Adds a workload status command

[meyskens]

cofidectl workload status foo --pod-name foo-pod --namespace bar --trust-zone foo

Initially, this command will take a workload name, with pod name, namespace and trust-zone as flags, and use Maartje's "attest-me" implementation via a debug container to return human-readable cert information with the CLI.

As a follow-up, I'd like to make it simpler to reference the workload (ideally a single argument) and for pod and cluster info be inferred, but that'll depend on how we handle 'workloads' and will need some additional thought.

[mattbates]

I've merged in main and also (force) pushed some updates.

FYI this PR depends on cofide/cofidectl-debug-container also being opened up. There are small improvements to be made to it (eg some simple docs and a build script), but in the meantime "Cofiders" can build it directly for testing.

[markgoddard]

Looking good

[mattbates]

@nialdaly thanks for the approval, you've verified everything works for you?

[nialdaly]

It worked well for me:

./cofidectl workload status --namespace test --pod-name client-6c7f5bf7dc-mzkh4 --trust-zone test
✅ Complete: Successfully executed ephemeral debug container in client-6c7f5bf7dc-mzkh4

Trust bundles received
* spiffe://cofide-a.test
    Certificate "CD:11:C2:66:50:4C:A9:D6:9E:99:9B:DA:CB:CE:6A:0F:C1:44:54:53:D4:D8:70:A4:F0:37:D4:FB:40:24:7E:92"
    is a CA certificate
    valid from "2024-11-25T09:49:43Z" to "2024-11-25T21:49:53Z"
    Subject: SERIALNUMBER=326417798281054835965078118436728917784,CN=example.org,O=Example,C=ARPA
    DNS names: spiffe://cofide-a.test
    Signature algorithm: SHA256-RSA
    Issuer: SERIALNUMBER=326417798281054835965078118436728917784,CN=example.org,O=Example,C=ARPA

SVIDs received
* spiffe://cofide-a.test/ns/test/sa/default
    Certificate "80:1F:DA:62:A7:A7:A1:53:A5:D4:DC:08:36:AB:FF:DF:63:55:25:2F:11:4D:EA:99:84:FE:FF:9B:49:C2:6B:43"
    valid from "2024-11-25T10:26:33Z" to "2024-11-25T14:26:43Z"
    Subject: O=SPIRE,C=US
    DNS names: spiffe://cofide-a.test/ns/test/sa/default
    Signature algorithm: SHA256-RSA
    Issuer: SERIALNUMBER=326417798281054835965078118436728917784,CN=example.org,O=Example,C=ARPA
    SVID verified against trust bundle

[jsnctl]

Hold off until debug container image hosting story is finalised

[meyskens]

Now using the GHCR image. CI is passing again ready for a last re-read before merging

[markgoddard]

I think this change has gone back to an earlier version prior to addressing review feedback. The commit that was approved was e27f3f8.

[markgoddard]

I think a bit of git magic will help here:

git checkout e27f3f8
git merge-base origin/main HEAD
git reset --soft $(git merge-base origin/main HEAD)
git status
git diff --cached 
git commit -m "New commit message here"
git rebase origin/main

[meyskens]

@markgoddard git surgery should be done! hope it worked out well...

[markgoddard]

I reworked it to be closer to the last approved patch and to use the statusspinner.