Allow to use external created secret

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/README.md

@@ -105,10 +105,10 @@ Kubernetes: `>=1.21.0-0`
 | server.config.jwtIssuer | string | `"oidc-discovery.example.org"` |  |
 | server.config.logLevel | string | `"info"` |  |
 | server.config.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` |  |
-| server.config.upstreamAuthority.disk.bundle | string | `""` |  |
-| server.config.upstreamAuthority.disk.certificate | string | `""` |  |
 | server.config.upstreamAuthority.disk.enabled | bool | `false` |  |
-| server.config.upstreamAuthority.disk.key | string | `""` |  |
+| server.config.upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys yourself. |
+| server.config.upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled will create a secret with following certificate info |
+| server.config.upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled will look for a secret with this name. |
 | server.dataStorage.accessMode | string | `"ReadWriteOnce"` |  |
 | server.dataStorage.enabled | bool | `true` |  |
 | server.dataStorage.size | string | `"1Gi"` |  |

charts/spire/templates/_helpers.tpl

@@ -132,3 +132,14 @@ Create the name of the service account to use
 {{- printf "%s/%s" .image.registry .image.repository -}}
 {{- end -}}
 {{- end }}
+
+{{- define "spire.server-upstream-ca-secret" -}}
+{{- $root := . }}
+{{- with .Values.server.config.upstreamAuthority.disk -}}
+{{- if eq (.secret.create | toString) "true" -}}
+{{ include "spire.fullname" $root }}-upstream-ca
+{{- else -}}
+{{ default (include "spire.fullname" $root) .secret.name }}
+{{- end -}}
+{{- end -}}
+{{- end }}

charts/spire/templates/server-configmap.yaml

@@ -66,7 +66,7 @@ data:
         plugin_data {
           cert_file_path = "/run/spire/upstream_ca/tls.crt"
           key_file_path = "/run/spire/upstream_ca/tls.key"
-          {{- if ne .bundle "" }}
+          {{- if ne .secret.data.bundle "" }}
           bundle_file_path = "/run/spire/upstream_ca/bundle.crt"
           {{- end }}
         }

charts/spire/templates/server-statefulset.yaml

@@ -63,7 +63,7 @@ spec:
             - name: upstream-ca
               mountPath: /run/spire/upstream_ca
               readOnly: false
-            {{ end }}
+            {{- end }}
           livenessProbe:
             httpGet:
               path: /live
@@ -130,7 +130,7 @@ spec:
         {{- if eq (.Values.server.config.upstreamAuthority.disk.enabled | toString) "true" }}
         - name: upstream-ca
           secret:
-            secretName: {{ include "spire.fullname" . }}-upstream-ca
+            secretName: {{ include "spire.server-upstream-ca-secret" . }}
         {{- end }}
   volumeClaimTemplates:
     {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }}

charts/spire/templates/upstream-ca-secret.yaml

@@ -1,18 +1,20 @@
 {{- $root := . }}
 {{- with .Values.server.config.upstreamAuthority.disk }}
-{{- if eq (.enabled | toString) "true" }}
+{{- if and (eq (.enabled | toString) "true") (eq (.secret.create | toString) "true") }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "spire.fullname" $root }}-upstream-ca
+  name: {{ include "spire.server-upstream-ca-secret" $root }}
   namespace: {{ $root.Release.Namespace }}
   labels:
     {{- include "spire.server.labels" $root | nindent 4 }}
 data:
-  tls.crt: {{ .certificate | toYaml | indent 2 }}
+  {{- with .secret.data }}
-  tls.key: {{ .key | toYaml | indent 2 }}
+  tls.crt: {{ .certificate | b64enc }}
+  tls.key: {{ .key | b64enc }}
   {{- if ne .bundle ""}}
-  bundle.crt: {{ .bundle | toYaml | indent 2 }}
+  bundle.crt: {{ .bundle | b64enc }}
+  {{- end }}
   {{- end }}
 {{- end }}
 {{- end }}

charts/spire/values.yaml

@@ -97,9 +97,16 @@ server:
     upstreamAuthority:
       disk:
         enabled: false
-        certificate: ""
+        secret:
-        key: ""
+          # -- If disabled requires you to create a secret with the given keys yourself.
-        bundle: ""
+          create: true
+          # -- If secret creation is disabled will look for a secret with this name.
+          name: "spiffe-upstream-ca"
+          # -- If secret creation is enabled will create a secret with following certificate info
+          data:
+            certificate: ""
+            key: ""
+            bundle: ""
 
 agent:
   image: