From f93434a926187aca08457e94686f3ae29371d3c0 Mon Sep 17 00:00:00 2001
From: Kevin Fox <Kevin.Fox@pnnl.gov>
Date: Mon, 6 Mar 2023 06:03:02 -0800
Subject: [PATCH] Make server service account allow list configurable

If you don't have the agent and server in the same namespace or the same
cluster, or want to bind additional clusters, you need the ability to
configure the service account allow list.

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>
---
 charts/spire/charts/spire-server/README.md                | 1 +
 charts/spire/charts/spire-server/templates/_helpers.tpl   | 8 ++++++++
 charts/spire/charts/spire-server/templates/configmap.yaml | 2 +-
 charts/spire/charts/spire-server/values.yaml              | 4 ++++
 4 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index ea98185..d2428c5 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -62,6 +62,7 @@ A Helm chart to install the SPIRE server.
 | jwtIssuer | string | `"oidc-discovery.example.org"` |  |
 | logLevel | string | `"info"` |  |
 | nameOverride | string | `""` |  |
+| nodeAttestor.k8sPsat.serviceAccountsAllowed | list | `[]` |  |
 | nodeSelector | object | `{}` |  |
 | podAnnotations | object | `{}` |  |
 | podSecurityContext | object | `{}` |  |
diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl
index 9e68939..2d094f8 100644
--- a/charts/spire/charts/spire-server/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-server/templates/_helpers.tpl
@@ -92,3 +92,11 @@ Create the name of the service account to use
 {{- define "spire-k8s-workload-registrar.fullname" -}}
 {{ include "spire-server.fullname" . | trimSuffix "-server" }}-k8s-workload-registrar
 {{- end }}
+
+{{- define "spire-server.serviceAccountAllowedList" }}
+{{- if ne (len .Values.nodeAttestor.k8sPsat.serviceAccountsAllowed) 0 }}
+{{- .Values.nodeAttestor.k8sPsat.serviceAccountsAllowed | toJson }}
+{{- else }}
+[{{ printf "%s:%s-agent" .Release.Namespace .Release.Name | quote }}]
+{{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml
index c67dff1..bba5004 100644
--- a/charts/spire/charts/spire-server/templates/configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/configmap.yaml
@@ -40,7 +40,7 @@ data:
         plugin_data {
           clusters = {
             {{ .Values.clusterName | quote }} = {
-              service_account_allow_list = ["{{ .Release.Namespace }}:{{ .Release.Name }}-agent"]
+              service_account_allow_list = {{ include "spire-server.serviceAccountAllowedList" . | trim }}
             }
           }
         }
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 5ec626d..a816836 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -177,3 +177,7 @@ extraVolumeMounts: []
 extraContainers: []
 
 initContainers: []
+
+nodeAttestor:
+  k8sPsat:
+    serviceAccountsAllowed: []