nsm-spire image

[rpiceage]

In NSM old gen there was an nsm-spire sidecar image for handling spire configuration. Is there any plan to create it for the next gen also? Or is there some recommended way how to handle spire workload registration based on config files, without entry create commands?

[denis-tingaikin]

Currently, we do not plan to add automatization for spire registration. I feel this may be scheduled in the future.

@edwarnicke , @fkautz Could you share thoughts about this?

[edwarnicke]

@rpiceage Could you provide more specific detail around your needs in this regard. It may make more sense for us to contribute upstream to spire.

[rpiceage]

@edwarnicke The aim is to be able to ship the config together with the other stuff, so we want to avoid additional config steps through the spire server CLI after deployment. The nsm-spire sidecar is exactly doing this together with the config file called registration.json which contains the necessary entries for spire.
In fact yesterday I managed to reuse that old image, so it works now temporarily for us. So my question is whether there will be some equivalent in your newer repos, or will it be maintained so that we can use it long term?

[edwarnicke]

@rpiceage Got it. So it sounds like something that would let you ship a CRD for config (ie, just another part of the yaml) would meet your needs. Its more a declarative vs imperative thing than anything.

I've kicked off a conversation on the spire slack here. Would be good to get more voices there :)

[edwarnicke]

@rpiceage Question: if the existing spire-server containers could have identities updated via ConfigMaps updating config files for that container... would it get you where you need to go?

[rpiceage]

@edwarnicke As I understand, the config file for the spire server could not contain the entries needed to be injected as our configuration.
On the other hand the CRD solution would be OK. Also I will have a go at the spire k8s-workload-registrar, maybe it can solve the problem.

[rpiceage]

@edwarnicke It seems that the k8s-workload-registrar image provided by Spire works for us, so there is no need for the former nsm-spire functionality at the moment.
Thanks for the support, I think we can close this issue.

[edwarnicke]

@rpiceage Excellent news!

[denis-tingaikin]

it sounds like we can simplify a bit our examples if we'll use k8s-workload-registrar. @edwarnicke Do we need to update our examples and use k8s-workload-registrar?

[edwarnicke]

@denis-tingaikin Lets look into it :)