spire
spire copied to clipboard
SPIRE bundle endpoint server should be configurable in terms of profile
When configuring federation in SPIRE Server, remote bundle endpoint servers are configured in terms of what profile they are using (i.e. https_web or https_spiffe). This is in contrast to SPIRE Server's bundle endpoint server, the configuration of which takes only address/port and an optional ACME config. If ACME is configured, the bundle endpoint server uses the https_web profile, and if not then it uses the https_spiffe profile.
This distinction isn't documented anywhere, and it is also confusing to users who now have to choose a "profile" when they didn't have to originally. Instead, SPIRE Server's bundle endpoint server should be configurable in terms of profile the same way that the client is, and the ACME configurables should simply be a part of the https_web profile configuration.
Propose then implement a new configuration shape for the bundle endpoint server that is more closely aligned with the client configuration and the specification terminology