From 46466e5ec642639a34c3fc3e3e3a3c4acba7bc77 Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@philips.com>
Date: Tue, 3 Aug 2021 10:56:14 +0200
Subject: [PATCH] Run oidc insecure on unix socket using Nginx

Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 charts/spire/templates/oidc-deployment.yaml   | 31 +++++++++++++++----
 charts/spire/templates/oidc-dp-configmap.yaml | 21 +++++++++++++
 charts/spire/templates/oidc-service.yaml      |  3 ++
 3 files changed, 49 insertions(+), 6 deletions(-)

diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml
index 446aa2e..6d1d6e4 100644
--- a/charts/spire/templates/oidc-deployment.yaml
+++ b/charts/spire/templates/oidc-deployment.yaml
@@ -40,11 +40,11 @@ spec:
           args:
             - -config
             - /run/spire/oidc/config/oidc-discovery-provider.conf
+          {{- if not .Values.oidc.allowInsecureScheme }}
           ports:
-            - containerPort: {{ .Values.oidc.service.port }}
-              name: http
             - containerPort: 443
               name: https
+          {{- end }}
           volumeMounts:
             - name: spire-oidc-sockets
               mountPath: /run/spire/oidc-sockets
@@ -54,15 +54,34 @@ spec:
               readOnly: true
           readinessProbe:
             exec:
-              command: ["/bin/ps", "aux", " ||", "grep", "oidc-discovery-provider -config /run/spire/oidc/config/oidc-discovery-provider.conf"]
+              command: ["/bin/ps", "aux", "|", "grep", "oidc-discovery-provider -config /run/spire/oidc/config/oidc-discovery-provider.conf"]
             initialDelaySeconds: 5
             periodSeconds: 5
           livenessProbe:
-            httpGet:
-              path: /.well-known/openid-configuration
-              port: http
+            exec:
+              command: ["/bin/ps", "aux", "|", "grep", "oidc-discovery-provider -config /run/spire/oidc/config/oidc-discovery-provider.conf"]
+            initialDelaySeconds: 5
+            periodSeconds: 5
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
+        {{- if .Values.oidc.allowInsecureScheme }}
+        - name: nginx
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: nginx:latest
+          imagePullPolicy: {{ .Values.oidc.image.pullPolicy }}
+          ports:
+            - containerPort: 80
+              name: http
+          volumeMounts:
+            - name: spire-oidc-sockets
+              mountPath: /run/spire/oidc-sockets
+              readOnly: true
+            - name: spire-oidc-config
+              mountPath: /etc/nginx/templates/default.conf.template
+              subPath: default.conf.template
+              readOnly: true
+        {{- end }}
       volumes:
         - name: spire-oidc-sockets
           hostPath:
diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml
index 32910f2..8f4b20a 100644
--- a/charts/spire/templates/oidc-dp-configmap.yaml
+++ b/charts/spire/templates/oidc-dp-configmap.yaml
@@ -12,15 +12,36 @@ data:
     {{ else }}
     domains = []
     {{ end }}
+    {{- if .Values.oidc.allowInsecureScheme }}
     allow_insecure_scheme = {{ .Values.oidc.allowInsecureScheme }}
+    listen_socket_path = "/run/spire/oidc-sockets/oidc-server.sock"
+    {{- else }}
     acme {
         directory_url = "{{ .Values.oidc.acme.directoryUrl }}"
         cache_dir = "{{ .Values.oidc.acme.cacheDir }}"
         tos_accepted = {{ .Values.oidc.acme.tosAccepted }}
         email = "{{ .Values.oidc.acme.emailAddress }}"
     }
+    {{- end }}
+
     workload_api {
         socket_path = "/run/spire/agent-sockets/agent.sock"
         trust_domain = "{{ .Values.spire.trustDomain }}"
     }
+  {{- if .Values.oidc.allowInsecureScheme }}
+  default.conf.template: |
+    upstream oidc {
+      server unix:/run/spire/oidc-sockets/oidc-server.sock;
+    }
+
+    server {
+      listen            80;
+      listen       [::]:80;
+
+      location / {
+        proxy_pass http://oidc;
+        proxy_set_header Host $host;
+      }
+    }
+  {{- end }}
 {{ end }}
diff --git a/charts/spire/templates/oidc-service.yaml b/charts/spire/templates/oidc-service.yaml
index d1bd83d..cc9087e 100644
--- a/charts/spire/templates/oidc-service.yaml
+++ b/charts/spire/templates/oidc-service.yaml
@@ -11,12 +11,15 @@ metadata:
 spec:
   type: {{ .Values.oidc.service.type }}
   ports:
+    {{- if .Values.oidc.allowInsecureScheme }}
     - name: http
       port: {{ .Values.oidc.service.port }}
       targetPort: http
+    {{- else }}
     - name: https
       port: 443
       targetPort: https
+    {{- end }}
   selector:
     {{- include "spire.oidc.selectorLabels" . | nindent 4 }}
 {{ end }}