Enable global config for clusterName, trustDomain, and bundleConfigMap (#156)

charts/spire/README.md

@@ -105,20 +105,16 @@ Kubernetes: `>=1.21.0-0`
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
 | fullnameOverride | string | `""` |  |
+| global.spire.bundleConfigMap | string | `""` | Override all instances of bundleConfigMap |
+| global.spire.clusterName | string | `"example-cluster"` | Set the name of the Kubernetes cluster |
+| global.spire.trustDomain | string | `"example.org"` | Set the trust domain to use for the spiffe identifiers |
 | nameOverride | string | `""` |  |
 | spiffe-csi-driver.enabled | bool | `true` |  |
 | spiffe-oidc-discovery-provider.enabled | bool | `false` |  |
-| spiffe-oidc-discovery-provider.trustDomain | string | `"example.org"` |  |
-| spire-agent.bundleConfigMap | string | `"spire-bundle"` |  |
-| spire-agent.clusterName | string | `"example-cluster"` |  |
 | spire-agent.enabled | bool | `true` |  |
 | spire-agent.nameOverride | string | `"agent"` |  |
-| spire-agent.trustDomain | string | `"example.org"` |  |
-| spire-server.bundleConfigMap | string | `"spire-bundle"` |  |
-| spire-server.clusterName | string | `"example-cluster"` |  |
 | spire-server.controllerManager.enabled | bool | `true` |  |
 | spire-server.enabled | bool | `true` |  |
 | spire-server.nameOverride | string | `"server"` |  |
-| spire-server.trustDomain | string | `"example.org"` |  |
 
 ----------------------------------------------

charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl

@@ -87,3 +87,19 @@ Create the name of the service account to use
 {{- define "spiffe-oidc-discovery-provider.workload-api-socket-path" -}}
 {{- printf "/spiffe-workload-api/%s" .Values.agentSocketName }}
 {{- end }}
+
+{{- define "spiffe-oidc-discovery-provider.cluster-name" }}
+{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
+{{- .Values.global.spire.clusterName }}
+{{- else }}
+{{- .Values.clusterName }}
+{{- end }}
+{{- end }}
+
+{{- define "spiffe-oidc-discovery-provider.trust-domain" }}
+{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
+{{- .Values.global.spire.trustDomain }}
+{{- else }}
+{{- .Values.trustDomain }}
+{{- end }}
+{{- end }}

charts/spire/charts/spire-agent/templates/_helpers.tpl

@@ -103,3 +103,27 @@ Create the name of the service account to use
 {{- define "spire-agent.socket-path" -}}
 {{- print .Values.socketPath }}
 {{- end }}
+
+{{- define "spire-agent.cluster-name" }}
+{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
+{{- .Values.global.spire.clusterName }}
+{{- else }}
+{{- .Values.clusterName }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-agent.trust-domain" }}
+{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
+{{- .Values.global.spire.trustDomain }}
+{{- else }}
+{{- .Values.trustDomain }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-agent.bundle-configmap" }}
+{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
+{{- .Values.global.spire.bundleConfigMap }}
+{{- else }}
+{{- .Values.bundleConfigMap }}
+{{- end }}
+{{- end }}

charts/spire/charts/spire-agent/templates/configmap.yaml

@@ -12,13 +12,13 @@ data:
       server_port = {{ .Values.server.port | quote }}
       socket_path = {{ include "spire-agent.socket-path" . | quote }}
       trust_bundle_path = "/run/spire/bundle/bundle.crt"
-      trust_domain = {{ .Values.trustDomain | quote }}
+      trust_domain = {{ include "spire-agent.trust-domain" . | quote }}
     }
 
     plugins {
       NodeAttestor "k8s_psat" {
         plugin_data {
-          cluster = {{ .Values.clusterName | quote }}
+          cluster = {{ include "spire-agent.cluster-name" . | quote }}
         }
       }
 

charts/spire/charts/spire-agent/templates/daemonset.yaml

@@ -100,7 +100,7 @@ spec:
             name: {{ include "spire-agent.fullname" . }}
         - name: spire-bundle
           configMap:
-            name: {{ .Values.bundleConfigMap }}
+            name: {{ include "spire-agent.bundle-configmap" . }}
         - name: spire-token
           projected:
             sources:

charts/spire/charts/spire-server/README.md

@@ -22,7 +22,7 @@ A Helm chart to install the SPIRE server.
 | autoscaling.maxReplicas | int | `100` |  |
 | autoscaling.minReplicas | int | `1` |  |
 | autoscaling.targetCPUUtilizationPercentage | int | `80` |  |
-| bundleConfigMap | string | `"spire-server"` |  |
+| bundleConfigMap | string | `"spire-bundle"` |  |
 | caKeyType | string | `"rsa-2048"` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA.  EC cryptography is not supported) |
 | caTTL | string | `"24h"` |  |
 | ca_subject.common_name | string | `"example.org"` |  |

charts/spire/charts/spire-server/templates/_helpers.tpl

@@ -110,3 +110,27 @@ Create the name of the service account to use
 [{{ printf "%s:%s-agent" .Release.Namespace .Release.Name | quote }}]
 {{- end }}
 {{- end }}
+
+{{- define "spire-server.cluster-name" }}
+{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
+{{- .Values.global.spire.clusterName }}
+{{- else }}
+{{- .Values.clusterName }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-server.trust-domain" }}
+{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
+{{- .Values.global.spire.trustDomain }}
+{{- else }}
+{{- .Values.trustDomain }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-server.bundle-configmap" }}
+{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
+{{- .Values.global.spire.bundleConfigMap }}
+{{- else }}
+{{- .Values.bundleConfigMap }}
+{{- end }}
+{{- end }}

charts/spire/charts/spire-server/templates/bundle-configmap.yaml

@@ -2,5 +2,5 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ .Values.bundleConfigMap }}
+  name: {{ include "spire-server.bundle-configmap" . }}
   namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}

charts/spire/charts/spire-server/templates/configmap.yaml

@@ -10,7 +10,7 @@ data:
     server {
       bind_address = "0.0.0.0"
       bind_port = "8081"
-      trust_domain = {{ .Values.trustDomain | quote }}
+      trust_domain = {{ include "spire-server.trust-domain" . | quote }}
       data_dir = "/run/spire/data"
       log_level = {{ .Values.logLevel | quote }}
 
@@ -55,7 +55,7 @@ data:
       NodeAttestor "k8s_psat" {
         plugin_data {
           clusters = {
-            {{ $root.Values.clusterName | quote }} = {
+            {{ include "spire-server.cluster-name" $root | quote }} = {
               service_account_allow_list = {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
             }
           }
@@ -73,7 +73,7 @@ data:
       Notifier "k8sbundle" {
         plugin_data {
           namespace = {{ .Values.notifier.k8sbundle.namespace | default $namespace | quote }}
-          config_map = {{ .Values.bundleConfigMap | quote }}
+          config_map = {{ include "spire-server.bundle-configmap" . | quote }}
         }
       }
 

charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml

@@ -22,8 +22,8 @@ data:
       resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
       resourceNamespace: {{ include "spire-server.namespace" . }}
     validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook
-    clusterName: {{ .Values.clusterName }}
+    clusterName: {{ include "spire-server.cluster-name" . }}
-    trustDomain: {{ .Values.trustDomain }}
+    trustDomain: {{ include "spire-server.trust-domain" . }}
     ignoreNamespaces:
       {{- with .Values.controllerManager.ignoreNamespaces }}
       {{- toYaml . | nindent 6 }}

charts/spire/charts/spire-server/templates/roles.yaml

@@ -8,7 +8,7 @@ metadata:
 rules:
   - apiGroups: [""]
     resources: [configmaps]
-    resourceNames: [{{ .Values.bundleConfigMap }}]
+    resourceNames: [{{ include "spire-server.bundle-configmap" . }}]
     verbs:
       - get
       - patch

charts/spire/charts/spire-server/values.yaml

@@ -85,7 +85,7 @@ jwtIssuer: oidc-discovery.example.org
 clusterName: example-cluster
 trustDomain: example.org
 
-bundleConfigMap: spire-server
+bundleConfigMap: spire-bundle
 
 federation:
   enabled: false

charts/spire/values.yaml

@@ -1,8 +1,16 @@
-# You can enable features that affect all services here.
+# You can enable config/features that affect all services here.
-# global:
+global:
-#   telemetry:
+  spire:
-#     prometheus:
+    # -- Set the name of the Kubernetes cluster
-#       enabled: true
+    clusterName: "example-cluster"
+    # -- Set the trust domain to use for the spiffe identifiers
+    trustDomain: "example.org"
+    # -- Override all instances of bundleConfigMap
+    bundleConfigMap: ""
+
+#  telemetry:
+#    prometheus:
+#      enabled: true
 
 nameOverride: ""
 fullnameOverride: ""
@@ -11,10 +19,6 @@ fullnameOverride: ""
 spire-server:
   enabled: true
   nameOverride: server
-  bundleConfigMap: &bundleConfigMap spire-bundle
-
-  clusterName: &clusterName "example-cluster"
-  trustDomain: &trustDomain "example.org"
 
   controllerManager:
     enabled: true
@@ -22,14 +26,9 @@ spire-server:
 spire-agent:
   enabled: true
   nameOverride: agent
-  bundleConfigMap: *bundleConfigMap
-
-  clusterName: *clusterName
-  trustDomain: *trustDomain
 
 spiffe-csi-driver:
   enabled: true
 
 spiffe-oidc-discovery-provider:
   enabled: false
-  trustDomain: *trustDomain