Add tls section to federation bundle endpoint and fix up annotations (#173)

* Add cert-manager support to the federation bundle endpoint and fix up bundle endpoint ingress annotations Signed-off-by: Kevin Fox <[email protected]> * Add external secret too Signed-off-by: Kevin Fox <[email protected]> * Add forgotten files Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
2024-01-17 00:17:15 -08:00
parent c7ab1319cc
commit 3ccdb5e4c1
6 changed files with 134 additions and 3 deletions
@@ -0,0 +1,27 @@
+{{- define "spire-server.federation-cert-manager-default-cert" }}
+{{-   $fullName := include "spire-server.fullname" . }}
+{{-   $issuerFullName := printf "%s-federation" $fullName }}
+dnsNames:
+  {{- if ne (len .Values.federation.tls.certManager.certificate.dnsNames) 0 }}
+  {{-   toYaml .Values.federation.tls.certManager.certificate.dnsNames | nindent 4 }}
+  {{- else }}
+  - {{ include "spire-lib.ingress-calculated-name" (dict "ingress" .Values.federation.ingress "Values" .Values) }}
+  {{- end }}
+issuerRef:
+  {{- with .Values.federation.tls.certManager.certificate.issuerRef.group }}
+  group: {{ . }}
+  {{- end }}
+  kind: {{ default "Issuer" .Values.federation.tls.certManager.certificate.issuerRef.kind }}
+  name: {{ default $issuerFullName .Values.federation.tls.certManager.certificate.issuerRef.name }}
+secretName: {{ $issuerFullName }}-cert
+{{- end }}
+{{- if .Values.federation.tls.certManager.enabled }}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "spire-server.fullname" . }}
+  namespace: {{ include "spire-server.namespace" . }}
+spec:
+  {{ merge (include "spire-server.federation-cert-manager-default-cert" . | fromYaml) .Values.federation.tls.certManager.certificate | toYaml | nindent 2 }}
+{{- end }}