devx: Add extra cas for spire agent

Added in the same manner as done for the SPIRE server already.
This allows configuring the agent to trust self-signed certificates for
local dev.

Author: alec-w

charts/spire/charts/spire-agent/README.md

@@ -126,6 +126,7 @@ A Helm chart to install the SPIRE agent.
 | `extraVolumes`                                         | Extra volumes to be mounted on Spire Agent pods                                                                                                                                                   | `[]`                                                                             |
 | `extraVolumeMounts`                                    | Extra volume mounts for Spire Agent pods                                                                                                                                                          | `[]`                                                                             |
 | `extraContainers`                                      | Additional containers to create with Spire Agent pods                                                                                                                                             | `[]`                                                                             |
+| `extraCAs`                                             | A bundle, in PEM format, of X.509 certificates representing additional Certificate Authorities (CAs) to add to the default (WebPKI) trust store                                                   | `""`                                                                             |
 | `initContainers`                                       | Additional init containers to create with Spire Agent pods                                                                                                                                        | `[]`                                                                             |
 | `hostAliases`                                          | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/                                                                               | `[]`                                                                             |
 | `customPlugins.keyManager`                             | Custom plugins of type KeyManager are configured here                                                                                                                                             | `{}`                                                                             |

charts/spire/charts/spire-agent/templates/daemonset.yaml

@@ -290,6 +290,12 @@ spec:
               mountPath: /hostCert
               readOnly: true
             {{- end }}
+            {{- if .Values.extraCAs }}
+            - name: extra-ca
+              mountPath: /etc/ssl/certs/extra-ca.crt
+              subPath: ca.crt
+              readOnly: true
+            {{- end -}}
             {{- if gt (len .Values.extraVolumeMounts) 0 }}
             {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
             {{- end }}
@@ -392,6 +398,11 @@ spec:
           hostPath:
             path: {{ .Values.workloadAttestors.k8s.verification.hostCert.basePath | quote }}
         {{- end }}
+        {{- if .Values.extraCAs }}
+        - name: extra-ca
+          configMap:
+            name: {{ include "spire-agent.fullname" . }}-extra-ca
+        {{- end -}}
         {{- if gt (len .Values.extraVolumes) 0 }}
         {{- toYaml .Values.extraVolumes | nindent 8 }}
         {{- end }}

charts/spire/charts/spire-agent/templates/extra-ca-configmap.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.extraCAs }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "spire-agent.fullname" . }}-extra-ca
+  namespace: {{ include "spire-agent.namespace" . }}
+  labels:
+    {{- include "spire-agent.labels" . | nindent 4 }}
+data:
+  ca.crt: |
+{{ .Values.extraCAs | indent 4 }}
+{{- end }}

charts/spire/charts/spire-agent/values.yaml

@@ -315,6 +315,9 @@ extraVolumeMounts: []
 ## @param extraContainers [array] Additional containers to create with Spire Agent pods
 extraContainers: []
 
+## @param extraCAs [string] A bundle, in PEM format, of X.509 certificates representing additional Certificate Authorities (CAs) to add to the default (WebPKI) trust store
+extraCAs: ""
+
 ## @param initContainers [array] Additional init containers to create with Spire Agent pods
 initContainers: []
 ## @param hostAliases [array] Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/