Deploying the SPIRE Server

Deploy the SPIRE Server by configuring the SpireServer custom resource (CR). This establishes a central authority that manages and issues identities to the workloads in your cluster.

Prerequisites

  • You have access to the cluster as a user with the cluster-admin role.

  • You have installed Zero Trust Workload Identity Manager in the cluster.

Procedure

  1. Create the SpireServer CR:

    1. Create a YAML file that defines the SpireServer CR, for example, SpireServer.yaml:

      The following is an example of a SpireServer.yaml file.

      apiVersion: operator.openshift.io/v1alpha1
kind: SpireServer
metadata:
 name: cluster
spec:
  logLevel: "info"
  logFormat: "text"
  jwtIssuer: "https://oidc-discovery.apps.cluster.example.com"
  caValidity: "24h"
  defaultX509Validity: "1h"
  defaultJWTValidity: "5m"
  jwtKeyType: "rsa-2048"
  caSubject:
    country: "US"
    organization: "Example Corporation"
    commonName: "SPIRE Server CA"
  persistence:
    size: "5Gi"
    accessMode: "ReadWriteOnce"
    storageClass: "gp3-csi"
  datastore:
    databaseType: "sqlite3"
    connectionString: "/run/spire/data/datastore.sqlite3"
    tlsSecretName: ""
    maxOpenConns: 100
    maxIdleConns: 10
    connMaxLifetime: 0
    disableMigration: "false"

      where:

      metadata.name

      Specifies that the value must be cluster.

      spec.logLevel

      Specifies the logging level for the SPIRE Server. The valid options are debug, info, warn, and error.

      spec.logFormat

      Specifies the logging format for the SPIRE Server. The valid options are text and json.

      spec.jwtIssuer

      Specifies the JWT issuer URL. Must be a valid HTTPS or HTTP URL with a maximum length of 512 characters.

      spec.caValidity

      Specifies the validity period (Time to Live (TTL)) for the SPIRE Server’s CA certificate. This determines how long the server’s root or intermediate certificate is valid. The format is a duration string (for example, 24h, 168h).

      spec.defaultX509Validity

      Specifies the default validity period (TTL) for X.509 SVIDs issued to workloads. This value is used if a specific TTL is not configured for a registration entry.

      spec.defaultJWTValidity

      Specifies thedefault validity period (TTL) for JWT SVIDs issued to workloads. This value is used if a specific TTL is not configured for a registration entry.

      spec.jwtKeyType

      Specifies the key type used for JWT signing. The valid options are rsa-2048, rsa-4096, ec-p256, and ec-p384. This field is optional.

      spec.caSubject.country

      Specifies the country for the SPIRE Server certificate authority (CA). Must be an ISO 3166-1 alpha-2 country code (2 characters).

      spec.caSubject.organization

      Specifies the organization for the SPIRE Server CA. Maximum length is 64 characters.

      spec.caSubject.commonName

      Specifies the common name for the SPIRE Server CA. Maximum length is 255 characters.

      spec.persistence.size

      Specifies the size of the persistent volume (for example, 1Gi, 5Gi). Once set, this field is immutable.

      spec.persistence.accessMode

      Specifies the access mode for the persistent volume. The valid options are ReadWriteOnce, ReadWriteOncePod, and ReadWriteMany. Once set, this field is immutable.

      spec.persistence.storageClass

      Specifies the storage class to be used for the PVC. Once set, this field is immutable.

      spec.datastore.databaseType

      Specifies the type of database to use for the datastore. The valid options are sql, sqlite3, postgres, mysql, aws_postgresql, and aws_mysql.

      spec.datastore.connectionString

      Specifies the connection string for the database. For PostgreSQL with SSL, include sslmode and certificate paths (for example, dbname=spire user=spire host=postgres.example.com sslmode=verify-full).

      spec.datastore.tlsSecretName

      Specifies the name of a Kubernetes Secret containing TLS certificates for database connections. The Secret will be mounted at /run/spire/db/certs. This field is optional.

      spec.datastore.maxOpenConns

      Specifies the maximum number of open database connections. Must be between 1 and 10000.

      spec.datastore.maxIdleConns

      Specifies the maximum number of idle database connections in the pool. Must be between 0 and 10000.

      spec.datastore.connMaxLifetime

      Specifies the maximum lifetime of a database connection in seconds. A value of 0 means connections are not closed due to age.

      spec.datastore.disableMigration

      Specifies whether to disable automatic database migration. The valid options are true and false.

    2. Apply the configuration by running the following command:

      $ oc apply -f SpireServer.yaml
Verification

  • Verify that the stateful set of SPIRE Server is ready and available by running the following command:

    $ oc get statefulset -l app.kubernetes.io/name=spire-server -n zero-trust-workload-identity-manager
    Example output
    NAME            READY   AGE
spire-server    1/1     65s

  • Verify that the status of the SPIRE Server pod is Running by running the following command:

    $ oc get po -l app.kubernetes.io/name=spire-server -n zero-trust-workload-identity-manager
    Example output
    NAME               READY   STATUS    RESTARTS        AGE
spire-server-0     2/2     Running   1 (108s ago)    111s

  • Verify that the persistent volume claim (PVC) is bound, by running the following command:

    $ oc get pvc -l app.kubernetes.io/name=spire-server -n zero-trust-workload-identity-manager
    Example output
    NAME                        STATUS    VOLUME                                     CAPACITY   ACCESS MODES  STORAGECLASS  VOLUMEATTRIBUTECLASS  AGE
spire-data-spire-server-0   Bound     pvc-27a36535-18a1-4fde-ab6d-e7ee7d3c2744   5Gi        RW0           gp3-csi       <unset>               22m

← Previous: About the ZeroTrustWorkloadIdentityManager custom resource | ↑ Up: SPIFFE | ⌂ Home: Red Hat OpenShift Container Platform | Next: Deploying the SPIRE Agent →