Move spire-server to dedicated subchart

Signed-off-by: Marco Franssen <[email protected]> Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:10 +01:00
parent e312d42350
commit ce9b58e725
24 changed files with 430 additions and 252 deletions
@@ -0,0 +1,83 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "spire-server.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+data:
+  server.conf: |
+    server {
+      bind_address = "0.0.0.0"
+      bind_port = "8081"
+      socket_path = {{ .Values.socketPath | quote }}
+      trust_domain = {{ .Values.trustDomain | quote }}
+      data_dir = "/run/spire/data"
+      log_level = "{{ .Values.logLevel }}"
+      # AWS requires the use of RSA.  EC cryptography is not supported
+      ca_key_type = "rsa-2048"
+
+      jwt_issuer = "{{ .Values.jwtIssuer }}"
+
+      default_x509_svid_ttl = "1h"
+      default_jwt_svid_ttl = "1h"
+      ca_subject = {
+        {{- with .Values.ca_subject }}
+        country = [{{ .country | quote }}],
+        organization = [{{ .organization | quote }}],
+        common_name = {{ .common_name | quote }},
+        {{- end }}
+      }
+    }
+
+    plugins {
+      DataStore "sql" {
+        plugin_data {
+          database_type = "sqlite3"
+          connection_string = "/run/spire/data/datastore.sqlite3"
+        }
+      }
+
+      NodeAttestor "k8s_psat" {
+        plugin_data {
+          clusters = {
+            {{ .Values.clusterName | quote }} = {
+              service_account_allow_list = ["{{ .Release.Namespace }}:spire-agent"]
+            }
+          }
+        }
+      }
+
+      KeyManager "disk" {
+        plugin_data {
+          keys_path = "/run/spire/data/keys.json"
+        }
+      }
+
+      Notifier "k8sbundle" {
+        plugin_data {
+          namespace = "{{ .Release.Namespace }}"
+          config_map = {{ .Values.bundleConfigMap | quote }}
+        }
+      }
+
+      {{- with .Values.upstreamAuthority.disk }}
+      {{- if eq (.enabled | toString) "true" }}
+      UpstreamAuthority "disk" {
+        plugin_data {
+          cert_file_path = "/run/spire/upstream_ca/tls.crt"
+          key_file_path = "/run/spire/upstream_ca/tls.key"
+          {{- if ne .secret.data.bundle "" }}
+          bundle_file_path = "/run/spire/upstream_ca/bundle.crt"
+          {{- end }}
+        }
+      }
+      {{- end }}
+      {{- end }}
+    }
+
+    health_checks {
+      listener_enabled = true
+      bind_address = "0.0.0.0"
+      bind_port = "8080"
+      live_path = "/live"
+      ready_path = "/ready"
+    }