nsm-spire image about deployments-k8s HOT 10 CLOSED

@edwarnicke It seems that the k8s-workload-registrar image provided by Spire works for us, so there is no need for the former nsm-spire functionality at the moment.
Thanks for the support, I think we can close this issue.

from deployments-k8s.

Currently, we do not plan to add automatization for spire registration. I feel this may be scheduled in the future.

@edwarnicke , @fkautz Could you share thoughts about this?

from deployments-k8s.

@rpiceage Could you provide more specific detail around your needs in this regard. It may make more sense for us to contribute upstream to spire.

from deployments-k8s.

@edwarnicke The aim is to be able to ship the config together with the other stuff, so we want to avoid additional config steps through the spire server CLI after deployment. The nsm-spire sidecar is exactly doing this together with the config file called registration.json which contains the necessary entries for spire.
In fact yesterday I managed to reuse that old image, so it works now temporarily for us. So my question is whether there will be some equivalent in your newer repos, or will it be maintained so that we can use it long term?

from deployments-k8s.

@rpiceage Got it. So it sounds like something that would let you ship a CRD for config (ie, just another part of the yaml) would meet your needs. Its more a declarative vs imperative thing than anything.

I've kicked off a conversation on the spire slack here. Would be good to get more voices there :)

from deployments-k8s.

@rpiceage Question: if the existing spire-server containers could have identities updated via ConfigMaps updating config files for that container... would it get you where you need to go?

from deployments-k8s.

@edwarnicke As I understand, the config file for the spire server could not contain the entries needed to be injected as our configuration.
On the other hand the CRD solution would be OK. Also I will have a go at the spire k8s-workload-registrar, maybe it can solve the problem.

from deployments-k8s.

@rpiceage Excellent news!

from deployments-k8s.

it sounds like we can simplify a bit our examples if we'll use k8s-workload-registrar. @edwarnicke Do we need to update our examples and use k8s-workload-registrar?

from deployments-k8s.

@denis-tingaikin Lets look into it :)

from deployments-k8s.