Improve upstream CA

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/README.md

@@ -99,19 +99,16 @@ Kubernetes: `>=1.21.0-0`
 | oidc.service.port | int | `80` |  |
 | oidc.service.type | string | `"NodePort"` |  |
 | oidc.tolerations | list | `[]` |  |
-| server.caSecretStorage.enabled | bool | `false` |  |
-| server.caSecretStorage.path | string | `"/conf/server/"` |  |
-| server.caSecretStorage.secretName | string | `"csi-driver-spiffe-ca"` |  |
 | server.config.ca_subject.common_name | string | `"example.org"` |  |
 | server.config.ca_subject.country | string | `"NL"` |  |
 | server.config.ca_subject.organization | string | `"Example"` |  |
 | server.config.jwtIssuer | string | `"oidc-discovery.example.org"` |  |
 | server.config.logLevel | string | `"info"` |  |
 | server.config.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` |  |
-| server.config.upstreamAuthority.disk.bundleFilePath | string | `""` |  |
+| server.config.upstreamAuthority.disk.bundle | string | `""` |  |
-| server.config.upstreamAuthority.disk.certFilePath | string | `"/conf/server/tls.crt"` |  |
+| server.config.upstreamAuthority.disk.certificate | string | `""` |  |
 | server.config.upstreamAuthority.disk.enabled | bool | `false` |  |
-| server.config.upstreamAuthority.disk.keyFilePath | string | `"/conf/server/tls.key"` |  |
+| server.config.upstreamAuthority.disk.key | string | `""` |  |
 | server.dataStorage.accessMode | string | `"ReadWriteOnce"` |  |
 | server.dataStorage.enabled | bool | `true` |  |
 | server.dataStorage.size | string | `"1Gi"` |  |

charts/spire/templates/server-configmap.yaml

@@ -64,10 +64,10 @@ data:
       {{- if eq (.enabled | toString) "true" }}
       UpstreamAuthority "disk" {
         plugin_data {
-          cert_file_path = "{{ .certFilePath }}"
+          cert_file_path = "/run/spire/upstream_ca/tls.crt"
-          key_file_path = "{{ .keyFilePath }}"
+          key_file_path = "/run/spire/upstream_ca/tls.key"
-          {{- if ne .bundleFilePath "" }}
+          {{- if ne .bundle "" }}
-          bundle_file_path = "{{ .bundleFilePath }}"
+          bundle_file_path = "/run/spire/upstream_ca/bundle.crt"
           {{- end }}
         }
       }

charts/spire/templates/server-statefulset.yaml

@@ -59,9 +59,9 @@ spec:
               mountPath: /run/spire/data
               readOnly: false
             {{ end }}
-            {{- if eq (.Values.server.caSecretStorage.enabled | toString) "true" }}
+            {{- if eq (.Values.server.config.upstreamAuthority.disk.enabled | toString) "true" }}
-            - name: secret-data
+            - name: upstream-ca
-              mountPath: {{ .Values.server.caSecretStorage.path }}
+              mountPath: /run/spire/upstream_ca
               readOnly: false
             {{ end }}
           livenessProbe:
@@ -127,10 +127,10 @@ spec:
           hostPath:
             path: /run/spire/server-sockets
             type: DirectoryOrCreate
-        {{- if eq (.Values.server.caSecretStorage.enabled | toString) "true" }}
+        {{- if eq (.Values.server.config.upstreamAuthority.disk.enabled | toString) "true" }}
-        - name: secret-data
+        - name: upstream-ca
           secret:
-            secretName: {{ .Values.server.caSecretStorage.secretName }}
+            secretName: {{ include "spire.fullname" . }}-upstream-ca
         {{- end }}
   volumeClaimTemplates:
     {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }}

charts/spire/templates/upstream-ca-secret.yaml

@@ -0,0 +1,15 @@
+{{- if eq (.Values.server.config.upstreamAuthority.disk.enabled | toString) "true"}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "spire.fullname" . }}-upstream-ca
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "spire.server.labels" . | nindent 4 }}
+data:
+  tls.crt: {{ .Values.server.config.upstreamAuthority.disk.certificate | toYaml | indent 2 }}
+  tls.key: {{ .Values.server.config.upstreamAuthority.disk.key | toYaml | indent 2 }}
+  {{- if ne .Values.server.config.upstreamAuthority.disk.bundle ""}}
+  bundle.crt: {{ .Values.server.config.upstreamAuthority.disk.bundle | toYaml | indent 2 }}
+  {{- end }}
+{{- end }}

charts/spire/values.yaml

@@ -84,11 +84,6 @@ server:
 
   topologySpreadConstraints: []
 
-  caSecretStorage:
-    enabled: false
-    path: /conf/server/
-    secretName: "csi-driver-spiffe-ca"
-
   config:
     logLevel: info
     socketPath: /run/spire/server-sockets/spire-server.sock
@@ -102,9 +97,9 @@ server:
     upstreamAuthority:
       disk:
         enabled: false
-        certFilePath: /conf/server/tls.crt
+        certificate: ""
-        keyFilePath: /conf/server/tls.key
+        key: ""
-        bundleFilePath: ""
+        bundle: ""
 
 agent:
   image: