Kubernetes and Helm
The chart is published as an OCI artifact at oci://ghcr.io/bcollard/charts/jwks-bridge.
Install
helm install jwks-bridge oci://ghcr.io/bcollard/charts/jwks-bridge \
-n jwks --create-namespace -f values.yamlexamples/kubernetes/values.yaml is a production-style starting point with mTLS, NetworkPolicy, ServiceMonitor and OTLP export, and examples/kubernetes/certificate.yaml issues the server certificate with cert-manager.
Main values
| Value | Default | Description |
|---|---|---|
replicaCount | 2 | Replicas cache independently; run two or more. |
keysets | default: secret/jwks-bridge/default | Keyset name to Vault path. |
vault.address | Required with source: vault. | |
vault.auth | kubernetes | kubernetes, approle or token. |
vault.caSecret | Secret with ca.crt for the Vault server certificate. | |
private.tls.secretName | Required. kubernetes.io/tls Secret for the private listener. Reloaded from disk when it changes. | |
private.mtls.caSecret | Enables mTLS; Secret with ca.crt. | |
private.mtls.allowedSANs | [] | Client SAN or CN allowlist. |
private.basicAuth.secretName | Enables Basic auth; Secret with username and password. | |
config.* | refreshInterval, maxStale, jwksMaxAge, minStageDuration, logLevel, logFormat. | |
extraEnv | [] | For example OTEL_EXPORTER_OTLP_ENDPOINT. |
networkPolicy.enabled | false | Restricts each listener to the configured peers. |
serviceMonitor.enabled | false | Prometheus Operator scrape config for the admin port. |
Services
The chart creates jwks-bridge (public 8080, private 8443) and jwks-bridge-admin (metrics 9090). Probes use /readyz and /healthz on the admin port.
Pod hardening
Distroless static image, non-root UID 65532, read-only root filesystem, all capabilities dropped, RuntimeDefault seccomp, and no service account token mount unless Vault Kubernetes auth needs it.