panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
4f8ac5af060b1609cc0217bf3fb97cc88ca9b6a4
helm-charts-hardened/charts/spire/values.yaml
T
Guillermo Gastonandkfox1111 4f8ac5af06 Configure jwt_issuer in SPIRE OIDC Provider (#829) 
The SPIRE OIDC Discovery Provider binary supports a top-level
`jwt_issuer` configuration key. When set, the provider returns that
exact string as the `issuer` field in the OIDC discovery document
(`.well-known/openid-configuration`) regardless of how the request was
routed. When unset, it derives `issuer` from the inbound HTTP Host
header. This chart did not render that key into the OIDC provider
config, leaving the discovery document Host-derived even when the
operator had a fixed issuer in mind.

Why this matters

OpenID Connect Discovery requires the discovery doc's `issuer` to be
byte-equal to the JWT `iss` claim. Conformant verifiers reject the chain
when the two differ. Production OIDC consumers routinely reach the
discovery endpoint at a URL different from the canonical issuer:

    - a load balancer, ingress, or NodePort exposes the provider on an
      IP or host different from the canonical issuer name;
    - TLS terminates at a hostname different from the one advertised to
      clients;
    - the discovery URL is fetched by an internal service (e.g. the API
      server in a private cluster) over a different DNS view than
      external clients use;
    - a pinned issuer URL is contractually required and must survive
      infrastructure changes that move the actual service endpoint.

In all of these the JWT's `iss` claim is a logical, stable URL; the
discovery doc must report that same value, or downstream verifiers
reject the tokens.

Current chart behavior

The chart already has `global.spire.jwtIssuer` (and a subchart-local
`jwtIssuer`), resolved by the `spire-lib.jwt-issuer` helper to
`global.spire.jwtIssuer` -> subchart-local `jwtIssuer` ->
`https://oidc-discovery.<trustDomain>`. The spire-server subchart writes
that helper's result unconditionally as `jwt_issuer:` into the server's
config -- this controls the `iss` claim of every JWT-SVID the server
mints. In the OIDC subchart, however, the same helper was only used for
two things:

    1. as the strict-mode assertion gate (fails the render when the
       resolved value is the `example.org` default);
    2. as the default source for `config.jwtDomain` (the Host
       allow-list).

It was never written into the rendered OIDC provider configuration file.
The asymmetry means the chart shipped a structurally invalid OIDC setup
by default: the spire-server signs JWTs with `iss = <resolved issuer>`,
while the OIDC discovery endpoint advertises whatever Host header was
used to reach it. The only way to correct that today is to patch the
rendered ConfigMap out of band (`kubectl patch`, a CMP, a kustomize
post-renderer), which defeats the purpose of the chart.

Backward compatibility and behavior changes

Operators who set `global.spire.jwtIssuer` will see one additional
`jwt_issuer:` line in the rendered OIDC ConfigMap. The discovery doc's
`issuer` will start returning that pinned value instead of being
Host-derived, bringing the chain into spec compliance; this is a fix for
any spec-compliant verifier that previously rejected tokens. Operators
who only set the OIDC subchart-local `jwtIssuer` see the same fix
applied via the helper's fallback chain. Operators with nothing set will
see the new line default to `https://oidc-discovery.<trustDomain>`,
matching what the spire-server config already emits today.

Signed-off-by: Guillermo Gaston <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
2026-06-14 01:25:43 +00:00

246 lines
11 KiB
YAML
Raw Blame History

# Default configuration for Spire chart
# SPDX-License-Identifier: APACHE-2.0
## @section Global parameters
## Note: the parameter values specified here will override the chart level values for these parameters.
##
global:
## @param global.imagePullSecrets [array] Image pull secret names
imagePullSecrets: []
k8s:
## @param global.k8s.clusterDomain Cluster domain name configured for Spire install
clusterDomain: cluster.local
spire:
## @param global.spire.bundleConfigMap A configmap containing the Spire bundle
bundleConfigMap: ""
## @param global.spire.clusterName The name of the k8s cluster for Spire install
clusterName: example-cluster
## @param global.spire.jwtIssuer Issuer URL used for both the JWT-SVID `iss` claim minted by spire-server and the `issuer` field advertised by the OIDC discovery document. Defaults to oidc-discovery.$trustDomain if unset
jwtIssuer: ""
## @param global.spire.trustDomain The trust domain for Spire install
trustDomain: example.org
## @param global.spire.upstreamServerAddress Set what address to use for the upstream server when using nested spire
upstreamServerAddress: ""
## @param global.spire.caSubject.country Country for Spire server CA
## @param global.spire.caSubject.organization Organization for Spire server CA
## @param global.spire.caSubject.commonName Common Name for Spire server CA
caSubject:
country: ""
organization: ""
commonName: ""
persistence:
## @param global.spire.persistence.storageClass What storage class to use for persistence
storageClass: null
## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off.
## @param global.spire.recommendations.namespaceLayout Set to true to use recommended values for installing across namespaces
## @param global.spire.recommendations.namespacePSS When chart namespace creation is enabled, label them with preffered Pod Security Standard labels
## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names
## @param global.spire.recommendations.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
## @param global.spire.recommendations.securityContexts Set to true to use recommended values for Pod and Container Security Contexts
## @param global.spire.recommendations.prometheus Enable prometheus exporters for monitoring
recommendations:
enabled: false
namespaceLayout: true
namespacePSS: true
priorityClassName: true
strictMode: true
securityContexts: true
prometheus: true
image:
## @param global.spire.image.registry Override all Spire image registries at once
registry: ""
namespaces:
## @param global.spire.namespaces.create Set to true to Create all namespaces. If this or either of the namespace specific create flags is set, the namespace will be created.
create: false
system:
## @param global.spire.namespaces.system.name Name of the Spire system Namespace.
name: "spire-system"
## @param global.spire.namespaces.system.create Create a Namespace for Spire system resources.
create: false
## @param global.spire.namespaces.system.annotations [object] Annotations to apply to the Spire system Namespace.
annotations: {}
## @param global.spire.namespaces.system.labels [object] Labels to apply to the Spire system Namespace.
labels: {}
server:
## @param global.spire.namespaces.server.name Name of the Spire server Namespace.
name: "spire-server"
## @param global.spire.namespaces.server.create Create a Namespace for Spire server resources.
create: false
## @param global.spire.namespaces.server.annotations [object] Annotations to apply to the Spire server Namespace.
annotations: {}
## @param global.spire.namespaces.server.labels [object] Labels to apply to the Spire server Namespace.
labels: {}
## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
strictMode: false
## @param global.spire.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
ingressControllerType: ""
tools:
kubectl:
## @param global.spire.tools.kubectl.tag Set to force the tag to use for all kubectl instances
tag: ""
installAndUpgradeHooks:
## @param global.installAndUpgradeHooks.enabled Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`)
enabled: true
## @param global.installAndUpgradeHooks.resources [object] Resource requests and limits for installAndUpgradeHooks
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, copy the following
# to your values file and edit as needed.
# limits:
# cpu: 100m
# memory: 128Mi
# requests:
# cpu: 100m
# memory: 128Mi
deleteHooks:
## @param global.deleteHooks.enabled Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`)
enabled: true
## @param global.deleteHooks.resources [object] Resource requests and limits for deleteHooks
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, copy the following
# to your values file and edit as needed.
# limits:
# cpu: 100m
# memory: 128Mi
# requests:
# cpu: 100m
# memory: 128Mi
# telemetry:
# prometheus:
# enabled: true
# podMonitor:
# enabled: true
# # -- Allows to install the PodMonitor in another namespace then the spire components are installed into.
# namespace: "kube-prometheus-system"
# labels: {}
## subcharts
## @section Spire server parameters
## Parameter values for Spire server
##
spire-server:
## @param spire-server.enabled Flag to enable Spire server
enabled: true
## @param spire-server.nameOverride Overrides the name of Spire server pods
nameOverride: server
## @param spire-server.kind Run spire server as deployment/statefulset. This feature is experimental.
kind: statefulset
controllerManager:
## @param spire-server.controllerManager.enabled Enable controller manager and provision CRD's
enabled: true
externalControllerManagers:
## @param spire-server.externalControllerManagers.enabled Enable external controller manager support
enabled: true
## @section Spire agent parameters
## Parameter values for Spire agent
##
spire-agent:
## @param spire-agent.enabled Flag to enable Spire agent
enabled: true
## @param spire-agent.nameOverride Overrides the name of Spire agent pods
nameOverride: agent
## @section Upstream Spire agent and CSI driver configuration
## Parameter values enabling upstream spire agent and CSI driver
##
upstream:
## @param upstream.enabled Enable upstream agent and driver for use with nested spire
enabled: false
## @section Upstream Spire agent parameters
## Parameter values for upstream Spire agent
##
upstream-spire-agent:
## @param upstream-spire-agent.upstream Flag for enabling upstream Spire agent
upstream: true
## @param upstream-spire-agent.nameOverride Name override for upstream Spire agent
nameOverride: agent-upstream
## @param upstream-spire-agent.bundleConfigMap The configmap name for upstream Spire agent bundle
bundleConfigMap: spire-bundle-upstream
## @param upstream-spire-agent.socketPath Socket path where Spire agent socket is mounted
socketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
serviceAccount:
## @param upstream-spire-agent.serviceAccount.name Service account name for upstream Spire agent
name: spire-agent-upstream
healthChecks:
## @param upstream-spire-agent.healthChecks.port Health check port number for upstream Spire agent
port: 9981
telemetry:
prometheus:
## @param upstream-spire-agent.telemetry.prometheus.port The port where prometheus metrics are available
port: 9989
## @param upstream-spire-agent.persistence.hostPath Which path to use on the host when persistence.type = hostPath
persistence:
hostPath: /var/lib/spire/k8s/upstream-agent
## @section SPIFFE CSI Driver parameters
## Parameter values for spiffe-csi-driver
##
spiffe-csi-driver:
## @param spiffe-csi-driver.enabled Flag to enable spiffe-csi-driver for the cluster
enabled: true
## @section Upstream SPIFFE CSI Driver parameters
## Parameter values for upstream spiffe-csi-driver
##
upstream-spiffe-csi-driver:
## @param upstream-spiffe-csi-driver.pluginName The plugin name for configuring upstream Spiffe CSI driver
pluginName: upstream.csi.spiffe.io
## @param upstream-spiffe-csi-driver.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
agentSocketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
healthChecks:
## @param upstream-spiffe-csi-driver.healthChecks.port The port where Spiffe CSI driver health checks are exposed
port: 9810
## @section SPIFFE oidc discovery provider parameters
## Parameter values for spiffe-oidc-discovery-provider
##
spiffe-oidc-discovery-provider:
## @param spiffe-oidc-discovery-provider.enabled Flag to enable spiffe-oidc-discovery-provider for the cluster
enabled: true
## @section Tornjak frontend parameters
## Parameter values for Tornjak frontend
##
tornjak-frontend:
## @param tornjak-frontend.enabled Enables deployment of Tornjak frontend/UI (Not for production)
enabled: false
## @section SPIKE Keeper parameters
## Parameter values for SPIKE Keeper
##
spike-keeper:
## @param spike-keeper.enabled Enables deployment of SPIKE Keeper (Not for production)
enabled: false
## @section SPIKE Nexus parameters
## Parameter values for SPIKE Nexus
##
spike-nexus:
## @param spike-nexus.enabled Enables deployment of SPIKE Nexus (Not for production)
enabled: false
## @section SPIKE Pilot parameters
## Parameter values for SPIKE Pilot
##
spike-pilot:
## @param spike-pilot.enabled Enables deployment of SPIKE Pilot (Not for production)
enabled: false
Reference in New Issue View Git Blame Copy Permalink