Skip to content

Fix k8s workload attestor Broker API config docs and remove dead code #7112

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sorindumitru merged 3 commits into from
Jul 2, 2026
+31 −29
Merged

Fix k8s workload attestor Broker API config docs and remove dead code #7112

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f5afd35
Fix k8s workload attestor Broker API config docs and remove dead code
amartinezfayo Jul 2, 2026
985a9f8
Address review comments
amartinezfayo Jul 2, 2026
a8911ab
Align experimental config table to satisfy markdownlint MD060
amartinezfayo Jul 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 23 additions & 8 deletions conf/agent/agent_full.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -509,7 +509,15 @@ plugins {
# Defaults to false. (Linux only)
# verbose_container_locator_logs = false

# broker: Broker API-specific configuration used by AttestReference.
# experimental: Experimental plugin options, subject to change or
# removal. Holds the Kubernetes API server and SPIFFE Broker API
# configuration.
#
# experimental.api_server.cache.enabled: If true, enables a
# controller-runtime Kubernetes API server cache for
# object-reference lookups. Defaults to false.
#
# experimental.broker: Broker API-specific configuration used by AttestReference.
# Broker API uses AttestReference, so this block is required for
# all Broker API references handled by this plugin, including
# WorkloadPIDReference and KubernetesObjectReference. Each broker
Expand Down Expand Up @@ -549,14 +557,21 @@ plugins {
# - kind: User
# name: spiffe://example.org/broker
#
# broker {
# access_policy = "enforced"
# brokers = [
# {
# id = "spiffe://example.org/broker"
# pod_reference_scope = "cluster"
# experimental {
# api_server {
# cache {
# enabled = false
# }
# ]
# }
# broker {
# access_policy = "enforced"
# brokers = [
# {
# id = "spiffe://example.org/broker"
# pod_reference_scope = "cluster"
# }
# ]
# }
# }

# sigstore: sigstore options. Enables image cosign signatures checking.
Expand Down
10 changes: 8 additions & 2 deletions doc/plugin_agent_workloadattestor_k8s.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,6 @@ since [hostprocess](https://kubernetes.io/docs/tasks/configure-pod-container/cre

| Configuration | Description |
|-----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `experimental.api_server.cache.enabled` | If true, enables a controller-runtime Kubernetes API server cache for object-reference lookups. Defaults to false. |
| `disable_container_selectors` | If true, container selectors are not produced. This can be used to produce pod selectors when the workload pod is known but the workload container is not ready at the time of attestation. |
| `kubelet_read_only_port` | The kubelet read-only port. This is mutually exclusive with `kubelet_secure_port`. |
| `kubelet_secure_port` | The kubelet secure port. It defaults to `10250` unless `kubelet_read_only_port` is set. |
Expand All @@ -60,11 +59,18 @@ since [hostprocess](https://kubernetes.io/docs/tasks/configure-pod-container/cre
| `use_anonymous_authentication` | If true, use anonymous authentication for kubelet communication |
| `node_name_env` | The environment variable used to obtain the node name. Defaults to `MY_NODE_NAME`. |
| `node_name` | The name of the node. Overrides the value obtained by the environment variable specified by `node_name_env`. |
| `experimental.broker` | Experimental Broker API options for `AttestReference`. Required when this plugin handles Broker API references. See [Broker API](#broker-api). |
| `experimental` | The experimental options that are subject to change or removal (see below). |
| `sigstore` | Sigstore options. Options described below. See [Sigstore options](#sigstore-options). When set, enables verification of container image signatures and attestations. |
| `use_new_container_locator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true. |
| `verbose_container_locator_logs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false. |

These are the current experimental configurations.

| experimental | Description | Default |
|:---------------------------|-----------------------------------------------------------------------------------------------------------------------------------|---------|
| `api_server.cache.enabled` | If true, enables a controller-runtime Kubernetes API server cache for object-reference lookups. | false |
| `broker` | Broker API options for `AttestReference`. Required when this plugin handles Broker API references. See [Broker API](#broker-api). | |

## Sigstore feature

This feature extends the `k8s` workload attestor with the ability to validate container image signatures and attestations using the [Sigstore](https://www.sigstore.dev/) ecosystem. It is optional and only enabled when the `sigstore` block is configured.
Expand Down
19 changes: 0 additions & 19 deletions pkg/agent/plugin/workloadattestor/k8s/k8s.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -893,9 +893,6 @@ func (p *Plugin) findPodByName(ctx context.Context, config *k8sConfig, namespace
}
return nil, status.Errorf(codes.Internal, "unable to get pod from Kubernetes API: %v", err)
}
if err := checkPodReferenceScope(scope, config.NodeName, pod); err != nil {
return nil, err
}
return pod, nil
}

Expand Down Expand Up @@ -947,25 +944,9 @@ func (p *Plugin) findPodByUID(ctx context.Context, config *k8sConfig, uid types.
if pod.UID != uid {
return nil, status.Errorf(codes.NotFound, "pod %s/%s has UID %s, expected %s", pod.Namespace, pod.Name, pod.UID, uid)
}
if err := checkPodReferenceScope(scope, config.NodeName, pod); err != nil {
return nil, err
}
return pod, nil
}

func checkPodReferenceScope(scope podReferenceScope, agentNodeName string, pod *corev1.Pod) error {
if scope != podReferenceScopeAgentNode {
return nil
}
if agentNodeName == "" {
return status.Error(codes.Internal, "agent node name is not configured")
}
if pod.Spec.NodeName != agentNodeName {
return status.Error(codes.PermissionDenied, "pod is not on the agent node")
}
return nil
}

// decodePodFromKubelet rehydrates a `corev1.Pod` from the partially-parsed
// JSON the kubelet pod-list path keeps in fastjson form (the cache stores
// pods as `*fastjson.Value` to avoid per-request unmarshalling when no pod
Expand Down
Loading