helm-charts-hardened/charts/spiffe-step-ssh/templates/config-configmap.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ include "spiffe-step-ssh.fullname" . }}-config-deployment
  labels:
    {{- include "spiffe-step-ssh.labels" . | nindent 4 }}
data:
  spiffe-helper.conf: |
    agent_address = "/spiffe-workload-api/spire-agent.sock"
    cmd = "sh"
    cmd_args = "/config-deployment/update.sh"
    cert_dir = "/certs"
    svid_file_name = "tls.crt"
    svid_key_file_name = "tls.key"
    svid_bundle_file_name = "ca.pem"
    add_intermediates_to_bundle = false
  update.sh: |
    #!/bin/sh
    export ROOTS=$(base64 /certs/ca.pem | tr '\n' ' ' | sed 's/ //g')
    echo Updating Roots to "$ROOTS"
    cat /config/ca.json > /work/ca.json
    yq e -i -ojson '.authority.provisioners |= map(select(.name == "x5c@spiffe").roots = env(ROOTS))' /work/ca.json
    /helper/kubectl create configmap {{ include "spiffe-step-ssh.fullname" . }}-config -n "{{ .Release.Namespace }}" --from-file=/work/ca.json --from-file=/config/defaults.json --from-file=/config/ssh_x5c.tpl --dry-run=client -o yaml | /helper/kubectl apply -f -
    /helper/kubectl rollout restart statefulset {{ include "spiffe-step-ssh.fullname" . }} -n "{{ .Release.Namespace }}"
    echo $?