Add option to enable federation on spire-server (#97)

2023-03-16 20:36:13 +01:00
parent 382c1f4334
commit 811a2f6b01
7 changed files with 46 additions and 0 deletions
@@ -0,0 +1,3 @@
+spire-server:
+  federation:
+    enabled: true
@@ -57,6 +57,9 @@ A Helm chart to install the SPIRE server.
 | extraContainers | list | `[]` |  |
 | extraVolumeMounts | list | `[]` |  |
 | extraVolumes | list | `[]` |  |
+| federation.bundleEndpoint.address | string | `"0.0.0.0"` |  |
+| federation.bundleEndpoint.port | int | `8443` |  |
+| federation.enabled | bool | `false` |  |
 | fullnameOverride | string | `""` |  |
 | image.pullPolicy | string | `"IfNotPresent"` |  |
 | image.registry | string | `"ghcr.io"` |  |
@@ -29,6 +29,17 @@ data:
        common_name = {{ .common_name | quote }},
        {{- end }}
      }
+
+      {{- with .Values.federation }}
+      {{- if eq (.enabled | toString) "true" }}
+      federation {
+        bundle_endpoint {
+          address = "{{ .bundleEndpoint.address }}"
+          port = {{ .bundleEndpoint.port }}
+        }
+      }
+      {{- end }}
+      {{- end }}
    }

    plugins {
@@ -16,5 +16,13 @@ spec:
      port: {{ .Values.service.port }}
      targetPort: grpc
      protocol: TCP
+    {{- with .Values.federation }}
+    {{- if eq (.enabled | toString) "true" }}
+    - name: federation
+      port: {{ .bundleEndpoint.port }}
+      targetPort: federation
+      protocol: TCP
+    {{- end }}
+    {{- end }}
  selector:
    {{- include "spire-server.selectorLabels" . | nindent 4 }}
@@ -57,6 +57,13 @@ spec:
              protocol: TCP
            - containerPort: 8080
              name: healthz
+            {{- with .Values.federation }}
+            {{- if eq (.enabled | toString) "true" }}
+            - name: federation
+              containerPort: {{ .bundleEndpoint.port }}
+              protocol: TCP
+            {{- end }}
+            {{- end }}
            {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
            - containerPort: 9988
              name: prom
@@ -17,4 +17,12 @@ spec:
      args: ['-zvw3', '{{ include "spire-server.fullname" . }}', '{{ .Values.service.port }}']
      securityContext:
        {{- toYaml .Values.securityContext | nindent 8 }}
+    {{- if eq (.Values.federation.enabled | toString) "true" }}
+    - name: wget-federation-bundle-endpoint
+      image: busybox
+      command: ['wget']
+      args: ['--no-check-certificate', '-O', '/dev/null', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.cluster.local:{{ .Values.federation.bundleEndpoint.port }}']
+      securityContext:
+        {{- toYaml .Values.securityContext | nindent 8 }}
+    {{- end }}
  restartPolicy: Never
@@ -87,6 +87,12 @@ trustDomain: example.org

 bundleConfigMap: spire-server

+federation:
+  enabled: false
+  bundleEndpoint:
+    port: 8443
+    address: "0.0.0.0"
+
 ca_subject:
  country: NL
  organization: Example