Add JWT-SVID exec-auth source for kubeConfigs entries (#907)

Add jwtSVIDExec as a fourth exactly-one kubeConfigs source: the chart generates an exec-credential kubeconfig that authenticates to an external cluster with short-lived SPIFFE JWT-SVIDs instead of a static credential. Signed-off-by: sabsari <[email protected]> Co-authored-by: Claude Opus 4.8 <[email protected]>
2026-08-11 06:40:05 -07:00
parent a481bab3f0
commit 648e0e45e5
7 changed files with 140 additions and 5 deletions
@@ -333,6 +333,21 @@ spire-server:
 			Expect(objs[serverTmpl]).Should(ContainSubstring("name: my-ext-secret"))
 			Expect(objs[serverTmpl]).Should(ContainSubstring("path: clusterb"))
 		})
+		It("jwtSVIDExec entry generates the Secret and stages the exec plugin", func() {
+			objs, err := ValueStringRender(chart, `
+spire-server:
+  jwtSVIDExecConfig:
+    spiffeID: spiffe://example.org/external-spire-server
+  kubeConfigs:
+    clusterd:
+      jwtSVIDExec:
+        server: https://clusterd-api.example.com:6443
+        certificateAuthorityData: TESTCADATAB64==
+`)
+			Expect(err).Should(Succeed())
+			Expect(objs[secretTmpl]).Should(ContainSubstring("kind: Secret"))
+			Expect(objs[serverTmpl]).Should(ContainSubstring("init-jwt-svid-exec"))
+		})
 	})
 	Describe("spire-server.externalServerSubject", func() {
 		It("binds the external server's downstream RBAC to a ServiceAccount subject", func() {