spiffe / spiffe-helper

The SPIFFE Helper is a tool that can be used to retrieve and manage SVIDs on behalf of a workload
Apache License 2.0
43 stars 40 forks source link

Allow multiple JWT tokens to be configured (closes #108) #109

Closed keeganwitt closed 7 months ago

faisal-memon commented 8 months ago

@keeganwitt Thanks for the submission. Couple questions:

keeganwitt commented 8 months ago
  • What does the hcl config look like with this change?

My intention was for it to look something like this (and maybe the way I've got it in my PR isn't quite right)

"jwt_svids": [
  {
    "jwt_audience": "some-audience",
    "jwt_svid_file_name": "some/path/some-audience.jwt"
  }
]
  • What do you think my suggestion of auto suffixing the audience to the file name?

This might be an acceptable approach. In our specific case, that would be acceptable. But my thinking was what if you required these JWTs to be in different Kubernetes volumes? There'd be no way to do this. So I thought it was better to choose an option that would offer more flexibility.

keeganwitt commented 8 months ago

I discovered #112 while working on this, which is probably a pre-requisite.

faisal-memon commented 8 months ago
  • What does the hcl config look like with this change?

My intention was for it to look something like this (and maybe the way I've got it in my PR isn't quite right)

"jwt_svids": [
  {
    "jwt_audience": "some-audience",
    "jwt_svid_file_name": "some/path/some-audience.jwt"
  }
]

Seems about right.

  • What do you think my suggestion of auto suffixing the audience to the file name?

This might be an acceptable approach. In our specific case, that would be acceptable. But my thinking was what if you required these JWTs to be in different Kubernetes volumes? There'd be no way to do this. So I thought it was better to choose an option that would offer more flexibility.

Good point.

faisal-memon commented 8 months ago

@keeganwitt changes are looking good. Can you update the readme?

keeganwitt commented 8 months ago

@keeganwitt changes are looking good. Can you update the readme?

Oops. Yes. Done.