From 811a2f6b013077405965e8ad685c428b31026e24 Mon Sep 17 00:00:00 2001
From: Pete Cable <petercable@gmail.com>
Date: Thu, 16 Mar 2023 12:36:13 -0700
Subject: [PATCH] Add option to enable federation on spire-server (#97)

---
 .github/tests/federation-bundle-endpoint/values.yaml  |  3 +++
 charts/spire/charts/spire-server/README.md            |  3 +++
 .../charts/spire-server/templates/configmap.yaml      | 11 +++++++++++
 .../spire/charts/spire-server/templates/service.yaml  |  8 ++++++++
 .../charts/spire-server/templates/statefulset.yaml    |  7 +++++++
 .../spire-server/templates/tests/test-connection.yaml |  8 ++++++++
 charts/spire/charts/spire-server/values.yaml          |  6 ++++++
 7 files changed, 46 insertions(+)
 create mode 100644 .github/tests/federation-bundle-endpoint/values.yaml

diff --git a/.github/tests/federation-bundle-endpoint/values.yaml b/.github/tests/federation-bundle-endpoint/values.yaml
new file mode 100644
index 0000000..6b7d104
--- /dev/null
+++ b/.github/tests/federation-bundle-endpoint/values.yaml
@@ -0,0 +1,3 @@
+spire-server:
+  federation:
+    enabled: true
diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index 38d021a..ac897b7 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -57,6 +57,9 @@ A Helm chart to install the SPIRE server.
 | extraContainers | list | `[]` |  |
 | extraVolumeMounts | list | `[]` |  |
 | extraVolumes | list | `[]` |  |
+| federation.bundleEndpoint.address | string | `"0.0.0.0"` |  |
+| federation.bundleEndpoint.port | int | `8443` |  |
+| federation.enabled | bool | `false` |  |
 | fullnameOverride | string | `""` |  |
 | image.pullPolicy | string | `"IfNotPresent"` |  |
 | image.registry | string | `"ghcr.io"` |  |
diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml
index 03f148a..31063da 100644
--- a/charts/spire/charts/spire-server/templates/configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/configmap.yaml
@@ -29,6 +29,17 @@ data:
         common_name = {{ .common_name | quote }},
         {{- end }}
       }
+
+      {{- with .Values.federation }}
+      {{- if eq (.enabled | toString) "true" }}
+      federation {
+        bundle_endpoint {
+          address = "{{ .bundleEndpoint.address }}"
+          port = {{ .bundleEndpoint.port }}
+        }
+      }
+      {{- end }}
+      {{- end }}
     }
 
     plugins {
diff --git a/charts/spire/charts/spire-server/templates/service.yaml b/charts/spire/charts/spire-server/templates/service.yaml
index a0cb1c2..5cdaf50 100644
--- a/charts/spire/charts/spire-server/templates/service.yaml
+++ b/charts/spire/charts/spire-server/templates/service.yaml
@@ -16,5 +16,13 @@ spec:
       port: {{ .Values.service.port }}
       targetPort: grpc
       protocol: TCP
+    {{- with .Values.federation }}
+    {{- if eq (.enabled | toString) "true" }}
+    - name: federation
+      port: {{ .bundleEndpoint.port }}
+      targetPort: federation
+      protocol: TCP
+    {{- end }}
+    {{- end }}
   selector:
     {{- include "spire-server.selectorLabels" . | nindent 4 }}
diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml
index cd18025..2773bf6 100644
--- a/charts/spire/charts/spire-server/templates/statefulset.yaml
+++ b/charts/spire/charts/spire-server/templates/statefulset.yaml
@@ -57,6 +57,13 @@ spec:
               protocol: TCP
             - containerPort: 8080
               name: healthz
+            {{- with .Values.federation }}
+            {{- if eq (.enabled | toString) "true" }}
+            - name: federation
+              containerPort: {{ .bundleEndpoint.port }}
+              protocol: TCP
+            {{- end }}
+            {{- end }}
             {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
             - containerPort: 9988
               name: prom
diff --git a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
index 432a583..4daa47d 100644
--- a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
+++ b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
@@ -17,4 +17,12 @@ spec:
       args: ['-zvw3', '{{ include "spire-server.fullname" . }}', '{{ .Values.service.port }}']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
+    {{- if eq (.Values.federation.enabled | toString) "true" }}
+    - name: wget-federation-bundle-endpoint
+      image: busybox
+      command: ['wget']
+      args: ['--no-check-certificate', '-O', '/dev/null', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.cluster.local:{{ .Values.federation.bundleEndpoint.port }}']
+      securityContext:
+        {{- toYaml .Values.securityContext | nindent 8 }}
+    {{- end }}
   restartPolicy: Never
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 5768c0b..5324b55 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -87,6 +87,12 @@ trustDomain: example.org
 
 bundleConfigMap: spire-server
 
+federation:
+  enabled: false
+  bundleEndpoint:
+    port: 8443
+    address: "0.0.0.0"
+
 ca_subject:
   country: NL
   organization: Example