Align config across components

Signed-off-by: Marco Franssen <[email protected]>

charts/spire/README.md

@@ -48,6 +48,7 @@ Kubernetes: `>=1.21.0-0`
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
+| agent.config.logLevel | string | `"info"` |  |
 | agent.image.pullPolicy | string | `"IfNotPresent"` |  |
 | agent.image.registry | string | `"ghcr.io"` |  |
 | agent.image.repository | string | `"spiffe/spire-agent"` |  |
@@ -71,15 +72,14 @@ Kubernetes: `>=1.21.0-0`
 | nodeDriverRegistrar.image.repository | string | `"k8scsi/csi-node-driver-registrar"` |  |
 | nodeDriverRegistrar.image.version | string | `"v2.0.1"` |  |
 | nodeDriverRegistrar.resources | object | `{}` |  |
-| oidc.acme.cacheDir | string | `"/run/spire"` |  |
-| oidc.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` |  |
-| oidc.acme.emailAddress | string | `"[email protected]"` |  |
-| oidc.acme.tosAccepted | bool | `false` |  |
 | oidc.affinity | object | `{}` |  |
-| oidc.domains[0] | string | `"localhost"` |  |
+| oidc.config.acme.cacheDir | string | `"/run/spire"` |  |
-| oidc.domains[1] | string | `"spire-oidc.spire"` |  |
+| oidc.config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` |  |
-| oidc.domains[2] | string | `"spire-oidc.spire.svc.cluster.local"` |  |
+| oidc.config.acme.emailAddress | string | `"[email protected]"` |  |
-| oidc.domains[3] | string | `"oidc-discovery.example.org"` |  |
+| oidc.config.acme.tosAccepted | bool | `false` |  |
+| oidc.config.domains[0] | string | `"localhost"` |  |
+| oidc.config.domains[1] | string | `"oidc-discovery.example.org"` |  |
+| oidc.config.logLevel | string | `"info"` |  |
 | oidc.enabled | bool | `false` |  |
 | oidc.image.pullPolicy | string | `"IfNotPresent"` |  |
 | oidc.image.registry | string | `"ghcr.io"` |  |
@@ -90,8 +90,6 @@ Kubernetes: `>=1.21.0-0`
 | oidc.insecureScheme.nginx.image.registry | string | `"cgr.dev"` |  |
 | oidc.insecureScheme.nginx.image.repository | string | `"chainguard/nginx"` |  |
 | oidc.insecureScheme.nginx.image.version | float | `1.23` |  |
-| oidc.jwtIssuer | string | `"oidc-discovery.example.org"` |  |
-| oidc.logLevel | string | `"INFO"` |  |
 | oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |
 | oidc.podAnnotations | object | `{}` |  |
 | oidc.podSecurityContext | object | `{}` |  |
@@ -102,6 +100,11 @@ Kubernetes: `>=1.21.0-0`
 | oidc.service.port | int | `80` |  |
 | oidc.service.type | string | `"NodePort"` |  |
 | oidc.tolerations | list | `[]` |  |
+| server.config.ca_subject.common_name | string | `"example.org"` |  |
+| server.config.ca_subject.country | string | `"NL"` |  |
+| server.config.ca_subject.organization | string | `"Example"` |  |
+| server.config.jwtIssuer | string | `"oidc-discovery.example.org"` |  |
+| server.config.logLevel | string | `"info"` |  |
 | server.dataStorage.accessMode | string | `"ReadWriteOnce"` |  |
 | server.dataStorage.enabled | bool | `true` |  |
 | server.dataStorage.size | string | `"1Gi"` |  |
@@ -120,9 +123,7 @@ Kubernetes: `>=1.21.0-0`
 | serviceAccount.annotations | object | `{}` |  |
 | serviceAccount.create | bool | `true` |  |
 | serviceAccount.name | string | `""` |  |
-| spire.agent.logLevel | string | `"info"` |  |
 | spire.clusterName | string | `"example-cluster"` |  |
-| spire.server.logLevel | string | `"info"` |  |
 | spire.trustDomain | string | `"example.org"` |  |
 | waitForIt.image.pullPolicy | string | `"IfNotPresent"` |  |
 | waitForIt.image.registry | string | `"gcr.io"` |  |

charts/spire/templates/agent-configmap.yaml

@@ -7,7 +7,7 @@ data:
   agent.conf: |
     agent {
       data_dir = "/run/spire"
-      log_level = "{{ .Values.spire.agent.logLevel }}"
+      log_level = "{{ .Values.agent.config.logLevel }}"
       server_address = "{{ include "spire.fullname" . }}-server"
       server_port = "{{ .Values.server.service.port }}"
       socket_path = "/run/spire/agent-sockets/agent.sock"

charts/spire/templates/oidc-dp-configmap.yaml

@@ -6,13 +6,13 @@ metadata:
   namespace: {{ .Release.Namespace }}
 data:
   oidc-discovery-provider.conf: |
-    log_level = "{{ .Values.oidc.logLevel }}"
+    log_level = "{{ .Values.oidc.config.logLevel }}"
 
     domains = [
       "spire-oidc.{{ .Release.Namespace }}",
       "spire-oidc.{{ .Release.Namespace }}.svc.cluster.local",
-    {{- if gt (len .Values.oidc.domains) 0 }}
+    {{- if gt (len .Values.oidc.config.domains) 0 }}
-      "{{- join "\",\n      \"" .Values.oidc.domains }}"
+      "{{- join "\",\n      \"" .Values.oidc.config.domains }}"
     {{- end }}
     ]
 
@@ -21,10 +21,10 @@ data:
     listen_socket_path = "/run/spire/oidc-sockets/oidc-server.sock"
     {{- else }}
     acme {
-      directory_url = "{{ .Values.oidc.acme.directoryUrl }}"
+      directory_url = "{{ .Values.oidc.config.acme.directoryUrl }}"
-      cache_dir = "{{ .Values.oidc.acme.cacheDir }}"
+      cache_dir = "{{ .Values.oidc.config.acme.cacheDir }}"
-      tos_accepted = {{ .Values.oidc.acme.tosAccepted }}
+      tos_accepted = {{ .Values.oidc.config.acme.tosAccepted }}
-      email = "{{ .Values.oidc.acme.emailAddress }}"
+      email = "{{ .Values.oidc.config.acme.emailAddress }}"
     }
     {{- end }}
 

charts/spire/templates/server-configmap.yaml

@@ -11,19 +11,21 @@ data:
       socket_path = "/run/spire/server-sockets/registration.sock"
       trust_domain = {{ .Values.spire.trustDomain | quote }}
       data_dir = "/run/spire/data"
-      log_level = "{{ .Values.spire.server.logLevel }}"
+      log_level = "{{ .Values.server.config.logLevel }}"
-      #AWS requires the use of RSA.  EC cryptography is not supported
+      # AWS requires the use of RSA.  EC cryptography is not supported
       ca_key_type = "rsa-2048"
 
       {{- if eq (.Values.oidc.enabled | toString) "true" }}
-      jwt_issuer = "{{ .Values.oidc.jwtIssuer }}"
+      jwt_issuer = "{{ .Values.server.config.jwtIssuer }}"
       {{ end }}
       default_x509_svid_ttl = "1h"
       default_jwt_svid_ttl = "1h"
       ca_subject = {
-        country = ["NL"],
+        {{- with .Values.server.config.ca_subject }}
-        organization = ["EXAMPLE"],
+        country = [{{ .country | quote }}],
-        common_name = "",
+        organization = [{{ .organization | quote }}],
+        common_name = {{ .common_name | quote }},
+        {{- end }}
       }
     }
 

charts/spire/values.yaml

@@ -75,6 +75,43 @@ server:
     # runAsNonRoot: true
     # runAsUser: 1000
 
+  config:
+    logLevel: info
+    jwtIssuer: oidc-discovery.example.org
+
+    ca_subject:
+      country: NL
+      organization: Example
+      common_name: example.org
+
+agent:
+  image:
+    # registry: gcr.io
+    # repository: spiffe-io/spire-agent
+    registry: ghcr.io
+    repository: spiffe/spire-agent
+    pullPolicy: IfNotPresent
+    # Overrides the image tag whose default is the chart appVersion.
+    version: ""
+
+  nodeSelector:
+    kubernetes.io/arch: amd64
+
+  resources: {}
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    # requests:
+    #   cpu: 50m
+    #   memory: 64Mi
+    # limits:
+    #   cpu: 100m
+    #   memory: 128Mi
+
+  config:
+    logLevel: info
+
 csiDriver:
   image:
     registry: ghcr.io
@@ -138,20 +175,12 @@ oidc:
     #   cpu: 100m
     #   memory: 64Mi
 
-  logLevel: INFO
-
   service:
     type: NodePort
     port: 80
     annotations: {}
       # external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org
 
-  jwtIssuer: oidc-discovery.example.org
-
-  domains:
-    - localhost
-    - oidc-discovery.example.org
-
   podSecurityContext: {}
     # fsGroup: 2000
 
@@ -178,36 +207,17 @@ oidc:
         pullPolicy: IfNotPresent
         version: 1.23
 
-  acme:
+  config:
-    tosAccepted: false
+    logLevel: info
-    cacheDir: /run/spire
+    domains:
-    directoryUrl: https://acme-v02.api.letsencrypt.org/directory
+      - localhost
-    emailAddress: [email protected]
+      - oidc-discovery.example.org
 
-agent:
+    acme:
-  image:
+      tosAccepted: false
-    # registry: gcr.io
+      cacheDir: /run/spire
-    # repository: spiffe-io/spire-agent
+      directoryUrl: https://acme-v02.api.letsencrypt.org/directory
-    registry: ghcr.io
+      emailAddress: [email protected]
-    repository: spiffe/spire-agent
-    pullPolicy: IfNotPresent
-    # Overrides the image tag whose default is the chart appVersion.
-    version: ""
-
-  nodeSelector:
-    kubernetes.io/arch: amd64
-
-  resources: {}
-    # We usually recommend not to specify default resources and to leave this as a conscious
-    # choice for the user. This also increases chances charts run on environments with little
-    # resources, such as Minikube. If you do want to specify resources, uncomment the following
-    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-    # requests:
-    #   cpu: 50m
-    #   memory: 64Mi
-    # limits:
-    #   cpu: 100m
-    #   memory: 128Mi
 
 imagePullSecrets: []
   # - name: my-docker-registry
@@ -236,7 +246,3 @@ autoscaling:
 spire:
   clusterName: "example-cluster"
   trustDomain: "example.org"
-  agent:
-    logLevel: info
-  server:
-    logLevel: info