diff --git a/charts/spire/README.md b/charts/spire/README.md index 5716fa7..1da10ab 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -79,6 +79,10 @@ kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeid We only support upgrading one major/minor version at a time. Version skipping isn't supported. Please see for details. +### 0.30.X + +- The OIDC discovery issuer is now set automatically. We do not anticipate any negative impact; however, please verify your OIDC provider's integration with other services during your upgrade testing. + ### 0.26.X - The notifier.k8sBundle plugin has been deprecated in favor of bundlePublisher.k8sConfigMap. The only features it does not provide are the settings `apiServiceLabel` and `webhookLabel`. If you are using either of these two features, set the chart to use the notifier.k8sBundle plugin again, and let us know. We don't think anyone is using these features. @@ -277,7 +281,7 @@ Now you can interact with the Spire agent socket from your own application. The | `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` | | `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` | | `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` | -| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset | `""` | +| `global.spire.jwtIssuer` | Issuer URL used for both the JWT-SVID `iss` claim minted by spire-server and the `issuer` field advertised by the OIDC discovery document. Defaults to oidc-discovery.$trustDomain if unset | `""` | | `global.spire.trustDomain` | The trust domain for Spire install | `example.org` | | `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` | | `global.spire.caSubject.country` | Country for Spire server CA | `""` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 05c6c63..fc5c9e4 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -79,7 +79,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.30.0-alpine` | | `insecureScheme.nginx.ipMode` | IP modes supported by the cluster. Must be one of [ipv4, ipv6, both] | `both` | | `insecureScheme.nginx.resources` | Resource requests and limits | `{}` | -| `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` | +| `jwtIssuer` | Issuer URL used for the `issuer` field advertised by the OIDC discovery document. Defaults to oidc-discovery.$trustDomain if unset | `""` | | `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | | `config.logFormat` | The log format, valid values are "text" and "json" | `text` | | `config.jwtDomain` | The JWT domain. Defaults to oidc-discovery.$jwtIssuer URL-parsed host if unset | `""` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml index c4f9c1a..db56d8c 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml @@ -56,6 +56,8 @@ server_path_prefix: {{ .Values.config.serverPathPrefix | quote }} set_key_use: true {{- end }} +jwt_issuer: {{ include "spire-lib.jwt-issuer" . | quote }} + {{- if eq .Values.bundleSource "ConfigMap" }} file: path: /bundle/bundle.spiffe diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 69f2179..5c1546f 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -203,7 +203,7 @@ insecureScheme: # cpu: 100m # memory: 64Mi -## @param jwtIssuer Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset +## @param jwtIssuer Issuer URL used for the `issuer` field advertised by the OIDC discovery document. Defaults to oidc-discovery.$trustDomain if unset jwtIssuer: "" config: diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index ceca886..91172c3 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -17,7 +17,7 @@ global: bundleConfigMap: "" ## @param global.spire.clusterName The name of the k8s cluster for Spire install clusterName: example-cluster - ## @param global.spire.jwtIssuer The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset + ## @param global.spire.jwtIssuer Issuer URL used for both the JWT-SVID `iss` claim minted by spire-server and the `issuer` field advertised by the OIDC discovery document. Defaults to oidc-discovery.$trustDomain if unset jwtIssuer: "" ## @param global.spire.trustDomain The trust domain for Spire install trustDomain: example.org diff --git a/tests/unit/spire_test.go b/tests/unit/spire_test.go index 1c79419..97ffb36 100644 --- a/tests/unit/spire_test.go +++ b/tests/unit/spire_test.go @@ -189,4 +189,35 @@ spire-server: Expect(notes).Should(ContainSubstring("Installed")) }) }) + Describe("spiffe-oidc-discovery-provider.jwtIssuer", func() { + It("auto-derives jwt_issuer from global.spire.jwtIssuer and matches spire-server", func() { + objs, err := ValueStringRender(chart, ` +global: + spire: + jwtIssuer: https://canonical.example.com +`) + Expect(err).Should(Succeed()) + oidcCM := objs["spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml"] + Expect(oidcCM).Should(ContainSubstring(`"jwt_issuer": "https://canonical.example.com"`)) + serverCM := objs["spire/charts/spire-server/templates/configmap.yaml"] + Expect(serverCM).Should(ContainSubstring(`"jwt_issuer": "https://canonical.example.com"`)) + }) + It("propagates the subchart-local jwtIssuer to jwt_issuer", func() { + objs, err := ValueStringRender(chart, ` +spiffe-oidc-discovery-provider: + jwtIssuer: https://legacy.example.com +`) + Expect(err).Should(Succeed()) + oidcCM := objs["spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml"] + Expect(oidcCM).Should(ContainSubstring(`"jwt_issuer": "https://legacy.example.com"`)) + }) + It("defaults to oidc-discovery. when nothing is set and strict mode is disabled", func() { + objs, err := ValueStringRender(chart, ``) + Expect(err).Should(Succeed()) + oidcCM := objs["spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml"] + Expect(oidcCM).Should(ContainSubstring(`"jwt_issuer": "https://oidc-discovery.example.org"`)) + serverCM := objs["spire/charts/spire-server/templates/configmap.yaml"] + Expect(serverCM).Should(ContainSubstring(`"jwt_issuer": "https://oidc-discovery.example.org"`)) + }) + }) })