spiffe/spire

Consider introducing a "bootstrap entries" feature for configuring static entries

オープン

#2,626 opened on 2021/11/16

 (14 件のコメント) (5 件のリアクション) (0 人の担当者)Go (631 件のフォーク)auto 404
help wantedpriority/backlog

Repository metrics

Stars
 (2,443 個のスター)
PR merge metrics
 (PR metrics pending)

説明

SPIRE deployments commonly include one or more administrative components that are responsible for managing registration entries. These components themselves however also require a registration entry to function (since they need an SVID to authenticate to the SPIRE Server APIs), thus creating a chicken and egg problem.

One way to solve this problem is to provide a bootstrap entry feature wherein an entry or set of entries can be statically provided to SPIRE as configuration. For example, a bootstrap_entries_file configurable on SPIRE Server, which specifies a path to a JSON formatted file containing one or more registration entries. When SPIRE boots, it checks for the presence of these entries in the datastore. It creates them if they're not there, it warns if they're there but different, it silently carries on if they're there and accurate.

コントリビューターガイド