabled = true
-      bind_address = "0.0.0.0"
-      bind_port = "8080"
-      live_path = "/live"
-      ready_path = "/ready"
-    }
-
-    {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
-    telemetry {
-      Prometheus {
-        host = "0.0.0.0"
-        port = 9988
-      }
-    }
-    {{- end }}
+    {{- include "spire-server.yaml-config" . | fromYaml | toPrettyJson | nindent 4 }}