From ce86fb97e19749266cbe09a8edc23ce619e9d1f2 Mon Sep 17 00:00:00 2001
From: Ken Huffman <ken.huffman@niceincontact.com>
Date: Wed, 21 Dec 2022 06:10:58 -0500
Subject: [PATCH] Add optional UpstreamAuthority (#79)

Co-authored-by: Marco Franssen <marco.franssen@gmail.com>
Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 charts/spire/README.md                         |  7 +++++++
 charts/spire/templates/server-configmap.yaml   | 14 ++++++++++++++
 charts/spire/templates/server-statefulset.yaml | 10 ++++++++++
 charts/spire/values.yaml                       | 12 ++++++++++++
 4 files changed, 43 insertions(+)

diff --git a/charts/spire/README.md b/charts/spire/README.md
index 81e3a30..73168a9 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -99,12 +99,19 @@ Kubernetes: `>=1.21.0-0`
 | oidc.service.port | int | `80` |  |
 | oidc.service.type | string | `"NodePort"` |  |
 | oidc.tolerations | list | `[]` |  |
+| server.caSecretStorage.enabled | bool | `false` |  |
+| server.caSecretStorage.path | string | `"/conf/server/"` |  |
+| server.caSecretStorage.secretName | string | `"csi-driver-spiffe-ca"` |  |
 | server.config.ca_subject.common_name | string | `"example.org"` |  |
 | server.config.ca_subject.country | string | `"NL"` |  |
 | server.config.ca_subject.organization | string | `"Example"` |  |
 | server.config.jwtIssuer | string | `"oidc-discovery.example.org"` |  |
 | server.config.logLevel | string | `"info"` |  |
 | server.config.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` |  |
+| server.config.upstreamAuthority.disk.bundleFilePath | string | `""` |  |
+| server.config.upstreamAuthority.disk.certFilePath | string | `"/conf/server/tls.crt"` |  |
+| server.config.upstreamAuthority.disk.enabled | bool | `false` |  |
+| server.config.upstreamAuthority.disk.keyFilePath | string | `"/conf/server/tls.key"` |  |
 | server.dataStorage.accessMode | string | `"ReadWriteOnce"` |  |
 | server.dataStorage.enabled | bool | `true` |  |
 | server.dataStorage.size | string | `"1Gi"` |  |
diff --git a/charts/spire/templates/server-configmap.yaml b/charts/spire/templates/server-configmap.yaml
index 78bd729..5e2d12b 100644
--- a/charts/spire/templates/server-configmap.yaml
+++ b/charts/spire/templates/server-configmap.yaml
@@ -59,6 +59,20 @@ data:
           config_map = "{{ include "spire.fullname" . }}-bundle"
         }
       }
+
+      {{- with .Values.server.config.upstreamAuthority.disk }}
+      {{- if eq (.enabled | toString) "true" }}
+      UpstreamAuthority "disk" {
+        plugin_data {
+          cert_file_path = "{{ .certFilePath }}"
+          key_file_path = "{{ .keyFilePath }}"
+          {{- if ne .bundleFilePath "" }}
+          bundle_file_path = "{{ .bundleFilePath }}"
+          {{- end }}
+        }
+      }
+      {{- end }}
+      {{- end }}
     }
 
     health_checks {
diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml
index 6c53a9e..a404408 100644
--- a/charts/spire/templates/server-statefulset.yaml
+++ b/charts/spire/templates/server-statefulset.yaml
@@ -59,6 +59,11 @@ spec:
               mountPath: /run/spire/data
               readOnly: false
             {{ end }}
+            {{- if eq (.Values.server.caSecretStorage.enabled | toString) "true" }}
+            - name: secret-data
+              mountPath: {{ .Values.server.caSecretStorage.path }}
+              readOnly: false
+            {{ end }}
           livenessProbe:
             httpGet:
               path: /live
@@ -122,6 +127,11 @@ spec:
           hostPath:
             path: /run/spire/server-sockets
             type: DirectoryOrCreate
+        {{- if eq (.Values.server.caSecretStorage.enabled | toString) "true" }}
+        - name: secret-data
+          secret:
+            secretName: {{ .Values.server.caSecretStorage.secretName }}
+        {{- end }}
   volumeClaimTemplates:
     {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }}
     - metadata:
diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml
index ad286ce..edbdb2a 100644
--- a/charts/spire/values.yaml
+++ b/charts/spire/values.yaml
@@ -84,6 +84,11 @@ server:
 
   topologySpreadConstraints: []
 
+  caSecretStorage:
+    enabled: false
+    path: /conf/server/
+    secretName: "csi-driver-spiffe-ca"
+
   config:
     logLevel: info
     socketPath: /run/spire/server-sockets/spire-server.sock
@@ -94,6 +99,13 @@ server:
       organization: Example
       common_name: example.org
 
+    upstreamAuthority:
+      disk:
+        enabled: false
+        certFilePath: /conf/server/tls.crt
+        keyFilePath: /conf/server/tls.key
+        bundleFilePath: ""
+
 agent:
   image:
     # registry: gcr.io