Add support for Vault UpstreamAuthority plugin - K8s Auth (#415)

Co-authored-by: Marco Franssen <[email protected]>

charts/spire/charts/spire-server/templates/configmap.yaml

@@ -157,6 +157,38 @@ plugins:
   {{- end }}
   {{- end }}
 
+  {{- with .Values.upstreamAuthority.vault }}
+  {{- if eq (.enabled | toString) "true" }}
+  {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
+  UpstreamAuthority:
+    vault:
+      plugin_data:
+        vault_addr: {{ .vaultAddr | quote }}
+        pki_mount_point: {{ .pkiMountPoint | quote }}
+        insecure_skip_verify: {{ .insecureSkipVerify }}
+        {{- if ne (.insecureSkipVerify | toString) "true" }}
+        ca_cert_path: "/run/spire/vault-upstream/ca.crt"
+        {{- end }}
+        {{- if ne .namespace "" }}
+        namespace: {{ .namespace | quote }}
+        {{- end }}
+
+        {{- $vaultAuthMethodUsed := 0 }}
+        {{- with .k8sAuth }}
+        {{- if eq (.enabled | toString) "true" }}
+        {{- $vaultAuthMethodUsed = add1 $vaultAuthMethodUsed }}
+        k8s_auth:
+          k8s_auth_mount_point: {{ .k8sAuthMountPoint | quote }}
+          k8s_auth_role_name: {{ .k8sAuthRoleName | quote }}
+          token_path: "/var/run/secrets/tokens/spire-server"
+        {{- end }}
+        {{- end }}
+        {{- if gt $vaultAuthMethodUsed 1 }}
+        {{- fail "You can only enable a single authentication mechanism to an upstream Vault." }}
+        {{- end }}
+  {{- end }}
+  {{- end }}  
+
   {{- with .Values.upstreamAuthority.awsPCA }}
   {{- if eq (.enabled | toString) "true" }}
   {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}

charts/spire/charts/spire-server/templates/statefulset.yaml

@@ -170,7 +170,19 @@ spec:
               subPath: policy.json
               readOnly: true
             {{ end }}
-            {{ end }}
+            {{- end }}
+            {{- with .Values.upstreamAuthority.vault }}
+            {{- if eq (.enabled | toString) "true" }}
+            {{- if eq (.k8sAuth.enabled | toString) "true" }}
+            - name: spire-psat
+              mountPath: /var/run/secrets/tokens
+            {{- end }}
+            {{- if ne (.insecureSkipVerify | toString) "true" }}
+            - name: vault-ca
+              mountPath: /run/spire/vault-upstream
+            {{- end }}
+            {{- end }}
+            {{- end }}
             {{- if gt (len .Values.extraVolumeMounts) 0 }}
             {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
             {{- end }}
@@ -357,6 +369,33 @@ spec:
             path: {{ .Values.persistence.hostPath }}
             type: Directory
         {{- end }}
+        {{- with .Values.upstreamAuthority.vault }}
+        {{- if eq (.enabled | toString) "true" }}
+        {{- if ne (.insecureSkipVerify | toString) "true" }}
+        {{- if eq (.caCert.type | lower) "configmap" }}
+        - name: vault-ca
+          configMap:
+            name: {{ .caCert.name }}
+        {{- else if eq (.caCert.type | lower) "secret" }}
+        - name: vault-ca
+          secret:
+            secretName: {{ .caCert.name }}
+            optional: false
+        {{- end }}
+        {{- end -}}
+        {{- if eq (.k8sAuth.enabled | toString) "true" }}
+        - name: spire-psat
+          projected:
+            sources:
+            - serviceAccountToken:
+                path: spire-server
+                expirationSeconds: {{ .k8sAuth.token.expiry }}
+                {{- if ne .k8sAuth.token.audience "" }}
+                audience: {{ .k8sAuth.token.audience }}
+                {{- end }}
+        {{- end }}
+        {{- end -}}
+        {{- end -}}
   {{- if eq .Values.persistence.type "pvc" }}
   volumeClaimTemplates:
     - metadata: