Skip to content

[v17] Support configuring DNS SANs for X509 SVIDs using WorkloadIdentity resource (#50676) #50761

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jan 6, 2025
Merged

[v17] Support configuring DNS SANs for X509 SVIDs using WorkloadIdentity resource (#50676) #50761

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
159 changes: 114 additions & 45 deletions api/gen/proto/go/teleport/workloadidentity/v1/resource.pb.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

11 changes: 11 additions & 0 deletions api/proto/teleport/workloadidentity/v1/resource.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,15 @@ message WorkloadIdentityRules {
repeated WorkloadIdentityRule allow = 1;
}

// Configuration specific to the issuance of X509-SVIDs.
message WorkloadIdentitySPIFFEX509 {
// The DNS Subject Alternative Names (SANs) that should be included in an
// X509-SVID issued using this WorkloadIdentity.
//
// Each entry in this list supports templating using attributes.
repeated string dns_sans = 1;
}

// Configuration pertaining to the issuance of SPIFFE-compatible workload
// identity credentials.
message WorkloadIdentitySPIFFE {
Expand All @@ -73,6 +82,8 @@ message WorkloadIdentitySPIFFE {
// credential produced by this WorkloadIdentity. This can be used to provide
// additional context that can be used to select between multiple credentials.
string hint = 2;
// Configuration specific to X509-SVIDs.
WorkloadIdentitySPIFFEX509 x509 = 3;
}

// The spec for the WorkloadIdentity resource.
Expand Down
7 changes: 7 additions & 0 deletions docs/pages/reference/terraform-provider/data-sources/workload_identity.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,4 +66,11 @@ Optional:

- `hint` (String) A freeform text field which is provided to workloads along with a credential produced by this WorkloadIdentity. This can be used to provide additional context that can be used to select between multiple credentials.
- `id` (String) The path of the SPIFFE ID that will be issued to the workload. This should be prefixed with a forward-slash ("/"). This field supports templating using attributes.
- `x509` (Attributes) Configuration specific to X509-SVIDs. (see [below for nested schema](#nested-schema-for-specspiffex509))

### Nested Schema for `spec.spiffe.x509`

Optional:

- `dns_sans` (List of String) The DNS Subject Alternative Names (SANs) that should be included in an X509-SVID issued using this WorkloadIdentity. Each entry in this list supports templating using attributes.

7 changes: 7 additions & 0 deletions docs/pages/reference/terraform-provider/resources/workload_identity.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,4 +91,11 @@ Optional:

- `hint` (String) A freeform text field which is provided to workloads along with a credential produced by this WorkloadIdentity. This can be used to provide additional context that can be used to select between multiple credentials.
- `id` (String) The path of the SPIFFE ID that will be issued to the workload. This should be prefixed with a forward-slash ("/"). This field supports templating using attributes.
- `x509` (Attributes) Configuration specific to X509-SVIDs. (see [below for nested schema](#nested-schema-for-specspiffex509))

### Nested Schema for `spec.spiffe.x509`

Optional:

- `dns_sans` (List of String) The DNS Subject Alternative Names (SANs) that should be included in an X509-SVID issued using this WorkloadIdentity. Each entry in this list supports templating using attributes.

Loading
Loading