helm-charts-hardened/charts/spire/charts/spire-server/templates/configmap.yaml

{{- define "spire-server.yaml-config" -}}
{{- $upstreamAuthorityUsed := 0 }}
{{- $keyManagerUsed := 0 }}
{{- $root := . }}
server:
  bind_address: "0.0.0.0"
  bind_port: "8081"
  trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
  data_dir: "/run/spire/data"
  log_level: {{ .Values.logLevel | quote }}
  jwt_issuer: {{ include "spire-lib.jwt-issuer" . | quote }}

  ca_key_type: {{ .Values.caKeyType | quote }}
  ca_ttl: {{ .Values.caTTL | quote }}

  default_x509_svid_ttl: {{ .Values.defaultX509SvidTTL | quote }}
  default_jwt_svid_ttl: {{ .Values.defaultJwtSvidTTL | quote }}

  ca_subject:
    {{- with .Values.ca_subject }}
    - country: [{{ .country | quote }}]
      organization: [{{ .organization | quote }}]
      common_name: {{ .common_name | quote }}
    {{- end }}

  {{- with .Values.federation }}
  {{- if eq (.enabled | toString) "true" }}
  federation:
    bundle_endpoint:
      - {{ .bundleEndpoint | toYaml | nindent 8 }}
  {{- end }}
  {{- end }}

plugins:
  DataStore:
    - sql:
        plugin_data:
          {{ include "spire-server.datastore-config" . | nindent 10 }}

  {{- with .Values.nodeAttestor.k8sPsat }}
  {{- if eq (.enabled | toString) "true" }}
  NodeAttestor:
    - k8s_psat:
        plugin_data:
          clusters:
            {{ include "spire-lib.cluster-name" $root }}:
              service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
  {{- end }}
  {{- end }}

  {{- with .Values.keyManager.disk }}
  {{- if eq (.enabled | toString) "true" }}
  {{- $keyManagerUsed = add1 $keyManagerUsed }}
  KeyManager:
    - disk:
        plugin_data:
          keys_path: "/run/spire/data/keys.json"
  {{- end }}
  {{- end }}

  {{- with .Values.keyManager.memory }}
  {{- if eq (.enabled | toString) "true" }}
  {{- $keyManagerUsed = add1 $keyManagerUsed }}
  KeyManager:
    - memory:
        plugin_data:
  {{- end }}
  {{- end }}

  {{- with .Values.keyManager.awsKMS }}
  {{- if eq (.enabled | toString) "true" }}
  {{- $keyManagerUsed = add1 $keyManagerUsed }}
  KeyManager:
    - aws_kms:
        plugin_data:
          region: {{ .region | quote }}
          key_metadata_file: "/run/spire/data/aws-kms-key-metadata"
          {{- if ne .accessKeyID "" }}
          access_key_id: "${AWS_KMS_ACCESS_KEY_ID}"
          {{- end }}
          {{- if ne .secretAccessKey "" }}
          secret_access_key: "${AWS_KMS_SECRET_ACCESS_KEY}"
          {{- end }}
          {{- if or (ne .keyPolicy.policy "") (ne .keyPolicy.existingConfigMap "") }}
          key_policy_file: "/run/spire/data/aws-kms-key-policy.json"
          {{- end }}
  {{- end }}
  {{- end }}

{{- if ne $keyManagerUsed 1 }}
{{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }}
{{- end }}

  Notifier:
    - k8sbundle:
        plugin_data:
          namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }}
          config_map: {{ include "spire-lib.bundle-configmap" . | quote }}

  {{- with .Values.upstreamAuthority.disk }}
  {{- if eq (.enabled | toString) "true" }}
  {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
  UpstreamAuthority:
    - disk:
        plugin_data:
          cert_file_path: "/run/spire/upstream_ca/tls.crt"
          key_file_path: "/run/spire/upstream_ca/tls.key"
          {{- if ne .secret.data.bundle "" }}
          bundle_file_path: "/run/spire/upstream_ca/bundle.crt"
          {{- end }}
  {{- end }}
  {{- end }}

  {{- with .Values.upstreamAuthority.certManager }}
  {{- if eq (.enabled | toString) "true" }}
  {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
  UpstreamAuthority:
    - cert-manager:
        plugin_data:
          issuer_name: {{ default (include "spire-server.fullname" $root) .issuer_name }}-ca
          issuer_kind: {{ .issuer_kind | quote }}
          issuer_group: {{ .issuer_group | quote }}
          namespace: {{ default $root.Release.Namespace .namespace | quote }}
          {{- if ne .kube_config_file "" }}
          kube_config_file: {{ .kube_config_file | quote }}
          {{- end }}
  {{- end }}
  {{- end }}

  {{- with .Values.upstreamAuthority.spire }}
  {{- if eq (.enabled | toString) "true" }}
  {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
  UpstreamAuthority:
    - spire:
        plugin_data:
          server_address: {{ include "spire-server.upstream-spire-address" $root | quote }}
          server_port: {{ .server.port }}
          workload_api_socket: "/run/spire/upstream_agent/spire-agent.sock"
  {{- end }}
  {{- end }}

  {{- with .Values.upstreamAuthority.awsPCA }}
  {{- if eq (.enabled | toString) "true" }}
  {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
  UpstreamAuthority:
    - aws_pca:
        plugin_data:
          region: {{ .region | quote }}
          certificate_authority_arn: {{ .certificateAuthorityARN | quote }}
          ca_signing_template_arn: {{ .caSigningTemplateARN | default "arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen0/V1" | quote }}
          {{- if ne .signingAlgorithm "" }}
          signing_algorithm: {{ .signingAlgorithm | quote }}
          {{- end }}          
          {{- if ne .assumeRoleARN "" }}
          assume_role_arn: {{ .assumeRoleARN | quote }}
          {{- end }}          
          {{- if ne .endpoint "" }}
          endpoint: {{ .endpoint | quote }}
          {{- end }}          
          {{- if ne .supplementalBundlePath "" }}
          supplemental_bundle_path: {{ .supplementalBundlePath  | quote }}
          {{- end }}          
  {{- end }}
  {{- end }}  
{{- if gt $upstreamAuthorityUsed 1 }}
{{- fail "You can only enable a single Upstream Authority." }}
{{- end }}

health_checks:
  listener_enabled: true
  bind_address: "0.0.0.0"
  bind_port: "8080"
  live_path: "/live"
  ready_path: "/ready"

{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
telemetry:
  - Prometheus:
      - host: "0.0.0.0"
        port: 9988
{{- end }}
{{- end }}
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ include "spire-server.fullname" . }}
  namespace: {{ include "spire-server.namespace" . }}
  {{- with .Values.configMap.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
data:
  server.conf: |
    {{- include "spire-server.yaml-config" . | fromYaml | toPrettyJson | nindent 4 }}