Workload Identity: Add workload-identity-x509 service to tbot

[strideynet]

Part of: #49986

As per RFD191: #49133

For now, this command is hidden until we remove the feature flag.

version: v2
proxy_server: example.teleport.sh
onboarding:
  join_method: kubernetes
  token: local-workload-id
certificate_ttl: 24h
storage:
  type: directory
  path: /Users/noah/code/gravitational/teleport-scratch/tbot-new-workload-id/storage
services:
  - type: workload-identity-x509
    destination:
      type: directory
      path: /Users/noah/code/gravitational/teleport-scratch/tbot-new-workload-id/svid-out
    workload_identity:
      name: workload-identity
  - type: workload-identity-x509
    destination:
      type: directory
      path: /Users/noah/code/gravitational/teleport-scratch/tbot-new-workload-id/svid-labels-out
    workload_identity:
      labels:
        test: [bar]

Follow up PRs will include the workload-identity-api and workload-identity-jwt services.

[timothyb89]

Looks pretty good, and working well on my dev cluster.

Aside from a couple of nits, one more general question: if a user wants to issue more than one SVID, what's the solution? I guess multiple outputs, one per SVID?

I realize the UX for this case is rough with upstream SPIFFE tools too and the impl here seems sane. Just curious more than anything.

[strideynet]

Aside from a couple of nits, one more general question: if a user wants to issue more than one SVID, what's the solution? I guess multiple outputs, one per SVID?

Yeah for now - certainly. Perhaps eventually we can write them all into sub-directories? The other thing in my mind is we could really just make having many outputs cheap - and then it doesn't really matter.

[public-teleport-github-review-bot]

@strideynet See the table below for backport results.

Branch	Result
branch/v16	Failed
branch/v17	Create PR