Configurable insecureScheme nginx image

Co-Authored-by: Gert Jan Kamstra <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/README.md

@@ -62,7 +62,6 @@ Kubernetes: `>=1.19.0-0`
 | oidc.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` |  |
 | oidc.acme.emailAddress | string | `"[email protected]"` |  |
 | oidc.acme.tosAccepted | bool | `false` |  |
-| oidc.allowInsecureScheme | bool | `false` |  |
 | oidc.domains[0] | string | `"localhost"` |  |
 | oidc.domains[1] | string | `"spire-oidc.spire"` |  |
 | oidc.domains[2] | string | `"spire-oidc.spire.svc.cluster.local"` |  |
@@ -71,6 +70,10 @@ Kubernetes: `>=1.19.0-0`
 | oidc.image.pullPolicy | string | `"IfNotPresent"` |  |
 | oidc.image.repository | string | `"gcr.io/spiffe-io/oidc-discovery-provider"` |  |
 | oidc.image.tag | string | `""` |  |
+| oidc.insecureScheme.enabled | bool | `false` |  |
+| oidc.insecureScheme.nginx.pullPolicy | string | `"IfNotPresent"` |  |
+| oidc.insecureScheme.nginx.repository | string | `"nginx"` |  |
+| oidc.insecureScheme.nginx.tag | string | `"alpine"` |  |
 | oidc.jwtIssuer | string | `"oidc-discovery.example.org"` |  |
 | oidc.logLevel | string | `"INFO"` |  |
 | oidc.service.annotations | object | `{}` |  |

charts/spire/templates/oidc-deployment.yaml

@@ -40,7 +40,7 @@ spec:
           args:
             - -config
             - /run/spire/oidc/config/oidc-discovery-provider.conf
-          {{- if not .Values.oidc.allowInsecureScheme }}
+          {{- if not .Values.oidc.insecureScheme.enabled }}
           ports:
             - containerPort: 443
               name: https
@@ -64,12 +64,12 @@ spec:
             periodSeconds: 5
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
-        {{- if .Values.oidc.allowInsecureScheme }}
+        {{- if .Values.oidc.insecureScheme.enabled }}
         - name: nginx
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: nginx:latest
-          imagePullPolicy: {{ .Values.oidc.image.pullPolicy }}
+          image: "{{ .Values.oidc.insecureScheme.nginx.repository }}:{{ .Values.oidc.insecureScheme.nginx.tag }}"
+          imagePullPolicy: {{ .Values.oidc.insecureScheme.nginx.pullPolicy }}
           ports:
             - containerPort: 80
               name: http

charts/spire/templates/oidc-dp-configmap.yaml

@@ -12,8 +12,8 @@ data:
     {{ else }}
     domains = []
     {{ end }}
-    {{- if .Values.oidc.allowInsecureScheme }}
-    allow_insecure_scheme = {{ .Values.oidc.allowInsecureScheme }}
+    {{- if .Values.oidc.insecureScheme.enabled }}
+    allow_insecure_scheme = {{ .Values.oidc.insecureScheme.enabled }}
     listen_socket_path = "/run/spire/oidc-sockets/oidc-server.sock"
     {{- else }}
     acme {
@@ -28,7 +28,7 @@ data:
         socket_path = "/run/spire/agent-sockets/agent.sock"
         trust_domain = "{{ .Values.spire.trustDomain }}"
     }
-  {{- if .Values.oidc.allowInsecureScheme }}
+  {{- if .Values.oidc.insecureScheme.enabled }}
   default.conf.template: |
     upstream oidc {
       server unix:/run/spire/oidc-sockets/oidc-server.sock;

charts/spire/templates/oidc-service.yaml

@@ -11,7 +11,7 @@ metadata:
 spec:
   type: {{ .Values.oidc.service.type }}
   ports:
-    {{- if .Values.oidc.allowInsecureScheme }}
+    {{- if .Values.oidc.insecureScheme.enabled }}
     - name: http
       port: {{ .Values.oidc.service.port }}
       targetPort: http

charts/spire/values.yaml

@@ -52,7 +52,13 @@ oidc:
     - spire-oidc.spire.svc.cluster.local
     - oidc-discovery.example.org
 
-  allowInsecureScheme: false
+  insecureScheme:
+    enabled: false
+
+    nginx:
+      repository: nginx
+      pullPolicy: IfNotPresent
+      tag: "alpine"
 
   acme:
     tosAccepted: false