domains can not include URIs fixes #424

use a real URI for the production example as a test case for this Signed-off-by: Drew Wells <dwells@infoblox.com>
spiffe · Aug 5, 2023 · 80549f2 · 80549f2
1 parent 1e3039c
commit 80549f2
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml
@@ -2,14 +2,17 @@
 {{- define "spiffe-oidc-discovery-provider.yaml-config" -}}
 {{- $oidcSocket := .oidcSocket }}
 {{- with .root }}
+{{- $uri := urlParse (include "spire-lib.jwt-issuer" .) }}
 log_level: {{ .Values.config.logLevel | quote }}
 
 domains:
   - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}"
   - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}"
   - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}"
-  {{- $jwtIssuer := include "spire-lib.jwt-issuer" . }}
-  {{- uniq (concat (list $jwtIssuer) .Values.config.additionalDomains) | toYaml | nindent 2 }}
+  - "{{- default $uri.path $uri.host }}"
+  {{- with .Values.config.additionalDomains }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
 
 {{- if .Values.insecureScheme.enabled }}
 allow_insecure_scheme: {{ .Values.insecureScheme.enabled }}

diff --git a/examples/production/values.yaml b/examples/production/values.yaml
@@ -2,6 +2,7 @@ global:
   telemetry:
     prometheus:
       enabled: true
+  jwtIssuer: https://oidc-discovery.example.org
 
 spire-server:
   nodeAttestor: