From 76a0c5ecfcf2e41b2fc8169b73416843cbfb5763 Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@philips.com>
Date: Thu, 3 Nov 2022 16:51:00 +0100
Subject: [PATCH] Move security values to server and oidc components

Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 charts/spire/README.md                        |  6 ++--
 charts/spire/templates/oidc-deployment.yaml   |  2 +-
 .../spire/templates/server-statefulset.yaml   |  2 +-
 charts/spire/values.yaml                      | 32 +++++++++++++------
 4 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/charts/spire/README.md b/charts/spire/README.md
index 7c1d188..c3981b8 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -93,14 +93,14 @@ Kubernetes: `>=1.21.0-0`
 | oidc.jwtIssuer | string | `"oidc-discovery.example.org"` |  |
 | oidc.logLevel | string | `"INFO"` |  |
 | oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |
+| oidc.podSecurityContext | object | `{}` |  |
 | oidc.replicaCount | int | `1` |  |
 | oidc.resources | object | `{}` |  |
+| oidc.securityContext | object | `{}` |  |
 | oidc.service.annotations | object | `{}` |  |
 | oidc.service.port | int | `80` |  |
 | oidc.service.type | string | `"NodePort"` |  |
 | podAnnotations | object | `{}` |  |
-| podSecurityContext | object | `{}` |  |
-| securityContext | object | `{}` |  |
 | server.dataStorage.accessMode | string | `"ReadWriteOnce"` |  |
 | server.dataStorage.enabled | bool | `true` |  |
 | server.dataStorage.size | string | `"1Gi"` |  |
@@ -110,8 +110,10 @@ Kubernetes: `>=1.21.0-0`
 | server.image.repository | string | `"spiffe/spire-server"` |  |
 | server.image.version | string | `""` |  |
 | server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |
+| server.podSecurityContext | object | `{}` |  |
 | server.replicaCount | int | `1` |  |
 | server.resources | object | `{}` |  |
+| server.securityContext | object | `{}` |  |
 | server.service.port | int | `8081` |  |
 | server.service.type | string | `"ClusterIP"` |  |
 | serviceAccount.annotations | object | `{}` |  |
diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml
index e4b0dca..e71d730 100644
--- a/charts/spire/templates/oidc-deployment.yaml
+++ b/charts/spire/templates/oidc-deployment.yaml
@@ -30,7 +30,7 @@ spec:
       {{- end }}
       serviceAccountName: {{ include "spire.serviceAccountName" . }}-agent
       securityContext:
-        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+        {{- toYaml .Values.oidc.podSecurityContext | nindent 8 }}
       containers:
         - name: spire-oidc
           securityContext:
diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml
index aa4ce15..e33b4ed 100644
--- a/charts/spire/templates/server-statefulset.yaml
+++ b/charts/spire/templates/server-statefulset.yaml
@@ -31,7 +31,7 @@ spec:
       serviceAccountName: {{ include "spire.serviceAccountName" . }}-server
       shareProcessNamespace: true
       securityContext:
-        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+        {{- toYaml .Values.server.podSecurityContext | nindent 8 }}
       {{- with .Values.server.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml
index a5e847f..f81e981 100644
--- a/charts/spire/values.yaml
+++ b/charts/spire/values.yaml
@@ -64,6 +64,17 @@ server:
     type: ClusterIP
     port: 8081
 
+  podSecurityContext: {}
+    # fsGroup: 2000
+
+  securityContext: {}
+    # capabilities:
+    #   drop:
+    #   - ALL
+    # readOnlyRootFilesystem: true
+    # runAsNonRoot: true
+    # runAsUser: 1000
+
 csiDriver:
   image:
     registry: ghcr.io
@@ -143,6 +154,17 @@ oidc:
     - spire-oidc.spire.svc.cluster.local
     - oidc-discovery.example.org
 
+  podSecurityContext: {}
+    # fsGroup: 2000
+
+  securityContext: {}
+    # capabilities:
+    #   drop:
+    #   - ALL
+    # readOnlyRootFilesystem: true
+    # runAsNonRoot: true
+    # runAsUser: 1000
+
   insecureScheme:
     enabled: false
 
@@ -201,16 +223,6 @@ serviceAccount:
 
 podAnnotations: {}
 
-podSecurityContext: {}
-  # fsGroup: 2000
-
-securityContext: {}
-  # capabilities:
-  #   drop:
-  #   - ALL
-  # readOnlyRootFilesystem: true
-  # runAsNonRoot: true
-  # runAsUser: 1000
 
 autoscaling:
   enabled: false