From 21bcece2ac709b2e431b2985db4e117a578f600b Mon Sep 17 00:00:00 2001 From: Daniel Schlatter Date: Thu, 2 Jul 2026 15:57:29 -0600 Subject: [PATCH] add config to allow disabling jwt svids (#864) Signed-off-by: Daniel Schlatter Co-authored-by: kfox1111 --- charts/spire/charts/spire-server/README.md | 1 + charts/spire/charts/spire-server/templates/configmap.yaml | 2 +- charts/spire/charts/spire-server/values.yaml | 3 +++ 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 42ecb03..a0fcd49 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -165,6 +165,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | | `bundleConfigMap` | Set the Configmap name for SPIRE bundle | `spire-bundle` | | `clusterDomain` | This is the value of your clusters `kubeadm init --service-dns-domain` flag | `cluster.local` | +| `jwtSVIDSupport` | If false, completely disables JWT-SVID functionality. The server will not generate JWT keys, sign JWT-SVIDs, or implement JWT-related API calls. This is useful for deployments that don’t need JWT-SVIDs support. | `true` | | `federation.enabled` | Flag to enable federation | `false` | | `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` | | `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index c0e107f..5500a2c 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -57,7 +57,7 @@ server: {{- end }} jwt_issuer: {{ include "spire-lib.jwt-issuer" . | quote }} audit_log_enabled: {{ .Values.auditLogEnabled }} - + disable_jwt_svids: {{ not .Values.jwtSVIDSupport }} ca_key_type: {{ .Values.caKeyType | quote }} ca_ttl: {{ .Values.caTTL | quote }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 9577990..5a37aad 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -251,6 +251,9 @@ bundleConfigMap: spire-bundle ## @param clusterDomain This is the value of your clusters `kubeadm init --service-dns-domain` flag clusterDomain: cluster.local +## @param jwtSVIDSupport If false, completely disables JWT-SVID functionality. The server will not generate JWT keys, sign JWT-SVIDs, or implement JWT-related API calls. This is useful for deployments that don’t need JWT-SVIDs support. +jwtSVIDSupport: true + federation: ## @param federation.enabled Flag to enable federation enabled: false