Add support for spire-server ingress (#68)

Co-authored-by: Faisal Memon <[email protected]> Co-authored-by: Marco Franssen <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-05-23 13:58:58 +00:00
parent 4777a30012
commit 0ba03880a1
12 changed files with 257 additions and 28 deletions
@@ -12,3 +12,25 @@ helm upgrade --install --namespace spire-server spire charts/spire -f values.yam
 ```

 See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
+
+If you want to expose your spire-server outside of Kubernetes and are using ingress-nginx, add following values file when running `helm template/install/upgrade`.
+
+```shell
+-f values-expose-spire-server-ingress-nginx.yaml
+```
+
+If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx
+you have two options as described here:
+https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles
+
+If you chose profile https_web, use:
+
+```shell
+-f values-expose-federation-https-web-ingress-nginx.yaml
+```
+
+If you chose profile https_spiffe, use:
+
+```shell
+-f values-expose-federation-https-spiffe-ingress-nginx.yaml
+```
@@ -0,0 +1,25 @@
+spire-server:
+  federation:
+    enabled: true
+    ingress:
+      enabled: true
+      annotations:
+        nginx.ingress.kubernetes.io/ssl-redirect: "true"
+        nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+        nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+        nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+
+        # Optional settings you may put in your own values.
+        # kubernetes.io/ingress.class: nginx
+        # kubernetes.io/tls-acme: "true"
+
+      # className: nginx
+ 
+      hosts:
+        - host: spire-server-federation.example.org
+          paths:
+            - path: /
+              pathType: Prefix
+      tls:
+        - hosts:
+            - spire-server-federation.example.org
@@ -0,0 +1,25 @@
+spire-server:
+  federation:
+    enabled: true
+    ingress:
+      enabled: true
+      annotations:
+        nginx.ingress.kubernetes.io/ssl-redirect: "true"
+        nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+        nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+
+        # Optional settings you may put in your own values.
+        # kubernetes.io/ingress.class: nginx
+        # kubernetes.io/tls-acme: "true"
+
+      # className: nginx
+ 
+      hosts:
+        - host: spire-server-federation.example.org
+          paths:
+            - path: /
+              pathType: Prefix
+      tls:
+        - hosts:
+            - spire-server-federation.example.org
+          secretName: spire-server-federation-tls
@@ -0,0 +1,25 @@
+spire-server:
+  ingress:
+    enabled: true
+    annotations:
+      nginx.ingress.kubernetes.io/ssl-redirect: "true"
+      nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+      nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+
+      # Optional settings you may put in your own values.
+      # kubernetes.io/tls-acme: "true"
+      # kubernetes.io/ingress.class: nginx
+
+    # className: nginx
+
+    # You must override these in your own values file with the appropriate hostname
+    # and secret or it wont start.
+    hosts:
+      - host: spire-server.example.org
+        paths:
+          - path: /
+            pathType: Prefix
+    tls:
+      - hosts:
+          - spire-server.example.org