spiffe support

[olix0r]

now that linkerd supports client certs, it should be pretty straightforward to instrument spiffe support

[rmichela]

The SPIFFE SVID client certificate specification can be found at https://github.com/spiffe/svid/blob/master/SPECIFICATION.md

[rmichela]

In addition to validating SVID client certs, it would be great if Linkerd could populate the x-forwarded-client-cert header when proxying an incoming request to the supporting service. x-forwarded-client-cert would allow services to make detailed authorization decisions using the SPIFFE ID from the client certificate.

https://lyft.github.io/envoy/docs/configuration/http_conn_man/headers.html#x-forwarded-client-cert

[nathanawmk]

Is SPIFFE and/or SVID now integrated into Linkerd?

[cpretzer]

There's no native integration for Linkerd 1 or Linkerd 2. Linkerd 1 has a plug-in system that would enable you to write code to integrate with SPIFFE/SVID