Remove spire ingress as it complicate SNI acme

Signed-off-by: Marco Franssen <[email protected]>

charts/spire/README.md

@@ -58,16 +58,20 @@ Kubernetes: `>=1.19.0-0`
 | imagePullSecrets | list | `[]` |  |
 | nameOverride | string | `""` |  |
 | nodeSelector | object | `{}` |  |
+| oidc.acme.cacheDir | string | `"/run/spire"` |  |
+| oidc.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` |  |
+| oidc.acme.emailAddress | string | `"[email protected]"` |  |
+| oidc.acme.tosAccepted | bool | `false` |  |
+| oidc.allowInsecureScheme | bool | `false` |  |
+| oidc.domain | string | `"oidc-discovery.example.org"` |  |
 | oidc.enabled | bool | `false` |  |
 | oidc.image.pullPolicy | string | `"IfNotPresent"` |  |
 | oidc.image.repository | string | `"gcr.io/spiffe-io/oidc-discovery-provider"` |  |
 | oidc.image.tag | string | `""` |  |
-| oidc.ingress.domain | string | `"oidc-discovery.example.org"` |  |
-| oidc.ingress.enabled | bool | `false` |  |
-| oidc.letsEncrypt.emailAddress | string | `"[email protected]"` |  |
 | oidc.logLevel | string | `"INFO"` |  |
+| oidc.service.annotations | object | `{}` |  |
 | oidc.service.port | int | `80` |  |
-| oidc.service.type | string | `"ClusterIP"` |  |
+| oidc.service.type | string | `"NodePort"` |  |
 | podAnnotations | object | `{}` |  |
 | podSecurityContext | object | `{}` |  |
 | replicaCount | int | `1` |  |

charts/spire/templates/oidc-dp-configmap.yaml

@@ -8,14 +8,15 @@ data:
   oidc-discovery-provider.conf: |
     log_level = "{{ .Values.oidc.logLevel }}"
 
-    domain = "{{ .Values.oidc.ingress.domain }}"
+    domain = "{{ .Values.oidc.domain }}"
     insecure_addr = ":{{ .Values.oidc.service.port }}"
-    # acme {
-    #     directory_url = "https://acme-v02.api.letsencrypt.org/directory"
-    #     cache_dir = "/run/spire"
-    #     tos_accepted = true
-    #     email = "{{ .Values.oidc.letsEncrypt.emailAddress }}"
-    # }
+    allow_insecure_scheme = {{ .Values.oidc.allowInsecureScheme }}
+    acme {
+        directory_url = "{{ .Values.oidc.acme.directoryUrl }}"
+        cache_dir = "{{ .Values.oidc.acme.cacheDir }}"
+        tos_accepted = {{ .Values.oidc.acme.tosAccepted }}
+        email = "{{ .Values.oidc.acme.emailAddress }}"
+    }
     server_api {
         address = "unix://{{ include "spire.sockets" . }}/registration.sock"
     }

charts/spire/templates/oidc-ingress.yaml

@@ -1,30 +0,0 @@
-{{- if and (eq (.Values.oidc.enabled | toString) "true") (eq (.Values.oidc.ingress.enabled | toString) "true") }}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: {{ include "spire.fullname" . }}-oidc-ingress
-  namespace: spire
-spec:
-  tls:
-    - hosts:
-        - {{ .Values.oidc.ingress.domain }}
-      secretName: oidc-secret
-  rules:
-    - host: {{ .Values.oidc.ingress.domain }}
-      http:
-        paths:
-          - path: /.well-known/openid-configuration
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: {{ include "spire.fullname" . }}-oidc
-                port:
-                  name: http
-          - path: /keys
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: {{ include "spire.fullname" . }}-oidc
-                port:
-                  name: http
-{{ end }}

charts/spire/templates/oidc-service.yaml

@@ -4,12 +4,19 @@ kind: Service
 metadata:
   name: {{ include "spire.fullname" . }}-oidc
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.oidc.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 8 }}
+  {{- end }}
 spec:
   type: {{ .Values.oidc.service.type }}
   ports:
     - name: http
       port: {{ .Values.oidc.service.port }}
-      targetPort: spire-oidc-port
+      targetPort: oidc-http
+    - name: https
+      port: 443
+      targetPort: oidc-https
   selector:
     {{- include "spire.server.selectorLabels" . | nindent 4 }}
 {{ end }}

charts/spire/templates/server-statefulset.yaml

@@ -94,12 +94,15 @@ spec:
         {{- if eq (.Values.oidc.enabled | toString) "true" }}
         - name: spire-oidc
           image: "{{ .Values.oidc.image.repository }}:{{ .Values.oidc.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.oidc.image.pullPolicy }}
           args:
             - -config
             - /run/spire/oidc/config/oidc-discovery-provider.conf
           ports:
             - containerPort: {{ .Values.oidc.service.port }}
-              name: spire-oidc-port
+              name: oidc-http
+            - containerPort: 443
+              name: oidc-https
           volumeMounts:
             - name: spire-server-socket
               mountPath: {{ include "spire.sockets" . }}

charts/spire/values.yaml

@@ -39,14 +39,19 @@ oidc:
   logLevel: INFO
 
   service:
-    type: ClusterIP
+    type: NodePort
     port: 80
+    annotations: {}
+      # external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org
 
-  ingress:
-    enabled: false
-    domain: "oidc-discovery.example.org"
+  domain: "oidc-discovery.example.org"
 
-  letsEncrypt:
+  allowInsecureScheme: false
+
+  acme:
+    tosAccepted: false
+    cacheDir: /run/spire
+    directoryUrl: https://acme-v02.api.letsencrypt.org/directory
     emailAddress: [email protected]
 
 agent: