AWS KMS key_identifier upgrade (#314)

* Allow use of key_identifier_file or key_identifier_value in place of key_metadata_file Signed-off-by: aniket patel <[email protected]> * Change key identifier values to have enabled flags Signed-off-by: aniket patel <[email protected]> * Update charts/spire/charts/spire-server/templates/configmap.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: anhpatel <[email protected]> * Update charts/spire/charts/spire-server/templates/configmap.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: anhpatel <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: anhpatel <[email protected]> * Update docs Signed-off-by: aniket patel <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: anhpatel <[email protected]> * Update docs Signed-off-by: aniket patel <[email protected]> --------- Signed-off-by: aniket patel <[email protected]> Signed-off-by: anhpatel <[email protected]> Co-authored-by: kfox1111 <[email protected]>
2024-04-10 06:26:10 -07:00
parent 7aa8cb360e
commit bc79f58ab7
3 changed files with 20 additions and 0 deletions
@@ -35,6 +35,9 @@
 {{- if ne $tlsFederationCount 1 }}
 {{-   fail "You must enable one and only one federation TLS configuration" }}
 {{- end }}
+{{- if and (eq (.Values.keyManager.awsKMS.keyIdentifierFile.enabled | toString) "true") (eq (.Values.keyManager.awsKMS.keyIdentifierValue.enabled | toString ) "true") }}
+{{-   fail "You can only enable one of keyIdentifierFile or keyIdentifierValue at a time" }}
+{{- end }}
 {{- define "spire-server.yaml-config" -}}
 {{- $upstreamAuthorityUsed := 0 }}
 {{- $keyManagerUsed := 0 }}
@@ -190,7 +193,13 @@ plugins:
    aws_kms:
      plugin_data:
        region: {{ .region | quote }}
+        {{- if eq (.keyIdentifierFile.enabled | toString) "true" }}
+        key_identifier_file: "/run/spire/data/aws-kms-key-identifier"
+        {{- else if eq (.keyIdentifierValue.enabled | toString) "true" }}
+        key_identifier_value: {{ .keyIdentifierValue.identifier | quote }}
+        {{- else }}
        key_metadata_file: "/run/spire/data/aws-kms-key-metadata"
+        {{- end }}
        {{- if ne .accessKeyID "" }}
        access_key_id: "${AWS_KMS_ACCESS_KEY_ID}"
        {{- end }}