Identity Plugin by atpugtihsrah · Pull Request #288 · containerd/nri

atpugtihsrah · 2026-04-24T07:11:39Z

Identity Plugin WIP

RFC PR: #245

Relates to #240

PR Assisted by IBM Bob.

MikeZappa87 · 2026-05-07T19:02:51Z

@atpugtihsrah this is interesting. I did some work in the istio/isovalent ecosystem for SPIRE. Lmk if you need any help

mikebrow · 2026-07-14T14:26:31Z

Ginkgo detected a version mismatch between the Ginkgo CLI and the version of Ginkgo imported by your packages:
  Ginkgo CLI Version:
    2.28.1
  Mismatched package versions found:
    2.19.1 used by identity-injector

  Ginkgo will continue to attempt to run but you may see errors (including flag
  parsing errors) and should either update your go.mod or your version of the
  Ginkgo CLI to match.

  To install the matching version of the CLI run
    go install github.com/onsi/ginkgo/v2/ginkgo
  from a path that contains a go.mod file.  Alternatively you can use
    go run github.com/onsi/ginkgo/v2/ginkgo
  from a path that contains a go.mod file to invoke the matching version of the
  Ginkgo CLI.

  If you are attempting to test multiple packages that each have a different
  version of the Ginkgo library with a single Ginkgo CLI that is currently
  unsupported.

mikebrow · 2026-07-20T19:58:41Z

good meeting this morning @atpugtihsrah! Note to other reviewers contributor is going to clean up the vendor issues and boost the plugin getting started guide.

mikebrow · 2026-08-20T22:26:28Z

heads up needs rebase :-) we've been busy getting ready for a release

Signed-off-by: Harshit Gupta <hg2t4e@gmail.com>

mikebrow · 2026-09-01T21:00:04Z

Ran the test instructions to success using kind...

We can add this later:
mikebrow@76915f1

mikebrow

LGTM very nice...

would like to get this in and iterate

MikeZappa87 · 2026-09-01T21:30:42Z

+type plugin struct {
+	stub         stub.Stub
+	delegatedIdentityConn  *grpc.ClientConn
+	delegatedIdentityClient delegatedidentityv1.DelegatedIdentityClient


Broker Endpoint API was just merged into SPIFFE and SPIRE

maybe a TODO for covering the new broker endpoint api..

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Adds a WIP “Identity Plugin” (identity-injector) to fetch X.509 SVIDs via SPIRE’s Delegated Identity API and inject them into workload containers, along with kustomize manifests and a local-cluster setup guide.

Changes:

Introduces the identity-injector plugin implementation (gRPC streaming watchers, file writes, annotation parsing) and a unit test for annotation parsing.
Adds kustomize base/overlay resources to deploy the plugin as a DaemonSet.
Adds a detailed setup guide for SPIRE/SPIFFE + local build/test flow, and wires the plugin tests into the main Makefile.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
plugins/identity-injector/identity-injector.go	Implements the identity-injector plugin, certificate/bundle streaming watchers, and annotation parsing.
plugins/identity-injector/identity-injector_test.go	Adds unit tests for parsing identity annotations.
plugins/identity-injector/go.mod	Defines the plugin module and dependencies (SPIFFE/SPIRE SDK, gRPC, yaml, etc.).
plugins/identity-injector/go.sum	Locks dependency checksums for the plugin module.
contrib/kustomize/identity-injector/kustomization.yaml	Adds a kustomize entry point for the identity-injector deployment.
contrib/kustomize/identity-injector/base/kustomization.yaml	Defines base resources, image override, and common labels for deployment.
contrib/kustomize/identity-injector/base/daemonset.yaml	Adds the DaemonSet manifest to run the plugin and mount required host paths/sockets.
plugins/identity-injector/setup.md	Documents end-to-end local setup for SPIRE + plugin + test workload.
Makefile	Adds a test target for the new identity-injector plugin.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: nri-plugin-identity
+spec:
+  template:
+    spec:
+      containers:
+        - name: nri-plugin-identity
+          image: plugin:latest


+          volumeMounts:
+            - name: nri-socket
+              mountPath: /var/run/nri/nri.sock
+            - name: spire-admin-socket
+              mountPath: /run/spire/admin-socket/admin.sock
+            - name: spiffe-certs
+              mountPath: /var/run/spiffe/secrets/
+      volumes:


+        - name: spire-admin-socket
+          hostPath:
+            path: /run/spire/admin-socket/admin.sock
+            type: Socket


+func (p *plugin) startCertificateWatcher(ctx context.Context, pod *api.PodSandbox, ctr *api.Container, pid int32, hostDir string, config *identityConfig) error {
+	watcherKey := filepath.Join(pod.GetUid(), ctr.Name)
+
+	// Check if watcher already exists
+	p.watchersMu.RLock()
+	if _, exists := p.watchers[watcherKey]; exists {
+		p.watchersMu.RUnlock()
+		log.Debugf("%s: certificate watcher already running", containerName(pod, ctr))
+		return nil
+	}
+	p.watchersMu.RUnlock()


+	p.watchersMu.RUnlock()
+
+	// Create cancellable context for this watcher
+	watcherCtx, cancel := context.WithCancel(context.Background())


+
+}
+
+// TODO create test cases for processDelegatedIdentityUpdate()


+sudo mkdir /tmp/spire-data
+
+sudo chmod 777 /tmp/spire-data


+sudo mkdir /var/run/spiffe/
+sudo mkdir /var/run/spiffe/secrets/
+sudo chmod 777 /var/run/spiffe/secrets/


+				log.Errorf("%s: watcher context cancelled: %v", containerName(pod, ctr), err)
+				return
+			}
+
+			resp, err := stream.Recv()
+			if err != nil {
+				log.Errorf("%s: bundle stream error: %v", containerName(pod, ctr), err)


@@ -0,0 +1,550 @@
+This document describes how to get a test setup up and running to test the NRI Identity Plugin


atpugtihsrah mentioned this pull request Apr 24, 2026

Identity Plugin RFC #245

Draft

atpugtihsrah force-pushed the identity-plugin-5qjelc65nb branch from 11f5595 to ff81182 Compare May 21, 2026 14:48

atpugtihsrah force-pushed the identity-plugin-5qjelc65nb branch 2 times, most recently from 0748a95 to e355b5e Compare July 12, 2026 06:44

mikebrow reviewed Jul 14, 2026

View reviewed changes

Comment thread plugins/identity-injector/identity-injector_test.go Outdated

mikebrow reviewed Jul 14, 2026

View reviewed changes

Comment thread plugins/identity-injector/go.mod

atpugtihsrah force-pushed the identity-plugin-5qjelc65nb branch 10 times, most recently from 7b49520 to ec86027 Compare July 16, 2026 09:26

atpugtihsrah marked this pull request as ready for review July 16, 2026 09:29

mikebrow reviewed Jul 30, 2026

View reviewed changes

Comment thread plugins/identity-injector/setup.md Outdated

mikebrow reviewed Jul 30, 2026

View reviewed changes

Comment thread plugins/identity-injector/setup.md Outdated

atpugtihsrah force-pushed the identity-plugin-5qjelc65nb branch 2 times, most recently from cadcd8d to c3a1707 Compare July 31, 2026 08:31

atpugtihsrah force-pushed the identity-plugin-5qjelc65nb branch from c3a1707 to b86c62e Compare August 25, 2026 14:50

identity plugin code

3358c45

Signed-off-by: Harshit Gupta <hg2t4e@gmail.com>

atpugtihsrah force-pushed the identity-plugin-5qjelc65nb branch from b46ddf1 to 3358c45 Compare August 25, 2026 15:13

mikebrow approved these changes Sep 1, 2026

View reviewed changes

mikebrow requested a balanced review from Copilot September 1, 2026 21:22

MikeZappa87 reviewed Sep 1, 2026

View reviewed changes

Copilot AI reviewed Sep 1, 2026

View reviewed changes

Copilot started reviewing on behalf of mikebrow September 1, 2026 21:53 View session

Navigation Menu

Uh oh!

Identity Plugin - #288

Identity Plugin#288
atpugtihsrah wants to merge 1 commit into
containerd:mainfrom
atpugtihsrah:identity-plugin-5qjelc65nb

atpugtihsrah commented Apr 24, 2026 •

edited

Loading

Uh oh!

MikeZappa87 commented May 7, 2026

Uh oh!

Uh oh!

mikebrow commented Jul 14, 2026

Uh oh!

Uh oh!

mikebrow commented Jul 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

mikebrow commented Aug 20, 2026

Uh oh!

mikebrow commented Sep 1, 2026

Uh oh!

mikebrow left a comment

Uh oh!

MikeZappa87 Sep 1, 2026

Uh oh!

mikebrow Sep 1, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants


		}

		// TODO create test cases for processDelegatedIdentityUpdate()

		@@ -0,0 +1,550 @@
		This document describes how to get a test setup up and running to test the NRI Identity Plugin

Uh oh!

Conversation

atpugtihsrah commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MikeZappa87 commented May 7, 2026

Uh oh!

Uh oh!

mikebrow commented Jul 14, 2026

Uh oh!

Uh oh!

mikebrow commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mikebrow commented Aug 20, 2026

Uh oh!

mikebrow commented Sep 1, 2026

Uh oh!

mikebrow left a comment

Choose a reason for hiding this comment

Uh oh!

MikeZappa87 Sep 1, 2026

Choose a reason for hiding this comment

Uh oh!

mikebrow Sep 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

atpugtihsrah commented Apr 24, 2026 •

edited

Loading

mikebrow commented Jul 20, 2026 •

edited

Loading