Utilize spiffe csi driver in OIDC component

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/templates/agent-configmap.yaml

@@ -10,7 +10,7 @@ data:
       log_level = "{{ .Values.agent.config.logLevel }}"
       server_address = "{{ include "spire.fullname" . }}-server"
       server_port = "{{ .Values.server.service.port }}"
-      socket_path = "/run/spire/agent-sockets/agent.sock"
+      socket_path = "/run/spire/agent-sockets/spire-agent.sock"
       trust_bundle_path = "/run/spire/bundle/bundle.crt"
       trust_domain = {{ .Values.spire.trustDomain | quote }}
     }

charts/spire/templates/oidc-deployment.yaml

@@ -46,8 +46,8 @@ spec:
               name: https
           {{- end }}
           volumeMounts:
-            - name: spire-agent-sockets
-              mountPath: /run/spire/agent-sockets
+            - name: spiffe-workload-api
+              mountPath: /spiffe-workload-api
               readOnly: true
             - name: spire-oidc-sockets
               mountPath: /run/spire/oidc-sockets
@@ -89,14 +89,14 @@ spec:
               readOnly: true
         {{- end }}
       volumes:
+        - name: spiffe-workload-api
+          csi:
+            driver: "csi.spiffe.io"
+            readOnly: true
         - name: spire-oidc-sockets
           hostPath:
             path: /run/spire/oidc-sockets
             type: DirectoryOrCreate
-        - name: spire-agent-sockets
-          hostPath:
-            path: /run/spire/agent-sockets
-            type: DirectoryOrCreate
         - name: spire-oidc-config
           configMap:
             name: {{ include "spire.fullname" . }}-oidc-discovery-provider

charts/spire/templates/oidc-dp-configmap.yaml

@@ -18,7 +18,7 @@ data:
 
     {{- if .Values.oidc.insecureScheme.enabled }}
     allow_insecure_scheme = {{ .Values.oidc.insecureScheme.enabled }}
-    listen_socket_path = "/run/spire/oidc-sockets/oidc-server.sock"
+    listen_socket_path = "/run/spire/oidc-sockets/spire-oidc-server.sock"
     {{- else }}
     acme {
       directory_url = "{{ .Values.oidc.config.acme.directoryUrl }}"
@@ -29,7 +29,7 @@ data:
     {{- end }}
 
     workload_api {
-      socket_path = "/run/spire/agent-sockets/agent.sock"
+      socket_path = "/spiffe-workload-api/spire-agent.sock"
       trust_domain = "{{ .Values.spire.trustDomain }}"
     }
 
@@ -41,7 +41,7 @@ data:
   {{- if .Values.oidc.insecureScheme.enabled }}
   default.conf.template: |
     upstream oidc {
-      server unix:/run/spire/oidc-sockets/oidc-server.sock;
+      server unix:/run/spire/oidc-sockets/spire-oidc-server.sock;
     }
 
     server {