4360d67064
This implements custom Alpine-based Smart SPIRE Server and Agent Docker images with self-seeding configuration entrypoints. It also updates the docker-compose configuration to utilize a single host storage volume and a dedicated named socket volume. Setup build pipelines are expanded to compile and push these custom SPIRE images. Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
60 lines
2.3 KiB
Plaintext
60 lines
2.3 KiB
Plaintext
# ==============================================================================
|
|
# SPIRE Server Configuration
|
|
# Auth-Yes Identity & Access Management Fabric
|
|
# ==============================================================================
|
|
# This configuration defines the root SPIFFE trust authority for your cluster.
|
|
# You can customize trust domains, certificate TTLs, and datastore plugins below.
|
|
# ==============================================================================
|
|
|
|
server {
|
|
# Network binding: 0.0.0.0 listens on all internal mesh interfaces.
|
|
bind_address = "0.0.0.0"
|
|
bind_port = "8081"
|
|
|
|
# Trust Domain: Identifies the root cryptographic security domain.
|
|
# SPIFFE IDs will be generated in the format: spiffe://<trust_domain>/<workload>
|
|
trust_domain = "system.local"
|
|
|
|
# Directory where SPIRE server persists runtime data, datastore, and keys.
|
|
data_dir = "/opt/spire/data/server"
|
|
|
|
# Logging verbosity: DEBUG, INFO, WARN, ERROR
|
|
log_level = "INFO"
|
|
|
|
# Certificate Authority (CA) Time-to-Live (default: 30 days)
|
|
ca_ttl = "720h"
|
|
|
|
# Default Workload SVID Time-to-Live (default: 1 hour for high-security rotation)
|
|
default_x509_svid_ttl = "1h"
|
|
}
|
|
|
|
plugins {
|
|
# ----------------------------------------------------------------------------
|
|
# DataStore Plugin: Persists SPIFFE registrations, entries, and nodes.
|
|
# Default: Embedded SQLite3 datastore inside /opt/spire/data/server.
|
|
# ----------------------------------------------------------------------------
|
|
DataStore "sql" {
|
|
plugin_data {
|
|
database_type = "sqlite3"
|
|
connection_string = "/opt/spire/data/server/datastore.sqlite3"
|
|
}
|
|
}
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# NodeAttestor Plugin: Verifies identity of SPIRE agents joining the cluster.
|
|
# 'join_token' allows dynamic 1-time token enrollment for agents.
|
|
# ----------------------------------------------------------------------------
|
|
NodeAttestor "join_token" {
|
|
plugin_data {}
|
|
}
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# KeyManager Plugin: Securely stores the server CA private keys on disk.
|
|
# ----------------------------------------------------------------------------
|
|
KeyManager "disk" {
|
|
plugin_data {
|
|
keys_path = "/opt/spire/data/server/keys.json"
|
|
}
|
|
}
|
|
}
|