Introduce AttestReference API in workloadattestor

proto/spire/plugin/agent/workloadattestor/v1/workloadattestor.proto

@@ -2,6 +2,8 @@ syntax = "proto3";
 package spire.plugin.agent.workloadattestor.v1;
 option go_package = "github.com/spiffe/spire-plugin-sdk/proto/spire/plugin/agent/workloadattestor/v1";
 
+import "google/protobuf/any.proto";
+
 service WorkloadAttestor {
     // Attests the specified workload process. If the process is not one the
     // attestor is in a position to attest (e.g. k8s attestor attesting a
@@ -10,6 +12,16 @@ service WorkloadAttestor {
     // fails to gather all selectors related to that workload, the call will
     // fail. Otherwise the attestor will return one or more workload selectors.
     rpc Attest(AttestRequest) returns (AttestResponse);
+
+    // Attests a workload identified by an opaque reference (e.g. a process
+    // ID, a Kubernetes object reference, etc.). The reference's type URL is
+    // taken from the SPIFFE Broker API specification's WorkloadReference and
+    // delivered verbatim. A plugin that does not implement reference-based
+    // attestation at all returns Unimplemented, which lets the host fall back
+    // to Attest when the reference is a WorkloadPIDReference. A plugin that
+    // implements this RPC but receives a reference type it does not support
+    // returns InvalidArgument.
+    rpc AttestReference(AttestReferenceRequest) returns (AttestReferenceResponse);
 }
 
 message AttestRequest {
@@ -22,3 +34,17 @@ message AttestResponse {
     // of the selector is inferred from the plugin name.
     repeated string selector_values = 1;
 }
+
+message AttestReferenceRequest {
+    // Required. Reference to the workload to be attested. The packed message
+    // is one of the WorkloadReference reference types defined by the SPIFFE
+    // Broker API specification (e.g. WorkloadPIDReference,
+    // KubernetesObjectReference) or a vendor-specific extension type.
+    google.protobuf.Any reference = 1;
+}
+
+message AttestReferenceResponse {
+    // Optional. Selector values related to the attested workload. The type
+    // of the selector is inferred from the plugin name.
+    repeated string selector_values = 1;
+}

templates/agent/workloadattestor/workloadattestor.go

@@ -69,6 +69,25 @@ func (p *Plugin) Attest(ctx context.Context, req *workloadattestorv1.AttestReque
 	return nil, status.Error(codes.Unimplemented, "not implemented")
 }
 
+// AttestReference implements the WorkloadAttestor AttestReference RPC. Attests a workload identified by an opaque
+// reference (e.g. a process ID, a Kubernetes object reference, etc.). A plugin that does not implement
+// reference-based attestation at all returns Unimplemented, which lets the host fall back to Attest when the
+// reference is a WorkloadPIDReference. A plugin that implements this RPC but receives a reference type it does not
+// support returns InvalidArgument.
+func (p *Plugin) AttestReference(ctx context.Context, req *workloadattestorv1.AttestReferenceRequest) (*workloadattestorv1.AttestReferenceResponse, error) {
+	config, err := p.getConfig()
+	if err != nil {
+		return nil, err
+	}
+
+	// TODO: Implement the RPC behavior. The following line silences compiler
+	// warnings and can be removed once the configuration is referenced by the
+	// implementation.
+	config = config
+
+	return nil, status.Error(codes.Unimplemented, "not implemented")
+}
+
 // Configure configures the plugin. This is invoked by SPIRE when the plugin is
 // first loaded. In the future, it may be invoked to reconfigure the plugin.
 // As such, it should replace the previous configuration atomically.