From 60b2f7c7737246ec8e134c1e9f2ade45a0879487 Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@philips.com>
Date: Sun, 6 Nov 2022 11:40:00 +0100
Subject: [PATCH] Utilize spiffe csi driver in OIDC component

Signed-off-by: Marco Franssen <marco.franssen@philips.com>
Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 charts/spire/templates/agent-configmap.yaml   |  2 +-
 charts/spire/templates/oidc-deployment.yaml   | 12 ++++++------
 charts/spire/templates/oidc-dp-configmap.yaml |  6 +++---
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/charts/spire/templates/agent-configmap.yaml b/charts/spire/templates/agent-configmap.yaml
index e0fb6e1..4530f6b 100644
--- a/charts/spire/templates/agent-configmap.yaml
+++ b/charts/spire/templates/agent-configmap.yaml
@@ -10,7 +10,7 @@ data:
       log_level = "{{ .Values.agent.config.logLevel }}"
       server_address = "{{ include "spire.fullname" . }}-server"
       server_port = "{{ .Values.server.service.port }}"
-      socket_path = "/run/spire/agent-sockets/agent.sock"
+      socket_path = "/run/spire/agent-sockets/spire-agent.sock"
       trust_bundle_path = "/run/spire/bundle/bundle.crt"
       trust_domain = {{ .Values.spire.trustDomain | quote }}
     }
diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml
index 0c7b48f..8cb24f2 100644
--- a/charts/spire/templates/oidc-deployment.yaml
+++ b/charts/spire/templates/oidc-deployment.yaml
@@ -46,8 +46,8 @@ spec:
               name: https
           {{- end }}
           volumeMounts:
-            - name: spire-agent-sockets
-              mountPath: /run/spire/agent-sockets
+            - name: spiffe-workload-api
+              mountPath: /spiffe-workload-api
               readOnly: true
             - name: spire-oidc-sockets
               mountPath: /run/spire/oidc-sockets
@@ -89,14 +89,14 @@ spec:
               readOnly: true
         {{- end }}
       volumes:
+        - name: spiffe-workload-api
+          csi:
+            driver: "csi.spiffe.io"
+            readOnly: true
         - name: spire-oidc-sockets
           hostPath:
             path: /run/spire/oidc-sockets
             type: DirectoryOrCreate
-        - name: spire-agent-sockets
-          hostPath:
-            path: /run/spire/agent-sockets
-            type: DirectoryOrCreate
         - name: spire-oidc-config
           configMap:
             name: {{ include "spire.fullname" . }}-oidc-discovery-provider
diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml
index 18e1fdd..ee5a317 100644
--- a/charts/spire/templates/oidc-dp-configmap.yaml
+++ b/charts/spire/templates/oidc-dp-configmap.yaml
@@ -18,7 +18,7 @@ data:
 
     {{- if .Values.oidc.insecureScheme.enabled }}
     allow_insecure_scheme = {{ .Values.oidc.insecureScheme.enabled }}
-    listen_socket_path = "/run/spire/oidc-sockets/oidc-server.sock"
+    listen_socket_path = "/run/spire/oidc-sockets/spire-oidc-server.sock"
     {{- else }}
     acme {
       directory_url = "{{ .Values.oidc.config.acme.directoryUrl }}"
@@ -29,7 +29,7 @@ data:
     {{- end }}
 
     workload_api {
-      socket_path = "/run/spire/agent-sockets/agent.sock"
+      socket_path = "/spiffe-workload-api/spire-agent.sock"
       trust_domain = "{{ .Values.spire.trustDomain }}"
     }
 
@@ -41,7 +41,7 @@ data:
   {{- if .Values.oidc.insecureScheme.enabled }}
   default.conf.template: |
     upstream oidc {
-      server unix:/run/spire/oidc-sockets/oidc-server.sock;
+      server unix:/run/spire/oidc-sockets/spire-oidc-server.sock;
     }
 
     server {