tylerg/auth-yes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(spire): maintain bootstrap token continuously until agent enrollment completes

Browse Source
This commit is contained in:
Tyler Gillispie 2026-08-23 11:29:15 -07:00
parent 1151431e5f
commit 37f86f2ba7
2 changed files with 19 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
spire/entrypoint.agent.sh
View File

@ -18,7 +18,7 @@ fi
# Check if this agent is enrolling for the first time
if [ ! -f /opt/spire/data/agent/svid.key ] && [ ! -f /opt/spire/data/agent/agent_svids.json ]; then
echo "[SPIRE Agent] Initial enrollment detected. Waiting for bootstrap join token..."
for i in $(seq 1 30); do
for i in $(seq 1 60); do
if [ -f /opt/spire/data/bootstrap_token ]; then
break
fi
@ -28,10 +28,9 @@ if [ ! -f /opt/spire/data/agent/svid.key ] && [ ! -f /opt/spire/data/agent/agent
if [ -f /opt/spire/data/bootstrap_token ]; then
JOIN_TOKEN=$(cat /opt/spire/data/bootstrap_token | tr -d ' \r\n')
echo "[SPIRE Agent] Joining SPIRE cluster with token..."
rm -f /opt/spire/data/bootstrap_token
exec /usr/local/bin/spire-agent "$@" -joinToken "$JOIN_TOKEN"
else
echo "[SPIRE Agent] Warning: No bootstrap_token found after 30s. Attempting standard startup..."
echo "[SPIRE Agent] Warning: No bootstrap_token found after 60s. Attempting standard startup..."
fi
fi

31
spire/entrypoint.server.sh
View File

@ -13,26 +13,29 @@ fi
/usr/local/bin/spire-server "$@" &
SERVER_PID=$!
# Helper: Auto-generate bootstrap join token for local agent on initial enrollment
# Helper: Maintain auto-bootstrap join token until local agent has successfully enrolled
(
SOCKET="/opt/spire/data/server/api.sock"
for i in $(seq 1 30); do
if [ -S "$SOCKET" ]; then
break
fi
while [ ! -S "$SOCKET" ]; do
sleep 1
done
if [ -S "$SOCKET" ] && [ ! -f /opt/spire/data/agent/svid.key ]; then
echo "[SPIRE Server] Generating auto-bootstrap join token for local agent..."
TOKEN_OUTPUT=$(/usr/local/bin/spire-server token generate -spiffeID spiffe://system.local/agent -socketPath "$SOCKET" 2>/dev/null || true)
TOKEN=$(echo "$TOKEN_OUTPUT" | grep -i "token:" | awk '{print $2}')
if [ -n "$TOKEN" ]; then
echo "$TOKEN" > /opt/spire/data/bootstrap_token
chmod 600 /opt/spire/data/bootstrap_token
echo "[SPIRE Server] Auto-bootstrap token ready."
while [ ! -f /opt/spire/data/agent/svid.key ] && [ ! -f /opt/spire/data/agent/agent_svids.json ]; do
if [ ! -f /opt/spire/data/bootstrap_token ]; then
echo "[SPIRE Server] Generating auto-bootstrap join token for local agent..."
TOKEN_OUTPUT=$(/usr/local/bin/spire-server token generate -spiffeID spiffe://system.local/agent -socketPath "$SOCKET" -ttl 3600 2>/dev/null || true)
TOKEN=$(echo "$TOKEN_OUTPUT" | grep -i "token:" | awk '{print $2}')
if [ -n "$TOKEN" ]; then
echo "$TOKEN" > /opt/spire/data/bootstrap_token
chmod 600 /opt/spire/data/bootstrap_token
echo "[SPIRE Server] Auto-bootstrap token ready."
fi
fi
fi
sleep 5
done
echo "[SPIRE Server] Agent enrollment verified. Cleaning up bootstrap tokens."
rm -f /opt/spire/data/bootstrap_token
) &
wait "$SERVER_PID"