UpstreamAuthority cert-manager support (#82)

charts/spire/charts/spire-server/README.md

@@ -78,6 +78,13 @@ A Helm chart to install the SPIRE server.
 | tolerations | list | `[]` |  |
 | topologySpreadConstraints | list | `[]` |  |
 | trustDomain | string | `"example.org"` |  |
+| upstreamAuthority.certManager.enabled | bool | `false` |  |
+| upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` |  |
+| upstreamAuthority.certManager.issuer_kind | string | `"Issuer"` |  |
+| upstreamAuthority.certManager.issuer_name | string | `"spire-ca"` |  |
+| upstreamAuthority.certManager.kube_config_file | string | `""` |  |
+| upstreamAuthority.certManager.namespace | string | `""` | Specify to use a namespace other then the one the chart is installed into |
+| upstreamAuthority.certManager.rbac.create | bool | `true` |  |
 | upstreamAuthority.disk.enabled | bool | `false` |  |
 | upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. |
 | upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info |

charts/spire/charts/spire-server/templates/configmap.yaml

@@ -1,3 +1,4 @@
+{{ $namespace := .Release.Namespace }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -71,6 +72,22 @@ data:
       }
       {{- end }}
       {{- end }}
+
+      {{- with .Values.upstreamAuthority.certManager }}
+      {{- if eq (.enabled | toString) "true" }}
+      UpstreamAuthority "cert-manager" {
+        plugin_data {
+          issuer_name = {{ .issuer_name | quote }}
+          issuer_kind = {{ .issuer_kind | quote }}
+          issuer_group = {{ .issuer_group | quote }}
+          namespace = {{ default $namespace .namespace | quote }}
+          {{- if ne .kube_config_file "" }}
+          kube_config_file = {{ .kube_config_file | quote }}
+          {{- end }}
+        }
+      }
+      {{- end }}
+      {{- end }}
     }
 
     health_checks {

charts/spire/charts/spire-server/templates/roles.yaml

@@ -18,6 +18,18 @@ rules:
     verbs:
       - get
       - patch
+  {{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.rbac.create }}
+  - apiGroups: ["cert-manager.io"]
+    resources:
+      - certificaterequests
+    verbs:
+      - list
+      - get
+      - create
+      - delete
+      - patch
+      - update
+  {{- end }}
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1

charts/spire/charts/spire-server/values.yaml

@@ -104,6 +104,16 @@ upstreamAuthority:
         certificate: ""
         key: ""
         bundle: ""
+  certManager:
+    enabled: false
+    rbac:
+      create: true
+    issuer_name: "spire-ca"
+    issuer_kind: "Issuer"
+    issuer_group: "cert-manager.io"
+    # -- Specify to use a namespace other then the one the chart is installed into
+    namespace: ""
+    kube_config_file: ""
 
 controllerManager:
   enabled: false