Add a flag to configure the Kubernetes NodeAttestor (#83)

charts/spire/charts/spire-server/README.md

@@ -62,6 +62,7 @@ A Helm chart to install the SPIRE server.
 | jwtIssuer | string | `"oidc-discovery.example.org"` |  |
 | logLevel | string | `"info"` |  |
 | nameOverride | string | `""` |  |
+| nodeAttestor.k8sPsat.enabled | bool | `true` |  |
 | nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` |  |
 | nodeSelector | object | `{}` |  |
 | podAnnotations | object | `{}` |  |

charts/spire/charts/spire-server/templates/configmap.yaml

@@ -1,4 +1,4 @@
-{{ $namespace := .Release.Namespace }}
+{{ $root := . }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -36,15 +36,19 @@ data:
         }
       }
 
+      {{- with .Values.nodeAttestor.k8sPsat }}
+      {{- if eq (.enabled | toString) "true" }}
       NodeAttestor "k8s_psat" {
         plugin_data {
           clusters = {
-            {{ .Values.clusterName | quote }} = {
+            {{ $root.Values.clusterName | quote }} = {
-              service_account_allow_list = {{ include "spire-server.serviceAccountAllowedList" . | trim }}
+              service_account_allow_list = {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
             }
           }
         }
       }
+      {{- end }}
+      {{- end }}
 
       KeyManager "disk" {
         plugin_data {
@@ -80,7 +84,7 @@ data:
           issuer_name = {{ .issuer_name | quote }}
           issuer_kind = {{ .issuer_kind | quote }}
           issuer_group = {{ .issuer_group | quote }}
-          namespace = {{ default $namespace .namespace | quote }}
+          namespace = {{ default $root.Release.Namespace .namespace | quote }}
           {{- if ne .kube_config_file "" }}
           kube_config_file = {{ .kube_config_file | quote }}
           {{- end }}

charts/spire/charts/spire-server/templates/roles.yaml

@@ -44,6 +44,8 @@ roleRef:
   kind: Role
   name: {{ include "spire-server.fullname" . }}
   apiGroup: rbac.authorization.k8s.io
+
+{{- if and .Values.nodeAttestor.k8sPsat.enabled }}
 ---
 # ClusterRole to allow spire-server node attestor to query Token Review API
 # and to be able to push certificate bundles to a configmap
@@ -72,7 +74,6 @@ kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "spire-server.fullname" . }}
-  namespace: {{ .Release.Namespace }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "spire-server.serviceAccountName" . }}
@@ -81,3 +82,4 @@ roleRef:
   kind: ClusterRole
   name: {{ include "spire-server.fullname" . }}
   apiGroup: rbac.authorization.k8s.io
+{{- end }}

charts/spire/charts/spire-server/values.yaml

@@ -180,4 +180,5 @@ initContainers: []
 
 nodeAttestor:
   k8sPsat:
+    enabled: true
     serviceAccountAllowList: []