From b6ad65d768ed87d28900dcc5d616fac2486fe7bb Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Sun, 13 Sep 2026 15:44:18 +0000
Subject: [PATCH] =?UTF-8?q?=E6=9A=B4=E9=9C=B2=20SPIRE=20OIDC=20discovery?=
 =?UTF-8?q?=20endpoint?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 infrastructure/dns/records.yml    |  1 +
 platform/spire/README.md          | 11 ++++++++---
 platform/spire/httproute.yaml     | 16 ++++++++++++++++
 platform/spire/kustomization.yaml |  1 +
 4 files changed, 26 insertions(+), 3 deletions(-)
 create mode 100644 platform/spire/httproute.yaml

diff --git a/infrastructure/dns/records.yml b/infrastructure/dns/records.yml
index 3789835..11a3375 100644
--- a/infrastructure/dns/records.yml
+++ b/infrastructure/dns/records.yml
@@ -13,6 +13,7 @@ homelab_dns:
       - { zone: ad.ddupan.top, name: retrolab, type: A, values: [10.60.0.10] }
       - { zone: ad.ddupan.top, name: netbox, type: A, values: [192.168.10.127] }
       - { zone: ad.ddupan.top, name: s3, type: A, values: [192.168.10.127] }
+      - { zone: ad.ddupan.top, name: spire-oidc, type: A, values: [192.168.10.127] }
 
   split_horizon:
     # LAN and pod resolvers should eventually render the same set from here.
diff --git a/platform/spire/README.md b/platform/spire/README.md
index e13e6b1..226c374 100644
--- a/platform/spire/README.md
+++ b/platform/spire/README.md
@@ -50,9 +50,14 @@ PostgreSQL保存 registration state；SPIRE Server 的 disk KeyManager 仍使用
 https://spire-oidc.ad.ddupan.top
 ```
 
-首次部署时 OIDC Discovery Provider 仅为 ClusterIP，内部为明文 HTTP；尚未创建
-外部 DNS 或 Gateway route。接入 OpenBao 前，在现有 Envoy Gateway 上终止 TLS、
-增加内网 DNS，并验证 discovery document 的 `issuer` 与上述 URL 完全一致。
+OIDC Discovery Provider 在 Pod 内部使用明文 HTTP，由现有 Envoy Gateway 的
+`https` listener 使用 `*.ad.ddupan.top` wildcard certificate 终止 TLS。对应的
+`HTTPRoute` 将 `spire-oidc.ad.ddupan.top` 转发到 ClusterIP Service；AD DNS 记录
+声明在 `../../infrastructure/dns/records.yml`，由 Samba DNS Ansible 流程应用。
+
+接入 OpenBao 前必须从集群内和 LAN 分别验证 discovery document 的 `issuer` 与
+上述 URL 完全一致。该 endpoint 只发布公开的 discovery metadata 和 JWKS，不能
+在其 HTTPRoute 上添加 Authelia forward-auth。
 
 ## 首次部署与验证
 
diff --git a/platform/spire/httproute.yaml b/platform/spire/httproute.yaml
new file mode 100644
index 0000000..352b6e4
--- /dev/null
+++ b/platform/spire/httproute.yaml
@@ -0,0 +1,16 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: spire-oidc-discovery-provider
+  namespace: spire-server
+spec:
+  parentRefs:
+    - name: eg
+      namespace: envoy-gateway-system
+      sectionName: https
+  hostnames:
+    - spire-oidc.ad.ddupan.top
+  rules:
+    - backendRefs:
+        - name: spire-spiffe-oidc-discovery-provider
+          port: 80
diff --git a/platform/spire/kustomization.yaml b/platform/spire/kustomization.yaml
index 69075cb..1ade345 100644
--- a/platform/spire/kustomization.yaml
+++ b/platform/spire/kustomization.yaml
@@ -14,3 +14,4 @@ resources:
   - helmrepository.yaml
   - helmrelease-crds.yaml
   - helmrelease.yaml
+  - httproute.yaml