From 3cc8955429f491747a744b2950962a5356405524 Mon Sep 17 00:00:00 2001
From: kfox1111 <Kevin.Fox@pnnl.gov>
Date: Mon, 17 Apr 2023 23:54:46 -0700
Subject: [PATCH] Move reusable macros to root chart (#218)

This patch adds the start of a library to help reduce code duplication.
It will be split out to its own library chart at the same time the other
charts are split out.

---------

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>
---
 .../spiffe-csi-driver/templates/_helpers.tpl  | 13 ------
 .../templates/daemonset.yaml                  |  4 +-
 .../templates/_helpers.tpl                    | 35 ---------------
 .../templates/configmap.yaml                  |  4 +-
 .../templates/deployment.yaml                 |  6 +--
 .../templates/tests/test-connection.yaml      |  2 +-
 .../charts/spire-agent/templates/_helpers.tpl | 35 ---------------
 .../spire-agent/templates/configmap.yaml      |  4 +-
 .../spire-agent/templates/daemonset.yaml      |  6 +--
 .../spire-server/templates/_helpers.tpl       | 43 -------------------
 .../templates/bundle-configmap.yaml           |  2 +-
 .../spire-server/templates/configmap.yaml     |  6 +--
 .../controller-manager-configmap.yaml         |  4 +-
 .../templates/post-install-hook.yaml          |  2 +-
 .../templates/post-upgrade-hook.yaml          |  2 +-
 .../templates/pre-upgrade-hook.yaml           |  2 +-
 .../charts/spire-server/templates/roles.yaml  |  2 +-
 .../spire-server/templates/statefulset.yaml   |  4 +-
 .../templates/tests/test-connection.yaml      |  2 +-
 charts/spire/templates/_spire-lib.tpl         | 43 +++++++++++++++++++
 20 files changed, 69 insertions(+), 152 deletions(-)
 create mode 100644 charts/spire/templates/_spire-lib.tpl

diff --git a/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl b/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl
index 0680b9e..3df9f55 100644
--- a/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl
+++ b/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl
@@ -72,19 +72,6 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
-
-{{- define "spiffe-csi-driver.image" -}}
-{{- if eq (substr 0 7 .image.version) "sha256:" -}}
-{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
-{{- else if .appVersion -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
-{{- else if .image.version -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
-{{- else -}}
-{{- printf "%s/%s" .image.registry .image.repository -}}
-{{- end -}}
-{{- end }}
-
 {{- define "spiffe-csi-driver.agent-socket-path" -}}
 {{- print .Values.agentSocketPath }}
 {{- end }}
diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
index 59d1239..caa219f 100644
--- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
+++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
@@ -31,7 +31,7 @@ spec:
       containers:
         # This is the container which runs the SPIFFE CSI driver.
         - name: {{ .Chart.Name }}
-          image: {{ template "spiffe-csi-driver.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args: [
             "-workload-api-socket-dir", "/spire-agent-socket",
@@ -71,7 +71,7 @@ spec:
         # of all the little details required to register a CSI driver with
         # the kubelet.
         - name: node-driver-registrar
-          image: {{ template "spiffe-csi-driver.image" .Values.nodeDriverRegistrar }}
+          image: {{ template "spire-lib.image" .Values.nodeDriverRegistrar }}
           imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }}
           args: [
             "-csi-address", "/spiffe-csi/csi.sock",
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
index 139e151..72b9077 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
@@ -82,42 +82,7 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
-{{- define "spiffe-oidc-discovery-provider.image" -}}
-{{- if eq (substr 0 7 .image.version) "sha256:" -}}
-{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
-{{- else if .appVersion -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
-{{- else if .image.version -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
-{{- else -}}
-{{- printf "%s/%s" .image.registry .image.repository -}}
-{{- end -}}
-{{- end }}
-
 {{- define "spiffe-oidc-discovery-provider.workload-api-socket-path" -}}
 {{- printf "/spiffe-workload-api/%s" .Values.agentSocketName }}
 {{- end }}
 
-{{- define "spiffe-oidc-discovery-provider.cluster-name" }}
-{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
-{{- .Values.global.spire.clusterName }}
-{{- else }}
-{{- .Values.clusterName }}
-{{- end }}
-{{- end }}
-
-{{- define "spiffe-oidc-discovery-provider.trust-domain" }}
-{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
-{{- .Values.global.spire.trustDomain }}
-{{- else }}
-{{- .Values.trustDomain }}
-{{- end }}
-{{- end }}
-
-{{- define "spiffe-oidc-discovery-provider.cluster-domain" }}
-{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
-{{- .Values.global.k8s.clusterDomain }}
-{{- else }}
-{{- .Values.clusterDomain }}
-{{- end }}
-{{- end }}
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml
index 6e03daf..e4df285 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml
@@ -7,7 +7,7 @@ log_level: {{ .Values.config.logLevel | quote }}
 domains:
   - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}"
   - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}"
-  - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}"
+  - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}"
   {{- if gt (len .Values.config.domains) 0 }}
   {{- .Values.config.domains | toYaml | nindent 2 }}
   {{- end }}
@@ -25,7 +25,7 @@ acme:
 
 workload_api:
   socket_path: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | quote }}
-  trust_domain: {{ include "spiffe-oidc-discovery-provider.trust-domain" . | quote }}
+  trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
 
 health_checks:
   bind_port: "8008"
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml
index 7516df6..f1af485 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml
@@ -34,7 +34,7 @@ spec:
         - name: {{ .Chart.Name }}
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: {{ template "spiffe-oidc-discovery-provider.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:
             - -config
@@ -75,7 +75,7 @@ spec:
         - name: nginx
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: {{ template "spiffe-oidc-discovery-provider.image" .Values.insecureScheme.nginx }}
+          image: {{ template "spire-lib.image" .Values.insecureScheme.nginx }}
           imagePullPolicy: {{ .Values.insecureScheme.nginx.image.pullPolicy }}
           ports:
             - containerPort: 8080
@@ -97,7 +97,7 @@ spec:
         - name: nginx-exporter
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: {{ template "spiffe-oidc-discovery-provider.image" .Values.telemetry.prometheus.nginxExporter }}
+          image: {{ template "spire-lib.image" .Values.telemetry.prometheus.nginxExporter }}
           imagePullPolicy: {{ .Values.telemetry.prometheus.nginxExporter.image.pullPolicy }}
           args:
           - -nginx.scrape-uri=http://127.0.0.1:8080/stub_status
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
index e687868..3f11d11 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
@@ -26,7 +26,7 @@ spec:
     - name: curl-service-name-namespace-svc-cluster-local
       image: cgr.dev/chainguard/bash:latest
       command: ['curl']
-      args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
+      args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     {{- if .Values.ingress.enabled }}
diff --git a/charts/spire/charts/spire-agent/templates/_helpers.tpl b/charts/spire/charts/spire-agent/templates/_helpers.tpl
index ff43724..4fa7ee7 100644
--- a/charts/spire/charts/spire-agent/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-agent/templates/_helpers.tpl
@@ -90,18 +90,6 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
-{{- define "spire-agent.image" -}}
-{{- if eq (substr 0 7 .image.version) "sha256:" -}}
-{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
-{{- else if .appVersion -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
-{{- else if .image.version -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
-{{- else -}}
-{{- printf "%s/%s" .image.registry .image.repository -}}
-{{- end -}}
-{{- end }}
-
 {{- define "spire-agent.server-address" }}
 {{- if .Values.server.address }}
 {{- .Values.server.address }}
@@ -114,26 +102,3 @@ Create the name of the service account to use
 {{- print .Values.socketPath }}
 {{- end }}
 
-{{- define "spire-agent.cluster-name" }}
-{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
-{{- .Values.global.spire.clusterName }}
-{{- else }}
-{{- .Values.clusterName }}
-{{- end }}
-{{- end }}
-
-{{- define "spire-agent.trust-domain" }}
-{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
-{{- .Values.global.spire.trustDomain }}
-{{- else }}
-{{- .Values.trustDomain }}
-{{- end }}
-{{- end }}
-
-{{- define "spire-agent.bundle-configmap" }}
-{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
-{{- .Values.global.spire.bundleConfigMap }}
-{{- else }}
-{{- .Values.bundleConfigMap }}
-{{- end }}
-{{- end }}
diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml
index 15cbd3b..9f8d70d 100644
--- a/charts/spire/charts/spire-agent/templates/configmap.yaml
+++ b/charts/spire/charts/spire-agent/templates/configmap.yaml
@@ -6,13 +6,13 @@ agent:
   server_port: {{ .Values.server.port | quote }}
   socket_path: {{ include "spire-agent.socket-path" . | quote }}
   trust_bundle_path: "/run/spire/bundle/bundle.crt"
-  trust_domain: {{ include "spire-agent.trust-domain" . | quote }}
+  trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
 
 plugins:
   NodeAttestor:
     - k8s_psat:
         plugin_data:
-          cluster: {{ include "spire-agent.cluster-name" . | quote }}
+          cluster: {{ include "spire-lib.cluster-name" . | quote }}
 
   KeyManager:
     - memory:
diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml
index 10c2603..5f76bee 100644
--- a/charts/spire/charts/spire-agent/templates/daemonset.yaml
+++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml
@@ -38,7 +38,7 @@ spec:
           # This is a small image with wait-for-it, choose whatever image
           # you prefer that waits for a service to be up. This image is built
           # from https://github.com/vishnubob/wait-for-it
-          image: {{ template "spire-agent.image" .Values.waitForIt }}
+          image: {{ template "spire-lib.image" .Values.waitForIt }}
           imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
           args: ["-t", "30", "-h", "{{ include "spire-agent.server-address" . | trim }}", "-p", {{ .Values.server.port | quote }}]
           resources:
@@ -48,7 +48,7 @@ spec:
         {{- end }}
       containers:
         - name: {{ .Chart.Name }}
-          image: {{ template "spire-agent.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args: ["-config", "/run/spire/config/agent.conf"]
           ports:
@@ -100,7 +100,7 @@ spec:
             name: {{ include "spire-agent.fullname" . }}
         - name: spire-bundle
           configMap:
-            name: {{ include "spire-agent.bundle-configmap" . }}
+            name: {{ include "spire-lib.bundle-configmap" . }}
         - name: spire-token
           projected:
             sources:
diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl
index 809aeb3..952d606 100644
--- a/charts/spire/charts/spire-server/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-server/templates/_helpers.tpl
@@ -82,18 +82,6 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
-{{- define "spire-server.image" -}}
-{{- if eq (substr 0 7 .image.version) "sha256:" -}}
-{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
-{{- else if .appVersion -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
-{{- else if .image.version -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
-{{- else -}}
-{{- printf "%s/%s" .image.registry .image.repository -}}
-{{- end -}}
-{{- end }}
-
 {{- define "spire-server.upstream-ca-secret" -}}
 {{- $root := . }}
 {{- with .Values.upstreamAuthority.disk -}}
@@ -117,34 +105,3 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
-{{- define "spire-server.cluster-name" }}
-{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
-{{- .Values.global.spire.clusterName }}
-{{- else }}
-{{- .Values.clusterName }}
-{{- end }}
-{{- end }}
-
-{{- define "spire-server.trust-domain" }}
-{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
-{{- .Values.global.spire.trustDomain }}
-{{- else }}
-{{- .Values.trustDomain }}
-{{- end }}
-{{- end }}
-
-{{- define "spire-server.bundle-configmap" }}
-{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
-{{- .Values.global.spire.bundleConfigMap }}
-{{- else }}
-{{- .Values.bundleConfigMap }}
-{{- end }}
-{{- end }}
-
-{{- define "spire-server.cluster-domain" -}}
-{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
-{{- .Values.global.k8s.clusterDomain }}
-{{- else }}
-{{- .Values.clusterDomain }}
-{{- end }}
-{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/bundle-configmap.yaml b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml
index bbc2fb5..ea4224e 100644
--- a/charts/spire/charts/spire-server/templates/bundle-configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml
@@ -2,5 +2,5 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "spire-server.bundle-configmap" . }}
+  name: {{ include "spire-lib.bundle-configmap" . }}
   namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml
index 11e8a66..11dc84e 100644
--- a/charts/spire/charts/spire-server/templates/configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/configmap.yaml
@@ -3,7 +3,7 @@
 server:
   bind_address: "0.0.0.0"
   bind_port: "8081"
-  trust_domain: {{ include "spire-server.trust-domain" . | quote }}
+  trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
   data_dir: "/run/spire/data"
   log_level: {{ .Values.logLevel | quote }}
   jwt_issuer: {{ .Values.jwtIssuer | quote }}
@@ -42,7 +42,7 @@ plugins:
     - k8s_psat:
         plugin_data:
           clusters:
-            {{ include "spire-server.cluster-name" $root }}:
+            {{ include "spire-lib.cluster-name" $root }}:
               service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
   {{- end }}
   {{- end }}
@@ -56,7 +56,7 @@ plugins:
     - k8sbundle:
         plugin_data:
           namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }}
-          config_map: {{ include "spire-server.bundle-configmap" . | quote }}
+          config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
 
   {{- with .Values.upstreamAuthority.disk }}
   {{- if eq (.enabled | toString) "true" }}
diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
index 0509a56..333a070 100644
--- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
@@ -22,8 +22,8 @@ data:
       resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
       resourceNamespace: {{ include "spire-server.namespace" . }}
     validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook
-    clusterName: {{ include "spire-server.cluster-name" . }}
-    trustDomain: {{ include "spire-server.trust-domain" . }}
+    clusterName: {{ include "spire-lib.cluster-name" . }}
+    trustDomain: {{ include "spire-lib.trust-domain" . }}
     ignoreNamespaces:
       {{- with .Values.controllerManager.ignoreNamespaces }}
       {{- toYaml . | nindent 6 }}
diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml
index 1279198..53d2e3f 100644
--- a/charts/spire/charts/spire-server/templates/post-install-hook.yaml
+++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml
@@ -63,7 +63,7 @@ spec:
       - name: post-install-job
         securityContext:
           {{- toYaml .Values.securityContext | nindent 10 }}
-        image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
+        image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
         command:
         - /bin/sh
         - -c
diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
index db0129a..b28bdc2 100644
--- a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
@@ -63,7 +63,7 @@ spec:
       - name: post-upgrade-job
         securityContext:
           {{- toYaml .Values.securityContext | nindent 10 }}
-        image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
+        image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
         command:
         - /bin/sh
         - -c
diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
index e07f9d9..2639632 100644
--- a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
@@ -63,7 +63,7 @@ spec:
       - name: post-install-job
         securityContext:
           {{- toYaml .Values.securityContext | nindent 10 }}
-        image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
+        image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
         command:
         - /bin/sh
         - -c
diff --git a/charts/spire/charts/spire-server/templates/roles.yaml b/charts/spire/charts/spire-server/templates/roles.yaml
index 7bd8b1c..f1bf0fa 100644
--- a/charts/spire/charts/spire-server/templates/roles.yaml
+++ b/charts/spire/charts/spire-server/templates/roles.yaml
@@ -8,7 +8,7 @@ metadata:
 rules:
   - apiGroups: [""]
     resources: [configmaps]
-    resourceNames: [{{ include "spire-server.bundle-configmap" . }}]
+    resourceNames: [{{ include "spire-lib.bundle-configmap" . }}]
     verbs:
       - get
       - patch
diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml
index 2773bf6..114307c 100644
--- a/charts/spire/charts/spire-server/templates/statefulset.yaml
+++ b/charts/spire/charts/spire-server/templates/statefulset.yaml
@@ -43,7 +43,7 @@ spec:
         - name: {{ .Chart.Name }}
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:
             - -config
@@ -108,7 +108,7 @@ spec:
         - name: spire-controller-manager
           securityContext:
             {{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
-          image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image) }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image) }}
           imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }}
           args:
             - --config=controller-manager-config.yaml
diff --git a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
index ce49605..7674197 100644
--- a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
+++ b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
@@ -33,7 +33,7 @@ spec:
     - name: curl-federation-bundle-endpoint
       image: cgr.dev/chainguard/bash:latest
       command: ['curl']
-      args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-server.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}']
+      args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     {{- end }}
diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/templates/_spire-lib.tpl
new file mode 100644
index 0000000..379aed5
--- /dev/null
+++ b/charts/spire/templates/_spire-lib.tpl
@@ -0,0 +1,43 @@
+{{- define "spire-lib.cluster-name" }}
+{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
+{{- .Values.global.spire.clusterName }}
+{{- else }}
+{{- .Values.clusterName }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-lib.trust-domain" }}
+{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
+{{- .Values.global.spire.trustDomain }}
+{{- else }}
+{{- .Values.trustDomain }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-lib.bundle-configmap" }}
+{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
+{{- .Values.global.spire.bundleConfigMap }}
+{{- else }}
+{{- .Values.bundleConfigMap }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-lib.cluster-domain" -}}
+{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
+{{- .Values.global.k8s.clusterDomain }}
+{{- else }}
+{{- .Values.clusterDomain }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-lib.image" -}}
+{{- if eq (substr 0 7 .image.version) "sha256:" -}}
+{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
+{{- else if .appVersion -}}
+{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
+{{- else if .image.version -}}
+{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
+{{- else -}}
+{{- printf "%s/%s" .image.registry .image.repository -}}
+{{- end -}}
+{{- end }}