From 1d72b57260b5d73a04f9ca5a43bb4f28c2c37650 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Sat, 11 Mar 2023 10:28:22 +0100 Subject: [PATCH] Change spire-server configmap to yaml format Signed-off-by: Marco Franssen --- .../spire-server/templates/configmap.yaml | 220 ++++++++---------- 1 file changed, 102 insertions(+), 118 deletions(-) diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index d1143f5..11e8a66 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -1,5 +1,105 @@ +{{- define "spire-server.yaml-config" -}} {{- $root := . }} -{{- $namespace := include "spire-server.namespace" . }} +server: + bind_address: "0.0.0.0" + bind_port: "8081" + trust_domain: {{ include "spire-server.trust-domain" . | quote }} + data_dir: "/run/spire/data" + log_level: {{ .Values.logLevel | quote }} + jwt_issuer: {{ .Values.jwtIssuer | quote }} + + ca_key_type: {{ .Values.caKeyType | quote }} + ca_ttl: {{ .Values.caTTL | quote }} + + default_x509_svid_ttl: {{ .Values.defaultX509SvidTTL | quote }} + default_jwt_svid_ttl: {{ .Values.defaultJwtSvidTTL | quote }} + + ca_subject: + {{- with .Values.ca_subject }} + - country: [{{ .country | quote }}] + organization: [{{ .organization | quote }}] + common_name: {{ .common_name | quote }} + {{- end }} + + {{- with .Values.federation }} + {{- if eq (.enabled | toString) "true" }} + federation: + bundle_endpoint: + - {{ .bundleEndpoint | toYaml | nindent 8 }} + {{- end }} + {{- end }} + +plugins: + DataStore: + - sql: + plugin_data: + database_type: "sqlite3" + connection_string: "/run/spire/data/datastore.sqlite3" + + {{- with .Values.nodeAttestor.k8sPsat }} + {{- if eq (.enabled | toString) "true" }} + NodeAttestor: + - k8s_psat: + plugin_data: + clusters: + {{ include "spire-server.cluster-name" $root }}: + service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }} + {{- end }} + {{- end }} + + KeyManager: + - disk: + plugin_data: + keys_path: "/run/spire/data/keys.json" + + Notifier: + - k8sbundle: + plugin_data: + namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }} + config_map: {{ include "spire-server.bundle-configmap" . | quote }} + + {{- with .Values.upstreamAuthority.disk }} + {{- if eq (.enabled | toString) "true" }} + UpstreamAuthority: + - disk: + plugin_data: + cert_file_path: "/run/spire/upstream_ca/tls.crt" + key_file_path: "/run/spire/upstream_ca/tls.key" + {{- if ne .secret.data.bundle "" }} + bundle_file_path: "/run/spire/upstream_ca/bundle.crt" + {{- end }} + {{- end }} + {{- end }} + + {{- with .Values.upstreamAuthority.certManager }} + {{- if eq (.enabled | toString) "true" }} + UpstreamAuthority: + - cert-manager: + plugin_data: + issuer_name: {{ .issuer_name | quote }} + issuer_kind: {{ .issuer_kind | quote }} + issuer_group: {{ .issuer_group | quote }} + namespace: {{ default $root.Release.Namespace .namespace | quote }} + {{- if ne .kube_config_file "" }} + kube_config_file: {{ .kube_config_file | quote }} + {{- end }} + {{- end }} + {{- end }} + +health_checks: + listener_enabled: true + bind_address: "0.0.0.0" + bind_port: "8080" + live_path: "/live" + ready_path: "/ready" + +{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }} +telemetry: + - Prometheus: + - host: "0.0.0.0" + port: 9988 +{{- end }} +{{- end }} apiVersion: v1 kind: ConfigMap metadata: @@ -7,120 +107,4 @@ metadata: namespace: {{ include "spire-server.namespace" . }} data: server.conf: | - server { - bind_address = "0.0.0.0" - bind_port = "8081" - trust_domain = {{ include "spire-server.trust-domain" . | quote }} - data_dir = "/run/spire/data" - log_level = {{ .Values.logLevel | quote }} - - jwt_issuer = {{ .Values.jwtIssuer | quote }} - - ca_key_type = {{ .Values.caKeyType | quote }} - ca_ttl = {{ .Values.caTTL | quote }} - - default_x509_svid_ttl = {{ .Values.defaultX509SvidTTL | quote }} - default_jwt_svid_ttl = {{ .Values.defaultJwtSvidTTL | quote }} - - ca_subject = { - {{- with .Values.ca_subject }} - country = [{{ .country | quote }}], - organization = [{{ .organization | quote }}], - common_name = {{ .common_name | quote }}, - {{- end }} - } - - {{- with .Values.federation }} - {{- if eq (.enabled | toString) "true" }} - federation { - bundle_endpoint { - address = "{{ .bundleEndpoint.address }}" - port = {{ .bundleEndpoint.port }} - } - } - {{- end }} - {{- end }} - } - - plugins { - DataStore "sql" { - plugin_data { - database_type = "sqlite3" - connection_string = "/run/spire/data/datastore.sqlite3" - } - } - - {{- with .Values.nodeAttestor.k8sPsat }} - {{- if eq (.enabled | toString) "true" }} - NodeAttestor "k8s_psat" { - plugin_data { - clusters = { - {{ include "spire-server.cluster-name" $root | quote }} = { - service_account_allow_list = {{ include "spire-server.serviceAccountAllowedList" $root | trim }} - } - } - } - } - {{- end }} - {{- end }} - - KeyManager "disk" { - plugin_data { - keys_path = "/run/spire/data/keys.json" - } - } - - Notifier "k8sbundle" { - plugin_data { - namespace = {{ .Values.notifier.k8sbundle.namespace | default $namespace | quote }} - config_map = {{ include "spire-server.bundle-configmap" . | quote }} - } - } - - {{- with .Values.upstreamAuthority.disk }} - {{- if eq (.enabled | toString) "true" }} - UpstreamAuthority "disk" { - plugin_data { - cert_file_path = "/run/spire/upstream_ca/tls.crt" - key_file_path = "/run/spire/upstream_ca/tls.key" - {{- if ne .secret.data.bundle "" }} - bundle_file_path = "/run/spire/upstream_ca/bundle.crt" - {{- end }} - } - } - {{- end }} - {{- end }} - - {{- with .Values.upstreamAuthority.certManager }} - {{- if eq (.enabled | toString) "true" }} - UpstreamAuthority "cert-manager" { - plugin_data { - issuer_name = {{ .issuer_name | quote }} - issuer_kind = {{ .issuer_kind | quote }} - issuer_group = {{ .issuer_group | quote }} - namespace = {{ default $root.Release.Namespace .namespace | quote }} - {{- if ne .kube_config_file "" }} - kube_config_file = {{ .kube_config_file | quote }} - {{- end }} - } - } - {{- end }} - {{- end }} - } - - health_checks { - listener_enabled = true - bind_address = "0.0.0.0" - bind_port = "8080" - live_path = "/live" - ready_path = "/ready" - } - - {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }} - telemetry { - Prometheus { - host = "0.0.0.0" - port = 9988 - } - } - {{- end }} + {{- include "spire-server.yaml-config" . | fromYaml | toPrettyJson | nindent 4 }}