* Expose filterByClassName setting to restrict the controller manager's ClusterSPIFFEID cache by class name, defaulting to false for backward compatibility.
Signed-off-by: Joel Goh <[email protected]>
* Shorten filterByClassName param descriptions and regenerate README.
Signed-off-by: Joel Goh <[email protected]>
---------
Signed-off-by: Joel Goh <[email protected]>
Co-authored-by: Joel Goh <[email protected]>
Replace the hardcoded `User: spire-root` subject with an `externalServerSubject`
block (`kind`/`name`/`namespace`) so the downstream RBAC can bind to a User,
Group, or ServiceAccount. Defaults preserve the previous behavior.
Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
* Gateway api support
Signed-off-by: Kevin Fox <[email protected]>
* Update readme
Signed-off-by: Kevin Fox <[email protected]>
* Fix gateway name. a gateway doesnt need to be named gateway
Signed-off-by: Kevin Fox <[email protected]>
* Fix naming issue
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
* Adds a changed-charts script to detect charts needing release
Shows charts where a release needs to be made, and in what order.
Example:
$ ./scripts/changed-charts.py
spire-lib
spire-identity-exchange
spire
spire-nested
Signed-off-by: Kevin Fox <[email protected]>
* Add deps that will change
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Allow each kubeConfigs entry to reference an externally-managed Secret
(externalSecret{name,key}) instead of embedding the kubeconfig in values.
Entries may reference different Secrets and mix inline with external ones.
The kubeconfigs volume becomes a projected volume; consumer mount paths are
unchanged. Each entry must set exactly one of kubeConfig, kubeConfigBase64,
or externalSecret.
Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
* Broker updates
Signed-off-by: Kevin Fox <[email protected]>
* Fix broker permission when running as nonroot
Signed-off-by: Kevin Fox <[email protected]>
* Fix broker permission when running as nonroot
Signed-off-by: Kevin Fox <[email protected]>
* Add workload attestor config
Signed-off-by: Kevin Fox <[email protected]>
* Add workload attestor config
Signed-off-by: Kevin Fox <[email protected]>
* Bump versions
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
* Update spire-identity-exchange version
Signed-off-by: Kevin Fox <[email protected]>
* Update spire-identity-exchange version
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
* Automatically label clusterspiffeids with their class name
Signed-off-by: Kevin Fox <[email protected]>
* Automatically label clusterspiffeids with their class name
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* SPIRE Agent support for Broker API
Signed-off-by: Kevin Fox <[email protected]>
* SPIRE Agent support for Broker API
Signed-off-by: Kevin Fox <[email protected]>
* SPIRE Agent support for Broker API
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-agent/templates/configmap.yaml
Co-authored-by: Matheus Pimenta <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
* Remove the istio entry
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Matheus Pimenta <[email protected]>
Add support for the EJBCA UpstreamAuthority plugin, allowing the SPIRE
server to use an EJBCA instance as its upstream CA over mTLS.
- Add upstreamAuthority.ejbca values (hostname, caName, endEntityProfileName,
certificateProfileName, optional endEntityName and accountBindingId).
- Render the ejbca UpstreamAuthority block in the server config and count it
toward the single-upstream-authority guard.
- Mount the mTLS client credentials (and optional CA cert) from a secret,
either chart-created (secret.create) or externally provided.
- Gate ca_cert_path on secret.data.caCert, mirroring the disk plugin's bundle
handling for deterministic rendering.
- Regenerate the chart README and add a unit render test.
Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
* Enable easy plugin loading
customPluings have to be loaded into the main container somehow. Extend
the existing cel plugin loader to allow users to easily specify an image
to load it from.
Signed-off-by: Kevin Fox <[email protected]>
* Add some missing bits
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Fix formatting
Signed-off-by: Kevin Fox <[email protected]>
* Fix formatting
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
The SPIRE OIDC Discovery Provider binary supports a top-level
`jwt_issuer` configuration key. When set, the provider returns that
exact string as the `issuer` field in the OIDC discovery document
(`.well-known/openid-configuration`) regardless of how the request was
routed. When unset, it derives `issuer` from the inbound HTTP Host
header. This chart did not render that key into the OIDC provider
config, leaving the discovery document Host-derived even when the
operator had a fixed issuer in mind.
Why this matters
OpenID Connect Discovery requires the discovery doc's `issuer` to be
byte-equal to the JWT `iss` claim. Conformant verifiers reject the chain
when the two differ. Production OIDC consumers routinely reach the
discovery endpoint at a URL different from the canonical issuer:
- a load balancer, ingress, or NodePort exposes the provider on an
IP or host different from the canonical issuer name;
- TLS terminates at a hostname different from the one advertised to
clients;
- the discovery URL is fetched by an internal service (e.g. the API
server in a private cluster) over a different DNS view than
external clients use;
- a pinned issuer URL is contractually required and must survive
infrastructure changes that move the actual service endpoint.
In all of these the JWT's `iss` claim is a logical, stable URL; the
discovery doc must report that same value, or downstream verifiers
reject the tokens.
Current chart behavior
The chart already has `global.spire.jwtIssuer` (and a subchart-local
`jwtIssuer`), resolved by the `spire-lib.jwt-issuer` helper to
`global.spire.jwtIssuer` -> subchart-local `jwtIssuer` ->
`https://oidc-discovery.<trustDomain>`. The spire-server subchart writes
that helper's result unconditionally as `jwt_issuer:` into the server's
config -- this controls the `iss` claim of every JWT-SVID the server
mints. In the OIDC subchart, however, the same helper was only used for
two things:
1. as the strict-mode assertion gate (fails the render when the
resolved value is the `example.org` default);
2. as the default source for `config.jwtDomain` (the Host
allow-list).
It was never written into the rendered OIDC provider configuration file.
The asymmetry means the chart shipped a structurally invalid OIDC setup
by default: the spire-server signs JWTs with `iss = <resolved issuer>`,
while the OIDC discovery endpoint advertises whatever Host header was
used to reach it. The only way to correct that today is to patch the
rendered ConfigMap out of band (`kubectl patch`, a CMP, a kustomize
post-renderer), which defeats the purpose of the chart.
Backward compatibility and behavior changes
Operators who set `global.spire.jwtIssuer` will see one additional
`jwt_issuer:` line in the rendered OIDC ConfigMap. The discovery doc's
`issuer` will start returning that pinned value instead of being
Host-derived, bringing the chain into spec compliance; this is a fix for
any spec-compliant verifier that previously rejected tokens. Operators
who only set the OIDC subchart-local `jwtIssuer` see the same fix
applied via the helper's fallback chain. Operators with nothing set will
see the new line default to `https://oidc-discovery.<trustDomain>`,
matching what the spire-server config already emits today.
Signed-off-by: Guillermo Gaston <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
* feat(spire-server): add terminationGracePeriodSeconds and lifecycle support
Adds two new top-level values to the spire-server chart:
- `terminationGracePeriodSeconds` (nullable, pod-spec level): overrides the
default 30s termination grace period. Useful when the server is behind a
load balancer that needs time to deregister the target (e.g. AWS NLB with
a deregistration delay > 30s).
- `lifecycle` (object, container level): lifecycle hooks for the spire-server
container. The primary use case is a preStop hook to hold the pod alive
while the load balancer deregisters the target before SIGTERM is sent:
lifecycle:
preStop:
sleep:
seconds: 60
Both fields default to their absent/empty equivalents (null and {}) so
existing deployments are unaffected.
Signed-off-by: Bronson Mirafuentes <[email protected]>
* Bump docker/login-action from 4.1.0 to 4.2.0 (#836)
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.1.0 to 4.2.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v4.1.0...v4.2.0)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 4.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Bronson Mirafuentes <[email protected]>
* feat(spire-server): remove lifecycle hook support
Lifecycle hooks are not needed for the terminationGracePeriodSeconds
use case; preStop semantics can be handled outside the chart.
Signed-off-by: Bronson Mirafuentes <[email protected]>
* update README
Signed-off-by: Bronson Mirafuentes <[email protected]>
* update README
Signed-off-by: Bronson Mirafuentes <[email protected]>
---------
Signed-off-by: Bronson Mirafuentes <[email protected]>
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
