Move security values to server and oidc components

Signed-off-by: Marco Franssen <[email protected]>

charts/spire/README.md

@@ -93,14 +93,14 @@ Kubernetes: `>=1.21.0-0`
 | oidc.jwtIssuer | string | `"oidc-discovery.example.org"` |  |
 | oidc.logLevel | string | `"INFO"` |  |
 | oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |
+| oidc.podSecurityContext | object | `{}` |  |
 | oidc.replicaCount | int | `1` |  |
 | oidc.resources | object | `{}` |  |
+| oidc.securityContext | object | `{}` |  |
 | oidc.service.annotations | object | `{}` |  |
 | oidc.service.port | int | `80` |  |
 | oidc.service.type | string | `"NodePort"` |  |
 | podAnnotations | object | `{}` |  |
-| podSecurityContext | object | `{}` |  |
-| securityContext | object | `{}` |  |
 | server.dataStorage.accessMode | string | `"ReadWriteOnce"` |  |
 | server.dataStorage.enabled | bool | `true` |  |
 | server.dataStorage.size | string | `"1Gi"` |  |
@@ -110,8 +110,10 @@ Kubernetes: `>=1.21.0-0`
 | server.image.repository | string | `"spiffe/spire-server"` |  |
 | server.image.version | string | `""` |  |
 | server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |
+| server.podSecurityContext | object | `{}` |  |
 | server.replicaCount | int | `1` |  |
 | server.resources | object | `{}` |  |
+| server.securityContext | object | `{}` |  |
 | server.service.port | int | `8081` |  |
 | server.service.type | string | `"ClusterIP"` |  |
 | serviceAccount.annotations | object | `{}` |  |

charts/spire/templates/oidc-deployment.yaml

@@ -30,7 +30,7 @@ spec:
       {{- end }}
       serviceAccountName: {{ include "spire.serviceAccountName" . }}-agent
       securityContext:
-        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+        {{- toYaml .Values.oidc.podSecurityContext | nindent 8 }}
       containers:
         - name: spire-oidc
           securityContext:

charts/spire/templates/server-statefulset.yaml

@@ -31,7 +31,7 @@ spec:
       serviceAccountName: {{ include "spire.serviceAccountName" . }}-server
       shareProcessNamespace: true
       securityContext:
-        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+        {{- toYaml .Values.server.podSecurityContext | nindent 8 }}
       {{- with .Values.server.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

charts/spire/values.yaml

@@ -64,6 +64,17 @@ server:
     type: ClusterIP
     port: 8081
 
+  podSecurityContext: {}
+    # fsGroup: 2000
+
+  securityContext: {}
+    # capabilities:
+    #   drop:
+    #   - ALL
+    # readOnlyRootFilesystem: true
+    # runAsNonRoot: true
+    # runAsUser: 1000
+
 csiDriver:
   image:
     registry: ghcr.io
@@ -143,6 +154,17 @@ oidc:
     - spire-oidc.spire.svc.cluster.local
     - oidc-discovery.example.org
 
+  podSecurityContext: {}
+    # fsGroup: 2000
+
+  securityContext: {}
+    # capabilities:
+    #   drop:
+    #   - ALL
+    # readOnlyRootFilesystem: true
+    # runAsNonRoot: true
+    # runAsUser: 1000
+
   insecureScheme:
     enabled: false
 
@@ -201,16 +223,6 @@ serviceAccount:
 
 podAnnotations: {}
 
-podSecurityContext: {}
-  # fsGroup: 2000
-
-securityContext: {}
-  # capabilities:
-  #   drop:
-  #   - ALL
-  # readOnlyRootFilesystem: true
-  # runAsNonRoot: true
-  # runAsUser: 1000
 
 autoscaling:
   enabled: false