panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enable CA settings via global (#268)

Browse Source 
Adds a global.spire.caSubject section where you can set the CA
subject information for all spire-server instances.

Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
2024-02-28 11:47:24 -08:00
committed by GitHub
parent ac83694970
commit c57017425e
4 changed files with 36 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/templates/_helpers.tpl
+15
View File
@@ -264,3 +264,18 @@ The code below determines what connection type should be used.
{{- .Release.Namespace }}-{{ default .Release.Name .Values.crNameOverride }}
{{- end -}}
{{- end -}}
{{- define "spire-server.ca-subject-country" }}
{{- $g := dig "spire" "caSubject" "country" "" .Values.global }}
{{- default .Values.ca_subject.country $g }}
{{- end }}
{{- define "spire-server.ca-subject-organization" }}
{{- $g := dig "spire" "caSubject" "organization" "" .Values.global }}
{{- default .Values.ca_subject.organization $g }}
{{- end }}
{{- define "spire-server.ca-subject-common-name" }}
{{- $g := dig "spire" "caSubject" "commonName" "" .Values.global }}
{{- default .Values.ca_subject.common_name $g }}
{{- end }}
charts/spire/charts/spire-server/templates/configmap.yaml
+6 -8
View File
@@ -1,9 +1,9 @@
{{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}}
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.county must be set" (eq .Values.ca_subject.country "ARPA"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.organization must be set" (eq .Values.ca_subject.organization "Example"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.common_name must be set" (eq .Values.ca_subject.common_name "example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.county must be set" (eq (include "spire-server.ca-subject-country" .) "ARPA"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.organization must be set" (eq (include "spire-server.ca-subject-organization" .) "Example"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.common_name must be set" (eq (include "spire-server.ca-subject-common-name" .) "example.org"))}}
{{- range $type, $tvals := .Values.customPlugins }}
{{- if not (has $type (list "bundlePublisher" "credentialComposer" "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }}
{{- fail (printf "Unknown plugin type specified: %s" $type) }}
@@ -59,11 +59,9 @@ server:
default_jwt_svid_ttl: {{ .Values.defaultJwtSvidTTL | quote }}
ca_subject:
{{- with .Values.ca_subject }}
- country: [{{ .country | quote }}]
organization: [{{ .organization | quote }}]
common_name: {{ .common_name | quote }}
{{- end }}
- country: [{{ include "spire-server.ca-subject-country" . | quote }}]
organization: [{{ include "spire-server.ca-subject-organization" . | quote }}]
common_name: {{ include "spire-server.ca-subject-common-name" . | quote }}
{{- with .Values.federation }}
{{- if eq (.enabled | toString) "true" }}