Comments (6)
One case I'd be interested in is supporting processes without native workload support.
I'm thinking the user-interaction might look something like this:
spiffe --spiffe="spiffe://example.org/pickaworkload" exec -- mysql --ssl-ca=@X509BUNDLE --ssl-cert=@X509SVID --ssl-key=@SVIDKEY
the spiffe tool would write out temp files (ideally, to somewhere like a tmpfs that's relatively secure) and exec the tool with the templated parameters filled in. Lots of bikeshedding to do on the details, and at least in the above case I'd probably want a wrapper shell script (I'd call it spiffe-mysql or something) so folks don't have to type it out.
That would work with tools like curl, mysql, etc -- anything that takes a cert bundle, client cert, and key as files.
Maybe a flag to send a signal to the child on update, too?
from go-spiffe.
There are likely additional features that would fit well here (SPIFFE bundle fetching? Munging to type-specific bundles? etc)
Perhaps:
- Fetch a SPIFFE bundle from a SPIFFE federation API
- Serve a SPIFFE bundle from disk-based files or from the workload API
- Munge SPIFFE bundles into SVID-specific types as mentioned above (e.g. SPIFFE bundle to JWKS w/ only JWT-SVID keys, or into PEM-formatted CA certificates
Maybe some of the functionality from the SPIRE OIDC provider can live here too?
from go-spiffe.
There's a few ways you might want to specify the paths to files:
- as command line options, like mysql/curl do, with some syntax like in the comment above
- as environment variables, for a "12 factor" style applications
- to preconfigured paths (for apps with config files that don't want to change)
from go-spiffe.
You may also want support for different file formats...
eg, syslog
wants an "openssl CA directory".
Java & windows apps often want a .p12 file
Some apps want a pkcs1 vs pkcs8 key.
Some want the x509 cert, chain, and key all in the same file (eg, mongodb)
our internal not-yet-spiffe software supported that set of file format options & that's given almost complete coverage of software we've run into.
from go-spiffe.
Handling rotation:
- Might want to signal a process (ideally, a child process)
- Might want to run a command (eg,
sv restart /service/foo
if you're using runit, or some equivalent systemd command, etc) to restart a process. Definitely need to use this with care; I wouldn't want to knock out a fleet with a bad restart command. - Ideally apps notice files on disk changing (via inotify) and reload, or do it on some timer, requiring no coordination.
from go-spiffe.
This is basically a description of spiffe-helper, but I think it's helpful to re-state what the goals are for a larger tool.
from go-spiffe.
Related Issues (20)
- Possible bug in getTLSCertificate where err might not be returned HOT 3
- store serialized JWT token in []byte instead in the JWT-SVID HOT 1
- Convenience pretty-printing json output
- Support for named pipes HOT 17
- Problem with SPIFFE trust domain usage during peer verification HOT 4
- Migration guide from v1 to v2 HOT 4
- Support running tests on CI for each supported minor version of Go HOT 1
- Unable to create TLS connection: spiffetls: cannot create X.509 source: context deadline exceeded HOT 3
- Feature Request: Authorizers combination
- chores: migrate jose from v2 to v3
- Bump google.golang.org/grpc from 1.51.0 to 1.53.0 causes the fake spire server to fail HOT 2
- Example validating JWTs with provided x509 certificate bundle
- Should we add a delegated identity API client to go-spiffe/v2? HOT 1
- Add new ParseRawWithHint() func for X.509-SVID
- Workload API is not working in Windows.
- TestMTLSWebHandshake/client_no_valid_certificate: Error message not equal HOT 3
- WithDefaultX509SVIDPicker / WithDefaultJWTSVIDPicker
- Allow `workloadapi` backoff to be customized
- Support `*slog.Logger` as configured logger HOT 2
- Add an example of application auth using JWTs
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from go-spiffe.