Add SubscribeToRotatedIdentities interface

[meyskens]

This change adds a SubscribeToRotatedIdentities function.
This gives a channel which is used to pass identity updates
back from the certificate proider to the auth manager.
In the auth manager there can better be acted upon to
receive the IDs and re-trigger a mTLS handshake if needed.

Add a mechanism for the SPIRE server to signal rotated certificates for re-authenticating connections

[youngnick]

LGTM with one non-blocking comment about cilium-id.

[mhofstetter]

looks good, some minor suggestions

[meyskens]

/test

Job 'Cilium-PR-K8s-1.25-kernel-4.19' failed:

Click to show.

Test Name

K8sDatapathServicesTest Checks E/W loadbalancing (ClusterIP, NodePort from inside cluster, etc) Tests NodePort inside cluster (kube-proxy) with IPSec and externalTrafficPolicy=Local

Failure Output

FAIL: Request from k8s1 to service http://[fd04::11]:30152 failed

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.25-kernel-4.19 so I can create one.

[julianwiedmann]

Let's wait for tests to complete ⏳. mlh will set the label automatically if all is green.

[youngnick]

Seems like this is currently blocked by #24471.

[meyskens]

Updated to latest changes on master

[meyskens]

/test

[sayboras]

LGTM ✔️

[sayboras]

integration test failures seem related to this change

--- FAIL: TestSpireDelegateClient_GetCertificateForIdentity (0.01s)
                                                                   
    --- FAIL: TestSpireDelegateClient_GetCertificateForIdentity/get_certificate_for_numeric_identity (0.00s)
                                                                                                            
    certificate_provider_test.go:391: SpireDelegateClient.GetCertificateForIdentity() error = no SPIFFE ID for spiffe://test.cilium.io/identity/1234, wantErr false
────────────────────────────────────────────────────────────────────────────────────────────────
                                                                                                
--- FAIL: TestSpireDelegateClient_SubscribeToRotatedIdentities (0.00s)
                                                                      
    --- FAIL: TestSpireDelegateClient_SubscribeToRotatedIdentities/receive_1_updated_event (0.00s)
                                                                                                  
level=error msg="failed to convert spiffe ID spiffe://test.cilium.io/cilium-id/1234 to numeric identity" error="SPIFFE ID spiffe://test.cilium.io/cilium-id/1234 does not belong to our trust domain or is not in the valid format" subsys=spire
    certificate_provider_test.go:486: SpireDelegateClient.SubscribeToRotatedIdentities() = [], want [{1234}]
────────────────────────────────────────────────────────────────────────────────────────────────
                                                                                                
--- FAIL: TestSpireDelegateClient_ValidateIdentity (0.00s)
                                                          
    --- FAIL: TestSpireDelegateClient_ValidateIdentity/validate_with_correct_SPIFFE_ID (0.00s)
                                                                                              
    certificate_provider_test.go:219: SpireDelegateClient.ValidateIdentity() = false, want true
────────────────────────────────────────────────────────────────────────────────────────────────
                                                                                                
--- FAIL: TestSpireDelegateClient_sniToSPIFFEID (0.00s)
                                                       
    --- FAIL: TestSpireDelegateClient_sniToSPIFFEID/convert_valid_numeric_identity (0.00s)

[meyskens]

Rebased with fixes to test

[meyskens]

/test

[meyskens]

/test

[meyskens]

rest-runtime fails due to network issue

docker: Error response from daemon: Get "[https://registry-1.docker.io/v2/":](https://registry-1.docker.io/v2/) read tcp 10.0.2.15:33340->52.1.184.176:443: read: connection reset by peer.

[meyskens]

/test-runtime