panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feature: add awsSecretsManager upstreamAuthority (#772)

Browse Source 
* feature: add awsSecretsManager upstreamAuthority

Signed-off-by: gcavalcante8808 <[email protected]>

* Bump test chart dependencies (#773)

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
Signed-off-by: gcavalcante8808 <[email protected]>

* Fix docs (#1)

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: gcavalcante8808 <[email protected]>

---------

Signed-off-by: gcavalcante8808 <[email protected]>
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: spire-helm-version-checker[bot] <161522935+spire-helm-version-checker[bot]@users.noreply.github.com>
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
Gabriel Abdalla Cavalcante
2026-03-26 11:43:19 -07:00
committed by GitHub
co-authored by marcofranssen spire-helm-version-checker[bot] kfox1111
parent f78c1d4246
commit bf4bd8199e
3 changed files with 36 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+6
View File
@@ -229,6 +229,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `upstreamAuthority.awsPCA.signingAlgorithm` | (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | `""` |
| `upstreamAuthority.awsPCA.endpoint` | (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | `""` |
| `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` |
| `upstreamAuthority.awsSecret.enabled` | Flag to enable upstream authority plugin with AWS Secrets Manager | `false` |
| `upstreamAuthority.awsSecret.region` | AWS Region to use | `""` |
| `upstreamAuthority.awsSecret.certFileArn` | ARN or name of the secret containing the intermediate CA certificate | `""` |
| `upstreamAuthority.awsSecret.keyFileArn` | ARN or name of the secret containing the intermediate CA private key | `""` |
| `upstreamAuthority.awsSecret.bundleFileArn` | (Optional) ARN or name of the secret containing the root CA bundle | `""` |
| `upstreamAuthority.awsSecret.assumeRoleArn` | (Optional) ARN of an IAM role to assume | `""` |
| `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` |
| `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` |
| `upstreamAuthority.certManager.issuerName` | Defaults to the release name, override if CA is provided outside of the chart | `""` |
charts/spire/charts/spire-server/templates/configmap.yaml
+17
View File
@@ -507,6 +507,23 @@ plugins:
{{- end }}
{{- end }}
{{- end }}
{{- with .Values.upstreamAuthority.awsSecret }}
{{- if eq (.enabled | toString) "true" }}
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
UpstreamAuthority:
awssecret:
plugin_data:
region: {{ .region | quote }}
cert_file_arn: {{ .certFileArn | quote }}
key_file_arn: {{ .keyFileArn | quote }}
{{- if ne .bundleFileArn "" }}
bundle_file_arn: {{ .bundleFileArn | quote }}
{{- end }}
{{- if ne .assumeRoleArn "" }}
assume_role_arn: {{ .assumeRoleArn | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- if gt $upstreamAuthorityUsed 1 }}
{{- fail "You can only enable a single Upstream Authority." }}
{{- end }}
charts/spire/charts/spire-server/values.yaml
+13
View File
@@ -448,6 +448,19 @@ upstreamAuthority:
endpoint: ""
## @param upstreamAuthority.awsPCA.supplementalBundlePath (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle.
supplementalBundlePath: ""
awsSecret:
## @param upstreamAuthority.awsSecret.enabled Flag to enable upstream authority plugin with AWS Secrets Manager
enabled: false
## @param upstreamAuthority.awsSecret.region AWS Region to use
region: ""
## @param upstreamAuthority.awsSecret.certFileArn ARN or name of the secret containing the intermediate CA certificate
certFileArn: ""
## @param upstreamAuthority.awsSecret.keyFileArn ARN or name of the secret containing the intermediate CA private key
keyFileArn: ""
## @param upstreamAuthority.awsSecret.bundleFileArn (Optional) ARN or name of the secret containing the root CA bundle
bundleFileArn: ""
## @param upstreamAuthority.awsSecret.assumeRoleArn (Optional) ARN of an IAM role to assume
assumeRoleArn: ""
certManager:
## @param upstreamAuthority.certManager.enabled Flag to enable upstream authority plugin with cert manager
enabled: false