panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
752a26565a6c06b7f5cbba21c97ec4a18f16cff5
helm-charts-hardened/charts/spire/charts/spire-server/templates/_helpers.tpl
T
Michael Munchandkfox1111 1ce42d587a fix(spire-server): support postgres TLS client-certificate (passwordless) auth (#922) 
* fix(spire-server): support postgres TLS client-certificate (passwordless) auth

The postgres datastore always injected a password into the connection
string, always created the -dbpw Secret, and always set the DBPW env var,
with no way to use TLS client-certificate (or IAM) authentication. This
forced a dummy password (e.g. "unused") when authenticating with certs.

- Map dataStore.sql.rootCAPath / clientCertPath / clientKeyPath to the
  postgres connection-string options sslrootcert / sslcert / sslkey
  (previously these were mysql-only and rejected for postgres). MySQL keeps
  using the root_ca_path / client_cert_path / client_key_path plugin fields,
  now correctly gated to mysql/aws_mysql only.
- For postgres/aws_postgres, when dataStore.sql.password is empty, omit
  "password=${DBPW}" from the connection string and skip creating the -dbpw
  Secret and the DBPW/RODBPW env vars (mirrors the existing gcp_mysql_sa_iam
  passwordless behavior).
- Add a guard: for postgres, dataStore.sql.password and clientCertPath are
  mutually exclusive.
- Fix a stray tab in the mysql client_key_path config field.
- Update value docs and regenerate the README.

Existing configurations with a password set are unaffected.

Signed-off-by: Michael Munch <[email protected]>

* 🐛 fix(spire-server): keep postgres password when external secret is used

The postgres passwordless path keyed only on an empty password, so
enabling dataStore.sql.externalSecret (or readOnly.externalSecret) with
an empty password dropped the password token from the connection string
and skipped the DBPW/RODBPW env vars, breaking external-secret auth.

- Add shared passwordless predicates that also require external secrets
  to be disabled, evaluated independently for read-write and read-only.
- Use the predicates in datastore-config, secret.yaml, and
  server-resource.yaml so the gating cannot drift.
- Add unit tests for postgres with read-write and read-only external
  secrets plus the cert-auth passwordless case.

Signed-off-by: Michael Munch <[email protected]>

* 🔁 ci: re-trigger checks

Re-run CI; the previous spiffe-step-ssh integration job failed on an
unrelated flaky SSH host-key verification on k8s v1.35.1 (passed on
v1.33.7 and v1.34.3).

Signed-off-by: Michael Munch <[email protected]>

---------

Signed-off-by: Michael Munch <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
2026-08-20 11:15:26 -07:00

556 lines
21 KiB
Smarty
Raw Blame History

{{/*
Expand the name of the chart.
*/}}
{{- define "spire-server.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Spire Server deployment/statefulset
*/}}
{{- define "spire-server.kind" -}}
{{- if not (has .Values.kind (list "statefulset" "deployment")) -}}
{{- fail "Unsupported deployment type" -}}
{{- else -}}
{{- .Values.kind -}}
{{- end -}}
{{- end }}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "spire-server.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Allow the release namespace to be overridden for multi-namespace deployments in combined charts
*/}}
{{- define "spire-server.namespace" -}}
{{- if .Values.namespaceOverride -}}
{{- .Values.namespaceOverride -}}
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
{{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }}
{{- .Values.global.spire.namespaces.server.name }}
{{- else }}
{{- printf "spire-server" }}
{{- end }}
{{- else -}}
{{- .Release.Namespace -}}
{{- end -}}
{{- end -}}
{{- define "spire-server.agent-namespace" -}}
{{- if .Values.namespaceOverride -}}
{{- .Values.namespaceOverride -}}
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
{{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }}
{{- .Values.global.spire.namespaces.system.name }}
{{- else }}
{{- printf "spire-system" }}
{{- end }}
{{- else -}}
{{- .Release.Namespace -}}
{{- end -}}
{{- end -}}
{{- define "spire-server.bundle-namespace-bundlepublisher" -}}
{{- if .Values.bundlePublisher.k8sConfigMap.namespace }}
{{- .Values.bundlePublisher.k8sConfigMap.namespace }}
{{- else if .Values.namespaceOverride -}}
{{- .Values.namespaceOverride -}}
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
{{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }}
{{- .Values.global.spire.namespaces.system.name }}
{{- else }}
{{- printf "spire-system" }}
{{- end }}
{{- else -}}
{{- .Release.Namespace -}}
{{- end -}}
{{- end -}}
{{- define "spire-server.bundle-namespace-notifier" -}}
{{- if .Values.notifier.k8sBundle.namespace }}
{{- .Values.notifier.k8sBundle.namespace }}
{{- else if .Values.namespaceOverride -}}
{{- .Values.namespaceOverride -}}
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
{{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }}
{{- .Values.global.spire.namespaces.system.name }}
{{- else }}
{{- printf "spire-system" }}
{{- end }}
{{- else -}}
{{- .Release.Namespace -}}
{{- end -}}
{{- end -}}
{{- define "spire-server.bundle-namespace" -}}
{{- if .Values.notifier.k8sBundle.namespace }}
{{- .Values.notifier.k8sBundle.namespace }}
{{- else }}
{{- include "spire-server.bundle-namespace-bundlepublisher" . -}}
{{- end }}
{{- end }}
{{- define "spire-server.podMonitor.namespace" -}}
{{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }}
{{- .Values.telemetry.prometheus.podMonitor.namespace }}
{{- else if ne (len (dig "telemetry" "prometheus" "podMonitor" "namespace" "" .Values.global)) 0 }}
{{- .Values.global.telemetry.prometheus.podMonitor.namespace }}
{{- else }}
{{- include "spire-server.namespace" . }}
{{- end }}
{{- end -}}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "spire-server.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "spire-server.labels" -}}
helm.sh/chart: {{ include "spire-server.chart" . }}
{{ include "spire-server.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "spire-server.selectorLabels" -}}
app.kubernetes.io/name: {{ include "spire-server.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{/*
Create the name of the service account to use
*/}}
{{- define "spire-server.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "spire-server.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}
{{- define "spire-server.upstream-ca-secret" -}}
{{- $root := . }}
{{- with .Values.upstreamAuthority.disk -}}
{{- if eq (.secret.create | toString) "true" -}}
{{ include "spire-server.fullname" $root }}-upstream-ca
{{- else -}}
{{ default (include "spire-server.fullname" $root) .secret.name }}
{{- end -}}
{{- end -}}
{{- end }}
{{- define "spire-server.upstream-ejbca-secret" -}}
{{- $root := . }}
{{- with .Values.upstreamAuthority.ejbca -}}
{{- if eq (.secret.create | toString) "true" -}}
{{ include "spire-server.fullname" $root }}-upstream-ejbca
{{- else -}}
{{ default (include "spire-server.fullname" $root) .secret.name }}
{{- end -}}
{{- end -}}
{{- end }}
{{- define "spire-controller-manager.fullname" -}}
{{ include "spire-server.fullname" . | trimSuffix "-server" }}-controller-manager
{{- end }}
{{/*
Name of the chart-generated Secret holding the inline kubeConfigs entries.
*/}}
{{- define "spire-server.kubeconfigs-secret-name" -}}
{{ include "spire-server.fullname" . }}-kubeconfigs
{{- end }}
{{/*
Path of the staged jwt-svid exec plugin binary inside the shared plugins volume. Used both as the
init-container copy target and as the exec kubeconfig command, so the two must stay in sync.
*/}}
{{- define "spire-server.jwt-svid-exec-binary-path" -}}
/plugins/jwt-svid-exec
{{- end }}
{{- define "spire-server.jwt-svid-exec-kubeconfig" -}}
{{- $jwtSVIDExec := .jwtSVIDExec -}}
{{- $root := .root -}}
{{- $spiffeID := $root.Values.jwtSVIDExecConfig.spiffeID -}}
{{- if not $spiffeID -}}
{{- fail "jwtSVIDExecConfig.spiffeID is required when a kubeConfigs entry uses jwtSVIDExec" -}}
{{- end -}}
{{- $chartTD := include "spire-lib.trust-domain" $root -}}
{{- if hasPrefix "/" $spiffeID -}}
{{- $spiffeID = printf "spiffe://%s%s" $chartTD $spiffeID -}}
{{- else if hasPrefix "spiffe://" $spiffeID -}}
{{- $idTD := $spiffeID | trimPrefix "spiffe://" | splitList "/" | first -}}
{{- if ne $idTD $chartTD -}}
{{- fail (printf "jwtSVIDExecConfig.spiffeID trust domain %q must match the chart trust domain %q" $idTD $chartTD) -}}
{{- end -}}
{{- else -}}
{{- fail (printf "jwtSVIDExecConfig.spiffeID %q must be a spiffe:// URI or a path starting with \"/\"" $spiffeID) -}}
{{- end -}}
apiVersion: v1
kind: Config
clusters:
- name: cluster
cluster:
server: {{ $jwtSVIDExec.server | quote }}
certificate-authority-data: {{ $jwtSVIDExec.certificateAuthorityData | quote }}
users:
- name: spiffe
user:
exec:
apiVersion: client.authentication.k8s.io/v1
command: {{ include "spire-server.jwt-svid-exec-binary-path" $root }}
interactiveMode: Never
env:
- name: SPIFFE_JWT_SOURCE
value: "server-admin-api"
- name: SPIRE_SERVER_SOCKET
value: "unix:///tmp/spire-server/private/api.sock"
- name: SPIFFE_ID
value: {{ $spiffeID | quote }}
- name: SPIFFE_JWT_AUDIENCE
value: {{ $jwtSVIDExec.audience | default "k8s" | quote }}
contexts:
- name: cluster
context:
cluster: cluster
user: spiffe
current-context: cluster
{{- end }}
{{- define "spire-server.serviceAccountAllowedList" }}
{{- $releaseNamespace := include "spire-server.agent-namespace" . }}
{{- if ne (len .Values.nodeAttestor.k8sPSAT.serviceAccountAllowList) 0 }}
{{- $list := list }}
{{- range .Values.nodeAttestor.k8sPSAT.serviceAccountAllowList }}
{{- if contains ":" . }}
{{- $list = append $list . }}
{{- else }}
{{- $list = append $list ( printf "%s:%s" $releaseNamespace . ) | }}
{{- end }}
{{- end }}
{{- $list | toJson }}
{{- else }}
[{{ printf "%s:%s-agent" $releaseNamespace .Release.Name | quote }}]
{{- end }}
{{- end }}
{{- define "spire-server.config-sqlite-query" }}
{{- $lst := list }}
{{- range . }}
{{- range $key, $value := . }}
{{- $eValue := toString $value }}
{{- $entry := printf "%s=%s" (urlquery $key) (urlquery $eValue) }}
{{- $lst = append $lst $entry }}
{{- end }}
{{- end }}
{{- if gt (len $lst) 0 }}
{{- printf "?%s" (join "&" (uniq $lst)) }}
{{- end }}
{{- end }}
{{- define "spire-server.config-mysql-query" }}
{{- $lst := list }}
{{- range . }}
{{- range $key, $value := . }}
{{- $eValue := toString $value }}
{{- $entry := printf "%s=%s" (urlquery $key) (urlquery $eValue) }}
{{- $lst = append $lst $entry }}
{{- end }}
{{- end }}
{{- $lst = append $lst "parseTime=true" }}
{{- printf "?%s" (join "&" (uniq $lst)) }}
{{- end }}
{{- define "spire-server.config-postgresql-options" }}
{{- $lst := list }}
{{- range . }}
{{- range $key, $value := . }}
{{- $eValue := toString $value }}
{{- $entry := printf "%s=%s" $key $eValue }}
{{- $lst = append $lst $entry }}
{{- end }}
{{- end }}
{{- if gt (len $lst) 0 }}
{{- printf " %s" (join " " $lst) }}
{{- end }}
{{- end }}
{{- define "spire-server.datastore-is-postgres" -}}
{{- or (eq .Values.dataStore.sql.databaseType "postgres") (eq .Values.dataStore.sql.databaseType "aws_postgres") -}}
{{- end }}
{{- define "spire-server.datastore-postgres-passwordless" -}}
{{- $isPostgres := eq (include "spire-server.datastore-is-postgres" .) "true" -}}
{{- and $isPostgres (eq .Values.dataStore.sql.password "") (not .Values.dataStore.sql.externalSecret.enabled) -}}
{{- end }}
{{- define "spire-server.datastore-postgres-ro-passwordless" -}}
{{- $isPostgres := eq (include "spire-server.datastore-is-postgres" .) "true" -}}
{{- and $isPostgres (eq .Values.dataStore.sql.readOnly.password "") (not .Values.dataStore.sql.readOnly.externalSecret.enabled) -}}
{{- end }}
{{- define "spire-server.datastore-config" }}
{{- $config := dict }}
{{- $pw := "" }}
{{- $ropw := "" }}
{{- if eq .Values.dataStore.sql.databaseType "sqlite3" }}
{{- $_ := set $config "database_type" "sqlite3" }}
{{- if .Values.dataStore.sql.inMemory }}
{{- /* cache=shared is not optional: without it every pooled connection opens its own
empty database, so the server silently loses every write it did not make itself. */}}
{{- $query := include "spire-server.config-sqlite-query" (concat (list (dict "mode" "memory") (dict "cache" "shared")) .Values.dataStore.sql.options) }}
{{- $_ := set $config "connection_string" (printf "memdb%s" $query) }}
{{- else }}
{{- $query := include "spire-server.config-sqlite-query" .Values.dataStore.sql.options }}
{{- $_ := set $config "connection_string" (printf "%s%s" .Values.dataStore.sql.file $query) }}
{{- end }}
{{- else if or (eq .Values.dataStore.sql.databaseType "mysql") (eq .Values.dataStore.sql.databaseType "aws_mysql") (eq .Values.dataStore.sql.databaseType "gcp_mysql_sa_iam") }}
{{- if eq .Values.dataStore.sql.databaseType "mysql" }}
{{- $_ := set $config "database_type" "mysql" }}
{{- $pw = "${DBPW}" }}
{{- $ropw = "${RODBPW}" }}
{{- else if eq .Values.dataStore.sql.databaseType "gcp_mysql_sa_iam" }}
{{- $_ := set $config "database_type" "mysql" }}
{{- $pw = "" }}
{{- $ropw = "" }}
{{- else }}
{{- $_ := set $config "database_type" (list (dict "aws_mysql" (dict "region" .Values.dataStore.sql.region))) }}
{{- $pw = "${DBPW}" }}
{{- $ropw = "${RODBPW}" }}
{{- end }}
{{- $port := int .Values.dataStore.sql.port | default 3306 }}
{{- $query := include "spire-server.config-mysql-query" .Values.dataStore.sql.options }}
{{- if eq $pw "" }}
{{- $_ := set $config "connection_string" (printf "%s@tcp(%s:%d)/%s%s" .Values.dataStore.sql.username .Values.dataStore.sql.host $port .Values.dataStore.sql.databaseName $query) }}
{{- else }}
{{- $_ := set $config "connection_string" (printf "%s:%s@tcp(%s:%d)/%s%s" .Values.dataStore.sql.username $pw .Values.dataStore.sql.host $port .Values.dataStore.sql.databaseName $query) }}
{{- end }}
{{- if .Values.dataStore.sql.readOnly.enabled }}
{{- $roPort := int .Values.dataStore.sql.readOnly.port | default 3306 }}
{{- $roQuery := include "spire-server.config-mysql-query" .Values.dataStore.sql.readOnly.options }}
{{- if eq $ropw "" }}
{{- $_ := set $config "ro_connection_string" (printf "%s@tcp(%s:%d)/%s%s" .Values.dataStore.sql.readOnly.username .Values.dataStore.sql.readOnly.host $roPort .Values.dataStore.sql.readOnly.databaseName $roQuery) }}
{{- else }}
{{- $_ := set $config "ro_connection_string" (printf "%s:%s@tcp(%s:%d)/%s%s" .Values.dataStore.sql.readOnly.username $ropw .Values.dataStore.sql.readOnly.host $roPort .Values.dataStore.sql.readOnly.databaseName $roQuery) }}
{{- end }}
{{- end }}
{{- else if or (eq .Values.dataStore.sql.databaseType "postgres") (eq .Values.dataStore.sql.databaseType "aws_postgres") }}
{{- if eq .Values.dataStore.sql.databaseType "postgres" }}
{{- $_ := set $config "database_type" "postgres" }}
{{- else }}
{{- $_ := set $config "database_type" (list (dict "aws_postgres" (dict "region" .Values.dataStore.sql.region))) }}
{{- end }}
{{- if ne (include "spire-server.datastore-postgres-passwordless" .) "true" }}
{{- $pw = " password=${DBPW}" }}
{{- end }}
{{- if ne (include "spire-server.datastore-postgres-ro-passwordless" .) "true" }}
{{- $ropw = " password=${RODBPW}" }}
{{- end }}
{{- $sslPaths := "" }}
{{- if ne .Values.dataStore.sql.rootCAPath "" }}
{{- $sslPaths = printf "%s sslrootcert=%s" $sslPaths .Values.dataStore.sql.rootCAPath }}
{{- end }}
{{- if ne .Values.dataStore.sql.clientCertPath "" }}
{{- $sslPaths = printf "%s sslcert=%s" $sslPaths .Values.dataStore.sql.clientCertPath }}
{{- end }}
{{- if ne .Values.dataStore.sql.clientKeyPath "" }}
{{- $sslPaths = printf "%s sslkey=%s" $sslPaths .Values.dataStore.sql.clientKeyPath }}
{{- end }}
{{- $port := int .Values.dataStore.sql.port | default 5432 }}
{{- $options:= include "spire-server.config-postgresql-options" .Values.dataStore.sql.options }}
{{- $_ := set $config "connection_string" (printf "dbname=%s user=%s%s host=%s port=%d%s%s" .Values.dataStore.sql.databaseName .Values.dataStore.sql.username $pw .Values.dataStore.sql.host $port $options $sslPaths) }}
{{- if .Values.dataStore.sql.readOnly.enabled }}
{{- $roPort := int .Values.dataStore.sql.readOnly.port | default 5432 }}
{{- $roOptions:= include "spire-server.config-postgresql-options" .Values.dataStore.sql.readOnly.options }}
{{- $_ := set $config "ro_connection_string" (printf "dbname=%s user=%s%s host=%s port=%d%s%s" .Values.dataStore.sql.readOnly.databaseName .Values.dataStore.sql.readOnly.username $ropw .Values.dataStore.sql.readOnly.host $roPort $roOptions $sslPaths) }}
{{- end }}
{{- else }}
{{- fail "Unsupported database type" }}
{{- end }}
{{- $config | toYaml }}
{{- end }}
{{- define "spire-server.upstream-spire-address" }}
{{- if ne (len (dig "spire" "upstreamSpireAddress" "" .Values.global)) 0 }}
{{- print .Values.global.spire.upstreamSpireAddress }}
{{- else if .Values.upstreamAuthority.spire.server.address }}
{{- if contains "." .Values.upstreamAuthority.spire.server.address }}
{{- print .Values.upstreamAuthority.spire.server.address }}
{{- else }}
{{- printf "%s.%s" .Values.upstreamAuthority.spire.server.address (include "spire-lib.trust-domain" .) }}
{{- end }}
{{- else if .Values.upstreamAuthority.spire.server.nameOverride }}
{{- printf "%s-%s" .Release.Name .Values.upstreamAuthority.spire.server.nameOverride }}
{{- else }}
{{- print .Values.upstreamAuthority.spire.server.address }}
{{- end }}
{{- end }}
{{/*
Tornjak specific section
*/}}
{{- define "spire-tornjak.fullname" -}}
{{ include "spire-server.fullname" . | trimSuffix "-server" }}-tornjak
{{- end }}
{{- define "spire-tornjak.config" -}}
{{ include "spire-tornjak.fullname" . }}-config
{{- end }}
{{- define "spire-tornjak.backend" -}}
{{ include "spire-tornjak.fullname" . }}-backend
{{- end }}
{{/*
Tornjak automatically determines the connection type based on provided configuration.
When TLS Secret is provided, it enables TLS connection.
When TLS Secret and User CA Secret (or ConfigMap) are provided, it enables mTLS connection.
Otherwise it starts HTTP Connection
The code below determines what connection type should be used.
*/}}
{{- define "spire-tornjak.connectionType" -}}
{{- if (lookup "v1" "Secret" (include "spire-server.namespace" .) .Values.tornjak.config.tlsSecret) -}}
{{- $caType := default "INVALID" .Values.tornjak.config.clientCA.type }}
{{- if (lookup "v1" $caType (include "spire-server.namespace" .) .Values.tornjak.config.clientCA.name) -}}
{{- printf "mtls" -}}
{{- else }}
{{- printf "tls" -}}
{{- end -}}
{{- else -}}
{{- printf "http" -}}
{{- end -}}
{{- end -}}
{{- define "spire-tornjak.servicename" -}}
{{- include "spire-tornjak.backend" . -}}
{{- end -}}
{{- define "spire-server.test.federation-ingress-args" }}
{{- $args := list }}
{{- $host := "" }}
{{- if .host }}
{{- $host = .host }}
{{- else }}
{{- $host = include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.federation.ingress) }}
{{- if gt (len .Values.federation.ingress.tls) 0 }}
{{- $host = index (index (index .Values.federation.ingress.tls 0) "hosts") 0 }}
{{- end }}
{{- end }}
{{- if dig "tests" "tls" "enabled" false .Values }}
{{- if ne (len (dig "tests" "tls" "customCA" "" .Values)) 0 }}
{{- $args = append $args "--cacert" }}
{{- $args = append $args "/ca/ca.crt" }}
{{- end }}
{{- $args = append $args (printf "https://%s/" $host) }}
{{- else }}
{{- $args = append $args (printf "-k -L http://%s/" $host) }}
{{- end }}
{{ $args | toYaml }}
{{- end -}}
{{- define "spire-server.controller-manager-class-name" -}}
{{- if and (hasKey . "settings") (hasKey .settings "className") }}
{{- .settings.className }}
{{- else if and (hasKey . "defaults") .defaults.className }}
{{- .defaults.className }}
{{- else if .Values.controllerManager.className }}
{{- .Values.controllerManager.className }}
{{- else }}
{{- .Release.Namespace }}-{{ default .Release.Name .Values.crNameOverride }}
{{- end -}}
{{- end -}}
{{- define "spire-server.ca-subject-country" }}
{{- $g := dig "spire" "caSubject" "country" "" .Values.global }}
{{- default .Values.caSubject.country $g }}
{{- end }}
{{- define "spire-server.ca-subject-organization" }}
{{- $g := dig "spire" "caSubject" "organization" "" .Values.global }}
{{- default .Values.caSubject.organization $g }}
{{- end }}
{{- define "spire-server.ca-subject-common-name" }}
{{- $g := dig "spire" "caSubject" "commonName" "" .Values.global }}
{{- default .Values.caSubject.commonName $g }}
{{- end }}
{{- define "spire-server.external-server-subject-kind" -}}
{{- $kind := .Values.externalServerSubject.kind | default "User" }}
{{- if not (has $kind (list "User" "Group" "ServiceAccount")) }}
{{- fail (printf "Unknown externalServerSubject.kind: %s (must be \"User\", \"Group\", or \"ServiceAccount\")" $kind) }}
{{- end }}
{{- $kind }}
{{- end }}
{{- define "spire-server.subject" }}
subjects:
{{- if .Values.externalServer }}
{{- $kind := include "spire-server.external-server-subject-kind" . }}
{{- if eq $kind "ServiceAccount" }}
- kind: ServiceAccount
name: {{ .Values.externalServerSubject.name | quote }}
namespace: {{ .Values.externalServerSubject.namespace | default (include "spire-server.namespace" .) | quote }}
{{- else }}
- apiGroup: rbac.authorization.k8s.io
kind: {{ $kind }}
name: {{ .Values.externalServerSubject.name | quote }}
{{- end }}
{{- else }}
- kind: ServiceAccount
name: {{ include "spire-server.serviceAccountName" . }}
namespace: {{ include "spire-server.namespace" . }}
{{- end }}
{{- end }}
{{- define "spire-server.podSecurityContext" -}}
{{- $podSecurityContext := include "spire-lib.podsecuritycontext" . | fromYaml }}
{{- $openshift := ((.Values).global).openshift | default false }}
{{- if not $openshift }}
{{- if not (hasKey $podSecurityContext "runAsUser") }}
{{- $_ := set $podSecurityContext "runAsUser" 1000 }}
{{- end }}
{{- if not (hasKey $podSecurityContext "runAsGroup") }}
{{- $_ := set $podSecurityContext "runAsGroup" 1000 }}
{{- end }}
{{- end }}
{{- toYaml $podSecurityContext }}
{{- end }}
{{- define "spire-server.identity-exchange-spiffe-prefix" -}}
{{- $cn := "" }}
{{- if .Values.nodeAttestor.x509POP.addClusterName.spiffePrefix }}
{{- $cn = printf "/%s" (include "spire-lib.cluster-name" .) }}
{{- end }}
{{- replace "${HELM_ADD_CLUSTER_NAME}" $cn .Values.nodeAttestor.x509POP.spiffePrefix }}
{{- end }}
Reference in New Issue View Git Blame Copy Permalink