feat(spire): add insecure_bootstrap and automatic join token generation for zero-friction agent enrollment

spire/entrypoint.agent.sh

@@ -1,5 +1,4 @@
 #!/bin/sh
-
 set -e
 
 # Mitigation for Risk 2: Stale UNIX Socket on Unclean Shutdown
@@ -8,10 +7,32 @@ rm -f /var/run/spire/agent.sock
 mkdir -p /opt/spire/data/agent
 mkdir -p /var/run/spire
 
-if [ ! -f /opt/spire/agent.conf ]; then
+CONF_FILE="/opt/spire/agent.conf"
+
+if [ ! -f "$CONF_FILE" ]; then
   echo "Writing default SPIRE agent.conf..."
-  cp /etc/spire/templates/agent.conf /opt/spire/agent.conf
+  cp /etc/spire/templates/agent.conf "$CONF_FILE"
-  chmod 644 /opt/spire/agent.conf
+  chmod 644 "$CONF_FILE"
+fi
+
+# Check if this agent is enrolling for the first time
+if [ ! -f /opt/spire/data/agent/svid.key ] && [ ! -f /opt/spire/data/agent/agent_svids.json ]; then
+  echo "[SPIRE Agent] Initial enrollment detected. Waiting for bootstrap join token..."
+  for i in $(seq 1 30); do
+    if [ -f /opt/spire/data/bootstrap_token ]; then
+      break
+    fi
+    sleep 1
+  done
+
+  if [ -f /opt/spire/data/bootstrap_token ]; then
+    JOIN_TOKEN=$(cat /opt/spire/data/bootstrap_token | tr -d ' \r\n')
+    echo "[SPIRE Agent] Joining SPIRE cluster with token..."
+    rm -f /opt/spire/data/bootstrap_token
+    exec /usr/local/bin/spire-agent "$@" -join_token "$JOIN_TOKEN"
+  else
+    echo "[SPIRE Agent] Warning: No bootstrap_token found after 30s. Attempting standard startup..."
+  fi
 fi
 
 exec /usr/local/bin/spire-agent "$@"

spire/entrypoint.server.sh

@@ -1,5 +1,4 @@
 #!/bin/sh
-
 set -e
 
 mkdir -p /opt/spire/data/server
@@ -10,4 +9,30 @@ if [ ! -f /opt/spire/server.conf ]; then
   chmod 644 /opt/spire/server.conf
 fi
 
-exec /usr/local/bin/spire-server "$@"
+# Launch SPIRE Server in background to allow auto-bootstrap token generation
+/usr/local/bin/spire-server "$@" &
+SERVER_PID=$!
+
+# Helper: Auto-generate bootstrap join token for local agent on initial enrollment
+(
+  SOCKET="/opt/spire/data/server/api.sock"
+  for i in $(seq 1 30); do
+    if [ -S "$SOCKET" ]; then
+      break
+    fi
+    sleep 1
+  done
+
+  if [ -S "$SOCKET" ] && [ ! -f /opt/spire/data/agent/svid.key ]; then
+    echo "[SPIRE Server] Generating auto-bootstrap join token for local agent..."
+    TOKEN_OUTPUT=$(/usr/local/bin/spire-server token generate -spiffeID spiffe://system.local/agent -socketPath "$SOCKET" 2>/dev/null || true)
+    TOKEN=$(echo "$TOKEN_OUTPUT" | grep -i "token:" | awk '{print $2}')
+    if [ -n "$TOKEN" ]; then
+      echo "$TOKEN" > /opt/spire/data/bootstrap_token
+      chmod 600 /opt/spire/data/bootstrap_token
+      echo "[SPIRE Server] Auto-bootstrap token ready."
+    fi
+  fi
+) &
+
+wait "$SERVER_PID"

spire/templates/agent.conf

@@ -22,6 +22,9 @@ agent {
 
   # Must match the SPIRE Server's trust_domain.
   trust_domain = "system.local"
+
+  # Automatically fetch trust bundle from server on first bootstrap
+  insecure_bootstrap = true
 }
 
 plugins {

spire/templates/server.conf

@@ -18,6 +18,9 @@ server {
   # Directory where SPIRE server persists runtime data, datastore, and keys.
   data_dir = "/opt/spire/data/server"
 
+  # Path to bind the SPIRE Server API admin socket
+  socket_path = "/opt/spire/data/server/api.sock"
+
   # Logging verbosity: DEBUG, INFO, WARN, ERROR
   log_level = "INFO"