Add optional UpstreamAuthority (#79)

Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/templates/server-configmap.yaml

@@ -59,6 +59,20 @@ data:
           config_map = "{{ include "spire.fullname" . }}-bundle"
         }
       }
+
+      {{- with .Values.server.config.upstreamAuthority.disk }}
+      {{- if eq (.enabled | toString) "true" }}
+      UpstreamAuthority "disk" {
+        plugin_data {
+          cert_file_path = "{{ .certFilePath }}"
+          key_file_path = "{{ .keyFilePath }}"
+          {{- if ne .bundleFilePath "" }}
+          bundle_file_path = "{{ .bundleFilePath }}"
+          {{- end }}
+        }
+      }
+      {{- end }}
+      {{- end }}
     }
 
     health_checks {

charts/spire/templates/server-statefulset.yaml

@@ -59,6 +59,11 @@ spec:
               mountPath: /run/spire/data
               readOnly: false
             {{ end }}
+            {{- if eq (.Values.server.caSecretStorage.enabled | toString) "true" }}
+            - name: secret-data
+              mountPath: {{ .Values.server.caSecretStorage.path }}
+              readOnly: false
+            {{ end }}
           livenessProbe:
             httpGet:
               path: /live
@@ -122,6 +127,11 @@ spec:
           hostPath:
             path: /run/spire/server-sockets
             type: DirectoryOrCreate
+        {{- if eq (.Values.server.caSecretStorage.enabled | toString) "true" }}
+        - name: secret-data
+          secret:
+            secretName: {{ .Values.server.caSecretStorage.secretName }}
+        {{- end }}
   volumeClaimTemplates:
     {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }}
     - metadata: