Supporting "Delegated Identity API" from SPIRE via SDS
#19.756 geöffnet am 31. Jan. 2022
Repository-Metriken
- Stars
- (27.997 Stars)
- PR-Merge-Metriken
- (Durchschn. Merge 8T) (378 gemergte PRs in 30 T)
Beschreibung
Title: Supporting "Delegated Identity API" from SPIRE via SDS
Description:
Hi! Recently, SPIRE added support for a Delegated Identity API, which adds support for a trusted workload to retrieve certificates on-behalf-of other workloads on the host. From looking at the current XDS integration with SPIRE the only way I can see to make delegated identity work with a shared host-level proxy would be to have clusters per client-identity x destination and working that backwards through client-aware routes, etc.. While that in theory sounds possible, we don't want to have an online dependency between the configuration synchronized to Envoy and the current state of workloads deployed to a host. We'd also be worried about the cardinality of client-identity x destination over time.
Assuming there's not something obvious we're missing, do yall have any thoughts around how Envoy could be extended to suppor this use case? Or somebody I should bug more synchronously about this?
[optional Relevant Links:]
[0] Delegated Identity API [1] Example XDS integration with SPIRE as-is