From f1232960321233f5b758b57aa679c9e89ef8394d Mon Sep 17 00:00:00 2001
From: kfox1111 <Kevin.Fox@pnnl.gov>
Date: Mon, 6 Mar 2023 10:59:54 -0800
Subject: [PATCH] Add a flag to configure the Kubernetes NodeAttestor (#83)

---
 charts/spire/charts/spire-server/README.md           |  1 +
 .../charts/spire-server/templates/configmap.yaml     | 12 ++++++++----
 .../spire/charts/spire-server/templates/roles.yaml   |  4 +++-
 charts/spire/charts/spire-server/values.yaml         |  1 +
 4 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index f56eb50..a194e0f 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -62,6 +62,7 @@ A Helm chart to install the SPIRE server.
 | jwtIssuer | string | `"oidc-discovery.example.org"` |  |
 | logLevel | string | `"info"` |  |
 | nameOverride | string | `""` |  |
+| nodeAttestor.k8sPsat.enabled | bool | `true` |  |
 | nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` |  |
 | nodeSelector | object | `{}` |  |
 | podAnnotations | object | `{}` |  |
diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml
index bba5004..e24beda 100644
--- a/charts/spire/charts/spire-server/templates/configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/configmap.yaml
@@ -1,4 +1,4 @@
-{{ $namespace := .Release.Namespace }}
+{{ $root := . }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -36,15 +36,19 @@ data:
         }
       }
 
+      {{- with .Values.nodeAttestor.k8sPsat }}
+      {{- if eq (.enabled | toString) "true" }}
       NodeAttestor "k8s_psat" {
         plugin_data {
           clusters = {
-            {{ .Values.clusterName | quote }} = {
-              service_account_allow_list = {{ include "spire-server.serviceAccountAllowedList" . | trim }}
+            {{ $root.Values.clusterName | quote }} = {
+              service_account_allow_list = {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
             }
           }
         }
       }
+      {{- end }}
+      {{- end }}
 
       KeyManager "disk" {
         plugin_data {
@@ -80,7 +84,7 @@ data:
           issuer_name = {{ .issuer_name | quote }}
           issuer_kind = {{ .issuer_kind | quote }}
           issuer_group = {{ .issuer_group | quote }}
-          namespace = {{ default $namespace .namespace | quote }}
+          namespace = {{ default $root.Release.Namespace .namespace | quote }}
           {{- if ne .kube_config_file "" }}
           kube_config_file = {{ .kube_config_file | quote }}
           {{- end }}
diff --git a/charts/spire/charts/spire-server/templates/roles.yaml b/charts/spire/charts/spire-server/templates/roles.yaml
index 5d09e4e..d2da097 100644
--- a/charts/spire/charts/spire-server/templates/roles.yaml
+++ b/charts/spire/charts/spire-server/templates/roles.yaml
@@ -44,6 +44,8 @@ roleRef:
   kind: Role
   name: {{ include "spire-server.fullname" . }}
   apiGroup: rbac.authorization.k8s.io
+
+{{- if and .Values.nodeAttestor.k8sPsat.enabled }}
 ---
 # ClusterRole to allow spire-server node attestor to query Token Review API
 # and to be able to push certificate bundles to a configmap
@@ -72,7 +74,6 @@ kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "spire-server.fullname" . }}
-  namespace: {{ .Release.Namespace }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "spire-server.serviceAccountName" . }}
@@ -81,3 +82,4 @@ roleRef:
   kind: ClusterRole
   name: {{ include "spire-server.fullname" . }}
   apiGroup: rbac.authorization.k8s.io
+{{- end }}
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 03bd071..254359f 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -180,4 +180,5 @@ initContainers: []
 
 nodeAttestor:
   k8sPsat:
+    enabled: true
     serviceAccountAllowList: []