When nesting spire-agents using x509, currently we need to use a separate process, that adapts the spire-workload-api to the spire server attesting unix socket so the nested agent can fetch the bootstrap trustbundle.
Here's the code that implements this:
https://github.com/spiffe/spire-identity-exchange/blob/main/cmd/spire-server-attestor-spiffe-workload-api/main.go
It would be nice if we incorporated this functionality directly into the spire-agent so you could configure the bootstrap trust bundle along with the x509pop functionality without needing a separate daemon.
Proposal: add a trust_bundle_spiffe_workload_api property pointing at a spiffe workload socket.
When nesting spire-agents using x509, currently we need to use a separate process, that adapts the spire-workload-api to the spire server attesting unix socket so the nested agent can fetch the bootstrap trustbundle.
Here's the code that implements this:
https://github.com/spiffe/spire-identity-exchange/blob/main/cmd/spire-server-attestor-spiffe-workload-api/main.go
It would be nice if we incorporated this functionality directly into the spire-agent so you could configure the bootstrap trust bundle along with the x509pop functionality without needing a separate daemon.
Proposal: add a
trust_bundle_spiffe_workload_apiproperty pointing at a spiffe workload socket.