Supporting "Delegated Identity API" from SPIRE via SDS

Title: Supporting "Delegated Identity API" from SPIRE via SDS

Description:

Hi! Recently, SPIRE added support for a Delegated Identity API, which adds support for a trusted workload to retrieve certificates on-behalf-of other workloads on the host. From looking at the current XDS integration with SPIRE the only way I can see to make delegated identity work with a shared host-level proxy would be to have clusters per client-identity x destination and working that backwards through client-aware routes, etc.. While that in theory sounds possible, we don't want to have an online dependency between the configuration synchronized to Envoy and the current state of workloads deployed to a host. We'd also be worried about the cardinality of client-identity x destination over time.

Assuming there's not something obvious we're missing, do yall have any thoughts around how Envoy could be extended to suppor this use case? Or somebody I should bug more synchronously about this?

[optional Relevant Links:]

[0] Delegated Identity API [1] Example XDS integration with SPIRE as-is