SPIFFE/SPIREワークロードアイデンティティ — シークレットなしのサービス間認証

spiffe://prod.example.com/ns/orders/sa/orders-sa
└─┬──┘ └──────┬───────┘ └─────────┬──────────┘
 スキーム    信頼ドメイン        ワークロードパス
        (trust domain)    (例: ネームスペース/サービスアカウント)

+--------------------------------------------------------------+
|                        SPIRE Server                           |
|  - 登録エントリ(registration entries)を保存                   |
|  - CAとしてSVIDに署名(またはupstream CAへ委譲)                |
|  - node attestationを検証                                     |
+------------------------------+-------------------------------+
                               | (1) node attestation
                               |     「このノード/エージェントは本物か」
+------------------------------+-------------------------------+
|                  SPIRE Agent (ノードごとのDaemonSet)          |
|  - Workload API(unixソケット)を公開                           |
|  - workload attestationを実施                                 |
|  - SVIDのキャッシュ/更新                                      |
+------------------------------+-------------------------------+
                               | (2) workload attestation
                               |     「このプロセスはどのワークロードか」
            +------------------+------------------+
            |                  |                  |
       +----+----+        +----+----+        +----+----+
       | Pod A   |        | Pod B   |        | Pod C   |
       | (orders)|        | (pay)   |        | (envoy) |
       +---------+        +---------+        +---------+

apiVersion: v1
kind: ConfigMap
metadata:
  name: spire-server
  namespace: spire
data:
  server.conf: |
    server {
      bind_address = "0.0.0.0"
      bind_port = "8081"
      trust_domain = "prod.example.com"
      data_dir = "/run/spire/data"
      log_level = "INFO"
      ca_ttl = "24h"
      default_x509_svid_ttl = "1h"
    }
    plugins {
      DataStore "sql" {
        plugin_data {
          database_type = "sqlite3"
          connection_string = "/run/spire/data/datastore.sqlite3"
        }
      }
      NodeAttestor "k8s_psat" {
        plugin_data {
          clusters = {
            "prod-cluster" = {
              service_account_allow_list = ["spire:spire-agent"]
            }
          }
        }
      }
      KeyManager "disk" {
        plugin_data {
          keys_path = "/run/spire/data/keys.json"
        }
      }
      Notifier "k8sbundle" {
        plugin_data {
          namespace = "spire"
        }
      }
    }
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: spire-server
  namespace: spire
spec:
  serviceName: spire-server
  replicas: 1
  selector:
    matchLabels:
      app: spire-server
  template:
    metadata:
      labels:
        app: spire-server
    spec:
      serviceAccountName: spire-server
      containers:
        - name: spire-server
          image: ghcr.io/spiffe/spire-server:1.12.0
          args: ['-config', '/run/spire/config/server.conf']
          ports:
            - containerPort: 8081
          volumeMounts:
            - name: spire-config
              mountPath: /run/spire/config
              readOnly: true
            - name: spire-data
              mountPath: /run/spire/data
      volumes:
        - name: spire-config
          configMap:
            name: spire-server
  volumeClaimTemplates:
    - metadata:
        name: spire-data
      spec:
        accessModes: ['ReadWriteOnce']
        resources:
          requests:
            storage: 1Gi

apiVersion: v1
kind: ConfigMap
metadata:
  name: spire-agent
  namespace: spire
data:
  agent.conf: |
    agent {
      data_dir = "/run/spire"
      log_level = "INFO"
      server_address = "spire-server.spire.svc.cluster.local"
      server_port = "8081"
      socket_path = "/run/spire/sockets/agent.sock"
      trust_domain = "prod.example.com"
      trust_bundle_path = "/run/spire/bundle/bundle.crt"
    }
    plugins {
      NodeAttestor "k8s_psat" {
        plugin_data {
          cluster = "prod-cluster"
        }
      }
      KeyManager "memory" {
        plugin_data {}
      }
      WorkloadAttestor "k8s" {
        plugin_data {
          disable_container_selectors = false
        }
      }
    }
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: spire-agent
  namespace: spire
spec:
  selector:
    matchLabels:
      app: spire-agent
  template:
    metadata:
      labels:
        app: spire-agent
    spec:
      hostPID: true
      serviceAccountName: spire-agent
      containers:
        - name: spire-agent
          image: ghcr.io/spiffe/spire-agent:1.12.0
          args: ['-config', '/run/spire/config/agent.conf']
          volumeMounts:
            - name: spire-config
              mountPath: /run/spire/config
              readOnly: true
            - name: spire-bundle
              mountPath: /run/spire/bundle
              readOnly: true
            - name: spire-agent-socket
              mountPath: /run/spire/sockets
      volumes:
        - name: spire-config
          configMap:
            name: spire-agent
        - name: spire-bundle
          configMap:
            name: spire-bundle
        - name: spire-agent-socket
          hostPath:
            path: /run/spire/sockets
            type: DirectoryOrCreate

kubectl exec -n spire spire-server-0 -- \
  /opt/spire/bin/spire-server entry create \
  -spiffeID spiffe://prod.example.com/ns/orders/sa/orders-sa \
  -parentID spiffe://prod.example.com/spire/agent/k8s_psat/prod-cluster/NODE_UUID \
  -selector k8s:ns:orders \
  -selector k8s:sa:orders-sa

apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterSPIFFEID
metadata:
  name: default-workload-id
spec:
  spiffeIDTemplate: 'spiffe://prod.example.com/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}'
  podSelector:
    matchLabels:
      spiffe.io/spire-managed-identity: 'true'

# Envoyサイドカー設定(抜粋) — ordersサービス
static_resources:
  clusters:
    # SPIRE agentのWorkload APIをSDSクラスターとして登録
    - name: spire_agent
      connect_timeout: 1s
      http2_protocol_options: {}
      load_assignment:
        cluster_name: spire_agent
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    pipe:
                      path: /run/spire/sockets/agent.sock
    # アップストリーム: paymentsサービスへのmTLS接続
    - name: payments_upstream
      connect_timeout: 2s
      type: STRICT_DNS
      load_assignment:
        cluster_name: payments_upstream
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address:
                      address: payments.payments.svc.cluster.local
                      port_value: 8443
      transport_socket:
        name: envoy.transport_sockets.tls
        typed_config:
          '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
          common_tls_context:
            # 自分の身元(X.509-SVID)をSDSで受け取る
            tls_certificate_sds_secret_configs:
              - name: spiffe://prod.example.com/ns/orders/sa/orders-sa
                sds_config:
                  api_config_source:
                    api_type: GRPC
                    transport_api_version: V3
                    grpc_services:
                      - envoy_grpc:
                          cluster_name: spire_agent
            # 相手の検証: 信頼バンドル + 期待するSPIFFE ID
            combined_validation_context:
              default_validation_context:
                match_typed_subject_alt_names:
                  - san_type: URI
                    matcher:
                      exact: spiffe://prod.example.com/ns/payments/sa/payments-sa
              validation_context_sds_secret_config:
                name: spiffe://prod.example.com
                sds_config:
                  api_config_source:
                    api_type: GRPC
                    transport_api_version: V3
                    grpc_services:
                      - envoy_grpc:
                          cluster_name: spire_agent

// go-spiffe v2でmTLSクライアントを作る(抜粋)
source, err := workloadapi.NewX509Source(ctx)
if err != nil {
    log.Fatal(err)
}
defer source.Close()

serverID := spiffeid.RequireFromString("spiffe://prod.example.com/ns/payments/sa/payments-sa")
tlsConfig := tlsconfig.MTLSClientConfig(source, source, tlsconfig.AuthorizeID(serverID))

client := &http.Client{
    Transport: &http.Transport{TLSClientConfig: tlsConfig},
}
resp, err := client.Get("https://payments.payments.svc.cluster.local:8443/healthz")

spiffe://cluster.local/ns/orders/sa/orders-sa

# SPIRE Server設定にfederationを追加(server.conf抜粋)
# federates_withで相手ドメインのバンドルエンドポイントを指定
federation {
  bundle_endpoint {
    address = "0.0.0.0"
    port = 8443
  }
  federates_with "partner.example.org" {
    bundle_endpoint_url = "https://spire.partner.example.org:8443"
    bundle_endpoint_profile "https_spiffe" {
      endpoint_spiffe_id = "spiffe://partner.example.org/spire/server"
    }
  }
}

spire-server entry create \
  -spiffeID spiffe://prod.example.com/ns/orders/sa/orders-sa \
  -selector k8s:ns:orders -selector k8s:sa:orders-sa \
  -federatesWith spiffe://partner.example.org

[ユーザーJWT] --> Gateway --(exchange)--> [Txn-Token: ユーザー + コンテキスト + チェーン]
                              |
                              v
        orders (SVIDでmTLS) --> payments (SVIDでmTLS)
        リクエストごと: Txn-Token検証 + 呼び出し元SPIFFE ID確認