From aad7527c0c7c3c453dcd9cf9a44f251701b6b95c Mon Sep 17 00:00:00 2001 From: Alan Cha Date: Sun, 29 Mar 2026 12:34:30 -0400 Subject: [PATCH] Add set_key_use configuration option (#774) * Add set_key_use configuration option Add a setKeyUse boolean configuration option to control the set_key_use field in the SPIFFE OIDC Discovery Provider configuration. When enabled, this adds the 'use': 'sig' field to JWKS keys, which is required for compatibility with Keycloak's SPIFFE identity provider. Defaults to false to maintain backward compatibility. Signed-off-by: Alan Cha * Fix docs Signed-off-by: Kevin Fox --------- Signed-off-by: Alan Cha Signed-off-by: Kevin Fox Co-authored-by: Kevin Fox --- charts/spire/charts/spiffe-oidc-discovery-provider/README.md | 1 + .../spiffe-oidc-discovery-provider/templates/configmap.yaml | 4 ++++ .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 2 ++ 3 files changed, 7 insertions(+) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 06b8e7c..3904f9c 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -86,6 +86,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `config.jwksUri` | The JWKS URI | `""` | | `config.serverPathPrefix` | If specified, all endpoints listened to will be prefixed by this value | `""` | | `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` | +| `config.setKeyUse` | Add "use":"sig" field to JWKs (required for Keycloak SPIFFE provider) | `false` | | `imagePullSecrets` | Image pull secret names | `[]` | | `nameOverride` | Name override | `""` | | `fullnameOverride` | Full name override | `""` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml index a423778..c4f9c1a 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml @@ -52,6 +52,10 @@ jwks_uri: {{ .Values.config.jwksUri | quote }} server_path_prefix: {{ .Values.config.serverPathPrefix | quote }} {{- end }} +{{- if .Values.config.setKeyUse }} +set_key_use: true +{{- end }} + {{- if eq .Values.bundleSource "ConfigMap" }} file: path: /bundle/bundle.spiffe diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 80c1921..81c9de6 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -220,6 +220,8 @@ config: ## @param config.additionalDomains [array] Add additional domains that can be used for oidc discovery additionalDomains: [] # - localhost + ## @param config.setKeyUse Add "use":"sig" field to JWKs (required for Keycloak SPIFFE provider) + setKeyUse: false ## @param imagePullSecrets [array] Image pull secret names imagePullSecrets: []