🐛 Align configMapKey default to bundle.spiffe across Helm and make deploy#248
🐛 Align configMapKey default to bundle.spiffe across Helm and make deploy#248ChristianZaccaria wants to merge 1 commit intokagenti:mainfrom
Conversation
…ploy The Helm chart defaulted to "bundle.crt" (ZTWIM PEM format) while the Go binary flag defaults to "bundle.spiffe" (SPIFFE JSON format), causing silent behavioral divergence between the two deployment paths. "bundle.spiffe" is the SPIFFE spec-native format, a superset of PEM (includes X.509 roots and JWT keys), and the default for the SPIRE hardened Helm chart used on Kind and OCP fallback paths. The x5c provider auto-detects both formats at load time so no parsing change is needed. Updated the comment to document the ZTWIM override path. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: ChristianZaccaria <christian.zaccaria.cz@gmail.com>
cwiklik
left a comment
cwiklik
left a comment
There was a problem hiding this comment.
Review Summary
Minimal, focused bugfix aligning the Helm chart's configMapKey default from bundle.crt to bundle.spiffe, matching the Go binary flag default. Verified against upstream main: the Go flag at cmd/main.go defaults to "bundle.spiffe" while the Helm chart had "bundle.crt". This eliminates silent behavioral divergence between helm install and make deploy paths.
Areas reviewed: Helm values
Commits: 1 commit, signed-off: yes, proper Assisted-By trailer
CI status: DCO passing
| # SPIRE trust bundle ConfigMap (PEM from ZTWIM/SPIRE or SPIFFE JSON from BundlePublisher) | ||
| # Key within the SPIRE trust bundle ConfigMap. Matches the SPIRE hardened Helm chart default | ||
| # and the binary flag default. Override to "bundle.crt" only for older ZTWIM deployments. | ||
| spireTrustBundle: |
There was a problem hiding this comment.
👍 Good catch — silent divergence between Helm and make deploy defaults is exactly the kind of subtle bug that causes hard-to-debug behavior. Verified: Go binary at cmd/main.go defaults to "bundle.spiffe". The updated comment documenting the ZTWIM override path is helpful.
2 participants
Summary
The Helm chart defaulted
signatureVerification.spireTrustBundle.configMapKeyto
bundle.crt(ZTWIM PEM format) while the Go binary flag defaults tobundle.spiffe(SPIFFE JSON format). This silent divergence meant thathelm installandmake deploypointed to different keys in the SPIRE trustbundle ConfigMap, causing unpredictable behaviour when signature verification
is enabled.
Key changes:
configMapKeydefault frombundle.crttobundle.spiffeinvalues.yamlbundle.spiffeis the SPIFFE spec-native format (superset of PEM: X.509 roots + JWT keys)