From b4322a4a2b1ca46e6cb864c573b13675faa85c4d Mon Sep 17 00:00:00 2001 From: Alec Wilson Date: Thu, 13 Aug 2026 22:37:54 +0100 Subject: [PATCH 1/2] Remove deprecated fields from CLI usage --- workloads/federated-cofidectl-tf.sh | 6 ++++-- workloads/federated-cofidectl.sh | 6 ++++-- workloads/federated-helm-tf-eks.sh | 6 ++++-- workloads/login.sh | 7 ++++--- workloads/multi-mesh-cofidectl.sh | 6 ++++-- workloads/single-trust-zone-cofidectl-eks.sh | 6 ++++-- workloads/single-trust-zone-cofidectl-tf.sh | 6 ++++-- workloads/single-trust-zone-cofidectl.sh | 6 ++++-- 8 files changed, 32 insertions(+), 17 deletions(-) diff --git a/workloads/federated-cofidectl-tf.sh b/workloads/federated-cofidectl-tf.sh index a9f737d..2f93003 100755 --- a/workloads/federated-cofidectl-tf.sh +++ b/workloads/federated-cofidectl-tf.sh @@ -60,8 +60,10 @@ cofidectl connect init \ --connect-url $CONNECT_URL \ --connect-trust-domain $CONNECT_TRUST_DOMAIN \ --connect-bundle-host $CONNECT_BUNDLE_HOST \ - --authorization-domain $AUTHORIZATION_DOMAIN \ - --authorization-client-id $AUTHORIZATION_CLIENT_ID \ + --oauth-issuer-url https://$AUTHORIZATION_DOMAIN \ + --oauth-authorization-url https://$AUTHORIZATION_DOMAIN/oauth2/auth \ + --oauth-token-url https://$AUTHORIZATION_DOMAIN/oauth2/token \ + --oauth-client-id $AUTHORIZATION_CLIENT_ID \ --use-join-token set +x diff --git a/workloads/federated-cofidectl.sh b/workloads/federated-cofidectl.sh index 5ac3670..7497632 100755 --- a/workloads/federated-cofidectl.sh +++ b/workloads/federated-cofidectl.sh @@ -51,8 +51,10 @@ cofidectl connect init \ --connect-url $CONNECT_URL \ --connect-trust-domain $CONNECT_TRUST_DOMAIN \ --connect-bundle-host $CONNECT_BUNDLE_HOST \ - --authorization-domain $AUTHORIZATION_DOMAIN \ - --authorization-client-id $AUTHORIZATION_CLIENT_ID \ + --oauth-issuer-url https://$AUTHORIZATION_DOMAIN \ + --oauth-authorization-url https://$AUTHORIZATION_DOMAIN/oauth2/auth \ + --oauth-token-url https://$AUTHORIZATION_DOMAIN/oauth2/token \ + --oauth-client-id $AUTHORIZATION_CLIENT_ID \ --use-join-token cofidectl trust-zone add \ diff --git a/workloads/federated-helm-tf-eks.sh b/workloads/federated-helm-tf-eks.sh index 347c023..2413968 100755 --- a/workloads/federated-helm-tf-eks.sh +++ b/workloads/federated-helm-tf-eks.sh @@ -92,8 +92,10 @@ cofidectl connect init \ --connect-url $CONNECT_URL \ --connect-trust-domain $CONNECT_TRUST_DOMAIN \ --connect-bundle-host $CONNECT_BUNDLE_HOST \ - --authorization-domain $AUTHORIZATION_DOMAIN \ - --authorization-client-id $AUTHORIZATION_CLIENT_ID + --oauth-issuer-url https://$AUTHORIZATION_DOMAIN \ + --oauth-authorization-url https://$AUTHORIZATION_DOMAIN/oauth2/auth \ + --oauth-token-url https://$AUTHORIZATION_DOMAIN/oauth2/token \ + --oauth-client-id $AUTHORIZATION_CLIENT_ID ## Deploy SPIRE components using Helm diff --git a/workloads/login.sh b/workloads/login.sh index f24b0fd..96525b1 100755 --- a/workloads/login.sh +++ b/workloads/login.sh @@ -13,9 +13,10 @@ cofidectl connect init \ --connect-url $CONNECT_URL \ --connect-trust-domain $CONNECT_TRUST_DOMAIN \ --connect-bundle-host $CONNECT_BUNDLE_HOST \ - --authorization-domain $AUTHORIZATION_DOMAIN \ - --authorization-client-id $AUTHORIZATION_CLIENT_ID \ - --connect-datasource + --oauth-issuer-url https://$AUTHORIZATION_DOMAIN \ + --oauth-authorization-url https://$AUTHORIZATION_DOMAIN/oauth2/auth \ + --oauth-token-url https://$AUTHORIZATION_DOMAIN/oauth2/token \ + --oauth-client-id $AUTHORIZATION_CLIENT_ID if ! cofidectl connect login --check; then cofidectl connect login diff --git a/workloads/multi-mesh-cofidectl.sh b/workloads/multi-mesh-cofidectl.sh index d1c3f39..be320cc 100755 --- a/workloads/multi-mesh-cofidectl.sh +++ b/workloads/multi-mesh-cofidectl.sh @@ -73,8 +73,10 @@ cofidectl connect init \ --connect-url $CONNECT_URL \ --connect-trust-domain $CONNECT_TRUST_DOMAIN \ --connect-bundle-host $CONNECT_BUNDLE_HOST \ - --authorization-domain $AUTHORIZATION_DOMAIN \ - --authorization-client-id $AUTHORIZATION_CLIENT_ID \ + --oauth-issuer-url https://$AUTHORIZATION_DOMAIN \ + --oauth-authorization-url https://$AUTHORIZATION_DOMAIN/oauth2/auth \ + --oauth-token-url https://$AUTHORIZATION_DOMAIN/oauth2/token \ + --oauth-client-id $AUTHORIZATION_CLIENT_ID \ --use-join-token cofidectl trust-zone add \ diff --git a/workloads/single-trust-zone-cofidectl-eks.sh b/workloads/single-trust-zone-cofidectl-eks.sh index d6bae11..d00753c 100755 --- a/workloads/single-trust-zone-cofidectl-eks.sh +++ b/workloads/single-trust-zone-cofidectl-eks.sh @@ -29,8 +29,10 @@ cofidectl connect init \ --connect-url $CONNECT_URL \ --connect-trust-domain $CONNECT_TRUST_DOMAIN \ --connect-bundle-host $CONNECT_BUNDLE_HOST \ - --authorization-domain $AUTHORIZATION_DOMAIN \ - --authorization-client-id $AUTHORIZATION_CLIENT_ID + --oauth-issuer-url https://$AUTHORIZATION_DOMAIN \ + --oauth-authorization-url https://$AUTHORIZATION_DOMAIN/oauth2/auth \ + --oauth-token-url https://$AUTHORIZATION_DOMAIN/oauth2/token \ + --oauth-client-id $AUTHORIZATION_CLIENT_ID cofidectl trust-zone add \ $WORKLOAD_TRUST_ZONE_1 \ diff --git a/workloads/single-trust-zone-cofidectl-tf.sh b/workloads/single-trust-zone-cofidectl-tf.sh index 1800b27..33d116d 100755 --- a/workloads/single-trust-zone-cofidectl-tf.sh +++ b/workloads/single-trust-zone-cofidectl-tf.sh @@ -42,8 +42,10 @@ cofidectl connect init \ --connect-url $CONNECT_URL \ --connect-trust-domain $CONNECT_TRUST_DOMAIN \ --connect-bundle-host $CONNECT_BUNDLE_HOST \ - --authorization-domain $AUTHORIZATION_DOMAIN \ - --authorization-client-id $AUTHORIZATION_CLIENT_ID \ + --oauth-issuer-url https://$AUTHORIZATION_DOMAIN \ + --oauth-authorization-url https://$AUTHORIZATION_DOMAIN/oauth2/auth \ + --oauth-token-url https://$AUTHORIZATION_DOMAIN/oauth2/token \ + --oauth-client-id $AUTHORIZATION_CLIENT_ID \ --use-join-token set +x diff --git a/workloads/single-trust-zone-cofidectl.sh b/workloads/single-trust-zone-cofidectl.sh index 34b56a3..786c36a 100755 --- a/workloads/single-trust-zone-cofidectl.sh +++ b/workloads/single-trust-zone-cofidectl.sh @@ -41,8 +41,10 @@ cofidectl connect init \ --connect-url $CONNECT_URL \ --connect-trust-domain $CONNECT_TRUST_DOMAIN \ --connect-bundle-host $CONNECT_BUNDLE_HOST \ - --authorization-domain $AUTHORIZATION_DOMAIN \ - --authorization-client-id $AUTHORIZATION_CLIENT_ID \ + --oauth-issuer-url https://$AUTHORIZATION_DOMAIN \ + --oauth-authorization-url https://$AUTHORIZATION_DOMAIN/oauth2/auth \ + --oauth-token-url https://$AUTHORIZATION_DOMAIN/oauth2/token \ + --oauth-client-id $AUTHORIZATION_CLIENT_ID \ --use-oss-spire cofidectl trust-zone add \ From 2a70e0a614655f0ebfdec274b9224656a49638b7 Mon Sep 17 00:00:00 2001 From: Alec Wilson Date: Fri, 14 Aug 2026 13:39:45 +0100 Subject: [PATCH 2/2] Discover oauth config through CLI --- AGENTS.md | 2 +- workloads/config.env.example | 4 +--- workloads/federated-cofidectl-tf.sh | 5 +---- workloads/federated-cofidectl.sh | 5 +---- workloads/federated-helm-tf-eks.sh | 5 +---- workloads/login.sh | 5 +---- workloads/multi-mesh-cofidectl.sh | 5 +---- workloads/single-trust-zone-cofidectl-eks.sh | 5 +---- workloads/single-trust-zone-cofidectl-tf.sh | 5 +---- workloads/single-trust-zone-cofidectl.sh | 5 +---- 10 files changed, 10 insertions(+), 36 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index c222f8c..a200818 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -52,7 +52,7 @@ cp config.env.example config.env # populate with Connect API details ./prerequisites.sh # verify tooling and log in ``` -`config.env` must be populated before running any deployment script. It sets `CONNECT_URL`, `CONNECT_TRUST_DOMAIN`, `CONNECT_BUNDLE_HOST`, `AUTHORIZATION_DOMAIN`, `AUTHORIZATION_CLIENT_ID`, `NAMESPACE`, and `LOCAL`. +`config.env` must be populated before running any deployment script. It sets `CONNECT_URL`, `CONNECT_TRUST_DOMAIN`, `CONNECT_BUNDLE_HOST`, `OAUTH_CLIENT_ID`, `NAMESPACE`, and `LOCAL`. ### Running deployments diff --git a/workloads/config.env.example b/workloads/config.env.example index b56b3e9..bf35d8a 100644 --- a/workloads/config.env.example +++ b/workloads/config.env.example @@ -4,10 +4,8 @@ CONNECT_URL="" CONNECT_TRUST_DOMAIN="" # Bundle endpoint host of Connect API. CONNECT_BUNDLE_HOST="" -# Domain of authorization provider. -AUTHORIZATION_DOMAIN="" # Client ID for authorization. -AUTHORIZATION_CLIENT_ID="" +OAUTH_CLIENT_ID="" # Kubernetes namespace for validation workload. NAMESPACE=production # If the Kubernetes clusters are local (Kind). diff --git a/workloads/federated-cofidectl-tf.sh b/workloads/federated-cofidectl-tf.sh index 2f93003..1fd565d 100755 --- a/workloads/federated-cofidectl-tf.sh +++ b/workloads/federated-cofidectl-tf.sh @@ -60,10 +60,7 @@ cofidectl connect init \ --connect-url $CONNECT_URL \ --connect-trust-domain $CONNECT_TRUST_DOMAIN \ --connect-bundle-host $CONNECT_BUNDLE_HOST \ - --oauth-issuer-url https://$AUTHORIZATION_DOMAIN \ - --oauth-authorization-url https://$AUTHORIZATION_DOMAIN/oauth2/auth \ - --oauth-token-url https://$AUTHORIZATION_DOMAIN/oauth2/token \ - --oauth-client-id $AUTHORIZATION_CLIENT_ID \ + --oauth-client-id $OAUTH_CLIENT_ID \ --use-join-token set +x diff --git a/workloads/federated-cofidectl.sh b/workloads/federated-cofidectl.sh index 7497632..eb4d734 100755 --- a/workloads/federated-cofidectl.sh +++ b/workloads/federated-cofidectl.sh @@ -51,10 +51,7 @@ cofidectl connect init \ --connect-url $CONNECT_URL \ --connect-trust-domain $CONNECT_TRUST_DOMAIN \ --connect-bundle-host $CONNECT_BUNDLE_HOST \ - --oauth-issuer-url https://$AUTHORIZATION_DOMAIN \ - --oauth-authorization-url https://$AUTHORIZATION_DOMAIN/oauth2/auth \ - --oauth-token-url https://$AUTHORIZATION_DOMAIN/oauth2/token \ - --oauth-client-id $AUTHORIZATION_CLIENT_ID \ + --oauth-client-id $OAUTH_CLIENT_ID \ --use-join-token cofidectl trust-zone add \ diff --git a/workloads/federated-helm-tf-eks.sh b/workloads/federated-helm-tf-eks.sh index 2413968..a89464d 100755 --- a/workloads/federated-helm-tf-eks.sh +++ b/workloads/federated-helm-tf-eks.sh @@ -92,10 +92,7 @@ cofidectl connect init \ --connect-url $CONNECT_URL \ --connect-trust-domain $CONNECT_TRUST_DOMAIN \ --connect-bundle-host $CONNECT_BUNDLE_HOST \ - --oauth-issuer-url https://$AUTHORIZATION_DOMAIN \ - --oauth-authorization-url https://$AUTHORIZATION_DOMAIN/oauth2/auth \ - --oauth-token-url https://$AUTHORIZATION_DOMAIN/oauth2/token \ - --oauth-client-id $AUTHORIZATION_CLIENT_ID + --oauth-client-id $OAUTH_CLIENT_ID ## Deploy SPIRE components using Helm diff --git a/workloads/login.sh b/workloads/login.sh index 96525b1..80da6c9 100755 --- a/workloads/login.sh +++ b/workloads/login.sh @@ -13,10 +13,7 @@ cofidectl connect init \ --connect-url $CONNECT_URL \ --connect-trust-domain $CONNECT_TRUST_DOMAIN \ --connect-bundle-host $CONNECT_BUNDLE_HOST \ - --oauth-issuer-url https://$AUTHORIZATION_DOMAIN \ - --oauth-authorization-url https://$AUTHORIZATION_DOMAIN/oauth2/auth \ - --oauth-token-url https://$AUTHORIZATION_DOMAIN/oauth2/token \ - --oauth-client-id $AUTHORIZATION_CLIENT_ID + --oauth-client-id $OAUTH_CLIENT_ID if ! cofidectl connect login --check; then cofidectl connect login diff --git a/workloads/multi-mesh-cofidectl.sh b/workloads/multi-mesh-cofidectl.sh index be320cc..5b9ce55 100755 --- a/workloads/multi-mesh-cofidectl.sh +++ b/workloads/multi-mesh-cofidectl.sh @@ -73,10 +73,7 @@ cofidectl connect init \ --connect-url $CONNECT_URL \ --connect-trust-domain $CONNECT_TRUST_DOMAIN \ --connect-bundle-host $CONNECT_BUNDLE_HOST \ - --oauth-issuer-url https://$AUTHORIZATION_DOMAIN \ - --oauth-authorization-url https://$AUTHORIZATION_DOMAIN/oauth2/auth \ - --oauth-token-url https://$AUTHORIZATION_DOMAIN/oauth2/token \ - --oauth-client-id $AUTHORIZATION_CLIENT_ID \ + --oauth-client-id $OAUTH_CLIENT_ID \ --use-join-token cofidectl trust-zone add \ diff --git a/workloads/single-trust-zone-cofidectl-eks.sh b/workloads/single-trust-zone-cofidectl-eks.sh index d00753c..574bc72 100755 --- a/workloads/single-trust-zone-cofidectl-eks.sh +++ b/workloads/single-trust-zone-cofidectl-eks.sh @@ -29,10 +29,7 @@ cofidectl connect init \ --connect-url $CONNECT_URL \ --connect-trust-domain $CONNECT_TRUST_DOMAIN \ --connect-bundle-host $CONNECT_BUNDLE_HOST \ - --oauth-issuer-url https://$AUTHORIZATION_DOMAIN \ - --oauth-authorization-url https://$AUTHORIZATION_DOMAIN/oauth2/auth \ - --oauth-token-url https://$AUTHORIZATION_DOMAIN/oauth2/token \ - --oauth-client-id $AUTHORIZATION_CLIENT_ID + --oauth-client-id $OAUTH_CLIENT_ID cofidectl trust-zone add \ $WORKLOAD_TRUST_ZONE_1 \ diff --git a/workloads/single-trust-zone-cofidectl-tf.sh b/workloads/single-trust-zone-cofidectl-tf.sh index 33d116d..0f0a022 100755 --- a/workloads/single-trust-zone-cofidectl-tf.sh +++ b/workloads/single-trust-zone-cofidectl-tf.sh @@ -42,10 +42,7 @@ cofidectl connect init \ --connect-url $CONNECT_URL \ --connect-trust-domain $CONNECT_TRUST_DOMAIN \ --connect-bundle-host $CONNECT_BUNDLE_HOST \ - --oauth-issuer-url https://$AUTHORIZATION_DOMAIN \ - --oauth-authorization-url https://$AUTHORIZATION_DOMAIN/oauth2/auth \ - --oauth-token-url https://$AUTHORIZATION_DOMAIN/oauth2/token \ - --oauth-client-id $AUTHORIZATION_CLIENT_ID \ + --oauth-client-id $OAUTH_CLIENT_ID \ --use-join-token set +x diff --git a/workloads/single-trust-zone-cofidectl.sh b/workloads/single-trust-zone-cofidectl.sh index 786c36a..97cd864 100755 --- a/workloads/single-trust-zone-cofidectl.sh +++ b/workloads/single-trust-zone-cofidectl.sh @@ -41,10 +41,7 @@ cofidectl connect init \ --connect-url $CONNECT_URL \ --connect-trust-domain $CONNECT_TRUST_DOMAIN \ --connect-bundle-host $CONNECT_BUNDLE_HOST \ - --oauth-issuer-url https://$AUTHORIZATION_DOMAIN \ - --oauth-authorization-url https://$AUTHORIZATION_DOMAIN/oauth2/auth \ - --oauth-token-url https://$AUTHORIZATION_DOMAIN/oauth2/token \ - --oauth-client-id $AUTHORIZATION_CLIENT_ID \ + --oauth-client-id $OAUTH_CLIENT_ID \ --use-oss-spire cofidectl trust-zone add \