Deploy Cofide SPIRE (single cluster)

This guide walks through creating the Connect API resources for a trust zone and deploying the Cofide SPIRE server that will issue identities to workloads in it.

Prerequisites

A Cofide Connect account.
A Kubernetes cluster to host the Cofide SPIRE server (this can be bare-metal, VM or a cloud provider such as EKS or GKE).
Decide on the authentication option.
The Cofide Helm charts repository added (helm repo add cofide https://charts.cofide.dev).
cofidectl installed (see Install and configure CLI).

Create the trust zone

Create the trust zone Connect API resource.

With cofidectl:

cofidectl trust-zone add \
  <your-trust-zone-name> \
  --trust-domain <your-trust-domain>

For additional configuration options, see cofidectl trust-zone add -h.

With Terraform:

resource "cofide_connect_trust_zone" "example" {
  name         = "<your-trust-zone-name>"
  trust_domain = "<your-trust-domain>"
}

Create API Resources

With the trust zone created above, create a Cluster resource for the Kubernetes cluster that will host the Cofide SPIRE server:

cofidectl cluster add \
  <your-cluster-name> \
  --trust-zone <your-trust-zone-name> \
  --kubernetes-context <context-of-k8s-cluster> \
  --kubernetes-oidc-issuer https://<cluster-oidc-issuer-url>

The above command uses Kubernetes OIDC functionality to allow the trust zone’s Cofide SPIRE server to authenticate with Connect. Alternative authentication methods are also available.

For additional configuration options, see cofidectl cluster add -h.

Deploy Cofide SPIRE server

Having created the trust zone and cluster(s) entries for your workload identity infrastructure, the next step is to deploy the Cofide SPIRE server to a Kubernetes cluster in each trust zone using the Cofide SPIRE Helm charts and Cofide Helm charts. For convenience, cofidectl provides commands to help populate the Helm values for these charts based on the configuration in Connect.

Use cofidectl to generate values for the Cofide SPIRE Helm charts:

cofidectl trust-zone helm values \
  <your-trust-zone-name> \
  --output-file spire-values.yaml

Inspect the generated values and make any changes or additions as required, then install Cofide SPIRE on your Connect-registered cluster:

helm repo add cofide https://charts.cofide.dev --force-update
helm install spire cofide/spire \
  --version 0.28.3-cofide.0 \
  --kube-context <context> \
  --namespace spire-mgmt \
  --create-namespace \
  --values spire-values.yaml \
  --wait

Once complete, the Cofide SPIRE server is ready to start issuing SPIFFE identities to your workloads in the trust zone.

Your next step will be workloads overview.

Additional SPIRE Configuration

If you intend to deploy Credex to this trust zone, add the following Helm values to enable the required Credex integrations:

# Authorize Credex for JWT signer use
# (only required when Credex's OAuth AS subsystem is enabled)
spire-server:
  experimental:
    enabled: true
    customJwtSigner:
      allowedIDs:
        - spiffe://<trust-domain>/cluster/<cluster-name>/ns/cofide/sa/cofide-credex
# Authorize Credex for admin API use
# (only required when Credex's SPIFFE exchange subsystem is enabled)
spire-agent:
  sockets:
    admin:
      enabled: true
      mountOnHost: true
  authorizedDelegates:
    - spiffe://<trust-domain>/cluster/<cluster-name>/ns/cofide/sa/cofide-credex