Support Zero-trust architecture

[praveingk]

Details in Design Doc

[mrsabath]

I am interested in this work too.

[praveingk]

The list of sub-tasks happening on this:

• Launch SPIRE agent on the VM in a secure way. @mrsabath is looking into this along with the SPIRE community on providing a secure (and standard) way of doing this.
• Deploy SPIRE Server in a reachable point to the VMs where SPIRE agent is deployed. The SPIRE server and the orchestrator share a common root of trust. The SPIRE agent gets the OIDC certificate from this server, periodically.
• Orchestrator to check with SPIRE server on the status of the VMs, their identities, and update the states in the tag service.
• Tag service to maintain the leaf mapping of identity in SPIFFE format to IP address, and this will be validated by the orchestrator periodically, and action taken by orchestrator upon any violation.