Guillermo Gastonandkfox1111
4f8ac5af06
The SPIRE OIDC Discovery Provider binary supports a top-level
`jwt_issuer` configuration key. When set, the provider returns that
exact string as the `issuer` field in the OIDC discovery document
(`.well-known/openid-configuration`) regardless of how the request was
routed. When unset, it derives `issuer` from the inbound HTTP Host
header. This chart did not render that key into the OIDC provider
config, leaving the discovery document Host-derived even when the
operator had a fixed issuer in mind.
Why this matters
OpenID Connect Discovery requires the discovery doc's `issuer` to be
byte-equal to the JWT `iss` claim. Conformant verifiers reject the chain
when the two differ. Production OIDC consumers routinely reach the
discovery endpoint at a URL different from the canonical issuer:
- a load balancer, ingress, or NodePort exposes the provider on an
IP or host different from the canonical issuer name;
- TLS terminates at a hostname different from the one advertised to
clients;
- the discovery URL is fetched by an internal service (e.g. the API
server in a private cluster) over a different DNS view than
external clients use;
- a pinned issuer URL is contractually required and must survive
infrastructure changes that move the actual service endpoint.
In all of these the JWT's `iss` claim is a logical, stable URL; the
discovery doc must report that same value, or downstream verifiers
reject the tokens.
Current chart behavior
The chart already has `global.spire.jwtIssuer` (and a subchart-local
`jwtIssuer`), resolved by the `spire-lib.jwt-issuer` helper to
`global.spire.jwtIssuer` -> subchart-local `jwtIssuer` ->
`https://oidc-discovery.<trustDomain>`. The spire-server subchart writes
that helper's result unconditionally as `jwt_issuer:` into the server's
config -- this controls the `iss` claim of every JWT-SVID the server
mints. In the OIDC subchart, however, the same helper was only used for
two things:
1. as the strict-mode assertion gate (fails the render when the
resolved value is the `example.org` default);
2. as the default source for `config.jwtDomain` (the Host
allow-list).
It was never written into the rendered OIDC provider configuration file.
The asymmetry means the chart shipped a structurally invalid OIDC setup
by default: the spire-server signs JWTs with `iss = <resolved issuer>`,
while the OIDC discovery endpoint advertises whatever Host header was
used to reach it. The only way to correct that today is to patch the
rendered ConfigMap out of band (`kubectl patch`, a CMP, a kustomize
post-renderer), which defeats the purpose of the chart.
Backward compatibility and behavior changes
Operators who set `global.spire.jwtIssuer` will see one additional
`jwt_issuer:` line in the rendered OIDC ConfigMap. The discovery doc's
`issuer` will start returning that pinned value instead of being
Host-derived, bringing the chain into spec compliance; this is a fix for
any spec-compliant verifier that previously rejected tokens. Operators
who only set the OIDC subchart-local `jwtIssuer` see the same fix
applied via the helper's fallback chain. Operators with nothing set will
see the new line default to `https://oidc-discovery.<trustDomain>`,
matching what the spire-server config already emits today.
Signed-off-by: Guillermo Gaston <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
46 KiB
46 KiB
spiffe-oidc-discovery-provider
A Helm chart to install the SPIFFE OIDC discovery provider.
Homepage: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
Maintainers
| Name | Url | |
|---|---|---|
| marcofranssen | [email protected] | https://marcofranssen.nl |
| kfox1111 | [email protected] | |
| faisal-memon | [email protected] | |
| edwbuck | [email protected] |
Source Code
Parameters
Chart parameters
| Name | Description | Value |
|---|---|---|
agentSocketName |
The name of the spire-agent unix socket | spire-agent.sock |
csiDriverName |
The csi driver to use | csi.spiffe.io |
bundleSource |
Configure where to fetch the trust bundle from. Must be CSI or ConfigMap. | CSI |
bundleConfigMap |
ConfigMap name for SPIRE bundle when bundleSource is ConfigMap | spire-bundle |
replicaCount |
Replica count | 1 |
namespaceOverride |
Namespace override | "" |
annotations |
Annotations for the deployment | {} |
labels |
Labels for the deployment | {} |
image.registry |
The OCI registry to pull the image from | ghcr.io |
image.repository |
The repository within the registry | spiffe/oidc-discovery-provider |
image.pullPolicy |
The image pull policy | IfNotPresent |
image.tag |
Overrides the image tag whose default is the chart appVersion | "" |
expandEnv |
Set to true to enable environment variable substitution of config file options | false |
extraEnv |
Extra environment variables to add to the spiffe oidc discovery provider | [] |
spiffeHelper.image.registry |
The OCI registry to pull the image from | ghcr.io |
spiffeHelper.image.repository |
The repository within the registry | spiffe/spiffe-helper |
spiffeHelper.image.pullPolicy |
The image pull policy | IfNotPresent |
spiffeHelper.image.tag |
Overrides the image tag whose default is the chart appVersion | 0.11.0 |
spiffeHelper.resources |
Resource requests and limits | {} |
resources |
Resource requests and limits | {} |
service.type |
Service type | ClusterIP |
service.ports.http |
Insecure port for the service | 80 |
service.ports.https |
Secure port for the service | 443 |
service.annotations |
Annotations for service resource | {} |
service.loadBalancerIP |
IP address to assign to load balancer (if supported) | "" |
configMap.annotations |
Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | {} |
podSecurityContext |
Pod security context for OIDC discovery provider pods | {} |
securityContext |
Security context for OIDC discovery provider deployment | {} |
readinessProbe.initialDelaySeconds |
Initial delay seconds for readinessProbe | 5 |
readinessProbe.periodSeconds |
Period seconds for readinessProbe | 5 |
livenessProbe.initialDelaySeconds |
Initial delay seconds for livenessProbe | 5 |
livenessProbe.periodSeconds |
Period seconds for livenessProbe | 5 |
podAnnotations |
Pod annotations for Spire OIDC discovery provider | {} |
podLabels |
Labels to add to pods | {} |
tls.spire.enabled |
Use spire to secure the oidc-discovery-provider | true |
tls.externalSecret.enabled |
Provide your own certificate/key via tls style Kubernetes Secret | false |
tls.externalSecret.secretName |
Specify which Secret to use | "" |
tls.certManager.enabled |
Use certificateManager to create the certificate | false |
tls.certManager.issuer.create |
Create an issuer to use to issue the certificate | true |
tls.certManager.issuer.acme.email |
Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service | "" |
tls.certManager.issuer.acme.server |
Server to use to get certificate. Defaults to LetsEncrypt | https://acme-v02.api.letsencrypt.org/directory |
tls.certManager.issuer.acme.solvers |
Configure the issuer solvers. Defaults to http01 via ingress. | {} |
tls.certManager.certificate.dnsNames |
Override the dnsNames on the certificate request. Defaults to the same settings as Ingress | [] |
tls.certManager.certificate.issuerRef.group |
If you are using an external plugin, specify the group for it here | "" |
tls.certManager.certificate.issuerRef.kind |
Kind of the issuer reference. Override if you want to use a ClusterIssuer | Issuer |
tls.certManager.certificate.issuerRef.name |
Name of the issuer to use. If unset, it will use the name of the built in issuer | "" |
insecureScheme.nginx.image.registry |
The OCI registry to pull the image from. Only used when TLS is disabled. | docker.io |
insecureScheme.nginx.image.repository |
The repository within the registry. Only used when TLS is disabled. | nginxinc/nginx-unprivileged |
insecureScheme.nginx.image.pullPolicy |
The image pull policy. Only used when TLS is disabled. | IfNotPresent |
insecureScheme.nginx.image.tag |
Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | 1.30.0-alpine |
insecureScheme.nginx.ipMode |
IP modes supported by the cluster. Must be one of [ipv4, ipv6, both] | both |
insecureScheme.nginx.resources |
Resource requests and limits | {} |
jwtIssuer |
Issuer URL used for the issuer field advertised by the OIDC discovery document. Defaults to oidc-discovery.$trustDomain if unset |
"" |
config.logLevel |
The log level, valid values are "debug", "info", "warn", and "error" | info |
config.logFormat |
The log format, valid values are "text" and "json" | text |
config.jwtDomain |
The JWT domain. Defaults to oidc-discovery.$jwtIssuer URL-parsed host if unset | "" |
config.jwksUri |
The JWKS URI | "" |
config.serverPathPrefix |
If specified, all endpoints listened to will be prefixed by this value | "" |
config.additionalDomains |
Add additional domains that can be used for oidc discovery | [] |
config.setKeyUse |
Add "use":"sig" field to JWKs (required for Keycloak SPIFFE provider) | false |
imagePullSecrets |
Image pull secret names | [] |
nameOverride |
Name override | "" |
fullnameOverride |
Full name override | "" |
serviceAccount.create |
Specifies whether a service account should be created | true |
serviceAccount.annotations |
Annotations to add to the service account | {} |
serviceAccount.name |
The name of the service account to use. If not set and create is true, a name is generated. | "" |
deleteHook.enabled |
Enable Helm hooks to autofix common delete issues (should be disabled when using helm template) |
true |
autoscaling.enabled |
Flag to enable autoscaling | false |
autoscaling.minReplicas |
Minimum replicas for autoscaling | 1 |
autoscaling.maxReplicas |
Maximum replicas for autoscaling | 5 |
autoscaling.targetCPUUtilizationPercentage |
Target CPU utlization that triggers autoscaling | 80 |
autoscaling.targetMemoryUtilizationPercentage |
Target Memory utlization that triggers autoscaling | 80 |
nodeSelector |
Node selector | {} |
tolerations |
iist of tolerations | [] |
affinity |
Node affinity | {} |
trustDomain |
Set the trust domain to be used for the SPIFFE identifiers | example.org |
clusterDomain |
The name of the Kubernetes cluster (kubeadm init --service-dns-domain) |
cluster.local |
telemetry.prometheus.enabled |
Flag to enable prometheus monitoring | false |
telemetry.prometheus.port |
Port for prometheus metrics | 9988 |
telemetry.prometheus.podMonitor.enabled |
Enable podMonitor for prometheus | false |
telemetry.prometheus.podMonitor.namespace |
Override where to install the podMonitor, if not set will use the same namespace as the helm release | "" |
telemetry.prometheus.podMonitor.labels |
Pod labels to filter for prometheus monitoring | {} |
telemetry.prometheus.nginxExporter.image.registry |
The OCI registry to pull the image from | docker.io |
telemetry.prometheus.nginxExporter.image.repository |
The repository within the registry | nginx/nginx-prometheus-exporter |
telemetry.prometheus.nginxExporter.image.pullPolicy |
The image pull policy | IfNotPresent |
telemetry.prometheus.nginxExporter.image.tag |
Overrides the image tag whose default is the chart appVersion | 1.5.1 |
telemetry.prometheus.nginxExporter.resources |
Resource requests and limits | {} |
ingress.enabled |
Flag to enable ingress | false |
ingress.className |
Ingress class name | "" |
ingress.controllerType |
Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | "" |
ingress.annotations |
Annotations for ingress object | {} |
ingress.host |
Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | oidc-discovery |
ingress.tlsSecret |
Secret that has the certs. If blank will use default certs. Used with host var. | "" |
ingress.hosts |
Host paths for ingress object. If emtpy, rules will be built based on the host var. | [] |
ingress.tls |
Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | [] |
tests.hostAliases |
List of host aliases for testing | [] |
tests.tls.enabled |
Flag for enabling tls for tests | false |
tests.tls.customCA |
Custom CA value for tests | "" |
tests.bash.image.registry |
The OCI registry to pull the image from | cgr.dev |
tests.bash.image.repository |
The repository within the registry | chainguard/bash |
tests.bash.image.pullPolicy |
The image pull policy | IfNotPresent |
tests.bash.image.tag |
Overrides the image tag whose default is the chart appVersion | latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58 |
tests.toolkit.image.registry |
The OCI registry to pull the image from | cgr.dev |
tests.toolkit.image.repository |
The repository within the registry | chainguard/min-toolkit-debug |
tests.toolkit.image.pullPolicy |
The image pull policy | IfNotPresent |
tests.toolkit.image.tag |
Overrides the image tag whose default is the chart appVersion | latest@sha256:9e45e6836c28489a6e57ca1210ec66927e88eca2409e403616a1278e210e86c9 |
tests.step.image.registry |
The OCI registry to pull the image from | docker.io |
tests.step.image.repository |
The repository within the registry | smallstep/step-cli |
tests.step.image.pullPolicy |
The image pull policy | IfNotPresent |
tests.step.image.tag |
Overrides the image tag whose default is the chart appVersion | 0.30.2 |
tests.busybox.image.registry |
The OCI registry to pull the image from | "" |
tests.busybox.image.repository |
The repository within the registry | busybox |
tests.busybox.image.pullPolicy |
The image pull policy | IfNotPresent |
tests.busybox.image.tag |
Overrides the image tag whose default is the chart appVersion | 1.37.0-uclibc |
tests.agent.image.registry |
The OCI registry to pull the image from | ghcr.io |
tests.agent.image.repository |
The repository within the registry | spiffe/spire-agent |
tests.agent.image.pullPolicy |
The image pull policy | IfNotPresent |
tests.agent.image.tag |
Overrides the image tag whose default is the chart appVersion | "" |
tools.kubectl.image.registry |
The OCI registry to pull the image from | registry.k8s.io |
tools.kubectl.image.repository |
The repository within the registry | kubectl |
tools.kubectl.image.pullPolicy |
The image pull policy | IfNotPresent |
tools.kubectl.image.tag |
Overrides the image tag whose default is the chart appVersion | "" |