RFC-WORKLOAD-IDENTITY-0001                                     Section 12
Category: Standards Track                                     Federation

{
  "trust_domain": "prod.example.com",
  "keys": [
    {
      "kty": "RSA",
      "use": "x509-svid",
      "n": "...",
      "e": "AQAB"
    }
  ],
  "sequence_number": 1
}

# SPIRE Server configuration for federation
server:
  trust_domain: "prod.example.com"
  ca_subject:
    country: ["US"]
    organization: ["Example Corp"]
 
  federation:
    bundle_endpoint:
      address: "0.0.0.0"
      port: 8443
      acme:
        domain_name: "spiffe-federation.prod.example.com"
        email: "security@example.com"
 
    federates_with:
      "staging.example.com":
        bundle_endpoint_url: "https://spiffe-federation.staging.example.com:8443"
        bundle_endpoint_profile:
          https_spiffe:
            endpoint_spiffe_id: "spiffe://staging.example.com/spire/server"

# AWS: Trust GCP OIDC
resource "aws_iam_role" "gcp_workload" {
  name = "gcp-workload-access"
 
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = {
        Federated = "arn:aws:iam::${var.account_id}:oidc-provider/container.googleapis.com/v1/projects/${var.gcp_project}/locations/${var.gcp_location}/clusters/${var.gcp_cluster}"
      }
      Action = "sts:AssumeRoleWithWebIdentity"
      Condition = {
        StringEquals = {
          "container.googleapis.com:sub" = "system:serviceaccount:${var.namespace}:${var.service_account}"
        }
      }
    }]
  })
}

# GCP: Workload Identity Pool for AWS
resource "google_iam_workload_identity_pool" "aws" {
  workload_identity_pool_id = "aws-pool"
  display_name              = "AWS Workload Pool"
}
 
resource "google_iam_workload_identity_pool_provider" "aws_eks" {
  workload_identity_pool_id          = google_iam_workload_identity_pool.aws.workload_identity_pool_id
  workload_identity_pool_provider_id = "aws-eks"
  display_name                       = "AWS EKS"
 
  aws {
    account_id = var.aws_account_id
  }
 
  attribute_mapping = {
    "google.subject"        = "assertion.arn"
    "attribute.aws_account" = "assertion.account"
  }
}
 
# Bind to GCP service account
resource "google_service_account_iam_binding" "aws_workload" {
  service_account_id = google_service_account.target.name
  role               = "roles/iam.workloadIdentityUser"
 
  members = [
    "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.aws.name}/attribute.aws_account/${var.aws_account_id}"
  ]
}

# Enable auth for remote cluster
vault auth enable -path=kubernetes-cluster-b kubernetes
 
# Configure with cluster B's OIDC issuer
vault write auth/kubernetes-cluster-b/config \
    kubernetes_host="https://cluster-b.example.com:6443" \
    kubernetes_ca_cert=@cluster-b-ca.crt \
    issuer="https://oidc.cluster-b.example.com"
 
# Create role for cross-cluster access
vault write auth/kubernetes-cluster-b/role/cross-cluster-app \
    bound_service_account_names=app \
    bound_service_account_namespaces=default \
    policies=cross-cluster-read \
    ttl=1h

# Partner federation configuration
federation:
  federates_with:
    "partner.otherorg.com":
      bundle_endpoint_url: "https://spiffe.partner.otherorg.com:8443"
      bundle_endpoint_profile:
        https_web: {}
      # Only trust specific workloads
      trust_bundle_url: "https://spiffe.partner.otherorg.com/.well-known/spiffe-bundle.json"

# Only allow specific partner workloads
apiVersion: policy.linkerd.io/v1beta1
kind: ServerAuthorization
metadata:
  name: allow-partner-api
  namespace: b2b-gateway
spec:
  server:
    name: partner-gateway
  client:
    meshTLS:
      identities:
        # Only trust partner's integration service
        - "spiffe://partner.otherorg.com/ns/integration/sa/api-client"

# Federated workloads still need explicit authorization
apiVersion: policy.linkerd.io/v1beta1
kind: ServerAuthorization
metadata:
  name: federated-access
spec:
  server:
    name: api
  client:
    meshTLS:
      identities:
        # Explicit allow, not wildcard
        - "spiffe://partner.example.com/ns/allowed/sa/client"
      # Deny by default - only listed identities allowed

# Remove federation relationship
spire-server federation delete -trustDomain partner.example.com
 
# Update mesh policies
kubectl delete serverauthorization -l federation=partner.example.com
 
# Verify revocation
spire-server bundle list