tylerg/auth-yes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(spire): maintain bootstrap token continuously until agent enrollment completes

Browse Source
This commit is contained in:
Tyler Gillispie 2026-08-23 11:29:15 -07:00
parent 1151431e5f
commit 37f86f2ba7
2 changed files with 19 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
spire/entrypoint.agent.sh
View File

@ -18,7 +18,7 @@ fi
# Check if this agent is enrolling for the first time # Check if this agent is enrolling for the first time
if [ ! -f /opt/spire/data/agent/svid.key ] && [ ! -f /opt/spire/data/agent/agent_svids.json ]; then if [ ! -f /opt/spire/data/agent/svid.key ] && [ ! -f /opt/spire/data/agent/agent_svids.json ]; then
echo "[SPIRE Agent] Initial enrollment detected. Waiting for bootstrap join token..." echo "[SPIRE Agent] Initial enrollment detected. Waiting for bootstrap join token..."
for i in $(seq 1 30); do for i in $(seq 1 60); do
if [ -f /opt/spire/data/bootstrap_token ]; then if [ -f /opt/spire/data/bootstrap_token ]; then
break break
fi fi
@ -28,10 +28,9 @@ if [ ! -f /opt/spire/data/agent/svid.key ] && [ ! -f /opt/spire/data/agent/agent
if [ -f /opt/spire/data/bootstrap_token ]; then if [ -f /opt/spire/data/bootstrap_token ]; then
JOIN_TOKEN=$(cat /opt/spire/data/bootstrap_token | tr -d ' \r\n') JOIN_TOKEN=$(cat /opt/spire/data/bootstrap_token | tr -d ' \r\n')
echo "[SPIRE Agent] Joining SPIRE cluster with token..." echo "[SPIRE Agent] Joining SPIRE cluster with token..."
rm -f /opt/spire/data/bootstrap_token
exec /usr/local/bin/spire-agent "$@" -joinToken "$JOIN_TOKEN" exec /usr/local/bin/spire-agent "$@" -joinToken "$JOIN_TOKEN"
else else
echo "[SPIRE Agent] Warning: No bootstrap_token found after 30s. Attempting standard startup..." echo "[SPIRE Agent] Warning: No bootstrap_token found after 60s. Attempting standard startup..."
fi fi
fi fi

17
spire/entrypoint.server.sh
View File

@ -13,19 +13,17 @@ fi
/usr/local/bin/spire-server "$@" & /usr/local/bin/spire-server "$@" &
SERVER_PID=$! SERVER_PID=$!
# Helper: Auto-generate bootstrap join token for local agent on initial enrollment # Helper: Maintain auto-bootstrap join token until local agent has successfully enrolled
( (
SOCKET="/opt/spire/data/server/api.sock" SOCKET="/opt/spire/data/server/api.sock"
for i in $(seq 1 30); do while [ ! -S "$SOCKET" ]; do
if [ -S "$SOCKET" ]; then
break
fi
sleep 1 sleep 1
done done
if [ -S "$SOCKET" ] && [ ! -f /opt/spire/data/agent/svid.key ]; then while [ ! -f /opt/spire/data/agent/svid.key ] && [ ! -f /opt/spire/data/agent/agent_svids.json ]; do
if [ ! -f /opt/spire/data/bootstrap_token ]; then
echo "[SPIRE Server] Generating auto-bootstrap join token for local agent..." echo "[SPIRE Server] Generating auto-bootstrap join token for local agent..."
TOKEN_OUTPUT=$(/usr/local/bin/spire-server token generate -spiffeID spiffe://system.local/agent -socketPath "$SOCKET" 2>/dev/null || true) TOKEN_OUTPUT=$(/usr/local/bin/spire-server token generate -spiffeID spiffe://system.local/agent -socketPath "$SOCKET" -ttl 3600 2>/dev/null || true)
TOKEN=$(echo "$TOKEN_OUTPUT" | grep -i "token:" | awk '{print $2}') TOKEN=$(echo "$TOKEN_OUTPUT" | grep -i "token:" | awk '{print $2}')
if [ -n "$TOKEN" ]; then if [ -n "$TOKEN" ]; then
echo "$TOKEN" > /opt/spire/data/bootstrap_token echo "$TOKEN" > /opt/spire/data/bootstrap_token
@ -33,6 +31,11 @@ SERVER_PID=$!
echo "[SPIRE Server] Auto-bootstrap token ready." echo "[SPIRE Server] Auto-bootstrap token ready."
fi fi
fi fi
sleep 5
done
echo "[SPIRE Server] Agent enrollment verified. Cleaning up bootstrap tokens."
rm -f /opt/spire/data/bootstrap_token
) & ) &
wait "$SERVER_PID" wait "$SERVER_PID"