aws node attester: add org verification support (#825)

* add verify org support for aws node attester Signed-off-by: pratik-lotia <[email protected]> * refactor with suggested changes Signed-off-by: pratik-lotia <[email protected]> --------- Signed-off-by: pratik-lotia <[email protected]>
2026-05-12 12:25:07 -07:00
parent f9a2c443a6
commit 806c6ae59e
4 changed files with 65 additions and 0 deletions
@@ -150,6 +150,32 @@ spire-server:
 			Expect(notes).Should(ContainSubstring("Installed"))
 		})
 	})
+	Describe("spire-server.nodeAttestor.awsIID.verifyOrganization", func() {
+		It("emits verify_organization in server config JSON", func() {
+			objs, err := ValueStringRender(chart, `
+spire-server:
+  nodeAttestor:
+    k8sPSAT:
+      enabled: false
+    awsIID:
+      enabled: true
+      verifyOrganization:
+        enabled: true
+        managementAccountId: "111122223333"
+        assumeOrgRole: "spire-server-org-validator"
+        managementAccountRegion: "us-east-1"
+        orgAccountMapTTL: "5m"
+`)
+			Expect(err).Should(Succeed())
+			notes := objs["spire/charts/spire-server/templates/configmap.yaml"]
+			Expect(notes).Should(ContainSubstring(`verify_organization`))
+			Expect(notes).Should(ContainSubstring(`management_account_id`))
+			Expect(notes).Should(ContainSubstring(`111122223333`))
+			Expect(notes).Should(ContainSubstring(`spire-server-org-validator`))
+			Expect(notes).Should(ContainSubstring(`us-east-1`))
+			Expect(notes).Should(ContainSubstring(`5m`))
+		})
+	})
 	Describe("spire-server.credentialComposer.uniqueID", func() {
 		It("spire server uniqueid credential composer", func() {
 			objs, err := ValueStringRender(chart, `