Add spire-credentialcomposer-cel support (#587)

* Add spire-credentialcomposer-cel support

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Bump version

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>

charts/spire/charts/spire-server/values.yaml

@@ -340,6 +340,34 @@ caSubject:
   commonName: example.org
 
 credentialComposer:
+  cel:
+    ## @param credentialComposer.cel.enabled Enable the cel based credential composer
+    enabled: false
+    ## @param credentialComposer.cel.image.registry The OCI registry to pull the image from
+    ## @param credentialComposer.cel.image.repository The repository within the registry
+    ## @param credentialComposer.cel.image.pullPolicy The image pull policy
+    ## @param credentialComposer.cel.image.tag Overrides the image tag
+    ##
+    image:
+      registry: ghcr.io
+      repository: spiffe/spire-credentialcomposer-cel
+      pullPolicy: IfNotPresent
+      tag: "0.0.2"
+    ## @param credentialComposer.cel.checksum The sha256 checksum of the plugin binary
+    checksum: 23fa1d10f15ad5d5c555930cf82289c664801d7d5609bfd8847f95a0a667e4e4
+    ## @param credentialComposer.cel.pluginPath The filename in the container of the plugin
+    pluginPath: /ko-app/cmd
+    jwt:
+      ## @param credentialComposer.cel.jwt.expression The expression to use for jwt token composing
+      expression: ""
+      #expression: |
+      #  spire.plugin.server.credentialcomposer.v1.ComposeWorkloadJWTSVIDResponse{
+      #    attributes: spire.plugin.server.credentialcomposer.v1.JWTSVIDAttributes{
+      #      claims: request.attributes.claims.mapOverrideEntries(
+      #        {'newclaim': "value"}
+      #      )
+      #    }
+      #  }
   uniqueID:
     ## @param credentialComposer.uniqueID.enabled Add the x509UniqueIdentifier attribute to workload X509-SVIDs
     enabled: false
@@ -779,6 +807,17 @@ tools:
       repository: rancher/kubectl
       pullPolicy: IfNotPresent
       tag: ""
+  busybox:
+    ## @param tools.busybox.image.registry The OCI registry to pull the image from
+    ## @param tools.busybox.image.repository The repository within the registry
+    ## @param tools.busybox.image.pullPolicy The image pull policy
+    ## @param tools.busybox.image.tag Overrides the image tag whose default is the chart appVersion
+    ##
+    image:
+      registry: ""
+      repository: busybox
+      pullPolicy: IfNotPresent
+      tag: 1.37.0-uclibc
 
 telemetry:
   prometheus: