panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add set_key_use configuration option (#774)

Browse Source 
* Add set_key_use configuration option

Add a setKeyUse boolean configuration option to control the set_key_use
field in the SPIFFE OIDC Discovery Provider configuration.

When enabled, this adds the 'use': 'sig' field to JWKS keys, which is
required for compatibility with Keycloak's SPIFFE identity provider.

Defaults to false to maintain backward compatibility.

Signed-off-by: Alan Cha <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Alan Cha <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Kevin Fox <[email protected]>
This commit is contained in:
Alan Cha
2026-03-29 09:34:30 -07:00
committed by GitHub
co-authored by Kevin Fox
parent de59147fc5
commit aad7527c0c
3 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+1
View File
@@ -86,6 +86,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| `config.jwksUri` | The JWKS URI | `""` | | `config.jwksUri` | The JWKS URI | `""` |
| `config.serverPathPrefix` | If specified, all endpoints listened to will be prefixed by this value | `""` | | `config.serverPathPrefix` | If specified, all endpoints listened to will be prefixed by this value | `""` |
| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` | | `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` |
| `config.setKeyUse` | Add "use":"sig" field to JWKs (required for Keycloak SPIFFE provider) | `false` |
| `imagePullSecrets` | Image pull secret names | `[]` | | `imagePullSecrets` | Image pull secret names | `[]` |
| `nameOverride` | Name override | `""` | | `nameOverride` | Name override | `""` |
| `fullnameOverride` | Full name override | `""` | | `fullnameOverride` | Full name override | `""` |
charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml
+4
View File
@@ -52,6 +52,10 @@ jwks_uri: {{ .Values.config.jwksUri | quote }}
server_path_prefix: {{ .Values.config.serverPathPrefix | quote }} server_path_prefix: {{ .Values.config.serverPathPrefix | quote }}
{{- end }} {{- end }}
{{- if .Values.config.setKeyUse }}
set_key_use: true
{{- end }}
{{- if eq .Values.bundleSource "ConfigMap" }} {{- if eq .Values.bundleSource "ConfigMap" }}
file: file:
path: /bundle/bundle.spiffe path: /bundle/bundle.spiffe
charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+2
View File
@@ -220,6 +220,8 @@ config:
## @param config.additionalDomains [array] Add additional domains that can be used for oidc discovery ## @param config.additionalDomains [array] Add additional domains that can be used for oidc discovery
additionalDomains: [] additionalDomains: []
# - localhost # - localhost
## @param config.setKeyUse Add "use":"sig" field to JWKs (required for Keycloak SPIFFE provider)
setKeyUse: false
## @param imagePullSecrets [array] Image pull secret names ## @param imagePullSecrets [array] Image pull secret names
imagePullSecrets: [] imagePullSecrets: []