mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-15 05:09:44 +08:00
Taylor Mutch
702cbc4f63
* feat(providers): support SPIFFE-backed token grants Add provider profile token_grant metadata and expand endpoint-specific dynamic credentials so sandbox supervisors can request SPIFFE JWT-SVIDs, exchange them with an OAuth-style token endpoint, cache returned access tokens, and inject bearer tokens into matching HTTP requests. Wire Kubernetes and Helm deployments to mount the provider SPIFFE Workload API socket into sandbox pods for token grant exchange. Signed-off-by: Taylor Mutch <taylormutch@gmail.com> Signed-off-by: Gordon Sim <gsim@redhat.com> * test(examples): add SPIFFE token grant demo Add a reusable alpha/beta demo that deploys a SPIFFE-verifying token issuer and protected services, imports a token-grant provider profile, creates a sandbox, and verifies endpoint-specific bearer tokens. The script leaves Kubernetes workloads in place, deletes sandboxes through openshell unless KEEP_SANDBOX=1, and prints protected service logs as proof of life. Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(providers): harden SPIFFE token grants * fix(providers): harden dynamic token grants Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(providers): harden token grant handling --------- Signed-off-by: Taylor Mutch <taylormutch@gmail.com> Signed-off-by: Gordon Sim <gsim@redhat.com>
25 lines
866 B
YAML
25 lines
866 B
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# SPIRE hardened chart values for the local Helm dev environment.
|
|
global:
|
|
spire:
|
|
clusterName: openshell-dev
|
|
jwtIssuer: https://spire-spiffe-oidc-discovery-provider.spire.svc.cluster.local
|
|
trustDomain: openshell.local
|
|
|
|
spire-server:
|
|
defaultJwtSvidTTL: 5m
|
|
controllerManager:
|
|
identities:
|
|
clusterSPIFFEIDs:
|
|
openshell-sandboxes:
|
|
enabled: true
|
|
spiffeIDTemplate: 'spiffe://{{ .TrustDomain }}/openshell/sandbox/{{ index .PodMeta.Annotations "openshell.io/sandbox-id" }}'
|
|
namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: openshell
|
|
podSelector:
|
|
matchLabels:
|
|
openshell.ai/managed-by: openshell
|