Use Spiffe Helm Chart for Spire (#496)

* Use Spiffe Helm Chart for Spire

Signed-off-by: Brad Beck <bradley.beck@gmail.com>

* Upgrade Helm v3.7.1 -> v3.14.3

Signed-off-by: Brad Beck <bradley.beck@gmail.com>

---------

Signed-off-by: Brad Beck <bradley.beck@gmail.com>
Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>

platform/00-kubernetes-minikube-setup.sh

@@ -10,10 +10,10 @@ MINIKUBE_VERSION=v1.30.1
 MINIKUBE_FILE_NAME=minikube-linux-amd64
 MINIKUBE_URL=https://github.com/kubernetes/minikube/releases/download/$MINIKUBE_VERSION/$MINIKUBE_FILE_NAME
 
-HELM_VERSION=v3.7.1
-HELM_FILE_NAME=helm-v3.7.1-linux-amd64.tar.gz
+HELM_VERSION=v3.14.3
+HELM_FILE_NAME=helm-v3.14.3-linux-amd64.tar.gz
 HELM_URL=https://get.helm.sh/$HELM_FILE_NAME
-HELM_SHA256="6cd6cad4b97e10c33c978ff3ac97bb42b68f79766f1d2284cfd62ec04cd177f4"
+HELM_SHA256="3c90f24e180f8c207b8a18e5ec82cb0fa49858a7a0a86e4ed52a98398681e00b"
 
 TKN_VERSION=v0.33.0
 TKN_FILE_NAME=tkn_0.33.0_Linux_x86_64.tar.gz

platform/20-spire-install.sh

@@ -12,9 +12,12 @@ C_RESET_ALL='\033[0m'
 
 kubectl create namespace spire --dry-run=client -o yaml | kubectl apply -f -
 
-helm upgrade --install spire "${GIT_ROOT}/platform/vendor/spire/chart" \
-  --values "${GIT_ROOT}/platform/components/spire/values.yaml" \
-  --namespace spire --wait
+helm upgrade --install -n spire spire-crds "${GIT_ROOT}/platform/vendor/spire/crd" --wait
+helm upgrade --install -n spire spire "${GIT_ROOT}/platform/vendor/spire/server" \
+  --values "${GIT_ROOT}/platform/components/spire/values.yaml" --wait
 
 kubectl rollout status -n spire statefulset/spire-server
 kubectl rollout status -n spire daemonset/spire-agent
+kubectl rollout status -n spire daemonset/spire-spiffe-csi-driver
+kubectl rollout status -n spire deploy/spire-spiffe-oidc-discovery-provider
+

platform/26-vault-setup.sh

@@ -45,7 +45,7 @@ fi
 
 vault_exec read auth/jwt/config >/dev/null 2>&1 || \
 vault_exec write auth/jwt/config \
-  oidc_discovery_url=https://spire-oidc.spire.svc.cluster.local \
+  oidc_discovery_url=https://spire-spiffe-oidc-discovery-provider.spire.svc.cluster.local \
   default_role="spire-chains-controller"
 
 vault_exec policy read spire-transit >/dev/null 2>&1 || \

platform/components/cert-manager/spire.yaml

@@ -9,7 +9,7 @@ spec:
   duration: 336h     # 14 days
   renewBefore: 168h  #  7 days
   dnsNames:
-    - spire-oidc.spire.svc.cluster.local
+    - spire-spiffe-oidc-discovery-provider.spire.svc.cluster.local
     - oidc.example.org
     - oidc
   privateKey:

platform/components/spire/values.yaml

@@ -1,20 +1,12 @@
-server:
-  trustDomain: "example.org"
-  clusterName: frsca
-
-agent:
-  kubeletSkipVerification: true
-
-csi:
-  enabled: true
-
-client:
-  enabled: false
-
-oidc:
-  enabled: true
-  discoveryDomain: "spire-oidc.spire.svc.cluster.local"
-  # discoveryDomain: "oidc.example.org"
-  acme:
-    enabled: false
-  certsSecret: oidc-cert
+global:
+  spire:
+    clusterName: frsca
+    trustDomain: example.org
+
+spiffe-oidc-discovery-provider:
+  tls:
+    spire:
+      enabled: false
+    externalSecret:
+      enabled: true
+      secretName: oidc-cert