From d341c5ad58268fe09dcbb7cce2fcdf8ac9e3aeba Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Fri, 3 Mar 2023 11:48:35 -0800 Subject: [PATCH] UpstreamAuthority cert-manager support (#82) --- .../cert-manager-ca.yaml | 31 +++++++++++++++++++ .../pre-install.sh | 5 +++ .../values.yaml | 5 +++ .github/workflows/helm-chart-ci.yaml | 8 +++++ charts/spire/charts/spire-server/README.md | 7 +++++ .../spire-server/templates/configmap.yaml | 17 ++++++++++ .../charts/spire-server/templates/roles.yaml | 12 +++++++ charts/spire/charts/spire-server/values.yaml | 10 ++++++ 8 files changed, 95 insertions(+) create mode 100644 .github/tests/upstream-authority-cert-manager/cert-manager-ca.yaml create mode 100755 .github/tests/upstream-authority-cert-manager/pre-install.sh create mode 100644 .github/tests/upstream-authority-cert-manager/values.yaml diff --git a/.github/tests/upstream-authority-cert-manager/cert-manager-ca.yaml b/.github/tests/upstream-authority-cert-manager/cert-manager-ca.yaml new file mode 100644 index 0000000..dbbe201 --- /dev/null +++ b/.github/tests/upstream-authority-cert-manager/cert-manager-ca.yaml @@ -0,0 +1,31 @@ +--- +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: selfsigned-issuer +spec: + selfSigned: {} +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: demo-selfsigned-ca +spec: + isCA: true + commonName: demo-selfsigned-ca + secretName: root-secret + privateKey: + algorithm: ECDSA + size: 256 + issuerRef: + name: selfsigned-issuer + kind: Issuer + group: cert-manager.io +--- +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: demo-ca +spec: + ca: + secretName: root-secret diff --git a/.github/tests/upstream-authority-cert-manager/pre-install.sh b/.github/tests/upstream-authority-cert-manager/pre-install.sh new file mode 100755 index 0000000..3586e71 --- /dev/null +++ b/.github/tests/upstream-authority-cert-manager/pre-install.sh @@ -0,0 +1,5 @@ +#!/usr/bin/env bash + +helm install cert-manager cert-manager --namespace cert-manager --create-namespace --version v1.11.0 --set installCRDs=true --repo https://charts.jetstack.io --wait +SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) +kubectl apply -f $SCRIPT_DIR/cert-manager-ca.yaml -n "$VALUES" diff --git a/.github/tests/upstream-authority-cert-manager/values.yaml b/.github/tests/upstream-authority-cert-manager/values.yaml new file mode 100644 index 0000000..08fbec7 --- /dev/null +++ b/.github/tests/upstream-authority-cert-manager/values.yaml @@ -0,0 +1,5 @@ +spire-server: + upstreamAuthority: + certManager: + enabled: true + issuer_name: "demo-ca" diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index 92fbc94..b4c5f6f 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -151,7 +151,15 @@ jobs: - name: Run chart-testing (install) run: | + [ "$VALUES" != "default" ] && kubectl create namespace "$VALUES" + post-install() { + [ -x .github/tests/$VALUES/post-install.sh ] && .github/tests/$VALUES/post-install.sh + exit $1 + } + trap 'post-install $? $LINENO' EXIT + [ -x .github/tests/$VALUES/pre-install.sh ] && .github/tests/$VALUES/pre-install.sh ct install --debug \ + --namespace $VALUES \ --target-branch ${{ github.base_ref }} \ --exclude-deprecated \ ${{ (matrix.values != 'default' && '--helm-extra-set-args "--values=.github/tests/$VALUES/values.yaml"') || '' }} diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index a50bd27..ea98185 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -78,6 +78,13 @@ A Helm chart to install the SPIRE server. | tolerations | list | `[]` | | | topologySpreadConstraints | list | `[]` | | | trustDomain | string | `"example.org"` | | +| upstreamAuthority.certManager.enabled | bool | `false` | | +| upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` | | +| upstreamAuthority.certManager.issuer_kind | string | `"Issuer"` | | +| upstreamAuthority.certManager.issuer_name | string | `"spire-ca"` | | +| upstreamAuthority.certManager.kube_config_file | string | `""` | | +| upstreamAuthority.certManager.namespace | string | `""` | Specify to use a namespace other then the one the chart is installed into | +| upstreamAuthority.certManager.rbac.create | bool | `true` | | | upstreamAuthority.disk.enabled | bool | `false` | | | upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | | upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index df97c60..c67dff1 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -1,3 +1,4 @@ +{{ $namespace := .Release.Namespace }} apiVersion: v1 kind: ConfigMap metadata: @@ -71,6 +72,22 @@ data: } {{- end }} {{- end }} + + {{- with .Values.upstreamAuthority.certManager }} + {{- if eq (.enabled | toString) "true" }} + UpstreamAuthority "cert-manager" { + plugin_data { + issuer_name = {{ .issuer_name | quote }} + issuer_kind = {{ .issuer_kind | quote }} + issuer_group = {{ .issuer_group | quote }} + namespace = {{ default $namespace .namespace | quote }} + {{- if ne .kube_config_file "" }} + kube_config_file = {{ .kube_config_file | quote }} + {{- end }} + } + } + {{- end }} + {{- end }} } health_checks { diff --git a/charts/spire/charts/spire-server/templates/roles.yaml b/charts/spire/charts/spire-server/templates/roles.yaml index 439c1bc..5d09e4e 100644 --- a/charts/spire/charts/spire-server/templates/roles.yaml +++ b/charts/spire/charts/spire-server/templates/roles.yaml @@ -18,6 +18,18 @@ rules: verbs: - get - patch + {{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.rbac.create }} + - apiGroups: ["cert-manager.io"] + resources: + - certificaterequests + verbs: + - list + - get + - create + - delete + - patch + - update + {{- end }} --- kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index e119702..5ec626d 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -104,6 +104,16 @@ upstreamAuthority: certificate: "" key: "" bundle: "" + certManager: + enabled: false + rbac: + create: true + issuer_name: "spire-ca" + issuer_kind: "Issuer" + issuer_group: "cert-manager.io" + # -- Specify to use a namespace other then the one the chart is installed into + namespace: "" + kube_config_file: "" controllerManager: enabled: false