Add all built in BundlePublishers (#430)

* Add all built in BundlePublishers Signed-off-by: Kevin Fox <[email protected]> * Add secret management Signed-off-by: Kevin Fox <[email protected]> * Fix typo Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
2024-08-27 12:35:23 -07:00
parent 532852d907
commit e72b94fc13
6 changed files with 127 additions and 19 deletions
@@ -1,17 +0,0 @@
-{{- $root := . }}
-{{- with .Values.keyManager.awsKMS }}
-{{- if or (ne .accessKeyID "") (ne .secretAccessKey "") }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "spire-server.fullname" $root }}-aws-kms
-  namespace: {{ include "spire-server.namespace" $root }}
-data:
-  {{- if ne .accessKeyID "" }}
-  AWS_KMS_ACCESS_KEY_ID: {{ .accessKeyID | b64enc }}
-  {{- end }}
-  {{- if ne .secretAccessKey "" }}
-  AWS_KMS_SECRET_ACCESS_KEY: {{ .secretAccessKey | b64enc }}
-  {{- end }}
-{{- end }}
-{{- end }}
@@ -0,0 +1,24 @@
+{{- $root := . }}
+{{- if or (ne .Values.keyManager.awsKMS.accessKeyID "") (ne .Values.keyManager.awsKMS.secretAccessKey "") (ne .Values.secrets.aws.accessKeyID "") (ne .Values.secrets.aws.secretAccessKey "") (ne .Values.secrets.gcp.applicationCredentials "") }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "spire-server.fullname" $root }}-cloud
+  namespace: {{ include "spire-server.namespace" $root }}
+data:
+  {{- if ne .Values.keyManager.awsKMS.accessKeyID "" }}
+  AWS_KMS_ACCESS_KEY_ID: {{ .Values.keyManager.awsKMS.accessKeyID | b64enc }}
+  {{- end }}
+  {{- if ne .Values.keyManager.awsKMS.secretAccessKey "" }}
+  AWS_KMS_SECRET_ACCESS_KEY: {{ .Values.keyManager.awsKMS.secretAccessKey | b64enc }}
+  {{- end }}
+  {{- if ne .Values.secrets.aws.accessKeyID "" }}
+  AWS_ACCESS_KEY_ID: {{ .Values.secrets.aws.accessKeyID | b64enc }}
+  {{- end }}
+  {{- if ne .Values.secrets.aws.secretAccessKey "" }}
+  AWS_SECRET_ACCESS_KEY: {{ .Values.secrets.aws.secretAccessKey | b64enc }}
+  {{- end }}
+  {{- if ne .Values.secrets.gcp.applicationCredentials "" }}
+  GOOGLE_APPLICATION_CREDENTIALS: {{ .Values.secrets.gcp.applicationCredentials | b64enc }}
+  {{- end }}
+{{- end }}
@@ -247,6 +247,31 @@ plugins:
        {{- end }}
  {{- end }}

+  {{- if or .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled .Values.bundlePublisher.awsS3.enabled .Values.bundlePublisher.gcpCloudStorage.enabled }}
+  BundlePublisher:
+    {{- if .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled }}
+    aws_rolesanywhere_trustanchor:
+      plugin_data:
+        region: {{ .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.region | quote }}
+        trust_anchor_id: {{ .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID | quote }}
+    {{- end }}
+    {{- if .Values.bundlePublisher.awsS3.enabled }}
+    aws_s3:
+      plugin_data:
+        region: {{ .Values.bundlePublisher.awsS3.region | quote }}
+        bucket: {{ .Values.bundlePublisher.awsS3.bucket | quote }}
+        object_key: {{ .Values.bundlePublisher.awsS3.objectKey | quote }}
+        format: {{ .Values.bundlePublisher.awsS3.format | quote }}
+    {{- end }}
+    {{- if .Values.bundlePublisher.gcpCloudStorage.enabled }}
+    gcp_cloudstorage:
+      plugin_data:
+        bucket_name: {{ .Values.bundlePublisher.gcpCloudStorage.bucketName | quote }}
+        object_name: {{ .Values.bundlePublisher.gcpCloudStorage.objectName | quote }}
+        format: {{ .Values.bundlePublisher.awsS3.format | quote }}
+    {{- end }}
+  {{- end }}
+
  {{- with .Values.upstreamAuthority.disk }}
  {{- if eq (.enabled | toString) "true" }}
  {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
@@ -174,16 +174,37 @@ spec:
          - name: AWS_KMS_ACCESS_KEY_ID
            valueFrom:
              secretKeyRef:
-                name: {{ $fullname }}-aws-kms
+                name: {{ $fullname }}-cloud
                key: AWS_KMS_ACCESS_KEY_ID
          {{- end }}
          {{- if ne .Values.keyManager.awsKMS.secretAccessKey "" }}
          - name: AWS_KMS_SECRET_ACCESS_KEY
            valueFrom:
              secretKeyRef:
-                name: {{ $fullname }}-aws-kms
+                name: {{ $fullname }}-cloud
                key: AWS_KMS_SECRET_ACCESS_KEY
          {{- end }}
+          {{- if ne .Values.secrets.aws.accessKeyID "" }}
+          - name: AWS_ACCESS_KEY_ID
+            valueFrom:
+              secretKeyRef:
+                name: {{ $fullname }}-cloud
+                key: AWS_ACCESS_KEY_ID
+          {{- end }}
+          {{- if ne .Values.secrets.aws.secretAccessKey "" }}
+          - name: AWS_SECRET_ACCESS_KEY
+            valueFrom:
+              secretKeyRef:
+                name: {{ $fullname }}-cloud
+                key: AWS_SECRET_ACCESS_KEY
+          {{- end }}
+          {{- if ne .Values.secrets.gcp.applicationCredentials "" }}
+          - name: GOOGLE_APPLICATION_CREDENTIALS
+            valueFrom:
+              secretKeyRef:
+                name: {{ $fullname }}-cloud
+                key: GOOGLE_APPLICATION_CREDENTIALS
+          {{- end }}
          ports:
            - name: grpc
              containerPort: 8081