This setup deploys SPIRE as follows:<\/p>\n
SPIRE provides machine and workload identity.<\/p>\n
The SPIRE Server on <SPIRE_SERVER_HOST> is the trust authority for the trust domain <TRUST_DOMAIN>.<\/p>\n
The SPIRE Agent on <SPIRE_AGENT_HOST> attests to the server using x509pop with an X.509 certificate issued by an enterprise\/internal CA.<\/p>\n
Applications on <SPIRE_AGENT_HOST> do not talk directly to the SPIRE Server. They talk to the local SPIRE Agent over the local workload API socket <AGENT_SOCKET_PATH>.<\/p>\n
The agent returns an X.509-SVID representing the workload identity.<\/p>\n
Run on both hosts:<\/p>\n
mkdir -p \/opt\/spire
\ncd \/tmp
\nwget https:\/\/github.com\/spiffe\/spire\/releases\/download\/v1.15.2\/spire-1.15.2-linux-amd64-musl.tar.gz
\ntar zxf spire-1.15.2-linux-amd64-musl.tar.gz
\ncp -r spire-1.15.2\/. \/opt\/spire\/<\/p>\n
On the SPIRE Server host:<\/p>\n
ln -sf \/opt\/spire\/bin\/spire-server \/usr\/bin\/spire-server<\/p>\n
On the SPIRE Agent host:<\/p>\n
ln -sf \/opt\/spire\/bin\/spire-agent \/usr\/bin\/spire-agent<\/p>\n
Create directories:<\/p>\n
mkdir -p \/opt\/spire\/conf
\nmkdir -p \/opt\/spire\/data\/server
\nmkdir -p \/opt\/spire\/conf\/x509pop<\/p>\n
Place the CA bundle at:<\/p>\n
\/opt\/spire\/conf\/x509pop\/bundle.pem<\/p>\n
Contents:<\/p>\n
—–BEGIN CERTIFICATE—–
\n<REDACTED CA CERTIFICATE>
\n—–END CERTIFICATE—–
\n—–BEGIN CERTIFICATE—–
\n<REDACTED CA CERTIFICATE>
\n—–END CERTIFICATE—–
\n—–BEGIN CERTIFICATE—–
\n<REDACTED CA CERTIFICATE>
\n—–END CERTIFICATE—–<\/p>\n
Create \/opt\/spire\/conf\/server.conf:<\/p>\n
server {
\nbind_address = “0.0.0.0”
\nbind_port = “<SERVER_PORT>”
\ntrust_domain = “<TRUST_DOMAIN>”
\ndata_dir = “\/opt\/spire\/data\/server”
\nlog_level = “INFO”
\n}<\/p>\n
plugins {
\nDataStore “sql” {
\nplugin_data {
\ndatabase_type = “sqlite3”
\nconnection_string = “\/opt\/spire\/data\/server\/datastore.sqlite3”
\n}
\n}<\/p>\n
NodeAttestor “x509pop” {
\nplugin_data {
\nca_bundle_path = “\/opt\/spire\/conf\/x509pop\/bundle.pem”
\n}
\n}<\/p>\n
KeyManager “memory” {
\nplugin_data {}
\n}
\n}<\/p>\n
health_checks {
\nlistener_enabled = true
\nbind_address = “127.0.0.1”
\nbind_port = “<HEALTH_PORT>”
\n}<\/p>\n
Create \/etc\/systemd\/system\/spire-server.service:<\/p>\n
[Unit]
\nDescription=SPIRE Server
\nAfter=network-online.target
\nWants=network-online.target<\/p>\n
[Service]
\nType=simple
\nExecStart=\/opt\/spire\/bin\/spire-server run -config \/opt\/spire\/conf\/server.conf
\nRestart=on-failure
\nRestartSec=5
\nLimitNOFILE=65536<\/p>\n
[Install]
\nWantedBy=multi-user.target<\/p>\n
Start server:<\/p>\n
systemctl daemon-reload
\nsystemctl enable –now spire-server
\nsystemctl status spire-server –no-pager<\/p>\n
Validate server:<\/p>\n
spire-server healthcheck<\/p>\n
Create directories:<\/p>\n
mkdir -p \/opt\/spire\/conf
\nmkdir -p \/opt\/spire\/data\/agent
\nmkdir -p \/opt\/spire\/sockets
\nmkdir -p \/opt\/spire\/conf\/x509pop<\/p>\n
Issue a certificate through your enterprise PKI platform. Download as OpenSSL format and split CRT\/KEY files. Copy the node certificate to:<\/p>\n
\/opt\/spire\/conf\/x509pop\/agent.crt<\/p>\n
Copy the node private key to:<\/p>\n
\/opt\/spire\/conf\/x509pop\/agent.key<\/p>\n
The private key must be unencrypted PEM.<\/p>\n
Set permissions:<\/p>\n
chmod 700 \/opt\/spire\/conf\/x509pop
\nchmod 600 \/opt\/spire\/conf\/x509pop\/agent.key
\nchmod 644 \/opt\/spire\/conf\/x509pop\/agent.crt<\/p>\n
Create \/opt\/spire\/conf\/agent.conf:<\/p>\n
agent {
\ndata_dir = “\/opt\/spire\/data\/agent”
\nlog_level = “INFO”
\ntrust_domain = “<TRUST_DOMAIN>”
\nserver_address = “<SPIRE_SERVER_HOST>”
\nserver_port = “<SERVER_PORT>”
\nsocket_path = “<AGENT_SOCKET_PATH>”
\ninsecure_bootstrap = true
\n}<\/p>\n
plugins {
\nKeyManager “disk” {
\nplugin_data {
\ndirectory = “\/opt\/spire\/data\/agent”
\n}
\n}<\/p>\n
WorkloadAttestor “unix” {
\nplugin_data {}
\n}<\/p>\n
NodeAttestor “x509pop” {
\nplugin_data {
\nprivate_key_path = “\/opt\/spire\/conf\/x509pop\/agent.key”
\ncertificate_path = “\/opt\/spire\/conf\/x509pop\/agent.crt”
\n}
\n}
\n}<\/p>\n
Create \/etc\/systemd\/system\/spire-agent.service:<\/p>\n
[Unit]
\nDescription=SPIRE Agent
\nAfter=network-online.target
\nWants=network-online.target<\/p>\n
[Service]
\nType=simple
\nExecStart=\/opt\/spire\/bin\/spire-agent run -config \/opt\/spire\/conf\/agent.conf
\nRestart=on-failure
\nRestartSec=5
\nLimitNOFILE=65536<\/p>\n
[Install]
\nWantedBy=multi-user.target<\/p>\n
Start agent:<\/p>\n
systemctl daemon-reload
\nsystemctl enable –now spire-agent
\nsystemctl status spire-agent –no-pager<\/p>\n
On the SPIRE Server host:<\/p>\n
spire-server agent list<\/p>\n
Expected result:<\/p>\n
spiffe:\/\/<TRUST_DOMAIN>\/spire\/agent\/x509pop\/<AGENT_HASH><\/p>\n
Use the current x509pop agent SPIFFE ID from spire-server agent list.<\/p>\n
On the SPIRE Server host:<\/p>\n
spire-server entry create \\
\n-spiffeID spiffe:\/\/<TRUST_DOMAIN>\/workload\/<WORKLOAD_NAME> \\
\n-parentID spiffe:\/\/<TRUST_DOMAIN>\/spire\/agent\/x509pop\/<AGENT_HASH> \\
\n-selector unix:uid:0<\/p>\n
This authorizes a root-owned process on the SPIRE Agent host.<\/p>\n
\/opt\/spire\/bin\/spire-agent api fetch x509 -socketPath <AGENT_SOCKET_PATH><\/p>\n
Expected SPIFFE ID:<\/p>\n
spiffe:\/\/<TRUST_DOMAIN>\/workload\/<WORKLOAD_NAME><\/p>\n
Create destination directory:<\/p>\n
mkdir -p \/etc\/spire\/svid\/test
\nchmod 700 \/etc\/spire\/svid\/test<\/p>\n
Write files:<\/p>\n
\/opt\/spire\/bin\/spire-agent api fetch x509 \\
\n-socketPath <AGENT_SOCKET_PATH> \\
\n-write \/etc\/spire\/svid\/test<\/p>\n
Inspect output:<\/p>\n
ls -l \/etc\/spire\/svid\/test<\/p>\n
openssl x509 -in \/etc\/spire\/svid\/test\/svid.0.pem -text -noout<\/p>\n
Reboot the SPIRE Agent host.<\/p>\n
After reboot, validate:<\/p>\n
systemctl status spire-agent –no-pager<\/p>\n
ls -l <AGENT_SOCKET_PATH><\/p>\n
\/opt\/spire\/bin\/spire-agent api fetch x509 -socketPath <AGENT_SOCKET_PATH><\/p>\n
Expected behavior:<\/p>\n
Create JWT registration on the SPIRE Server host:<\/p>\n
spire-server entry create \\
\n-spiffeID spiffe:\/\/<TRUST_DOMAIN>\/workload\/<JWT_WORKLOAD_NAME> \\
\n-parentID spiffe:\/\/<TRUST_DOMAIN>\/spire\/agent\/x509pop\/<AGENT_HASH> \\
\n-selector unix:uid:0<\/p>\n
Fetch JWT-SVID from the SPIRE Agent host:<\/p>\n
\/opt\/spire\/bin\/spire-agent api fetch jwt \\
\n-socketPath <AGENT_SOCKET_PATH> \\
\n-audience <JWT_AUDIENCE> \\
\n-spiffeID spiffe:\/\/<TRUST_DOMAIN>\/workload\/<JWT_WORKLOAD_NAME><\/p>\n
Example output:<\/p>\n
token(spiffe:\/\/<TRUST_DOMAIN>\/workload\/<JWT_WORKLOAD_NAME>):
\n<REDACTED JWT-SVID><\/p>\n
bundle(spiffe:\/\/<TRUST_DOMAIN>):
\n<REDACTED JWKS BUNDLE><\/p>\n
On the SPIRE Server host:<\/p>\n
mkdir -p \/opt\/spire-extras
\ncd \/tmp
\nwget https:\/\/github.com\/spiffe\/spire\/releases\/download\/v1.15.2\/spire-extras-1.15.2-linux-amd64-musl.tar.gz
\ntar zxf spire-extras-1.15.2-linux-amd64-musl.tar.gz
\ncp -r spire-extras-1.15.2\/ \/opt\/spire-extras\/<\/p>\n
ln -sf \/opt\/spire-extras\/bin\/oidc-discovery-provider \/usr\/bin\/oidc-discovery-provider
\nmkdir -p \/opt\/spire-extras\/conf\/oidc-discovery-provider<\/p>\n
Create certificate and key files:<\/p>\n
\/opt\/spire-extras\/conf\/oidc-discovery-provider\/tls.crt
\n\/opt\/spire-extras\/conf\/oidc-discovery-provider\/tls.key<\/p>\n
Set permissions:<\/p>\n
chmod 644 \/opt\/spire-extras\/conf\/oidc-discovery-provider\/tls.crt
\nchmod 600 \/opt\/spire-extras\/conf\/oidc-discovery-provider\/tls.key<\/p>\n
Create \/opt\/spire-extras\/conf\/oidc-discovery-provider\/oidc-discovery-provider.conf:<\/p>\n
log_level = “INFO”<\/p>\n
domains = [“<OIDC_DISCOVERY_DOMAIN>”]<\/p>\n
server_api {
\naddress = “unix:\/\/<SPIRE_SERVER_API_SOCKET>”
\n}<\/p>\n
serving_cert_file {
\ncert_file_path = “\/opt\/spire-extras\/conf\/oidc-discovery-provider\/tls.crt”
\nkey_file_path = “\/opt\/spire-extras\/conf\/oidc-discovery-provider\/tls.key”
\n}<\/p>\n
Create \/etc\/systemd\/system\/spire-oidc-discovery-provider.service:<\/p>\n
[Unit]
\nDescription=SPIRE OIDC Discovery Provider
\nAfter=network-online.target spire-server.service
\nWants=network-online.target<\/p>\n
[Service]
\nType=simple
\nExecStart=\/opt\/spire-extras\/bin\/oidc-discovery-provider -config \/opt\/spire-extras\/conf\/oidc-discovery-provider\/oidc-discovery-provider.conf
\nRestart=on-failure
\nRestartSec=5
\nLimitNOFILE=65536<\/p>\n
[Install]
\nWantedBy=multi-user.target<\/p>\n
Configure PingFederate to trust and validate JWTs issued from the SPIRE environment.<\/p>\n
Use these values:<\/p>\n
PingFederate should validate JWT signatures using the JWKS published by the SPIRE OIDC Discovery Provider.<\/p>\n
Ping does not need to call the SPIRE server directly for every token validation. It should use the discovery\/JWKS metadata from the OIDC Discovery Provider.<\/p>\n
Ping should require:<\/p>\n
iss = https:\/\/<OIDC_DISCOVERY_DOMAIN><\/p>\n
Recommended audience value:<\/p>\n
<PING_AUDIENCE><\/p>\n
Clients requesting JWT-SVIDs from SPIRE should request them with this audience.<\/p>\n
The workload identity will be in:<\/p>\n
sub<\/p>\n
Example:<\/p>\n
spiffe:\/\/<TRUST_DOMAIN>\/workload\/<WORKLOAD_NAME><\/p>\n
This is the primary identity claim Ping should use to identify the calling workload.<\/p>\n
Validate:<\/p>\n
Current example SPIFFE ID:<\/p>\n
spiffe:\/\/<TRUST_DOMAIN>\/workload\/<WORKLOAD_NAME><\/p>\n
A workload on the SPIRE Agent host should obtain its JWT from the local SPIRE agent, not from the SPIRE server directly.<\/p>\n
Local agent socket:<\/p>\n
<AGENT_SOCKET_PATH><\/p>\n
| Placeholder | Meaning |
\n|—|—|<\/p>\n
| <SPIRE_SERVER_HOST> | SPIRE server hostname |<\/p>\n
| <SPIRE_AGENT_HOST> | SPIRE agent hostname |<\/p>\n
| <TRUST_DOMAIN> | SPIRE trust domain |<\/p>\n
| <SERVER_PORT> | SPIRE server listener port |<\/p>\n
| <HEALTH_PORT> | Health check port |<\/p>\n
| <AGENT_SOCKET_PATH> | Local SPIRE Agent workload API socket |<\/p>\n
| <AGENT_HASH> | x509pop parent\/agent hash |<\/p>\n
| <WORKLOAD_NAME> | Example X.509 workload name |<\/p>\n
| <JWT_WORKLOAD_NAME> | Example JWT workload name |<\/p>\n
| <JWT_AUDIENCE> | JWT audience used by client |<\/p>\n
| <PING_AUDIENCE> | Audience PingFederate validates |<\/p>\n
| <OIDC_DISCOVERY_DOMAIN> | Public\/abstracted OIDC issuer hostname |<\/p>\n
| <SPIRE_SERVER_API_SOCKET> | SPIRE server private API socket |<\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview This setup deploys SPIRE as follows: SPIRE Server on <SPIRE_SERVER_HOST> SPIRE Agent on <SPIRE_AGENT_HOST> Trust domain: <TRUST_DOMAIN> Server\/agent communication port: <SERVER_PORT>\/tcp How it works SPIRE provides machine and workload identity. The SPIRE Server on <SPIRE_SERVER_HOST> is the trust authority for the trust domain <TRUST_DOMAIN>. The SPIRE Agent on <SPIRE_AGENT_HOST> attests to the server using …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2114],"tags":[2118,2216],"class_list":["post-12445","post","type-post","status-publish","format-standard","hentry","category-pingfederate","tag-pingfederate","tag-spire"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/12445","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=12445"}],"version-history":[{"count":1,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/12445\/revisions"}],"predecessor-version":[{"id":12446,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/12445\/revisions\/12446"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12445"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12445"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12445"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}