Fix oidc health check using using scratch images

Signed-off-by: Marco Franssen <[email protected]>

charts/spire/templates/oidc-deployment.yaml

@@ -40,8 +40,10 @@ spec:
           args:
             - -config
             - /run/spire/oidc/config/oidc-discovery-provider.conf
-          {{- if not .Values.oidc.insecureScheme.enabled }}
           ports:
+            - containerPort: 8008
+              name: health
+          {{- if not .Values.oidc.insecureScheme.enabled }}
             - containerPort: 443
               name: https
           {{- end }}
@@ -55,16 +57,19 @@ spec:
             - name: spire-oidc-config
               mountPath: /run/spire/oidc/config/
               readOnly: true
-          readinessProbe:
+          # Needs new release of spire to fix the http healthchecks
-            exec:
+          # readinessProbe:
-              command: ["/bin/ps", "aux", "|", "grep", "oidc-discovery-provider -config /run/spire/oidc/config/oidc-discovery-provider.conf"]
+          #   httpGet:
-            initialDelaySeconds: 5
+          #     path: /ready
-            periodSeconds: 5
+          #     port: health
-          livenessProbe:
+          #   initialDelaySeconds: 5
-            exec:
+          #   periodSeconds: 5
-              command: ["/bin/ps", "aux", "|", "grep", "oidc-discovery-provider -config /run/spire/oidc/config/oidc-discovery-provider.conf"]
+          # livenessProbe:
-            initialDelaySeconds: 5
+          #   httpGet:
-            periodSeconds: 5
+          #     path: /live
+          #     port: health
+          #   initialDelaySeconds: 5
+          #   periodSeconds: 5
           resources:
             {{- toYaml .Values.oidc.resources | nindent 12 }}
         {{- if .Values.oidc.insecureScheme.enabled }}

charts/spire/templates/oidc-dp-configmap.yaml

@@ -17,16 +17,22 @@ data:
     listen_socket_path = "/run/spire/oidc-sockets/oidc-server.sock"
     {{- else }}
     acme {
-        directory_url = "{{ .Values.oidc.acme.directoryUrl }}"
+      directory_url = "{{ .Values.oidc.acme.directoryUrl }}"
-        cache_dir = "{{ .Values.oidc.acme.cacheDir }}"
+      cache_dir = "{{ .Values.oidc.acme.cacheDir }}"
-        tos_accepted = {{ .Values.oidc.acme.tosAccepted }}
+      tos_accepted = {{ .Values.oidc.acme.tosAccepted }}
-        email = "{{ .Values.oidc.acme.emailAddress }}"
+      email = "{{ .Values.oidc.acme.emailAddress }}"
     }
     {{- end }}
 
     workload_api {
-        socket_path = "/run/spire/agent-sockets/agent.sock"
+      socket_path = "/run/spire/agent-sockets/agent.sock"
-        trust_domain = "{{ .Values.spire.trustDomain }}"
+      trust_domain = "{{ .Values.spire.trustDomain }}"
+    }
+
+    health_checks {
+      bind_port = "8008"
+      ready_path = "/ready"
+      live_path = "/live"
     }
   {{- if .Values.oidc.insecureScheme.enabled }}
   default.conf.template: |