From 31bce3b09ef493c835a2b0b11e44aa618efde834 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 23 Jul 2021 08:35:09 +0200 Subject: [PATCH] Remove spire ingress as it complicate SNI acme Signed-off-by: Marco Franssen --- charts/spire/README.md | 12 +++++--- charts/spire/templates/oidc-dp-configmap.yaml | 15 +++++----- charts/spire/templates/oidc-ingress.yaml | 30 ------------------- charts/spire/templates/oidc-service.yaml | 9 +++++- .../spire/templates/server-statefulset.yaml | 5 +++- charts/spire/values.yaml | 15 ++++++---- 6 files changed, 38 insertions(+), 48 deletions(-) delete mode 100644 charts/spire/templates/oidc-ingress.yaml diff --git a/charts/spire/README.md b/charts/spire/README.md index 7d10ba5..4b684c5 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -58,16 +58,20 @@ Kubernetes: `>=1.19.0-0` | imagePullSecrets | list | `[]` | | | nameOverride | string | `""` | | | nodeSelector | object | `{}` | | +| oidc.acme.cacheDir | string | `"/run/spire"` | | +| oidc.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | +| oidc.acme.emailAddress | string | `"letsencrypt@example.org"` | | +| oidc.acme.tosAccepted | bool | `false` | | +| oidc.allowInsecureScheme | bool | `false` | | +| oidc.domain | string | `"oidc-discovery.example.org"` | | | oidc.enabled | bool | `false` | | | oidc.image.pullPolicy | string | `"IfNotPresent"` | | | oidc.image.repository | string | `"gcr.io/spiffe-io/oidc-discovery-provider"` | | | oidc.image.tag | string | `""` | | -| oidc.ingress.domain | string | `"oidc-discovery.example.org"` | | -| oidc.ingress.enabled | bool | `false` | | -| oidc.letsEncrypt.emailAddress | string | `"letsencrypt@example.org"` | | | oidc.logLevel | string | `"INFO"` | | +| oidc.service.annotations | object | `{}` | | | oidc.service.port | int | `80` | | -| oidc.service.type | string | `"ClusterIP"` | | +| oidc.service.type | string | `"NodePort"` | | | podAnnotations | object | `{}` | | | podSecurityContext | object | `{}` | | | replicaCount | int | `1` | | diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml index 4500ca0..0323909 100644 --- a/charts/spire/templates/oidc-dp-configmap.yaml +++ b/charts/spire/templates/oidc-dp-configmap.yaml @@ -8,14 +8,15 @@ data: oidc-discovery-provider.conf: | log_level = "{{ .Values.oidc.logLevel }}" - domain = "{{ .Values.oidc.ingress.domain }}" + domain = "{{ .Values.oidc.domain }}" insecure_addr = ":{{ .Values.oidc.service.port }}" - # acme { - # directory_url = "https://acme-v02.api.letsencrypt.org/directory" - # cache_dir = "/run/spire" - # tos_accepted = true - # email = "{{ .Values.oidc.letsEncrypt.emailAddress }}" - # } + allow_insecure_scheme = {{ .Values.oidc.allowInsecureScheme }} + acme { + directory_url = "{{ .Values.oidc.acme.directoryUrl }}" + cache_dir = "{{ .Values.oidc.acme.cacheDir }}" + tos_accepted = {{ .Values.oidc.acme.tosAccepted }} + email = "{{ .Values.oidc.acme.emailAddress }}" + } server_api { address = "unix://{{ include "spire.sockets" . }}/registration.sock" } diff --git a/charts/spire/templates/oidc-ingress.yaml b/charts/spire/templates/oidc-ingress.yaml deleted file mode 100644 index c6063de..0000000 --- a/charts/spire/templates/oidc-ingress.yaml +++ /dev/null @@ -1,30 +0,0 @@ -{{- if and (eq (.Values.oidc.enabled | toString) "true") (eq (.Values.oidc.ingress.enabled | toString) "true") }} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ include "spire.fullname" . }}-oidc-ingress - namespace: spire -spec: - tls: - - hosts: - - {{ .Values.oidc.ingress.domain }} - secretName: oidc-secret - rules: - - host: {{ .Values.oidc.ingress.domain }} - http: - paths: - - path: /.well-known/openid-configuration - pathType: ImplementationSpecific - backend: - service: - name: {{ include "spire.fullname" . }}-oidc - port: - name: http - - path: /keys - pathType: ImplementationSpecific - backend: - service: - name: {{ include "spire.fullname" . }}-oidc - port: - name: http -{{ end }} diff --git a/charts/spire/templates/oidc-service.yaml b/charts/spire/templates/oidc-service.yaml index 77638c8..4ac9afd 100644 --- a/charts/spire/templates/oidc-service.yaml +++ b/charts/spire/templates/oidc-service.yaml @@ -4,12 +4,19 @@ kind: Service metadata: name: {{ include "spire.fullname" . }}-oidc namespace: {{ .Release.Namespace }} + {{- with .Values.oidc.service.annotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} spec: type: {{ .Values.oidc.service.type }} ports: - name: http port: {{ .Values.oidc.service.port }} - targetPort: spire-oidc-port + targetPort: oidc-http + - name: https + port: 443 + targetPort: oidc-https selector: {{- include "spire.server.selectorLabels" . | nindent 4 }} {{ end }} diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml index 6e587c4..ffa6cf7 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/templates/server-statefulset.yaml @@ -94,12 +94,15 @@ spec: {{- if eq (.Values.oidc.enabled | toString) "true" }} - name: spire-oidc image: "{{ .Values.oidc.image.repository }}:{{ .Values.oidc.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.oidc.image.pullPolicy }} args: - -config - /run/spire/oidc/config/oidc-discovery-provider.conf ports: - containerPort: {{ .Values.oidc.service.port }} - name: spire-oidc-port + name: oidc-http + - containerPort: 443 + name: oidc-https volumeMounts: - name: spire-server-socket mountPath: {{ include "spire.sockets" . }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index c7cac43..2fe9e99 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -39,14 +39,19 @@ oidc: logLevel: INFO service: - type: ClusterIP + type: NodePort port: 80 + annotations: {} + # external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org - ingress: - enabled: false - domain: "oidc-discovery.example.org" + domain: "oidc-discovery.example.org" - letsEncrypt: + allowInsecureScheme: false + + acme: + tosAccepted: false + cacheDir: /run/spire + directoryUrl: https://acme-v02.api.letsencrypt.org/directory emailAddress: letsencrypt@example.org agent: