Adds private key and bundle to the X509 SVID response

cmd/kubespiffe/main.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"encoding/pem"
 	"log"
 	"log/slog"
@@ -58,14 +59,20 @@ func main() {
 		}
 		slog.Info("✅ Pod attested", "registration", wr.Name, "spec", wr.Spec)
 
-		svid, err := issuer.IssueX509SVID(wr)
+		svid, svidKey, err := issuer.IssueX509SVID(wr)
 		if err != nil {
 			slog.Error("problem issuing SVID", "error", err)
 		}
 
+		resp := map[string]any{
+			"x509_svid":     pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: svid}),
+			"x509_svid_key": pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: svidKey}),
+			"bundle":        pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: issuer.GetCACert()}),
+		}
+
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusOK)
-		w.Write(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: svid}))
+		json.NewEncoder(w).Encode(resp)
 	})
 
 	log.Fatal(http.ListenAndServe(":8080", nil))

deployment/workload/Dockerfile

@@ -1,4 +1,4 @@
 FROM alpine:latest
-RUN apk add --no-cache curl openssl
+RUN apk add --no-cache curl openssl jq
 COPY entrypoint.sh /entrypoint.sh
 ENTRYPOINT ["/entrypoint.sh"]

deployment/workload/entrypoint.sh

@@ -15,10 +15,11 @@ while true; do
   echo "$TOKEN"
 
   RESULT=$(curl -s -k -H "Authorization: Bearer $TOKEN" kubespiffed.kubespiffe.svc.cluster.local:8080/v1/svid)
+  X509=$(echo "$RESULT" | jq -r '.x509_svid' | base64 -d)
   echo "Obtained X509-SVID:"
-  echo "$RESULT"
+  echo "$X509"
 
-  echo "$RESULT" | openssl x509 -noout -ext subjectAltName
+  echo "$X509" | openssl x509 -noout -ext subjectAltName
   echo ""
   sleep 20
 done

pkg/svid/issuer.go

@@ -69,7 +69,7 @@ func createCACert(key *ecdsa.PrivateKey) (*x509.Certificate, error) {
 	return x509.ParseCertificate(certBytes)
 }
 
-func (i *SVIDIssuer) IssueX509SVID(wr *v1alpha1.WorkloadRegistration) ([]byte, error) {
+func (i *SVIDIssuer) IssueX509SVID(wr *v1alpha1.WorkloadRegistration) ([]byte, []byte, error) {
 	key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	svid := &x509.Certificate{
 		SerialNumber:          randomSerial(),
@@ -83,11 +83,20 @@ func (i *SVIDIssuer) IssueX509SVID(wr *v1alpha1.WorkloadRegistration) ([]byte, e
 	}
 	svidBytes, err := x509.CreateCertificate(rand.Reader, svid, i.caCert, &key.PublicKey, i.signer)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
+	}
+
+	svidKeyBytes, err := x509.MarshalPKCS8PrivateKey(key)
+	if err != nil {
+		return nil, nil, err
 	}
 
 	i.svids[wr.Spec.SPIFFEID] = svidBytes
-	return svidBytes, nil
+	return svidBytes, svidKeyBytes, nil
+}
+
+func (i *SVIDIssuer) GetCACert() []byte {
+	return i.caCert.Raw
 }
 
 func randomSerial() *big.Int {

pkg/svid/issuer_test.go

@@ -30,7 +30,7 @@ func TestIssueX509SVID(t *testing.T) {
 			SVIDType: "svid",
 		},
 	}
-	bytes, err := issuer.IssueX509SVID(wr)
+	bytes, _, err := issuer.IssueX509SVID(wr)
 
 	require.NoError(t, err)
 	assert.NotNil(t, bytes)