{"action":"created","issue":{"url":"https://api.github.com/repos/spiffe/spire/issues/646","repository_url":"https://api.github.com/repos/spiffe/spire","labels_url":"https://api.github.com/repos/spiffe/spire/issues/646/labels{/name}","comments_url":"https://api.github.com/repos/spiffe/spire/issues/646/comments","events_url":"https://api.github.com/repos/spiffe/spire/issues/646/events","html_url":"https://github.com/spiffe/spire/issues/646","id":386967502,"node_id":"MDU6SXNzdWUzODY5Njc1MDI=","number":646,"title":"Support and verification for message based communication(like MQTT) among workloads (including hierarchical spire) ","user":{"login":"skdwriting","id":8660550,"node_id":"MDQ6VXNlcjg2NjA1NTA=","avatar_url":"https://avatars3.githubusercontent.com/u/8660550?v=4","gravatar_id":"","url":"https://api.github.com/users/skdwriting","html_url":"https://github.com/skdwriting","followers_url":"https://api.github.com/users/skdwriting/followers","following_url":"https://api.github.com/users/skdwriting/following{/other_user}","gists_url":"https://api.github.com/users/skdwriting/gists{/gist_id}","starred_url":"https://api.github.com/users/skdwriting/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/skdwriting/subscriptions","organizations_url":"https://api.github.com/users/skdwriting/orgs","repos_url":"https://api.github.com/users/skdwriting/repos","events_url":"https://api.github.com/users/skdwriting/events{/privacy}","received_events_url":"https://api.github.com/users/skdwriting/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-12-03T19:24:18Z","updated_at":"2018-12-06T23:50:58Z","closed_at":null,"author_association":"NONE","body":"Background:\r\nIn most of the Edge Cloud Platforms, the workload to workload communication is message based like MQTT. Indirectly, there is no \"direct\" communication between the workloads. Hence, we need a suitable method in spiffe to handle this. \r\nConsideration: \r\njwt token based communication support (basic) is available in spiffe (refer [#495](https://github.com/spiffe/spire/issues/495), [#531](https://github.com/spiffe/spire/issues/531), [#544](https://github.com/spiffe/spire/issues/544),  [#545](https://github.com/spiffe/spire/issues/545),[ #616](https://github.com/spiffe/spire/issues/616))\r\n\r\nHence one of the solutions to message-based workload - workload communication could be using jwt.\r\n\r\nScope:\r\n1. Basic verification of JWT : Workloads using JWT tokens for communication. (fetch, verify apis and basic flow)\r\n2. JWT in message based wl-wl communication: workloads communicating through MQTT using jwt for identity\r\n3. Basic edge scenario verification using a simple case (single Spire server)\r\n4. jwt in hierarchial spire server mode.\r\n[[Refer some discussions on the same in the document prepared by Evan here]](https://docs.google.com/document/d/1Mbsbo2xuWajU1h_XxNx2ChmNv4RIfZlb7VIaS2qM5K4)\r\n\r\nTentative Idea:\r\nworkload1 fetches the jwt token from local spire agent --> add this to the message --> workload2 validates the jwt token with local spire agent\r\nspire agent gets the signed token from the spire server.\r\n\r\nOther option:\r\nExplore Message Broker security (mTLS..). Then, jwt may not be needed\r\n\r\nOptimization/Constraints Notes:\r\n1. In a normal case, all the message needs to be with jwt tokens and validate to be done. This can affect the performance in edge? If yes, what are the other options?\r\n2. Currently the validate is a workload api and goes to spire agent in case of jwt. Can this be local to workload?\r\n3. Hierarchical spire server scenario in Edge to be handled. jwt chaining ?! \r\n\r\nWe will update the design, flow and other details as a separate document."},"comment":{"url":"https://api.github.com/repos/spiffe/spire/issues/comments/445072600","html_url":"https://github.com/spiffe/spire/issues/646#issuecomment-445072600","issue_url":"https://api.github.com/repos/spiffe/spire/issues/646","id":445072600,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NTA3MjYwMA==","user":{"login":"evan2645","id":1944142,"node_id":"MDQ6VXNlcjE5NDQxNDI=","avatar_url":"https://avatars1.githubusercontent.com/u/1944142?v=4","gravatar_id":"","url":"https://api.github.com/users/evan2645","html_url":"https://github.com/evan2645","followers_url":"https://api.github.com/users/evan2645/followers","following_url":"https://api.github.com/users/evan2645/following{/other_user}","gists_url":"https://api.github.com/users/evan2645/gists{/gist_id}","starred_url":"https://api.github.com/users/evan2645/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/evan2645/subscriptions","organizations_url":"https://api.github.com/users/evan2645/orgs","repos_url":"https://api.github.com/users/evan2645/repos","events_url":"https://api.github.com/users/evan2645/events{/privacy}","received_events_url":"https://api.github.com/users/evan2645/received_events","type":"User","site_admin":false},"created_at":"2018-12-06T23:50:58Z","updated_at":"2018-12-06T23:50:58Z","author_association":"MEMBER","body":"Ok, thanks for the update @skdwriting. I think we will need to tackle the JWT problem eventually... I am not sure what the best approach is at the moment. We either need to distribute the JWKs across the whole tree, or we need a new token type which is chain-able"}}
{"actor":{"display_login":"evan2645"}}