From bf4bd8199e922454401dbbdcbf5a7eb129881768 Mon Sep 17 00:00:00 2001 From: Gabriel Abdalla Cavalcante Date: Thu, 26 Mar 2026 15:43:19 -0300 Subject: [PATCH] feature: add awsSecretsManager upstreamAuthority (#772) * feature: add awsSecretsManager upstreamAuthority Signed-off-by: gcavalcante8808 * Bump test chart dependencies (#773) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> Signed-off-by: gcavalcante8808 * Fix docs (#1) Signed-off-by: Kevin Fox Signed-off-by: gcavalcante8808 --------- Signed-off-by: gcavalcante8808 Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: Kevin Fox Co-authored-by: spire-helm-version-checker[bot] <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> Co-authored-by: kfox1111 --- charts/spire/charts/spire-server/README.md | 6 ++++++ .../spire-server/templates/configmap.yaml | 17 +++++++++++++++++ charts/spire/charts/spire-server/values.yaml | 13 +++++++++++++ 3 files changed, 36 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index f750aa1..1267a43 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -229,6 +229,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `upstreamAuthority.awsPCA.signingAlgorithm` | (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | `""` | | `upstreamAuthority.awsPCA.endpoint` | (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | `""` | | `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` | +| `upstreamAuthority.awsSecret.enabled` | Flag to enable upstream authority plugin with AWS Secrets Manager | `false` | +| `upstreamAuthority.awsSecret.region` | AWS Region to use | `""` | +| `upstreamAuthority.awsSecret.certFileArn` | ARN or name of the secret containing the intermediate CA certificate | `""` | +| `upstreamAuthority.awsSecret.keyFileArn` | ARN or name of the secret containing the intermediate CA private key | `""` | +| `upstreamAuthority.awsSecret.bundleFileArn` | (Optional) ARN or name of the secret containing the root CA bundle | `""` | +| `upstreamAuthority.awsSecret.assumeRoleArn` | (Optional) ARN of an IAM role to assume | `""` | | `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` | | `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` | | `upstreamAuthority.certManager.issuerName` | Defaults to the release name, override if CA is provided outside of the chart | `""` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 701187c..2fa417b 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -507,6 +507,23 @@ plugins: {{- end }} {{- end }} {{- end }} + {{- with .Values.upstreamAuthority.awsSecret }} + {{- if eq (.enabled | toString) "true" }} + {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }} + UpstreamAuthority: + awssecret: + plugin_data: + region: {{ .region | quote }} + cert_file_arn: {{ .certFileArn | quote }} + key_file_arn: {{ .keyFileArn | quote }} + {{- if ne .bundleFileArn "" }} + bundle_file_arn: {{ .bundleFileArn | quote }} + {{- end }} + {{- if ne .assumeRoleArn "" }} + assume_role_arn: {{ .assumeRoleArn | quote }} + {{- end }} + {{- end }} + {{- end }} {{- if gt $upstreamAuthorityUsed 1 }} {{- fail "You can only enable a single Upstream Authority." }} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 8387d5e..be57d98 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -448,6 +448,19 @@ upstreamAuthority: endpoint: "" ## @param upstreamAuthority.awsPCA.supplementalBundlePath (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. supplementalBundlePath: "" + awsSecret: + ## @param upstreamAuthority.awsSecret.enabled Flag to enable upstream authority plugin with AWS Secrets Manager + enabled: false + ## @param upstreamAuthority.awsSecret.region AWS Region to use + region: "" + ## @param upstreamAuthority.awsSecret.certFileArn ARN or name of the secret containing the intermediate CA certificate + certFileArn: "" + ## @param upstreamAuthority.awsSecret.keyFileArn ARN or name of the secret containing the intermediate CA private key + keyFileArn: "" + ## @param upstreamAuthority.awsSecret.bundleFileArn (Optional) ARN or name of the secret containing the root CA bundle + bundleFileArn: "" + ## @param upstreamAuthority.awsSecret.assumeRoleArn (Optional) ARN of an IAM role to assume + assumeRoleArn: "" certManager: ## @param upstreamAuthority.certManager.enabled Flag to enable upstream authority plugin with cert manager enabled: false