Working Group Proposal: Quarkus Workload Identity

[sberyozkin]

Goal

Workload Identity attests the provenance and validity of the Quarkus workload that is running in the cloud or on bare metal.

SPIFFE is one of the key technologies that can be used to issue verifiable identifiers such as JWT tokens, X509 certificates and workload identity attestations.

Kibernetes projected service token is a simpler mechanism for single clusters.

Currently, only Quarkus OIDC can use both Spiffe JWT SVID and Kubernetes service tokens for OAuth2 client authentication - but only when these tokens have been provisioned on the file system.

SPIFFE X509 certificates are already supported at the Quarkus OIDC, REST Client and other extensions that can work with the TLS registry reload mechanism - but it is up to the application or sidecar to provision them and copy to the file system.

The goal of this working group is to make it very easy for any Quarkus extension or application to acquire and present a workload identity identifier, either from a file system or directly.

Progress tracking

Planned

• #55274 Support scheduled SPIFFE Client executions
• #55338 Provide SPIFFE X509 certificate verification support for mTLS
• #55412 Provide closer integration between Spiffe X509 and TLS registry
• #55275 Add REST Client Workload Identity Federation filter
• #55340 Provide caching SPIFFE client support
• #55339 Provide SPIFFE JWT-SVID integration with kafka-client
• #53894 Support for SPIFFE WIT-SVID Workload Identity attestation

In Progress

• #55273 Enhance SPIFFE client to fetch X509 workload certificates
• #53816 Support for SPIFFE file system provisioned X509-SVID OIDC client authentication (OIDC extensions: reload provider WebClient TLS certificates when they are rotated #53912 made it work, only the documentation update is pending)
• #52682 OAuth2 Client attestation without secrets (complements SPIFFE, Verifiable Credentials, pending Keycloak 27.0.0 release)

Completed

• #55136 Add Spiffe client extension
• #52232 Support for SPIFFE file system provisioned JWT-SVID OIDC client authentication
• #40013 Support for Kubernetes file system provisioned JWT bearer OIDC client authentication

Participation

@sberyozkin, @michalvavrik.
Advice, recommendations, contributions from @sabre1041, @ryanemerson, @starksm64 and others will be welcomed

End in Sight

This work is done when once all issues listed in the Planned and In Progress sections are completed.

[cescoffier]

Please follow the proposal template. Also, we already have many active working groups at the moment (challenging my time and tooling)

[sberyozkin]

@cescoffier

Please follow the proposal template

Sure

Also, we already have many active working groups at the moment (challenging my time and tooling)

Sure, I only opened this Discussion to have a public roadmap, which I thought you preferred, but we definitely do not have to follow a Working Group path, not immediately for sure.

What we can do right now, is to keep looking into it, some parts of it is still in drafts, and then we can create a WG later with some issues already resolved, some to be resolved.

Let me know please later when the time is right to create WG, thanks

[sberyozkin]

@cescoffier Hi, I've updated the proposal as we now have a much clearer view of what needs to be done. I'll add a few more planned issues asap and the group should be ready to be opened

[sberyozkin]

That said, I'll add some obvious candidates right now, let me know if you'd like some more tuning in the proposal, otherwise, please open the group