Support for optional SAN based label selectors in X509 pop Node Attestor

[snanjundaswamy]

Problem

The current join token-based node attestation plugin identifies only a single node. Unlike the k8s/aws_iid node attestation, the join token does not expose any flexibile selectors, which limits us in certain aspects:

1. We need to create a join token request for every single node. We could create a spiffe id while creating join token, but this locks us down to having only one SpiffeId format for all nodes. Therefore, these nodes cannot be part of multiple clusters without managing additional metadata in a different.
2. Creating and managing multiple aliases for nodes in a dynamic environment becomes operationally challenging especially when new nodes are added/removed.

Solution

Multiple options were discussed in this issue and the outcome of that discussion pointed us towards enhancing x509pop node attestor plugin to support additional selectors by extracting SANs on the leaf certificate.

Specifications

The URI SAN on the leaf certificate could be of the format.
x509pop://key:value
Some examples of the SAN selectors

• x509pop://datacenter:us-east-1
• x509pop://env:prod

Considerations:

• The SAN extraction into selectors should be deliberate, hence need to be a URI SANS beginning with x509pop://

Server Side:

Additional Configuration

   NodeAttestor "x509pop" {
        plugin_data {
            ca_bundle_path = "/opt/spire/conf/server/agent-cacert.pem"
            enable_san_selector = false  #defaulted to false
            agent_path_template = "/cn/{{ .Subject.CommonName }}/{{.san.datacenter}}/{{.san.env}}"
        }
    }

Sample Exposed Selector format:
x509pop:san:datacenter:us-east-1
x509pop:san:env:prod

Subject Alternative Name format :
Agent Side Changes:
None

Implementation Options

• The custom selectors would be passed as a map to the template function enabling construction of the Agent ID
• The map of key, value selectors would be sent to this method to expose them as selectors

Related Discussion

#5647

[snanjundaswamy]

Tagging @amartinezfayo @rturner3 for review as they have the most context.