Entry labels

[kfox1111]

I would like to be able to add labels (arbitrary key/value pairs) onto entries. They would be stored in the db along with the entry, and otherwise would be normally ignored by spire.

Kubernetes popularized this kind of thing and has proven quite useful over time.

One particular use case of interest would be to be able to use them in conjunction with custom CredentialComposer plugins. For example, when using JWTs with Minio, the JWT needs a custom "policy" property. (spiffe/club-zero#7). An entry could have a label like 'minio.io/policy=readwrite' added to the entry, and the MinioCredentialComposer could use the saved labels to affect the generated JWTs.

[kfox1111]

This would be much cleaner then having to add the needed information into the spiffeid, then scrape it back out to add the property. For example:
https://github.com/spiffe/spire-credentialcomposer-cel?tab=readme-ov-file#minio

Also, there currently isn't a way not to have that info still in the resulting spiffeid as a credential composer cant rewrite the subject.

[sorindumitru]

Thanks @kfox1111 for opening this issue. This has been considered in the past, for example #1336. At that point we've decided not to added them, because:

• We didn't have a lot of good examples of how they could be used.
• They might not be the right abstraction to solve the issue.

I think the minio example is possibly a good example for making use of the metadata, but I'm not sure it's the right abstraction to use:

• It assumes whoever configured the Minio policies has access to configure entries (and have a way to deal with conflicting changes). In some ways it mixes authentication with authorization.
• It forces thinking the Minio policy configuration in terms of workload selectors and even more of that in terms of the ParentID relationships in the registration entries.

I think an ideal way of configuring these would be driven by the SPIFFE ID, i.e. this SPIFFE ID has this kind of access to these buckets. Some ways of dealing with this would be:

• Credential exchange. The workload can swap a SVID for a MinIO specific token, which contains the policies the workload has acess to.
• A CredentialComposer plugin that fetches the list of MinIO policies based on the SPIFFE ID from some other service that is used to definte these policies.