From f37d681bc2669bcbba20083430b2ba621bfbcbc8 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Tue, 1 Jul 2025 17:26:58 -0700 Subject: [PATCH] Enable running the oidc discovery provider without cluster-admin/CSI (#570) * Update for 1.12.3 Signed-off-by: Kevin Fox * Fix typo. Use test image Signed-off-by: Kevin Fox * Fix lint Signed-off-by: Kevin Fox * Fix format flag. Update config location for k8s configmap bp Signed-off-by: Kevin Fox * Fix role Signed-off-by: Kevin Fox * Update rbac Signed-off-by: Kevin Fox * Fix key Signed-off-by: Kevin Fox * Fix format Signed-off-by: Kevin Fox * Fix the bundle format for the fetchca bits Signed-off-by: Kevin Fox * Update key Signed-off-by: Kevin Fox * Fix test rather then reconfigure Signed-off-by: Kevin Fox * Add namespace Signed-off-by: Kevin Fox * Update to follow the new patch Signed-off-by: Kevin Fox * Fix formatting Signed-off-by: Kevin Fox * Fix formatting Signed-off-by: Kevin Fox * Update filename based on format Signed-off-by: Kevin Fox * Add upgrade notes Signed-off-by: Kevin Fox * Enable running the oidc discovery provider without cluster-admin/CSI Signed-off-by: Kevin Fox * Calm lint Signed-off-by: Kevin Fox * Switch to testing nightly. Dont manage bundle configmap. Signed-off-by: Kevin Fox * Update permissions Signed-off-by: Kevin Fox * Update permissions Signed-off-by: Kevin Fox * Update permissions Signed-off-by: Kevin Fox * Update for final release Signed-off-by: Kevin Fox * Update for final 1.12.4 release Signed-off-by: Kevin Fox * Apply suggestions from code review Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Update docs Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon --- .../charts/spiffe-oidc-discovery-provider/README.md | 2 ++ .../templates/configmap.yaml | 8 ++++++++ .../templates/deployment.yaml | 13 +++++++++++++ .../spiffe-oidc-discovery-provider/values.yaml | 6 ++++++ examples/static-manifest-server/values.yaml | 8 ++++++-- 5 files changed, 35 insertions(+), 2 deletions(-) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 8fab9b8..88d9d79 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -29,6 +29,8 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | | `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | | `csiDriverName` | The csi driver to use | `csi.spiffe.io` | +| `bundleSource` | Configure where to fetch the trust bundle from. Must be CSI or ConfigMap. | `CSI` | +| `bundleConfigMap` | ConfigMap name for SPIRE bundle when bundleSource is ConfigMap | `spire-bundle` | | `replicaCount` | Replica count | `1` | | `namespaceOverride` | Namespace override | `""` | | `annotations` | Annotations for the deployment | `{}` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml index 06a52f3..30e970e 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml @@ -1,3 +1,6 @@ +{{- if and (ne .Values.bundleSource "ConfigMap") (ne .Values.bundleSource "CSI") }} +{{- fail "Bundle source must be CSI or ConfigmMap" }} +{{- end }} {{- $tlsCount := 0 }} {{- if and .Values.enabled .Values.tls.spire.enabled }} {{- $tlsCount = add $tlsCount 1 }} @@ -44,9 +47,14 @@ serving_cert_file: jwks_uri: {{ .Values.config.jwksUri | quote }} {{- end }} +{{- if eq .Values.bundleSource "ConfigMap" }} +file: + path: /bundle/bundle.spiffe +{{- else }} workload_api: socket_path: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | quote }} trust_domain: {{ include "spire-lib.trust-domain" . | quote }} +{{- end }} health_checks: bind_port: "8008" diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml index 8b02c5b..07420bf 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -86,9 +86,15 @@ spec: name: https {{- end }} volumeMounts: + {{- if eq .Values.bundleSource "ConfigMap" }} + - name: spiffe-bundle + mountPath: /bundle + readOnly: true + {{- else }} - name: spiffe-workload-api mountPath: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | dir }} readOnly: true + {{- end }} - name: spire-oidc-sockets mountPath: /run/spire/oidc-sockets readOnly: false @@ -171,10 +177,17 @@ spec: {{- end }} {{- end }} volumes: + {{- if or .Values.tls.spire.enabled (eq .Values.bundleSource "CSI") }} - name: spiffe-workload-api csi: driver: "{{ .Values.csiDriverName }}" readOnly: true + {{- end }} + {{- if eq .Values.bundleSource "ConfigMap" }} + - name: spiffe-bundle + configMap: + name: {{ include "spire-lib.bundle-configmap" . }} + {{- end }} - name: spire-oidc-sockets emptyDir: {} - name: spire-oidc-config diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 613b131..43ef469 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -11,6 +11,12 @@ agentSocketName: spire-agent.sock ## @param csiDriverName The csi driver to use csiDriverName: csi.spiffe.io +## @param bundleSource Configure where to fetch the trust bundle from. Must be CSI or ConfigMap. +bundleSource: CSI + +## @param bundleConfigMap ConfigMap name for SPIRE bundle when bundleSource is ConfigMap +bundleConfigMap: spire-bundle + ## @param replicaCount Replica count replicaCount: 1 diff --git a/examples/static-manifest-server/values.yaml b/examples/static-manifest-server/values.yaml index 99c1d1c..b005fab 100644 --- a/examples/static-manifest-server/values.yaml +++ b/examples/static-manifest-server/values.yaml @@ -17,7 +17,7 @@ spire-server: selectors: - tpm:pub_hash:12345 foo-kubelet: - parentID: spiffe://example.org/foo + parentID: spiffe://example.org/hosts/foo spiffeID: spiffe://example.org/k8s/one/node/foo selectors: - systemd:id:kubelet.service @@ -28,4 +28,8 @@ spire-agent: spiffe-csi-driver: enabled: false spiffe-oidc-discovery-provider: - enabled: false + enabled: true + bundleSource: ConfigMap + tls: + spire: + enabled: false