From 456c9cc53b1c2ff9c5e3baeff2e30727f8d99ff3 Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@philips.com>
Date: Mon, 16 Jan 2023 16:01:40 +0100
Subject: [PATCH] Add by default k8s workload registrar compatible SPIFFEIDs to
 controller-manager setup

Signed-off-by: Marco Franssen <marco.franssen@philips.com>
Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 charts/spire/charts/spire-server/README.md    |  5 +++++
 .../controller-manager-cluster-ids.yaml       | 19 +++++++++++++++++++
 .../controller-manager-configmap.yaml         |  3 +++
 charts/spire/charts/spire-server/values.yaml  | 12 ++++++++++++
 4 files changed, 39 insertions(+)
 create mode 100644 charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml

diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index 2730c86..7f248f9 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -19,6 +19,11 @@ A Helm chart to install the SPIRE server.
 | ca_subject.organization | string | `"Example"` |  |
 | clusterName | string | `"example-cluster"` |  |
 | controllerManager.enabled | bool | `false` |  |
+| controllerManager.identities.dnsNameTemplates | list | `[]` |  |
+| controllerManager.identities.enabled | bool | `true` |  |
+| controllerManager.identities.podSelector | object | `{}` |  |
+| controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` |  |
+| controllerManager.ignoreNamespaces | list | `[]` |  |
 | controllerManager.image.pullPolicy | string | `"IfNotPresent"` |  |
 | controllerManager.image.registry | string | `"ghcr.io"` |  |
 | controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` |  |
diff --git a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml
new file mode 100644
index 0000000..2818c1f
--- /dev/null
+++ b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml
@@ -0,0 +1,19 @@
+{{- $root := . }}
+{{- with .Values.controllerManager }}
+{{- if and (eq (.enabled | toString) "true") (eq (.identities.enabled | toString) "true") }}
+apiVersion: spire.spiffe.io/v1alpha1
+kind: ClusterSPIFFEID
+metadata:
+  name: {{ include "spire-controller-manager.fullname" $root }}-service-account-based
+spec:
+  spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }}
+  {{- with .identities.podSelector }}
+  podSelector:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .identities.dnsNameTemplates }}
+  dnsNameTemplates:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
index 0d40782..5a2edb3 100644
--- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
@@ -28,5 +28,8 @@ data:
       - kube-public
       - {{ .Release.Namespace }}
       - local-path-storage
+      {{- with .Values.controllerManager.ignoreNamespaces }}
+      {{- toYaml . | nindent 6 }}
+      {{- end }}
     spireServerSocketPath: {{ .Values.socketPath | quote }}
 {{- end }}
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 86ec2de..091cb07 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -142,6 +142,18 @@ controllerManager:
     port: 443
     annotations: {}
 
+  ignoreNamespaces: []
+
+  identities:
+    enabled: true
+
+    spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
+    podSelector: {}
+      # matchLabels:
+      #   spiffe.io/spiffe-id: "true"
+    dnsNameTemplates: []
+      # - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local'
+
 k8sWorkloadRegistrar:
   # -- The `k8s-workload-registrar` is deprecated in favor of the `spire-controller-manager`
   # A next release will switch to use the `spire-controller-manager` by default.