Merge pull request #113 from spiffe/spire-config-as-yaml-converted-json

charts/spire/README.md

@@ -17,7 +17,7 @@ A Helm chart for deploying the complete Spire stack including: spire-server, spi
 
 | Dependency | Supported Versions |
 |:-----------|:-------------------|
-| SPIRE      | `1.5.3+`, `1.6.x`  |
+| SPIRE      | `1.5.3+`, `1.6.3+` |
 | Helm       | `3.x`              |
 | Kubernetes | `1.21+`            |
 

charts/spire/README.md.gotmpl

@@ -19,7 +19,7 @@
 
 | Dependency | Supported Versions |
 |:-----------|:-------------------|
-| SPIRE      | `1.5.3+`, `1.6.x`  |
+| SPIRE      | `1.5.3+`, `1.6.3+` |
 | Helm       | `3.x`              |
 | Kubernetes | `1.21+`            |
 

charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml

@@ -1,4 +1,38 @@
 {{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }}
+{{- define "spiffe-oidc-discovery-provider.yaml-config" -}}
+{{- $oidcSocket := .oidcSocket }}
+{{- with .root }}
+log_level: {{ .Values.config.logLevel | quote }}
+
+domains:
+  - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}"
+  - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}"
+  - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}"
+  {{- if gt (len .Values.config.domains) 0 }}
+  {{- .Values.config.domains | toYaml | nindent 2 }}
+  {{- end }}
+
+{{- if .Values.insecureScheme.enabled }}
+allow_insecure_scheme: {{ .Values.insecureScheme.enabled }}
+listen_socket_path: {{ $oidcSocket | quote }}
+{{- else }}
+acme:
+  directory_url: {{ .Values.config.acme.directoryUrl | quote }}
+  cache_dir: {{ .Values.config.acme.cacheDir | quote }}
+  tos_accepted: {{ .Values.config.acme.tosAccepted }}
+  email: {{ .Values.config.acme.emailAddress | quote }}
+{{- end }}
+
+workload_api:
+  socket_path: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | quote }}
+  trust_domain: {{ include "spiffe-oidc-discovery-provider.trust-domain" . | quote }}
+
+health_checks:
+  bind_port: "8008"
+  ready_path: "/ready"
+  live_path: "/live"
+{{- end }}
+{{- end }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -6,39 +40,7 @@ metadata:
   namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
 data:
   oidc-discovery-provider.conf: |
-    log_level = "{{ .Values.config.logLevel }}"
+    {{- include "spiffe-oidc-discovery-provider.yaml-config" (dict "oidcSocket" $oidcSocket "root" .) | fromYaml | toPrettyJson | nindent 4 }}
-
-    domains = [
-      "{{ include "spiffe-oidc-discovery-provider.fullname" . }}",
-      "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}",
-      "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}",
-    {{- if gt (len .Values.config.domains) 0 }}
-      "{{- join "\",\n      \"" .Values.config.domains }}"
-    {{- end }}
-    ]
-
-    {{- if .Values.insecureScheme.enabled }}
-    allow_insecure_scheme = {{ .Values.insecureScheme.enabled }}
-    listen_socket_path = {{ $oidcSocket | quote }}
-    {{- else }}
-    acme {
-      directory_url = "{{ .Values.config.acme.directoryUrl }}"
-      cache_dir = "{{ .Values.config.acme.cacheDir }}"
-      tos_accepted = {{ .Values.config.acme.tosAccepted }}
-      email = "{{ .Values.config.acme.emailAddress }}"
-    }
-    {{- end }}
-
-    workload_api {
-      socket_path = {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | quote }}
-      trust_domain = {{ include "spiffe-oidc-discovery-provider.trust-domain" . | quote }}
-    }
-
-    health_checks {
-      bind_port = "8008"
-      ready_path = "/ready"
-      live_path = "/live"
-    }
   {{- if .Values.insecureScheme.enabled }}
   default.conf: |
     upstream oidc {

charts/spire/charts/spire-agent/templates/configmap.yaml

@@ -1,3 +1,50 @@
+{{- define "spire-agent.yaml-config" -}}
+agent:
+  data_dir: "/run/spire"
+  log_level: {{ .Values.logLevel | quote }}
+  server_address: {{ include "spire-agent.server-address" . | trim | quote }}
+  server_port: {{ .Values.server.port | quote }}
+  socket_path: {{ include "spire-agent.socket-path" . | quote }}
+  trust_bundle_path: "/run/spire/bundle/bundle.crt"
+  trust_domain: {{ include "spire-agent.trust-domain" . | quote }}
+
+plugins:
+  NodeAttestor:
+    - k8s_psat:
+        plugin_data:
+          cluster: {{ include "spire-agent.cluster-name" . | quote }}
+
+  KeyManager:
+    - memory:
+        plugin_data:
+
+  WorkloadAttestor:
+    - k8s:
+        plugin_data:
+          # Defaults to the secure kubelet port by default.
+          # Minikube does not have a cert in the cluster CA bundle that
+          # can authenticate the kubelet cert, so skip validation.
+          skip_kubelet_verification: true
+
+  {{- if .Values.workloadAttestors.unix.enabled }}
+    - unix:
+        plugin_data:
+  {{- end }}
+
+health_checks:
+  listener_enabled: true
+  bind_address: "0.0.0.0"
+  bind_port: {{ .Values.healthChecks.port | quote }}
+  live_path: "/live"
+  ready_path: "/ready"
+
+{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
+telemetry:
+  - Prometheus:
+      - host: "0.0.0.0"
+        port: {{ .Values.telemetry.prometheus.port }}
+{{- end }}
+{{- end }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -5,58 +52,4 @@ metadata:
   namespace: {{ include "spire-agent.namespace" . }}
 data:
   agent.conf: |
-    agent {
+    {{- include "spire-agent.yaml-config" . | fromYaml | toPrettyJson | nindent 4 }}
-      data_dir = "/run/spire"
-      log_level = {{ .Values.logLevel | quote }}
-      server_address = {{ include "spire-agent.server-address" . | trim | quote }}
-      server_port = {{ .Values.server.port | quote }}
-      socket_path = {{ include "spire-agent.socket-path" . | quote }}
-      trust_bundle_path = "/run/spire/bundle/bundle.crt"
-      trust_domain = {{ include "spire-agent.trust-domain" . | quote }}
-    }
-
-    plugins {
-      NodeAttestor "k8s_psat" {
-        plugin_data {
-          cluster = {{ include "spire-agent.cluster-name" . | quote }}
-        }
-      }
-
-      KeyManager "memory" {
-        plugin_data {
-        }
-      }
-
-      WorkloadAttestor "k8s" {
-        plugin_data {
-          # Defaults to the secure kubelet port by default.
-          # Minikube does not have a cert in the cluster CA bundle that
-          # can authenticate the kubelet cert, so skip validation.
-          skip_kubelet_verification = true
-        }
-      }
-
-      {{- if .Values.workloadAttestors.unix.enabled }}
-      WorkloadAttestor "unix" {
-          plugin_data {
-          }
-      }
-      {{- end }}
-    }
-
-    health_checks {
-      listener_enabled = true
-      bind_address = "0.0.0.0"
-      bind_port = {{ .Values.healthChecks.port | quote }}
-      live_path = "/live"
-      ready_path = "/ready"
-    }
-
-    {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
-    telemetry {
-      Prometheus {
-        host = "0.0.0.0"
-        port = {{ .Values.telemetry.prometheus.port }}
-      }
-    }
-    {{- end }}

charts/spire/charts/spire-server/templates/configmap.yaml

@@ -1,5 +1,105 @@
+{{- define "spire-server.yaml-config" -}}
 {{- $root := . }}
-{{- $namespace := include "spire-server.namespace" . }}
+server:
+  bind_address: "0.0.0.0"
+  bind_port: "8081"
+  trust_domain: {{ include "spire-server.trust-domain" . | quote }}
+  data_dir: "/run/spire/data"
+  log_level: {{ .Values.logLevel | quote }}
+  jwt_issuer: {{ .Values.jwtIssuer | quote }}
+
+  ca_key_type: {{ .Values.caKeyType | quote }}
+  ca_ttl: {{ .Values.caTTL | quote }}
+
+  default_x509_svid_ttl: {{ .Values.defaultX509SvidTTL | quote }}
+  default_jwt_svid_ttl: {{ .Values.defaultJwtSvidTTL | quote }}
+
+  ca_subject:
+    {{- with .Values.ca_subject }}
+    - country: [{{ .country | quote }}]
+      organization: [{{ .organization | quote }}]
+      common_name: {{ .common_name | quote }}
+    {{- end }}
+
+  {{- with .Values.federation }}
+  {{- if eq (.enabled | toString) "true" }}
+  federation:
+    bundle_endpoint:
+      - {{ .bundleEndpoint | toYaml | nindent 8 }}
+  {{- end }}
+  {{- end }}
+
+plugins:
+  DataStore:
+    - sql:
+        plugin_data:
+          database_type: "sqlite3"
+          connection_string: "/run/spire/data/datastore.sqlite3"
+
+  {{- with .Values.nodeAttestor.k8sPsat }}
+  {{- if eq (.enabled | toString) "true" }}
+  NodeAttestor:
+    - k8s_psat:
+        plugin_data:
+          clusters:
+            {{ include "spire-server.cluster-name" $root }}:
+              service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
+  {{- end }}
+  {{- end }}
+
+  KeyManager:
+    - disk:
+        plugin_data:
+          keys_path: "/run/spire/data/keys.json"
+
+  Notifier:
+    - k8sbundle:
+        plugin_data:
+          namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }}
+          config_map: {{ include "spire-server.bundle-configmap" . | quote }}
+
+  {{- with .Values.upstreamAuthority.disk }}
+  {{- if eq (.enabled | toString) "true" }}
+  UpstreamAuthority:
+    - disk:
+        plugin_data:
+          cert_file_path: "/run/spire/upstream_ca/tls.crt"
+          key_file_path: "/run/spire/upstream_ca/tls.key"
+          {{- if ne .secret.data.bundle "" }}
+          bundle_file_path: "/run/spire/upstream_ca/bundle.crt"
+          {{- end }}
+  {{- end }}
+  {{- end }}
+
+  {{- with .Values.upstreamAuthority.certManager }}
+  {{- if eq (.enabled | toString) "true" }}
+  UpstreamAuthority:
+    - cert-manager:
+        plugin_data:
+          issuer_name: {{ .issuer_name | quote }}
+          issuer_kind: {{ .issuer_kind | quote }}
+          issuer_group: {{ .issuer_group | quote }}
+          namespace: {{ default $root.Release.Namespace .namespace | quote }}
+          {{- if ne .kube_config_file "" }}
+          kube_config_file: {{ .kube_config_file | quote }}
+          {{- end }}
+  {{- end }}
+  {{- end }}
+
+health_checks:
+  listener_enabled: true
+  bind_address: "0.0.0.0"
+  bind_port: "8080"
+  live_path: "/live"
+  ready_path: "/ready"
+
+{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
+telemetry:
+  - Prometheus:
+      - host: "0.0.0.0"
+        port: 9988
+{{- end }}
+{{- end }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -7,120 +107,4 @@ metadata:
   namespace: {{ include "spire-server.namespace" . }}
 data:
   server.conf: |
-    server {
+    {{- include "spire-server.yaml-config" . | fromYaml | toPrettyJson | nindent 4 }}
-      bind_address = "0.0.0.0"
-      bind_port = "8081"
-      trust_domain = {{ include "spire-server.trust-domain" . | quote }}
-      data_dir = "/run/spire/data"
-      log_level = {{ .Values.logLevel | quote }}
-
-      jwt_issuer = {{ .Values.jwtIssuer | quote }}
-
-      ca_key_type = {{ .Values.caKeyType | quote }}
-      ca_ttl = {{ .Values.caTTL | quote }}
-
-      default_x509_svid_ttl = {{ .Values.defaultX509SvidTTL | quote }}
-      default_jwt_svid_ttl = {{ .Values.defaultJwtSvidTTL | quote }}
-
-      ca_subject = {
-        {{- with .Values.ca_subject }}
-        country = [{{ .country | quote }}],
-        organization = [{{ .organization | quote }}],
-        common_name = {{ .common_name | quote }},
-        {{- end }}
-      }
-
-      {{- with .Values.federation }}
-      {{- if eq (.enabled | toString) "true" }}
-      federation {
-        bundle_endpoint {
-          address = "{{ .bundleEndpoint.address }}"
-          port = {{ .bundleEndpoint.port }}
-        }
-      }
-      {{- end }}
-      {{- end }}
-    }
-
-    plugins {
-      DataStore "sql" {
-        plugin_data {
-          database_type = "sqlite3"
-          connection_string = "/run/spire/data/datastore.sqlite3"
-        }
-      }
-
-      {{- with .Values.nodeAttestor.k8sPsat }}
-      {{- if eq (.enabled | toString) "true" }}
-      NodeAttestor "k8s_psat" {
-        plugin_data {
-          clusters = {
-            {{ include "spire-server.cluster-name" $root | quote }} = {
-              service_account_allow_list = {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
-            }
-          }
-        }
-      }
-      {{- end }}
-      {{- end }}
-
-      KeyManager "disk" {
-        plugin_data {
-          keys_path = "/run/spire/data/keys.json"
-        }
-      }
-
-      Notifier "k8sbundle" {
-        plugin_data {
-          namespace = {{ .Values.notifier.k8sbundle.namespace | default $namespace | quote }}
-          config_map = {{ include "spire-server.bundle-configmap" . | quote }}
-        }
-      }
-
-      {{- with .Values.upstreamAuthority.disk }}
-      {{- if eq (.enabled | toString) "true" }}
-      UpstreamAuthority "disk" {
-        plugin_data {
-          cert_file_path = "/run/spire/upstream_ca/tls.crt"
-          key_file_path = "/run/spire/upstream_ca/tls.key"
-          {{- if ne .secret.data.bundle "" }}
-          bundle_file_path = "/run/spire/upstream_ca/bundle.crt"
-          {{- end }}
-        }
-      }
-      {{- end }}
-      {{- end }}
-
-      {{- with .Values.upstreamAuthority.certManager }}
-      {{- if eq (.enabled | toString) "true" }}
-      UpstreamAuthority "cert-manager" {
-        plugin_data {
-          issuer_name = {{ .issuer_name | quote }}
-          issuer_kind = {{ .issuer_kind | quote }}
-          issuer_group = {{ .issuer_group | quote }}
-          namespace = {{ default $root.Release.Namespace .namespace | quote }}
-          {{- if ne .kube_config_file "" }}
-          kube_config_file = {{ .kube_config_file | quote }}
-          {{- end }}
-        }
-      }
-      {{- end }}
-      {{- end }}
-    }
-
-    health_checks {
-      listener_enabled = true
-      bind_address = "0.0.0.0"
-      bind_port = "8080"
-      live_path = "/live"
-      ready_path = "/ready"
-    }
-
-    {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
-    telemetry {
-      Prometheus {
-        host = "0.0.0.0"
-        port = 9988
-      }
-    }
-    {{- end }}