[RFC-0014] Introduce SPIFFE Broker API

Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>

Author: matheuscscp

.github/workflows/e2e.yaml

@@ -89,3 +89,25 @@ jobs:
           kubectl -n helm-system get helmreleases -oyaml || true
           kubectl -n helm-system get all
           helm ls -n helm-system --all
+  kubeconfig-remote:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # for reading the repository code.
+    steps:
+      - name: Test suite setup
+        # The custom kind config sets the ServiceAccount issuer URL used by the
+        # remote cluster's OIDC authenticator.
+        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@948f0babb1fce92d805ea0755a3d7ec1cc4f3176 # v0.16.0
+        with:
+          go-version: 1.27.x
+          kind-config: hack/ci/kubeconfig-primary-kind.yaml
+      - name: Build container image
+        run: |
+          make docker-build IMG=test/helm-controller:latest \
+            BUILD_PLATFORMS=linux/amd64 \
+            BUILD_ARGS="--load"
+      - name: Run remote kubeconfig e2e
+        # Reuses the "kind" cluster the setup action created and adds a second one.
+        run: hack/ci/kubeconfig-e2e.sh
+        env:
+          IMG: test/helm-controller:latest

docs/README.md

@@ -36,6 +36,8 @@
 | `--requeue-dependency`                 | duration      | The interval at which failing dependencies are reevaluated. (default 30s)                                                                                                                |
 | `--snapshot-digest-algo`               | string        | The algorithm to use to calculate the digest of Helm release storage snapshots. (default "sha256")                                                                                       |
 | `--token-cache-max-size`               | int           | The maximum amount of entries in the LRU cache used for tokens. (default 100, enabled)                                                                                                   |
+| `--spiffe-broker-endpoint`            | string        | The gRPC URL of the SPIFFE Broker endpoint.                                                                                                                                              |
+| `--spiffe-broker-id`                  | strings       | SPIFFE ID of the SPIFFE Broker endpoint. Can be repeated.                                                                                                                                |
 | `--token-cache-max-duration`           | duration      | The maximum duration for which a token would be considered unexpired. This is capped at 1h. (default 1h)                                                                                 |
 | `--watch-all-namespaces`               | boolean       | Watch for custom resources in all namespaces, if set to false it will only watch the runtime namespace. (default true)                                                                   |
 | `--watch-configs-label-selector`       | string        | Watch for ConfigMaps and Secrets with matching labels (default 'reconcile.fluxcd.io/watch=Enabled').                                                                                     |
@@ -72,6 +74,21 @@ understands it as the trust domain of the controller's own X509-SVID.
 
 Invalid values cause helm-controller to fail at startup.
 
+### SPIFFE Broker API
+
+When `--spiffe-broker-endpoint` and at least one `--spiffe-broker-id` are set,
+helm-controller acquires an X.509-SVID from the SPIFFE Workload API and uses it to
+authenticate to the SPIFFE Broker API. The `SPIFFE_ENDPOINT_SOCKET` environment
+variable must point to the Workload API socket.
+
+The Broker is used to acquire JWT-SVIDs for object-level workload identity when
+a ServiceAccount sets `credential.auth.fluxcd.io/provider` to `spiffe`. The
+Broker endpoint is a TCP gRPC target, e.g.
+`dns:///spire-server.spire.svc.cluster.local:8443`.
+
+Each `--spiffe-broker-id` value is interpreted like the SPIFFE IDs used by the
+mTLS flags. Invalid values cause helm-controller to fail at startup.
+
 ### Feature Gates
 
 | Name                             | Default Value | Description                                                                                                                                                                                                                                            |

docs/spec/v2/helmreleases.md

@@ -1290,6 +1290,11 @@ this feature, see the following docs:
 - [GKE](/flux/integrations/gcp/#for-google-kubernetes-engine)
 - [Generic](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#configuring-the-api-server)
 
+For a complete guide to the ServiceAccount annotations used for object-level
+workload identity, including the `spiffe` credential provider, see the
+[ServiceAccount annotations](/flux/integrations/serviceaccount-annotations)
+docs.
+
 Example for an EKS cluster:
 
 ```yaml

go.mod

@@ -22,12 +22,12 @@ require (
 	github.com/fluxcd/pkg/apis/event v0.32.0
 	github.com/fluxcd/pkg/apis/kustomize v1.23.0
 	github.com/fluxcd/pkg/apis/meta v1.36.1-0.20261021122630-1ab1573eaf5b
-	github.com/fluxcd/pkg/auth v0.63.1-0.20261021122630-1ab1573eaf5b
+	github.com/fluxcd/pkg/auth v0.63.1-0.20261021195940-7f28daf18ea8
 	github.com/fluxcd/pkg/cache v0.17.1-0.20261021122630-1ab1573eaf5b
 	github.com/fluxcd/pkg/chartutil v1.32.0
 	github.com/fluxcd/pkg/http/fetch v0.28.1-0.20261021122630-1ab1573eaf5b
 	github.com/fluxcd/pkg/runtime v0.120.1-0.20261021122630-1ab1573eaf5b
-	github.com/fluxcd/pkg/spiffe v0.0.0-20261021122630-1ab1573eaf5b
+	github.com/fluxcd/pkg/spiffe v0.0.0-20261021195940-7f28daf18ea8
 	github.com/fluxcd/pkg/ssa v0.80.0
 	github.com/fluxcd/pkg/testserver v0.15.0
 	github.com/fluxcd/source-controller/api v1.9.6
@@ -114,7 +114,7 @@ require (
 	github.com/extism/go-sdk v1.7.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
 	github.com/felixge/httpsnoop v1.1.0 // indirect
-	github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261021122630-1ab1573eaf5b // indirect
+	github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261021195940-7f28daf18ea8 // indirect
 	github.com/fluxcd/pkg/tar v1.3.0 // indirect
 	github.com/fsnotify/fsnotify v1.10.1 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.3 // indirect
@@ -137,6 +137,7 @@ require (
 	github.com/go-openapi/swag/stringutils v0.29.1 // indirect
 	github.com/go-openapi/swag/typeutils v0.29.1 // indirect
 	github.com/go-openapi/swag/yamlutils v0.29.1 // indirect
+	github.com/gobuffalo/flect v1.0.3 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
@@ -233,3 +234,5 @@ require (
 )
 
 replace github.com/fluxcd/source-controller/api => github.com/fluxcd/source-controller/api v1.9.1-0.20261005091731-e47a59ad5d01
+
+exclude github.com/fluxcd/pkg/spiffe v0.0.0

go.sum

@@ -152,16 +152,16 @@ github.com/fluxcd/cli-utils v1.4.0 h1:zlTiCWcVDQvvwZXILYeu5rpbnGt1sS+w32y3+rkOpi
 github.com/fluxcd/cli-utils v1.4.0/go.mod h1:OupUOj2boEKTbiguMbGMz5Z/d59JUcb1c7pPESe8Pjw=
 github.com/fluxcd/pkg/apis/acl v0.12.0 h1:UWpZDqKxpKDW38wdXIMHV8Uv3POPu2vUrra0JH1frH0=
 github.com/fluxcd/pkg/apis/acl v0.12.0/go.mod h1:PJrGIu5Bw/6/siO95uhS+pi5oKSU+gVJqHqsPHb8Kok=
-github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261021122630-1ab1573eaf5b h1:/n7p1+Yyu88dVjg3ezqCM0p96VUwMxtjgSb6cELFiQg=
-github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261021122630-1ab1573eaf5b/go.mod h1:bEwkDgBjLXMVJ2BwmVbbj32PkirmNSicabgl2Jvw7Dk=
+github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261021195940-7f28daf18ea8 h1:5v8rFjr2mtgOvgcnq6p+YP6n3PIxUeCw9LuLVgtRtrQ=
+github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261021195940-7f28daf18ea8/go.mod h1:bEwkDgBjLXMVJ2BwmVbbj32PkirmNSicabgl2Jvw7Dk=
 github.com/fluxcd/pkg/apis/event v0.32.0 h1:3zyjdUspwQN+EQJPlUXwCvCMbeqtB+azlNmeenAcbuE=
 github.com/fluxcd/pkg/apis/event v0.32.0/go.mod h1:ALma8dTqo+NbI+z4BawSzt0pAPjetCSNNUSSS/9p0VU=
 github.com/fluxcd/pkg/apis/kustomize v1.23.0 h1:tT/sUURyh6ixQG4+Y/ZoUu+hh5/DQLRraWBgy42ubqQ=
 github.com/fluxcd/pkg/apis/kustomize v1.23.0/go.mod h1:Jm/LmEsqJIldhhTmhkORAq8JKVZK3ZV2Q88rntjGxEI=
 github.com/fluxcd/pkg/apis/meta v1.36.1-0.20261021122630-1ab1573eaf5b h1:g/s+m/jU7cPJ+8IIIXbDD19G7TQAKbiUvqTt5GuywlM=
 github.com/fluxcd/pkg/apis/meta v1.36.1-0.20261021122630-1ab1573eaf5b/go.mod h1:1MLvK2Xu3UdTKBzg+Q1Oj7H9PHeiKsUB1UW3uwxAwiM=
-github.com/fluxcd/pkg/auth v0.63.1-0.20261021122630-1ab1573eaf5b h1:uqRL6xKRFwUi7AXrPj7BSRAqQYz7rxNMNjSK2W6YqB0=
-github.com/fluxcd/pkg/auth v0.63.1-0.20261021122630-1ab1573eaf5b/go.mod h1:gWbB4MzuHWalVyI0o4lE84aINidor9+S63ithckm+94=
+github.com/fluxcd/pkg/auth v0.63.1-0.20261021195940-7f28daf18ea8 h1:ylRlAqUfY2cWj4vbmKxaitNwLRl79jSbEHHku4XA7Wo=
+github.com/fluxcd/pkg/auth v0.63.1-0.20261021195940-7f28daf18ea8/go.mod h1:H3d+oTnSZOXibRp0dFIwY9nBEyZPfeSEbdHLgTifrYA=
 github.com/fluxcd/pkg/cache v0.17.1-0.20261021122630-1ab1573eaf5b h1:wi9U1NDlqYmbVUMntuKU71vOqnSFSslDEMbbnBnzJDs=
 github.com/fluxcd/pkg/cache v0.17.1-0.20261021122630-1ab1573eaf5b/go.mod h1:OW3fncHhPnPZFZav5FdEa//cyMHSndI0JS+IM69LXOU=
 github.com/fluxcd/pkg/chartutil v1.32.0 h1:rqBhgiGsrS4am/jsCfKYlQvPQ+jATug10BtO95UHdq0=
@@ -170,8 +170,8 @@ github.com/fluxcd/pkg/http/fetch v0.28.1-0.20261021122630-1ab1573eaf5b h1:q+StvN
 github.com/fluxcd/pkg/http/fetch v0.28.1-0.20261021122630-1ab1573eaf5b/go.mod h1:SOq8vrzru2zipskTEguXzKHabn2ASyXESQ/DY93FafY=
 github.com/fluxcd/pkg/runtime v0.120.1-0.20261021122630-1ab1573eaf5b h1:/S4RzBts7XoNrxXM0hUjmVzZ+fxrXcZ6VyHJfaiWIII=
 github.com/fluxcd/pkg/runtime v0.120.1-0.20261021122630-1ab1573eaf5b/go.mod h1:Cw0CQ/tVKS9lgJoyKVouZr1qVnoJcYnSHw3QDzIOOjA=
-github.com/fluxcd/pkg/spiffe v0.0.0-20261021122630-1ab1573eaf5b h1:I7Z3cEgoM+EqYpLkr0xI3a1z+Qh1WbZKDCOd8EeGYJg=
-github.com/fluxcd/pkg/spiffe v0.0.0-20261021122630-1ab1573eaf5b/go.mod h1:tZ+T8ljAM9ZE0VriHSWM4vfvhlq5zv5bNcPKqwZK1lk=
+github.com/fluxcd/pkg/spiffe v0.0.0-20261021195940-7f28daf18ea8 h1:00U+vD6Ra4NJGlptrWvKrZeh8NebTUZ8kGqnJhVeaV8=
+github.com/fluxcd/pkg/spiffe v0.0.0-20261021195940-7f28daf18ea8/go.mod h1:SbLhH/mBxffgJqsoTFVXHNdfpcxFP2l0fmgh3FiU/u8=
 github.com/fluxcd/pkg/ssa v0.80.0 h1:GgakpCFz4pY+unpOscPYlc5eVLUsB7hw9TmWSNr3yp8=
 github.com/fluxcd/pkg/ssa v0.80.0/go.mod h1:mUwKP2+KZXm1mal1gSs9SjgcexyqzXbPfHKxdFv5ntM=
 github.com/fluxcd/pkg/tar v1.3.0 h1:PbL5jNN5q/F6nXA8aCH+msM75BS6lSnPX2RNd48f8ls=
@@ -239,6 +239,8 @@ github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpv
 github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
+github.com/gobuffalo/flect v1.0.3 h1:xeWBM2nui+qnVvNM4S3foBhCAL2XgPU+a7FdpelbTq4=
+github.com/gobuffalo/flect v1.0.3/go.mod h1:A5msMlrHtLqh9umBSnvabjsMrCcCpAyzglnDvkbYKHs=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
@@ -408,12 +410,17 @@ github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3A
 github.com/spiffe/go-spiffe/v2 v2.9.0 h1:g5qTg3qIP1HXV+GzuyEfSJFVxUCpEP5Ui1OINVJHPB4=
 github.com/spiffe/go-spiffe/v2 v2.9.0/go.mod h1:w2CLWKLMTX/PPYUEUPv3ltH0RXsw5S8suwNF46w9/Aw=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
 github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834 h1:ZF+QBjOI+tILZjBaFj3HgFonKXUcwgJ4djLb6i42S3Q=