search

spiffe / spiffe-helper

The SPIFFE Helper is a tool that can be used to retrieve and manage SVIDs on behalf of a workload
Apache License 2.0
40 stars 39 forks source link

suggestion: systemd integration #156

Open udf2457 opened 2 months ago

udf2457 commented 2 months ago

It would be nice if the tool had integration with systemd to enable launch / reload via systemd.

Its saves sysadmins from "reinventing the wheel" and un-necessary DIY maintenance dependencies.

Also pretty much all third-party packages will install a systemd service. So that's more sysadmin work to remove the systemd service.

For example, PostgreSQL, install via official package. It installs a systemd service. All configuration (e.g. where to find SSL certs) is done in /etc/postgresql, so sysadmins don't need to touch the maintainer's systemd service. It would be good to point the /etc config at the spiffe certs location and spiffe-helper calls systemd.

kfox1111 commented 2 months ago

There's a start of some here: https://github.com/spiffe/spire-examples/pull/64

Would be pretty easy to add spiffe-helper there too.

udf2457 commented 2 months ago

Thanks for the pointer, will take a look.

I haven't reviewed it or tried it, but I do know from recently looking through their docs that smallstep use systemd service and timer templates: https://smallstep.com/docs/step-ca/renewal/#automated-renewal ... cert-renewer@.service cert-renewer@.timer and then e.g. creating cert-renewer@postgresql.service and cert-renewer@postgresql.timer

Whether that's simpler or more convoluted than your proposal I don't know... 😉