Allow cluster names in Cofide identities (#97)

* chore: Allow cluster names in Cofide identities

Closes #96

Removes the regex validation of the SPIFFE IDs for access to the Connect
API. Envoy will still validate the presented cert, but then which
identities can do what is handled within Connect application code.

On the xds service the validation remains to only allow the Cofide agent
to connect to it, but the regex is updated to allow SPIFFE IDs both with
and without cluster names in them. Once Connect is updated to always
include the cluster name in this identity the old one can be removed.

Author: alec-w

charts/cofide-connect/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.11.6
+version: 0.11.7
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/cofide-connect/templates/configmap-envoy.yaml

@@ -48,10 +48,16 @@ data:
                     combined_validation_context:
                       default_validation_context:
                         match_typed_subject_alt_names:
+                          # cofide-agent identity without cluster name - legacy, to be removed
                           - san_type: URI
                             matcher:
                               safe_regex:
-                                regex: spiffe://[^/]*/ns/cofide/sa/cofide-agent
+                                regex: spiffe://[^/]+/ns/cofide/sa/cofide-agent
+                          # cofide-agent identity with cluster name
+                          - san_type: URI
+                            matcher:
+                              safe_regex:
+                                regex: spiffe://[^/]+/cluster/[^/]+/ns/cofide/sa/cofide-agent
                       validation_context_sds_secret_config:
                         name: ALL
                         sds_config:
@@ -224,35 +230,16 @@ data:
                             grpc_services:
                               - envoy_grpc:
                                   cluster_name: spire_agent
-                    combined_validation_context:
-                      default_validation_context:
-                        match_typed_subject_alt_names:
-                          - san_type: URI
-                            matcher:
-                              safe_regex:
-                                regex: spiffe://[^/]*/ns/cofide/sa/cofide-agent
-                          - san_type: URI
-                            matcher:
-                              safe_regex:
-                                regex: spiffe://[^/]*/spire/server
-                          - san_type: URI
-                            matcher:
-                              safe_regex:
-                                regex: spiffe://[^/]*/ns/cofide/sa/cofide-observer
-                          - san_type: URI
-                            matcher:
-                              safe_regex:
-                                regex: spiffe://[^/]*/ns/cofide/sa/trust-zone-operator
-                      validation_context_sds_secret_config:
-                        name: ALL
-                        sds_config:
-                          resource_api_version: V3
-                          api_config_source:
-                            transport_api_version: V3
-                            api_type: GRPC
-                            grpc_services:
-                              - envoy_grpc:
-                                  cluster_name: spire_agent
+                    validation_context_sds_secret_config:
+                      name: ALL
+                      sds_config:
+                        resource_api_version: V3
+                        api_config_source:
+                          transport_api_version: V3
+                          api_type: GRPC
+                          grpc_services:
+                            - envoy_grpc:
+                                cluster_name: spire_agent
               filters:
                 - name: envoy.filters.network.http_connection_manager
                   typed_config: