Additional Components

This page describes how to deploy additional per-trust-zone components of the Cofide Connect platform, beyond the base Cofide SPIRE deployment.

Note

In order to deploy the components listed on this page, you must be granted access to the Cofide container image repository. Please contact the Cofide team to arrange access.

Before proceeding, add the Cofide Helm charts repository.

helm repo add cofide https://charts.cofide.dev

Cofide Observer

The Cofide Observer is an optional component of the Connect platform. It is required when using Kubernetes attestation policies.

Install the observer with

helm install \
  cofide-observer cofide/cofide-observer \
  --version 0.4.0 \
  --kube-context <context> \
  --namespace cofide \
  --create-namespace \
  --set "observer.connectMTLSGRPCTarget=<your-connect-api-address>" \
  --set "observer.connectSPIFFEID=spiffe://example.org/ns/connect/sa/cofide-connect-api" \
  --wait

The connectMTLSGRPCTarget and connectSPIFFEID parameters can be found in your local cofide.yaml file, generated by cofidectl init.

Cofide Agent

The Cofide Agent is an optional component of the Connect platform which programs the downstream network path (via xDS, or for meshes such as Istio) for seamless cross-boundary mTLS.

Use cofidectl to generate values for the Cofide Agent Helm chart:

./cofidectl connect agent helm values \
  --trust-zone <trust zone> \
  --cluster <cluster> \
  --output-file cofide-agent-values.yaml

Install Cofide Agent:

helm install \
  cofide-agent cofide/cofide-agent \
  --version 0.5.4 \
  --kube-context <context> \
  --namespace cofide \
  --create-namespace \
  --values cofide-agent-values.yaml \
  --wait

When using Cofide SPIRE, a join token is not required for Cofide Agent.

If using OSS SPIRE, a join token is required to establish federation between a workload trust zone and Connect. In this case, pass --generate-token=true when generating values to include a short-lived join token directly in the values file. Alternatively, generate one separately:

./cofidectl connect agent join-token generate \
  --trust-zone <trust zone> \
  --cluster <cluster> \
  --output-file agent-token

The token can then be injected as a Helm value using --set agent.env.AGENT_TOKEN=<token>.

Cofide Credex

Credex is an OAuth Authorization Server and Security Token Service that lets workloads exchange credentials across identity protocols without static secrets or custom glue code. It supports a variety of use cases, such as policy-backed delegated authority for AI agents and identity bridging between OAuth and SPIFFE systems to enable integrations between OAuth-native applications and SPIFFE-native workloads.

For more information and deployment documentation, see the dedicated Credex pages.