Add externalSecret support to spire-server kubeConfigs (#889)

Allow each kubeConfigs entry to reference an externally-managed Secret
(externalSecret{name,key}) instead of embedding the kubeconfig in values.
Entries may reference different Secrets and mix inline with external ones.
The kubeconfigs volume becomes a projected volume; consumer mount paths are
unchanged. Each entry must set exactly one of kubeConfig, kubeConfigBase64,
or externalSecret.

Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>

tests/unit/spire_test.go

@@ -257,4 +257,35 @@ spiffe-oidc-discovery-provider:
 			Expect(serverCM).Should(ContainSubstring(`"jwt_issuer": "https://oidc-discovery.example.org"`))
 		})
 	})
+	Describe("spire-server.kubeConfigs", func() {
+		secretTmpl := "spire/charts/spire-server/templates/kubeconfig-secret.yaml"
+		serverTmpl := "spire/charts/spire-server/templates/server-resource.yaml"
+		It("inline entry generates a Secret and a projected volume source referencing it", func() {
+			objs, err := ValueStringRender(chart, `
+spire-server:
+  kubeConfigs:
+    clustera:
+      kubeConfig: |
+        apiVersion: v1
+        kind: Config
+`)
+			Expect(err).Should(Succeed())
+			Expect(objs[secretTmpl]).Should(ContainSubstring("kind: Secret"))
+			Expect(objs[serverTmpl]).Should(ContainSubstring("projected:"))
+			Expect(objs[serverTmpl]).Should(ContainSubstring("path: clustera"))
+		})
+		It("externalSecret entry wires a projected source and skips the generated Secret", func() {
+			objs, err := ValueStringRender(chart, `
+spire-server:
+  kubeConfigs:
+    clusterb:
+      externalSecret:
+        name: my-ext-secret
+`)
+			Expect(err).Should(Succeed())
+			Expect(objs[secretTmpl]).ShouldNot(ContainSubstring("kind: Secret"))
+			Expect(objs[serverTmpl]).Should(ContainSubstring("name: my-ext-secret"))
+			Expect(objs[serverTmpl]).Should(ContainSubstring("path: clusterb"))
+		})
+	})
 })