Add broker suport to the spire-ha-agent (#884)

* Add broker suport to the spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
2026-07-30 13:15:55 -07:00
parent 3cfefb72ba
commit f4c7df239e
10 changed files with 322 additions and 15 deletions
@@ -0,0 +1,74 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: federation-test
+spec:
+  backoffLimit: 0
+  template:
+    metadata:
+      labels:
+        app: federation-test
+    spec:
+      restartPolicy: Never
+      initContainers:
+      - name: static-busybox
+        # Replaced by run-tests.sh with the image from the spiffe-oidc-discovery-provider chart
+        image: replaced-by-run-tests.sh
+        command:
+        - sh
+        - -c
+        - |
+          cp /bin/busybox /data/busybox
+          chmod +x /data/busybox
+        volumeMounts:
+        - name: data-volume
+          mountPath: /data
+      containers:
+      - name: main
+        # Replaced by run-tests.sh with the image from the spire-agent chart
+        image: replaced-by-run-tests.sh
+        command:
+        - /data/busybox
+        - sh
+        - -xc
+        - |
+          SOCK=/spire-agent/spire-agent.sock
+          i=0
+          while [ "$i" -lt 60 ]; do
+            if XOUT=$(/opt/spire/bin/spire-agent api fetch x509 -socketPath "$SOCK" -write /data -timeout 5s 2>&1) &&
+               echo "$XOUT" | /data/busybox grep -q "for trust domain other.org" &&
+               JOUT=$(/opt/spire/bin/spire-agent api fetch jwt -audience test -socketPath "$SOCK" -timeout 5s 2>&1) &&
+               echo "$JOUT" | /data/busybox grep -q "bundle(other.org)"; then
+              # The other.org bundle was statically set to the same single CA on both sides,
+              # so every federated bundle delivered must contain exactly one certificate.
+              for f in /data/federated_bundle.*.pem; do
+                COUNT=$(/data/busybox grep -c "BEGIN CERTIFICATE" "$f")
+                if [ "$COUNT" != "1" ]; then
+                  echo "expected 1 CA in $f, got $COUNT"
+                  exit 1
+                fi
+              done
+              echo "$XOUT"
+              echo "$JOUT"
+              echo FEDERATION-OK
+              exit 0
+            fi
+            i=$((i+1))
+            /data/busybox sleep 2
+          done
+          echo "$XOUT"
+          echo "$JOUT"
+          exit 1
+        volumeMounts:
+        - name: data-volume
+          mountPath: /data
+        - name: spire-api
+          mountPath: /spire-agent
+          readOnly: true
+      volumes:
+      - name: data-volume
+        emptyDir: {}
+      - name: spire-api
+        csi:
+          driver: csi.spiffe.io
+          readOnly: true