Added SPIFFE entry registration and SVID entrypointer backoff

cmd/controller/main.go

@@ -60,12 +60,20 @@ func main() {
 	flag.StringVar(&opts.Images.ImageDigestExporterImage, "imagedigest-exporter-image", "", "The container image containing our image digest exporter binary.")
 	flag.StringVar(&opts.Images.WorkingDirInitImage, "workingdirinit-image", "", "The container image containing our working dir init binary.")
 
+	flag.StringVar(&opts.SpireConfig.TrustDomain, "spire-trust-domain", "example.org", "Experimental: The SPIRE Trust domain to use.")
+	flag.StringVar(&opts.SpireConfig.SocketPath, "spire-socket-path", "/spiffe-workload-api/spire-agent.sock", "Experimental: The SPIRE agent socket for SPIFFE workload API.")
+	flag.StringVar(&opts.SpireConfig.ServerAddr, "spire-server-addr", "spire-server.spire.svc.cluster.local:8081", "Experimental: The SPIRE server address for workload/node registration.")
+	flag.StringVar(&opts.SpireConfig.NodeAliasPrefix, "spire-node-alias-prefix", "/tekton-node/", "Experimental: The SPIRE node alias prefix to use.")
+
 	// This parses flags.
 	cfg := injection.ParseAndGetRESTConfigOrDie()
 
 	if err := opts.Images.Validate(); err != nil {
 		log.Fatal(err)
 	}
+	if err := opts.SpireConfig.Validate(); err != nil {
+		log.Fatal(err)
+	}
 	if cfg.QPS == 0 {
 		cfg.QPS = 2 * rest.DefaultQPS
 	}

go.mod

@@ -17,17 +17,14 @@ require (
 	github.com/opencontainers/image-spec v1.0.3-0.20211202222133-eacdcc10569b
 	github.com/pkg/errors v0.9.1
 	github.com/spiffe/go-spiffe/v2 v2.0.0-beta.5
-	github.com/spiffe/spire v0.12.2 // indirect
-	github.com/spiffe/spire/proto/spire v0.10.1 // indirect
 	github.com/tektoncd/plumbing v0.0.0-20211012143332-c7cc43d9bc0c
 	go.opencensus.io v0.23.0
 	go.uber.org/zap v1.19.1
 	golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8
 	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
 	golang.org/x/time v0.0.0-20211116232009-f0f3c7e86c11 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.2.0
-	google.golang.org/grpc v1.43.0 // indirect
-	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
+	google.golang.org/grpc v1.43.0
 	k8s.io/api v0.22.5
 	k8s.io/apimachinery v0.22.5
 	k8s.io/client-go v0.22.5
@@ -46,6 +43,7 @@ require (
 	github.com/emicklei/go-restful v2.15.0+incompatible // indirect
 	github.com/go-logr/logr v1.2.2 // indirect
 	github.com/google/go-containerregistry/pkg/authn/kubernetes v0.0.0-20220120123041-d22850aca581 // indirect
+	github.com/spiffe/spire-api-sdk v1.2.0
 	go.uber.org/multierr v1.7.0 // indirect
 	golang.org/x/net v0.0.0-20220114011407-0dd24b26b47d // indirect
 	k8s.io/klog/v2 v2.40.1 // indirect

pkg/apis/pipeline/options.go

@@ -16,8 +16,13 @@ limitations under the License.
 
 package pipeline
 
+import (
+	spireconfig "github.com/tektoncd/pipeline/pkg/spire/config"
+)
+
 // Options holds options passed to the Tekton Pipeline controllers
 // typically via command-line flags.
 type Options struct {
-	Images Images
+	Images      Images
+	SpireConfig spireconfig.SpireConfig
 }

pkg/reconciler/taskrun/controller.go

@@ -62,6 +62,7 @@ func NewController(opts *pipeline.Options, clock clock.Clock) func(context.Conte
 			KubeClientSet:     kubeclientset,
 			PipelineClientSet: pipelineclientset,
 			Images:            opts.Images,
+			SpireConfig:       opts.SpireConfig,
 			Clock:             clock,
 			taskRunLister:     taskRunInformer.Lister(),
 			resourceLister:    resourceInformer.Lister(),

pkg/reconciler/taskrun/taskrun.go

@@ -47,6 +47,8 @@ import (
 	"github.com/tektoncd/pipeline/pkg/reconciler/events/cloudevent"
 	"github.com/tektoncd/pipeline/pkg/reconciler/taskrun/resources"
 	"github.com/tektoncd/pipeline/pkg/reconciler/volumeclaim"
+	"github.com/tektoncd/pipeline/pkg/spire"
+	spireconfig "github.com/tektoncd/pipeline/pkg/spire/config"
 	"github.com/tektoncd/pipeline/pkg/taskrunmetrics"
 	_ "github.com/tektoncd/pipeline/pkg/taskrunmetrics/fake" // Make sure the taskrunmetrics are setup
 	"github.com/tektoncd/pipeline/pkg/workspace"
@@ -68,6 +70,7 @@ type Reconciler struct {
 	KubeClientSet     kubernetes.Interface
 	PipelineClientSet clientset.Interface
 	Images            pipeline.Images
+	SpireConfig       spireconfig.SpireConfig
 	Clock             clock.Clock
 
 	// listers index properties about resources
@@ -427,9 +430,28 @@ func (c *Reconciler) reconcile(ctx context.Context, tr *v1beta1.TaskRun, rtr *re
 	}
 
 	if podconvert.SidecarsReady(pod.Status) {
+		if config.FromContextOrDefaults(ctx).FeatureFlags.EnableSpire {
+			logger.Infof("Registering SPIRE entry: %v/%v", pod.Namespace, pod.Name)
+			spiffeclient, err := spire.NewSpiffeServerApiClient(ctx, c.SpireConfig)
+			if err != nil {
+				logger.Errorf("Failed to establish client with SPIRE server: %v", err)
+				return err
+			}
+			if err = spiffeclient.CreateNodeEntry(ctx, pod.Spec.NodeName); err != nil {
+				logger.Errorf("Failed to create node SPIFFE entry for node %v: %v", pod.Spec.NodeName, err)
+				return err
+			}
+			if err = spiffeclient.CreateWorkloadEntry(ctx, tr, pod); err != nil {
+				logger.Errorf("Failed to create workload SPIFFE entry for taskrun %v: %v", tr.Name, err)
+				return err
+			}
+			logger.Infof("Created SPIFFE workload entry for %v/%v", tr.Namespace, tr.Name)
+		}
+
 		if err := podconvert.UpdateReady(ctx, c.KubeClientSet, *pod); err != nil {
 			return err
 		}
+
 		if err := c.metrics.RecordPodLatency(pod, tr); err != nil {
 			logger.Warnf("Failed to log the metrics : %v", err)
 		}

pkg/spire/config/config.go

@@ -0,0 +1,59 @@
+/*
+Copyright 2019 The Tekton Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+)
+
+// SpireConfig holds the images reference for a number of container images used
+// across tektoncd pipelines.
+type SpireConfig struct {
+	TrustDomain     string
+	SocketPath      string
+	ServerAddr      string
+	NodeAliasPrefix string
+}
+
+// Validate returns an error if any image is not set.
+func (c SpireConfig) Validate() error {
+	var unset []string
+	for _, f := range []struct {
+		v, name string
+	}{
+		{c.TrustDomain, "spire-trust-domain"},
+		{c.SocketPath, "spire-socket-path"},
+		{c.ServerAddr, "spire-server-addr"},
+		{c.NodeAliasPrefix, "spire-node-alias-prefix"},
+	} {
+		if f.v == "" {
+			unset = append(unset, f.name)
+		}
+	}
+	if len(unset) > 0 {
+		sort.Strings(unset)
+		return fmt.Errorf("found unset image flags: %s", unset)
+	}
+
+	if !strings.HasPrefix(c.NodeAliasPrefix, "/") {
+		return fmt.Errorf("Spire node alias should start with a /")
+	}
+
+	return nil
+}

pkg/spire/spire.go

@@ -0,0 +1,174 @@
+/*
+Copyright 2019 The Tekton Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package spire
+
+import (
+	"context"
+	"fmt"
+
+	entryv1 "github.com/spiffe/spire-api-sdk/proto/spire/api/server/entry/v1"
+	spiffetypes "github.com/spiffe/spire-api-sdk/proto/spire/api/types"
+
+	corev1 "k8s.io/api/core/v1"
+
+	"github.com/spiffe/go-spiffe/v2/spiffetls/tlsconfig"
+	"github.com/spiffe/go-spiffe/v2/workloadapi"
+	"github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1"
+	spireconfig "github.com/tektoncd/pipeline/pkg/spire/config"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials"
+)
+
+type SpiffeServerApiClient struct {
+	serverConn   *grpc.ClientConn
+	workloadConn *workloadapi.X509Source
+	entryClient  entryv1.EntryClient
+	config       spireconfig.SpireConfig
+}
+
+func NewSpiffeServerApiClient(ctx context.Context, c spireconfig.SpireConfig) (*SpiffeServerApiClient, error) {
+	// Create X509Source
+	source, err := workloadapi.NewX509Source(ctx, workloadapi.WithClientOptions(workloadapi.WithAddr("unix://"+c.SocketPath)))
+	if err != nil {
+		return nil, fmt.Errorf("Unable to create X509Source for SPIFFE client: %w", err)
+	}
+
+	// Create connection
+	tlsConfig := tlsconfig.MTLSClientConfig(source, source, tlsconfig.AuthorizeAny())
+	conn, err := grpc.DialContext(ctx, c.ServerAddr, grpc.WithTransportCredentials(credentials.NewTLS(tlsConfig)))
+	if err != nil {
+		source.Close()
+		return nil, fmt.Errorf("Unable to dial SPIRE server: %w", err)
+	}
+
+	return &SpiffeServerApiClient{
+		serverConn:   conn,
+		workloadConn: source,
+		entryClient:  entryv1.NewEntryClient(conn),
+		config:       c,
+	}, nil
+}
+
+func (sc *SpiffeServerApiClient) CreateNodeEntry(ctx context.Context, nodeName string) error {
+	selectors := []*spiffetypes.Selector{
+		{
+			Type:  "k8s_psat",
+			Value: "agent_ns:spire",
+		},
+		{
+			Type:  "k8s_psat",
+			Value: "agent_node_name:" + nodeName,
+		},
+	}
+
+	entries := []*spiffetypes.Entry{
+		{
+			SpiffeId: &spiffetypes.SPIFFEID{
+				TrustDomain: sc.config.TrustDomain,
+				Path:        fmt.Sprintf("%v%v", sc.config.NodeAliasPrefix, nodeName),
+			},
+			ParentId: &spiffetypes.SPIFFEID{
+				TrustDomain: sc.config.TrustDomain,
+				Path:        "/spire/server",
+			},
+			Selectors: selectors,
+		},
+	}
+
+	req := entryv1.BatchCreateEntryRequest{
+		Entries: entries,
+	}
+
+	resp, err := sc.entryClient.BatchCreateEntry(ctx, &req)
+	if err != nil {
+		return err
+	}
+
+	if len(resp.Results) != 1 {
+		return fmt.Errorf("Batch create entry failed, malformed response expected 1 result")
+	}
+
+	res := resp.Results[0]
+	if codes.Code(res.Status.Code) == codes.AlreadyExists ||
+		codes.Code(res.Status.Code) == codes.OK {
+		return nil
+	}
+
+	return fmt.Errorf("Batch create entry failed, code: %v", res.Status.Code)
+}
+
+func (sc *SpiffeServerApiClient) CreateWorkloadEntry(ctx context.Context, tr *v1beta1.TaskRun, pod *corev1.Pod) error {
+	// Note: We can potentially add attestation on the container images as well since
+	// the information is available here.
+	selectors := []*spiffetypes.Selector{
+		{
+			Type:  "k8s",
+			Value: "pod-uid:" + string(pod.UID),
+		},
+		{
+			Type:  "k8s",
+			Value: "pod-name:" + pod.Name,
+		},
+	}
+
+	entries := []*spiffetypes.Entry{
+		{
+			SpiffeId: &spiffetypes.SPIFFEID{
+				TrustDomain: sc.config.TrustDomain,
+				Path:        fmt.Sprintf("/ns/%v/taskrun/%v", tr.Namespace, tr.Name),
+			},
+			ParentId: &spiffetypes.SPIFFEID{
+				TrustDomain: sc.config.TrustDomain,
+				Path:        fmt.Sprintf("%v%v", sc.config.NodeAliasPrefix, pod.Spec.NodeName),
+			},
+			Selectors: selectors,
+		},
+	}
+
+	req := entryv1.BatchCreateEntryRequest{
+		Entries: entries,
+	}
+
+	resp, err := sc.entryClient.BatchCreateEntry(ctx, &req)
+	if err != nil {
+		return err
+	}
+
+	if len(resp.Results) != 1 {
+		return fmt.Errorf("Batch create entry failed, malformed response expected 1 result")
+	}
+
+	res := resp.Results[0]
+	if codes.Code(res.Status.Code) == codes.AlreadyExists ||
+		codes.Code(res.Status.Code) == codes.OK {
+		return nil
+	}
+
+	return fmt.Errorf("Batch create entry failed, code: %v", res.Status.Code)
+}
+
+func (sc *SpiffeServerApiClient) Close() {
+	err := sc.serverConn.Close()
+	if err != nil {
+		// Log error
+	}
+	err = sc.workloadConn.Close()
+	if err != nil {
+		// Log error
+	}
+}