Consider introducing a "bootstrap entries" feature for configuring static entries
#2,626 opened on Nov 16, 2021
Repository metrics
- Stars
- (2,443 stars)
- PR merge metrics
- (PR metrics pending)
Description
SPIRE deployments commonly include one or more administrative components that are responsible for managing registration entries. These components themselves however also require a registration entry to function (since they need an SVID to authenticate to the SPIRE Server APIs), thus creating a chicken and egg problem.
One way to solve this problem is to provide a bootstrap entry feature wherein an entry or set of entries can be statically provided to SPIRE as configuration. For example, a bootstrap_entries_file configurable on SPIRE Server, which specifies a path to a JSON formatted file containing one or more registration entries. When SPIRE boots, it checks for the presence of these entries in the datastore. It creates them if they're not there, it warns if they're there but different, it silently carries on if they're there and accurate.