Support downstream entries/spiffeIds (closes #43)

Signed-off-by: Keegan Witt <[email protected]>

Author: keeganwitt

api/v1alpha1/clusterspiffeid_types.go

@@ -67,6 +67,9 @@ type ClusterSPIFFEIDSpec struct {
 	// administrative APIs. Extra care should be taken to only apply this
 	// SPIFFE ID to admin workloads.
 	Admin bool `json:"admin,omitempty"`
+
+	// Downstream indicates that the entry describes a downstream SPIRE server.
+	Downstream bool `json:"downstream,omitempty"`
 }
 
 // ClusterSPIFFEIDStatus defines the observed state of ClusterSPIFFEID

api/v1alpha1/clusterspiffeid_webhook.go

@@ -89,6 +89,7 @@ type ParsedClusterSPIFFEIDSpec struct {
 	DNSNameTemplates          []*template.Template
 	WorkloadSelectorTemplates []*template.Template
 	Admin                     bool
+	Downstream                bool
 }
 
 // ParseClusterSPIFFEIDSpec parses and validates the fields in the ClusterSPIFFEIDSpec

config/crd/bases/spire.spiffe.io_clusterspiffeids.yaml

@@ -48,6 +48,9 @@ spec:
                 items:
                   type: string
                 type: array
+              downstream:
+                description: Downstream indicates that the entry describes a downstream SPIRE server.
+                type: boolean
               federatesWith:
                 description: FederatesWith is a list of trust domain names that workloads
                   that obtain this SPIFFE ID will federate with.

demo/config/cluster1/crd/spire.spiffe.io_clusterspiffeids.yaml

@@ -48,6 +48,9 @@ spec:
                 items:
                   type: string
                 type: array
+              downstream:
+                description: Downstream indicates that the entry describes a downstream SPIRE server.
+                type: boolean
               federatesWith:
                 description: FederatesWith is a list of trust domain names that workloads
                   that obtain this SPIFFE ID will federate with.

demo/config/cluster2/crd/spire.spiffe.io_clusterspiffeids.yaml

@@ -48,6 +48,9 @@ spec:
                 items:
                   type: string
                 type: array
+              downstream:
+                description: Downstream indicates that the entry describes a downstream SPIRE server.
+                type: boolean
               federatesWith:
                 description: FederatesWith is a list of trust domain names that workloads
                   that obtain this SPIFFE ID will federate with.

docs/clusterspiffeid-crd.md

@@ -24,6 +24,7 @@ The definition can be found [here](../api/v1alpha1/clusterspiffeid_types.go).
 | `ttl`                       | OPTIONAL | Duration value indicating an upper bound on the time-to-live for SVIDs issued to target workload |
 | `federatesWith`             | OPTIONAL | One or more trust domain names that target workloads federate with |
 | `admin`                     | OPTIONAL | Indicates whether the target workload is an admin workload (i.e. can access SPIRE administrative APIs) |
+| `downstream`                | OPTIONAL | Indicates that the entry describes a downstream SPIRE server. |
 
 ## ClusterSPIFFEIDStatus
 

pkg/spireapi/types.go

@@ -40,6 +40,7 @@ type Entry struct {
 	TTL           time.Duration
 	FederatesWith []spiffeid.TrustDomain
 	Admin         bool
+	Downstream    bool
 	DnsNames      []string
 }
 

pkg/spireapi/types_test.go

@@ -30,6 +30,7 @@ var (
 		TTL:           time.Minute,
 		FederatesWith: []spiffeid.TrustDomain{spiffeid.RequireTrustDomainFromString("domain2.test")},
 		Admin:         true,
+		Downstream:    true,
 		DnsNames:      []string{"dnsname"},
 	}
 
@@ -47,6 +48,7 @@ var (
 		Ttl:           60,
 		FederatesWith: []string{"domain2.test"},
 		Admin:         true,
+		Downstream:    true,
 		DnsNames:      []string{"dnsname"},
 	}
 )

pkg/spireentry/entries.go

@@ -80,6 +80,7 @@ func renderPodEntry(spec *spirev1alpha1.ParsedClusterSPIFFEIDSpec, node *corev1.
 		FederatesWith: spec.FederatesWith,
 		DnsNames:      dnsNames,
 		Admin:         spec.Admin,
+		Downstream:    spec.Downstream,
 	}, nil
 }
 

pkg/spireentry/logging.go

@@ -37,6 +37,7 @@ const (
 	federatesWithKey      = "federatesWith"
 	dnsNamesKey           = "dnsNames"
 	adminKey              = "admin"
+	downstreamKey         = "downstream"
 )
 
 func objectName(o metav1.Object) string {
@@ -55,6 +56,7 @@ func entryLogFields(entry spireapi.Entry) []interface{} {
 		federatesWithKey, stringFromTrustDomains(entry.FederatesWith),
 		dnsNamesKey, stringList(entry.DnsNames),
 		adminKey, entry.Admin,
+		downstreamKey, entry.Downstream,
 	}
 }