diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml index b6024c7..f40071a 100644 --- a/charts/spire/templates/oidc-deployment.yaml +++ b/charts/spire/templates/oidc-deployment.yaml @@ -40,8 +40,10 @@ spec: args: - -config - /run/spire/oidc/config/oidc-discovery-provider.conf - {{- if not .Values.oidc.insecureScheme.enabled }} ports: + - containerPort: 8008 + name: health + {{- if not .Values.oidc.insecureScheme.enabled }} - containerPort: 443 name: https {{- end }} @@ -55,16 +57,19 @@ spec: - name: spire-oidc-config mountPath: /run/spire/oidc/config/ readOnly: true - readinessProbe: - exec: - command: ["/bin/ps", "aux", "|", "grep", "oidc-discovery-provider -config /run/spire/oidc/config/oidc-discovery-provider.conf"] - initialDelaySeconds: 5 - periodSeconds: 5 - livenessProbe: - exec: - command: ["/bin/ps", "aux", "|", "grep", "oidc-discovery-provider -config /run/spire/oidc/config/oidc-discovery-provider.conf"] - initialDelaySeconds: 5 - periodSeconds: 5 + # Needs new release of spire to fix the http healthchecks + # readinessProbe: + # httpGet: + # path: /ready + # port: health + # initialDelaySeconds: 5 + # periodSeconds: 5 + # livenessProbe: + # httpGet: + # path: /live + # port: health + # initialDelaySeconds: 5 + # periodSeconds: 5 resources: {{- toYaml .Values.oidc.resources | nindent 12 }} {{- if .Values.oidc.insecureScheme.enabled }} diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml index e1f5650..6b06b98 100644 --- a/charts/spire/templates/oidc-dp-configmap.yaml +++ b/charts/spire/templates/oidc-dp-configmap.yaml @@ -17,16 +17,22 @@ data: listen_socket_path = "/run/spire/oidc-sockets/oidc-server.sock" {{- else }} acme { - directory_url = "{{ .Values.oidc.acme.directoryUrl }}" - cache_dir = "{{ .Values.oidc.acme.cacheDir }}" - tos_accepted = {{ .Values.oidc.acme.tosAccepted }} - email = "{{ .Values.oidc.acme.emailAddress }}" + directory_url = "{{ .Values.oidc.acme.directoryUrl }}" + cache_dir = "{{ .Values.oidc.acme.cacheDir }}" + tos_accepted = {{ .Values.oidc.acme.tosAccepted }} + email = "{{ .Values.oidc.acme.emailAddress }}" } {{- end }} workload_api { - socket_path = "/run/spire/agent-sockets/agent.sock" - trust_domain = "{{ .Values.spire.trustDomain }}" + socket_path = "/run/spire/agent-sockets/agent.sock" + trust_domain = "{{ .Values.spire.trustDomain }}" + } + + health_checks { + bind_port = "8008" + ready_path = "/ready" + live_path = "/live" } {{- if .Values.oidc.insecureScheme.enabled }} default.conf.template: |