panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add first-class support for gcp_cas UpstreamAuthority plugin (#914)

Browse Source 
The gcp_cas built-in plugin was not wired into the spire-server chart.
This adds values, configmap rendering, and generated docs to support
GCP Certificate Authority Service as an upstream authority, matching
the existing awsPCA pattern.

Signed-off-by: saumil Macwan <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
Saumil Macwan
2026-08-18 15:03:28 -07:00
committed by GitHub
co-authored by kfox1111
parent 59bb8a774c
commit f1dddf2e85
3 changed files with 35 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+6
View File
@@ -272,6 +272,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `upstreamAuthority.awsSecret.keyFileArn` | ARN or name of the secret containing the intermediate CA private key | `""` |
| `upstreamAuthority.awsSecret.bundleFileArn` | (Optional) ARN or name of the secret containing the root CA bundle | `""` |
| `upstreamAuthority.awsSecret.assumeRoleArn` | (Optional) ARN of an IAM role to assume | `""` |
| `upstreamAuthority.gcpCAS.enabled` | Flag to enable upstream authority plugin with GCP Certificate Authority Service | `false` |
| `upstreamAuthority.gcpCAS.projectName` | GCP project containing the root CA certificate | `""` |
| `upstreamAuthority.gcpCAS.regionName` | GCP region name (e.g., us-central1) | `""` |
| `upstreamAuthority.gcpCAS.caPool` | Name of the CA Pool that has the root CA certificate | `""` |
| `upstreamAuthority.gcpCAS.labelKey` | Label key used to filter and select the relevant CA certificate | `""` |
| `upstreamAuthority.gcpCAS.labelValue` | Label value used to filter and select the relevant CA certificate | `""` |
| `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` |
| `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` |
| `upstreamAuthority.certManager.issuerName` | Defaults to the release name, override if CA is provided outside of the chart | `""` |
charts/spire/charts/spire-server/templates/configmap.yaml
+16
View File
@@ -656,6 +656,22 @@ plugins:
{{- end }}
{{- end }}
{{- end }}
{{- with .Values.upstreamAuthority.gcpCAS }}
{{- if eq (.enabled | toString) "true" }}
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
UpstreamAuthority:
gcp_cas:
plugin_data:
root_cert_spec:
project_name: {{ .projectName | quote }}
region_name: {{ .regionName | quote }}
ca_pool: {{ .caPool | quote }}
label_key: {{ .labelKey | quote }}
label_value: {{ .labelValue | quote }}
{{- end }}
{{- end }}
{{- if gt $upstreamAuthorityUsed 1 }}
{{- fail "You can only enable a single Upstream Authority." }}
{{- end }}
charts/spire/charts/spire-server/values.yaml
+13
View File
@@ -551,6 +551,19 @@ upstreamAuthority:
bundleFileArn: ""
## @param upstreamAuthority.awsSecret.assumeRoleArn (Optional) ARN of an IAM role to assume
assumeRoleArn: ""
gcpCAS:
## @param upstreamAuthority.gcpCAS.enabled Flag to enable upstream authority plugin with GCP Certificate Authority Service
enabled: false
## @param upstreamAuthority.gcpCAS.projectName GCP project containing the root CA certificate
projectName: ""
## @param upstreamAuthority.gcpCAS.regionName GCP region name (e.g., us-central1)
regionName: ""
## @param upstreamAuthority.gcpCAS.caPool Name of the CA Pool that has the root CA certificate
caPool: ""
## @param upstreamAuthority.gcpCAS.labelKey Label key used to filter and select the relevant CA certificate
labelKey: ""
## @param upstreamAuthority.gcpCAS.labelValue Label value used to filter and select the relevant CA certificate
labelValue: ""
certManager:
## @param upstreamAuthority.certManager.enabled Flag to enable upstream authority plugin with cert manager
enabled: false