Autogen jwtIssuer (#88)
* Autogen jwtIssuer Unset a default for jwtIssuer and global.spire.jwtIssuer. When unset, generate it to the default of oidc-discovery.$trustDomain so in many cases the user doesn't need to set it at all. Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Mariusz Sabath <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
co-authored by
Faisal Memon
Mariusz Sabath
Faisal Memon
Mariusz Sabath
parent
93c20c6830
commit
f2758a8b2b
@@ -2,7 +2,6 @@ global:
|
||||
spire:
|
||||
clusterName: production
|
||||
trustDomain: production.other
|
||||
jwtIssuer: oidc-discovery.production.other
|
||||
|
||||
spire-server:
|
||||
controllerManager:
|
||||
|
||||
@@ -145,11 +145,11 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
### Global parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- |
|
||||
| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- |
|
||||
| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` |
|
||||
| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` |
|
||||
| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` |
|
||||
| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens | `oidc-discovery.example.org` |
|
||||
| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset | `""` |
|
||||
| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` |
|
||||
| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` |
|
||||
| `global.spire.image.registry` | Override all Spire image registries at once | `""` |
|
||||
|
||||
@@ -60,7 +60,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.2-alpine` |
|
||||
| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` |
|
||||
| `jwtIssuer` | Path to JWT issuer | `https://oidc-discovery.example.org` |
|
||||
| `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` |
|
||||
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||
| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` |
|
||||
| `config.acme.tosAccepted` | Flag for Terms of Service acceptance | `false` |
|
||||
|
||||
@@ -125,8 +125,8 @@ insecureScheme:
|
||||
# cpu: 100m
|
||||
# memory: 64Mi
|
||||
|
||||
## @param jwtIssuer Path to JWT issuer
|
||||
jwtIssuer: https://oidc-discovery.example.org
|
||||
## @param jwtIssuer Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset
|
||||
jwtIssuer: ""
|
||||
|
||||
config:
|
||||
## @param config.logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
||||
|
||||
@@ -142,7 +142,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `dataStore.sql.externalSecret.name` | The name of the secret object | `""` |
|
||||
| `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
|
||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||
| `jwtIssuer` | The JWT issuer domain | `https://oidc-discovery.example.org` |
|
||||
| `jwtIssuer` | The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset | `""` |
|
||||
| `clusterName` | Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`) | `example-cluster` |
|
||||
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||
| `bundleConfigMap` | Set the trust domain to be used for the SPIFFE identifiers | `spire-bundle` |
|
||||
|
||||
@@ -174,8 +174,8 @@ dataStore:
|
||||
|
||||
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
||||
logLevel: info
|
||||
## @param jwtIssuer The JWT issuer domain
|
||||
jwtIssuer: https://oidc-discovery.example.org
|
||||
## @param jwtIssuer The JWT issuer domain. Defaults to oidc-discovery.$trustDomain if unset
|
||||
jwtIssuer: ""
|
||||
|
||||
## @param clusterName Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`)
|
||||
clusterName: example-cluster
|
||||
|
||||
@@ -17,8 +17,10 @@
|
||||
{{- define "spire-lib.jwt-issuer" }}
|
||||
{{- if ne (len (dig "spire" "jwtIssuer" "" .Values.global)) 0 }}
|
||||
{{- .Values.global.spire.jwtIssuer }}
|
||||
{{- else }}
|
||||
{{- else if ne (len .Values.jwtIssuer) 0 }}
|
||||
{{- .Values.jwtIssuer }}
|
||||
{{- else }}
|
||||
{{- printf "oidc-discovery.%s" (include "spire-lib.trust-domain" .) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
@@ -13,8 +13,8 @@ global:
|
||||
bundleConfigMap: ""
|
||||
## @param global.spire.clusterName The name of the k8s cluster for Spire install
|
||||
clusterName: example-cluster
|
||||
## @param global.spire.jwtIssuer The issuer for Spire JWT tokens
|
||||
jwtIssuer: oidc-discovery.example.org
|
||||
## @param global.spire.jwtIssuer The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset
|
||||
jwtIssuer: ""
|
||||
## @param global.spire.trustDomain The trust domain for Spire install
|
||||
trustDomain: example.org
|
||||
## @param global.spire.upstreamServerAddress Set what address to use for the upstream server when using nested spire
|
||||
|
||||
@@ -2,7 +2,6 @@ global:
|
||||
spire:
|
||||
clusterName: production
|
||||
trustDomain: production.other
|
||||
jwtIssuer: oidc-discovery.production.other
|
||||
|
||||
spire-server:
|
||||
ca_subject:
|
||||
|
||||
Reference in New Issue
Block a user