Skip to content

feat(auth): add SPIFFE supervisor authentication #1414

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
TaylorMutch wants to merge 1 commit into
base: tmutch/per-supervisor-authn
Choose a base branch
from
Draft

feat(auth): add SPIFFE supervisor authentication #1414

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions .agents/skills/debug-openshell-cluster/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,22 @@ If the gateway exits with `failed to read sandbox JWT signing key from
`sandbox-jwt` secret at `/etc/openshell-jwt`. The sandbox JWT mount is required
even when local Helm values disable TLS.

If `server.spiffe.enabled=true`, the sandbox JWT ConfigMap block and
`sandbox-jwt` StatefulSet mount are intentionally omitted. Instead verify that
SPIRE is installed, the CSI driver is available, and the gateway pod mounts the
SPIFFE Workload API socket:

```bash
helm -n openshell get values openshell | grep -E 'spiffe|trustDomain|workloadApiSocketPath'
kubectl get pods -A | grep -E 'spire|spiffe'
kubectl -n openshell get statefulset openshell -o yaml | grep -E 'spiffe-workload-api|csi.spiffe.io'
```

Sandbox pods in SPIFFE mode should have `openshell.io/sandbox-id` and
`openshell.io/spiffe-id` annotations, an `openshell.ai/managed-by=openshell`
label, and supervisor env vars `OPENSHELL_SPIFFE_WORKLOAD_API_SOCKET`,
`OPENSHELL_SPIFFE_AUDIENCE`, and `OPENSHELL_SPIFFE_ID`.

Check the image references currently used by the gateway deployment:

```bash
Expand Down
17 changes: 17 additions & 0 deletions .agents/skills/helm-dev-environment/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,21 @@ To remove Keycloak:
mise run keycloak:k8s:teardown
```

### SPIRE / SPIFFE Sandbox Identity

Skaffold can install SPIRE with the SPIFFE hardened Helm charts. To activate
SPIFFE JWT-SVID supervisor authentication:

1. Uncomment the `spire-crds` and `spire` releases in `deploy/helm/openshell/skaffold.yaml`
2. Uncomment `#- ci/values-spire.yaml` in the OpenShell release values files
3. Redeploy: `mise run helm:skaffold:run`

`ci/values-spire-stack.yaml` configures the local SPIRE trust domain as
`openshell.local` and adds a `ClusterSPIFFEID` that maps sandbox pod
annotations to `spiffe://openshell.local/openshell/sandbox/<sandbox-id>`.
OpenShell mounts the SPIFFE CSI Workload API socket at
`/spiffe-workload-api/spire-agent.sock`.

---

## Cluster Lifecycle (suspend/resume)
Expand Down Expand Up @@ -196,6 +211,8 @@ mise run helm:k3s:status
| `deploy/helm/openshell/ci/values-cert-manager.yaml` | cert-manager PKI overlay (opt-in; disables pkiInitJob) |
| `deploy/helm/openshell/ci/values-gateway.yaml` | Envoy Gateway GRPCRoute + Gateway overlay |
| `deploy/helm/openshell/ci/values-keycloak.yaml` | Keycloak OIDC overlay |
| `deploy/helm/openshell/ci/values-spire.yaml` | SPIFFE/SPIRE sandbox supervisor auth overlay |
| `deploy/helm/openshell/ci/values-spire-stack.yaml` | SPIRE hardened chart values for local dev |
| `deploy/helm/openshell/ci/values-tls-disabled.yaml` | Lint-only: TLS + auth disabled (reverse-proxy edge termination) |
| `deploy/kube/manifests/envoy-gateway-openshell.yaml` | GatewayClass for Envoy Gateway (`mise run helm:gateway:apply`) |
| `tasks/scripts/helm-k3s-local.sh` | k3d cluster create/delete/start/stop/status |
Expand Down
1 change: 1 addition & 0 deletions .markdownlint-cli2.jsonc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@
".claude/**",
".opencode/**",
".github/**",
"architecture/plans/**",
"**/node_modules/**",
"target/**",
".pytest_cache/**",
Expand Down
Loading
Loading