From c132cc481e1477cf570f7b883a95279d2e2cadac Mon Sep 17 00:00:00 2001
From: kfox1111 <Kevin.Fox@pnnl.gov>
Date: Fri, 26 Apr 2024 12:19:01 -0700
Subject: [PATCH] Add support for externalServer=true (#303)

---
 charts/spire/charts/spire-server/README.md       |  1 +
 .../charts/spire-server/templates/_helpers.tpl   | 13 +++++++++++++
 .../charts/spire-server/templates/configmap.yaml |  2 ++
 .../templates/controller-manager-configmap.yaml  |  2 ++
 .../templates/controller-manager-roles.yaml      | 10 ++--------
 .../templates/controller-manager-service.yaml    |  2 ++
 .../templates/controller-manager-webhook.yaml    |  2 ++
 .../spire/charts/spire-server/templates/hpa.yaml |  2 ++
 .../spire-server/templates/podmonitor.yaml       |  2 ++
 .../templates/post-install-hook.yaml             |  2 ++
 .../templates/post-upgrade-hook.yaml             |  2 ++
 .../spire-server/templates/pre-delete-hook.yaml  |  2 ++
 .../spire-server/templates/pre-upgrade-hook.yaml |  2 ++
 .../charts/spire-server/templates/roles.yaml     | 16 ++++------------
 .../spire-server/templates/server-resource.yaml  |  2 ++
 .../charts/spire-server/templates/service.yaml   |  2 ++
 .../spire-server/templates/serviceaccount.yaml   |  2 ++
 .../templates/tests/test-connection.yaml         |  2 ++
 charts/spire/charts/spire-server/values.yaml     |  3 +++
 19 files changed, 51 insertions(+), 20 deletions(-)

diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index 9270736..d138be5 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -87,6 +87,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
 | `image.pullPolicy`                                                                           | The image pull policy                                                                                                                                                                                                                                                                                                                                                | `IfNotPresent`                                                                                 |
 | `image.tag`                                                                                  | Overrides the image tag whose default is the chart appVersion                                                                                                                                                                                                                                                                                                        | `""`                                                                                           |
 | `kind`                                                                                       | Define SPIRE server deployment type. Can be statefulset/deployment. Defaults to statefulset if not set. This feature is experimental.                                                                                                                                                                                                                                | `statefulset`                                                                                  |
+| `externalServer`                                                                             | Deploy only the bundle ConfigMap, RBAC rules, and identity documents but not the server. Use in a nested setup where the server is external.                                                                                                                                                                                                                         | `false`                                                                                        |
 | `imagePullSecrets`                                                                           | Pull secrets for images                                                                                                                                                                                                                                                                                                                                              | `[]`                                                                                           |
 | `nameOverride`                                                                               | Name override                                                                                                                                                                                                                                                                                                                                                        | `""`                                                                                           |
 | `crNameOverride`                                                                             | Name override for any custom resources                                                                                                                                                                                                                                                                                                                               | `""`                                                                                           |
diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl
index 9f6e011..acb4697 100644
--- a/charts/spire/charts/spire-server/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-server/templates/_helpers.tpl
@@ -301,3 +301,16 @@ The code below determines what connection type should be used.
 {{-   $g := dig "spire" "caSubject" "commonName" "" .Values.global }}
 {{-   default .Values.ca_subject.common_name $g }}
 {{- end }}
+
+{{- define "spire-server.subject" }}
+subjects:
+{{-   if .Values.externalServer }}
+- apiGroup: rbac.authorization.k8s.io
+  kind: User
+  name: spire-root
+{{-   else }}
+- kind: ServiceAccount
+  name: {{ include "spire-server.serviceAccountName" . }}
+  namespace: {{ include "spire-server.namespace" . }}
+{{-   end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml
index 2c6e34c..a4e07a5 100644
--- a/charts/spire/charts/spire-server/templates/configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/configmap.yaml
@@ -361,6 +361,7 @@ telemetry:
         port: 9988
 {{- end }}
 {{- end }}
+{{- if not .Values.externalServer }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -373,3 +374,4 @@ metadata:
 data:
   server.conf: |
     {{- include "spire-lib.reformat-and-yaml2json" (dict "config" (include "spire-server.yaml-config" .) "root" .) | nindent 4 }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
index f019f56..52e86ca 100644
--- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.externalServer }}
 {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
 apiVersion: v1
 kind: ConfigMap
@@ -51,3 +52,4 @@ data:
     {{- toYaml . | nindent 6 }}
   {{- end }}
 {{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml
index d2f9e9b..8b18b3d 100644
--- a/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml
+++ b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml
@@ -24,10 +24,7 @@ roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: {{ include "spire-controller-manager.fullname" . }}-leader-election
-subjects:
-- kind: ServiceAccount
-  name: {{ include "spire-server.serviceAccountName" . }}
-  namespace: {{ include "spire-server.namespace" . }}
+{{ include "spire-server.subject" . }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -87,8 +84,5 @@ roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: {{ .Release.Namespace}}-{{ include "spire-controller-manager.fullname" . }}
-subjects:
-- kind: ServiceAccount
-  name: {{ include "spire-server.serviceAccountName" . }}
-  namespace: {{ include "spire-server.namespace" . }}
+{{ include "spire-server.subject" . }}
 {{- end }}
diff --git a/charts/spire/charts/spire-server/templates/controller-manager-service.yaml b/charts/spire/charts/spire-server/templates/controller-manager-service.yaml
index 5d3b0a7..864c204 100644
--- a/charts/spire/charts/spire-server/templates/controller-manager-service.yaml
+++ b/charts/spire/charts/spire-server/templates/controller-manager-service.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.externalServer }}
 {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
 apiVersion: v1
 kind: Service
@@ -20,3 +21,4 @@ spec:
   selector:
     {{- include "spire-server.selectorLabels" . | nindent 4 }}
 {{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml
index 7f91f10..660c2f8 100644
--- a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml
+++ b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.externalServer }}
 {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
@@ -37,3 +38,4 @@ webhooks:
         resources: ["clusterspiffeids"]
     sideEffects: None
 {{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/hpa.yaml b/charts/spire/charts/spire-server/templates/hpa.yaml
index 65b195e..7fd457a 100644
--- a/charts/spire/charts/spire-server/templates/hpa.yaml
+++ b/charts/spire/charts/spire-server/templates/hpa.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.externalServer }}
 {{- if .Values.autoscaling.enabled }}
 apiVersion: {{ include "spire-lib.autoscalingVersion" . }}
 kind: HorizontalPodAutoscaler
@@ -38,3 +39,4 @@ spec:
           averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
     {{- end }}
 {{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/podmonitor.yaml b/charts/spire/charts/spire-server/templates/podmonitor.yaml
index 878a4ba..3e736df 100644
--- a/charts/spire/charts/spire-server/templates/podmonitor.yaml
+++ b/charts/spire/charts/spire-server/templates/podmonitor.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.externalServer }}
 {{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
 {{- $namespace := include "spire-server.podMonitor.namespace" . }}
 {{- $podNamespace := ( include "spire-server.namespace" . ) }}
@@ -25,3 +26,4 @@ spec:
     kubernetes.io/metadata.name: {{ $podNamespace }}
   {{- end }}  
 {{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml
index 6b4568e..3b9bf1b 100644
--- a/charts/spire/charts/spire-server/templates/post-install-hook.yaml
+++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.externalServer }}
 {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
 {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
 {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
@@ -87,3 +88,4 @@ spec:
 {{- end }}
 {{- end }}
 {{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
index 45f9525..683ba91 100644
--- a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.externalServer }}
 {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
 {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
 {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
@@ -87,3 +88,4 @@ spec:
 {{- end }}
 {{- end }}
 {{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml
index 2a14be9..7c4c0e8 100644
--- a/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml
+++ b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.externalServer }}
 {{- if eq ((dig "deleteHooks" "enabled" .Values.controllerManager.deleteHook.enabled .Values.global) | toString) "true" }}
 {{- if .Values.upstreamAuthority.spire.enabled }}
 apiVersion: v1
@@ -90,3 +91,4 @@ spec:
           - {{ include "spire-server.namespace" . }}
 {{- end }}
 {{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
index b3f8525..a3a86b6 100644
--- a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.externalServer }}
 {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
 {{- if and (eq (.Values.controllerManager.enabled | toString) "true") .Values.controllerManager.validatingWebhookConfiguration.enabled }}
 {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
@@ -87,3 +88,4 @@ spec:
 {{- end }}
 {{- end }}
 {{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/roles.yaml b/charts/spire/charts/spire-server/templates/roles.yaml
index c09bede..3949967 100644
--- a/charts/spire/charts/spire-server/templates/roles.yaml
+++ b/charts/spire/charts/spire-server/templates/roles.yaml
@@ -1,3 +1,4 @@
+{{- $subject := include "spire-server.subject" . }}
 {{- $namespace := include "spire-server.namespace" . }}
 {{- $bundleNamespace := include "spire-server.bundle-namespace" . }}
 # Role to be able to push certificate bundles to a configmap
@@ -39,10 +40,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "spire-server.fullname" . }}-cm
   namespace: {{ $namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "spire-server.serviceAccountName" . }}
-    namespace: {{ $namespace }}
+{{ $subject }}
 roleRef:
   kind: Role
   name: {{ include "spire-server.fullname" . }}-cm
@@ -54,10 +52,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "spire-lib.bundle-configmap" . }}
   namespace: {{ $bundleNamespace }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "spire-server.serviceAccountName" . }}
-    namespace: {{ $namespace }}
+{{ $subject }}
 roleRef:
   kind: Role
   name: {{ include "spire-lib.bundle-configmap" . }}
@@ -89,10 +84,7 @@ kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ .Release.Namespace}}-{{ include "spire-server.fullname" . }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "spire-server.serviceAccountName" . }}
-    namespace: {{ $namespace }}
+{{ $subject }}
 roleRef:
   kind: ClusterRole
   name: {{ .Release.Namespace}}-{{ include "spire-server.fullname" . }}
diff --git a/charts/spire/charts/spire-server/templates/server-resource.yaml b/charts/spire/charts/spire-server/templates/server-resource.yaml
index a661a3b..a90dba2 100644
--- a/charts/spire/charts/spire-server/templates/server-resource.yaml
+++ b/charts/spire/charts/spire-server/templates/server-resource.yaml
@@ -21,6 +21,7 @@
 {{- else }}
 {{-   fail "Unsupported kind." }}
 {{- end }}
+{{- if not .Values.externalServer }}
 apiVersion: apps/v1
 {{- if eq .Values.kind "statefulset" }}
 kind: StatefulSet
@@ -514,3 +515,4 @@ spec:
         storageClassName: {{ $storageClass }}
         {{- end }}
   {{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/service.yaml b/charts/spire/charts/spire-server/templates/service.yaml
index 1e57a07..b9726ef 100644
--- a/charts/spire/charts/spire-server/templates/service.yaml
+++ b/charts/spire/charts/spire-server/templates/service.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.externalServer }}
 apiVersion: v1
 kind: Service
 metadata:
@@ -26,3 +27,4 @@ spec:
     {{- end }}
   selector:
     {{- include "spire-server.selectorLabels" . | nindent 4 }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/serviceaccount.yaml b/charts/spire/charts/spire-server/templates/serviceaccount.yaml
index cd717b5..0b793d2 100644
--- a/charts/spire/charts/spire-server/templates/serviceaccount.yaml
+++ b/charts/spire/charts/spire-server/templates/serviceaccount.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.externalServer }}
 {{- if .Values.serviceAccount.create -}}
 apiVersion: v1
 kind: ServiceAccount
@@ -11,3 +12,4 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 {{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
index 3ff41c6..e4f33b0 100644
--- a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
+++ b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.externalServer }}
 {{ $values := merge .Values }}
 apiVersion: v1
 kind: Pod
@@ -64,3 +65,4 @@ spec:
         secretName: {{ .Values.tests.tls.customCA }}
   {{- end }}
   restartPolicy: Never
+{{- end }}
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 4369b9c..ef9e652 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -23,6 +23,9 @@ image:
 ## @param kind Define SPIRE server deployment type. Can be statefulset/deployment. Defaults to statefulset if not set. This feature is experimental.
 kind: statefulset
 
+## @param externalServer Deploy only the bundle ConfigMap, RBAC rules, and identity documents but not the server. Use in a nested setup where the server is external.
+externalServer: false
+
 ## @param imagePullSecrets [array] Pull secrets for images
 imagePullSecrets: []