Consider introducing a "bootstrap entries" feature for configuring static entries
#2 626 ouverte le 16 nov. 2021
Métriques du dépôt
- Stars
- (2 443 étoiles)
- Métriques de merge PR
- (Merge moyen 9j 14h) (44 PRs mergées en 30 j)
Description
SPIRE deployments commonly include one or more administrative components that are responsible for managing registration entries. These components themselves however also require a registration entry to function (since they need an SVID to authenticate to the SPIRE Server APIs), thus creating a chicken and egg problem.
One way to solve this problem is to provide a bootstrap entry feature wherein an entry or set of entries can be statically provided to SPIRE as configuration. For example, a bootstrap_entries_file configurable on SPIRE Server, which specifies a path to a JSON formatted file containing one or more registration entries. When SPIRE boots, it checks for the presence of these entries in the datastore. It creates them if they're not there, it warns if they're there but different, it silently carries on if they're there and accurate.